ntkrnlmp.exe Valorant oynarken mavi ekran hatası alıyorum.

Question

9: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff928fe417f830, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffff928fe417f788, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------


KEY_VALUES_STRING: 1

    Key  : Analysis.CPU.mSec
    Value: 375

    Key  : Analysis.Elapsed.mSec
    Value: 7140

    Key  : Analysis.IO.Other.Mb
    Value: 5

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 6

    Key  : Analysis.Init.CPU.mSec
    Value: 140

    Key  : Analysis.Init.Elapsed.mSec
    Value: 23703

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 91

    Key  : Bugcheck.Code.LegacyAPI
    Value: 0x139

    Key  : Bugcheck.Code.TargetModel
    Value: 0x139

    Key  : FailFast.Name
    Value: CORRUPT_LIST_ENTRY

    Key  : FailFast.Type
    Value: 3

    Key  : Failure.Bucket
    Value: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

    Key  : Failure.Hash
    Value: {3aede96a-54dd-40d6-d4cb-2a161a843851}

    Key  : WER.OS.Branch
    Value: vb_release

    Key  : WER.OS.Version
    Value: 10.0.19041.1


BUGCHECK_CODE:  139

BUGCHECK_P1: 3

BUGCHECK_P2: ffff928fe417f830

BUGCHECK_P3: ffff928fe417f788

BUGCHECK_P4: 0

FILE_IN_CAB:  032424-19531-01.dmp

TRAP_FRAME:  ffff928fe417f830 -- (.trap 0xffff928fe417f830)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff8281a2fe27e8 rbx=0000000000000000 rcx=0000000000000003
rdx=ffff8281a0663680 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8003f23dca3 rsp=ffff928fe417f9c0 rbp=ffffbd8167480180
 r8=0000000000000000  r9=fffff8003f000000 r10=0000fffff8003f00
r11=ffffe78cfbb5d840 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
nt!KeSetEvent+0xb3:
fffff800`3f23dca3 cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffff928fe417f788 -- (.exr 0xffff928fe417f788)
ExceptionAddress: fffff8003f23dca3 (nt!KeSetEvent+0x00000000000000b3)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY 

BLACKBOXBSD: 1 (!blackboxbsd)


BLACKBOXNTFS: 1 (!blackboxntfs)


BLACKBOXPNP: 1 (!blackboxpnp)


BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT:  1

PROCESS_NAME:  VALORANT-Win64-Shipping.exe

ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y   n tabanl  bir arabelle in ta t   n  alg lad . Bu ta ma, k t  niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000003

EXCEPTION_STR:  0xc0000409

STACK_TEXT:  
ffff928f`e417f508 fffff800`3f411e29     : 00000000`00000139 00000000`00000003 ffff928f`e417f830 ffff928f`e417f788 : nt!KeBugCheckEx
ffff928f`e417f510 fffff800`3f4123d0     : 00000000`00000000 fffff800`3f51fb2e fffff800`3fd25440 00000000`00000fff : nt!KiBugCheckDispatch+0x69
ffff928f`e417f650 fffff800`3f4102dd     : 00000000`00040282 fffff800`3fa1a3a9 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffff928f`e417f830 fffff800`3f23dca3     : ffff8281`a2fe27e0 00000000`00000001 00000000`00000014 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x31d
ffff928f`e417f9c0 fffff800`3f6e841d     : 00000000`00000000 ffff928f`e417fb40 ffff8281`9acdd080 ffff8281`a0663680 : nt!KeSetEvent+0xb3
ffff928f`e417fa50 fffff800`3f411d77     : ffff8281`9acdd080 ffff8281`a0e7e160 00000000`00000000 ffff8281`00000000 : nt!NtSetEvent+0xbd
ffff928f`e417fac0 00007fff`7896d1a4     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExitPico+0x41d
00000004`3f97e0a8 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`7896d1a4


SYMBOL_NAME:  nt!KiFastFailDispatch+d0

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  d0

FAILURE_BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {3aede96a-54dd-40d6-d4cb-2a161a843851}

Followup:     MachineOwner
---------

9: kd> !blackboxbsd
Version: 0xb0
Product type: 1

Auto advanced boot: FALSE
Advanced boot menu timeout: 30
Last boot succeeded: TRUE
Last boot shutdown: FALSE
Sleep in progress: FALSE

Power button timestamp: 0x0
System running: TRUE
Connected standby in progress: FALSE
User shutdown in progress: FALSE
System shutdown in progress: FALSE
Sleep in progress: 0
Connected standby scenario instance id: 0
Connected standby entry reason: 0
Connected standby exit reason: 0
System sleep transitions to on: 0
Last reference time: 0x1da7d473e26170f
	2024-03-23T17:26:29.968Z
Last reference time checksum: 0x87a509cd
Last update boot id: 159

Boot attempt count: 1
Last boot checkpoint: TRUE
Checksum: 0xc4
Last boot id: 159
Last successful shutdown boot id: 158
Last reported abnormal shutdown boot id: 158

Error info boot id: 0
Error info repeat count: 0
Error info other error count: 0
Error info code: 0
Error info status: 0x0

Power button last press time: 0x0
Power button cumulative press count: 0
Power button last press boot id: 0
Power button last power watchdog stage: 0
Power button watchdog armed: FALSE
Power button shutdown in progress: FALSE
Power button last release time: 0x0
Power button cumulative release count: 0
Power button last release boot id: 0
Power button error count: 0
Power button current connected standby phase: 0
Power button transition latest checkpoint id: 0
Power button transition latest checkpoint type: 0
Power button transition latest checkpoint sequence number: 0

Power transition Shutdown Device Type: 0
Power transition Setup In Progress: FALSE
Power transition OOBE In Progress: FALSE
Power transition Sleep Checkpoint Source: 0
Power transition Sleep Checkpoint: 0
Power transition Connected Standby Entry Reason Category: 0
Power transition Connected Standby Exit Reason Category: 0
Power transition Connected Standby Entry Scenario Instance Id: 0x0

Feature Configuration State : Uninitialized

Answer 1

Hello

The analysis indicates a KERNEL_SECURITY_CHECK_FAILURE (Bugcheck 139) caused by a corrupted LIST_ENTRY, which could potentially be exploited by a malicious user to gain control of the system. Here's a breakdown of the key points:

 

Bugcheck Analysis: Indicates a kernel component has corrupted a critical data structure, specifically a LIST_ENTRY.

 

Exception Record: Points to the exception record caused by the BugCheck. The ExceptionAddress indicates the function nt!KeSetEvent+0xb3 where the exception occurred.

 

Process Name: The crash occurred in the process named VALORANT-Win64-Shipping.exe, suggesting it might be related to the game VALORANT.

 

Error Code: The error code 0xc0000409 translates to "Security check failure or stack buffer overrun". This further confirms the security-related issue.

 

Blackbox BSD: Provides information about the system's boot status, power button activity, and shutdown history.

 

Followup: Indicates the next steps for troubleshooting, which typically involves analyzing memory dumps or logs to identify the root cause of the issue.

 

To address this problem, you may need to take the following steps:

 

Update Drivers: Ensure that all drivers, especially those related to hardware and system components, are up to date.

 

Check for Malware: Perform a thorough scan for malware or viruses that could be causing system corruption.

 

Check System Integrity: Use built-in Windows tools like System File Checker (SFC) and Deployment Image Servicing and Management (DISM) to check and repair system file integrity.

 

Check Hardware: If the issue persists, it might be hardware-related. Perform diagnostics on RAM, hard drives, and other hardware components to rule out any physical issues.

 

Game-specific Troubleshooting: Since the crash occurred during the execution of VALORANT, consider checking for any known issues or updates related to the game. Sometimes, game-specific patches or updates can resolve such crashes.