Jump to content
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble

MSFN is made available via donations, subscriptions and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, register and become a site sponsor/subscriber and ads will be disabled automatically. 


CyberyogiCoWindler

HELP: WinPcap installer fails on Win98SE

Recommended Posts

To download video streams I am trying to install "URL Snooper 2.37.01" on Windows 98SE (German language) with KernelEx 4.5.120. The program depends on the WinPcap driver and comes with versions 4.1.3 and 4.0beta2 - the latter is claimed to be compatible for Windows 98. Unfortunately both refuse to install.

The WinPCap website claims "Starting from WinPcap 4.0beta3, support for the Windows 9x/ME family of operating systems has been dropped. The last builds supporting such OSes are WinPcap 3.1 and WinPcap 4.0beta2, both available in the archive."

http://www.winpcap.org/install/default.htm

However when I attempt to install the self-extracting EXE of 4.0beta2, its NSIS installer exits with the error requester "This version of Windows is not supported by WinPcap 4.0 beta 2. The installation will be aborted."

When I tried to install version 3.1, the NSIS installer exits with the even stranger error popup "WinPcap 3.1 can be installed on 32-bit x86 systems only. The installation will be aborted" My CPU is an AMD K6-3+, which is definitely 32 bit x86 compatible.

So the last version that still installs on Win98SE is WinPcap 3.1beta4, which seems to contain a different installer. Unfortunately it is too old and makes URL Snooper lock up, so I had to uninstall it.

I have now manually unpacked the 4.0beta2-WinPcap.exe with 7zip. It contains the following directories and files:

\$PLUGINSDIRmodern-header.bmpmodern-wizard.bmpioSpecial.iniInstallOptions.dllNSISdl.dllnxs.dllSystem.dll\$R0\$PLUGINSDIRUserInfo.dll\$SYSDIRPacket.dllpthreadVC.dllWanPacket.dllwpcap.dllnpf.vxd\$SYSDIR\driversnpf.sys\$TEMPWpBann.htm
I copied the \$SYSDIR folder contents into "\windows\system", but I don't know what to do with the rest; it doesn't seem to be sufficient to work. Despite URL Snooper starts now (previously it complained missing Packet.dll) and shows the correct name of my USB ethernet adapter, the "sniff network" button triggers a popup requester "Automatic Network Adapter Detector FAILED | ERROR: Failed to find a suitable network driver."

When I debug the WinPcap 4.0beta2 installation process in Dependency Walker, before the popup it throws the error: "GetProcAddress(0xBFF70000 [e:\windows\system\KERNEL32.DLL], "GetUserDefaultUILanguage") called from "h:\download\utilities\videos downladen\winpcap\4.0BETA2-WINPCAP.EXE" at address 0x00405D06 and returned NULL. Error:" Apparently the NSIS installer is incompatible with Windows 98 because the function GetUserDefaultUILanguage in kernel32.dll exists only since Windows 2000. Also KernelEx settings don't seem to change this. So I added in kstub822.ini to the "[Kernel32.dll]" section the following line to simulate it:

[Kernel32.dll]...GetUserDefaultUILanguage=r0407 ; German language (added by =CO=Windler)...
I tried this also with "e0", which is apparently supposed to suppress an error flag.

[Kernel32.dll]...GetUserDefaultUILanguage=r0407e0 ; German language (added by =CO=Windler)...
But this doesn't do anything. Even DependencyWalker still shows the same "returned NULL" error. I am desperate. Is there a proper way to simulate GetUserDefaultUILanguage?

- How can I install the unpacked contents of 4.0beta2-WinPcap.exe manually?

Share this post


Link to post
Share on other sites

Unfortunately, KernelEx will only help you with software (ex. Firefox 3, Opera 11, Flash Player 10, etc.) that doesn't run natively on 95/98/Me; it will not work with 2K/XP drivers (such as those for WinPCap, printers, video cards, etc.) :(

Share this post


Link to post
Share on other sites

Make sure you don't have an unwanted compatibility setting for the installer. I have checked the 4.0 beta2 installer on my main system (official KernelEx 4.5.2) and it works without problems.

 

I've also tried to compile WinPcap 4.0 beta2 and after some fiddling it appears to have succeded. However there is no NSIS installer project in the sources so the actual changes are unknown. It does appear to modify a few registry keys but they don't seem critical to the daily usage. Useful files should be packet.dll and wpcap.dll (and maybe npf.vxd which I haven't been able to compile due to out of environment space errors). pthreadVC.dll, Wanpacket.dll and npf.sys appear to be NT-related so they wouldn't have any business on a 9x system.

Share this post


Link to post
Share on other sites

This is my DependencyWalker log file from profiling 4.0beta2-WinPcap.exe.

--------------------------------------------------------------------------------Starting profile on 15-01-29 at 02:31:09Operating System: Microsoft Windows 98 (32-bit), version 4.10.2222 A (Second Edition)Program Executable: h:\download\utilities\videos downladen\winpcap\4.0BETA2-WINPCAP.EXEProgram Arguments:Starting Directory: H:\Download\Utilities\Videos downladen\WinPCap\Search Path: E:\WINDOWS;E:\WINDOWS\COMMAND;E:\PROGRA~1\PROGRA~1\JAVA\JDK\JDK1.1.5\BIN;E:\WINDOWS;E:\WINDOWS;E:\WINDOWS\COMMAND;E:\WINDOWS;E:\WINDOWS\COMMAND;C:\S;C:\C;C:\WINDOWS;C:\WINDOWS\SYSTEM;C:\DOS;C:\EXPANS;C:\DEVS;C:\EXPANS\MOUSE;C:\EXPANS\ULTRASND;E:\PROGRA~1\GEMEIN~1\ULEADS~1\MPEG;E:\PROGRA~1\PROGRA~1\VISUAL~1.1\SOFTWARE\LIBOptions Selected:Simulate ShellExecute by inserting any App Paths directories into the PATH environment variable.Log DllMain calls for process attach and process detach messages.Hook the process to gather more detailed dependency information.Log LoadLibrary function calls.Log GetProcAddress function calls.Log debug output messages.Use full paths when logging file names.Automatically open and profile child processes.--------------------------------------------------------------------------------Started "h:\download\utilities\videos downladen\winpcap\4.0BETA2-WINPCAP.EXE" (process 0xFFF6BD2D) at address 0x00400000. Successfully hooked module.Loaded "e:\windows\system\VERSION.DLL" at address 0xBFE70000. Shared module not hooked.Loaded "e:\windows\system\OLE32.DLL" at address 0x65F00000. Successfully hooked module.Loaded "e:\windows\system\COMCTL32.DLL" at address 0xBFB70000. Shared module not hooked.Loaded "e:\windows\kernelex\KERNELEX.DLL" at address 0xBFA00000. Shared module not hooked.Loaded "e:\windows\kernelex\KEXBASEN.DLL" at address 0x7D000000. Successfully hooked module.Loaded "e:\windows\system\MSVCRT.DLL" at address 0x78000000. Successfully hooked module.Loaded "e:\windows\system\SHLWAPI.DLL" at address 0x70BD0000. Successfully hooked module.Loaded "e:\windows\system\SHELL32.DLL" at address 0x66800000. Successfully hooked module.Loaded "e:\windows\system\ADVAPI32.DLL" at address 0xBFE80000. Shared module not hooked.Loaded "e:\windows\system\GDI32.DLL" at address 0xBFF20000. Shared module not hooked.Loaded "e:\windows\system\USER32.DLL" at address 0xBFC00000. Shared module not hooked.Loaded "e:\windows\system\KERNEL32.DLL" at address 0xBFF70000. Shared module not hooked.Entrypoint reached. All implicit modules have been loaded.Injected "e:\programme\dependency walker\DEPENDS.DLL" at address 0x08370000.Loaded "e:\windows\kernelex\KEXBASES.DLL" at address 0xBFA40000. Shared module not hooked.DllMain(0x7D000000, DLL_PROCESS_ATTACH, 0x00000001) in "e:\windows\kernelex\KEXBASEN.DLL" called.DllMain(0x7D000000, DLL_PROCESS_ATTACH, 0x00000001) in "e:\windows\kernelex\KEXBASEN.DLL" returned 1 (0x1).DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in "e:\programme\dependency walker\DEPENDS.DLL" called.DllMain(0x08370000, DLL_PROCESS_ATTACH, 0x00000000) in "e:\programme\dependency walker\DEPENDS.DLL" returned 1 (0x1).DllMain(0x78000000, DLL_PROCESS_ATTACH, 0x00000001) in "e:\windows\system\MSVCRT.DLL" called.GetProcAddress(0xBFF70000 [e:\windows\system\KERNEL32.DLL], "IsProcessorFeaturePresent") called from "e:\windows\system\MSVCRT.DLL" at address 0x78001E3C and returned 0x9252D938.DllMain(0x78000000, DLL_PROCESS_ATTACH, 0x00000001) in "e:\windows\system\MSVCRT.DLL" returned 1 (0x1).DllMain(0x70BD0000, DLL_PROCESS_ATTACH, 0x00000001) in "e:\windows\system\SHLWAPI.DLL" called.DllMain(0x70BD0000, DLL_PROCESS_ATTACH, 0x00000001) in "e:\windows\system\SHLWAPI.DLL" returned 1 (0x1).DllMain(0x66800000, DLL_PROCESS_ATTACH, 0x00000001) in "e:\windows\system\SHELL32.DLL" called.DllMain(0x66800000, DLL_PROCESS_ATTACH, 0x00000001) in "e:\windows\system\SHELL32.DLL" returned 1 (0x1).DllMain(0x65F00000, DLL_PROCESS_ATTACH, 0x00000001) in "e:\windows\system\OLE32.DLL" called.DllMain(0x65F00000, DLL_PROCESS_ATTACH, 0x00000001) in "e:\windows\system\OLE32.DLL" returned 1 (0x1).GetProcAddress(0xBFC00000 [e:\windows\system\USER32.DLL], "GetSystemMetrics") called from "e:\windows\system\SHELL32.DLL" at address 0x66809285 and returned 0x9252DA28.GetProcAddress(0xBFC00000 [e:\windows\system\USER32.DLL], "MonitorFromWindow") called from "e:\windows\system\SHELL32.DLL" at address 0x6680929A and returned 0x9252DA38.GetProcAddress(0xBFC00000 [e:\windows\system\USER32.DLL], "MonitorFromRect") called from "e:\windows\system\SHELL32.DLL" at address 0x668092AF and returned 0x9252DA48.GetProcAddress(0xBFC00000 [e:\windows\system\USER32.DLL], "MonitorFromPoint") called from "e:\windows\system\SHELL32.DLL" at address 0x668092C4 and returned 0x9252DA58.GetProcAddress(0xBFC00000 [e:\windows\system\USER32.DLL], "EnumDisplayMonitors") called from "e:\windows\system\SHELL32.DLL" at address 0x668092D9 and returned 0x9252DA68.GetProcAddress(0xBFC00000 [e:\windows\system\USER32.DLL], "GetMonitorInfoA") called from "e:\windows\system\SHELL32.DLL" at address 0x668092EE and returned 0x9252DA78.LoadLibraryA("OLE32.DLL") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FEBE.LoadLibraryA("OLE32.DLL") returned 0x65F00000.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "RegisterDragDrop") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FED6 and returned 0x65F031EC.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "RevokeDragDrop") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FEE3 and returned 0x65F0314B.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "OleInitialize") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FEF0 and returned 0x65F2132B.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "OleUninitialize") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FEFD and returned 0x65F39A84.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "StgCreateDocfile") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FF0A and returned 0x65F16DD0.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "StgOpenStorage") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FF17 and returned 0x65F10A6A.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "OleQueryLinkFromData") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FF24 and returned 0x65F38AF3.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "OleQueryCreateFromData") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FF31 and returned 0x65F2C668.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "OleGetClipboard") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FF3E and returned 0x65F3F540.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "OleSetClipboard") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FF4B and returned 0x65F04F53.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "OleFlushClipboard") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FF58 and returned 0x65F39C48.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "DoDragDrop") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FF65 and returned 0x65F57F5D.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "GetClassFile") called from "e:\windows\system\SHELL32.DLL" at address 0x6680FF72 and returned 0x65F5A866.GetProcAddress(0x65F00000 [e:\windows\system\OLE32.DLL], "CoGetMalloc") called from "e:\windows\system\SHELL32.DLL" at address 0x66801986 and returned 0x65F0E098.----> This is where the error requester pops up:GetProcAddress(0xBFF70000 [e:\windows\system\KERNEL32.DLL], "GetUserDefaultUILanguage") called from "h:\download\utilities\videos downladen\winpcap\4.0BETA2-WINPCAP.EXE" at address 0x00405D06 and returned NULL. Error:Loaded "e:\programme\antivirus\avast4\software\ASWIDLE.DLL" at address 0x64A00000. Successfully hooked module.----> This is where I click OK to exit.DllMain(0x64A00000, DLL_PROCESS_ATTACH, 0x00000000) in "e:\programme\antivirus\avast4\software\ASWIDLE.DLL" called.DllMain(0x64A00000, DLL_PROCESS_ATTACH, 0x00000000) in "e:\programme\antivirus\avast4\software\ASWIDLE.DLL" returned 1 (0x1).DllMain(0x64A00000, DLL_PROCESS_DETACH, 0x00000001) in "e:\programme\antivirus\avast4\software\ASWIDLE.DLL" called.DllMain(0x64A00000, DLL_PROCESS_DETACH, 0x00000001) in "e:\programme\antivirus\avast4\software\ASWIDLE.DLL" returned 1 (0x1).DllMain(0x65F00000, DLL_PROCESS_DETACH, 0x00000001) in "e:\windows\system\OLE32.DLL" called.DllMain(0x65F00000, DLL_PROCESS_DETACH, 0x00000001) in "e:\windows\system\OLE32.DLL" returned 1 (0x1).DllMain(0x66800000, DLL_PROCESS_DETACH, 0x00000001) in "e:\windows\system\SHELL32.DLL" called.DllMain(0x66800000, DLL_PROCESS_DETACH, 0x00000001) in "e:\windows\system\SHELL32.DLL" returned 1 (0x1).DllMain(0x70BD0000, DLL_PROCESS_DETACH, 0x00000001) in "e:\windows\system\SHLWAPI.DLL" called.DllMain(0x70BD0000, DLL_PROCESS_DETACH, 0x00000001) in "e:\windows\system\SHLWAPI.DLL" returned 1 (0x1).DllMain(0x78000000, DLL_PROCESS_DETACH, 0x00000001) in "e:\windows\system\MSVCRT.DLL" called.DllMain(0x78000000, DLL_PROCESS_DETACH, 0x00000001) in "e:\windows\system\MSVCRT.DLL" returned 1 (0x1).DllMain(0x08370000, DLL_PROCESS_DETACH, 0x00000001) in "e:\programme\dependency walker\DEPENDS.DLL" called.DllMain(0x08370000, DLL_PROCESS_DETACH, 0x00000001) in "e:\programme\dependency walker\DEPENDS.DLL" returned 1 (0x1).DllMain(0x7D000000, DLL_PROCESS_DETACH, 0x00000001) in "e:\windows\kernelex\KEXBASEN.DLL" called.DllMain(0x7D000000, DLL_PROCESS_DETACH, 0x00000001) in "e:\windows\kernelex\KEXBASEN.DLL" returned 1 (0x1).Exited "h:\download\utilities\videos downladen\winpcap\4.0BETA2-WINPCAP.EXE" (process 0xFFF6BD2D) with code 2 (0x2).

Share this post


Link to post
Share on other sites

I see an antivirus popping up right after the error. Try disabling the antivirus while installing WinPcap.

 

I'm getting the same error on GetProcAddress - GetUserDefaultUILanguage, but it just goes on past that. It loads OLEAUT32.DLL, calls a few API in OLEAUT32 and OLE32 then it pops up a messagebox (in my case) saying it's already installed on this machine and if I want to force or abort the installation.

 

Yours being a German system should be the last on the list of possible reasons. Rather the antivirus or an incorrect OLE component installation/registration may be the reason.

Share this post


Link to post
Share on other sites

I already disabled the antivirus scan during installation. The Avast antivirus line appears in DependencyWalker *after* the error already has popped up. I also have ZoneAlarm Antivirus running as a firewall (outdated antivirus part disabled). I hope this won't generally prevent WinPcap from working.

Share this post


Link to post
Share on other sites

Depends doesn't know about KernelEx and is generally incompatible with it. Because Depends is hooking various apis in order to profile, I think you need to set the Kex compatibility modes on Depends as well as on the app being profiled.

Share this post


Link to post
Share on other sites

One thing I noticed: the return value for GetUserDefaultUILanguage() should be a hex value, so please try

[Kernel32.dll]...GetUserDefaultUILanguage=r0x0407e0

Please note that the above will only work in compatibility 'Windows ME' or higher. However, I have not used any compatibility mode for the installer other than KernelEx's default and the package still installed correctly.

 

Other than that, it it is still possible that some module of the AV (or even ZoneAlarm which had its bad days - search these forums, you'll find details) could interfere with the installation process, even when disabled.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×