Nmap Development mailing list archives

Previous By Date Next
Previous By Thread Next

RE: Nmap 4.22SOC7 Released [bit.dll]

From: "Rob Nicholls" <robert () everythingeverything co uk>
Date: Fri, 12 Oct 2007 09:16:54 +0100
I managed to reproduce my error message. It looks to me like the error I was
seeing was caused by a Debug version of bit.dll that I'd accidentally
compiled instead of a Release version. So I think I've solved my error
message (bit.dll should be around 50KB, not well over 100KB, so it's easy to
spot the bad dll), but I'm not sure if that's any help resolving Lawrence's
specific 14001 error (which I can't seem to reproduce either).

Renaming bit.dll, or removing user permissions (so only SYSTEM has access,
for example), resulted in:

SCRIPT ENGINE: Initiating script scanning.
LUA INTERPRETER in \xxxx\nmap-4.22SOC7\nse_init.cc:711:
...tools\win32\soc7\scripts\dns-test-open-recu
rsion.nse:11: module 'bit' not found:
        no field package.preload['bit']
        no file 'C:\tools\win32\soc7\nselib\bit.lua'
        no file '.\bit.lua'
        no file 'C:\tools\win32\soc7\lua\bit.lua'
        no file 'C:\tools\win32\soc7\lua\bit\init.lua'
        no file 'C:\tools\win32\soc7\bit.lua'
        no file 'C:\tools\win32\soc7\bit\init.lua'
        no file 'C:\tools\win32\soc7\nselib\bit.dll'
        no file '.\bit.dll'
        no file 'C:\tools\win32\soc7\bit.dll'
        no file 'C:\tools\win32\soc7\loadall.dll'
SCRIPT ENGINE: Aborting script scan.

And if you rename the nselib folder:

SCRIPT ENGINE: Initiating script scanning.
SCRIPT ENGINE: nselib\ not a directory

SCRIPT ENGINE: Aborting script scan.

And if you rename the scripts folder:

SCRIPT ENGINE: Initiating script scanning.
SCRIPT ENGINE: Couldn't find 'scripts\'
.
SCRIPT ENGINE: Aborting script scan.

And empty folders result in:

SCRIPT ENGINE: Initiating script scanning.
LUA INTERPRETER in \xxxx\nmap-4.22SOC7\nse_init.cc:455: cannot open : No
such file or directory
SCRIPT ENGINE: Aborting script scan.

None of which are the error code that Lawrence sees, so I presume it must be
able to find and access bit.dll on his system, and the scripts and nselib
folders exist. Deleting/renaming bit.dll at least has the same line number
as Lawrence's error message.


Rob


-----Original Message-----
From: jah [mailto:jah () zadkiel plus com] 
Sent: 11 October 2007 22:21
To: 'nmap-dev'
Cc: lawrence.waterhouse () gmail com
Subject: Re: Nmap 4.22SOC7 Released [bit.dll]

bit.dll is required by only two of the nse scripts:
dns-test-open-recursion.nse
zoneTrans.nse

so i decided to do the following scan to make sure the script actually 
runs and that bit is called:
nmap -P0 -sS -p53 --script=zoneTrans.nse --script-trace -vv -d2 <target>

and it definitely runs.  So definitely no issue that I can reproduce.

Lawrence, are you running 32bit XP and what is your service pack level?  
And how do you fancy running Process Monitor 
<http://www.microsoft.com/technet/sysinternals/utilities/processmonitor.mspx



to capture nmaps hunt for bit.dll?

As a comparison with Robs ProcMon output (showing the hunt and then the 
finding of bit.dll):

IRP_MJ_CREATE    C:\Program Files\Nmap\nselib\bit.lua    NAME NOT FOUND
IRP_MJ_CREATE    C:\Program Files\Nmap\nselib\bit.lua    NAME NOT FOUND
IRP_MJ_CREATE    C:\Documents and Settings\jah\bit.lua    NAME NOT FOUND
IRP_MJ_QUERY_INFORMATION    C:\Documents and Settings\jah    SUCCESS   
IRP_MJ_CREATE    C:\Documents and Settings\jah\bit.lua    NAME NOT FOUND
IRP_MJ_CREATE    C:\Program Files\Nmap\lua\bit.lua    PATH NOT FOUND   
IRP_MJ_CREATE    C:\Program Files\Nmap\lua\bit.lua    PATH NOT FOUND   
IRP_MJ_CREATE    C:\Program Files\Nmap\lua\bit\init.lua    PATH NOT FOUND
IRP_MJ_CREATE    C:\Program Files\Nmap\lua\bit\init.lua    PATH NOT FOUND
IRP_MJ_CREATE    C:\Program Files\Nmap\bit.lua    NAME NOT FOUND
IRP_MJ_CREATE    C:\Program Files\Nmap\bit.lua    NAME NOT FOUND
IRP_MJ_CREATE    C:\Program Files\Nmap\bit\init.lua    PATH NOT FOUND   
IRP_MJ_CREATE    C:\Program Files\Nmap\bit\init.lua    PATH NOT FOUND   
IRP_MJ_CREATE    C:\Program Files\Nmap\nselib\bit.dll    SUCCESS



Rob Nicholls wrote:

SOC7 seems to work okay for me too. I tried "nmap -sC 192.168.x.x -vv"

with

other versions I have and SOC5 and SOC6 also work fine (or at least don't
crash).

However, I did come across an issue with a version of SOC6 (SVN rev 5916)
that I had previously compiled with VS.NET 2003, which popped up an error
message in Windows Vista (and logged the same text as an Application Popup
in the Event Log, with no more info to go on that I can see):

nmap.exe - Unable To Locate Component
This application has failed to start because MSVCR71D.dll was not
found. Re-installing the application may fix this problem.

This dll is apparently a debug version of msvcr71.dll, so I suspect I must
have built a debug version instead of a release version (something I'll

look

into later). And nmap said a similar (but not identical) error message to
what Lawrence saw:

SCRIPT ENGINE: Initiating script scanning.
LUA INTERPRETER in c:\xxxxxxxxxxxx\nmap-svn-
5916\nmap\nse_init.cc:698: error loading module 'bit' from file
'C:\tools\win32\
nmap-4.22SOC6-svn-5916\nselib\bit.dll':
        The specified module could not be found.

SCRIPT ENGINE: Aborting script scan.

I believe line 698 is the last line of:

      /* load the *.nse file, set the closure and execute (init) the test 
       * */
      SCRIPT_ENGINE_LUA_TRY(luaL_loadfile(l, filename));
      lua_pushvalue(l, -2);
      lua_setfenv(l, -2);
      SCRIPT_ENGINE_LUA_TRY(lua_pcall(l, 0, 0, 0));

This appears to be the very same line (711) as Lawrence saw in his SOC7
error message. Is this perhaps a problem encountered by people that have
compiled the binaries themselves? It's an odd one that I can't seem to
reliably reproduce: the very same version I had compiled worked fine on
another Vista machine and on a Windows 2003 machine (the latter was used

to

compile the binary).

I ran Process Monitor on the laptop (where I get the error message

mentioned

above) and noticed a few quirks:

I spotted it trying to access *nix locations for some random numbers:

4718  41:07.2 nmap.exe        4960    CreateFile      C:\dev\arandom
4719  41:07.2 nmap.exe        4960    CreateFile      C:\dev\urandom

Anyone know why it's doing that on Windows?

Then I saw it looking for "bit" related stuff (even though bit.lua and
init.lua don't appear to exist anywhere, including source code, nor do bit
or lua folders), followed by a desperate search for the (debug) dll I
mentioned:

CreateFile    C:\[snip]\svn-5916\nselib\bit.lua       NAME NOT FOUND
CreateFile    C:\[snip]\svn-5916\bit.lua      NAME NOT FOUND
CreateFile    C:\[snip]\svn-5916\lua\bit.lua  PATH NOT FOUND
CreateFile    C:\[snip]\svn-5916\lua\bit\init.lua     PATH NOT FOUND
CreateFile    C:\[snip]\svn-5916\bit.lua      NAME NOT FOUND
CreateFile    C:\[snip]\svn-5916\bit\init.lua PATH NOT FOUND
CreateFile    C:\[snip]\svn-5916\nselib\bit.dll       SUCCESS
CloseFile     C:\[snip]\svn-5916\nselib\bit.dll       SUCCESS
QueryOpen     C:\[snip]\svn-5916\nselib\bit.dll       FAST IO DISALLOWED
CreateFile    C:\[snip]\svn-5916\nselib\bit.dll       SUCCESS
QueryBasicInformationFile     C:\[snip]\svn-5916\nselib\bit.dll
SUCCESS
CloseFile     C:\[snip]\svn-5916\nselib\bit.dll       SUCCESS
CreateFile    C:\[snip]\svn-5916\nselib\bit.dll       SUCCESS
CloseFile     C:\[snip]\svn-5916\nselib\bit.dll       SUCCESS
QueryOpen     C:\[snip]\svn-5916\nselib\bit.dll       FAST IO DISALLOWED
CreateFile    C:\[snip]\svn-5916\nselib\bit.dll       SUCCESS
QueryBasicInformationFile     C:\[snip]\svn-5916\nselib\bit.dll
SUCCESS
CloseFile     C:\[snip]\svn-5916\nselib\bit.dll       SUCCESS
CreateFile    C:\[snip]\svn-5916\nselib\bit.dll       SUCCESS
CloseFile     C:\[snip]\svn-5916\nselib\bit.dll       SUCCESS
QueryOpen     C:\[snip]\svn-5916\MSVCR71D.dll FAST IO DISALLOWED
CreateFile    C:\[snip]\svn-5916\MSVCR71D.dll NAME NOT FOUND
QueryOpen     C:\Windows\System32\MSVCR71D.dll        FAST IO DISALLOWED
CreateFile    C:\Windows\System32\MSVCR71D.dll        NAME NOT FOUND
QueryOpen     C:\Windows\system\MSVCR71D.dll  FAST IO DISALLOWED
CreateFile    C:\Windows\system\MSVCR71D.dll  NAME NOT FOUND
QueryOpen     C:\Windows\MSVCR71D.dll FAST IO DISALLOWED
CreateFile    C:\Windows\MSVCR71D.dll NAME NOT FOUND
QueryOpen     C:\[snip]\svn-5916\MSVCR71D.dll FAST IO DISALLOWED
CreateFile    C:\[snip]\svn-5916\MSVCR71D.dll NAME NOT FOUND
QueryOpen     C:\Perl\bin\MSVCR71D.dll        FAST IO DISALLOWED
CreateFile    C:\Perl\bin\MSVCR71D.dll        NAME NOT FOUND
QueryOpen     C:\Windows\System32\MSVCR71D.dll        FAST IO DISALLOWED
CreateFile    C:\Windows\System32\MSVCR71D.dll        NAME NOT FOUND
QueryOpen     C:\Windows\MSVCR71D.dll FAST IO DISALLOWED
CreateFile    C:\Windows\MSVCR71D.dll NAME NOT FOUND
QueryOpen     C:\Windows\System32\wbem\MSVCR71D.dll   FAST IO DISALLOWED
CreateFile    C:\Windows\System32\wbem\MSVCR71D.dll   NAME NOT FOUND
QueryOpen     C:\[snip]\MSVCR71D.dll  FAST IO DISALLOWED
CreateFile    C:\[snip]\MSVCR71D.dll  NAME NOT FOUND
QueryOpen     C:\Program Files\Microsoft SQL
Server\90\Tools\Binn\MSVCR71D.dll     FAST IO DISALLOWED
CreateFile    C:\Program Files\Microsoft SQL
Server\90\Tools\Binn\MSVCR71D.dll     NAME NOT FOUND

I might try recompiling SOC6 and compiling SOC5 and SOC7 later tonight and
see what happens then. Hopefully someone will find something useful out of
all the above, as I can't see anything obvious!


Rob


-----Original Message-----
From: jah [mailto:jah () zadkiel plus com] 
Sent: 11 October 2007 18:40
To: nmap-dev
Subject: Re: Nmap 4.22SOC7 Released

I'm not seeing the issue with nmap installed in it's default location.
If I install nmap to an alternative location (with winpcap in the same 
place or in it's default), I also don't see the issue.
Scan was nmap -sC <target>

Here's error 14001 from winerror.h:
//
// MessageId: ERROR_SXS_CANT_GEN_ACTCTX
//
// MessageText:
//
//  This application has failed to start because the application 
configuration is incorrect. Reinstalling the application may fix this 
problem.
//
#define ERROR_SXS_CANT_GEN_ACTCTX        14001L

which doesn't say much to me, but there may be a clue in the Windows 
Application event log.

And for a windows strace, Process Monitor may be able to shed some light:


http://www.microsoft.com/technet/sysinternals/utilities/processmonitor.mspx


Christoph J. Thompson wrote:
  

On Thu, 11 Oct 2007 11:51:36 -0400
"Lawrence Waterhouse" <lawrence.waterhouse () gmail com> wrote:
  
    

Hi folks,

Platform is WinXP here, I am getting this error when launching a
Script Scan (-sC)

SCRIPT ENGINE: Initiating script scanning.
LUA INTERPRETER in ..\nse_init.cc:711: error loading module 'bit'
from file 'd:\ tools\nmap\nselib\bit.dll':
        system error 14001

Just verified with SOC6, had the same error.
    
      

Do you have access to strace or something like it on Windows so we can

see

    

where it's looking for bit.dll?
  

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org

--
This email has been verified as Virus free
Virus Protection and more available at http://www.plus.net

  
    


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org


--
This email has been verified as Virus free
Virus Protection and more available at http://www.plus.net

  


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org
Previous By Date Next
Previous By Thread Next

Current thread: