Installer Runtime error 255 at 76539962, Could not load SimpleSC.dll

[jeff-bb]

While running the installer.

---

Error

Runtime error 255 at 76539962

OK

Output folder: C:\Users\userid\AppData\Local\Temp\nsr4865.tmp
Extract: NPFInstall.exe
Output folder: C:\Program Files\Npcap
Extract: LICENSE
Extract: DiagReport.bat
Extract: DiagReport.ps1
Extract: FixInstall.bat
Output folder: C:\Program Files\Npcap
Extract: Uninstall.exe
Extract: NPFInstall.exe
Output folder: C:\Program Files\Npcap
Extract: npcap.sys
Extract: npcap.cat
Extract: npcap.inf
Extract: npcap_wfp.inf
Installing NDIS6.x x64 driver for Win7, Win8 and Win10
Output folder: C:\WINDOWS\system32
Extract: wpcap.dll
Extract: Packet.dll
Extract: NpcapHelper.exe
Extract: WlanHelper.exe
Output folder: C:\WINDOWS\system32\Npcap
Extract: wpcap.dll
Extract: Packet.dll
Extract: NpcapHelper.exe
Extract: WlanHelper.exe
Output folder: C:\WINDOWS\system32
Extract: wpcap.dll
Extract: Packet.dll
Extract: NpcapHelper.exe
Extract: WlanHelper.exe
Output folder: C:\WINDOWS\system32\Npcap
Extract: wpcap.dll
Extract: Packet.dll
Extract: NpcapHelper.exe
Extract: WlanHelper.exe
Clearing Npcap entries from driver store
Npcap driver cache in Driver Store has been successfully cleaned up!
Installing WFP callout driver
Npcap WFP callout driver has been successfully installed!
Installing NDIS filter driver
Npcap LWF driver has been successfully installed!
The npcap service was successfully created
Writing service options to registry
Starting the npcap driver
Could not load: C:\Users\userid\AppData\Local\Temp\nsr4865.tmp\SimpleSC.dll

NPCAP is running, but that could be from the previous install (is an upgrade). Installer is unable to be cancelled or closed, I have to kill the process. The files referrenced (SimpleSC.dll) are present in the directory being referenced.

I removed npcap fully, including driver and re-ran install. Took defaults, same result. NPCAP does get started successfully, but installer still hangs at this point.

[Uroc327]

What version are you trying to install? I am getting (presumably) the same error when trying to install 1.10 or 1.00 either from wireshark or from the npcap installer on Windows 10.

I don't think, npcap is running, but I could be mistaken.

[urbanhusky]

I'm experiencing the same issues ever since attempting to upgrade from 1.00 to 1.10. Now I cannot even install 0.9991.
0.99-r7 installs without errors.

Related:
#104
#286

[urbanhusky]

I solved it for myself. If anyone else experiences this issue and is working remotely via citrix, not using citrix (directly) might help solve it for you.
You'll want the connection to your PC to run via remote desktop, not citrix. If your Citrix Receiver allows for it, establish a connection to a general desktop and then connect via remote desktop to your machine from there.

I was able to reproduce this issue. Worked fine via RDP, failed with error 255 when connected via Citrix.

[9numbernine9]

I've run into this issue as well, and I can confirm @urbanhusky's workaround works:

• Installing through Citrix Receiver connection: fails.
• Installing through Remote Desktop connection: success!

I feel like this is probably more of a Citrix issue than an npcap issue, but it would be nice if things "just worked." 😄 I see there's an issue already about updating the version of the NSIS installer being used (#292) - maybe newer versions of the installer address this particular issue?

[dmiller-nmap]

@9numbernine9 Thanks for confirming the issue. Npcap 1.20 uses NSIS 3, so we would appreciate if someone could answer whether the issue is resolved or persists there. Additionally, if someone could verify the size and digital signature of the SimpleSC.dll that is present but not loaded, that could inform us whether there is a corruption of the file as it is unpacked. Does Citrix enforce a storage quota that our installer might be exceeding?

[9numbernine9]

@dmiller-nmap Sorry for taking so long to respond!

I tried again today with the NMAP 1.20 installer, but it seems to have the same behaviour as before. The error code is Runtime error at 773C9862 - not the exact same error code as before, but I suspect it's the same problem.

Looking in the temporary directory that the installer creates (C:\Users\myname\AppData\Local\Temp\randomstring.tmp\), the following files were extracted, along with their size and the first part of the SHA256 hash:

File	Size	Hash
final.ini	283	44aeb663c
InstallOptions.dll	14848	31944b93e
modern-header.bmp	70976	f22d49eec
NPFInstall.exe	307672	94dbf270a
nsExec.dll	6656	114c6941a
options.ini	1163	6d817c1ba
SimpleFC.dll	71840	18b179999
System.dll	11776	6fcea34c8

As before, using Remote Desktop Connection instead of Citrix lets the installation work perfectly. I wish I knew enough about Citrix to offer more suggestions but alas. 😞

[jeff-bb]

@dmiller-nmap I can confirm @9numbernine9 's findings. The device hosted over Citrix Remote Access is the trigger. Works fine on the same device when just done over RDP (or physical console). As to storage quotas or any user profile management items that Citrix provides, those are not in play for my situation. They are not present or not turned on.

At this point, I'm going to test telling Citrix not to hook and see if it makes a difference or not.

[jeff-bb]

@dmiller-nmap It is the Citrix hooking that causes the issue. When I exclude NPFInstall.exe, the problem does not happen. When I get another chance, I'll try and see if I can at least narrow it down to which hook is causing the issue as that might shed some light on the npcap side to fix it.

[dmiller-nmap]

Can anyone confirm whether the disk location of the installer in this case is local to the machine being installed or is accessed remotely? We're pretty sure that nmap/npcap-build@61cc998659bf5f16711bc4a27f1f14c3a0a15516 will fix the issue, but we would like to investigate whether a potential workaround would be copying the installer to the target machine before running it.

[jeff-bb]

I found no difference in behavior when running it locally vs remote, interactive or silent.

[jeff-bb]

As info, for the Citrix hooking DLL part of this, the installer still throws the error and prevents continuing through the install. While some parts of this issue may be resolved with 1.50, the core reported issue has not.

[electr1cBugaloo]

I can confirm that NPCAP is still exhibiting this error using Npcap 1.50 installer over citrix. Same error, using a local disk as the origin of the installer. I can also confirm that disabling hooking also did the trick as a temporary workaround for me.

[electr1cBugaloo]

For reference/information, I had to include the installer file in the ctx hooks (e.g. npcap-1.50.exe), only NPFInstall.exe did not turn out to be sufficient for me. This is the reg file I used:

[HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\CtxHook]
"ExcludedImageNames"="NPFInstall.exe,npcap-1.50.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\CtxHook]
"ExcludedImageNames"="NPFInstall.exe,npcap-1.50.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\CtxHook64]
"ExcludedImageNames"="NPFInstall.exe,npcap-1.50.exe"

[jeff-bb]

The changes in 1.60 fix the issue with Citrix.