libelevate
libelevate copied to clipboard
BSOD nt!KeBuckCheckEx FAILURE_BUCKET_ID: AV_nt!KiDispatchException
I've compiled the testlibelevate and passed it a handle to a driver. When trying to restrip handle rights I get BSOD. Any ideas what went wrong ? What AV mech. could have caused this BSOD? Thanks a lot. I'm trying my best to learn but I'm still new to this
WinDbg gives me the following:
PROCESS_NAME: testlibelevate.exe
TRAP_FRAME: ffff800000000000 -- (.trap 0xffff800000000000) Unable to read trap frame at ffff8000`00000000
STACK_TEXT:
ffffea0b3b936c08 fffff800
5b459dcb : 000000000000001e ffffffff
c0000005 00007ff6dfe918fd 00000000
00000000 : nt!KeBugCheckEx
ffffea0b3b936c10 fffff800
5b4091ac : 0000000000001000 ffffea0b
3b9374b0 ffff800000000000 00000000
00000000 : nt!KiDispatchException+0x17449b
ffffea0b3b9372d0 fffff800
5b405343 : ffffa78887800100 fffff800
5b289392 ffffa78887800340 00000000
000000ff : nt!KiExceptionDispatch+0x12c
ffffea0b3b9374b0 00007ff6
dfe918fd : 0000000000000000 ffffd883
7f802000 000000000000020c ffffd883
7f802340 : nt!KiPageFault+0x443
ffffea0b3b937640 00000000
00000000 : ffffd8837f802000 00000000
0000020c ffffd8837f802340 00000000
00000060 : 0x00007ff6`dfe918fd
SYMBOL_NAME: nt!KiDispatchException+17449b
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 17449b
FAILURE_BUCKET_ID: AV_nt!KiDispatchException
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
Followup: MachineOwner