moolticute
moolticute copied to clipboard
mooltipass
Moolticute crashing on Windows
OS: Windows 10 Pro 1809 (build 17763.437)
After a recent Windows update, Moolticute and moolticuted will no longer start. I have tried versions 0.41.4 and 0.41.5. They are both crashing, and I can no longer use any Moolticute-required features of my Mooltipass at this time.
Perhaps this is related to the breaking of certain software caused by the April 9th Windows Update? My PC is still very much functional, though the timing would make sense.
Below are the crash logs for version 0.41.5 of Moolticute and moolticuted as seen in the Windows Event Viewer:
moolticute.exe
Error: ----------------- Faulting application name: moolticute.exe, version: 0.0.0.0, time stamp: 0x5caca8f7 Faulting module name: ntdll.dll, version: 10.0.17763.404, time stamp: 0xe1cce3af Exception code: 0xc0000005 Fault offset: 0x00043107 Faulting process id: 0x470c Faulting application start time: 0x01d4f7b73207caab Faulting application path: C:\Users\\AppData\Local\Programs\Moolticute\moolticute.exe Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll Report Id: 9f69ee83-fbf3-4a16-adb6-4440a690f473 Faulting package full name: Faulting package-relative application ID: Information: ----------------- Fault bucket 1418005630250442405, type 1 Event Name: APPCRASH Response: Not available Cab Id: 0 Problem signature: P1: moolticute.exe P2: 0.0.0.0 P3: 5caca8f7 P4: ntdll.dll P5: 10.0.17763.404 P6: e1cce3af P7: c0000005 P8: 00043107 P9: P10: Attached files: \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE3C.tmp.mdmp \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF08.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF28.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF42.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF63.tmp.txt These files may be available here: \\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_moolticute.exe_d583fe286944bf746bb2f5db99a47bce76e4af_2f2b3516_3eb50291 Analysis symbol: Rechecking for solution: 0 Report Id: 9f69ee83-fbf3-4a16-adb6-4440a690f473 Report Status: 268435456 Hashed bucket: f17c0802bb5947d073adc49b9894dea5 Cab Guid: 0
moolticuted.exe
Error: ----------------- Faulting application name: moolticuted.exe, version: 0.0.0.0, time stamp: 0x5caca879 Faulting module name: ntdll.dll, version: 10.0.17763.404, time stamp: 0xe1cce3af Exception code: 0xc0000005 Fault offset: 0x00043107 Faulting process id: 0x604 Faulting application start time: 0x01d4f7b733bc1057 Faulting application path: C:\Users\\AppData\Local\Programs\Moolticute\moolticuted.exe Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll Report Id: a098adc6-dab3-4747-bbe1-a4dc4a306385 Faulting package full name: Faulting package-relative application ID: Information: ----------------- Fault bucket 1348903619232283968, type 1 Event Name: APPCRASH Response: Not available Cab Id: 0 Problem signature: P1: moolticuted.exe P2: 0.0.0.0 P3: 5caca879 P4: ntdll.dll P5: 10.0.17763.404 P6: e1cce3af P7: c0000005 P8: 00043107 P9: P10: Attached files: \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER977.tmp.mdmp \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA24.tmp.WERInternalMetadata.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA44.tmp.xml \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA60.tmp.csv \\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA80.tmp.txt These files may be available here: \\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_moolticuted.exe_f41bec9d878a2bccb1808f8284b1da2ccb75b5_c3ee7077_4d310dcc Analysis symbol: Rechecking for solution: 0 Report Id: a098adc6-dab3-4747-bbe1-a4dc4a306385 Report Status: 268435456 Hashed bucket: b15aedd1836ccfd3d2b844b1e4943d40 Cab Guid: 0
Hello,
Thanks for the report! We are going to investigate this right away. I'm guessing this happens at boot and when manually started?
On Sun, Apr 21, 2019, 04:32 ubergeek77 [email protected] wrote:
OS: Windows 10 Pro 1809 (build 17763.437)
After a recent Windows update, Moolticute and moolticuted will no longer start. I have tried versions 0.41.4 and 0.41.5. They are both crashing, and I can no longer use any Moolticute-required features of my Mooltipass at this time.
Below are the crash logs for version 0.41.5 of Moolticute and moolticuted as seen in the Windows Event Viewer: moolticute.exe
Error:
Faulting application name: moolticute.exe, version: 0.0.0.0, time stamp: 0x5caca8f7 Faulting module name: ntdll.dll, version: 10.0.17763.404, time stamp: 0xe1cce3af Exception code: 0xc0000005 Fault offset: 0x00043107 Faulting process id: 0x470c Faulting application start time: 0x01d4f7b73207caab Faulting application path: C:\Users\AppData\Local\Programs\Moolticute\moolticute.exe Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll Report Id: 9f69ee83-fbf3-4a16-adb6-4440a690f473 Faulting package full name: Faulting package-relative application ID:
Information:
Fault bucket 1418005630250442405, type 1 Event Name: APPCRASH Response: Not available Cab Id: 0
Problem signature: P1: moolticute.exe P2: 0.0.0.0 P3: 5caca8f7 P4: ntdll.dll P5: 10.0.17763.404 P6: e1cce3af P7: c0000005 P8: 00043107 P9: P10:
Attached files: \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERFE3C.tmp.mdmp \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF08.tmp.WERInternalMetadata.xml \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF28.tmp.xml \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF42.tmp.csv \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF63.tmp.txt
These files may be available here: \?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_moolticute.exe_d583fe286944bf746bb2f5db99a47bce76e4af_2f2b3516_3eb50291
Analysis symbol: Rechecking for solution: 0 Report Id: 9f69ee83-fbf3-4a16-adb6-4440a690f473 Report Status: 268435456 Hashed bucket: f17c0802bb5947d073adc49b9894dea5 Cab Guid: 0
moolticuted.exe
Error:
Faulting application name: moolticuted.exe, version: 0.0.0.0, time stamp: 0x5caca879 Faulting module name: ntdll.dll, version: 10.0.17763.404, time stamp: 0xe1cce3af Exception code: 0xc0000005 Fault offset: 0x00043107 Faulting process id: 0x604 Faulting application start time: 0x01d4f7b733bc1057 Faulting application path: C:\Users\AppData\Local\Programs\Moolticute\moolticuted.exe Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll Report Id: a098adc6-dab3-4747-bbe1-a4dc4a306385 Faulting package full name: Faulting package-relative application ID:
Information:
Fault bucket 1348903619232283968, type 1 Event Name: APPCRASH Response: Not available Cab Id: 0
Problem signature: P1: moolticuted.exe P2: 0.0.0.0 P3: 5caca879 P4: ntdll.dll P5: 10.0.17763.404 P6: e1cce3af P7: c0000005 P8: 00043107 P9: P10:
Attached files: \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER977.tmp.mdmp \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA24.tmp.WERInternalMetadata.xml \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA44.tmp.xml \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA60.tmp.csv \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA80.tmp.txt
These files may be available here: \?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_moolticuted.exe_f41bec9d878a2bccb1808f8284b1da2ccb75b5_c3ee7077_4d310dcc
Analysis symbol: Rechecking for solution: 0 Report Id: a098adc6-dab3-4747-bbe1-a4dc4a306385 Report Status: 268435456 Hashed bucket: b15aedd1836ccfd3d2b844b1e4943d40 Cab Guid: 0
— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/mooltipass/moolticute/issues/438, or mute the thread https://github.com/notifications/unsubscribe-auth/ABPCNM4YN5H6YRX5AOPXAVTPRN4UHANCNFSM4HHKLZUA .
I updated my Windows to 1809 (build 17763.437) and tried to install and update Moolticute to 0.41.5, but still was not able to reproduce the issue. I think it is possibly an issue with ntdll.dll. After some investigation I found a few very similar issue and troubleshoot pages:
- https://www.lifewire.com/how-to-fix-ntdll-dll-errors-2624474
- https://www.drivereasy.com/knowledge/fix-ntdll-dll-crash-issue/
- https://answers.microsoft.com/en-us/windows/forum/all/app-crash-with-ntdlldll/9aa59f80-99a1-4f3c-b2f0-7eb72df05b2a
Thanks for the advice everyone. Apologies for the delay, I've had quite the last couple of weeks and have been occupied with other things that kept me away from my desk.
I should note that this is a work machine, not a personal machine, so I am somewhat limited in the things I can do to fix the problem. I do have administrative rights, but I've been asked not to interfere with any of the corporate programs installed on my machine. So while I would normally do a clean install in instances like this, that isn't an option, nor is uninstalling things such as my company-issued antivirus an option.
That being said, I know that a member of my organization's IT team also uses a Mooltipass (in fact, it was him who recommended it to me), so I don't think a corporate update broke this, at least not intentionally.
I've tried a few of the suggestions above, but none of them have appeared to work.
Notably, the solution provided by a Microsoft moderator in a thread linked above (with regsvr32) yields the following error popup, which is identical when both running the uninstall and reinstall commands:
--------------------------- RegSvr32 --------------------------- The module "ntdll.dll" was loaded but the entry-point DllUnregisterServer was not found. Make sure that "ntdll.dll" is a valid DLL or OCX file and then try again. --------------------------- OK ---------------------------
When I have some down time, I'll try contacting the member of IT that I know has a Mooltipass and see what he has to say about this.
Just to add some additional troubleshooting results, a few of the steps listed by that DriverEasy page suggest that nothing is corrupted.
Particularly, output from DISM reports that no corruption was found on my system. SFC also provides similar output, and no integrity issues were detected.
I wonder if the DLL is not actually corrupted? If it helps, here are some checksums from my machine. If they should be the same across machines, perhaps they can be compared to the sums of the contributors here on GitHub. Hopefully this will help nail down if something strange is going on with ntdll, or if it is a red herring:
MD5 Sums: 18c99bc2523e669ebfe0c63bc0a4c10b C:\Windows\System32\ntdll.dll 1fc9512afe36a3376cafd7a06e04a69b C:\Windows\SysWOW64\ntdll.dll SHA256 Sums: 42b74c815a6c7a6f2582ad0a1a43884dfb6ed0a612eea77874611c6f6b968da6 C:\Windows\System32\ntdll.dll b6bf88e6ec1d575c2f4d47af5530b1e62cbd7e5757542b5169c96aa9480f7c49 C:\Windows\SysWOW64\ntdll.dll
For reference, this is a 64-bit version of Windows 10.
I just wanted to check in again and report that this is still unfortunately an issue.
Interestingly, I was able to use Moolticute again after installing v0.42.1 over whatever version I had, but after a reboot, now even v0.42.1 can't be used. The errors in the Windows Event Viewer are the same as what has previously been reported in this issue. After doing that, Windows version 1903 became available, which is now installed to my system. Still no luck after that update.
I can still use Moolticute on my personal machine, but with this issue occurring on my work machine, I can no longer view or update passwords while at work. The IT manager that first recommended the Mooltipass to me is not experiencing the same issues as I am, though there's really no telling what kind of machines he uses (being a higher-up in IT, it's likely to be different than the machine I've been given).
I've given as much info as I can, but if there's anything I can look in to in order to get this fixed, I'll try anything.
Edit:
I had an idea to try the portable version of Moolticute, since the standard version worked for a day after installing a newer version, but sadly the portable version also doesn't work. Here is a recent log of the error, from today, generated when starting the portable version:
Faulting application name: moolticute.exe, version: 0.0.0.0, time stamp: 0x5cdd385c Faulting module name: ntdll.dll, version: 10.0.18362.1, time stamp: 0x9bbcb4a9 Exception code: 0xc0000005 Fault offset: 0x0003c17e Faulting process id: 0x2640 Faulting application start time: 0x01d55165abfad4f3 Faulting application path: C:\Users\<myname>\Downloads\moolticute_portable_win32_v0.42.1\moolticute_v0.42.1\moolticute.exe Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll Report Id: 0ad467da-d6d9-44c5-bc2a-fbcab01f3650 Faulting package full name: Faulting package-relative application ID:
Starting moolticuted.exe manually also produces an error in the Event Viewer that is virtually identical to this one.
that may be a stupid idea... but could you try the portable version ? https://github.com/mooltipass/moolticute/releases/download/v0.42.1/moolticute_portable_win32_v0.42.1.zip
Not stupid at all!
I actually already tried that and edited my comment shortly after I posted it, including the Windows Event Viewer output. I know GitHub doesn't notify you by email when I edit comments (at least I don't think it does), but there you go!
Apologies for the ping - I know you guys have a lot going on with the Mooltipass BLE coming up, but I'd like to report that this is still as issue as of today. I can't get Moolticute to start in any capacity, portable or non-portable.
IT can't figure out why this is happening to just me, which is particularly confusing, since a few of them are using the Mooltipass on company laptops without issue.
The problem is exactly the same as originally reported, and produces the same errors as seen in the Windows Event Viewer.
I see that there have been a few testing releases since 0.42.1, which is the last exe I am able to try. Could I perhaps try a more recent exe and see if that helps things? Maybe this bug was a fluke that was "accidentally" fixed it more recent versions.
Damn :/
pinging @deXol for next task.
@ubergeek77 can you try https://betas.themooltipass.com/v0.42.5-testing/ ?
@ubergeek77 Did you try to reinstall completely windows? If not it would be good to try this...
Your problem really seems like a windows problem to me, and I fear we can't do anything about that... No one could reproduce the problem...
Damn :/
pinging @deXol for next task.
@ubergeek77 can you try https://betas.themooltipass.com/v0.42.5-testing/ ?
Sadly, this did not work either. I tried it before and after rebooting, and with the portable and non-portable versions.
@ubergeek77 Did you try to reinstall completely windows? If not it would be good to try this...
Your problem really seems like a windows problem to me, and I fear we can't do anything about that... No one could reproduce the problem...
Unfortunately, that is not a luxury I have. This is a company-provisioned laptop, and my work location is remote from the office in which IT provisions their hardware. This would require me to back up any work, find (or have provisioned) a hard drive with which I could back this up to, and then wait a week or two for them to receive, provision, and mail back this device. And even then, in the event it is company software causing the problem (such as anti-virus software that I can't disable), then it would have been for nothing, since Moolticute wouldn't work anyway.
I appreciate the help though. I guess I'll have to either figure out how to use this in a VM, or do without.
This is still an issue on the latest Moolticute beta and latest Windows update, but I may have some insight into what causes this.
Using the new Windows Sandbox feature to simulate using a "clean" system, I was able to load Moolticute completely fine in a "Sandboxed" VM (very similar to a standard Hyper-V VM, but more restrictive). Since Windows Sandbox (to my knowledge) uses the exact same Windows kernel and system DLLs as the host system, I think we can rule out Windows version incompatibilities.
From there, I used the Microsoft Process Monitor to capture the load process of Moolticute inside and outside of the Windows Sandbox. And there is a huge difference between the two.
In the log output of the not-working system, I immediately noticed that there are many system calls related to my PC's antivirus. I'm not very familiar with the "down to the metal" initialization process of Windows applications, but this seems very suspect to me, and since I don't know any better, I'd say my antivirus is causing this whole issue. Unfortunately, I have no way to turn my corporate antivirus off or otherwise whitelist this directory, so I'm at the mercy of it for the foreseeable future. The Mooltipass does fit in quite well in a corporate setting, and I would like to continue using it, but I'm very confused as to why an antivirus update many months ago would all of a sudden break Moolticute, and only Moolticute.
I've saved the Process Monitor logs of the "working" and "not working" Moolticute boot attempts, and I would like to share them with you. However, they may contain some personally identifiable information (and definitely my name), so I would like to send them to you privately, as to not share them publicly in this issue.
Is this something you would like me to send you?
yes.... very much so!!!! thanks a lot for that :)
you may send the files to verystrangebug[at]themooltipass[dot]com
Thanks for checking in, @limpkin!
Unfortunately, yes. I've just downloaded the latest testing build from your betas site, and the issue still persists, complete with the same errors as shown in the Windows Event viewer.
Were you able to check the Process Monitor logs discussed in my above comment?
I would be happy to test anything or gather more information for you.
Oh wow what a throwback, I had forgotten about this.
Well, I no longer have the computer I originally filed this issue with, and Moolticute has been working perfectly fine on every other computer I use it on for several years now. So, I think it's safe to close this one.