Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Has your current copy of WhoCrashed home free version suddenly expired?

2 views
Skip to first unread message

Arlen Holder

unread,
Nov 2, 2020, 1:51:17 AM11/2/20
to
Has your current copy of WhoCrashed home free version suddenly expired?
o <https://i.postimg.cc/VNJjDnCL/whocrashed01.jpg>

A. Download WhoCrashed 6.65 Home Edition (free)
o <https://www.resplendence.com/whocrashed>
o <https://www.resplendence.com/downloads>
o <https://www.resplendence.com/download/whocrashedSetup.exe>
Name: whocrashedSetup.exe
Size: 9936128 bytes (9703 KiB)
SHA256: 0A7E3A03256D3143118BE5389F0C5F7F405A40066D999E246C57280E9282AE14

B. When running the installed executable, it fails with an error:
"Information
Sorry, this version has expired.
Please check our webiste for an update."

C:\app\hardware\bsod\whocrashed\WhoCrashedEx.exe
Name: WhoCrashedEx.exe
Size: 9703568 bytes (9476 KiB)
SHA256: E145CA4D3EA5B67B323838E77CDEC20744900FDAD52990E5C5ABA9648853E4B7

C. It brings up this web page, which says the product version is just fine:
<https://www.resplendence.com/bin/rspupdate.dll/checkforupdate?product=WhoCrashed>
product name: WhoCrashed (Home Edition)
your version: 6.65, build 665.30701
latest version: 6.65, build 665.30701
You have the latest version, no update is available.

Uninstalling & reinstalling changes nothing.

Has your current copy of WhoCrashed home free version suddenly expired?
o <https://i.postimg.cc/VNJjDnCL/whocrashed01.jpg>
--
Freeware has the strangest quirks sometimes, which require others' advice.

SC Tom

unread,
Nov 2, 2020, 7:35:24 AM11/2/20
to


"Arlen Holder" <arlen_...@newmachines.com> wrote in message
news:rnoa92$tme$1...@news.mixmin.net...
I haven't run it in quite some time (haven't needed to, knock on wood).
After seeing your topic line, I ran it and sure enough, v6.65 has expired.
When I clicked on the link, it downloaded the newest vwersion, 6.70.
If you go this link <https://www.resplendence.com/downloads> and scroll down
a little, you'll see a download link for the newest (or at least, I do).

HTH :-)
--

SC Tom


Arlen Holder

unread,
Nov 2, 2020, 10:17:02 AM11/2/20
to
On Mon, 2 Nov 2020 07:35:23 -0500, SC Tom wrote:

> I haven't run it in quite some time (haven't needed to, knock on wood).
> After seeing your topic line, I ran it and sure enough, v6.65 has expired.
> When I clicked on the link, it downloaded the newest vwersion, 6.70.
> If you go this link <https://www.resplendence.com/downloads> and scroll down
> a little, you'll see a download link for the newest (or at least, I do).

Hi SC Tom,

Thank you for being one of the purposefully helpful people on Usenet.
o <https://i.postimg.cc/4xTjbs2m/whocrashed03.jpg>

WhoCrashed is sneaky software, which doesn't work like we thought it did!
o That means it's worthless to archive it in our freeware archives. :(

I think we've tentatively confirmed the same thing, which is that it's
likely that Resplendence built in a hidden secret previously unknown-to-us
hard-coded expiry date into the WhoCrashed freeware (much like HP builds in
hard-coded expiry dates into printer ink cartridges).

I just ran the exact same experiment now that I ran only hours ago
o And the results are now quite different!
a. My version 6.65 still expires (as it did last night)
b. But now it brings up a web page saying there's a new version
c. The new version is currently unexpired

Yesterday's download: <https://i.postimg.cc/VNJjDnCL/whocrashed01.jpg>
<https://www.resplendence.com/download/whoCrashedSetup.exe>
product name: WhoCrashed (Home Edition)
your version: 6.65, build 665.30701
latest version: 6.65, build 665.30701
You have the latest version, no update is available.
Name: whocrashedSetup.exe
Size: 9936128 bytes (9703 KiB)
SHA256: 0A7E3A03256D3143118BE5389F0C5F7F405A40066D999E246C57280E9282AE14
"Sorry, this version has expired.
Please check our webiste for an update."
C:\app\hardware\bsod\whocrashed\WhoCrashedEx.exe
Name: WhoCrashedEx.exe
Size: 9703568 bytes (9476 KiB)
SHA256: E145CA4D3EA5B67B323838E77CDEC20744900FDAD52990E5C5ABA9648853E4B7

Today's download: <https://i.postimg.cc/JzK4vZDW/whocrashed02.jpg>
<https://www.resplendence.com/download/whoCrashedSetup.exe>
product name: WhoCrashed (Home Edition)
your version: 6.65, build 665.30701
latest version: 6.70, build 670.31101
Name: whoCrashedSetup (1).exe
Size: 10692312 bytes (10 MiB)
SHA256: 5CFA6302B0A8D953FD38B9522E9A32B371E4107CDD072DD86C19C7483A020CA7
C:\app\hardware\bsod\whocrashed\WhoCrashedEx.exe
Name: WhoCrashedEx.exe
Size: 10066064 bytes (9830 KiB)
SHA256: D3C7752947B49A8168F2C1D07411F03B501108661893E449EE1D78FE64938BB5

I needed it to work last night and it failed when I needed it.
o That's bad. It means my software archive is useless.
(Separately I will look for a software archive logger.)

But luckily it read last night's crash logs so I can move forward:
o <https://i.postimg.cc/4xTjbs2m/whocrashed03.jpg>

In summary, like most of you, I keep a software archive so that I don't
need to download software each time I install; but WhoCrashed, much like HP
with their printer ink cartridges, has (apparently) built in a hard-coded
expiry date into the freeware such that we need to note the DATE in every
download to determine the predetermined length of that hard-coded expiry.

The next time we run this new version and it expires, we will know what
that hard-coded time period is which renders our archives unusable.

Note: What we need is an installation logger which will log every change
during an installation to see if the expiry date is in the registry.
--
Together we can learn a lot about sneaky tricks developers pull on us.

Arlen Holder

unread,
Nov 2, 2020, 10:38:11 AM11/2/20
to
On Mon, 2 Nov 2020 15:17:01 -0000 (UTC), Arlen Holder wrote:

> Note: What we need is an installation logger which will log every change
> during an installation to see if the expiry date is in the registry.

It's just bad form that WhoCrashed has a secret hidden expiry date
o That makes any software archive utterly useless

But maybe we can figure out _where_ they put the hidden expiry date?

I will need to open a separate thread on how to archive installations
o To test, I ran "IObit Uninstaller" freeware on the WhoCrashed install

Although I know they could hide the hard-coded expiry date anywhere
o Nonetheless, I will look for clues in the installation monitor log

For example, maybe there's a clue to the expiry in these registry keys:
o HKCU\SOFTWARE\Resplendence Sp\WhoCrashed|Value|WhoCrashed.v67031101.home.ExCount
o HKCU\SOFTWARE\Resplendence Sp\WhoCrashed|Value|WhoCrashed.v67031101.home.FirstEx
o HKCU\SOFTWARE\Resplendence Sp\WhoCrashed|Value|WhoCrashed.v67031101.home.LastTimeRun
o HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|InstallDate
etc.

===< below is the IOBit "MonitorLog_WhoCrashed 6.70 (x64).txt" >===
Program Information
Display name: WhoCrashed 6.70 (x64)
Publisher: Resplendence Software Projects Sp.
Version: -
Registry entries: 32
Files: 34
Total size: 32.2 MB
Install date: 11/2/2020 6:56:07 AM
Install package: C:\tmp\whoCrashedSetup (1).exe
Location: C:\app\hardware\bsod\whocrashed\
Installation duration: 41 seconds

Registry entries
HKEY_CURRENT_USER\SOFTWARE\Resplendence Sp\WhoCrashed|Value|WhoCrashed.v67031101.home.ExCount
HKEY_CURRENT_USER\SOFTWARE\Resplendence Sp\WhoCrashed|Value|WhoCrashed.v67031101.home.FirstEx
HKEY_CURRENT_USER\SOFTWARE\Resplendence Sp\WhoCrashed|Value|WhoCrashed.v67031101.home.LastTimeRun
HKEY_CURRENT_USER\SOFTWARE\Resplendence Sp\WhoCrashed|Value|WindowContainerSettings1
HKEY_CURRENT_USER\SOFTWARE\Resplendence Sp\WhoCrashed|Value|WindowContainerSettings2
HKEY_CURRENT_USER\SOFTWARE\Resplendence Sp\WhoCrashed|Value|WindowContainerSettings3
HKEY_CURRENT_USER\Software\Resplendence Sp\WhoCrashed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data|Value|418A073AA3BC3475
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|DisplayIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|EstimatedSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|HelpLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|Inno Setup: App Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|Inno Setup: Deselected Tasks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|Inno Setup: Icon Group
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|Inno Setup: Language
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|Inno Setup: Selected Tasks
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|Inno Setup: Setup Version
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|Inno Setup: User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|InstallDate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|InstallLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|NoModify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|NoRepair
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|Publisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|QuietUninstallString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|UninstallString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|URLInfoAbout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1|Value|URLUpdateInfo
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WhoCrashed_is1
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bam\State\UserSettings\S-1-5-21-1978554382-385915032-812892281-1001|Value|\Device\HarddiskVolume3\app\hardware\bsod\whocrashed\WhoCrashedEx.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bam\State\UserSettings\S-1-5-21-1978554382-385915032-812892281-1001|Value|\Device\HarddiskVolume3\Users\arlen\AppData\Local\Temp\is-70KGK.tmp\whoCrashedSetup (1).tmp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bam\State\UserSettings\S-1-5-21-1978554382-385915032-812892281-1001|Value|\Device\HarddiskVolume3\Users\arlen\AppData\Local\Temp\is-S995K.tmp\whoCrashedSetup (1).tmp

Files
C:\app\hardware\bsod\whocrashed
C:\app\hardware\bsod\whocrashed\dbgeng.dll
C:\app\hardware\bsod\whocrashed\dbghelp.dll
C:\app\hardware\bsod\whocrashed\dbgmodel.dll
C:\app\hardware\bsod\whocrashed\ext.dll
C:\app\hardware\bsod\whocrashed\exts.dll
C:\app\hardware\bsod\whocrashed\kdexts.dll
C:\app\hardware\bsod\whocrashed\kext.dll
C:\app\hardware\bsod\whocrashed\libeay32.dll
C:\app\hardware\bsod\whocrashed\LICENSE.TXT
C:\app\hardware\bsod\whocrashed\msvcr100.dll
C:\app\hardware\bsod\whocrashed\rspCrash32.inf
C:\app\hardware\bsod\whocrashed\rspCrash32.sys
C:\app\hardware\bsod\whocrashed\rspCrash64.inf
C:\app\hardware\bsod\whocrashed\rspCrash64.sys
C:\app\hardware\bsod\whocrashed\rspSymSrv32.dll
C:\app\hardware\bsod\whocrashed\ssleay32.dll
C:\app\hardware\bsod\whocrashed\symbolcheck.dll
C:\app\hardware\bsod\whocrashed\symsrv.dll
C:\app\hardware\bsod\whocrashed\unins000.dat
C:\app\hardware\bsod\whocrashed\unins000.exe
C:\app\hardware\bsod\whocrashed\WhoCrashed.txt
C:\app\hardware\bsod\whocrashed\WhoCrashed32.dll
C:\app\hardware\bsod\whocrashed\WhoCrashedEx.exe
C:\app\hardware\bsod\whocrashed\WinXP
C:\app\hardware\bsod\whocrashed\WinXP\dbgeng.dll
C:\app\hardware\bsod\whocrashed\WinXP\dbghelp.dll
C:\app\hardware\bsod\whocrashed\WinXP\msvcr100.dll
C:\app\hardware\bsod\whocrashed\WinXP\symbolcheck.dll
C:\app\hardware\bsod\whocrashed\WinXP\symsrv.dll
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhoCrashed
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WhoCrashed\WhoCrashed.lnk
C:\Users\arlen\AppData\Local\Temp\rsptmp410843312000.html
C:\Users\arlen\Desktop\WhoCrashed.lnk
===< above is the MonitorLog_WhoCrashed 6.70 (x64).txt >===

Arlen Holder

unread,
Nov 2, 2020, 11:04:42 AM11/2/20
to
On Mon, 2 Nov 2020 15:38:11 -0000 (UTC), Arlen Holder wrote:

> It's just bad form that WhoCrashed has a secret hidden expiry date
> o That makes any software archive utterly useless
>
> But maybe we can figure out _where_ they put the hidden expiry date?

While they can put the secret hidden undocumented (AFAIK) expiry date in
any file anywhere, sometimes they put it in easy-to-find locations.

Hence...
o I asked over here just now for a good software installation logger:

o Recommendation requested for a decent (free) software installation logger
<https://groups.google.com/forum/#!topic/alt.comp.freeware/SmOrAhivz7Y>
--
The few people who are purposefully helpful are who make Usenet wonderful.

Paul

unread,
Nov 2, 2020, 2:12:51 PM11/2/20
to
Arlen Holder wrote:
> On Mon, 2 Nov 2020 15:38:11 -0000 (UTC), Arlen Holder wrote:
>
>> It's just bad form that WhoCrashed has a secret hidden expiry date
>> o That makes any software archive utterly useless
>>
>> But maybe we can figure out _where_ they put the hidden expiry date?
>
> While they can put the secret hidden undocumented (AFAIK) expiry date in
> any file anywhere, sometimes they put it in easy-to-find locations.
>
> Hence...
> o I asked over here just now for a good software installation logger:
>
> o Recommendation requested for a decent (free) software installation logger
> <https://groups.google.com/forum/#!topic/alt.comp.freeware/SmOrAhivz7Y>

If you protect an executable by signing it (so people can't be
using a hex editor on it), one of the side effects is the
signing certificate almost never has an infinite life.

Try doing properties on the executable and see if it is signed.

Paul

Arlen Holder

unread,
Nov 2, 2020, 3:42:58 PM11/2/20
to
On Mon, 02 Nov 2020 14:12:48 -0500, Paul wrote:

> If you protect an executable by signing it (so people can't be
> using a hex editor on it), one of the side effects is the
> signing certificate almost never has an infinite life.
>
> Try doing properties on the executable and see if it is signed.

Hi Paul,

Thank you for your purposefully helpful advice, as we can all learn from
the answer to this question of how to tell when an executable that we all
use and archive will suddenly, inexplicably, without warning, "expire".
o Where can we find the expiry date of the _new_ executable?
<https://i.postimg.cc/hv1dPFmX/whocrashed04.jpg>

Yes, the executable is signed, and the "new" start date was yesterday.
o Note this is not the installer - but the installed executable.
C:\app\hardware\bsod\whocrashed\WhoCrashedEx.exe

OLD installed executable:
o Name: WhoCrashedEx.exe
o Size: 9703568 bytes (9476 KiB)
o SHA256: E145CA4D3EA5B67B323838E77CDEC20744900FDAD52990E5C5ABA9648853E4B7
o Name of signer: Daniel Terhell
o Email: dan...@resplendence.com
o Digest algorithm: sha1
o Timestamp: Thursday, July 4, 2019 12:24:31 AM
o Issued by: Sectigo RSA Code Signing CA
o Valid from 2/6/2019 to 2/7/2023
o Extended Error Information
Revocation Status : OK.
Effective Date <ıSunday, ıNovember ı1, ı2020 6:33:57 PM>
Next Update <ıSunday, ıNovember ı8, ı2020 6:33:57 PM>

NEW installed executable:
o Name: WhoCrashedEx.exe
o Size: 10066064 bytes (9830 KiB)
o SHA256: D3C7752947B49A8168F2C1D07411F03B501108661893E449EE1D78FE64938BB5
o Name of signer: Daniel Terhell
o Email: dan...@resplendence.com
o Digest algorithm: sha1
o Timestamp: Sunday, November 1, 2020 11:33:41 PM
o Issued by: Sectigo RSA Code Signing CA
o Valid from 2/6/2019 to 2/7/2023
o Extended Error Information
Revocation Status : OK.
Effective Date <ıSunday, ıNovember ı1, ı2020 6:33:57 PM>
Next Update <ıSunday, ıNovember ı8, ı2020 6:33:57 PM>

Most of that is gibberish to me.
o Where can I find the expiry date of the _new_ executable?
<https://i.postimg.cc/hv1dPFmX/whocrashed04.jpg>
--
Together we can figure out the intracacies of the Windows software world.

Paul

unread,
Nov 2, 2020, 4:27:36 PM11/2/20
to
OK, so it's not the signing ("2023"). The developer
must have an internal expiry mechanism, or the
developer has an "update" tick box and pulls
updates when you use the thing or something.
There's got to be some sort of background story
there, and an explanation of what the developer
thought they were doing :-)

Paul

Arlen Holder

unread,
Nov 2, 2020, 8:24:14 PM11/2/20
to
On Mon, 02 Nov 2020 16:27:35 -0500, Paul wrote:

> OK, so it's not the signing ("2023").

Ah. I agree.

Thanks Paul for explaining this "certificate" stuff as it's all new to me.

The "properties" form says both the old & new executable certificates are
"Valid to Tuesday February 7, 2023"; so the expiry date is from elsewhere.

BTW, with just that certificate expiry alone in mind, assuming no others,
what actually happens if I still use that executable on Wed Feb 8, 2023?

> The developer must have an internal expiry mechanism, or the
> developer has an "update" tick box and pulls updates when
> you use the thing or something.

In this case, WhoCrashed was the _first_ thing I ran after a BSOD, which
means that I had only moments before booted the machine, where my machine
is set to always boot up _off_ the network.

So when I ran WhoCrashed, I was definitely _off_ the network, and it
_still_ knew that a given date had expired, so I think it's hard coded in a
file somewhere (or in the registry).

In addition to the expiry notice popping up _before_ it checked the web for
an update, it went to a web page to check for the latest version, but that
web page didn't exist because I was off the network when it did that (which
also indicates the expiry is a hard coded date).

Couple that observation with the fact that, after I enabled the network,
the web page it went to originally said that I had the latest release,
which is yet another indicator of a hard-coded super secret expiry date.
o <https://i.postimg.cc/VNJjDnCL/whocrashed01.jpg>

It's only when SC Tom and I tested it _later_ that the web page updated:
o <https://i.postimg.cc/JzK4vZDW/whocrashed02.jpg>

To me, that's evidence that it's a "hard coded" expiry date, which could be
almost anywhere (either in a file, in the executable, or in the registry).

The only thing I fault the developer for is being sleazy.
o All they had to do was tell us, openly & honestly, it's expiryware (which
is essentially the definition of trialware, IMHO, is it not?).

> There's got to be some sort of background story
> there, and an explanation of what the developer
> thought they were doing :-)

While I guess I can't complain given it's freeware, it still irks me that
the developer saw fit to hide this fact from us (AFAIK) that our software
will just die on us, literally at the very moment that we want to use it.

In addition, as you're likely aware, I archive all my installers, even
those which come initially as a "stub", where I go to the trouble to figure
out how to archive the full and complete offline network installer.
o Tutorial: How to install the free Brave privacy-based tor-enabled web browser where YOU want it to install (and how to save a full offline installer in the process)
<https://groups.google.com/forum/#!topic/alt.comp.freeware/bog50yqc_As>

The fact this secret undocumented (AFAIK) hidden expiry date exists means
that this particular software archive is worthless for everyone who has it.

Personally, I would have liked to see the developer tell us, up front, that
our software archives of his product are worthless, instead of me having to
find that out at the worst possible moment (e.g., right after a BSOD).

Nonetheless, I'm moving on writing up the diagnostic tutorial, where I will
add a caveat that the WhoCrashed software pulls sneaky sleazy tricks on us.
o Windows 10 BSOD indicates a hardware problem - but what hardware is the problem?
<https://alt.comp.os.windows-10.narkive.com/oL7PTNKu/windows-10-bsod-indicates-a-hardware-problem-but-what-hardware-is-the-problem>
<http://www.pcbanter.net/showthread.php?t=1110105>
<https://groups.google.com/forum/#!topic/alt.comp.microsoft.windows/u0ay9h777Wg>
--
Every question (and answer) posted to Usenet should benefit everyone.
0 new messages