Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Npcap 0.994 crashes with IRQL_NOT_LESS_OR_EQUAL #1591

Closed
dmiller-nmap opened this issue May 10, 2019 · 5 comments

Comments

@dmiller-nmap
Copy link

commented May 10, 2019

This issue has resulted in at least 23 crashes reported via the Microsoft crash telemetry, and is due to a failure to check for a NULL return from NPF_GetLoopbackOpen(). Fix is incoming. In the meantime, it would be advisable to revert to Npcap 0.993 until a release is made.

wireshark-gerrit pushed a commit to wireshark/wireshark that referenced this issue May 10, 2019
This reverts commit 2f82518.

Npcap 0.994 introduced a crash that will be fixed in next version:
nmap/nmap#1591

Change-Id: Iff9a29e6d28c57774844d25f2990e0f8c214bf75
Reviewed-on: https://code.wireshark.org/review/33143
Reviewed-by: Pascal Quantin <pascal@wireshark.org>
@jhlweb

This comment has been minimized.

Copy link

commented Jun 7, 2019

It this fixed in 0.995? I still get a win 10 crash when i try to uninstall this NPcap. only thought save mode i could uninstall it without a crash.
It there a way to manually uninstall this?
Also trying to disable or uninstall the device though device manager is resulting in a crash

@max2win

This comment has been minimized.

Copy link

commented Jun 10, 2019

Same here! Any attempt with 0.995 to shutdown Windows, or disable or uninstall the loopback adapter results in a crash. Trying to restart in safe mode doesn't work either, because of that. Difficult to install a patch at this point...

@dmiller-nmap

This comment has been minimized.

Copy link
Author

commented Jun 11, 2019

@max2win and @jhlweb: This issue is not related to the "crashes at uninstall or adapter removal" bug. Npcap 0.994 and 0.995 have a pair of related bugs (#1626, #1598) that in some cases cause a crash when stopping the driver service. We have a fix for this issue in testing and hope to release it soon. The new installer will prompt you to take some extra steps to allow Npcap 0.995 or 0.994 to be safely removed before installing Npcap, which will require a reboot. We apologize for the inconvenience.

In the meantime, here is a procedure for safely removing Npcap. After it is removed, the best option is to install Npcap 0.993, which is unaffected:

  1. Disable the npcap and npf driver services: In an Administrator command window, run sc.exe config npcap start=disabled and sc.exe config npf start=disabled
  2. Reboot the computer. Npcap will be disabled and unavailable.
  3. Uninstall Npcap via the "Add or remove programs" control panel. This ought to remove the loopback adapters, but the next step will ensure they are removed.
  4. Open Device Manager (devmgmt.msc) and expand Network Adapters. Right-click any "Npcap Loopback Adapter" and choose "Uninstall device." Repeat for each Npcap Loopback Adapter to remove it.

Please be patient as we prepare and test the next Npcap release to address these issues.

@max2win

This comment has been minimized.

Copy link

commented Jun 13, 2019

@dmiller-nmap: I confirm that your procedure successfully removed Npcap. Just a small note I wish to add: during step 2, don't panic if you see the BSOD again and go straight to step 3. Even if Windows crashed once more in my case, it had the time to save the Registry with the updated start property. You can check that before step 3, running sc.exe query npcap in the Administrator command window.

Many thanks Daniel for your quick response and solution.

@dmiller-nmap

This comment has been minimized.

Copy link
Author

commented Jun 15, 2019

This issue is resolved in Npcap 0.996, released today. https://npcap.org/#download

Because Npcap 0.995 consistently crashes some systems, the Npcap 0.996 installer will offer to disable the npcap driver service on the next boot so that the installation can be reattempted. You can also manually disable it by running (as administrator) sc.exe config npcap start= disabled. There may be one more crash when trying to restart, unfortunately, but it will be the last one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
3 participants
You can’t perform that action at this time.