Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Npcap 0.92 fails to install in WinPcap API Compatible Mode #414

Closed
davemidd opened this issue Jun 13, 2017 · 21 comments
Closed

Npcap 0.92 fails to install in WinPcap API Compatible Mode #414

davemidd opened this issue Jun 13, 2017 · 21 comments

Comments

@davemidd
Copy link

I previously had 0.91 installed (in Winpcap API Compatible Mode).
Windows 10 64 bit.
Installing 0.92 shows the following error on screen - image

Install log attached - NPFInstall.log.txt

If I un-select WinPcap API Compatible Mode then installation does complete ok.

@davemidd
Copy link
Author

I just noticed also that the installer has a message that WinPcap is installed, although it isn't actually installed. Related?

image

@dmiller-nmap
Copy link
Contributor

Thanks for the report, we'll start looking at it.

@BigbyBoss
Copy link

BigbyBoss commented Jun 26, 2017

Yup, same issue here.
NPFInstall.txt

@dmiller-nmap
Copy link
Contributor

@BigbyBoss Can you also provide NPFInstall.log? Is the error number identical?

@BigbyBoss
Copy link

@dmiller-nmap Added it to my previous comment.

@dmiller-nmap
Copy link
Contributor

Ok, it looks like the problem is that you have WinPcap (not Npcap) installed in some way that Npcap is unable to clean up. The "WinPcap API-compatible mode" is intended to completely replace WinPcap (instead of installing as Npcap with all Npcap features), so if we can't uninstall WinPcap, we can't safely install in WinPcap API-compatible mode.

Can you provide the output of DiagReport that will help us identify why the installer thinks WinPcap is installed? Maybe there is something that must be manually removed.

@BigbyBoss
Copy link

@dmiller-nmap I tried installing again a few days ago, expecting a change. And i actually managed to install it just fine this time. I got no warning stating i have WinPcap installed and the installation itself was successful.

Still, here's my DiagReport if it's of any use now.

DiagReport-20170708-001913.txt

@davemidd
Copy link
Author

davemidd commented Jul 7, 2017

Thanks @dmiller-nmap
I don't have WinPcap installed; I removed it when I first installed Npcap a few revisions ago.
It's only this last rev where there's been these problems.
Here's my DiagReport:

DiagReport-20170707-232033.txt

David

@EJMarr
Copy link

EJMarr commented Jul 8, 2017

I too have the same problem after the Creator update, with the installation failing. It complains that winpcap is installed (It is not, I have been using npcap in winpcap compatibility mode), then it halts when failing to uninstall Winpcap. After a clean install without compatibility selected, and an uninstall, it still failed.

Here are the logs, from using DiagReport, and near the end are mentioned four winpcap related files, dating back to when I installed winpcap when I was trying to understand why an application using npcap was not working (that was entirely my fault). Deleting the files from C:Windows\SysWOW64 seems to have cleared the problem. Files were NpcapHelper.exe, Packet.dll, WlanHelper.exe and wpcap.dll.

DiagReport-20170708-112649.txt

install.txt

Ed

@sinfulgurotesque
Copy link

I also started having this problem after the Creator Update. It installs fine if I don't try to install in WinPcap API-compatible mode.

DiagReport-20170713-162747.txt

@EJMarr
Copy link

EJMarr commented Jul 14, 2017

Try uninstalling the standard version of npcap, then look for the files in C:Windows\SysWOW64 (NpcapHelper.exe, Packet.dll, WlanHelper.exe and wpcap.dll.). If they are there delete them, then try installing API-compatible version (this worked for me).

@dmiller-nmap
Copy link
Contributor

@EJMarr Thanks especially for the install.log, but I don't see there where an error ocurred. Also, this appears to be an install of Npcap 0.86, not 0.92.

@sinfulgurotesque @davemidd @BigbyBoss Do any of you have an install.log file from right after the error occurs? We would really like to get to the bottom of this and fix it.

@sinfulgurotesque
Copy link

@EJMarr That worked you wonderful, beautiful bastard.

@EJMarr
Copy link

EJMarr commented Jul 15, 2017

Here's an install log that I recovered from Deleted Files. I don't have a DiagReport to go with this one, as I first needed a successful install to get the utility available (bit of a bootstrap problem there). It is 0.92, in WinPCap compatible mode, and it did fail.

install 10-22.log.txt

@dmiller-nmap
Copy link
Contributor

Linking to discussion on the nmap-dev mailing list: http://seclists.org/nmap-dev/2017/q3/44

@TomSellers
Copy link

TomSellers commented Jul 18, 2017

I can confirm that @EJMarr 's solution worked for me as well. Windows 10, all latest patches. While upgrading from Nmap 7.30 to 7.50 the bundled Npcap 0.91 installer failed. I restarted and removed all traces of Winpcap from Add/Remove Programs, disk, and the registry. No luck. Tried Npcap 0.92 same issue.
In all cases the installer would indicate that it detected that Winpcap was installed when it wasn't. I removed the files as @EJMarr indicated and the installer completed.

Note: I also have Wireshark installed which required Winpcap.

I've verified that both Wireshark and Nmap work after successfully installing Npcap 0.92.

CC: @dmiller-nmap

@dmiller-nmap
Copy link
Contributor

The issue appears to be that the Creators Update "reinstalls" Windows drivers. The diff from DiagReport before and after the install is attached.
creators-diff.txt

The essential changes are as follows:

  • Removed Npcap Loopback Adapter
  • Removed all non-standard values from the HKLM:\SYSTEM\CurrentControlSet\Services\npcap Registry key.
  • Changed the "Start" type for the npcap service to 3 (Manual) from 1 (System)
  • Removed the npcap_wifi, npf, and npf_wifi service Registry keys

dmiller-nmap referenced this issue Jul 27, 2017
Nonstandard registry values in the service's registry key get wiped out
by Windows updates like the Creators Update. They should be kept in the
Parameters subkey instead; and now they are.

See nmap/nmap#906
@dmiller-nmap
Copy link
Contributor

dmiller-nmap commented Jul 31, 2017 via email

@TheKevJac
Copy link

for me... it dont work

@ITSecMedia
Copy link

Tried to install npcap-0.93 two times today, after successful uninstall of npcap-0.83.

Both times installation failed with error message -> windows restore point gets recovered before installation, but afterwards it was installed ?

I then had to de-install it from windows "Apps & features" too, just to get sure I have no broken/corrupt installation on my machine.

@dmiller-nmap
Copy link
Contributor

Recommended procedure for this issue:

  1. install Npcap in WinPcap API-compatible mode. WinPcap-related files will be overwritten.
  2. Reinstall Npcap with whatever options you need. WinPcap-mode files will be removed prior to installation.

I am closing this issue. For problems with Npcap installations not working after applying Windows feature updates (version upgrades), see #93.

@fyodor fyodor transferred this issue from nmap/nmap May 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

8 participants