signalapp
Auto update (old-uninstaller.exe) crash on Windows
Using a supported version?
- [X] I have searched searched open and closed issues for duplicates.
- [X] I am using Signal-Desktop as provided by the Signal team, not a 3rd-party package.
Overall summary
While apparently attempting an automatic update, Signal Desktop (Windows 11) crashed resulting in the app no longer being installed (however a non-functional Start Menu entry was left behind).
Windows event log shows five crashes of old-uninstaller.exe (version 7.28.0.0) about 2-3 seconds apart.
Faulting application name: old-uninstaller.exe, version: 7.28.0.0, time stamp: 0x5c157f86
Faulting module name: ntdll.dll, version: 10.0.26100.2033, time stamp: 0xc415c4aa
Exception code: 0xc0000374
Fault offset: 0x000f9c3f
Faulting process id: 0x3558
Faulting application start time: 0x1DB1FFAF285BC87
Faulting application path: C:\Users\<USERNAME>\AppData\Local\Temp\nsq133.tmp\old-uninstaller.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 76758f52-0461-42de-b247-50621d80546e
Faulting package full name:
Faulting package-relative application ID:
Exception code and fault offset are the same for all five crashes.
OS Details:
Edition Windows 11 Enterprise Version 24H2 Installed on 16/10/2024 OS build 26100.2033 Experience Windows Feature Experience Pack 1000.26100.23.0
Steps to reproduce
- Do nothing, the problem happens in the background.
- Come to your computer and notice that there is an error dialog.
- Note that Signal is no longer installed.
Expected result
App is updated in background.
Actual result
Update process crashes. App is no longer installed (except for non-functional Start Menu entry left behind).
Screenshots
No response
Signal version
7.28.0
Operating system
Windows 11 24H2 26100.2033
Version of Signal on your phone
7.32 (384)
Link to debug log
No response
Note: Edited by OP to fix typo: "aout" -> "about".
For the benefit of any others who experience this type of problem, the orphaned Start Menu item can be removed using this procedure:
Can you if it is still visible in the apps folder? Press Win + R then enter Shell:AppsFolder
If it is, right-click on it then select uninstall. If you see that it is a blank icon, right-click on it then select Open file location and then delete it from the folder.
Credit: Paulo GM on Microsoft Answers
I've been experiencing the same type of problem (Windows 11 as well). Without any user input, Signal completely bricks itself. According to the Signal logs, this happens during an auto update in the background, leaving only broken desktop and start menu shortcuts behind. The Signal installation directory the shortcuts point to is completely empty. The only way that I've found to restore it is to download the installer and go through the installation again.
@jernej-9 I'm sorry that's happening to you. Do you see the same historical crashes in the windows event log that Daniel does?
Update - since opening this issue there have been (at least) two further updates to Signal Desktop on my machine which fail with an error dialog appearing. I figured they are the same issue so did not make duplicate reports.
I suspect this may have something to do with Windows security features, so to clarify on my machine:
- Memory integrity is ON
- LSA protection is ON
- Defender credential guard is ON
- Vulnerable driver blocklist is ON
- MS Defender Smartscreen (check apps and files) is ON
- Potentially unwanted app blocking is ON
- All of the exploit protections (CFG, DEP, etc) are ON
@daniel-ayers Thanks for that additional information - we'll take a look!
I continue to have crashes during Signal updates, but I see that the crash is now happening in a different executable.
Faulting application name: signal-desktop-win-7.32.0.exe, version: 7.32.0.0, time stamp: 0x5c157f86
Faulting module name: ntdll.dll, version: 10.0.26100.2033, time stamp: 0xc415c4aa
Exception code: 0xc0000374
Fault offset: 0x000f9c3f
Faulting process id: 0x36F4
Faulting application start time: 0x1DB30A722810CEB
Faulting application path: C:\Users\<Username>\AppData\Roaming\Signal\update-cache\signal-desktop-win-7.32.0.exe
Faulting module path: C:\WINDOWS\SYSTEM32\ntdll.dll
Report Id: 1803b402-c18e-4772-a68c-0456f85a8b90
Faulting package full name:
Faulting package-relative application ID:
The following error dialog appears:
@daniel-ayers Does your system perhaps have locks on the old Signal Desktop files? https://superuser.com/questions/117902/find-out-which-process-is-locking-a-file-or-folder-in-windows
I ran this from an Administrator CMD.EXE ...
openfiles /query /fo table > c:\temp\openfiles.txt
... three times.
First, before opening Signal (it is configured to close rather than background itself). It was in the state where the auto-update failed. When I opened Signal it told me there was an update to apply.
Second, before manually applying the update by clicking on the blue button with the circular arrow.
Third, after the update had completed.
The output was the same on all three occasions:
INFO: No shared open files found.
Files opened remotely via local share points:
---------------------------------------------
INFO: No shared open files found.
Was that the test you were thinking of?
I will try adding AV exclusions just in case AV is getting in the way. If new EXEs/DLLs are being extracted, written and executed that could be something that AV is poking its nose into.
I take it the crash implies a failure to delete or get an exclusive write lock on something?
To be honest, I'm not entirely sure why it is crashing. Typically errors during uninstall don't result in crashes and are bubbled up to the user via UI gracefully. In this case, however, it appears to be a hard crash...
@daniel-ayers sorry, I know it has been a lot of time since you reported the issue, but do you continue to experience this?
If yes, could try setting up procdump from https://learn.microsoft.com/en-us/sysinternals/downloads/procdump, and running:
procdump -ma -i c:\some\path\to\dumps
And then see if a dump gets created in that folder?
I replied to a Meredith Whittaker (President of Signal) X post about #Signal after the signal group chat, pointing out it has lots of #bugs, and a few hours later a bug I reported was closed on #GitHub as "completed" without any action being taken. #infosec #dfir #signalgate #messaging
Please explain how this issue has been "completed" given that there is no record in this issue about any action being taken? If the lack of any mention of action on this issue was an oversight, please tell us what was done to correct it - and should I expect the problem to be fixed in the next release. (BTW, I am screen-shotting updates on this issue).
Hey, this is completely coincidental timing. I was going through and triaging tickets, and this one hadn't received a response from you for more than a month since my last message. I'm happy to reopen the issue. In order to troubleshoot this further, I'd still need your help answering the questions in my two comments from February 11th:
- Are you still experiencing this bug?
- If so, can you run the procdump command I posted above?
Not hearing back might make the issue stale after a defined period, but it doesn't make it completed or closed in my view. Further, I was not the only person who reported the problem so closing it as completed hides it and makes it more difficult for people to +1 the issue.
I commented on X about inferences that I think can be drawn from the number and nature Signal issues (and others may disagree about my inferences) but "eagerly" closing an issue from October 2024 as "completed" on the grounds that it had not been updated in a month and just hours after I commented on Signal bugs generally seems suspicious to me. If I checked all the other issues in this repo, would I find that same policy has been consistently followed? My 20+ years of investigative experience has not led me to believe much in coincidences.
I am still experiencing the problem. I missed the update on this issue last month. I am happy to do whatever additional debugging I can, but that needs to be in the context of other priorities.
This seems to affect not only Signal's (un)installer, I also suspect some exploit protection (like CFG) is the cause. I've encountered other executables (like Busybox) that have been compiled in an incompatible way.
