nmap / npcap

Nmap Project's Windows packet capture and transmission library
https://npcap.com
Other
2.97k stars 514 forks source link

BSOD on PPPoE connection start (only LAN, and PPPoE, other disabled) #296

Open test346457 opened 3 years ago

test346457 commented 3 years ago

Windows 7 (7601) Bug detected in NPCAP versions 0.9991 - 1.20 If adapters other all enabled, PPPoE not create BSOD, and but create error 813. If all disabled, and LAN enabled,. on PPPoE start BSOD.

dmiller-nmap commented 3 years ago

Thank you for reporting this. Please send the kernel dump file (C:\Windows\Minidump\*.dmp) to dmiller@nmap.com so that we can analyze the crash and fix this issue.

Soheil777 commented 3 years ago

hi this software collect all of problem with own i can not search all of them sorry i use widows 7 in pc and use adsl modem after install this software because Dps Meter need this my internet connection disconnected after uninstall back to normal do you know way can use this software without problem or it is impossible?

TauCubed commented 4 weeks ago

Just confirming this still happens on windows 10. Setting up a PPPoE connection caused the bugcheck.

Not comfortable sending in minidumps, best I can do is this:

Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is: 
Windows 10 Kernel Version 19041 MP (16 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Kernel base = 0xfffff802`42400000 PsLoadedModuleList = 0xfffff802`4302a830
Debug session time: Sun Aug 18 16:15:04.049 2024 (UTC + 10:00)
System Uptime: 1 days 21:56:21.663
Loading Kernel Symbols
...............................................................
................................................................
................................................................
..................................
Loading User Symbols

Loading unloaded module list
...............................................
For analysis of this file, run !analyze -v
13: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

BUGCODE_NDIS_DRIVER (7c)
The operating system detected an error in a networking driver.
The BUGCODE_NDIS_DRIVER BugCheck identifies problems in network drivers.
Often, the defect is caused by a NDIS miniport driver. You can get a complete
list of NDIS miniport drivers using !ndiskd.netadapter.  You can get a
big-picture overview of the network stack with !ndiskd.netreport.
Arguments:
Arg1: 0000000000000021, NDIS_BUGCHECK_INVALID_OBJECT_HEADER
    A driver created an invalid NDIS_OBJECT_HEADER.
Arg2: ffffbd0b269079a0, The driver that indicated the illegal status
    indication. Use !ndiskd.miniport or
    !ndiskd.filter on this handle.
Arg3: ffffbd0b25becd38, The object with the malformed header. Its
    interpretation depends on the API being
    called. For example, if the driver called
    NdisAllocateCloneOidRequest, then cast
    the object to ndis!NDIS_OID_REQUEST.
Arg4: 0000000000000000, Zero.

STACK_TEXT:  
ffffab04`788d6f68 fffff802`44ca0431     : 00000000`0000007c 00000000`00000021 ffffbd0b`269079a0 ffffbd0b`25becd38 : nt!KeBugCheckEx
ffffab04`788d6f70 fffff802`829e3cde     : ffffbd0b`25becd38 ffffab04`788d70c9 00000000`00000000 00000000`00000000 : ndis!NdisAllocateCloneOidRequest+0x41f11
ffffab04`788d6ff0 fffff802`44c5c37c     : 00000000`00000000 00000000`00000000 ffffab04`788d70c9 ffffab04`788d70c9 : npcap+0x3cde
ffffab04`788d7020 fffff802`426914a8     : 00000000`00000000 ffffbd0b`26e39200 00000000`00000000 ffffbd0b`3554b500 : ndis!ndisFDoOidRequestInternal+0x31c
ffffab04`788d7130 fffff802`4269141d     : fffff802`44c5c060 ffffbd0b`269079a0 00000000`00000000 ffffbd0b`25becd38 : nt!KeExpandKernelStackAndCalloutInternal+0x78
ffffab04`788d71a0 fffff802`44c6c34d     : ffffbd0b`26e391a0 ffffbd0b`26907900 00000000`00000000 ffffbd0b`374c8348 : nt!KeExpandKernelStackAndCalloutEx+0x1d
ffffab04`788d71e0 fffff802`44c6c494     : 00000000`00000000 ffffbd0b`26e391a0 ffffbd0b`25becd38 ffffbd0b`25becd38 : ndis!ndisQueueOidRequest+0x229
ffffab04`788d7250 fffff802`44c683aa     : ffffbd0b`25becd38 fffff802`44d34048 ffffbd0b`25becd38 00000000`0000000a : ndis!ndisMOidRequest+0xa4
ffffab04`788d7330 fffff802`c02de3a3     : ffffbd0b`25bece50 ffffbd0b`25becd38 00000000`000000ff fffff802`00000000 : ndis!NdisOidRequest+0x5a
ffffab04`788d7380 fffff802`c02e50b4     : ffffbd0b`25becd00 ffffbd0b`2f5d1e01 00000000`00000007 00000000`00000000 : raspppoe!PrSetPacketFilterForAdapter+0xbf
ffffab04`788d73b0 fffff802`c02de689     : ffffbd0b`34615860 ffffbd0b`45dd3d00 ffffbd0b`2f5d1e30 ffffbd0b`3b9f2001 : raspppoe!ChangePacketFiltersForAdapters+0x1d8
ffffab04`788d73f0 fffff802`c02de768     : ffffbd0b`346158c0 ffffbd0b`3b9f2080 fffff802`44c89fc0 00000000`00000018 : raspppoe!ExecBindingWorkItem+0x109
ffffab04`788d7420 fffff802`44c89fd1     : ffffbd0b`405c6b10 00000000`00000000 fffff802`44c89fc0 ffffbd0b`1e329010 : raspppoe!WorkItemExec+0x28
ffffab04`788d7450 fffff802`42743f45     : 00000000`00000000 ffffbd0b`405c6b10 ffffbd0b`2f5d1e30 fffff802`828d5450 : ndis!ndisDispatchIoWorkItem+0x11
ffffab04`788d7480 fffff802`42622525     : ffffbd0b`3554b500 ffffbd0b`3554b500 fffff802`42743e10 ffffbd0b`00000000 : nt!IopProcessWorkItem+0x135
ffffab04`788d74f0 fffff802`427299a5     : ffffbd0b`3554b500 00000000`00000080 ffffbd0b`1e358200 00000000`00000000 : nt!ExpWorkerThread+0x105
ffffab04`788d7590 fffff802`428072a8     : ffffac80`c1e9a180 ffffbd0b`3554b500 fffff802`42729950 00000000`00000246 : nt!PspSystemThreadStartup+0x55
ffffab04`788d75e0 00000000`00000000     : ffffab04`788d8000 ffffab04`788d1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28

SYMBOL_NAME:  npcap+3cde

MODULE_NAME: npcap

IMAGE_NAME:  npcap.sys

STACK_COMMAND:  .cxr; .ecxr ; kb

BUCKET_ID_FUNC_OFFSET:  3cde

FAILURE_BUCKET_ID:  0x7C_21_npcap!unknown_function

OS_VERSION:  10.0.19041.1

BUILDLAB_STR:  vb_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {dafc2f11-d8e6-0679-a10f-ef562a43f093}

Followup:     MachineOwner

13: kd> !ndiskd.netadapter
    Driver             NetAdapter          Name                                 
    ffffbd0b2cf66a30   ffffbd0b31e6f1a0    Microsoft Wi-Fi Direct Virtual Adapter #2
    ffffbd0b2ddbfa30   ffffbd0b26f101a0    WAN Miniport (Network Monitor)
    ffffbd0b2ddbfa30   ffffbd0b26f291a0    WAN Miniport (IPv6)
    ffffbd0b2ddbfa30   ffffbd0b2f6411a0    WAN Miniport (IP)
    ffffbd0b2d404a30   ffffbd0b2f6311a0    WAN Miniport (PPPOE)
    ffffbd0b2f5cba30   ffffbd0b2f6281a0    WAN Miniport (PPTP)
    ffffbd0b2d42fa30   ffffbd0b2f6251a0    WAN Miniport (L2TP)
    ffffbd0b2f2f0a30   ffffbd0b2f6171a0    WAN Miniport (IKEv2)
    ffffbd0b2d429a30   ffffbd0b2f40b1a0    WAN Miniport (SSTP)
    ffffbd0b2cf66a30   ffffbd0b2df2d1a0    Microsoft Wi-Fi Direct Virtual Adapter
    ffffbd0b269b89b0   ffffbd0b26e391a0    Bluetooth Device (Personal Area Network)
    ffffbd0b27519960   ffffbd0b2751c1a0    RZ608 Wi-Fi 6E 80MHz
    ffffbd0b274525b0   ffffbd0b2751a1a0    Intel(R) Ethernet Controller (3) I225-V
    ffffbd0b26bf8570   ffffbd0b26bc61a0    Private Internet Access Network Adapter
    ffffbd0b26b5c570   ffffbd0b26bc31a0    VirtualBox Host-Only Ethernet Adapter

13: kd> lmvm npcap
Browse full module list
start             end                 module name
fffff802`829e0000 fffff802`829f3000   npcap      (no symbols)           
    Loaded symbol image file: npcap.sys
    Image path: \SystemRoot\system32\DRIVERS\npcap.sys
    Image name: npcap.sys
    Browse all global symbols  functions  data
    Timestamp:        Thu Jan 18 09:48:37 2024 (65A85945)
    CheckSum:         0001CF7E
    ImageSize:        00013000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

If you need more information I'll be keeping the full dump on my system for a while. Just tell me what you need. Best of luck.

Fachep commented 3 weeks ago

Same on Windows 11 Pro 23H2 22631.4037. Lots of softwares don't work well after bsod.