Re: NPPTools.dll missing error in Vista

["Rob Nicholls" <robert () everythingeverything co uk>]

I just tried installing the new 4.51BETA seup file and allowed it to
"upgrade" my WinPcap 4.1 Beta 2 with 4.0.2. Running nmap immediately
afterwards displays the NPPTools.dll message and this in nmap:
WARNING: Could not import all necessary WinPcap functions.  You may need
to upgrade to version 3.1 or higher from http://www.winpcap.org. 
Resorting to connect() mode -- Nmap may not function completely.

It's easily reproducible on my systems (and with nmap 4.50), and
definitely a bug in the nmap installer for WinPcap. I wouldn't be
surprised if the wrong version of packet.dll had crept in when nmap was
updated to install WinPcap 4.0.2, but even though the correct file is in
SVN (I did check), it still installs the wrong version.

I hadn't noticed before, partly because I tend to uncheck the WinPcap
option as I already have WinPcap installed, and partly because nmap skips
the WinPcap install if the same version is already present - the official
installer lets you force a reinstall of the same version. I tried 4.50 on
another Vista system of mine that still had WinPcap 4.0.0 and nmap
upgraded it to a broken version of 4.0.2.

> o Fixed Winpcap installer to install the right version of Packet.dll
>  on Windows Vista. [Fyodor]

The good news is I think I've worked out why it still hasn't been fixed!
The winpcap-nmap.nsi file appears to have a mistake.

To check it's installing the right packet.dll file on Vista, it does:

  ; Check windows version
  ReadRegStr $R0 HKLM "SOFTWARE\Microsoft\Windows NT\CurrentVersion"
VersionNumber

The thing is, that key doesn't exist on any of my copies of Vista! There
is, however, a CurrentVersion key that is on all my copies of Vista and
has the value 6.0 (and CurrentBuild of 6000 and CurrentBuildNumber of
6000).

Mind you, I believe Vista SP1 will change that to version 6.1 (I've got
the RC here, but wasn't planning on installing it, but perhaps I will just
to check what numbers it upgrades to), and I believe Windows 2008 also
uses 6.1 and should be out in something like Feb next year.

So I suggest, at the very least, we change line 110 to:

  ReadRegStr $R0 HKLM "SOFTWARE\Microsoft\Windows NT\CurrentVersion"
CurrentVersion

I'll give Vista SP1 RC a go in a bit (well, maybe once I wake up, it is
2AM here), and see about firing up whatever build of Windows 2008 I
currently have in a VM and install WinPcap/nmap on there, and let you know
if I have a better suggestion than using CurrentVersion, and if I think
it's worth doing a check for 6.1 too.

Anyway, in case anyone else gets the NPPTools.dll error on Vista, this is
probably why. I'd suggest pointing them in the direction of the official
installer for now, to force a reinstall of 4.0.2 with the correct
packet.dll.


Rob



_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org