October 2014 - Wine-bugs - list.winehq.org

[Bug 36731] New: Runes of Magic 'ClientUpdater.exe' crashes after a number of update cycles (mshtml environment setup contains stack buffer overflow)
by wine-bugs＠winehq.org 05 Dec '21

05 Dec '21

https://bugs.winehq.org/show_bug.cgi?id=36731 Bug ID: 36731 Summary: Runes of Magic 'ClientUpdater.exe' crashes after a number of update cycles (mshtml environment setup contains stack buffer overflow) Product: Wine Version: 1.7.20 Hardware: x86 OS: Linux Status: NEW Severity: normal Priority: P2 Component: mshtml Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Hello folks, found during investigation of 'Runes of Magic' client updater. There is a crash after a number of update cycles. Unfortunately it's not easily traceable as it requires large downloads and many client restarts (= hours) to reach the crash point. I started the updater with a few debug channels (= reduced noise) which still allowed me to do post-mortem analysis. The launcher restarts itself after each update cycle. --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/Runes of Magic $ WINEDEBUG=+tid,+seh,+loaddll,+process,+mshtml wine ./launcher.exe ... <hours, multiple updater restarts> ... 004f:trace:loaddll:load_builtin_dll Loaded L"C:\\windows\\system32\\mshtml.dll" at 0x7c090000: builtin 004f:trace:mshtml:DllGetClassObject (CLSID_HTMLDocument {00000001-0000-0000-c000-000000000046} 0x3392a8) 004f:trace:mshtml:ClassFactory_AddRef (0x1c2c80) ref = 1 004f:trace:mshtml:HTMLDocument_Create ((nil) IID_IUnknown 0x1c19d4) 004f:trace:mshtml:load_gecko () 004f:trace:mshtml:check_version "Wine Gecko 2.24" 004f:trace:mshtml:load_xul (L"C:\\windows\\system32\\gecko\\2.24\\wine_gecko\\\\xul.dll") 004f:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7c130001 ip=7c130001 tid=004f 004f:trace:seh:raise_exception info[0]=00000001 004f:trace:seh:raise_exception info[1]=8d43ade4 004f:trace:seh:raise_exception eax=00000001 ebx=006b0063 ecx=003389a0 edx=7bcda204 esi=00339330 edi=001c2de8 004f:trace:seh:raise_exception ebp=005c0070 esp=00338c00 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010212 004f:trace:seh:call_stack_handlers calling handler at 0x4a97b0 code=c0000005 flags=0 004f:trace:seh:call_stack_handlers handler at 0x4a97b0 returned 1 004f:trace:seh:call_stack_handlers calling handler at 0x7bc9ecf7 code=c0000005 flags=0 wine: Unhandled page fault on write access to 0x8d43ade4 at address 0x7c130001 (thread 004f), starting debugger... --- snip --- I looked at the crash site and noticed it being in the middle of opcode sequence. --- snip --- 7C130000 45 INC EBP 7C130001 0889 4424108D OR BYTE PTR DS:[ECX+8D102444],CL 7C130007 8313 B5 ADC DWORD PTR DS:[EBX],-4B 7C13000A FA CLI --- snip --- Decoded with proper opcode start addresses: --- snip --- 7C12FFFF 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8] 7C130002 894424 10 MOV DWORD PTR SS:[ESP+10],EAX 7C130006 8D83 13B5FAFF LEA EAX,[EBX+FFFAB513] --- snip --- Partial stack dump with 'esp' = 0x00338c00 from exception context: --- snip --- ... 00338BA8 C0000005 00338BAC 00000000 00338BB0 00000000 00338BB4 7C130001 00338BB8 00000002 00338BBC 00000001 00338BC0 8D43ADE4 äC 00338BC4 00650074 t e 00338BC8 0033006D m 3 00338BCC 005C0032 2 \ 00338BD0 00650067 g e 00338BD4 006B0063 c k 00338BD8 005C006F o \ 00338BDC 002E0032 2 . 00338BE0 00340032 2 4 00338BE4 0077005C \ w 00338BE8 006E0069 i n 00338BEC 00000005 00338BF0 00650067 g e 00338BF4 006B0063 c k 00338BF8 005C006F o \ 00338BFC 7C130000 00338C00 00338F74 ; UNICODE "C:\windows\system32\gecko\2.24\wine_gecko\" 00338C04 7C1FF480 00338C08 7C19E234 ; ASCII "load_xul" 00338C0C 7C19CF48 ; ASCII "(%s)" 00338C10 7BCEC8C1 ; ASCII "L"C:\\windows\\system32\\gecko\\2.24\\wine_gecko\\\\xul.dll"" 00338C14 7C19D4E8 ; ASCII "Wine Gecko 2.24" 00338C18 7C19E250 ; ASCII "check_version" 00338C1C 7C19D4C0 ; ASCII "%s" 00338C20 7BCEC8AF ; ASCII ""Wine Gecko 2.24"" ... --- snip --- Yes, looks pretty much like a stack buffer overflow. A string buffer overwrote 'ebp', 'ebx' values (register save on stack for '__x86_get_pc_thunk_bx') and parts of the return address. The NULL terminator cancelled out the lower 16 bits of the return address. The culprit: 'load_xul' -> 'set_environment' Source: http://source.winehq.org/git/wine.git/blob/0be56d27d2d4b22367313fa4c6f1e658… --- snip --- 439 static void set_environment(LPCWSTR gre_path) 440 { 441 WCHAR path_env[MAX_PATH], buf[20]; 442 int len, debug_level = 0; 443 444 static const WCHAR pathW[] = {'P','A','T','H',0}; 445 static const WCHAR warnW[] = {'w','a','r','n',0}; 446 static const WCHAR xpcom_debug_breakW[] = 447 {'X','P','C','O','M','_','D','E','B','U','G','_','B','R','E','A','K',0}; 448 static const WCHAR nspr_log_modulesW[] = 449 {'N','S','P','R','_','L','O','G','_','M','O','D','U','L','E','S',0}; 450 static const WCHAR debug_formatW[] = {'a','l','l',':','%','d',0}; 451 452 /* We have to modify PATH as XPCOM loads other DLLs from this directory. */ 453 GetEnvironmentVariableW(pathW, path_env, sizeof(path_env)/sizeof(WCHAR)); 454 len = strlenW(path_env); 455 path_env[len++] = ';'; 456 strcpyW(path_env+len, gre_path); 457 SetEnvironmentVariableW(pathW, path_env); 458 459 SetEnvironmentVariableW(xpcom_debug_breakW, warnW); 460 461 if(TRACE_ON(gecko)) 462 debug_level = 5; 463 else if(WARN_ON(gecko)) 464 debug_level = 3; 465 else if(ERR_ON(gecko)) 466 debug_level = 2; 467 468 sprintfW(buf, debug_formatW, debug_level); 469 SetEnvironmentVariableW(nspr_log_modulesW, buf); 470 } --- snip --- 'path_env' must have overflowed ... but how? I used a JIT debugger to examine the process environment block at the time of the crash since 'GetEnvironmentVariableW' reads from 'NtCurrentTeb()->Peb->ProcessParameters->Environment'. --- snip ---- Address UNICODE dump ... 00231EC0 m32\cmd.exe.PATH 00231EE0 =C:\windows\syst 00231F00 em32;C:\windows; 00231F20 C:\windows\syste 00231F40 m32\wbem;C:\wind 00231F60 ows\system32\gec 00231F80 ko\2.24\wine_gec 00231FA0 ko\;C:\windows\s 00231FC0 ystem32\gecko\2. 00231FE0 24\wine_gecko\;C 00232000 :\windows\system 00232020 32\gecko\2.24\wi 00232040 ne_gecko\;C:\win 00232060 dows\system32\ge 00232080 cko\2.24\wine_ge 002320A0 cko\;C:\windows\ 002320C0 system32\gecko\2 002320E0 .24\wine_gecko\. 00232100 TEMP=C:\users\fo 00232120 cht\Temp.TMP=C:\ 00232140 users\focht\Temp 00232160 .windir=C:\windo 00232180 ws.ALLUSERSPROFI 002321A0 LE=C:\users\Publ 002321C0 ic.APPDATA=C:\us ... --- snip --- At the time 'gre_path' path was appended, the string from 'PATH' environment variable had already grown near 'MAX_PATH' (260 characters) buffer limit. 'PATH' is of course not limited to 'MAX_PATH' since it contains a list of paths. A better option would be to query with 'GetEnvironmentVariableW( value, NULL, 0)' first and allocate the needed buffer from heap, including length for 'gre_path'. Even with these things corrected there is still a general problem: at one point it will overflow/being blocked from appending to 'PATH'. Each newly created updater process inherits the process environment from parent (client updater restarts itself each time). A more sophisticated thing to do would be to search for existing value and not append if already present. Wine Mono 'mscoree' component has a similar potential stack buffer overflow: http://source.winehq.org/git/wine.git/blob/8cdcf470016f0655dfc8810f9d4d2f2d… Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 6

[Bug 31358] New: Bobcad v25 hangs on startup
by wine-bugs＠winehq.org 04 Dec '21

04 Dec '21

http://bugs.winehq.org/show_bug.cgi?id=31358 Bug #: 31358 Summary: Bobcad v25 hangs on startup Product: Wine Version: 1.5.9 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com Classification: Unclassified Tried installing free trial 13f91536f3a429ccb65b45b7bf72adb927c7d294 BobCAD_V25_Demo_32bit.exe from http://www.bobcad.com/products/cad Seemed to install fine, and put up a UI, but the main window of the UI was never drawn, and the UI was nonresponsive. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 7

[Bug 24664] New: The letter 'R' is not visible in Shapes On A Plane
by wine-bugs＠winehq.org 04 Dec '21

04 Dec '21

http://bugs.winehq.org/show_bug.cgi?id=24664 Summary: The letter 'R' is not visible in Shapes On A Plane Product: Wine Version: 1.3.4 Platform: x86 URL: https://www.digipen.edu/?id=1170&proj=433 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: andrew.millington(a)gmail.com Nearly all the letter 'R' are not visible in text such as the options screen. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 12

[Bug 20987] New: msi tests can't be run in parallel
by wine-bugs＠winehq.org 04 Dec '21

04 Dec '21

http://bugs.winehq.org/show_bug.cgi?id=20987 Summary: msi tests can't be run in parallel Product: Wine Version: 1.1.34 Platform: PC OS/Version: Linux Status: NEW Severity: enhancement Priority: P2 Component: testcases AssignedTo: wine-bugs(a)winehq.org ReportedBy: dank(a)kegel.com We spend an awful lot of time waiting for tests to finish. It'd be awesome if "make -j 100 test" worked. As a first step, let's make the msi tests work in parallel. "make -j100" in the msi directory explodes at the moment because many of the tests use the same filenames. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 6

[Bug 32991] New: ARM port of "WabbitEMU" crashes due to unimplemented function KERNEL32.dll.RtlUnwindEx (no ntdll forward on arch=arm)
by wine-bugs＠winehq.org 03 Dec '21

03 Dec '21

http://bugs.winehq.org/show_bug.cgi?id=32991 Bug #: 32991 Summary: ARM port of "WabbitEMU" crashes due to unimplemented function KERNEL32.dll.RtlUnwindEx (no ntdll forward on arch=arm) Product: Wine Version: 1.5.24 Platform: arm OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: kernel32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello folks, the ARM port of "WabbitEMU", a Texas Instruments graphing calculator emulator and dev tools crashes after clicking "Browse for a ROM image" radio button in image selection dialog. Download: http://forum.xda-developers.com/showpost.php?p=37928562 (main thread: http://forum.xda-developers.com/showthread.php?t=2092348) --- snip --- $ WINEDEBUG=+tid,+seh,+relay wine ./Wabbitemu.exe ... 0024:Call user32.GetWindowTextA(00010096,40a0ebf0,00000104) ret=00439fa5 0024:Call window proc 0x40bc5f30 (hwnd=0x10096,msg=WM_GETTEXT,wp=00000104,lp=40a0ebf0) 0024:Ret window proc 0x40bc5f30 (hwnd=0x10096,msg=WM_GETTEXT,wp=00000104,lp=40a0ebf0) retval=00000000 0024:Ret user32.GetWindowTextA() retval=00000000 ret=00439fa5 0024:Call KERNEL32.GetLastError() ret=004141cf 0024:Ret KERNEL32.GetLastError() retval=00000000 ret=004141cf 0024:trace:seh:raise_exception info[0]=0047be54 0024:trace:seh:raise_exception info[1]=0047cc8e wine: Call from 0x7bc9a630 to unimplemented function KERNEL32.dll.RtlUnwindEx, aborting 0024:trace:seh:call_stack_handlers calling handler at 0x7bcb8d88 code=80000100 flags=1 0024:Call KERNEL32.UnhandledExceptionFilter(40a0e81c) ret=7bcb8df0 --- snip --- The app is importing all win32 API by name so it's the real thing :-) +module,+imports --- snip --- ... 0009:trace:module:load_dll looking for L"KERNEL32.dll" in L"Z:\\home\\linaro\\wine-apps\\wabbitemu;.;C:\\windows\\system32;C:\\windows\\system;C:\\windows;C:\\windows\\system32;C:\\windows;C:\\windows\\system32\\wbem" 0009:trace:module:load_dll Found L"C:\\windows\\system32\\KERNEL32.dll" for L"KERNEL32.dll" at 0x7b820000, count=19 0009:warn:module:import_dll No implementation for KERNEL32.dll.RtlUnwindEx imported from L"Z:\\home\\linaro\\wine-apps\\wabbitemu\\Wabbitemu.exe", setting to 0x41820000 0009:trace:imports:import_dll --- RtlUnwindEx KERNEL32.dll.1209 = 0x41820000 0009:trace:imports:import_dll --- GetCommandLineA KERNEL32.dll.481 = 0x7b846be0 0009:trace:imports:import_dll --- RtlPcToFileHeader KERNEL32.dll.1205 = 0x7bc69188 0009:warn:module:import_dll No implementation for KERNEL32.dll.RtlLookupFunctionEntry imported from L"Z:\\home\\linaro\\wine-apps\\wabbitemu\\Wabbitemu.exe", setting to 0x41820024 0009:trace:imports:import_dll --- RtlLookupFunctionEntry KERNEL32.dll.1203 = 0x41820024 0009:trace:imports:import_dll --- GetModuleFileNameW KERNEL32.dll.634 = 0x7b86b864 ... --- snip --- It also needs KERNEL32.dll.RtlLookupFunctionEntry later. Wine forwards both to ntdll but only on arch=x86_64. It seems Windows RT exposes both API. Interestingly only the MSDN page for KERNEL32.dll.RtlLookupFunctionEntry gives a hint about this: http://msdn.microsoft.com/en-us/library/windows/desktop/ms680597%28v=vs.85%… ("ARM Definition"). Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 23

[Bug 25193] New: Dasher does not operate correctly
by wine-bugs＠winehq.org 03 Dec '21

03 Dec '21

http://bugs.winehq.org/show_bug.cgi?id=25193 Summary: Dasher does not operate correctly Product: Wine Version: 1.3.7 Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: physicspirate(a)yahoo.ca Greetings, I've attempted to run Dasher(http://appdb.winehq.org/objectManager.php?sClass=version&iId=21982&i… and it does not appear to be loading or functioning correctly. I've attached a screenshot of what happens after loading. There is a gray box up top, and it appears to be non responsive. There also seems to be some problems with the networking as I have a high speed connection, and their servers tell me my latency is too high. If I run the same program on windows it runs like a dream. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 13

[Bug 36844] New: Multiple games need X3DAudio1_7.dll (BeamNG v0.3 Tech Demo)
by wine-bugs＠winehq.org 01 Dec '21

01 Dec '21

https://bugs.winehq.org/show_bug.cgi?id=36844 Bug ID: 36844 Summary: Multiple games need X3DAudio1_7.dll (BeamNG v0.3 Tech Demo) Product: Wine Version: 1.7.21 Hardware: x86 OS: Linux Status: NEW Severity: normal Priority: P2 Component: directx-dsound Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Hello folks, as the summary says. Bug 12182 should be avoided in future (meta bug) .. very unfortunate, covering all XAudio dlls. Better are bugs that specifically target stub dlls like bug 24545 ("Monkey Island: Special Edition wants X3DAudio1_6.dll"). --- snip --- $ pwd /home/focht/.wine/drive_c/users/focht/Local Settings/Application Data/BeamNG/BeamNG-Techdemo-0.3 ... $ wine ./BeamNGSandbox.x86.exe ... err:module:import_dll Library X3DAudio1_7.dll (which is needed by L"C:\\users\\focht\\Local Settings\\Application Data\\BeamNG\\BeamNG-Techdemo-0.3\\BeamNGSandbox.x86.dll") not found --- snip --- $ sha1sum BeamNG-Techdemo-0.3-setup.zip 21b29af0c77cf138ec69edf1c4cb0d4504bb2ed9 BeamNG-Techdemo-0.3-setup.zip $ du -sh BeamNG-Techdemo-0.3-setup.zip 95M BeamNG-Techdemo-0.3-setup.zip $ wine --version wine-1.7.21-50-g10e6a66 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 13

[Bug 21010] New: vc2005express install broken
by wine-bugs＠winehq.org 28 Nov '21

28 Nov '21

http://bugs.winehq.org/show_bug.cgi?id=21010 Summary: vc2005express install broken Product: Wine Version: 1.1.34 Platform: PC-x86-64 OS/Version: Linux Status: NEW Keywords: download, Installer, regression Severity: normal Priority: P2 Component: msi AssignedTo: wine-bugs(a)winehq.org ReportedBy: austinenglish(a)gmail.com CC: hans(a)meelstraat.net Regression testing points to: bd4bc161475f600612fad898f09825d74d6368a9 is first bad commit commit bd4bc161475f600612fad898f09825d74d6368a9 Author: Hans Leidekker <hans(a)codeweavers.com> Date: Tue Nov 17 15:59:11 2009 +0100 msi: Don't set the ALLUSERS property. :040000 040000 8964ea41515d9eaa19c0d38d44caa5b4661665e7 f3940f8962ebb38ca7f406d7fa1c65f44feaf03e M dlls side note: git bisect run is awesome! Reverting that in git lets the installer run to completion. Terminal output is breathtakingly short: Executing wine Ixpvc /t:c:\winetrickstmp\vc2005express.tmp /q:a /c:msiexec /i vcsetup.msi VSEXTUI=1 ADDLOCAL=ALL REBOOT=ReallySuppress err:msi:ITERATE_Actions Execution halted, action L"SxsInstallCA" returned 1603 err:msi:ITERATE_Actions Execution halted, action L"ExecuteAction" returned 1603 -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 5

[Bug 16999] New: Visual C++ 2005 Express IDE: stack overflow at startup due to empty class id string
by wine-bugs＠winehq.org 28 Nov '21

28 Nov '21

http://bugs.winehq.org/show_bug.cgi?id=16999 Summary: Visual C++ 2005 Express IDE: stack overflow at startup due to empty class id string Product: Wine Version: 1.1.13 Platform: Other URL: http://www.microsoft.com/express/2005/download/default.a spx OS/Version: other Status: UNCONFIRMED Severity: normal Priority: P2 Component: ole32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Hello, prerequisites: Patch from bug 5054 to work around invalid URL cache entries (http://bugs.winehq.org/attachment.cgi?id=18726) 1. clean WINEPREFIX 2. sh winetricks -q dotnet20 msxml6 3. download and run web installer (see URL) 4. start the VC++ 2005 IDE (wine VCExpress.exe) --- The IDE crashes due to stack overflow. --- snip --- ... 0038:Call advapi32.RegQueryValueExW(00000418,50061238 L"MRUCommand2GUID",00000000,003289e8,003289ec,003289e0) ret=50008e41 0038:Ret advapi32.RegQueryValueExW() retval=00000000 ret=50008e41 0038:Call advapi32.RegQueryValueExW(00000418,502800c8 L"MRUCommand2ID",00000000,00000000,00328c38,00328c34) ret=501f1800 0038:Ret advapi32.RegQueryValueExW() retval=00000000 ret=501f1800 0038:Call ole32.CLSIDFromString(00328c40 L"{5EFC7975-14BC-11CF-9B2B-00AA00573819}",50758004) ret=501f181a 0038:trace:ole:__CLSIDFromString L"{5EFC7975-14BC-11CF-9B2B-00AA00573819}" -> 0x50758004 0038:Ret ole32.CLSIDFromString() retval=00000000 ret=501f181a 0038:CALL MSVCR80.memset(003289f0,00000000,00000204) ret=50008e1d 0038:RET MSVCR80.memset() retval=003289f0 ret=50008e1d 0038:Call advapi32.RegQueryValueExW(00000418,50061258 L"MRUCommand3GUID",00000000,003289e8,003289ec,003289e0) ret=50008e41 0038:Ret advapi32.RegQueryValueExW() retval=00000000 ret=50008e41 0038:Call advapi32.RegQueryValueExW(00000418,502800e4 L"MRUCommand3ID",00000000,00000000,00328c38,00328c34) ret=501f1847 0038:Ret advapi32.RegQueryValueExW() retval=00000000 ret=501f1847 0038:Call ole32.CLSIDFromString(00328c40 L"",50758018) ret=501f1861 0038:Call KERNEL32.GetProcessHeap() ret=604e16fd 0038:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=604e16fd 0038:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=604e1711 0038:Ret ntdll.RtlAllocateHeap() retval=00ed1298 ret=604e1711 0038:Call advapi32.RegOpenKeyW(80000000,00ed1298 L"\\CLSID",00328acc) ret=604e1758 0038:Ret advapi32.RegOpenKeyW() retval=00000000 ret=604e1758 ... 0038:Call advapi32.RegOpenKeyW(80000000,00ed1298 L"\\CLSID",0023294c) ret=604e1758 0038:Ret advapi32.RegOpenKeyW() retval=00000000 ret=604e1758 0038:Call KERNEL32.GetProcessHeap() ret=604e17f0 0038:Ret KERNEL32.GetProcessHeap() retval=00110000 ret=604e17f0 0038:Call ntdll.RtlFreeHeap(00110000,00000000,00ed1298) ret=604e1809 0038:Ret ntdll.RtlFreeHeap() retval=00000001 ret=604e1809 0038:Call advapi32.RegQueryValueW(0000043c,00000000,00232956,00232950) ret=604e182d 0038:Ret advapi32.RegQueryValueW() retval=00000000 ret=604e182d 0038:Call advapi32.RegCloseKey(0000043c) ret=604e18b1 0038:Ret advapi32.RegCloseKey() retval=00000000 ret=604e18b1 0038:trace:seh:raise_exception code=c00000fd flags=0 addr=0x601e289e ip=0x601e289e tid=0038 0038:trace:seh:raise_exception eax=00000000 ebx=602e4ff4 ecx=00232720 edx=00000000 esi=00000000 edi=0023268c 0038:trace:seh:raise_exception ebp=00232038 esp=00231ffc cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010206 0038:trace:seh:call_stack_handlers calling handler at 0x506ea492 code=c00000fd flags=0 0038:err:seh:setup_exception_record stack overflow 976 bytes in thread 0038 eip 601b4678 esp 00230f60 stack 0x230000-0x231000-0x330000 --- snip --- Relevant registry data: --- snip --- [HKEY_USERS\S-1-5-4\Software\Microsoft\VCExpress\8.0\StartPage] "Command1"="{F3192B90-EA73-480F-9471-04524118D767}|20487|" "Command2"="{F3192B90-EA73-480F-9471-04524118D767}|20482|" "Command3"="{F3192B90-EA73-480F-9471-04524118D767}|20480|" "Command4"="{F3192B90-EA73-480F-9471-04524118D767}|20481|" "Command5"="{F3192B90-EA73-480F-9471-04524118D767}|20483|" "Command6"="{F3192B90-EA73-480F-9471-04524118D767}|20485|" "DownloadState"=dword:00000000 "MRUCommand1GUID"="{5EFC7975-14BC-11CF-9B2B-00AA00573819}" "MRUCommand1ID"=dword:000000d8 "MRUCommand2GUID"="{5EFC7975-14BC-11CF-9B2B-00AA00573819}" "MRUCommand2ID"=dword:00000141 "MRUCommand3GUID"="" "MRUCommand3ID"=dword:00000000 "MRUCommand4GUID"="" "MRUCommand4ID"=dword:00000000 --- snip --- The problem is actually a bug in CLSIDFromProgID() when passed an empty id string which results in nice recursion :-) --- snip dlls/ole32/compobj.c --- HRESULT WINAPI CLSIDFromString(LPOLESTR idstr, CLSID *id ) { HRESULT ret; if (!id) return E_INVALIDARG; ret = __CLSIDFromString(idstr, id); if(ret != S_OK) { /* It appears a ProgID is also valid */ ret = CLSIDFromProgID(idstr, id); } return ret; } ... HRESULT WINAPI CLSIDFromProgID(LPCOLESTR progid, LPCLSID clsid) { static const WCHAR clsidW[] = { '\\','C','L','S','I','D',0 }; WCHAR buf2[CHARS_IN_GUID]; LONG buf2len = sizeof(buf2); HKEY xhkey; WCHAR *buf; if (!progid || !clsid) { ERR("neither progid (%p) nor clsid (%p) are optional\n", progid, clsid); return E_INVALIDARG; } /* initialise clsid in case of failure */ memset(clsid, 0, sizeof(*clsid)); buf = HeapAlloc( GetProcessHeap(),0,(strlenW(progid)+8) * sizeof(WCHAR) ); strcpyW( buf, progid ); strcatW( buf, clsidW ); if (RegOpenKeyW(HKEY_CLASSES_ROOT,buf,&xhkey)) { HeapFree(GetProcessHeap(),0,buf); WARN("couldn't open key for ProgID %s\n", debugstr_w(progid)); return CO_E_CLASSSTRING; } HeapFree(GetProcessHeap(),0,buf); if (RegQueryValueW(xhkey,NULL,buf2,&buf2len)) { RegCloseKey(xhkey); WARN("couldn't query clsid value for ProgID %s\n", debugstr_w(progid)); return CO_E_CLASSSTRING; } RegCloseKey(xhkey); return CLSIDFromString(buf2,clsid); } --- snip dlls/ole32/compobj.c --- CLSIDFromProgID() needs to be fixed for the empty cls/prog id string case. With proper patch applied, the IDE starts. Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 9

[Bug 36736] New: Tucows Download Manager 2014 crashes on startup (decryption scheme relies on 'kernel32.dll.SetFilePointer' hotpatch signature)
by wine-bugs＠winehq.org 28 Nov '21

28 Nov '21

https://bugs.winehq.org/show_bug.cgi?id=36736 Bug ID: 36736 Summary: Tucows Download Manager 2014 crashes on startup (decryption scheme relies on 'kernel32.dll.SetFilePointer' hotpatch signature) Product: Wine Version: 1.7.20 Hardware: x86 OS: Linux Status: NEW Severity: normal Priority: P2 Component: kernel32 Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Hello folks, example download: http://www.tucows.com/preview/609375/Intuit-QuickBooks-Simple-Start-Edition… The download manager/installer uncompresses a secondary installer from bootstrapper. Before that the app decrypts parts of itself and this is done incorrectly, leading to strange results/code paths later. --- snip --- $ WINEDEBUG=+tid,+seh,+relay wine ./Setup_QuickBooks_SimpleStart_Intel_2009.exe >>log.txt 2>&1 ... 0023:Starting process L"Z:\\home\\focht\\Downloads\\Setup_QuickBooks_SimpleStart_Intel_2009.exe" (entryproc=0x409c40) 0023:Call KERNEL32.GetModuleHandleA(00000000) ret=004030e8 0023:Ret KERNEL32.GetModuleHandleA() retval=00400000 ret=004030e8 0023:Call KERNEL32.GetCommandLineA() ret=004030f3 0023:Ret KERNEL32.GetCommandLineA() retval=00134078 ret=004030f3 ... 0023:Call KERNEL32.CreateFileA(004203cc "Z:\\home\\focht\\Downloads\\Setup_QuickBooks_SimpleStart_Intel_2009.exe",80000000,00000001,00000000,00000003,00000080,00000000) ret=004075bd 0023:Ret KERNEL32.CreateFileA() retval=00000050 ret=004075bd 0023:Call KERNEL32.FindResourceA(00000000,00002b67,0000000a) ret=00409bfb 0023:Ret KERNEL32.FindResourceA() retval=004112c8 ret=00409bfb 0023:Call KERNEL32.SizeofResource(00000000,004112c8) ret=00409c0e 0023:Ret KERNEL32.SizeofResource() retval=0000002c ret=00409c0e 0023:Call KERNEL32.LoadResource(00000000,004112c8) ret=00409c20 0023:Ret KERNEL32.LoadResource() retval=00419a88 ret=00409c20 0023:Call KERNEL32.LockResource(00419a88) ret=00409c31 0023:Ret KERNEL32.LockResource() retval=00419a88 ret=00409c31 ... 0023:Call KERNEL32.CreateFileA(00437a5c "C:\\users\\focht\\Temp\\is-RJFDD.tmp\\Setup_QuickBooks_SimpleStart_Intel_2009.tmp",40000000,00000000,00000000,00000002,00000080,00000000) ret=004075bd 0023:Ret KERNEL32.CreateFileA() retval=00000054 ret=004075bd ... 0023:Call KERNEL32.SetFilePointer(00000050,00000000,0033fd78,00000001) ret=004075e0 0023:Ret KERNEL32.SetFilePointer() retval=000b9b03 ret=004075e0 0023:Call KERNEL32.SetFilePointer(00000050,000b9b03,0033fd60,00000000) ret=00407690 0023:Ret KERNEL32.SetFilePointer() retval=000b9b03 ret=00407690 0023:Call KERNEL32.SetFilePointer(00000054,00002a72,0033fd7c,00000000) ret=00407690 0023:Ret KERNEL32.SetFilePointer() retval=00002a72 ret=00407690 0023:Call KERNEL32.SetEndOfFile(00000054) ret=004076b8 0023:Ret KERNEL32.SetEndOfFile() retval=00000001 ret=004076b8 0023:Call KERNEL32.SetFilePointer(00000054,00000000,0033fd7c,00000000) ret=00407690 0023:Ret KERNEL32.SetFilePointer() retval=00000000 ret=00407690 0023:Call KERNEL32.WriteFile(00000054,00420424,00002a72,0033fd88,00000000) ret=004076e4 0023:Ret KERNEL32.WriteFile() retval=00000001 ret=004076e4 0023:Call KERNEL32.CloseHandle(00000054) ret=0040755d 0023:Ret KERNEL32.CloseHandle() retval=00000001 ret=0040755d 0023:Call KERNEL32.CloseHandle(00000050) ret=0040755d 0023:Ret KERNEL32.CloseHandle() retval=00000001 ret=0040755d 0023:Call user32.CreateWindowExA(00000000,0040a334 "STATIC",0040a320 "InnoSetupLdrWindow",00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000) ret=0040a136 ... 0023:Call KERNEL32.CreateProcessA(00000000,00420488 "\"C:\\users\\focht\\Temp\\is-RJFDD.tmp\\Setup_QuickBooks_SimpleStart_Intel_2009.tmp\" /SL5=\"$10066,747501,80384,Z:\\home\\focht\\Downloads\\Setup_QuickBooks_SimpleStart_Intel_2009.exe\" ",00000000,00000000,00000000,00000000,00000000,00000000,0033fd64,0033fd54) ret=00409a19 0023:Ret KERNEL32.CreateProcessA() retval=00000000 ret=00409a19 0023:Call KERNEL32.GetLastError() ret=00409671 0023:Ret KERNEL32.GetLastError() retval=00000005 ret=00409671 0023:Call KERNEL32.FormatMessageA(00003200,00000000,00000005,00000000,0033f8f8,00000400,00000000) ret=004072a8 0023:Ret KERNEL32.FormatMessageA() retval=00000010 ret=004072a8 0023:trace:seh:raise_exception code=c0000005 flags=0 addr=0x402eb4 ip=00402eb4 tid=0023 0023:trace:seh:raise_exception info[0]=00000000 0023:trace:seh:raise_exception info[1]=0000fd38 0023:trace:seh:raise_exception eax=00420654 ebx=00000069 ecx=00000002 edx=00000000 esi=00000005 edi=0040b240 0023:trace:seh:raise_exception ebp=0033fd34 esp=0033fd00 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010212 0023:trace:seh:call_stack_handlers calling handler at 0x4096eb code=c0000005 flags=0 ... 0023:trace:seh:call_stack_handlers handler at 0x7bc825c1 returned 2 0023:trace:seh:call_stack_handlers calling handler at 0x4096eb code=c00000fd flags=10 0023:err:seh:setup_exception_record stack overflow 992 bytes in thread 0023 eip f73e796b esp 00240f50 stack 0x240000-0x241000-0x340000 --- snip --- What is not seen (debugging): the app uses the entry point signature of 'kernel32.dll.SetFilePointer' as seed for further decryption. --- snip --- ... 0040400C 8B73 01 MOV ESI,DWORD PTR DS:[EBX+1] ; SetFilePointer 0040400F 89F7 MOV EDI,ESI ; 00404011 4F DEC EDI 00404012 8B57 01 MOV EDX,DWORD PTR DS:[EDI+1] ; *(DWORD*)entry 00404015 BB 6319F033 MOV EBX,33F01963 0040401A 31DA XOR EDX,EBX 0040401C 89D3 MOV EBX,EDX 0040401E 53 PUSH EBX 0040401F 5E POP ESI 00404020 89F0 MOV EAX,ESI 00404022 BA A6AA2938 MOV EDX,3829AAA6 00404027 81F2 A2AA2938 XOR EDX,3829AAA2 0040402D 29D4 SUB ESP,EDX 0040402F 890424 MOV DWORD PTR SS:[ESP],EAX 00404032 68 22778D73 PUSH 738D7722 00404037 B9 E9E37802 MOV ECX,278E3E9 0040403C 58 POP EAX 0040403D 31C1 XOR ECX,EAX 0040403F BF 7325BB99 MOV EDI,99BB2573 00404044 31F9 XOR ECX,EDI 00404046 81F1 5057EB50 XOR ECX,50EB5750 0040404C 31CE XOR ESI,ECX --- snip --- Wine's 'kernel32.dll.SetFilePointer' entry signature: --- snip --- 7B83EE7E 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4] 7B83EE82 83E4 F0 AND ESP,FFFFFFF0 7B83EE85 FF71 FC PUSH DWORD PTR DS:[ECX-4] 7B83EE88 55 PUSH EBP 7B83EE89 89E5 MOV EBP,ESP 7B83EE8B 56 PUSH ESI 7B83EE8C 53 PUSH EBX 7B83EE8D 51 PUSH ECX 7B83EE8E 83EC 4C SUB ESP,4C 7B83EE91 E8 FA07FEFF CALL KERNEL32.__x86.get_pc_thunk.bx 7B83EE96 81C3 6AC10700 ADD EBX,7C16A --- snip --- The app expects a hotpatch-type entry which gives proper seed. With 'DECLSPEC_HOTPATCH': --- snip ---- 7B83EE8E 8BFF MOV EDI,EDI 7B83EE90 55 PUSH EBP 7B83EE91 8BEC MOV EBP,ESP 7B83EE93 5D POP EBP 7B83EE94 8D4C24 04 LEA ECX,DWORD PTR SS:[ESP+4] 7B83EE98 83E4 F0 AND ESP,FFFFFFF0 7B83EE9B FF71 FC PUSH DWORD PTR DS:[ECX-4] 7B83EE9E 55 PUSH EBP 7B83EE9F 89E5 MOV EBP,ESP ... --- snip ---- With that part fixed the installer runs into next (known) mshtml/ieframe bug. A DRM/protection scan on the installer doesn't show suspicious schemes (might be custom). --- snip --- -=[ ProtectionID v0.6.5.5 OCTOBER]=- (c) 2003-2013 CDKiLLER & TippeX Build 31/10/13-21:09:09 Ready... Scanning -> Z:\home\focht\Downloads\Setup_QuickBooks_SimpleStart_Intel_2009.exe File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 768984 (0BBBD8h) Byte(s) -> File Appears to be Digitally Signed @ Offset 0B9B08h, size : 020D0h / 08400 byte(s) -> File has 680200 (0A6108h) bytes of appended data starting at offset 013A00h [File Heuristics] -> Flag : 00000000000001001100000000100100 (0x0004C024) [Entrypoint Section Entropy] : 6.66 [-= Installer =-] Inno Setup v5.5.0 Module - Scan Took : 0.261 Second(s) [000000105h tick(s)] [533 scan(s) done] --- snip --- $ du -sh Setup_QuickBooks_SimpleStart_Intel_2009.exe 752K Setup_QuickBooks_SimpleStart_Intel_2009.exe $ sha1sum Setup_QuickBooks_SimpleStart_Intel_2009.exe d2f213e1d05845897c9dae891a73d6be62283206 Setup_QuickBooks_SimpleStart_Intel_2009.exe $ wine --version wine-1.7.20 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 5