5.2.9.5 x64 causing ntdll.dll fault on WS2012R2

[miles267]

After much troubleshooting I’ve confirmed that Blue Iris x64 v5 is causing a memory leak with ntdll.dll in Windows Server 2012 R2. Am unable to complete a Windows Server Backup without the Block Level Backup Engine stopping consistently. With BI5 5.2.9.6 installed, wbengine.exe causes a fault in ntdll.dll. Immediately after uninstalling BI5 and the Visual C++ x86 package, the issue is resolved. I’ve spent a couple weeks troubleshooting until I was finally able to pinpoint the root cause.

Would be glad to provide any logs or help test any new app updates that address this ntdll.dll memory leak.

Thanks in advance.


Sent from my iPhone using Tapatalk

[MikeBwca]

Best practice would be to send BI support an email with the errors/logs.

[miles267]

Thanks Mike. I've submitted an email ticket per your advice. I hope that the developers of BI5 are able to patch this heap memory issue with ntdll.dll so that I, and others, can continue to use the app and have the security of Windows Backup (wbengine.exe).

[miles267]

Update -- I've reverted back to 5.0.0.41 and Visual C++ 2015-2019 x64 14.21.27702 and x86 14.24.28127 and the problem has gone away. I've confirmed that whichever VC++ libraries were introduced around May 1st have caused the ntdll.dll heap memory issues. I'm gradually updating one BI5 update at a time until I can identify the update that updates VC++. The latest VC+ package with BI5 causes memory leaks in Windows Server 2012 R2.

[Matts1984]

Any idea if that would translate to other editions of Windows Server?

I'm using Server 2019 and am on 5.2.9.6 currently. I'm not aware of any memory issues but perhaps I'm not the best at determining it either. I haven't noticed any noticeable changes in the amount of RAM being utilized.

FWIW, I'm using Server 2019 since MSFT offers it for free for "lab" use to anyone with a school/university email address. Fortunately my undergrad school gave out lifetime email accounts.

[miles267]

In my case on Windows Server 2012 R2, which I’ve been running for a long time, I noticed that my Windows Server Backup scheduled task stopped completing successfully around end of April. Just happened to check on it.

As this same box has been running BI and now BI5 for quite some time, I had assumed it was a device driver. That didn’t seem plausible since none had changed.

Through series of trial and error I found that one of the later BI5 updates with an updated VC++ library was causing wbengine.exe to appcrash with ntdll.dll becoming corrupted.

Yesterday I reverted back to a full BI 5.0.0.41 install with an older 2015-2019 VC++ library. No error. From there I’ve gradually applied BI5 updates and am now up to 5.2.6.2 with wbengine.exe working again. I know that somewhere between 5.2.6.2 and 5.2.9.5, the ntdll.dll corruption occurs but I’ve not yet pinpointed it. BI5 will run but wbengine.exe (Windows Server Backup) will not at that point.


Sent from my iPhone using Tapatalk