1Password gets into a bad state if master password is entered incorrectly into Secure Desktop

jamiseichenauer · October 2016

I have Browsers tab configured with
Unlock on Secure Desktop
and
When unlocking the application, also unlock 1Password in the browser
both checked.

If I fail to enter the correct master password on the UAC screen, I am returned to the desktop with 1Password open with the red failed screen. If I enter my password directly into 1Password (non UAC) 1Password gets into a bad state and starts throwing errors. I have to kill the process to get it back into a good state. It seems to not return to Secure Desktop if a password is entered incorrectly or some other Explorer related item is causing an issue.

Exception:

2.1 Date : Thu, 13 Oct 2016 12:39:54 -0400
2.2 Address : 004E05B4
2.3 Module Name : 1Password.exe - (1Password)
2.4 Module Version: 4.6.1.616
2.5 Type : EInvalidOperation
2.6 Message : Cannot change Visible in OnShow or OnHide.
2.7 ID : 9D8A
2.8 Count : 1
2.9 Status : New
2.10 Note :

User:

3.5 Privileges: SeShutdownPrivilege - OFF
SeChangeNotifyPrivilege - ON
SeUndockPrivilege - OFF
SeIncreaseWorkingSetPrivilege - OFF
SeTimeZonePrivilege - OFF

Active Controls:

4.1 Form Class : ApolloRuntimeContentWindow
4.2 Form Text : YNAB 4 v4.3.857 - My Budget
4.3 Control Class:
4.4 Control Text :

Custom Information:

8.2 Dropbox installed : Yes
8.7 License status : SUCCESS
8.8 Internet Explorer : C:\Program Files\Internet Explorer\IEXPLORE.EXE
8.9 Internet Explorer version : 11.0.9600.18500
8.10 Internet Explorer extension: Not installed
8.11 Mozilla Firefox : C:\Program Files (x86)\Mozilla Firefox\firefox.exe
8.12 Mozilla Firefox version : 49.0.1
8.13 Mozilla Firefox extension : Not installed
8.14 Google Chrome : C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
8.15 Google Chrome version : 54.0.2840.59
8.16 Google Chrome extension : Installed (version 4.6.1.90)
8.17 Apple Safari : does not exist.
8.18 Apple Safari extension : Not installed
8.19 Apple Bonjour : Installed (version 3331800)
8.20 1Password Language : English

Assembler Information:

; Forms.TCustomForm.CMShowingChanged (Line=5415 - Offset=1)
; ---------------------------------------------------------
004E058C mov eax, [ebp-$04]
004E058F test byte ptr [eax+$0358], $04
004E0596 jz Forms.TCustomForm.CMShowingChanged (Line=5417)
;
; Line=5416 - Offset=2
; --------------------
004E0598 lea edx, [ebp-$08]
004E059B mov eax, dword ptr [$86A6A8]
004E05A0 call -$000D8679
004E05A5 mov ecx, [ebp-$08]
004E05A8 mov dl, $01
004E05AA mov eax, dword ptr [EInvalidOperation]
004E05AF call -$000CD7B0
004E05B4 call -$000DB471 ; <-- EXCEPTION
;
; Line=5417 - Offset=3
; --------------------
004E05B9 mov eax, dword ptr [$8738E8]
004E05BE call Forms.TApplication.UpdateVisible
;
; Line=5418 - Offset=4
; --------------------
004E05C3 mov eax, [ebp-$04]
004E05C6 or byte ptr [eax+$0358], $04
;
; Line=5419 - Offset=5
; --------------------
004E05CD xor edx, edx
004E05CF push ebp
004E05D0 push $004E0BA8 ; 'é÷Còÿëî3ÀZYYd‰.hÌ.N'
004E05D5 push dword ptr fs:[edx]
004E05D8 mov fs:[edx], esp
;
; Line=5420 - Offset=6
; --------------------
004E05DB mov eax, [ebp-$04]

Registers:

EAX: 09242800 EDI: 031C0030
EBX: 0018DE20 ESI: 031C0030
ECX: 09242800 ESP: 0018DC60
EDX: 004E05B9 EIP: 004E05B4

Stack: Memory Dump:
------------------ ---------------------------------------------------------------------------
0018DC60: 0018DE3C 0495AA90: E8 8F 4B F2 FF A1 E8 38 87 00 E8 D5 53 00 00 8B ..K....8....S...
0018DC64: 00405024 0495AAA0: 45 FC 80 88 58 03 00 00 04 33 D2 55 68 A8 0B 4E E...X....3.Uh..N
0018DC68: 0018DC80 0495AAB0: 00 64 FF 32 64 89 22 8B 45 FC F6 40 1C 10 0F 85 .d.2d.".E..@....
0018DC6C: 031C0030 0495AAC0: 7A 05 00 00 8B 45 FC 80 B8 DA 01 00 00 00 0F 84 z....E..........
0018DC70: 031C0030 0495AAD0: 5E 04 00 00 33 C0 55 68 1C 06 4E 00 64 FF 30 64 ^...3.Uh..N.d.0d
0018DC74: 0018DE20 0495AAE0: 89 20 8B 45 FC 66 BE AB FF E8 BA 43 F2 FF 33 C0 . .E.f.....C..3.
0018DC78: 00000000 0495AAF0: 5A 59 59 64 89 10 EB 17 E9 CF 46 F2 FF 8B 55 FC ZYYd......F...U.
0018DC7C: 031C0030 0495AB00: A1 E8 38 87 00 E8 0E 49 00 00 E8 91 4B F2 FF 8B ..8....I....K...
0018DC80: 0018DDAC 0495AB10: 45 FC 80 B8 78 02 00 00 04 74 20 8B 45 FC 80 B8 E...x....t .E...
0018DC84: 004C505E 0495AB20: 78 02 00 00 06 0F 85 F3 00 00 00 8B 45 FC 80 B8 x...........E...
0018DC88: 031C0030 0495AB30: 77 02 00 00 01 0F 85 E3 00 00 00 8B 45 FC 80 B8 w...........E...
0018DC8C: 00000000 0495AB40: 77 02 00 00 01 75 3A A1 E8 38 87 00 8B 40 44 E8 w....u:..8...@D.
0018DC90: 0018DE20 0495AB50: 98 2C FE FF 8B D8 8B 45 FC 2B 58 48 D1 FB 79 03 .,.....E.+XH..y.
0018DC94: 0018DEA8 0495AB60: 83 D3 00 A1 E8 38 87 00 8B 40 44 E8 C0 2C FE FF .....8...@D..,..
0018DC98: 00000001 0495AB70: 8B F0 8B 45 FC 2B 70 4C D1 FE 79 37 83 D6 00 EB ...E.+pL..y7....
0018DC9C: 0112BFA0 0495AB80: 32 A1 EC 38 87 00 E8 11 1A 00 00 8B D8 8B 45 FC 2..8..........E.

DouweAG · October 2016

Thanks for contacting us about the issue you are experiencing.

Please share your 1Password diagnostics reports with us so we may shed some more light on what may be occurring in the background. Here are the instructions on how to do so:

Open and unlock 1Password;
Select 'Help -> Diagnostics Report > Export to File';
Save the file to your desktop;
Create an email and to support+windows@agilebits.com;
Attach the file and write a description of the problem.

Please include a link to this thread in your email, along with your forum handle so we can relate the two. You should receive an automated response. Please post the reference number here so that we can 'connect the dots' :)

I look forward to your reply!

jamiseichenauer · October 2016

I sent the diagnostics report to support+windows@agilebits.com but I have not received an automated response yet. I will keep an eye out. 8-) Thank you for taking a look.

AlexHoffmann · October 2016

We'll be standing by. Sorry for the inconvenience.

Please let us know if we can do anything for you in the meantime.

Cheers,

Alex

jamiseichenauer · October 2016

Hi Alex / Douwe,

The support ticket is [#TNR-82593-999]

AlexHoffmann · October 2016

Thank you @jamiseichenauer,

We're going to take a look at it and respond as soon as possible.

Cheers and have a great weekend!

Alex

jamiseichenauer · November 2016

Hi Alex,

I have captured a full memory dump of 1password.exe after it entered this hung state. Can you have support reach out to me again or provide me with a secure way to upload the memory dump so it can be passed to engineering?

AGAlumB · November 2016

I'm not sure that a full memory dump is appropriate — or a good idea, since that would likely contain a lot of sensitive information, depending on what was running at the time. I see you've already sent an email, so we can continue the conversation there. We'll take a look and get back to you shortly.

ref: TNR-82593-999

jamiseichenauer · November 2016

Hi brenty,

Sorry, I meant to clarify, a dump of 1Password.exe, not of the entire memory space. I can change my passwords again after sending you the dump in case any were in memory.

MikeT · November 2016

Hi @jamiseichenauer,

Thanks for writing back, as a policy, we cannot and will not accept any memory dumps, it is too risky and you should not create memory dumps in the first place.

In addition, a memory dump doesn't help our developers, it is too noisy and doesn't point to any specific issue. We've tried doing this in the past where we ask users to create a demo vault and do the memory dump but it never led to any usable theory or fix and since memory dumps contain all of the 1Password data in memory, we've decided it is not worth it and set a hard policy to never accept these dumps.

We're still looking at your last email and will reply as soon as we can.

jamiseichenauer · November 2016

Keep me posted. I was trying to drive this to resolution as I did not hear any steps on how to proceed.

MikeT · November 2016

We will, we're a bit behind in our email support queue but we'll reply as soon as we can.