Crash on start up

[mlines]

Sharpcap 3.2 has worked ok for a number of weeks on my laptop.

Tonight I started it again and it seems to fail almost instantly and quietly (no splash screen, no icon in the task bar, nothing)

I then upgraded to version 4

Exacly the same issue. If I run Windows Task Manager I can see it briefly in the task list and it then disappears.

Starting it manually with the /dump argument does not produce a crash file. It simply disappears?


Uninstalled and re-installed, still exactly the same. Is there any debug option I can use to make it verbose about what has happened?

[admin]

Hi,

You can run SharpCap with a '/debuglaunch' parameter which will show message boxes during the early part of application startup to trace progress - please post info of the last message box you see before the application crashes - that will allow us to understand how far the launch of the application has gone.

Another thing to check is whether a log is being written in the default location (see https://docs.sharpcap.co.uk/4.0/#How%20 ... %20a%20Bug) each time SharpCap is run - it's possible that the last information in the log might give some clues to what is going on.

Two more things...

1) Consider temporarily disabling antivirus to see if that helps - a lot of problems that don't make any sense end up being antivirus making a mess of things

2) You could try wiping the SharpCap registry settings to put settings back to default - this would be effective if somehow a saved setting is causing the crash. You could delete the registry key

Code: Select all

HKEY_CURRENT_USER\SOFTWARE\ASTROSHARP LIMITED\SharpCap

That will reset SharpCap back to defaults (including forgetting any SharpCap Pro license you have). Don't just delete the 4.0 key, since when you first run 4.0 with no '4.0' key, it will copy the settings from 3.2, which might contain the problem. If you do this, please export the registry data first (Right click on the 'SharpCap' key and choose export) - this will allow you to put your settings back if you want and also allow us to work out why the problem is happening if clearing the registry does cure the problem.

thanks,

Robin

[mlines]

Thanks for responding

1. Antivirus disabled (Symantec End Point Manager) - no change

2. It gets to Stage 5 ok. The next box I see says "Full Trust: True" after that, nothing,

3. Deleting all registry entries has no effect

4. Nothing in any of the sharpcap logs

[admin]

Hi,

thanks for the update the error is happening before anything would get written to the log and before the crash dump for '/dump' gets set up, so no surprise that they are not helping.

The fact that you are seeing nothing after the message about full trust is odd - it should either be OK and show you a stage 6 message or have an error and show a message about the error. The fact that it vanishes at that point is definitely weird.

A couple more things I can suggest:

1) try creating a different user account and see if running on a different account works

2) Check the Microsoft 'Event Viewer' logs to see if they have recorded anything of interest at the time you try to run it

3) Download procdump from Microsoft ( https://docs.microsoft.com/en-us/sysint ... s/procdump ) and then run it like this

Code: Select all

procdump -e -t -w SharpCap -mm

Now run SharpCap - Procdump should spot SharpCap running and then make a crash dump (probably in the same folder as Procdump.exe) when the problem happens. Hopefully with a crash dump I can see a bit more about what is going on.

thanks,

Robin

[mlines]

Here are the Event Log entries,

First I see .net load

Code: Select all

.NET Runtime version 4.0.30319.0 - The profiler was loaded successfully.  Profiler CLSID: '{B74E4EB1-99CB-4B76-AF5F-2A0A973DC9A9}'.  Process ID (decimal): 21480.  Message ID: [0x2507].

Then I see a .net error

Code: Select all

Log Name:      Application
Source:        .NET Runtime
Date:          10/08/2021 15:52:23
Event ID:      1025
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      CENSORED!!
Description:
Application: SharpCap.exe
Framework Version: v4.0.30319
Description: The application requested process termination through System.Environment.FailFast(string message).
Message: 
Stack:
   at System.Environment.FailFast(System.String)
   at <Module>.‏‬‪‮‍‏‫‍‏‏‬​​‮‮‬‪‪‎‮‮‌‭‮‎‍‍‪‬‮()
   at <Module>..cctor()
   at System.Delegate.BindToMethodInfo(System.Object, System.IRuntimeMethodInfo, System.RuntimeType, System.DelegateBindingFlags)
   at System.Delegate.UnsafeCreateDelegate(System.RuntimeType, System.Reflection.RuntimeMethodInfo, System.Object, System.DelegateBindingFlags)
   at System.Delegate.CreateDelegateInternal(System.RuntimeType, System.Reflection.RuntimeMethodInfo, System.Object, System.DelegateBindingFlags, System.Threading.StackCrawlMark ByRef)
   at System.Delegate.CreateDelegate(System.Type, System.Reflection.MethodInfo, Boolean)
   at System.Delegate.CreateDelegate(System.Type, System.Reflection.MethodInfo)
   at SharpCap.Launcher.Program.Main()

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name=".NET Runtime" />
    <EventID Qualifiers="0">1025</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-08-10T14:52:23.1606152Z" />
    <EventRecordID>306332</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>CENSORED!!</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Application: SharpCap.exe
Framework Version: v4.0.30319
Description: The application requested process termination through System.Environment.FailFast(string message).
Message: 
Stack:
   at System.Environment.FailFast(System.String)
   at &lt;Module&gt;.‏‬‪‮‍‏‫‍‏‏‬​​‮‮‬‪‪‎‮‮‌‭‮‎‍‍‪‬‮()
   at &lt;Module&gt;..cctor()
   at System.Delegate.BindToMethodInfo(System.Object, System.IRuntimeMethodInfo, System.RuntimeType, System.DelegateBindingFlags)
   at System.Delegate.UnsafeCreateDelegate(System.RuntimeType, System.Reflection.RuntimeMethodInfo, System.Object, System.DelegateBindingFlags)
   at System.Delegate.CreateDelegateInternal(System.RuntimeType, System.Reflection.RuntimeMethodInfo, System.Object, System.DelegateBindingFlags, System.Threading.StackCrawlMark ByRef)
   at System.Delegate.CreateDelegate(System.Type, System.Reflection.MethodInfo, Boolean)
   at System.Delegate.CreateDelegate(System.Type, System.Reflection.MethodInfo)
   at SharpCap.Launcher.Program.Main()
</Data>
  </EventData>
</Event>

Then I see an application error

Code: Select all

Log Name:      Application
Source:        Application Error
Date:          10/08/2021 15:52:23
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:     CENSORED!!
Description:
Faulting application name: SharpCap.exe, version: 3.2.6482.0, time stamp: 0x604a503e
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0x80131623
Fault offset: 0x02ce93b9
Faulting process ID: 0x53e8
Faulting application start time: 0x01d78df75291cf0c
Faulting application path: C:\Program Files (x86)\SharpCap 3.2\SharpCap.exe
Faulting module path: unknown
Report ID: 100dec0b-beb3-4bf8-bca2-c7c920885cfa
Faulting package full name: 
Faulting package-relative application ID: 
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>100</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-08-10T14:52:23.5870574Z" />
    <EventRecordID>306333</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>CENSORED!!</Computer>
    <Security />
  </System>
  <EventData>
    <Data>SharpCap.exe</Data>
    <Data>3.2.6482.0</Data>
    <Data>604a503e</Data>
    <Data>unknown</Data>
    <Data>0.0.0.0</Data>
    <Data>00000000</Data>
    <Data>80131623</Data>
    <Data>02ce93b9</Data>
    <Data>53e8</Data>
    <Data>01d78df75291cf0c</Data>
    <Data>C:\Program Files (x86)\SharpCap 3.2\SharpCap.exe</Data>
    <Data>unknown</Data>
    <Data>100dec0b-beb3-4bf8-bca2-c7c920885cfa</Data>
    <Data>
    </Data>
    <Data>
    </Data>
  </EventData>
</Event>

Then I see a windows reporting error

Code: Select all

Log Name:      Application
Source:        Windows Error Reporting
Date:          10/08/2021 15:52:25
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      CENSORED!!
Description:
Fault bucket 1484305383447266275, type 5
Event Name: CLR20r3
Response: Not available
Cab Id: 0

Problem signature:
P1: SharpCap.exe
P2: 3.2.6482.0
P3: 604a503e
P4: SharpCap.App
P5: 3.2.6482.0
P6: 604a5028
P7: 2
P8: 7e
P9: FatalError
P10: 

Attached files:
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7360.tmp.dmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER747B.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER74D9.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER74E7.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7546.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_SharpCap.exe_1a83a55ec6998ab18ee2552d64b851945334a_c5c81bd2_5b546622-cca3-432e-a51f-1aced33c9cc4

Analysis symbol: 
Rechecking for solution: 0
Report Id: 100dec0b-beb3-4bf8-bca2-c7c920885cfa
Report Status: 268435456
Hashed bucket: baf9bc2360b0231d44994fe1ce9303e3
Cab Guid: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2021-08-10T14:52:25.5234947Z" />
    <EventRecordID>306334</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>CENSORED!!</Computer>
    <Security />
  </System>
  <EventData>
    <Data>1484305383447266275</Data>
    <Data>5</Data>
    <Data>CLR20r3</Data>
    <Data>Not available</Data>
    <Data>0</Data>
    <Data>SharpCap.exe</Data>
    <Data>3.2.6482.0</Data>
    <Data>604a503e</Data>
    <Data>SharpCap.App</Data>
    <Data>3.2.6482.0</Data>
    <Data>604a5028</Data>
    <Data>2</Data>
    <Data>7e</Data>
    <Data>FatalError</Data>
    <Data>
    </Data>
    <Data>
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7360.tmp.dmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER747B.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER74D9.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER74E7.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER7546.tmp.txt</Data>
    <Data>\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_SharpCap.exe_1a83a55ec6998ab18ee2552d64b851945334a_c5c81bd2_5b546622-cca3-432e-a51f-1aced33c9cc4</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>100dec0b-beb3-4bf8-bca2-c7c920885cfa</Data>
    <Data>268435456</Data>
    <Data>baf9bc2360b0231d44994fe1ce9303e3</Data>
    <Data>0</Data>
  </EventData>
</Event>

[mlines]

P.S I also have a procdump captured

[admin]

Hi,

I think something is trying to debug or profile SharpCap as it starts running. SharpCap has anti-debug protection built in to try to stop people from hacking the SharpCap Pro licensing system (or copying all the cool stuff in SharpCap) and will shutdown if it detects an attempt to debug it.

A web search found this page which suggests having a product called 'dynatrace' installed can cause a similar thing with other software : https://stackoverflow.com/questions/433 ... d-failfast

Is it possible that you have installed anything like this since SharpCap last worked correctly for you?

cheers,

Robin

[mlines]

Hi,

Its a corporate laptop

Recently we have had to (manually) install:

Malwarebytes Endpoint Agent
Cybereason Active Probe
Symantec End Point Protection

However it is a manual install that is for people wishing to use the VPN tunnel. If you stay outside the Tunnel (ie Microsoft 365 cloud only) you do not have to install them. Therefore yes, I did have them installed but as it is a manual choice I de-installed them today as I knew that was a fairly recent change. It still does it without those applications installed. That doesnt mean that IT hasnt remotely installed something else, but I cannot see it. Whilst IT are reasonably relaxed about some elements of personal use, they will clearly not do any investigations and remediation of issues.

[admin]

Hi,

I think the security products are likely to be related to this happening. My rule of thumb is that 'impossible bugs are usually caused by Antivirus'...

I had the same in the last year before I went full time on SharpCap - an increasingly keen IT department loaded more and more security and management stuff onto laptops until they bogged down to a crawl if doing anything more than running Outlook, Teams or Word The humorous part of it is that these 3rd party MDM and security tools are often the ones that turn out contain the truly cataclysimic security vulnerabilities (SolarWinds anyone?).

Any chance you could run a virtual machine (VirtualBox/VMWare) on the laptop to get a clean install of Windows that shouldn't kill SharpCap? Performance will probably be OK for everything except very high speed imaging.

cheers,

Robin

[mlines]

Thanks Robin

I will run up a version in Hyper-V and see what happens

Martin