Open Tindaer opened 6 months ago
IDA-RE-things
commented
6 months ago I have have no such tuned virtual machine, Because I debug it on separate real XP computer, and dont want dirty it with such policies. (In my case).
But can you run it with --single process mode ?
May be it will create crash dump and so on.
Then it will be possible to investigate crashdump.
But of course the only proper way is to debug it, using such VM.
IDA-RE-things
commented
6 months ago Which host machine you use for this VM ? You can debug it remotely youself, Installing VS2010. The source code is here in release section. The PDB files -- also here.
Tindaer
commented
6 months ago The host machine is also WinXP :)
I've updated the post with a logfile. It's the GPU process that fails to start. Strange.
Single process mode also does not work.
IDA-RE-things
commented
6 months ago It will be good to see above logs, created with --single process mode. Above log was created without this switch ?
IDA-RE-things
commented
6 months ago And another moment. Are you have English VM for this tests ? Because russian error messages can't be foun then in code etc. It will really good to do this wioth English VM.
Try it with such clean log file. And clean start of browser without opened pages. To exclude mess from it.
Also create such separate log file without this SAFER enabled. Then we will compare it.
IDA-RE-things
commented
6 months ago GPU process exited unexpectedly: exit_code=-1073741502
"exit_code=-1073741502" is C0000142, which is "DLL Initialization Failed"
So some DLL can't be loaded with this Policies enabled.
Dont know whats happened, but its strange such log message for single process.
GPU process exited unexpectedly. Are you sure it was single ?, It looks like multiprocess execution. Multiple times:
The GPU process has crashed 9 time(s)
Also, try to find crashdumps in Supermium_UserData\Crashpad\reports\
Tindaer
commented
6 months ago I realize i made i mistake, because i was too lazy to type myself. So i just copied --single process from your message (without the "-" between the words) and pasted it in my shortcut. :)
Supermium works with SAFER enabled with the --single-process argument. It only crashes without this switch.
So, for me the issue is basically solved, because it's usable. But if there's interest on the developer's side to debug multi process mode, i will provide the logs.
Oh, and i (possibly) solved the russian issue, too. While my WinXP is in german, i do have other languages enabled (russian among them), so maybe the logger picked that one.
IDA-RE-things
commented
6 months ago But if there's interest on the developer's side to debug multi process mode, i will provide the logs.
Yes, it wil be interestingly to check what was happened in crashdumps in miltiprocess mode and in which point. It will be shown there.
Supermium_UserData\Crashpad\reports\ *.dmp-files
But if you can, try it with the latest available chrome.dll / PDB from 17.03.2024 : (I use it on my machine to check crashdumps) https://github.com/win32ss/supermium/releases/download/v122-dbg/122_new_pdb_32.7z
And remove old crashdumps before, (if they are), to prevent mess.
Tindaer
commented
6 months ago Here's the .dmp file with the chrome.dll / PDB in the link above.
IDA-RE-things
commented
6 months ago Its a callstack of the crashdump. By the stack, it seems some error was happened in Inter-Process communication pipe or so on. (if in single-process it works). More research should be done by the main dev of the repo (win32ss). (If he want to do this).
Also error C0000142, (which is "DLL Initialization Failed") from the above log, is strange. (which DLL ?).
May be it will stay here as "known problem".
win32ss
commented
6 months ago I would also suggest --no-sandbox and --in-process-gpu as well, as alternatives to --single-process. I'll try to log all LoadLibrary/LdrLoadDll calls from the GPU process as well.
Tindaer
commented
6 months ago I've tried it with --no-sandbox and --in-process-gpu , and it works in multiprocess mode. --no-sandbox is enough to make it work.
Which is a good thing, because with --single-process i did encounter this issue:
https://github.com/win32ss/supermium/issues/482
Plus, you can add the extension uBlock Origin https://chromewebstore.google.com/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm
to the list of extensions that make Supermium crash on exit, mentioned here:
IDA-RE-things
commented
6 months ago Yes, --single-process , - in this stage its only (or mostly) for debugging of some situations, where all must be inside single process to be catched by the debugger.
But for general everyday usage this mode still have problems.
Plus, you can add the extension uBlock Origin to the list of extensions that make Supermium crash on exit, mentioned here:
k, I will add it to the list. I think the list can be more... It was just for example which I use.
After enabling the SAFER ruleset from
https://skanthak.hier-im-netz.de/SAFER.html (get the file XP_SAFER.INF)
and rebooting, Supermium fails to start. The windows briefly opens and closes again.
There are NO "disallowed" entries in c:\WINDOWS\Debug\SAFER.LOG that would indicate SAFER blocking something.
The issue can be resolved by uninstalling SAFER, or just temporarily renaming the key
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer
To Reproduce Steps to reproduce the behavior:
Expected behavior Supermium should launch, as it did before enabling SAFER
Desktop (please complete the following information): Windows XP SP3 in a VM
Here is the logfile generated with
--enable-logging --v=1