Various licensing-related and Microsoft Office-related issues on Windows 10 and Servers when 0patch Agent is installed

Mitja Kolsek -

On Window 10 and Windows Servers 2012, 2016 and 2019, some users are reporting various licensing-related and Microsoft Office-related issues such as:

  • Software Protection Platform (sppsvc.exe) service failing to start
  • Outlook crashing with "corrupted mailbox" error
  • Licensed Office applications reporting being unlicensed
  • Office applications reporting errors at random times
  • Licensed Windows operating system reporting to be unlicensed
  • Non-Microsoft applications reporting licensing-related problems

These all have the common source, namely the first item on the above list: Software Protection Platform (sppsvc.exe) service seems to have a problem when 0patch Agent tries to inject its DLL into the process while the Code Integrity exploit mitigation checks for the signature on said DLL. The mitigation eventually prevents our DLL from injecting but it sometimes takes so long for that to happen that the service fails to start correctly. Unavailability of this service then causes all other problems listed above.

While we think the root cause of this issue is the Code Integrity mitigation being suboptimally implemented to delay a process start so significantly, there's nothing we can do about that, and since Code Integrity would not allow us to inject into sppsvc.exe anyway, our solution for this issue is to exclude sppsvc.exe from injection via 0patch Agent registry settings.

To exclude sppsvc.exe from injection, execute the following instructions on the affected computer as administrator once 0patch Agent is already installed (whether already registered or not).

 

PowerShell

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v ExcludeModules /t REG_SZ /d "sppsvc.exe" /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d $(Get-Random) /f
net stop 0patchService
net start 0patchService

 Command Prompt / cmd.exe

reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch /v ExcludeModules /t REG_SZ /d "sppsvc.exe" /f
reg add HKEY_LOCAL_MACHINE\SOFTWARE\0patch\CallbackKeys\UnloadLoaderDll /v Counter /t REG_DWORD /d %random%%random% /f
net stop 0patchService
net start 0patchService

 

 

Have more questions? Submit a request

0 Comments

Please sign in to leave a comment.