SysMon 13.24 crashing on app run with Visual Studio 2019

Question

Hello, we have confirmed that there is an interoperability issue with Visual Studio Code 2019 and SysMon 13.24 when trying to run an application.

This causes a Blue Screen and can corrupt a project in Visual Studio Code. The current work around is to remove SysMon. We don't know what other version this affects as these users don't have time to test.

I have seen some similar issues on older posts but was wondering if others are seeing this problem and how we can address it. This is happening on more than 1 system so it is more of a wide spread issue.

Here is a recent post as well that address this problem: https://learn.microsoft.com/en-us/answers/questions/511948/bsod-driver-overran-stack-buffer-when-attaching-to.html

This is a much older post with the same Failure ID hash so maybe not as relevant: https://social.technet.microsoft.com/Forums/en-US/64857333-cf8e-47ab-b638-4370ae4e4fce/sysmon-1111-bsod-on-laptops?forum=miscutils

Debugging Details:

------------------

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec  
Value: 4593  

Key  : Analysis.DebugAnalysisManager  
Value: Create  

Key  : Analysis.Elapsed.mSec  
Value: 14312  

Key  : Analysis.Init.CPU.mSec  
Value: 437  

Key  : Analysis.Init.Elapsed.mSec  
Value: 6108  

Key  : Analysis.Memory.CommitPeak.Mb  
Value: 77  

Key  : WER.OS.Branch  
Value: vb_release  

Key  : WER.OS.Timestamp  
Value: 2019-12-06T14:06:00Z  

Key  : WER.OS.Version  
Value: 10.0.19041.1  

BUGCHECK_CODE: f7

BUGCHECK_P1: ff96a4d06874eab0

BUGCHECK_P2: f8077ce3f0c0

BUGCHECK_P3: ffff07f8831c0f3f

BUGCHECK_P4: 0

SECURITY_COOKIE: Expected 0000f8077ce3f0c0 found ff96a4d06874eab0

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: devenv.exe

STACK_TEXT:
ffffa48a685cea38 fffff8077ce21056 : 00000000000000f7 ff96a4d06874eab0 0000f8077ce3f0c0 ffff07f8831c0f3f : nt!KeBugCheckEx
ffffa48a685cea40 00000000000000f7 : ff96a4d06874eab0 0000f8077ce3f0c0 ffff07f8831c0f3f 0000000000000000 : SysmonDrv+0x1056
ffffa48a685cea48 ff96a4d06874eab0 : 0000f8077ce3f0c0 ffff07f8831c0f3f 0000000000000000 0100000000100000 : 0xf7
ffffa48a685cea50 0000f8077ce3f0c0 : ffff07f8831c0f3f 0000000000000000 0100000000100000 ffff8009fb5bf620 : 0xff96a4d06874eab0 ffffa48a685cea58 ffff07f8831c0f3f : 0000000000000000 0100000000100000 ffff8009fb5bf620 fffff8077ce285e8 : 0x0000f8077ce3f0c0
ffffa48a685cea60 0000000000000000 : 0100000000100000 ffff8009fb5bf620 fffff8077ce285e8 0000000000000001 : 0xffff07f8`831c0f3f

SYMBOL_NAME: SysmonDrv+1056

MODULE_NAME: SysmonDrv

IMAGE_NAME: SysmonDrv.sys

STACK_COMMAND: .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET: 1056

FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_SysmonDrv!unknown_function

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {bfcd09b2-c8e3-6711-5ab4-bb081f1f34f2}

Followup: MachineOwner

Answer 1

I have confirmed that 13.30 has resolved this issue. Thanks all for your input and thanks to those who worked to get this fixed!

Answer 2

@Mark Russinovich - Any ideas? We are stuck.

Thanks boss.

Answer 3

I am tagging @Marc-MSFT as he may have been the one responding to SysMon related forums as well with great feed back.

It seems that asking a question in the old forums redirects us here to a generic learn.microsoft.com site which is super confusing.

Answer 4

This has become an issue for us as well.

Answer 5

Sysmon 13.30 has been released. Going to test and report back if this bug has been fixed. Please feel free to report back if you have tested and confirmed as well!

https://techcommunity.microsoft.com/t5/sysinternals-blog/autoruns-v14-06-and-sysmon-v13-30/ba-p/2887598