New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Npcap 0.994 crashes with IRQL_NOT_LESS_OR_EQUAL #352
Comments
This reverts commit 2f82518. Npcap 0.994 introduced a crash that will be fixed in next version: https://github.com/nmap/nmap/issues/1591 Change-Id: Iff9a29e6d28c57774844d25f2990e0f8c214bf75 Reviewed-on: https://code.wireshark.org/review/33143 Reviewed-by: Pascal Quantin <pascal@wireshark.org>
It this fixed in 0.995? I still get a win 10 crash when i try to uninstall this NPcap. only thought save mode i could uninstall it without a crash. |
Same here! Any attempt with 0.995 to shutdown Windows, or disable or uninstall the loopback adapter results in a crash. Trying to restart in safe mode doesn't work either, because of that. Difficult to install a patch at this point... |
@max2win and @jhlweb: This issue is not related to the "crashes at uninstall or adapter removal" bug. Npcap 0.994 and 0.995 have a pair of related bugs (#1626, #350) that in some cases cause a crash when stopping the driver service. We have a fix for this issue in testing and hope to release it soon. The new installer will prompt you to take some extra steps to allow Npcap 0.995 or 0.994 to be safely removed before installing Npcap, which will require a reboot. We apologize for the inconvenience. In the meantime, here is a procedure for safely removing Npcap. After it is removed, the best option is to install Npcap 0.993, which is unaffected:
Please be patient as we prepare and test the next Npcap release to address these issues. |
@dmiller-nmap: I confirm that your procedure successfully removed Npcap. Just a small note I wish to add: during step 2, don't panic if you see the BSOD again and go straight to step 3. Even if Windows crashed once more in my case, it had the time to save the Registry with the updated start property. You can check that before step 3, running Many thanks Daniel for your quick response and solution. |
This issue is resolved in Npcap 0.996, released today. https://npcap.org/#download Because Npcap 0.995 consistently crashes some systems, the Npcap 0.996 installer will offer to disable the |
As @dmiller-nmap says, this bug is fixed in 0.996, so the Working Solution is to use Npcap 0.996 or later; given that the current Npcap, as of 2023-12-10, is 1.78, which is definitely later, "just use the current Npcap" is the Working Solution. |
This issue has resulted in at least 23 crashes reported via the Microsoft crash telemetry, and is due to a failure to check for a NULL return from
NPF_GetLoopbackOpen()
. Fix is incoming. In the meantime, it would be advisable to revert to Npcap 0.993 until a release is made.The text was updated successfully, but these errors were encountered: