WFN (1.9 and 2) crashes when running as adminstrator

Jan 20, 2016 at 1:12 PM
Edited Jan 20, 2016 at 1:13 PM
Very interested in using WFN, especially to default block outbound connections on my PC. There's a problem though. When I try to run WFN as administrator (needed to set up the rules) it crashes. Running on Windows 7 x64. Debugging info below.

Fault bucket 150941412, type 30
Event Name: CLR20r3
Response: Not available
Cab Id: 0

Problem signature:
P1: WFN.exe
P3: 559c0312
P4: mscorlib
P5: 4.6.1055.0
P6: 563c113c
P7: 133d
P8: ffffffff
P9: System.AccessViolationException

Attached files:

These files may be available here:

Analysis symbol:
Rechecking for solution: 0
Report Id: 36b2f2b6-bf7e-11e5-a3c9-00059a3c7a00
Report Status: 1

Faulting application name: WFN.exe, version:, time stamp: 0x559c0312
Faulting module name:, version: 4.6.1055.0, time stamp: 0x563c113c
Exception code: 0xc0000005
Fault offset: 0x0000000001202f44
Faulting process id: 0xbfd8
Faulting application start time: 0x01d1538af8721347
Faulting application path: C:\Apps\WFN\WFN.exe
Faulting module path: C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\mscorlib\fa8eef6f6cb67c660d71e15c5cad71b5\
Report Id: 36b2f2b6-bf7e-11e5-a3c9-00059a3c7a00

Application: WFN.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.AccessViolationException
at System.String.wcslen(Char*)
at System.String.CtorCharPtr(Char*)
at System.Runtime.InteropServices.Marshal.PtrToStringUni(IntPtr)
at Wokhan.WindowsFirewallNotifier.Common.Helpers.IPHelper+Owner..ctor(TCPIP_OWNER_MODULE_BASIC_INFO)
at Wokhan.WindowsFirewallNotifier.Common.Helpers.IPHelpers.TCPHelper.GetOwningModuleTCP(MIB_TCPROW_OWNER_MODULE)
at Wokhan.WindowsFirewallNotifier.Common.Helpers.IPHelpers.TCPHelper+MIB_TCPROW_OWNER_MODULE.get_OwnerModule()
at Wokhan.WindowsFirewallNotifier.Console.Helpers.ViewModels.Connection..ctor(I_OWNER_MODULE)
at Wokhan.WindowsFirewallNotifier.Console.UI.Pages.Connections.AddOrUpdateConnection(I_OWNER_MODULE)
at Wokhan.WindowsFirewallNotifier.Console.UI.Pages.Connections.timer_Tick(System.Object, System.EventArgs)
at System.Windows.Threading.DispatcherOperation.InvokeDelegateCore()
at System.Windows.Threading.DispatcherOperation.InvokeImpl()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Windows.Threading.DispatcherOperation.Invoke()
at System.Windows.Threading.Dispatcher.ProcessQueue()
at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
at System.Windows.Application.RunDispatcher(System.Object)
at System.Windows.Application.RunInternal(System.Windows.Window)
at Wokhan.WindowsFirewallNotifier.Console.App.Main()
Jan 25, 2016 at 10:38 PM
Hello rogierg. I haven't heard word from led developer in over 2 months now, so I am not sure when he will be able to look into your issue.

Some things to try would be:
  1. Make sure you are using the latest .NET framework drivers (which according to the log, it looks like you are).
  2. Try removing WFN completely from your system and then try doing it all over again. Maybe you had a bad download.
  3. If none of those work, you should be able to run WFN in non-admin rights and be able to be fully protected from attackers, so I would recommend doing this, until we hear word from led developer again.
Thank you for using WFN.
Feb 4, 2016 at 8:43 AM
I suspect the problem is that the allocated buffer isn't zeroed out.

In TCPHelper.cs:
buffer = Marshal.AllocHGlobal(buffSize);

var resp = GetOwnerModuleFromTcpEntry(ref row, TCPIP_OWNER_MODULE_INFO_CLASS.TCPIP_OWNER_MODULE_INFO_BASIC, buffer, ref buffSize);

But MSDN clearly states:
"This field should be a NULL pointer..."

and AllocHGlobal doesn't zero its allocated memory:
Feb 5, 2016 at 11:38 AM
Sorry I wasn't able to answer sooner! This is indeed unexpected as launching WFN as an admin should work flawlessly. Anyway Daniel you are probably right, the buffer isn't cleared so in some yet unknown cases, it could raise such exception. Since I really cannot work as much as I would like to on the project, I welcome you in the team :-)
Rocknrollkid, you already know I'm grateful for your help, but thank you again for your work!!!

Best regards,
Jerome (Khan)
Feb 5, 2016 at 12:33 PM
@Jerome: Thanks for adding me to the team! :)

@rogierg: I'll try and get a patch in as soon as possible, however, I currently don't know when a new release can be made.
Feb 25, 2016 at 5:10 PM
This crash should be corrected by the v2.0 Alpha 5 release I just made public. rogierg, please test that release, and let me know if you see any improvements.
Mar 7, 2016 at 1:25 PM
Edited Mar 7, 2016 at 1:25 PM
@Daniel: checked the Alpha 5 and indeed it does not crash anymore. Thanks!

Funny thing is that the test notification function doesn't work anymore. Is it hardlinked to a specific location?
Mar 9, 2016 at 6:40 PM
rogierg wrote:
@Daniel: checked the Alpha 5 and indeed it does not crash anymore. Thanks!
Cool, great!

rogierg wrote:
Funny thing is that the test notification function doesn't work anymore. Is it hardlinked to a specific location?
It's not hardlinked that I know of? What exactly do you mean with "test notification function doesn't work anymore"? Do you mean that the demo-mode popup isn't showing?