netbt.sys can cause bluescreen (XP)
My aim was to coerce the system to not bind port 445 (windows filesharing) to all local interfaces, by shutting down the driver, then binding my own service, and then starting it up. This way I thought I could then set up a tunnel to a remote windows machine. Instead I got a system crash.Steps to reproduce:1. go 'device manager', enable 'show hidden devices'2. go 'non-plug and play devices', 'netbios over tcp/ip', and set it to start on 'demand'3. restart systemnow4. occupy port 445 (say, netcat.exe -l -s 127.0.0.1 -p 445)5. start the 'netbios over tcp/ip' driver6. bluescreen.For reference, if step 4 is omitted, the driver starts correctly. Apparently someone forgot to check the return value of bind()...
November 13th, 2008 8:15pm

Ah, theultramage, you put me on the right track!!! Thank you!!!I tried your steps and couldn't get port 445 to unbind. Then, I realized that we shouldn't be looking at NetBT...we should be trying your approach with Smb.sys!!!!!I modified your steps slightly and voila: Port forwarding 445 for SMB functionality restored!!!1) Go to "Device Manager" select View and enable "show hidden devices."2) Expand "Non-Plug and Play Drivers" and set "Message-oriented TCP/IP and TCP/IPv6 Protocol (SMB session)" to start on demand.3) Reboot4) Bind port 445 with your application. I used Putty and bound my local loopback addresses on ports 139 and 445 to the tunneled IP addresses' ports 139 and 445 on the remote network.5) Start the "Message-oriented TCP/IP and TCP/IPv6 Protocol (SMB session)" driver.6) Browse the remote shares like you used to do before KB942624.6) Celebrate! We just found a way around the Port forwarding 445 for SMB and SSH problem!I tried this on two different Vista machines: One with the KB942624 patch applied and the other with SP1 integrated in. It worked on both. No blue screens or any other quirks that I could see.Only problem is that you must bind the port before starting SMB.sys each time you start Windows. You can't stop the device once it's started (or at least I couldn't).
Free Windows Admin Tool Kit Click here and download it now
November 16th, 2008 4:26am

Thanks for putting me on the right track too. Apparently I bookmarked the Vista section instead of the whole forum xDAccording to your steps, it looks like Microsoft corrected that silly driver crash in Vista. I guess I'll go check out the XP section then.I just wanted to point this thing out so perhaps some Microsoft tech would notice (no idea if there's any place to submit windows bugreports).For reference, the reason why I was messing with drivers was because no matter what I did, I couldn't get the standard "install loopback adapter / tunnel port 139" method to work. According to wireshark logs, the system still kept connecting to port 445, and I could not find any way to make it do otherwise.
November 16th, 2008 3:01pm

We've been trying to get them to "notice" this problem for a while (see here). They have been oddly silent. And, as you mentioned, there was no way to get the system to release port 445 so the previous "loopback adapter tunneling trick" would work.Originally, in XP, you only had to bind/tunnel port 139. XP would fall back to port 139 if there was no response on port 445. In Vista (and, I'm guessing, also in XP with KB942624 applied), you must bind/tunnel both 139 and 445. Microsoft changed the behavior so that it no longer falls back to 139 upon 445 failure.
Free Windows Admin Tool Kit Click here and download it now
November 16th, 2008 6:15pm

I found a way to get Windows XP SP3 to release its default binding on port 445. Look here.
November 29th, 2008 2:34am

Ah, theultramage, you put me on the right track!!! Thank you!!! I tried your steps and couldn't get port 445 to unbind. Then, I realized that we shouldn't be looking at NetBT...we should be trying your approach with Smb.sys!!!!! I modified your steps slightly and voila: Port forwarding 445 for SMB functionality restored!!! 1) Go to "Device Manager" select View and enable "show hidden devices." 2) Expand "Non-Plug and Play Drivers" and set "Message-oriented TCP/IP and TCP/IPv6 Protocol (SMB session)" to start on demand. 3) Reboot 4) Bind port 445 with your application. I used Putty and bound my local loopback addresses on ports 139 and 445 to the tunneled IP addresses' ports 139 and 445 on the remote network. 5) Start the "Message-oriented TCP/IP and TCP/IPv6 Protocol (SMB session) " driver. 6) Browse the remote shares like you used to do before KB942624. 6) Celebrate! We just found a way around the Port forwarding 445 for SMB and SSH problem! I tried this on two different Vista machines: One with the KB942624 patch applied and the other with SP1 integrated in. It worked on both. No blue screens or any other quirks that I could see. Only problem is that you must bind the port before starting SMB.sys each time you start Windows. You can't stop the device once it's started (or at least I couldn't). How do you bind port 445? Is it a command in command prompt. Im lost at that part. Im trying to create a startup batch file that allows me to launch putty whenever I want to access shared drives. Obviously it won't work unless that port bound for putty at startup. How do I do it?
Free Windows Admin Tool Kit Click here and download it now
August 23rd, 2009 5:18am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics