Illegal Operation message under W98SE

[porterml]

I've just installed URL Snooper on my 2 networked w98Se PC's which access a broadband link via a netgear 814 router. On both machines the program has run fine the first time I loaded it. Every subsequent run I then get a notice about an illegal operation with the following data (from the most recent failure)

URLSNOOPER caused an invalid page fault in
module URLSNOOPER.EXE at 0197:00403d29.
Registers:
EAX=009dfdcc CS=0197 EIP=00403d29 EFLGS=00010207
EBX=00000000 SS=019f ESP=009dfd7c EBP=009dfdb4
ECX=009dfe00 DS=019f ESI=00000010 FS=48bf
EDX=00000000 ES=019f EDI=009df840 GS=3066
Bytes at CS:EIP:
8b 93 f0 02 00 00 52 e8 7b b1 10 00 59 ba 9a 78
Stack dump:
00000010 009dfdc0 009dfdcc 005a9d37 00607f4c 009dfd7c 00000000 00570500 009dfdcc 00000000 009dfdb8 00000000 00607034 81960dae 009dfe00 00401e65

Having read the reply to the post about an EAAccess problem I have tried deleting WinPcap and re-installing from their web site but still got the problem. Restarting the system doesn't fix it either. Any ideas what's wrong?

[mouser]

i have heard of someone else with windows98 having this problem or else not having it work with winpcap.. i wish i understood more about what the problem is.. im pretty sure its a winpcap issue but i dont know how to address it..

ah here is a way to learn more:
can you try downloading another demo app from winpcap site, or another tool that uses winpcap, and see if the problem is there as well:
http://www.winpcap.org/misc/links.htm

[porterml]

Thanks for the very fast reply. I'm just about to take the big leap into the 21st Century and get an XP system so rather than put anything else onto an already creaking base I'll wait till I've got the XP machine and then re-install.

[rjisinspired]

I'm getting the same error.  The error dialog comes up three times, twice for the program and one in kernel32.dll.  The program will work fine the first time but after that it won't.

I have a few programs that exclusively use winpcap and they work fine: wmrecorder and two packetanaylizers.  I'm not able to find the problem but from the errors I had received I'm thinking maybe the program may not be totally 98 compatible.  Ususally you would get an error about a missing export or entry point but not in this case, which would indicate a possible incompatibility with OS's.

I'm on 98 and don't prefer to switch although the highest I will go is win 2000.  I am comfortable with 98 and I don't have as many problems as a lot of people have, I know my sysytem like the back of my hand.  For what I do, 98 works for me and it's small, fast and stable for me.  I don't like XP, home or pro, at all.

If I can find anything related to this problem I'll post back.  In situations like these type of errors, usually it is a compatibility issue of some form.

[mouser]

i will try testing url snooper under win9x and see what i can find.

[rjisinspired]

Thanks Mouser.

In FileMon I noticed there were "notfound" results for a file called "lixtheme.dll"  This file is not in the main program's file folder, nor is it anywhere on the computer.  There were "notfound" results for some components; being they were not located in the same folder as the program but were later found succesfully in the windows system folder.

Before the third and final error, which is the kernel32 error, urlsnoop has requested the path "C:\windows\win.ini" for seek and reading though I found no entry in win.ini for urlsnoop.  I was thinking that wouldn't be necessary since the program writes an ini file all it's own in it's own folder to save settings.

I saved the log file if you would like to examine it.

edit-  I ran FileMon again and the win.ini wasn't shown before the error.  Now I don't have any clues.

[rjisinspired]

I noticed the initial poster didn't report a kernel error so I'll post mine:

URLSNOOPER caused an exception c0000026H in module KERNEL32.DLL at 0167:bffc04d4.
Registers:
EAX=00000000 CS=0167 EIP=bffc04d4 EFLGS=00000202
EBX=00000000 SS=016f ESP=00a2fb7c EBP=00a2fb8c
ECX=00a2fbc8 DS=016f ESI=00a2fab8 FS=39ff
EDX=00a2fc80 ES=016f EDI=81992f58 GS=0000
Bytes at CS:EIP:
5d 5f 5e 5b 8b e5 5d c3 8b 4c 24 04 f7 41 04 06
Stack dump:
00a2fb8c bff79138 00000000 00a2ff68 00a2fbb0 bffc0613 00a2ff68 00a2fbb0 00a2fc80 81992f58 00a2ff68 00a2fc80 00a2fc9c 00a2fbd4 bff76849 00a2fc80

update - Found a site full of exceptions and meanings:
C0000026h – Exception code used by the system during exception handling. This code might be used if the system encounters an unexpected return from a handler. It is also used if no Exception Record is supplied when calling RtlUnwind.

[mouser]

the clue that you have other programs that use winpcap is a big clue.
there is really nothing else in url snooper that i can think of that should be incompatible with win9x, so as long as winpcap is working it should work.

the fact that it runs fine the first time is an interesting clue, like maybe the error has to do with loading the configuration file.

i am going to investigate this weekend - if i can't find anything i will ask your help in testing some theories.

[rjisinspired]

Sounds good.  I'll keep playing around with it.  I like challenges :-)

[rgw825]

I also have this problem. Do the older versions have this problem? And where i could find them?

[Magister Ludi]

Try this:
Rename the installation directory of URLSnooper before you start it again. It sounds like voodoo and is quite uncomfortable, but it works (for me).

[Rekrul]

I just downloaded the lastest version of URL Snooper the other day and installed it tonight. I'm also using Windows 98SE and the same thing happens when I run it; It works fine the first time, then it refuses to start.

To verify that Winpcap wasn't to blame, I installed an older version of URL Snooper, 1.0b6, and it works fine. No crashes at all.

I was hoping to be able to use the new version (and have a keyword search that finally worked correctly), but I guess I'll be sticking to the older versions for now.

[mouser]

old version works!??
ok that's a *huge* clue.
now it sounds like it's probably something really stupid.

i've been putting off updated url snooper for a bit because i'm waiting to make an update for an IE7 issue, but i'm going to work on this in the next week or two.  please remind me if i don't.  thanks for the reports.

[Rekrul]

old version works!??
ok that's a *huge* clue.

Yes. In fact, I have a couple different versions that I've collected and all the ones I tried worked fine with the latest Winpcap. Note that these were all 1.x versions. The only 2.x version I have is the most recent one.