CryptAES randomly crashing my script

[kyuuuri]

Hello, as title says CryptAES is randomly crashing my script. When I say random I mean that it doesn't matter how many times I use the same function with the same values it will crash on one of those executions. I'm using AHK_H v1.

This is the piece of code:

Code: Select all

f1::
Path := "D:\test.txt"
hash := "f1461877468516263ea376f8588c8bc0c1413ca7712f9d4d5e624b95efda69c5"
sz:=130 ; 130 because: hashLength = 64 * 2 = 128 (unicode) + 2 for terminating char = 130
VarSetCapacity(str, sz)
StrPut(hash, &str)
sz := CryptAES(str, sz, "431GddAtuifssBogjCkgdoswMasegvsA5fkd8/*4-fa@#d", true)
tooltip a
; Write
file := FileOpen(Path, "a")
test := StrGet(&str, sz/(A_IsUnicode+1)) ; sz / 1+1 = 144 / 2 = 72
File.RawWrite(test, 144)
File.close()
return

CryptAES(ByRef lp,sz,pw,e:=1,SID:=256){
	static AES_128:=0x660E,AES_192:=1+AES_128,AES_256:=1+AES_192,SHA1:=1+0x8003 ; MD5
	If !DllCall("Advapi32\CryptAcquireContext","Ptr*",hP,"Uint",0,"Uint",0,"Uint",24,"UInt",0xF0000000) ;PROV_RSA_AES, CRYPT_VERIFYCONTEXT
	|| !DllCall("Advapi32\CryptCreateHash","Ptr",hP,"Uint",SHA1,"Uint",0,"Uint",0,"Ptr*",H )
	;|| !CryptHashData(H,&pw,StrLen(pw)*2,0)
	|| !DllCall("Advapi32\CryptHashData", "Ptr", H, "Uchar", &pw, "Uint", StrLen(pw)*2, "UInt", 0)
	;|| !CryptDeriveKey(hP,AES_%SID%,H,SID<<16,getvar(hK:=0))
	|| !DllCall("Advapi32\CryptDeriveKey", "Ptr", hP, "Ptr", AES_%SID%, "Ptr", H, "Uint", SID<<16, "Ptr", getvar(hK:=0))
	;|| !CryptDestroyHash(H)
	|| !DllCall("Advapi32\CryptDestroyHash", "Ptr", H)
		return 0
	if e
		DllCall("Advapi32\CryptEncrypt", "Ptr", hK, "Ptr", 0, "int", 1, "Uint", 0, "Uchar", &lp, "Uint", getvar(sz), "Uint", sz+16)
	else
		DllCall("Advapi32\CryptDecrypt", "Ptr", hK, "Ptr", 0, "int", 1, "Uint", 0, "Uchar", &lp, "Uint", getvar(sz))
		;DllCall("Advapi32\CryptDecrypt",hK,0,1,0,&lp,getvar(sz))
	DllCall("Advapi32\CryptDestroyKey", "Ptr", hK) 
	DllCall("Advapi32\CryptReleaseContext", "Ptr", hP, "Uint", 0)
	return sz
}
;~ CryptAES(ByRef lp,sz,pw,e:=1,SID:=256){
	;~ static f:="advapi32\Crypt",t:="UPtr",t_:="UPtr*",AES_128:=0x660E,AES_192:=1+AES_128,AES_256:=1+AES_192,SHA1:=1+0x8003 ; MD5
	;~ return e?VarSetCapacity(lp,sz+16):0,DllCall(f "AcquireContext",t_,hP,t,0,t,0,t,24,t,0xF0000000) ;PROV_RSA_AES, CRYPT_VERIFYCONTEXT
  ;~ ,DllCall(f "CreateHash",t,hP,t,SHA1,t,0,t,0,t_,H),DllCall(f "HashData",t,H,str,pw,t,StrLen(pw)*2,t,0)
  ;~ ,DllCall(f "DeriveKey",t,hP,t,AES_%SID%,t,H,t,SID<<16,t_,hK),DllCall(f "DestroyHash",t,H)
  ;~ ,e?DllCall(f "Encrypt",t,hK,t,0,t,1,t,0,t,&lp,t_,sz,t,sz+16):DllCall(f "Decrypt",t,hK,t,0,t,1,t,0,t,&lp,t_,sz)
  ;~ ,DllCall(f "DestroyKey",t,hK),DllCall(f "ReleaseContext",t,hP,t,0)
  ;~ ,sz
;~ }

For some reason this crashes at random, I couldn't find why.

Thanks in advance.

[guest3456]

please post full code that crashes, you've used missing Crypt* functions that aren't included.

[kyuuuri]

please post full code that crashes, you've used missing Crypt* functions that aren't included.

I edited the code with the exact same code I'm using, please check it. Thanks for answering.

PD: That's the entire code, I was playing around with this function until I noticed that it crashed randomly so I isolated it to a single file and it kept crashing.

[guest3456]

please post full code that crashes, you've used missing Crypt* functions that aren't included.

I edited the code with the exact same code I'm using, please check it. Thanks for answering.

PD: That's the entire code, I was playing around with this function until I noticed that it crashed randomly so I isolated it to a single file and it kept crashing.

i just tested it 10 times and it seemed to work

how do you know it crashes? i mean, what error message do you get?

[kyuuuri]

please post full code that crashes, you've used missing Crypt* functions that aren't included.

I edited the code with the exact same code I'm using, please check it. Thanks for answering.

PD: That's the entire code, I was playing around with this function until I noticed that it crashed randomly so I isolated it to a single file and it kept crashing.

i just tested it 10 times and it seemed to work

how do you know it crashes? i mean, what error message do you get?

Hello! No error. The script is closed, if I add a msgbox or a tooltip at the end it is displayed but because the script is closed it is closed.

That's why I'm so lost.
I will record a vídeo to show it.

[kyuuuri]

Here it crashed on the first try:


Here it never crashes:


Here it crashes on the 2nd try:


I don't know what's happening to be honest, never seen this behaviour before. How can this code sometimes work perfectly and sometimes crash at 1st try.

[HotKeyIt]

Might be due to missing & here: File.RawWrite(&test, sz)

Code: Select all

f1::
Path := "D:\testenc.txt"
hash := "f1461877468516263ea376f8588c8bc0c1413ca7712f9d4d5e624b95efda69c5"
sz := CryptAES(hash, StrLen(hash)*(A_IsUnicode+1) + (A_IsUnicode+1), "431GddAtuifssBogjCkgdoswMasegvsA5fkd8/*4-fa@#d", true)
tooltip a
; Write
file := FileOpen(Path, "a", "UTF-8")
File.RawWrite(&hash, sz)
File.close()
return

CryptAES(ByRef lp,sz,pw,e:=1,SID:=256){
	static AES_128:=0x660E,AES_192:=1+AES_128,AES_256:=1+AES_192,SHA1:=1+0x8003 ; MD5
	If !DllCall("Advapi32\CryptAcquireContext","Ptr*",hP,"Uint",0,"Uint",0,"Uint",24,"UInt",0xF0000000) ;PROV_RSA_AES, CRYPT_VERIFYCONTEXT
	|| !DllCall("Advapi32\CryptCreateHash","Ptr",hP,"Uint",SHA1,"Uint",0,"Uint",0,"Ptr*",H )
	|| !CryptHashData(H,&pw,StrLen(pw)*2,0)
	|| !CryptDeriveKey(hP,AES_%SID%,H,SID<<16,getvar(hK:=0))
	|| !CryptDestroyHash(H)
		return 0
	if e
		CryptEncrypt(hK,0,1,0,&lp,getvar(sz),sz+16)
	else
		CryptDecrypt(hK,0,1,0,&lp,getvar(sz))
	CryptDestroyKey(hK),CryptReleaseContext(hP,0)
	return sz
}

[kyuuuri]

Might be due to missing & here: File.RawWrite(&test, sz)

Code: Select all

f1::
Path := "D:\testenc.txt"
hash := "f1461877468516263ea376f8588c8bc0c1413ca7712f9d4d5e624b95efda69c5"
sz := CryptAES(hash, StrLen(hash)*(A_IsUnicode+1) + (A_IsUnicode+1), "431GddAtuifssBogjCkgdoswMasegvsA5fkd8/*4-fa@#d", true)
tooltip a
; Write
file := FileOpen(Path, "a", "UTF-8")
File.RawWrite(&hash, sz)
File.close()
return

CryptAES(ByRef lp,sz,pw,e:=1,SID:=256){
	static AES_128:=0x660E,AES_192:=1+AES_128,AES_256:=1+AES_192,SHA1:=1+0x8003 ; MD5
	If !DllCall("Advapi32\CryptAcquireContext","Ptr*",hP,"Uint",0,"Uint",0,"Uint",24,"UInt",0xF0000000) ;PROV_RSA_AES, CRYPT_VERIFYCONTEXT
	|| !DllCall("Advapi32\CryptCreateHash","Ptr",hP,"Uint",SHA1,"Uint",0,"Uint",0,"Ptr*",H )
	|| !CryptHashData(H,&pw,StrLen(pw)*2,0)
	|| !CryptDeriveKey(hP,AES_%SID%,H,SID<<16,getvar(hK:=0))
	|| !CryptDestroyHash(H)
		return 0
	if e
		CryptEncrypt(hK,0,1,0,&lp,getvar(sz),sz+16)
	else
		CryptDecrypt(hK,0,1,0,&lp,getvar(sz))
	CryptDestroyKey(hK),CryptReleaseContext(hP,0)
	return sz
}

Nop, still crashes. I will see if I can rewrite this function using CNG (prob going to copy jNizM's work and change it a little bit to be more like this one).

[guest3456]

Here it crashed on the first try:

it looks like when it crashes you get a fullscreen gray image? what do you think that is?

[kyuuuri]

Here it crashed on the first try:

it looks like when it crashes you get a fullscreen gray image? what do you think that is?

That's the menu that opens when you press F1 on Desktop

[guest3456]

That's the menu that opens when you press F1 on Desktop

lol ok

well it would be good if we can try to debug this further, and try to figure it out. i just tried a few more times and it always works for me.

you are not the first person to report silent crashes in AHK_H:
https://www.autohotkey.com/boards/viewtopic.php?f=65&t=71215
https://www.autohotkey.com/boards/viewtopic.php?f=65&t=64377

can you put some msgboxes inside your CryptAES function to try to narrow down one of the DllCalls that might be failing? instead of one big if expression with everything OR'd, something more like this:

https://github.com/jNizM/HashCalc/blob/f61d9e564d5d0531b7184e6f52a0dd6f67f9e111/src/HashCalc.ahk#L367

Code: Select all

CalcAddrHash(addr, length, algid, byref hash = 0, byref hashlength = 0)
{
    static h := [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, "a", "b", "c", "d", "e", "f"]
    static b := h.minIndex()
    hProv := hHash := o := ""
    if (DllCall("advapi32\CryptAcquireContext", "Ptr*", hProv, "Ptr", 0, "Ptr", 0, "UInt", 24, "UInt", 0xf0000000))
    {
        if (DllCall("advapi32\CryptCreateHash", "Ptr", hProv, "UInt", algid, "UInt", 0, "UInt", 0, "Ptr*", hHash))
        {
            if (DllCall("advapi32\CryptHashData", "Ptr", hHash, "Ptr", addr, "UInt", length, "UInt", 0))
            {
                if (DllCall("advapi32\CryptGetHashParam", "Ptr", hHash, "UInt", 2, "Ptr", 0, "UInt*", hashlength, "UInt", 0))
                {
                    VarSetCapacity(hash, hashlength, 0)
                    if (DllCall("advapi32\CryptGetHashParam", "Ptr", hHash, "UInt", 2, "Ptr", &hash, "UInt*", hashlength, "UInt", 0))
                    {
                        loop % hashlength
                        {
                            v := NumGet(hash, A_Index - 1, "UChar")
                            o .= h[(v >> 4) + b] h[(v & 0xf) + b]
                        }
                    }
                }
            }
            DllCall("advapi32\CryptDestroyHash", "Ptr", hHash)
        }
        DllCall("advapi32\CryptReleaseContext", "Ptr", hProv, "UInt", 0)
    }
    return o
}

that way each dllCall can be isolated and checked for the error, and you can msgbox inside each set of braces to see which is working and which is failing

[kyuuuri]

That's the menu that opens when you press F1 on Desktop

lol ok

well it would be good if we can try to debug this further, and try to figure it out. i just tried a few more times and it always works for me.

you are not the first person to report silent crashes in AHK_H:
https://www.autohotkey.com/boards/viewtopic.php?f=65&t=71215
https://www.autohotkey.com/boards/viewtopic.php?f=65&t=64377

can you put some msgboxes inside your CryptAES function to try to narrow down one of the DllCalls that might be failing? instead of one big if expression with everything OR'd, something more like this:

https://github.com/jNizM/HashCalc/blob/f61d9e564d5d0531b7184e6f52a0dd6f67f9e111/src/HashCalc.ahk#L367

Code: Select all

CalcAddrHash(addr, length, algid, byref hash = 0, byref hashlength = 0)
{
    static h := [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, "a", "b", "c", "d", "e", "f"]
    static b := h.minIndex()
    hProv := hHash := o := ""
    if (DllCall("advapi32\CryptAcquireContext", "Ptr*", hProv, "Ptr", 0, "Ptr", 0, "UInt", 24, "UInt", 0xf0000000))
    {
        if (DllCall("advapi32\CryptCreateHash", "Ptr", hProv, "UInt", algid, "UInt", 0, "UInt", 0, "Ptr*", hHash))
        {
            if (DllCall("advapi32\CryptHashData", "Ptr", hHash, "Ptr", addr, "UInt", length, "UInt", 0))
            {
                if (DllCall("advapi32\CryptGetHashParam", "Ptr", hHash, "UInt", 2, "Ptr", 0, "UInt*", hashlength, "UInt", 0))
                {
                    VarSetCapacity(hash, hashlength, 0)
                    if (DllCall("advapi32\CryptGetHashParam", "Ptr", hHash, "UInt", 2, "Ptr", &hash, "UInt*", hashlength, "UInt", 0))
                    {
                        loop % hashlength
                        {
                            v := NumGet(hash, A_Index - 1, "UChar")
                            o .= h[(v >> 4) + b] h[(v & 0xf) + b]
                        }
                    }
                }
            }
            DllCall("advapi32\CryptDestroyHash", "Ptr", hHash)
        }
        DllCall("advapi32\CryptReleaseContext", "Ptr", hProv, "UInt", 0)
    }
    return o
}

that way each dllCall can be isolated and checked for the error, and you can msgbox inside each set of braces to see which is working and which is failing

This code crashes at the end:

Code: Select all

CryptAES(ByRef lp,sz,pw,e:=1,SID:=256){
	static AES_128:=0x660E,AES_192:=1+AES_128,AES_256:=1+AES_192,SHA1:=1+0x8003 ; MD5
	DllCall("Advapi32\CryptAcquireContext","Ptr*",hP,"Uint",0,"Uint",0,"Uint",24,"UInt",0xF0000000)
	msgbox % "1: " A_LastError
	DllCall("Advapi32\CryptCreateHash","Ptr",hP,"Uint",SHA1,"Uint",0,"Uint",0,"Ptr*",H )
	msgbox % "2: " A_LastError
	DllCall("Advapi32\CryptHashData", "Ptr", H, "Uchar", &pw, "Uint", StrLen(pw)*2, "UInt", 0)
	msgbox % "3: " A_LastError
	DllCall("Advapi32\CryptDeriveKey", "Ptr", hP, "Ptr", AES_%SID%, "Ptr", H, "Uint", SID<<16, "Ptr", getvar(hK:=0))
	msgbox % "4: " A_LastError
	DllCall("Advapi32\CryptDestroyHash", "Ptr", H)
	msgbox % "5: " A_LastError
	if e
	{
		DllCall("Advapi32\CryptEncrypt", "Ptr", hK, "Ptr", 0, "int", 1, "Uint", 0, "Uchar", &lp, "Uint", getvar(sz), "Uint", sz+16)
		msgbox % "6: " A_LastError
	}
	else
	{
		msgbox % "7: " A_LastError
		DllCall("Advapi32\CryptDecrypt", "Ptr", hK, "Ptr", 0, "int", 1, "Uint", 0, "Uchar", &lp, "Uint", getvar(sz))
	}
	DllCall("Advapi32\CryptDestroyKey", "Ptr", hK) 
	msgbox % "8: " A_LastError
	DllCall("Advapi32\CryptReleaseContext", "Ptr", hP, "Uint", 0)
	msgbox % "9: " A_LastError
	return sz
}

All msgboxes output "0" and I can even see the tooltip from the hotkey being shown but it crashes around 100-200ms after showing it.
For some reason after a restart it worked without any problems. After looping that function around 200-300 times it started crashing no matter what I did, even removing the File part gives the same crash.


@edit: When I remove the function call it works perfectly. So it is the function that gives problems. Can it be related to that advapi32.dll is deprecated? It doesn't happen to me with CNG's AES Encryption.
Also It seems like there is something missing, like if you run it a lot of times the chances for it to crash increase. Seems like some kind of memory leak (idk the exact word I'm not very experienced on this) that accumulates, maybe a handle that is not getting closed?

[guest3456]

@edit: When I remove the function call it works perfectly. So it is the function that gives problems.

what function call? can you post exact code that always works 100%, and exact code that fails? and are you trying on AHK_H v1 or v2

Also It seems like there is something missing, like if you run it a lot of times the chances for it to crash increase. Seems like some kind of memory leak (idk the exact word I'm not very experienced on this) that accumulates, maybe a handle that is not getting closed?

yeah could be something like that

[kyuuuri]

@edit: When I remove the function call it works perfectly. So it is the function that gives problems.

can you post exact code that always works 100%, and exact code that fails? and are you trying on AHK_H v1 or v2

Also It seems like there is something missing, like if you run it a lot of times the chances for it to crash increase. Seems like some kind of memory leak (idk the exact word I'm not very experienced on this) that accumulates, maybe a handle that is not getting closed?

yeah could be something like that

Not at home right now. The code that works uses CNG, you can find it con jNizM functions con scripts and functions section.

Using ahk_h v1 on w10

[guest3456]

Not at home right now. The code that works uses CNG, you can find it con jNizM functions con scripts and functions section.

Using ahk_h v1 on w10

no, i mean, you said it works "without the function call" what does that mean?

[kyuuuri]

Not at home right now. The code that works uses CNG, you can find it con jNizM functions con scripts and functions section.

Using ahk_h v1 on w10

no, i mean, you said it works "without the function call" what does that mean?

Without callinh CryptAES it works, I mean it doesn't encrypt anything but it never crashes. That shows us that CryptAES is making the script crash.

[guest3456]

Without callinh CryptAES it works, I mean it doesn't encrypt anything but it never crashes. That shows us that CryptAES is making the script crash.

yes obviously we've determined that. i was hoping to isolate which specific DllCall function was responsible for the crash. but it seems you are saying that the CryptAES completes successfully, you see the tooltip, and then 100-200ms later the script crashes. that's weird.

[HotKeyIt]

What happens if you run it in a loop, for me this runs fine ahkv1 Win32w and Win32w_MT:

Code: Select all

i:=0
Loop 1000 {
	Path := "D:\testenc.txt"
	hash := "f1461877468516263ea376f8588c8bc0c1413ca7712f9d4d5e624b95efda69c5"
	sz := CryptAES(hash, StrLen(hash)*(A_IsUnicode+1) + (A_IsUnicode+1), "431GddAtuifssBogjCkgdoswMasegvsA5fkd8/*4-fa@#d", true)
	tooltip % ++i
	; Write
	file := FileOpen(Path, "a", "UTF-8")
	File.RawWrite(&hash, sz)
	File.close()
}

CryptAES(ByRef lp,sz,pw,e:=1,SID:=256){
	static AES_128:=0x660E,AES_192:=1+AES_128,AES_256:=1+AES_192,SHA1:=1+0x8003 ; MD5
	If !DllCall("Advapi32\CryptAcquireContext","Ptr*",hP,"Uint",0,"Uint",0,"Uint",24,"UInt",0xF0000000) ;PROV_RSA_AES, CRYPT_VERIFYCONTEXT
	|| !DllCall("Advapi32\CryptCreateHash","Ptr",hP,"Uint",SHA1,"Uint",0,"Uint",0,"Ptr*",H )
	|| !CryptHashData(H,&pw,StrLen(pw)*2,0)
	|| !CryptDeriveKey(hP,AES_%SID%,H,SID<<16,getvar(hK:=0))
	|| !CryptDestroyHash(H)
		return 0
	if e
		CryptEncrypt(hK,0,1,0,&lp,getvar(sz),sz+16)
	else
		CryptDecrypt(hK,0,1,0,&lp,getvar(sz))
	CryptDestroyKey(hK),CryptReleaseContext(hP,0)
	return sz
}

[kyuuuri]

This is weird.
This code:

Code: Select all

f1::
Path := "D:\test.txt"
hash := "f1461877468516263ea376f8588c8bc0c1413ca7712f9d4d5e624b95efda69c5"
file := FileOpen(Path, "a")
sz:=130 ; 130 because: hashLength = 64 * 2 = 128 (unicode) + 2 for terminating char = 130
loop, 100000
{
	VarSetCapacity(str, sz)
	StrPut(hash, &str)
	sz := CryptAES(str, sz, "431GddAtuifssBogjCkgdoswMasegvsA5fkd8/*4-fa@#d", true)
	tooltip %a_index%
	; Write

	test := StrGet(&str, sz/(A_IsUnicode+1)) ; sz / 1+1 = 144 / 2 = 72
	File.RawWrite(test, 144)
}
File.close()
return

f2::
Path := "D:\test.txt"
hash := "f1461877468516263ea376f8588c8bc0c1413ca7712f9d4d5e624b95efda69c5"
;file := FileOpen(Path, "a")
sz:=130 ; 130 because: hashLength = 64 * 2 = 128 (unicode) + 2 for terminating char = 130
loop, 100000
{
	VarSetCapacity(str, sz)
	StrPut(hash, &str)
	sz := CryptAES2(str, sz, "431GddAtuifssBogjCkgdoswMasegvsA5fkd8/*4-fa@#d", true)
	tooltip %a_index%
	; Write
	;test := StrGet(&str, sz/(A_IsUnicode+1)) ; sz / 1+1 = 144 / 2 = 72
	;File.RawWrite(test, 144)
}
;File.close()
return

f3::reload

CryptAES(ByRef lp,sz,pw,e:=1,SID:=256){
	static AES_128:=0x660E,AES_192:=1+AES_128,AES_256:=1+AES_192,SHA1:=1+0x8003 ; MD5
	DllCall("Advapi32\CryptAcquireContext","Ptr*",hP,"Uint",0,"Uint",0,"Uint",24,"UInt",0xF0000000)
	msgbox % "1: " A_LastError
	DllCall("Advapi32\CryptCreateHash","Ptr",hP,"Uint",SHA1,"Uint",0,"Uint",0,"Ptr*",H )
	msgbox % "2: " A_LastError
	DllCall("Advapi32\CryptHashData", "Ptr", H, "Uchar", &pw, "Uint", StrLen(pw)*2, "UInt", 0)
	msgbox % "3: " A_LastError
	DllCall("Advapi32\CryptDeriveKey", "Ptr", hP, "Ptr", AES_%SID%, "Ptr", H, "Uint", SID<<16, "Ptr", getvar(hK:=0))
	msgbox % "4: " A_LastError
	DllCall("Advapi32\CryptDestroyHash", "Ptr", H)
	msgbox % "5: " A_LastError
	if e
	{
		DllCall("Advapi32\CryptEncrypt", "Ptr", hK, "Ptr", 0, "int", 1, "Uint", 0, "Uchar", &lp, "Uint", getvar(sz), "Uint", sz+16)
		msgbox % "6: " A_LastError
	}
	else
	{
		msgbox % "7: " A_LastError
		DllCall("Advapi32\CryptDecrypt", "Ptr", hK, "Ptr", 0, "int", 1, "Uint", 0, "Uchar", &lp, "Uint", getvar(sz))
	}
	DllCall("Advapi32\CryptDestroyKey", "Ptr", hK) 
	msgbox % "8: " A_LastError
	DllCall("Advapi32\CryptReleaseContext", "Ptr", hP, "Uint", 0)
	msgbox % "9: " A_LastError
	return sz
}

CryptAES2(ByRef lp,sz,pw,e:=1,SID:=256){
	static AES_128:=0x660E,AES_192:=1+AES_128,AES_256:=1+AES_192,SHA1:=1+0x8003 ; MD5
	If !DllCall("Advapi32\CryptAcquireContext","Ptr*",hP,"Uint",0,"Uint",0,"Uint",24,"UInt",0xF0000000) ;PROV_RSA_AES, CRYPT_VERIFYCONTEXT
	|| !DllCall("Advapi32\CryptCreateHash","Ptr",hP,"Uint",SHA1,"Uint",0,"Uint",0,"Ptr*",H )
	;|| !CryptHashData(H,&pw,StrLen(pw)*2,0)
	|| !DllCall("Advapi32\CryptHashData", "Ptr", H, "Uchar", &pw, "Uint", StrLen(pw)*2, "UInt", 0)
	;|| !CryptDeriveKey(hP,AES_%SID%,H,SID<<16,getvar(hK:=0))
	|| !DllCall("Advapi32\CryptDeriveKey", "Ptr", hP, "Ptr", AES_%SID%, "Ptr", H, "Uint", SID<<16, "Ptr", getvar(hK:=0))
	;|| !CryptDestroyHash(H)
	|| !DllCall("Advapi32\CryptDestroyHash", "Ptr", H)
		return 0
	if e
		DllCall("Advapi32\CryptEncrypt", "Ptr", hK, "Ptr", 0, "int", 1, "Uint", 0, "Uchar", &lp, "Uint", getvar(sz), "Uint", sz+16)
	else
		DllCall("Advapi32\CryptDecrypt", "Ptr", hK, "Ptr", 0, "int", 1, "Uint", 0, "Uchar", &lp, "Uint", getvar(sz))
		;DllCall("Advapi32\CryptDecrypt",hK,0,1,0,&lp,getvar(sz))
	DllCall("Advapi32\CryptDestroyKey", "Ptr", hK) 
	DllCall("Advapi32\CryptReleaseContext", "Ptr", hP, "Uint", 0)
	return sz
}

Runs fine and at the same time it doesn't. If it starts to loop without any problems, it will never crash. It's like you have to be lucky when you open the script.

Steps I followed:
1. Opened it
2. Pressed F2, it crashed.
3. same as 2.
4. Opened it again, pressed F2, it worked, it ran around 20000 loops and I decided to reload (f3). Script reloaded and then crashed.
5. Opened it again, pressed F2, it crashed at first run.
6. same as 5.
7. same as 5.
8. same as 5.
9. same as 5.
10. Opened it again, pressed F2, it worked, it ran around 10000 loops and I decided to reload (f3). Script reloaded fine, not crashes.
11. I pressed F2, it crashed.

I'm lost. I think this is related to Advapi32 being deprecated.

Did the same steps with:
w10, ahk_h v1 (I changed /MT to /MD):
x64
x86 Unicode

w10, ahk_h v1 (I didn't change /MT):
x64
x86 Unicode

The script had the same behaviour on all those tests, the number of times I opened it and it crashed varies but again it's like random.

[HotKeyIt]

Can you disable AV and try again and make sure no other program is running.
Try also running it with windbg to see what happens.