Jump to content

MagicAndre1981

Patron
  • Posts

    6,232
  • Joined

  • Last visited

  • Donations

    0.00 USD 
  • Country

    United Kingdom

Posts posted by MagicAndre1981

  1. The Intel HD driver is the issue. It crashes while loading the CPL file:

    APPLICATION_VERIFIER_HEAPS_CORRUPTED_HEAP_BLOCK_SUFFIX (f)Corrupted suffix pattern for heap block.Most typically this happens for buffer overrun errors. Sometimes the applicationverifier places non-accessible pages at the end of the allocation and bufferoverruns will cause an access violation and sometimes the heap block isfollowed by a magic pattern. If this pattern is changed when the block getsfreed you will get this break. These breaks can be quite difficult to debugbecause you do not have the actual moment when corruption happened.You just have access to the free moment (stop happened here) and theallocation stack trace (!heap -p -a HEAP_BLOCK_ADDRESS) Arguments:Arg1: 00000000376e1000, Heap handle used in the call. Arg2: 000000001d5b4170, Heap block involved in the operation. Arg3: 0000000000000004, Size of the heap block. Arg4: 000000001d5b4174, Corruption address. 0:044> !heap -p -a 000000001d5b4170    address 000000001d5b4170 found in    _HEAP @ 1d5b0000              HEAP_ENTRY Size Prev Flags            UserPtr UserSize - state        000000001d5b4120 0008 0000  [00]   000000001d5b4170    00004 - (busy)        7f95dee81ab verifier!AVrfDebugPageHeapAllocate+0x000000000000039f        7f9644ad248 ntdll!RtlDebugAllocateHeap+0x0000000000000038        7f964469fd1 ntdll!RtlpAllocateHeap+0x00000000000000e6        7f9643c6773 ntdll!RtlAllocateHeap+0x00000000000001ae        7f95df006eb verifier!AVrfpRtlAllocateHeap+0x00000000000000d7        1b81ae4b hccutils!DllUnregisterServer+0x000000000000306f        1b81a237 hccutils!DllUnregisterServer+0x000000000000245b        1b811334 hccutils!GetCUICustomizationKey+0x0000000000000168        1b8118f2 hccutils!GetCUICustomizationKey+0x0000000000000726        1b81322b hccutils!CreateThisKey+0x0000000000000383        1b8135c8 hccutils!FindResources+0x0000000000000108        1b813908 hccutils!LoadSTRING+0x00000000000002f8        1b813ec8 hccutils!SaveString+0x000000000000014c        1b8141ab hccutils!LoadICON+0x000000000000002b        1b81426c hccutils!LoadIMAGE+0x0000000000000048        180001738 igfxcpl!CPlApplet+0x00000000000000b8        7f96299d76e shell32!CPL_CallEntry+0x0000000000000052        7f96299d271 shell32!_InitializeControl+0x000000000000009d        7f962b3d2ec shell32!`Microsoft::WRL::Module<1,Microsoft::WRL::Details::DefaultModule<5> >::Create'::`2'::`dynamic atexit destructor for 'module''+0x0000000000053ac7        7f962528ea2 shell32!CPL_LoadCPLModule+0x00000000000001c2        7f962528caf shell32!_LoadCPLModuleAndAdd+0x000000000000001f        7f962528c61 shell32!CPLD_InitModule+0x000000000000003d        7f962528bf9 shell32!CControlPanelEnum::_NextNonCachedCpl+0x000000000000008e        7f9624f9615 shell32!CControlPanelEnum::Next+0x00000000000000b4        7f9625d05a3 shell32!CRegFolderEnum::Next+0x00000000000001fa        7f9624fab95 shell32!CControlPanelAppletList::_AddAppletsToCategories+0x0000000000000051        7f96252c013 shell32!CControlPanelAppletList::LoadSlowApplets+0x000000000000007b        7f96252bf27 shell32!CControlPanelDataWorkItem::_LoadSlowData+0x0000000000000037        7f962527ec1 shell32!CControlPanelDataWorkItem::DoWork+0x0000000000000055        7f9624ff994 shell32!CFrameTask::InternalResumeRT+0x000000000000001c        7f96245a784 shell32!CRunnableTask::Run+0x0000000000000098        7f96242193c shell32!CShellTask::TT_Run+0x000000000000003c 0:044> lmvm igfxcplBrowse full module liststart             end                 module name00000001`80000000 00000001`80024000   igfxcpl    (export symbols)       igfxcpl.cpl    Loaded symbol image file: igfxcpl.cpl    Image path: C:\Windows\System32\igfxcpl.cpl    Image name: igfxcpl.cpl    Browse all global symbols  functions  data    Timestamp:        Tue Apr 23 01:55:33 2013 (5175CDF5)    CheckSum:         00028534    ImageSize:        00024000    File version:     8.15.10.3131    Product version:  8.15.10.3131    File flags:       0 (Mask 3F)    File OS:          4 Unknown Win32    File type:        2.0 Dll    File date:        00000000.00000000    Translations:     0409.04b0    CompanyName:      Intel Corporation    ProductName:      Intel(R) Common User Interface    InternalName:     IGFXCPL    OriginalFilename: IGFXCPL.DLL    ProductVersion:   8.15.10.3131    FileVersion:      8.15.10.3131    PrivateBuild:     8.15.10.3131    SpecialBuild:     8.15.10.3131    FileDescription:  igfxcpl Module    LegalCopyright:   Copyright 1999-2006, Intel Corporation    LegalTrademarks:  Copyright 1999-2006, Intel Corporation    Comments:         Copyright 1999-2006, Intel Corporation0:044> lmvm hccutilsBrowse full module liststart             end                 module name00000000`1b810000 00000000`1b82f000   hccutils   (export symbols)       hccutils.dll    Loaded symbol image file: hccutils.dll    Image path: C:\Windows\System32\hccutils.dll    Image name: hccutils.dll    Browse all global symbols  functions  data    Timestamp:        Tue Apr 23 01:55:05 2013 (5175CDD9)    CheckSum:         00024400    ImageSize:        0001F000    File version:     8.15.10.3131    Product version:  8.15.10.3131    File flags:       0 (Mask 3F)    File OS:          4 Unknown Win32    File type:        2.0 Dll    File date:        00000000.00000000    Translations:     0409.04b0    CompanyName:      Intel Corporation    ProductName:      Intel(R) Common User Interface    InternalName:     HCCUTILS    OriginalFilename: HCCUTILS.DLL    ProductVersion:   8.15.10.3131    FileVersion:      8.15.10.3131    PrivateBuild:     8.15.10.3131    SpecialBuild:     8.15.10.3131    FileDescription:  hccutils Module    LegalCopyright:   Copyright 1999-2006, Intel Corporation    LegalTrademarks:  Copyright 1999-2006, Intel Corporation    Comments:         Copyright 1999-2006, Intel Corporation

    Find a newer driver and install this one. Your driver is still 2 years old. Which GPU do you ave?

  2. still the same. I need to capture registry information to see more details:

     

    xbootmgr -trace boot -traceFlags BASE+LATENCY+DISPATCHER+POWER+REGISTRY+REG_HIVE -stackwalk profile+CSwitch+ReadyThread+RegQueryKey+RegEnumerateKey+RegEnumerateValueKey+RegDeleteKey+RegCreateKey+RegOpenKey+RegSetValue+RegDeleteValue+RegQueryValue+RegCloseKey  -resultPath C:\TEMP

  3. I can see the 40s delay in the Wait data. rpcrt4.dll!Invoke calls sspisrv.dll!SspirLogonUser and later lsasrv.dll!NegLogonUserEx2 and wait for a response of lsass.exe.
     
    wait_1.png
     
    The lsass.exe checks some registry keys if you have the system configured to automatically logon with a username/password (authui.dll!CAutoLogon::IsAutoLogonMode, authui.dll!CAutoLogon::GetAutoLogonCredential, kernel32.dll!RegCreateKeyExW).
     
    wait_2.png
     

    wait_3.png

     
    Do you have this configured? If yes, disable it and enter your password on its own. Is it faster now?

  4. WaitForLSM is slow (caused by the slow RpcSs start).

     

    Try this hotfix:

     

    https://support.microsoft.com/en-us/kb/2661001

     

    If you still have the issue, run this command, here I capture wait data:

     

    xbootmgr -trace boot -traceFlags BASE+LATENCY+DISK_IO_INIT+DISPATCHER+FILE_IO+FILENAME+POWER -stackwalk profile+CSwitch+ReadyThread+DiskReadInit+DiskWriteInit  -resultPath C:\TEMP

     

    Also please compress the ETL file as 7z/RAR to reduce the size.

  5. Security can still be decent with UAC disabled.

     

    not really. Sorry.

     

    OT but not much also UAC, DEP and ASLR (and what not) introduced in Vista and later are good security models in theory :yes:, but in practice I did not notice the dramatic drop in infections worldwide I would have expected since their introduction

     

    they do. 90% of the security issues are fixed only be having UAC on.

     

    http://arstechnica.com/information-technology/2010/03/half-of-windows-flaws-mitigated-by-removing-admin-rights/

×
×
  • Create New...