Skip to content

Npcap OEM 0.9990: Silent upgrade fails when DLL files are in use #2015

Closed
@akontsevoy

Description

@akontsevoy

When trying to upgrade an existing Npcap installation that's currently being used in silent mode (npcap-0.9990-oem.exe /loopback_support=no /admin_only=yes /dot11_support=no /winpcap_mode=no /S), the installer fails and/or hangs indefinitely for several reasons:

  1. NPFInstall.exe is called with -kill_proc_polite instead of -kill_proc, even in silent mode. -kill_proc_polite is supposed to ask the user, which in unattended mode (e.g. when run in a system session) does nothing and never returns -- the process remains running.
    Contents of NPFInstall.log:
[000013A8] 2020-04-03 02:57:04 --> wmain
[000013A8] 2020-04-03 02:57:04     _tmain: executing, argv[0] = C:\Program Files\Npcap\NPFInstall.exe.
[000013A8] 2020-04-03 02:57:04     _tmain: executing, argv[1] = -n.
[000013A8] 2020-04-03 02:57:04     _tmain: executing, argv[2] = -check_dll.
[000013A8] 2020-04-03 02:57:04 --> getInUseProcesses
[000013A8] 2020-04-03 02:57:04 --> enumProcesses
[000013A8] 2020-04-03 02:57:04     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = System, dwProcessID = 4.
[000013A8] 2020-04-03 02:57:04     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = Registry, dwProcessID = 96.
[000013A8] 2020-04-03 02:57:04     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = smss.exe, dwProcessID = 420.
[000013A8] 2020-04-03 02:57:04     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = csrss.exe, dwProcessID = 512.
[000013A8] 2020-04-03 02:57:04     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = wininit.exe, dwProcessID = 608.
[000013A8] 2020-04-03 02:57:04     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = csrss.exe, dwProcessID = 624.
[000013A8] 2020-04-03 02:57:04     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = services.exe, dwProcessID = 680.
[000013A8] 2020-04-03 02:57:05     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = SgrmBroker.exe, dwProcessID = 2276.
[000013A8] 2020-04-03 02:57:05     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = svchost.exe, dwProcessID = 7984.
[000013A8] 2020-04-03 02:57:05     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = SecurityHealthService.exe, dwProcessID = 4808.
[000013A8] 2020-04-03 02:57:05 --> getFileProductName
[000013A8] 2020-04-03 02:57:05     VerQueryValue: error.
[000013A8] 2020-04-03 02:57:05 <-- getFileProductName
[000013A8] 2020-04-03 02:57:05 --> getFileProductName
[000013A8] 2020-04-03 02:57:05 <-- getFileProductName
[000013A8] 2020-04-03 02:57:05     enumDLLs: succeed, strProcessName = al-tmhost.exe.current, strModulePathName = c:\windows\system32\npcap\packet.dll.
[000013A8] 2020-04-03 02:57:05 <-- enumProcesses
[000013A8] 2020-04-03 02:57:05 <-- getInUseProcesses
[000013A8] 2020-04-03 02:57:05     _tmain: error, nStatus = -1.
[000013A8] 2020-04-03 02:57:05 <-- wmain
[00002614] 2020-04-03 02:57:05 --> wmain
[00002614] 2020-04-03 02:57:05     _tmain: executing, argv[0] = C:\Program Files\Npcap\NPFInstall.exe.
[00002614] 2020-04-03 02:57:05     _tmain: executing, argv[1] = -n.
[00002614] 2020-04-03 02:57:05     _tmain: executing, argv[2] = -kill_proc_polite.
[00002614] 2020-04-03 02:57:05 --> killInUseProcesses_Polite
[00002614] 2020-04-03 02:57:05 --> enumProcesses_PID
[00002614] 2020-04-03 02:57:05     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = System, dwProcessID = 4.
[00002614] 2020-04-03 02:57:05     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = Registry, dwProcessID = 96.
[00002614] 2020-04-03 02:57:05     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = smss.exe, dwProcessID = 420.
[00002614] 2020-04-03 02:57:05     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = csrss.exe, dwProcessID = 512.
[00002614] 2020-04-03 02:57:05     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = wininit.exe, dwProcessID = 608.
[00002614] 2020-04-03 02:57:05     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = csrss.exe, dwProcessID = 624.
[00002614] 2020-04-03 02:57:05     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = services.exe, dwProcessID = 680.
[00002614] 2020-04-03 02:57:06     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = SgrmBroker.exe, dwProcessID = 2276.
[00002614] 2020-04-03 02:57:06     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = svchost.exe, dwProcessID = 7984.
[00002614] 2020-04-03 02:57:06     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = SecurityHealthService.exe, dwProcessID = 4808.
[00002614] 2020-04-03 02:57:06 --> getFileProductName
[00002614] 2020-04-03 02:57:06     VerQueryValue: error.
[00002614] 2020-04-03 02:57:06 <-- getFileProductName
[00002614] 2020-04-03 02:57:06 --> getFileProductName
[00002614] 2020-04-03 02:57:06 <-- getFileProductName
[00002614] 2020-04-03 02:57:06     enumDLLs: succeed, strProcessName = al-tmhost.exe.current, strModulePathName = c:\windows\system32\npcap\packet.dll.
[00002614] 2020-04-03 02:57:06 <-- enumProcesses_PID
[00002614] 2020-04-03 02:57:06 --> killProcess_Soft
[00002440] 2020-04-03 02:57:06 --> wmain
[00002440] 2020-04-03 02:57:06     _tmain: executing, argv[0] = C:\Program Files\Npcap\NPFInstall.exe.
[00002440] 2020-04-03 02:57:06     _tmain: executing, argv[1] = -n.
[00002440] 2020-04-03 02:57:06     _tmain: executing, argv[2] = -check_dll.
[00002440] 2020-04-03 02:57:06 --> getInUseProcesses
[00002440] 2020-04-03 02:57:06 --> enumProcesses
[00002440] 2020-04-03 02:57:06     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = System, dwProcessID = 4.
[00002440] 2020-04-03 02:57:06     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = Registry, dwProcessID = 96.
[00002440] 2020-04-03 02:57:06     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = smss.exe, dwProcessID = 420.
[00002440] 2020-04-03 02:57:06     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = csrss.exe, dwProcessID = 512.
[00002440] 2020-04-03 02:57:06     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = wininit.exe, dwProcessID = 608.
[00002440] 2020-04-03 02:57:06     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = csrss.exe, dwProcessID = 624.
[00002440] 2020-04-03 02:57:06     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = services.exe, dwProcessID = 680.
[00002440] 2020-04-03 02:57:07     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = SgrmBroker.exe, dwProcessID = 2276.
[00002440] 2020-04-03 02:57:07     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = svchost.exe, dwProcessID = 7984.
[00002440] 2020-04-03 02:57:07     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = SecurityHealthService.exe, dwProcessID = 4808.
[00002440] 2020-04-03 02:57:07 --> getFileProductName
[00002440] 2020-04-03 02:57:07     VerQueryValue: error.
[00002440] 2020-04-03 02:57:07 <-- getFileProductName
[00002440] 2020-04-03 02:57:07 --> getFileProductName
[00002440] 2020-04-03 02:57:07 <-- getFileProductName
[00002440] 2020-04-03 02:57:07     enumDLLs: succeed, strProcessName = al-tmhost.exe.current, strModulePathName = c:\windows\system32\npcap\packet.dll.
[00002440] 2020-04-03 02:57:07 <-- enumProcesses
[00002440] 2020-04-03 02:57:07 <-- getInUseProcesses
[00002440] 2020-04-03 02:57:07     _tmain: error, nStatus = -1.
[00002440] 2020-04-03 02:57:07 <-- wmain
[00000F34] 2020-04-03 02:57:07 --> wmain
[00000F34] 2020-04-03 02:57:07     _tmain: executing, argv[0] = C:\Program Files\Npcap\NPFInstall.exe.
[00000F34] 2020-04-03 02:57:07     _tmain: executing, argv[1] = -n.
[00000F34] 2020-04-03 02:57:07     _tmain: executing, argv[2] = -kill_proc_polite.
[00000F34] 2020-04-03 02:57:07 --> killInUseProcesses_Polite
[00000F34] 2020-04-03 02:57:07 --> enumProcesses_PID
[00000F34] 2020-04-03 02:57:07     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = System, dwProcessID = 4.
[00000F34] 2020-04-03 02:57:07     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = Registry, dwProcessID = 96.
[00000F34] 2020-04-03 02:57:07     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = smss.exe, dwProcessID = 420.
[00000F34] 2020-04-03 02:57:07     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = csrss.exe, dwProcessID = 512.
[00000F34] 2020-04-03 02:57:07     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = wininit.exe, dwProcessID = 608.
[00000F34] 2020-04-03 02:57:07     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = csrss.exe, dwProcessID = 624.
[00000F34] 2020-04-03 02:57:07     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = services.exe, dwProcessID = 680.
[00000F34] 2020-04-03 02:57:08     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = SgrmBroker.exe, dwProcessID = 2276.
[00000F34] 2020-04-03 02:57:08     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = svchost.exe, dwProcessID = 7984.
[00000F34] 2020-04-03 02:57:08     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = SecurityHealthService.exe, dwProcessID = 4808.
[00000F34] 2020-04-03 02:57:08 --> getFileProductName
[00000F34] 2020-04-03 02:57:08     VerQueryValue: error.
[00000F34] 2020-04-03 02:57:08 <-- getFileProductName
[00000F34] 2020-04-03 02:57:08 --> getFileProductName
[00000F34] 2020-04-03 02:57:08 <-- getFileProductName
[00000F34] 2020-04-03 02:57:08     enumDLLs: succeed, strProcessName = al-tmhost.exe.current, strModulePathName = c:\windows\system32\npcap\packet.dll.
[00000F34] 2020-04-03 02:57:08 <-- enumProcesses_PID
[00000F34] 2020-04-03 02:57:08 --> killProcess_Soft
[00000418] 2020-04-03 02:57:08 --> wmain
[00000418] 2020-04-03 02:57:08     _tmain: executing, argv[0] = C:\Program Files\Npcap\NPFInstall.exe.
[00000418] 2020-04-03 02:57:08     _tmain: executing, argv[1] = -n.
[00000418] 2020-04-03 02:57:08     _tmain: executing, argv[2] = -check_dll.
[00000418] 2020-04-03 02:57:08 --> getInUseProcesses
[00000418] 2020-04-03 02:57:08 --> enumProcesses
[00000418] 2020-04-03 02:57:08     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = System, dwProcessID = 4.
[00000418] 2020-04-03 02:57:08     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = Registry, dwProcessID = 96.
[00000418] 2020-04-03 02:57:08     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = smss.exe, dwProcessID = 420.
[00000418] 2020-04-03 02:57:08     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = csrss.exe, dwProcessID = 512.
[00000418] 2020-04-03 02:57:08     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = wininit.exe, dwProcessID = 608.
[00000418] 2020-04-03 02:57:08     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = csrss.exe, dwProcessID = 624.
[00000418] 2020-04-03 02:57:08     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = services.exe, dwProcessID = 680.
[00000418] 2020-04-03 02:57:09     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = SgrmBroker.exe, dwProcessID = 2276.
[00000418] 2020-04-03 02:57:09     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = svchost.exe, dwProcessID = 7984.
[00000418] 2020-04-03 02:57:09     enumDLLs::OpenProcess: error, errCode = 0x00000005, strProcessName = SecurityHealthService.exe, dwProcessID = 4808.
[00000418] 2020-04-03 02:57:09 --> getFileProductName
[00000418] 2020-04-03 02:57:09     VerQueryValue: error.
[00000418] 2020-04-03 02:57:09 <-- getFileProductName
[00000418] 2020-04-03 02:57:09 --> getFileProductName
[00000418] 2020-04-03 02:57:09 <-- getFileProductName
[00000418] 2020-04-03 02:57:09     enumDLLs: succeed, strProcessName = al-tmhost.exe.current, strModulePathName = c:\windows\system32\npcap\packet.dll.
[00000418] 2020-04-03 02:57:09 <-- enumProcesses
[00000418] 2020-04-03 02:57:09 <-- getInUseProcesses
[00000418] 2020-04-03 02:57:09     _tmain: error, nStatus = -1.
[00000418] 2020-04-03 02:57:09 <-- wmain

... etc, ad infinitum. (al-tmhost.exe.current is the application using Npcap in this case -- it never got terminated.)

Expected behavior: For silent (un)installs, -kill_proc should be used instead of -kill_proc_polite (again, silent installation should never ever ask anything of the user).

  1. If we manually move the DLLs and allow the uninstaller to proceed, it still fails because it cannot stop the npcap driver while captures are active. The driver goes into STOP_PENDING state and refuses to snap out of it until all pcap handles are closed.

Expected behavior: Npcap driver should always honor the STOP command, irregardless of any open handles. Open handles should then return an error result from their calls and any attempts to open new handles should fail.

  1. Even if NPFInstall.exe -kill_proc is run manually (which does kill the offending process), the process (in our case) is immediately restarted by its supervisor, and just starts using Npcap again (holding the DLLs open). The uninstaller still cannot remove or replace them and fails.

Expected behavior: The uninstaller should move or rename the Npcap DLLs before trying to kill any processes using them. Any newly started processes would then not be able to find the DLLs and the uninstall/upgrade can proceed in peace.

This issue is preventing reliable automated upgrades on Npcap distributed with our product.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions