Author Topic: AIS Firewall Instability Problems Again (in 5.0.545)  (Read 9297 times)

0 Members and 1 Guest are viewing this topic.

Offline lukor

  • Avast team
  • Super Poster
  • *
  • Posts: 1885
    • AVAST Software
Re: AIS Firewall Instability Problems Again (in 5.0.545)
« Reply #15 on: May 18, 2010, 07:37:26 PM »
Mag,

there is something more you may try, if you are willing to do some test for me :-)

You can run the Firewall Service with more strict settings for allocating memory. This way, when a memory corruption occurs we might know about it sooner - and hopefully it will be easier to debug it.

If you want, please download the pageheap utility from here (originaly from Microsoft)
http://public.avast.com/~rypacek/pageheap.exe

Please download it and run with the following commandline:
pageheap /enable afwserv.exe

It case the Firewall Service crashes again, the memory dump created in the "logs" folder will point closely to the location where the corruption might have occured.

You can then disable the extra heap by:
pageheap /disable afwserv.exe

With this extra setup, afwserv would probably consume more memory that needed, so it should be used just during testing.

Even more advanced command line is this:
pageheap /enable afwserv.exe /debug

Now, when the crash occurs, there should appear a window for command line debugger. (see picture). The command I would like you to type here is:
.dump /ma c:\afwserv.dmp

This will create even more detailed dump for me to analyze :-) You can then exit the debugger windows by the q command.

Thanks a lot.
Lukas

EDIT: As I am looking at the screenshot I realize that for the /debug switch to work, you would probably need to have "Debugging Tools for Windows" installed. Which I don't want to trouble you with right now. If you would like to try just the pageheap /enable afwServ.exe test, it would help as well.
« Last Edit: May 18, 2010, 07:41:02 PM by lukor »

Offline mag

  • Advanced Poster
  • **
  • Posts: 740
Re: AIS Firewall Instability Problems Again (in 5.0.545)
« Reply #16 on: May 18, 2010, 08:23:14 PM »
Lukas,
Thanks - I'm happy to give this ago - but I may need a bit more help.

I downloaded pageheap OK to the desktop. That's when things get tricky for me - here's what I did:

First I clicked run as under XP and OK - that didn't seem to do anything I could see - but if it has please let me know how to undo it?

I then copied it C:\douments and settings\mag

Then from vague memories of dos I went to start, run, and typed cmd OK to get the black screen.

I then typed pageheap/enable afwserve.exe. after the prompt.

And absolutley nothing happened that I could see.

I tried again with a space after pageheap - same result.

Task manager shows nothing called pageheap

Is there any way I can tell if I have got pageheap running?


« Last Edit: May 18, 2010, 09:49:03 PM by mag »

Offline lukor

  • Avast team
  • Super Poster
  • *
  • Posts: 1885
    • AVAST Software
Re: AIS Firewall Instability Problems Again (in 5.0.545)
« Reply #17 on: May 19, 2010, 07:50:42 AM »
Hi, sorry for not providing more detailed steps.

It seems you have done most of the steps correctly. Runnng cmd and pageheap  /enable afwserv.exe -- with spaces. It does not display much, but if you run pageheap without any parameters it will display what is remembered, for example:

Code: [Select]
C:\Documents and Settings\lukas>pageheap
afwserv.exe: page heap enabled with flags (full traces )

C:\Documents and Settings\lukas>

And that's all. Now, all what remains is wait for the problem to occur. When it occurs, due to different setting for memory allocation for this process it will crash sooner and more info will be stored in the memory dump.

Oh! One thing I forgot: You have to restart firewall for the pageheap config to take place. Just stop it from the GUI and restart again, please!

Thanks for your help Mag.
Lukas.

Offline mag

  • Advanced Poster
  • **
  • Posts: 740
Re: AIS Firewall Instability Problems Again (in 5.0.545)
« Reply #18 on: May 19, 2010, 03:54:58 PM »
Hi Lukas,
I got pageheap running as requested, with the same command screen result as in your screendump.

Eventful!

At first everything was OK, then after a restart the firewall crashed, then for the first time, avast real time shields crashed completely.

I have posted four dump files, but the last three (from the avast crash) seem to be empty. The firewall crash dump is called MAGAFWPH (it looks to me to be the same file size as every other dump file I've posted though).

Hope it helps.

I'll leave pageheap running for a while longer to capture any more crashes.

PS - I notice that on my system pageheap just says ...flags (traces), not ...flags (full traces) as in your example. Is there something I need to do to configure it for full traces?
mag

PPS - Operator error - it seems I have had pageheap enabled for afwserve.exe, not afwserv.exe. I have now corrected, but there may be a delay in getting a useful firewall crash dump file.
« Last Edit: May 19, 2010, 05:58:43 PM by mag »

Offline lukor

  • Avast team
  • Super Poster
  • *
  • Posts: 1885
    • AVAST Software
Re: AIS Firewall Instability Problems Again (in 5.0.545)
« Reply #19 on: May 19, 2010, 06:15:48 PM »
Thanks a lot, waiting eagerly for the dumps!

If you are into it, there is one more setting that sets the guards pages in front and not after the overrun buffer, this might be worth a try as well - so far we don't know if buffers get overwritten at the front or at the end.

The command is:

pageheap /enable afwserv.exe /backwards


Offline mag

  • Advanced Poster
  • **
  • Posts: 740
Re: AIS Firewall Instability Problems Again (in 5.0.545)
« Reply #20 on: May 24, 2010, 06:43:12 PM »
Lukas,

Thought I'd provide a quick update on this (I haven't lost interest in it!)

There have been no more firewall crashes since I enabled pageheap on afwserv - not sure if that might make any sense to you?

I'll leave it enabled for another week or so, then diable it and see if the instability returns.

Offline lukor

  • Avast team
  • Super Poster
  • *
  • Posts: 1885
    • AVAST Software
Re: AIS Firewall Instability Problems Again (in 5.0.545)
« Reply #21 on: May 31, 2010, 07:52:31 PM »
Hi mag,

there was a bug found and fixed that might have been responsible for the Firewall service instability problems as well. Please see my resume here:
http://forum.avast.com/index.php?topic=60074.15

And thanks for help, I hope that would fix your crashes as well.

Lukas.

Offline mag

  • Advanced Poster
  • **
  • Posts: 740
Re: AIS Firewall Instability Problems Again (in 5.0.545)
« Reply #22 on: June 01, 2010, 06:23:05 PM »
Thanks Lukas. No more crash problems here so far. I have disabled pageheap.