If 0patch Agent applied at least one patch to the crashing application, you will find the application listed in the Applications page of the 0patch Console. The first thing to try is to exclude this application from patching by switching the button next to it in the list of applications. If this doesn't stop your application from crashing, continue reading.
Some processes (especially games) don't like 0patch DLL being injected into them, and react by crashing or misbehaving. If you want 0patch Agent to leave some of your processes alone (i.e., not even inject our loader into them), you can edit the registry value named HKLM\Software\0patch\ExcludeModules and list in it names of all executable (.exe) files you want excluded, separated by the pipe character ('|'). For example, to exclude calc.exe and notepad.exe from being injected by 0patch Agent, put "calc.exe|notepad.exe" into the said value. Then to enforce this new setting, you have to change the value of HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll\Counter to any other number than it already has, other than zero (this removes the loader from all processes), and restart the 0patch Service service.
To find out which executable file to exclude when your application is crashing, you can launch the Event Viewer and inspect the Windows Logs -> Application log, then find the "Application Error" event (event ID 1000) associated with your application. The executable file name of the process that crashed is listed in the details as shown below.
To exclude an application remotely or in bulk on multiple computers, you can use the following command-line scripts executed as administrator (examples are for notepad.exe, so replace that with whatever you need):
PowerShell
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v ExcludeModules /t REG_SZ /d "notepad.exe" /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d $(Get-Random) /f
net stop 0patchService
net start 0patchService
Command Prompt / cmd.exe
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v ExcludeModules /t REG_SZ /d "notepad.exe" /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d %random%%random% /f
net stop 0patchService
net start 0patchService
Comments
0 comments
Please sign in to leave a comment.