C:\Crash and wws_crashreport_uploader.exe

Where do I opt out of this? I don't care to have 1.5 GB dump files on my small harddrive taking up space.

Buffrat@Antonia Bayle wrote:

There is no opt out that we're aware of and soe don't seem to be talking. Delete the crash folder and instead create a text file in its place called simply 'crash', then make it read only.
Check for more details.

Buffrat@Antonia Bayle wrote:

From another thread (quoting myself):


"Now, on to another questionable folder far more serious--C:/Crash--My wifes XP machine had two files in here, for a total of 56MBs.
drwtsn32.log (this file can be opened with notepad.exe and be read in plain-text)
I can understand why you might want this file, although it has information in it that you really don't need. The next file is the one that every person that reads this forum needs to inspect on their own machines--this is a serious breach of trust, if not a violation of Federal Wiretap laws. This file may, or may not, be in the C:/Crash folder, depending on whether or not it has been uploaded as the files here are deleted once uploaded.
user.dmp
If you open this file with notepad.exe, what you see is mostly machine/assembly code--unreadable for you and me. Grab that scroll bar on the right and start dragging--you will begin to see code for a graphical interface, frame settings and such. Keep scrolling (I had to scroll down about 80% of the way down the file). If you are like my wife and I, we use a P2P client--that client, specifically BitTorrent, is listed along with a few other applications. What follows is what really matters...a list of every single file downloaded by BitTorrent since my wife last ran CCleaner(set to delete BitTorrent logs), as well as every other file placed in those torrented folders, up to and including update files, patches, cracks, mods and user created files.

Hear me well, Torrenters. SOE is tracking everything you torrent, and doing so directly through your own computer. They are then uploading that data to their own servers via wws_crashreport_uploader.exe."

The other thread:
http://forums.station.sony.com/eq2/...topic_id=520848

tkia wrote:

Ah, but this is why I'm asking. I can't claim they're doing anything illegal until I know for sure there's no opt out.

Buffrat@Antonia Bayle wrote:

Nothing illegal about it. Microsoft Windows also creates dump files.

deadcrickets2 wrote:

Microsoft happens to offer a method to control the dump files:

1. Click Start , point to Settings , and then click Control Panel .
2. Double-click System .
3. Click the Advanced tab, and then click Settings under Startup and Recovery .

It also has the option to overwrite an existing file.
It would be nice if similar options were available for the EQ2 dump files.

Last I heard it was illegal to record system information with no consent and/or no opt out. But I could be wrong, I don't follow these things closely.

Also Microsoft creates dump files but asks you if you want to send it or not (and they're not 1.5 gb in size).

Buffrat@Antonia Bayle wrote:

It is agreed to through the Terms of Service:
http://www.soe.com/en/termsofservice.vm
D. CONSENT TO MONITOR

Please note that some games available on or through The Station may, when in operation, monitor your computer's random access memory, MAC address, and system and configuration files, crash data, etc. for the purpose of monitoring and improving quality and service and also for the purpose of identifying unauthorized third party programs running concurrently with your game which, in SOE's sole determination: (i) enable or facilitate cheating of any type; (ii) allow users to modify or hack the applicable game interface, environment, and/or experience in any way not expressly authorized by SOE; or (iii) intercept, "mine" or otherwise collect information from or through the applicable game (an "Unauthorized Third Party Program"). In the event that a game detects an Unauthorized Third Party Program, (a) the game may communicate information back to SOE, including without limitation your Station Account username, details about the Unauthorized Third Party Program detected and the activities or functions performed thereby, and/or details about your computer, and/or (b) SOE may exercise any or all of its rights and remedies under this Agreement or the applicable game end user license agreement without prior notice to the user linked to such Unauthorized Third Party Program.
In addition, you acknowledge that any and all character and account data that is stored and is resident on our servers, and any and all communications that you make within The Station or any game (including, but not limited to, messages solely directed at another player or group of players) traverse through our servers, may or may not be monitored by us or our agents (where and to the extent permitted by applicable law), you have no expectation of privacy in any such communications, you expressly consent to such monitoring of communications you send and receive, and you expressly agree to waive any rights of confidentiality that you may have in and to such communications. For example, SOE may monitor chat rooms in certain portions of The Station directed to Children.

Buffrat@Antonia Bayle wrote:

As someone pointed out with the TOS, you already gave your consent.

Sandyfoot wrote:

I agree that there needs to be a way to prevent them from happening. I was, after all, the first to point out the crash dump files appearing and what was creating them. Plus I pointed out the issue with those who have bandwidth or drive space limits. Not only that but I posted a potential solution to the issue here on the tech forum.

Buffrat@Antonia Bayle wrote:

I don't think there's a way to disable this. They're a leftover from the recent problem with the new in-game browser component causing the game client to crash every time you tried to view an HTML page (even something as innocuous as the ACT encounter-list main page off the local disk). It was very system-dependent, the devs couldn't replicate it, so they finally had to start taking memory dumps of the game client at the time of the crash and shipping them back so they could see exactly what was happening and figure out the common element that caused the crash. Looking at the dates, it looks like they're taking the dump image just before the browser window opens or just before it goes to display a page. There won't be anything particularly sensitive in it, everything except maybe the exact URL you're visiting is already on SOE's servers (in your account information, character data file and the like). It's not like the Windows crash dump that takes an image of everything in memory. It's safe to delete the dump files. The devs really should turn off the dump files now that the browser's working, though. It's messy and it can't be helping browser performance.

Sandyfoot wrote:

Thank you, I figured I just missed it. I haven't read it in awhile and skimmed through it earlier, but yeah. Feel dumb now.

Are you sure it's only related to the browser? I haven't used the in game browser for years yet I still have 3 dump files.
But yeah. It would be nice if they turned it off, or allowed directory changes. A friend of mine who uses a 60 gig SSD was pretty annoyed when he found 6 gigs of dumps on it.

Directory of C:\Crash
07/12/2012 11:56 PM .
07/12/2012 11:56 PM ..
06/21/2012 09:43 PM 1,001,917,270 EverQuest2.exe_06212012_214342.dmp
06/21/2012 09:47 PM 1,000,793,834 EverQuest2.exe_06212012_214755.dmp
06/21/2012 09:51 PM 1,020,504,058 EverQuest2.exe_06212012_215103.dmp
06/21/2012 09:54 PM 999,057,178 EverQuest2.exe_06212012_215404.dmp
06/26/2012 04:36 AM 778,965,546 EverQuest2.exe_06262012_043550.dmp
06/30/2012 06:34 PM 993,560,746 EverQuest2.exe_06302012_183342.dmp
06/30/2012 06:35 PM 983,152,538 EverQuest2.exe_06302012_183521.dmp
06/30/2012 06:36 PM 994,949,354 EverQuest2.exe_06302012_183639.dmp
07/11/2012 01:09 AM 1,505,681,730 EverQuest2.exe_07112012_010831.dmp
07/12/2012 11:57 PM 1,425,035,959 EverQuest2.exe_07122012_235646.dmp
10 File(s) 10,703,618,213 bytes
2 Dir(s) 557,409,886,208 bytes free
I've never had a reason to use the ingame browser, and would remember a continuous crash session of three in a row, indicated by the .dmp timestamps. There is no indication anywhere in my Event Viewer of an event occuring in or around the times of the above timestamps. Security logs have not blocked anything associated with SOE and Awesomium.
Simply using the in-game browser to view the internet and having it crash doesn't seem worthy of such massive amounts of data collection.
However, if Awesomium is also used for the Marketplace (and is used by other F2P games) that could hypothetically create a critical condition that would warrent the collection of so much data.

Bug wrote:

Well, not for everyone. My PC's security software bonks crashreport_uploader.exe every time it tries to communicate. I believe a "neener neener neener" to Big Brother's doubleplusungood snooping is called for.

Sandyfoot wrote:

It's not a lot of data, really. It's a crash dump, which is a copy of the entire memory space of the process in question, in this case the EQ2 game client. You'll remember that it's enough of a memory hog that 2GB of RAM is marginal for running it and you really want 3GB or more, so 1-1.5GB dumps (meaning a 1-1.5GB memory space for the process) isn't particularly unexpected. Remember that among other things it'll contain all the game's code, plus all the textures, models, graphics data and the like. And no, it can't be trimmed down. First, the debugger needs the entire image to load. If you leave parts out, the debugger will go to map those missing areas and won't be able to. Second, since the devs don't know what they're looking for they don't know what'll be relevant and what won't until after they've gotten the dump back and figured the problem out. How do you throw out the irrelevant parts when you don't know what'll be relevant? SOP in that case is to dump the entire process out so you can fire up the debugger on it and see exactly what it was doing just before it died. It's not strictly speaking the most efficient method, but it's the fastest way to get the answers you need.

Jrral@Unrest wrote:

The game never crashed durring the time of the dumps. I would most certainly be aware if I had three or more crashes in quick succession like my dump file timestamps indicate.
When these so called crashes happened, they were "silent" and did not interupt gameplay.
It is just curious and will leave it at that.

38 GB, Are you serious? Unacceptable.

c:\Crash>dir
Volume in drive C is OS
Directory of c:\Crash
06/22/2012 09:28 PM 1,401,395,982 EverQuest2.exe_06222012_212629.dmp
06/23/2012 08:58 PM 1,562,129,998 EverQuest2.exe_06232012_205730.dmp
06/25/2012 12:22 AM 1,508,806,970 EverQuest2.exe_06252012_002107.dmp
06/25/2012 10:32 PM 1,328,124,874 EverQuest2.exe_06252012_223135.dmp
06/26/2012 10:06 PM 1,117,004,963 EverQuest2.exe_06262012_220601.dmp
07/01/2012 10:30 AM 1,383,312,682 EverQuest2.exe_07012012_102925.dmp
07/01/2012 07:54 PM 1,315,036,631 EverQuest2.exe_07012012_195333.dmp
07/02/2012 10:04 PM 1,833,507,278 EverQuest2.exe_07022012_220327.dmp
07/04/2012 08:51 AM 1,456,170,183 EverQuest2.exe_07042012_084857.dmp
07/06/2012 11:33 PM 1,386,637,935 EverQuest2.exe_07062012_233232.dmp
07/07/2012 05:24 PM 833,850,377 EverQuest2.exe_07072012_172258.dmp
07/07/2012 07:19 PM 941,565,155 EverQuest2.exe_07072012_191923.dmp
07/12/2012 10:26 PM 1,555,428,379 EverQuest2.exe_07122012_222453.dmp
07/12/2012 11:08 PM 1,318,088,543 EverQuest2.exe_07122012_230721.dmp
07/12/2012 11:12 PM 971,987,059 EverQuest2.exe_07122012_231231.dmp
07/13/2012 09:06 AM 1,438,993,823 EverQuest2.exe_07132012_090603.dmp
07/13/2012 05:14 PM 1,435,108,014 EverQuest2.exe_07132012_171412.dmp
07/13/2012 06:19 PM 689,431,171 EverQuest2.exe_07132012_181901.dmp
07/13/2012 07:20 PM 1,486,795,771 EverQuest2.exe_07132012_191931.dmp
07/14/2012 03:45 PM 1,626,666,275 EverQuest2.exe_07142012_154407.dmp
07/14/2012 04:33 PM 1,507,293,143 EverQuest2.exe_07142012_163242.dmp
07/14/2012 10:55 PM 1,551,445,531 EverQuest2.exe_07142012_225432.dmp
07/15/2012 08:58 AM 429,281,523 EverQuest2.exe_07152012_085852.dmp
07/15/2012 10:38 AM 1,525,661,147 EverQuest2.exe_07152012_103712.dmp
07/15/2012 11:00 AM 1,359,771,067 EverQuest2.exe_07152012_105944.dmp
07/17/2012 07:58 PM 1,161,882,643 EverQuest2.exe_07172012_195746.dmp
07/19/2012 07:57 PM 1,533,876,679 EverQuest2.exe_07192012_195536.dmp
07/21/2012 10:49 AM 1,294,339,221 EverQuest2.exe_07212012_104815.dmp
07/23/2012 08:51 PM 991,511,219 EverQuest2.exe_07232012_205005.dmp
07/23/2012 09:20 PM 1,234,042,631 EverQuest2.exe_07232012_211956.dmp
07/24/2012 10:55 PM 1,558,831,854 EverQuest2.exe_07242012_225523.dmp
31 File(s) 40,737,978,721 bytes
2 Dir(s) 28,543,623,168 bytes free

c:\Crash>

38 gb for me~
Emptied the crash folder, it had filled my entire hard drive. Emptied the recycle bin... got 26 of it back.
For those of us with smaller hard drives this is a mess.
I dont use the in game browser at all, but do look at the marketplace.

slyfer wrote:

Slyfer, if you have a very large amount of data acquired via P2P protocols (BitTorrent,uTorrent, etc.), that might explain the size and frequency of those dumps.

If you are using a P2P client, see if any of the time-stamps of torrents coincide with the time-stamps on the dumps.

As I said, the dump on my wifes machine had thousands of files listed in readable text (buried amongst assembly code when opened in notepad.exe), the vast majority of them being files downloaded via BitTorrent. If you have the intestinal fortitude for it, you can see for yourself the files listed and uploaded in that crash dump--they are just very hard to catch, but here is a trick to do so:
Open one of those .dmp files with notepad.exe (the bigger it is, the longer it will take to open--give it some time). Once you have done so, select all, copy and paste it all into a rich text file. Again, the bigger the file, the longer it will take. Once you have the data pasted into a .rtf, use the "find" function to search for one of those torrent files using appropriate wild-cards (*).
This should be enough to verify that the dumps are tracking torrents. Please report back here if you find anything conclusive.
Bug
EDIT: It is possible all of that assembly code is actually garbage meant to obfuscate by dilution, essentially hiding the actual data.

Interesting. I have a C:/Crash folder, but it's empty.