This project has moved. For the latest updates, please go here.

WFN (1.9 and 2) crashes when running as adminstrator

Jan 20, 2016 at 1:12 PM
Edited Jan 20, 2016 at 1:13 PM
Very interested in using WFN, especially to default block outbound connections on my PC. There's a problem though. When I try to run WFN as administrator (needed to set up the rules) it crashes. Running on Windows 7 x64. Debugging info below.

Fault bucket 150941412, type 30
Event Name: CLR20r3
Response: Not available
Cab Id: 0

Problem signature:
P1: WFN.exe
P2: 2.0.0.0
P3: 559c0312
P4: mscorlib
P5: 4.6.1055.0
P6: 563c113c
P7: 133d
P8: ffffffff
P9: System.AccessViolationException
P10:

Attached files:
C:\Users\user\AppData\Local\Temp\WER9857.tmp.WERInternalMetadata.xml
C:\Users\user\AppData\Local\Temp\WERA285.tmp.appcompat.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_WFN.exe_1aa22daf78f3f14a23348969e1f1b379193c3a9_e132a294

Analysis symbol:
Rechecking for solution: 0
Report Id: 36b2f2b6-bf7e-11e5-a3c9-00059a3c7a00
Report Status: 1

Faulting application name: WFN.exe, version: 2.0.0.0, time stamp: 0x559c0312
Faulting module name: mscorlib.ni.dll, version: 4.6.1055.0, time stamp: 0x563c113c
Exception code: 0xc0000005
Fault offset: 0x0000000001202f44
Faulting process id: 0xbfd8
Faulting application start time: 0x01d1538af8721347
Faulting application path: C:\Apps\WFN\WFN.exe
Faulting module path: C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\mscorlib\fa8eef6f6cb67c660d71e15c5cad71b5\mscorlib.ni.dll
Report Id: 36b2f2b6-bf7e-11e5-a3c9-00059a3c7a00

Application: WFN.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.AccessViolationException
at System.String.wcslen(Char*)
at System.String.CtorCharPtr(Char*)
at System.Runtime.InteropServices.Marshal.PtrToStringUni(IntPtr)
at Wokhan.WindowsFirewallNotifier.Common.Helpers.IPHelper+Owner..ctor(TCPIP_OWNER_MODULE_BASIC_INFO)
at Wokhan.WindowsFirewallNotifier.Common.Helpers.IPHelpers.TCPHelper.GetOwningModuleTCP(MIB_TCPROW_OWNER_MODULE)
at Wokhan.WindowsFirewallNotifier.Common.Helpers.IPHelpers.TCPHelper+MIB_TCPROW_OWNER_MODULE.get_OwnerModule()
at Wokhan.WindowsFirewallNotifier.Console.Helpers.ViewModels.Connection..ctor(I_OWNER_MODULE)
at Wokhan.WindowsFirewallNotifier.Console.UI.Pages.Connections.AddOrUpdateConnection(I_OWNER_MODULE)
at Wokhan.WindowsFirewallNotifier.Console.UI.Pages.Connections.timer_Tick(System.Object, System.EventArgs)
at System.Windows.Threading.DispatcherOperation.InvokeDelegateCore()
at System.Windows.Threading.DispatcherOperation.InvokeImpl()
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
at System.Windows.Threading.DispatcherOperation.Invoke()
at System.Windows.Threading.Dispatcher.ProcessQueue()
at System.Windows.Threading.Dispatcher.WndProcHook(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndWrapper.WndProc(IntPtr, Int32, IntPtr, IntPtr, Boolean ByRef)
at MS.Win32.HwndSubclass.DispatcherCallbackOperation(System.Object)
at System.Windows.Threading.ExceptionWrapper.InternalRealCall(System.Delegate, System.Object, Int32)
at System.Windows.Threading.ExceptionWrapper.TryCatchWhen(System.Object, System.Delegate, System.Object, Int32, System.Delegate)
at System.Windows.Threading.Dispatcher.LegacyInvokeImpl(System.Windows.Threading.DispatcherPriority, System.TimeSpan, System.Delegate, System.Object, Int32)
at MS.Win32.HwndSubclass.SubclassWndProc(IntPtr, Int32, IntPtr, IntPtr)
at MS.Win32.UnsafeNativeMethods.DispatchMessage(System.Windows.Interop.MSG ByRef)
at System.Windows.Threading.Dispatcher.PushFrameImpl(System.Windows.Threading.DispatcherFrame)
at System.Windows.Application.RunDispatcher(System.Object)
at System.Windows.Application.RunInternal(System.Windows.Window)
at Wokhan.WindowsFirewallNotifier.Console.App.Main()
Editor
Jan 25, 2016 at 10:38 PM
Hello rogierg. I haven't heard word from led developer in over 2 months now, so I am not sure when he will be able to look into your issue.

Some things to try would be:
  1. Make sure you are using the latest .NET framework drivers (which according to the log, it looks like you are).
  2. Try removing WFN completely from your system and then try doing it all over again. Maybe you had a bad download.
  3. If none of those work, you should be able to run WFN in non-admin rights and be able to be fully protected from attackers, so I would recommend doing this, until we hear word from led developer again.
Thank you for using WFN.
Developer
Feb 4, 2016 at 8:43 AM
I suspect the problem is that the allocated buffer isn't zeroed out.

In TCPHelper.cs:
buffer = Marshal.AllocHGlobal(buffSize);

var resp = GetOwnerModuleFromTcpEntry(ref row, TCPIP_OWNER_MODULE_INFO_CLASS.TCPIP_OWNER_MODULE_INFO_BASIC, buffer, ref buffSize);


But MSDN clearly states:
https://msdn.microsoft.com/en-us/library/windows/desktop/aa366380(v=vs.85).aspx
"This field should be a NULL pointer..."

and AllocHGlobal doesn't zero its allocated memory:
http://stackoverflow.com/questions/1486999/how-to-zero-out-memory-allocated-by-marshal-allochglobal
Coordinator
Feb 5, 2016 at 11:38 AM
Hi,
Sorry I wasn't able to answer sooner! This is indeed unexpected as launching WFN as an admin should work flawlessly. Anyway Daniel you are probably right, the buffer isn't cleared so in some yet unknown cases, it could raise such exception. Since I really cannot work as much as I would like to on the project, I welcome you in the team :-)
Rocknrollkid, you already know I'm grateful for your help, but thank you again for your work!!!

Best regards,
Jerome (Khan)
Developer
Feb 5, 2016 at 12:33 PM
@Jerome: Thanks for adding me to the team! :)

@rogierg: I'll try and get a patch in as soon as possible, however, I currently don't know when a new release can be made.
Developer
Feb 25, 2016 at 5:10 PM
This crash should be corrected by the v2.0 Alpha 5 release I just made public. rogierg, please test that release, and let me know if you see any improvements.
Mar 7, 2016 at 1:25 PM
Edited Mar 7, 2016 at 1:25 PM
@Daniel: checked the Alpha 5 and indeed it does not crash anymore. Thanks!

Funny thing is that the test notification function doesn't work anymore. Is it hardlinked to a specific location?
Developer
Mar 9, 2016 at 6:40 PM
rogierg wrote:
@Daniel: checked the Alpha 5 and indeed it does not crash anymore. Thanks!
Cool, great!

rogierg wrote:
Funny thing is that the test notification function doesn't work anymore. Is it hardlinked to a specific location?
It's not hardlinked that I know of? What exactly do you mean with "test notification function doesn't work anymore"? Do you mean that the demo-mode popup isn't showing?