Update: UltraVNC 1.4.3.6 and UltraVNC SC 1.4.3.6: viewtopic.php?t=37885
Important: Please update to latest version before to create a reply, a topic or an issue: viewtopic.php?t=37864

Join us on social networks and share our announcements:
- Website: https://uvnc.com/
- GitHub: https://github.com/ultravnc
- Mastodon: https://mastodon.social/@ultravnc
- Facebook: https://www.facebook.com/ultravnc1
- X/Twitter: https://twitter.com/ultravnc1
- Reddit community: https://www.reddit.com/r/ultravnc
- OpenHub: https://openhub.net/p/ultravnc

[bug fixed] 1.0.8.2 SecureVNC -kill crash bug confirmed

Should you have problems with the DSM plugin, here's the place to look for help or report issues
Post Reply
User avatar
supercoe
400
400
Posts: 1732
Joined: 2009-07-20 21:27
Location: Walker, MN
Contact:

[bug fixed] 1.0.8.2 SecureVNC -kill crash bug confirmed

Post by supercoe »

Using the 1.0.8.2 server and viewer.

If a viewer is connected to the server using the SecureVNCPlugin.dsm and winvnc.exe -kill is executed windows reports that winvnc.exe has crashed.

Tested on XP Pro SP3, Vista SP2, Win7 with the same result.

Disabling the plugin solves the issue.

[mod=494,1262458871]added [bug fixed] and confirmed to title[/mod]
Last edited by supercoe on 2010-11-11 23:25, edited 3 times in total.
http://www.chunkvnc.com - ChunkVNC - Free PC Remote control with the Open Source UltraVNC wrapper InstantSupport!
User avatar
supercoe
400
400
Posts: 1732
Joined: 2009-07-20 21:27
Location: Walker, MN
Contact:

Re: 1.0.8.2 SecureVNC -kill crash bug

Post by supercoe »

Just retested with the MSRC4Plugin_NoReg.dsm and the issue is gone.

Seems to only happen with the SecureVNC plugin.
http://www.chunkvnc.com - ChunkVNC - Free PC Remote control with the Open Source UltraVNC wrapper InstantSupport!
redge
1000
1000
Posts: 6797
Joined: 2004-07-03 17:05
Location: Switzerland - Geneva

Re: 1.0.8.2 SecureVNC -kill crash bug

Post by redge »

how do you crash the winvnc
I tried with securevncplugin and did'nt crash ?
did you test via repeater or direct connection ?
direct connection, no problem
UltraVNC 1.0.9.6.1 (built 20110518)
OS Win: xp home + vista business + 7 home
only experienced user, not developer
User avatar
supercoe
400
400
Posts: 1732
Joined: 2009-07-20 21:27
Location: Walker, MN
Contact:

Re: 1.0.8.2 SecureVNC -kill crash bug

Post by supercoe »

Sorry forgot to mention that I was using the latest repeater found here:

[topic=16510][/topic]
http://www.chunkvnc.com - ChunkVNC - Free PC Remote control with the Open Source UltraVNC wrapper InstantSupport!
redge
1000
1000
Posts: 6797
Joined: 2004-07-03 17:05
Location: Switzerland - Geneva

Re: 1.0.8.2 SecureVNC -kill crash bug

Post by redge »

sorry for the delay
I had experiend problem only when i use winvnc service and service_commandline=-autoreconnect ID:1234 host_repeater
then locally connect to server, logon and do add new client from winvnc systray to another ID on same repeater or direct reverse connection without ID
then kill client, winvnc close silently with error 1000 reported to eventvwr ...application.


do you have step by step and conditions ?
server: win7rtm build 6.1.7600 total clean (no software except uvnc)
UltraVNC 1.0.9.6.1 (built 20110518)
OS Win: xp home + vista business + 7 home
only experienced user, not developer
User avatar
supercoe
400
400
Posts: 1732
Joined: 2009-07-20 21:27
Location: Walker, MN
Contact:

Re: 1.0.8.2 SecureVNC -kill crash bug

Post by supercoe »

Did some more testing today:

1.0.8.2 Server and Viewer were used.
Repeater from here: [topic=16510][/topic]

Using latest SecureVNC http://adamwalling.com/SecureVNC/SecureVNCPlugin.dsm

1) Server connects to repeater.
2) Viewer connects to repeater.
3) Server process is closed by "winvnc.exe -kill"

This will cause the server to crash on exit.

The only way I could get it to close without crashing was to disconnect the viewer first then send the -kill command to the server.
http://www.chunkvnc.com - ChunkVNC - Free PC Remote control with the Open Source UltraVNC wrapper InstantSupport!
redge
1000
1000
Posts: 6797
Joined: 2004-07-03 17:05
Location: Switzerland - Geneva

Re: 1.0.8.2 SecureVNC -kill crash bug

Post by redge »

supercoe wrote: 1) Server connects to repeater.
2) Viewer connects to repeater.
3) Server process is closed by "winvnc.exe -kill"
little more detail about my test did not crash winvnc at all.
i tested with only 1 viewer connected to 1 server via repeater mode II

uvnc 1.0.8.2 at both side with ID:12345678 (example)
securevncplugin.dsm 1.0.2.0 both side., vnc authentication
(no authentication for viewer, winvnc reverse connect to repeater)


0. repeater108 mode II on win7rc as application port 5901 viewer + 5501 server
1. winvnc1 port 5500 ingoing win7rc connect to repeater108 port 5501
2. vncviewer1 port 5900 outgoing vista pro sp2 connect to repeater port 5901
3. winvnc1 systray... kill All clients, winvnc lock workstation as awaited
logon on my session again looking eventvwr, no crash of winvnc.

for test under same conditions of you except OS, I have only 1 XP

could you show me your ultravnc.ini except the 2 passwd
and your vncviewer "filename.vnc" or "options.vnc"

how does run your repeater108 ? application or service system for the test ?
UltraVNC 1.0.9.6.1 (built 20110518)
OS Win: xp home + vista business + 7 home
only experienced user, not developer
User avatar
supercoe
400
400
Posts: 1732
Joined: 2009-07-20 21:27
Location: Walker, MN
Contact:

Re: 1.0.8.2 SecureVNC -kill crash bug

Post by supercoe »

Thanks for your help redge, here is some more info on my setup:

Repeater108 running as application on XP SP3, port 5901 viewer 5500 server, mode II, ports forwarded from WAN.


1) Server is run on Vista SP2, connects to the repeater via command line:

Code: Select all

winvnc.exe -autoreconnect ID:1234 -connect myrepeater.no-ip.com -run
Here is my ultravnc.ini:

Code: Select all

[Permissions]
[admin]
service_commandline=-autoreconnect ID:4444 -connect REPEATER.IP.HERE
FileTransferEnabled=1
FTUserImpersonation=1
BlankMonitorEnabled=1
BlankInputsOnly=0
CaptureAlphaBlending=1
BlackAlphaBlending=1
DefaultScale=1
UseDSMPlugin=1
DSMPlugin=SecureVNCPlugin.dsm
primary=1
secondary=0
SocketConnect=1
HTTPConnect=0
XDMCPConnect=0
AutoPortSelect=1
InputsEnabled=1
LocalInputsDisabled=0
IdleTimeout=0
EnableJapInput=0
QuerySetting=2
QueryTimeout=10
QueryAccept=0
LockSetting=0
RemoveWallpaper=1
RemoveAero=1
DebugMode=0
Avilog=0
path=
DebugLevel=0
AllowLoopback=1
LoopbackOnly=0
AllowShutdown=1
AllowProperties=1
AllowEditClients=1
FileTransferTimeout=30
KeepAliveInterval=5
DisableTrayIcon=1
MSLogonRequired=0
NewMSLogon=0
ConnectPriority=0
[ultravnc]
passwd=
passwd2=
2) Viewer (Win7 RTM build 7600) is connected to repeater ID:1234 utilizing the SecureVNC plugin. At this point in time everything works great. I can even close the viewer and reconnect just fine.

3) With the viewer connected to the server I run the command line:

Code: Select all

winvnc.exe -kill
The server disconnects the viewer and then crashes, same result with the server on Win7 and XP.



It looks like you were connecting the viewer to the repeater first, I wonder if that makes a difference?

Keep in mind I'm running command line to uvnc with my AutoIt script ChunkVNC so I'm not clicking "Kill all clients".
http://www.chunkvnc.com - ChunkVNC - Free PC Remote control with the Open Source UltraVNC wrapper InstantSupport!
twagner
40
40
Posts: 74
Joined: 2008-09-09 20:43
Location: Germany

Re: 1.0.8.2 SecureVNC -kill crash bug

Post by twagner »

hi supercoe,

i think you have two mainoptions:

1. use a pre-shared key by using the SecureVNC-plugin (the vncwassword is to disregarded) or
2. don`t use a pre-shared key by using the SecureVNC-plugin (vncpassword is used).

1a. (standard pre-shared-key) you can build the option to use the SecureVNC-DSM Plugin with a pre-shared-key, so a third one can use a uvnc-session at the same time.(Of course, they must have the same pre-shared-key too). Public key used by the instantsupport.exe (winvnc.exe) programm, secret key used by the uvncviewer.
1b. (individual pre-shared-keys) or build the option in ChunkVNC to create there own key`s for every instantsupport.exe file(creation), the option could support the work if you know you have only one uvnc connection but it`s not so practical if you have to support more than two uvncserver, because every uvnc-session must be configured manual on the uvnc-viewer.exe by starting the uvncsession. (e.g. delete existing keys and copy the valid keys in the uvncviewer-folder, and more :()
2. (no pre-shared-keys) I think i`ve read in one of the threats of adam walling (builder of SecureVNC-Plugin) that the public and the secret-key were build by the securevnc-plugin with the salt(value?) of the vnc-password. If you haven`t set a vnc-passwort the securevnc-plugin couldn`t build a valid key. Take a good vnc standardpassword ;) with maximum 8 character (the RFB specification)

i hope i could help a little bit

bye and a happy new year 2010

twagner
Last edited by twagner on 2010-01-01 10:10, edited 1 time in total.
Die Welt geht Remote . . . . / the World goes remote . . . .
www.vnc-world.com
Writer of the first book about UltraVNC!!!
redge
1000
1000
Posts: 6797
Joined: 2004-07-03 17:05
Location: Switzerland - Geneva

Re: 1.0.8.2 SecureVNC -kill crash bug

Post by redge »

supercoe

Finally arrival to crash serverA ID:1234 running as application with securevncplugin on vista business sp2 6.0.6002

connectionB ID:4444 using securevncplugin still live and controllable

Problem signature:
Problem Event Name: APPCRASH
Application Name: winvnc.exe
Application Version: 1.0.8.2
Application Timestamp: 4b1bd19d
Fault Module Name: SecureVNCPlugin.dsm
Fault Module Version: 1.0.0.0
Fault Module Timestamp: 4ad49975
Exception Code: c0000005
Exception Offset: 00005829
OS Version: 6.0.6002.2.2.0.256.6
Locale ID: 4108
Additional Information 1: fd00
Additional Information 2: ea6f5fe8924aaa756324d57f87834160
Additional Information 3: fd00
Additional Information 4: ea6f5fe8924aaa756324d57f87834160


strange
if winvnc running as service system
Administrator: C:\Program Files\UltraVNC>winvnc -kill ==> no effect, nothing happen, connection still live and controllable


I did the same test of you for connection order
1. serverA application first connect to repeaterZ ID:1234
2. viewerA connect to repeaterZ ID:1234

1. serverB service system first connect to repeaterZ ID:4444
2. viewerB connect to repeaterZ ID:4444

i did locally on physical computer of vista where winvnc run ID:1234
C:\Program Files\UtraVNC\>winvnc -kill

------------------

this line below is for winvnc as application
winvnc.exe -autoreconnect ID:1234 -connect myrepeater.no-ip.com -run


this line below is for uvnc_service via ultravnc.ini (winvnc system service)

[admin]
service_commandline=-autoreconnect ID:4444 -connect REPEATER.IP.HERE

------------------------------------------
verjj wrote:two variables in reapeater.c
mystruct Servers[20];
mystruct Viewers[20];
not synconized in multi-thread.
maybe is the repeater cause:
success with msrc4plugin (dynamic (without rc4.key)(single thread)
fail with securevncplugin (dynamic key)(multi thread) crashing winvnc

reference:
[topic=16869][/topic]
UltraVNC 1.0.9.6.1 (built 20110518)
OS Win: xp home + vista business + 7 home
only experienced user, not developer
redge
1000
1000
Posts: 6797
Joined: 2004-07-03 17:05
Location: Switzerland - Geneva

Re: 1.0.8.2 SecureVNC -kill crash bug

Post by redge »

borrowed the bug of securevncplugin in direct connection (not used repeater)
you can crash winvnc just doing this basic test.

securevncplugin 1.0.2.0 both side

1.
pcA winvnc started as application command line
C:\Program Files\UltraVNC>start winvnc.exe -sc_exit -run

pcB vncviewer 1.0.8.2 connect to pcA winvnc 1.0.8.2

2a
pc1 start cmd ... winvnc -kill... viewer closed before UAC allowed, no crash, but privilege is overrided for kill the server !
or
2b
pc1 start cmd run as administrator... winvnc -kill... UAC continue... winvnc crash !


short: there 2 bugs in one only applicable for securevncplugin 1.0.2.0
(no problem with msrc4plugin 1.2.4.0, security credential respected)
-edit (no problem without dsmplugin, security credential respected)end-

1. (winvnc -kill (command executed before security credential)
2 (cmd run as administrator, winvnc -kill crash winvnc if securevncplugin used.
Last edited by redge on 2010-01-02 07:45, edited 1 time in total.
UltraVNC 1.0.9.6.1 (built 20110518)
OS Win: xp home + vista business + 7 home
only experienced user, not developer
User avatar
supercoe
400
400
Posts: 1732
Joined: 2009-07-20 21:27
Location: Walker, MN
Contact:

Re: 1.0.8.2 SecureVNC -kill crash bug

Post by supercoe »

Redge, since you can get it to crash without the repeater have we isolated the bug to SecureVNCPlugin.dsm? Do we need to notify Adam Walling?
http://www.chunkvnc.com - ChunkVNC - Free PC Remote control with the Open Source UltraVNC wrapper InstantSupport!
redge
1000
1000
Posts: 6797
Joined: 2004-07-03 17:05
Location: Switzerland - Geneva

Re: 1.0.8.2 SecureVNC -kill crash bug

Post by redge »

> have we isolated the bug to SecureVNCPlugin.dsm?
yes, is only SecureVNCPlugin


Do we need to notify Adam Walling?
yes

open source,
we need to wait ...adzm or any developer can fix the bug in the source code.

thank you for your patience.
UltraVNC 1.0.9.6.1 (built 20110518)
OS Win: xp home + vista business + 7 home
only experienced user, not developer
adzm
20
20
Posts: 63
Joined: 2009-04-29 18:59

Re: [bug] 1.0.8.2 SecureVNC -kill crash bug confirmed

Post by adzm »

Thanks for all the info everyone. I shall look into this as soon as I get a chance. I'll post any updates here.
adzm
20
20
Posts: 63
Joined: 2009-04-29 18:59

Re: [bug] 1.0.8.2 SecureVNC -kill crash bug confirmed

Post by adzm »

Thank you for all your help. I found the issue to be due to an attempt to encrypt data and send a packet in UltraVNC where the socket is closed. Normally this is not a problem, but was causing a crash since the pluton interface was released when the socket was closed. Regardless, I prevented the issue from within the plugin.

I'll release this tomorrow after some further testing. I'll post when it is done.
User avatar
supercoe
400
400
Posts: 1732
Joined: 2009-07-20 21:27
Location: Walker, MN
Contact:

Re: [bug] 1.0.8.2 SecureVNC -kill crash bug confirmed

Post by supercoe »

adzm,

Awesome!! You just made my day. :D
http://www.chunkvnc.com - ChunkVNC - Free PC Remote control with the Open Source UltraVNC wrapper InstantSupport!
B
800
800
Posts: 2338
Joined: 2009-09-09 14:05

Re: [bug] 1.0.8.2 SecureVNC -kill crash bug confirmed

Post by B »

Oh this is very good news. Thanks for your hard work, adzm!

(pluton interface??)
adzm
20
20
Posts: 63
Joined: 2009-04-29 18:59

Re: [bug] 1.0.8.2 SecureVNC -kill crash bug confirmed

Post by adzm »

Pluton interface! Awesome. I intended to say plugin, but once again I was thwarted by auto-spellcheck on a smart phone.

Anyway, here you go:

SecureVNC Plugin v2.2.0.0

x86 / 32-bit - SecureVNCPlugin.dsm
x64 / 64-bit - SecureVNCPlugin64.dsm
  • * Fixes crash due to UltraVNC host attempting to encrypt a buffer using the legacy method after the socket has been closed and interface has been freed.
    * Client authentication has been changed. If you are using client authentication, you must update both the server and the client to this version. Otherwise, this is backwards compatible with v1.0.2.0.
    * ARC4 is being phased out. If there is any interest in it, please let me know, but for now we shall only use AES.
    * OpenSSL 0.9.8n fixes issue that caused a significant delay initializing the pseudo-random number generator.
    * This build actually contains a significantly improved interface with various new features; however the functionality cannot be exposed until a new build of UltraVNC is created. More information will be posted here once this is ready.
Regarding the new features are that are waiting on a new build of UltraVNC...

Mostly I updated the plugin interface to provide much better integration with UltraVNC. This allows much easier debugging and provides lots of other benefits for the user. Specifically, being able to handle variable size challenge/responses and even multiple ones. This is actually implemented according to the RFB authentication specs. Some new features include supporting multiple keys for client auth, 256-bit AES encryption, the possibility of further configuration (eg blowfish or other algorithm selection), the ability to report error messages to UltraVNC, some interface changes to show encryption status, etc. Additionally, vncviewer can detect the current version of the SecureVNCPlugin and switch to using that mode, so servers that are not updated to the new SecureVNCPlugin and the (currently unreleased) build of UltraVNC can still be accessed by the (currently unreleased) build of vncviewer.

Also some minor unrelated fixes in UltraVNC as well, such as an incredibly annoying bug where copying text while the enter password dialog is up in vncviewer causes the connection to fail.

I'll have these changes merged into UltraVNC shortly and we can wait for Rudi to make an official build. If there is interest, I may put up an unofficial build for those who want to help test.
User avatar
supercoe
400
400
Posts: 1732
Joined: 2009-07-20 21:27
Location: Walker, MN
Contact:

Re: [bug] 1.0.8.2 SecureVNC -kill crash bug confirmed

Post by supercoe »

I'm a fan of unofficial builds. :D
http://www.chunkvnc.com - ChunkVNC - Free PC Remote control with the Open Source UltraVNC wrapper InstantSupport!
adzm
20
20
Posts: 63
Joined: 2009-04-29 18:59

Re: [bug] 1.0.8.2 SecureVNC -kill crash bug confirmed

Post by adzm »

supercoe wrote:I'm a fan of unofficial builds. :D
Well then, check it out:

http://adamwalling.com/SecureVNC

Make sure you get the new plugin build, too.

:twisted:
adzm
20
20
Posts: 63
Joined: 2009-04-29 18:59

Re: [bug fixed] 1.0.8.2 SecureVNC -kill crash bug confirmed

Post by adzm »

This is definitely resolved by the way, in case there was any doubt.
Last edited by adzm on 2010-11-11 23:23, edited 1 time in total.
Post Reply