Re: [Wireshark-dev] Npcap 0.03 call for test

2015-08-10 Thread Yang Luo
Hi Jim, Pascal, This IRQL_NOT_LESS_OR_EQUAL (a) BSoD seems to be caused by NdisAcquireSpinLock call in function NPF_StartUsingOpenInstance has referred to freed Open struct memory, I have tried to fix it in latest installer, you may try it at: https://svn.nmap.org/nmap-exp/yang/NPcap-LWF/npcap-nma

[Wireshark-dev] Crash during fuzzing

2015-08-10 Thread Dario Lombardo
Hi list II was fuzzing a protocol, and I experienced a crash. The fuzz-test.sh gave me this output $ ../tools/fuzz-test.sh -b run ../data/hpfeed_all_packets_sample.pcap [...] Starting pass 130: ../data/hpfeeds_all_packets_sample.pcap: (-nVxr) (-nr) OK Starting pass 131: ../data/hpfeeds_al

Re: [Wireshark-dev] Crash during fuzzing

2015-08-10 Thread Evan Huus
The best way to reproduce fuzzer bugs is with ./tools/test-captures.sh which sets all the same environment variables and flags as the main fuzz script. Since the error was in a memory canary, valgrind and/or ASAN may also prove useful. Evan On Mon, Aug 10, 2015 at 3:52 PM, Dario Lombardo wrote:

Re: [Wireshark-dev] Crash during fuzzing

2015-08-10 Thread Dario Lombardo
No crash still happening... $ ../tools/test-captures.sh -b run ../data/hpfeeds_all_packets_sample.pcap Testing file ../data/hpfeeds_all_packets_sample.pcap... - with tree... OK - without tree... OK - without tree but with a read filter... OK $ On Mon, Aug 10, 2015 at 10:09 PM, Evan Huus wrote

Re: [Wireshark-dev] Crash during fuzzing

2015-08-10 Thread Pascal Quantin
Hi Dario, Le 10 août 2015 10:27 PM, "Dario Lombardo" a écrit : > > No crash still happening... > > $ ../tools/test-captures.sh -b run ../data/hpfeeds_all_packets_sample.pcap > Testing file ../data/hpfeeds_all_packets_sample.pcap... > - with tree... OK > - without tree... OK > - without tree bu

Re: [Wireshark-dev] Crash during fuzzing

2015-08-10 Thread Dario Lombardo
On Mon, Aug 10, 2015 at 10:39 PM, Pascal Quantin wrote: > Hi Dario, > > Le 10 août 2015 10:27 PM, "Dario Lombardo" > a écrit : > > > > No crash still happening... > > > > $ ../tools/test-captures.sh -b run > ../data/hpfeeds_all_packets_sample.pcap > > Testing file ../data/hpfeeds_all_packets_sam

Re: [Wireshark-dev] Npcap 0.03 call for test

2015-08-10 Thread Jim Young
Hello Yang, I installed npcap-nmap-0.03-r6.exe but am still getting the IRQL_NOT_LESS_OR_EQUAL (a) BSoD on my Windows 8.1. system immediately when I start Wireshark. I went back retested 0.03-r3, 0.03-r4 and 0.03-r5 to confirm that its only r5 and r6 that trigger the immediate BSoD on my sys