Mozilla Firefox 73 can crash upon launching when 0patch Agent is installed

mitja.kolsek -

[Update 2/18/2020: Mozilla has released Firefox 73.0.1 which reportedly fixes the compatibility issue with 0patch and some other security products. If you implemented the steps for temporarily excluding Firefox from  injection by 0patch Agent, you can revert that as explained below.]

Mozilla Firefox 73 has a compatibility issue with 0patch Agent that can lead to Firefox silently crashing upon launching. This manifests itself in Firefox simply not launching when you try to run it, while the Application event log shows an Application Error (event ID 1000) for process firefox.exe.

We were initially made aware of this issue by a kind user involved with testing Firefox Nightly version 73, and tried to find a solution with the Firefox team. Apparently the new Firefox includes a functionality that requires hooking the LdrLoadDll Windows API function. Unfortunately, 0patch Agent also tries to do the same, and when Firefox wins the race, it doesn't crash but when 0patch wins the race, Firefox crashes.

You can see the issue tracked in Mozilla's Bugzilla: https://bugzilla.mozilla.org/show_bug.cgi?id=1604008

Users of Firefox may or may not be affected by this - if you see Firefox producing an Application Error in the Application event log, you can instruct 0patch Agent to exclude Firefox from injection via Registry.

 

Excluding Firefox from injection by 0patch Agent

As administrator, set the registry value HKLM\Software\0patch\ExcludeModules to "firefox.exe" (without quotes). Then to enforce this new setting without restarting your computer, change the value of HKLM\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll\Counter to any other number than it already has (this removes 0patch loader from all processes), and restart the 0patch Service.

This can be done using the following command-line script executed as administrator:

 PowerShell

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v ExcludeModules /t REG_SZ /d "firefox.exe" /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d $(Get-Random) /f
net stop 0patchService
net start 0patchService

 Command Prompt / cmd.exe

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v ExcludeModules /t REG_SZ /d "firefox.exe" /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d %random%%random% /f
net stop 0patchService
net start 0patchService

 

Re-including Firefox for injection by 0patch Agent

As administrator, set the registry value HKLM\Software\0patch\ExcludeModules to an empty string. Then to enforce this new setting without restarting your computer, change the value of HKLM\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll\Counter to any other number than it already has (this removes 0patch loader from all processes), and restart the 0patch Service.

This can be done using the following command-line script executed as administrator:

 PowerShell

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v ExcludeModules /t REG_SZ /d "" /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d $(Get-Random) /f
net stop 0patchService
net start 0patchService

 Command Prompt / cmd.exe

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v ExcludeModules /t REG_SZ /d "" /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d %random%%random% /f
net stop 0patchService
net start 0patchService
Have more questions? Submit a request

7 Comments

  • 0
    Avatar
    zanadew2

    This is exactly what happened to me. I followed the above directions and it allowed Firefox to execute. I realize this means for now, a zero day bug would be bad news, but Firefox is quick at fixing these issues. I will now consider a Pro license for Windows 7.

  • 0
    Avatar
    helpdesk

    WOWS - talk about fast responders!  I reported my issues late yesterday and already this solution has been brought to my attention directly from the Lead from 0Patch in nearly live email assistance.  Great help !

  • 0
    Avatar
    layne.marshal

    Why does my system tell me that I must "Specify valid numerical value for '/d' ?

  • 0
    Avatar
    Scott.perry

    I noticed that Firefox was not initializing properly on my machine either, but after reinitializing it a few extra times by clicking on my desktop Firefox icon while watching my Task-Manager processes, it started to behave normally.

    For now, would you recommend for me that I might just simply click a few extra times on the icon to get Firefox working, and meanwhile that I might wait until you have this ironed out behind the scenes?  Or would you recommend at this time that I actually do the work-around as listed above?

    Edited by Scott.perry
  • 0
    Avatar
    mitja.kolsek

    layne.marshal, our initial script only worked in cmd.exe, which failed when executed in PowerShell. We've updated the article to also contain a PowerShell script.

    Scott.perry, We noticed a similar behavior but that is not to be relied upon. Mozilla stated in their release notes that they would fix this issue in the next version but in the meantime, we recommend implementing the provided workaround (exclude firefox.exe in 0patch).

  • 0
    Avatar
    mobilesuit600

    Mozilla has released FF 73.0.1 to address the issue. Please show procedure on how to revert from the above 0patch Agent temporary (?) fix. Thanks.

     

     

  • 0
    Avatar
    mitja.kolsek

    mobilesuit600 Done, thanks.

Please sign in to leave a comment.