PassFiltExTest.exe crashes with APPCRASH (c0000005) on Windows Server 2012 R2 after working for 1 year

[HuangJHong]

The issue is not only with PassFiltExTest.exe; in fact, the enhanced password policies originally implemented through this plugin are no longer usable on the actual domain controller.

Version: PassFiltEx_1.3.21.2
OS: Windows Server 2012 R2
Issue Type: Crash / Runtime Error

Describe the bug

PassFiltExTest.exe has been working normally for 1 year, but recently it started crashing immediately after entering a test password. The crash happens consistently when inputting any password (e.g., sw123456, sw134567).

To Reproduce

Steps to reproduce the behavior:

1. Open an Administrator: Windows PowerShell window.
2. Navigate to C:\Windows\System32:

   cd C:\Windows\System32

3. Run PassFiltExTest.exe:

   .\PassFiltExTest.exe

4. When prompted for Password:, enter any test password (e.g., sw134567).
5. The program crashes immediately with a "PassFiltExTest.exe has stopped working" dialog.

Expected behavior

The program should validate the password against the configured filter rules without crashing, as it did for the past year.

Actual behavior

The program crashes with an APPCRASH event, with the following details from Windows Event Viewer:

Fault bucket , type 0
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: PassFiltExTest.exe
P2: 0.0.0.0
P3: 67206910
P4: ntdll.dll
P5: 6.3.9600.20718
P6: 636f3964
P7: c0000005
P8: 000000000003d99e
P9: 
P10:

PassFiltExTest_crash.dmp

• Exception code: c0000005 (memory access violation / access denied)
• Faulting module: ntdll.dll (version 6.3.9600.20718)
• Fault offset: 0x000000000003d99e

Dependency Walker findings

Running Dependency Walker on PassFiltExTest.exe shows:

• Error: At least one required implicit or forwarded dependency was not found
• Warning: At least one delay-load dependency module was not found
• Missing private API DLLs (e.g., API-MS-WIN-SERVICE-PRIVATE-L1-1-1.DLL, API-MS-WIN-CORE-KERNEL32-PRIVATE-L1-1-1.DLL)

Environment

• OS: Windows Server 2012 R2 (build 6.3.9600.20718)
• PassFiltEx version: 1.3.21.2
• Execution context: Running as Administrator (elevated privileges)
• History: Worked correctly for 1 year; no intentional changes to the PassFiltEx configuration or system policy before the issue started.

Additional context

• The crash occurs only after entering a password; the program starts normally and displays the welcome message before the password prompt.
• The issue persists across reboots and multiple test passwords.
• No recent updates to PassFiltEx itself; the failure appeared spontaneously after normal operation.

Additional context

• I have successfully captured a full crash dump file using procdump64.exe for this failure:
  • Exception type: C0000005 ACCESS_VIOLATION (memory access violation)
  • Faulting module: ntdll.dll (version 6.3.9600.20718)
  • Fault offset: 0x000000000003d99e

Because I am not a native English speaker, this is machine translation, and I apologize if there are any expression errors.

PassFiltExTest_crash.dmp

[ryanries]

Thanks for the report and for sharing the memory dump. Unfortunately the memory dump looks pretty strange to me and isn't what I'd expect to see in an AV crash dump. To further reproduce the issue, I'd need to create a new 2012 R2 DC, but, I'd really rather see you use a supported version of Windows. 2012R2 isn't receiving new security updates anymore, so to be running a domain controller on 2012R2 is not a good idea. Sorry, I'm not trying to sell Windows licenses, but it's the truth.

[HuangJHong]

感谢你的报告和分享记忆转储。不幸的是，内存转储看起来很奇怪，也不是我预期的防毒崩溃转储。要进一步重现这个问题，我需要创建一个新的 2012 年 R2 DC，但我更希望你用的是支持的 Windows 版本。2012R2 不再接收新的安全更新，所以在 2012R2 上运行域控制器并不是个好主意。抱歉，我不是想卖 Windows 授权，但事实就是如此。

Thank you very much for taking the time to handle this. We will upgrade the domain controller server later.