Burp VSS functionnality doesn't seem to work under Windows 8.1 Pro x64

[deajan]

Hello,

I just setup my first Burp test environment, and here's what happens on a fresh Burp client install on a Windows 8.1 x64 client:

C:\Program Files\Burp\bin>burp -a b 2014-01-03 12:02:12: burp[9200] before client 2014-01-03 12:02:12: burp[9200] begin client 2014-01-03 12:02:12: burp[9200] auth ok 2014-01-03 12:02:12: burp[9200] Server version: 1.3.46 2014-01-03 12:02:12: burp[9200] nocsr ok 2014-01-03 12:02:12: burp[9200] Client uses TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA38 4 2014-01-03 12:02:12: burp[9200] Compression level: 9 2014-01-03 12:02:12: burp[9200] do backup client 2014-01-03 12:02:12: burp[9200] Control handler registered. VSSClientGeneric::Initialize: IVssBackupComponents->InitializeForBackup returned 0x80042302 2014-01-03 12:02:12: burp[9200] VSS was not initialized properly. 2014-01-03 12:02:12: burp[9200] VSS support is disabled. ERR=L'opération a réussi. 2014-01-03 12:02:12: burp[9200] error in backup 2014-01-03 12:02:12: burp[9200] after client

C:\Program Files\Burp\bin>

Actually "ERR=L'opération a réussi." is french for "Operation succeded" so maybe it's just a return code stuff ? Of course, i ran this task as administrator.

Greetings from France.

[grke]

Hello, I think the error message doesn't work properly, but you do have an actual error.

Ideas: Sometimes this kind of error happens if the VSS service isn't running. Maybe try to restart Windows and try again, or check in the Services section to see that it is running. It may be called Volume Shadow Copy Service, or similar. Also, I have heard that VSS can fail if you are nearly out of disk space.

[deajan]

Hello,

Thank you for the fast reply. I actually did try to restart windows, also did i check the VSS service is running before making this issue report. When i manually try to make a snapshot using VSCSC.exe (from http://vscsc.sourceforge.net), i get a valid snapshot ressource which i can mount and use. I have about 40Go of empty space on my test computer.

Any debug option i can use to find out what's happening ?

[deajan]

Have made some background checks, here's what's happening behind the scene:

When using burp, i get these two events in the event manager (these are the english versions of the eventID as the actual french ones wouldn't really help here): EventID 8193 «Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80040154, Class not registered . Operation: Instantiating VSS server» EventID 22 «Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered. This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider. The error returned from CoCreateInstance on class with CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} and Name IVssCoordinatorEx2 is [0x80040154, Class not registered ]. Operation: Instantiating VSS server»

After having searched a bit, it seems this happens when using 32bit VSS requestors on 64Bit systems. For the sake of tests, i've rerun the 32Bits version of VSCSC.exe which creates the same behavior Burp has. The 64bits version still works flawlessly.

[grke]

Sorry, I am a bit confused now.

On my mail client, I had comment lines in your last post mentioning Windows 7. Are you having the same problem on Windows 7, or does it log those messages and work anyway?

And sorry to ask a dumb question: are you using the 64bit Windows burp client?

There is no extra debug to turn on. To get extra debug, you would have to add it to the code and recompile the client. I am going to sleep now, so don't be disheartened when I don't reply quickly. :)

[deajan]

For the Win7 comment, i just copied the event messages from a forum as mine are french and forgot to remove the win7 stuff in the first place

For the problem itself, i'm more than just dishearted, i'll kill myself.... Not that you're not going to respond fast, but i actually used the 32bits client, my bad....

Is there any chance to see a 32/64 bit combined installer to simplify mass installation one day ? Thanks... .

[grke]

OK, I am glad that the problem has gone away. I will now close this issue.

I doubt that there will be a combined 32/64 bit installer. Does such a thing exist for other software? I don't think I have seen it before.

[deajan]

Well combined installers are mostly used in system applications (antivirus, backup software like TrueImage), actually any system related software. I myself have an alternative installer for smartmontools which has inbuild 64bit support. It's just easier to carry one and one script for deployments where you don't know if the target will be 32 or 64 bits.

Anyway, i'm still experiencing BURP and it's the best tool i've found so far compared to Bareos. Thanks.

[grke]

Thanks for the kind message. I just checked Bareos, because I forgot what it was. I found that Bacula Systems is sueing them! Anyway, hopefully burp will continue to work well for you.