February 2016 - Wine-bugs - list.winehq.org

[Bug 40143] New: bleem! 1.4 wants to switch to ring 0 kernel mode using a call gate
by wine-bugs＠winehq.org 19 Feb '16

19 Feb '16

https://bugs.winehq.org/show_bug.cgi?id=40143 Bug ID: 40143 Summary: bleem! 1.4 wants to switch to ring 0 kernel mode using a call gate Product: Wine Version: 1.9.3 Hardware: x86 URL: http://web.archive.org/web/20010607095803/http://www.b leem.com/files/demo-v1_4.exe OS: Linux Status: NEW Keywords: download, obfuscation Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: michael(a)fds-team.de CC: focht(a)gmx.net Distribution: --- After fixing bug 36013 the application is getting a bit crazy: 003F74E7 52 PUSH EDX 003F74E8 237E 50 AND EDI,DWORD PTR DS:[ESI+50] 003F74EB E8 BB54237E CALL krnl386.UnMapLS 003F74F0 83E0 FE AND EAX,FFFFFFFE 003F74F3 50 PUSH EAX 003F74F4 E8 A052237E CALL krnl386.MapLS 003F74F9 A3 C0743F00 MOV DWORD PTR DS:[3F74C0],EAX 003F74FE 6A 01 PUSH 1 003F7500 6A 00 PUSH 0 003F7502 68 29002A00 PUSH 2A0029 003F7507 E8 184A247E CALL krnl386.VxDCall // int31 - allocate LDT entry 003F750C A3 C4743F00 MOV DWORD PTR DS:[3F74C4],EAX UnMapLS leaks the address of the local descriptor table on Windows 9X. The LDT seems to be directly mapped into the user process and the application now tries to get a segment ptr for the LDT (not sure why though?). After getting a pointer, it allocates a new LDT entry and saves the segment index in 0x3F74C4. Now it is getting interesting: 003F7516 1E PUSH DS 003F7517 8E1D C2743F00 MOV DS,WORD PTR DS:[3F74C2] 003F751D C700 FFFF0000 MOV DWORD PTR DS:[EAX],0FFFF 003F7523 C740 04 009BCF00 MOV DWORD PTR DS:[EAX+4],0CF9B00 003F752A 1F POP DS The application changes the data segment to the segment containing the LDT table and starts changing the just allocated LDT entry. If you decode the written values you get the following LDT entry: (type = 11011, dpl = 00, present = 1, limithigh = 1111, sys = 0, reserved_0 = 0, default_big = 1, granularity = 1). This means it wants to map the whole 4GB range of memory as ring 0 (dpl = 0) code segment. You might already get an idea what the application is trying to do. After this bleem gets a second LDT entry using the same trick a second time: 003F752A 1F POP DS 003F752B 6A 01 PUSH 1 003F752D 6A 00 PUSH 0 003F752F 68 29002A00 PUSH 2A0029 003F7534 E8 EB49247E CALL krnl386.7E63BF24 003F7539 A3 C8743F00 MOV DWORD PTR DS:[3F74C8],EAX 003F753E 25 F8FF0000 AND EAX,0FFF8 003F7543 8B15 C2743F00 MOV EDX,DWORD PTR DS:[3F74C2] 003F7549 B9 EC753F00 MOV ECX,3F75EC 003F754E 66:8BD1 MOV DX,CX However this time it doesn't want to get a code segment: 003F7551 1E PUSH DS 003F7552 8E1D C2743F00 MOV DS,WORD PTR DS:[3F74C2] 003F7558 8910 MOV DWORD PTR DS:[EAX],EDX 003F755A 66:B9 00EC MOV CX,0EC00 003F755E 8948 04 MOV DWORD PTR DS:[EAX+4],ECX 003F7561 1F POP DS If you decode the written LDT entry, you will see that this is a call gate to switch from ring 3 to ring 0. Afterwards the application uses the call gate to switch to kernel mode and does funny stuff like: 003B194D CD20 61000100 VxDCall _CopyPageTable [...] 003B1AC3 CD20 28010100 VxDCall _PageCommitPhys I am pretty sure that we don't want and can't support this in Wine. I therefore close this as WONT FIX and just create this bug report so that no one else tries to debug this a second time. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 2

[Bug 39862] New: Steam crashes on install
by wine-bugs＠winehq.org 19 Feb '16

19 Feb '16

https://bugs.winehq.org/show_bug.cgi?id=39862 Bug ID: 39862 Summary: Steam crashes on install Product: Wine Version: unspecified Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: major Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: drednot57(a)gmail.com Distribution: --- Created attachment 53217 --> https://bugs.winehq.org/attachment.cgi?id=53217 Backtrace created after steam crash Installation gives crash error -- log file attached -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 2

[Bug 32121] New: ascont parohii v2.0 problem
by wine-bugs＠winehq.org 19 Feb '16

19 Feb '16

http://bugs.winehq.org/show_bug.cgi?id=32121 Bug #: 32121 Summary: ascont parohii v2.0 problem Product: Wine Version: unspecified Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: softliber(a)gmail.com Classification: Unclassified Created attachment 42370 --> http://bugs.winehq.org/attachment.cgi?id=42370 backtrace.txt instalation of an windows app. "ascont parohii" v2.0 is ok, but after register this app.: has encountered a problem and needs to close ... -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 7

[Bug 16776] New: Pyjs JSONRPC example test fails in wine iexplore
by wine-bugs＠winehq.org 19 Feb '16

19 Feb '16

http://bugs.winehq.org/show_bug.cgi?id=16776 Summary: Pyjs JSONRPC example test fails in wine iexplore Product: Wine Version: 1.1.12 Platform: PC URL: http://pyjs.org/examples/jsonrpc/output/JSONRPCExample.h tml OS/Version: Linux Status: NEW Keywords: download, source Severity: enhancement Priority: P2 Component: mshtml AssignedTo: wine-bugs(a)winehq.org ReportedBy: austinenglish(a)gmail.com Created an attachment (id=18450) --> (http://bugs.winehq.org/attachment.cgi?id=18450) +mshtml, bzip2 -9'ed Reported initially in wine-devel: http://www.winehq.org/pipermail/wine-devel/2009-January/071705.html Tried in firefox3, works fine (with PHP, python fails though). In iexplore, hangs on: fixme:mshtml:nsUploadChannel_SetUploadStream Unsupported aContentType argument: "application/x-www-form-urlencoded; charset=UTF-8" +mshtml attached -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 15

[Bug 39982] New: xaudio2_5.spec:2: function 'DllGetClassObject' not defined
by wine-bugs＠winehq.org 19 Feb '16

19 Feb '16

https://bugs.winehq.org/show_bug.cgi?id=39982 Bug ID: 39982 Summary: xaudio2_5.spec:2: function 'DllGetClassObject' not defined Product: Wine Version: 1.9.1 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: super_man(a)post.com Distribution: --- Since last commit round building of wine generates errors. Similar to the title mentioned. I did do git reset --hard origin before git pull and compile. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 2

[Bug 40022] New: Steam.exe fails on wine-staging 1.9.1, but working on the latest wine (official) at Git HEAD
by wine-bugs＠winehq.org 19 Feb '16

19 Feb '16

https://bugs.winehq.org/show_bug.cgi?id=40022 Bug ID: 40022 Summary: Steam.exe fails on wine-staging 1.9.1, but working on the latest wine (official) at Git HEAD Product: Wine-staging Version: 1.9.1 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: major Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: roman(a)hargrave.info CC: erich.e.hoover(a)wine-staging.com, michael(a)fds-team.de, sebastian(a)fds-team.de Distribution: --- `wine Steam.exe` returns exit status 1 on wine-staging 1.9.1 from the `testing` (`stretch`) debian repository. Running Steam.exe two `ERROR` level items are logged by Steam * WSALookupServiceBegin failed with: 8 * DNS Registry watch failed to start Please note that I am using the 32-Bit version of wine-staging and NOT the 64-Bit version. Steps to reproduce: * Using debian testing/stretch install wine-staging * Create and boot a new prefix for Steam * Install Steam * Attempt to run Steam I will submit logs when I am in front of my computer. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 16

[Bug 32268] New: When attempting to install RaiderZ a new mmog that launched yesterday the installer causes a stack a record stack overflow.
by wine-bugs＠winehq.org 19 Feb '16

19 Feb '16

http://bugs.winehq.org/show_bug.cgi?id=32268 Bug #: 32268 Summary: When attempting to install RaiderZ a new mmog that launched yesterday the installer causes a stack a record stack overflow. Product: Wine Version: unspecified Platform: x86-64 OS/Version: Linux Status: UNCONFIRMED Severity: critical Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: vince-wilson(a)att.net Classification: Unclassified Created attachment 42581 --> http://bugs.winehq.org/attachment.cgi?id=42581 bash output from wine RaiderZ install attempt (short due to hang upon stack overflow) Attempted to install into separate wineprefix. verbs= ie8 vcrun210 and 2008. Kubuntu 12.04.1 amd64 and wine 1.4. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 19

[Bug 39850] New: The King of Fighters'98 Ultimate Match: crash while enter the game
by wine-bugs＠winehq.org 19 Feb '16

19 Feb '16

https://bugs.winehq.org/show_bug.cgi?id=39850 Bug ID: 39850 Summary: The King of Fighters'98 Ultimate Match: crash while enter the game Product: Wine Version: unspecified Hardware: x86 OS: Mac OS X Status: UNCONFIRMED Severity: critical Priority: P2 Component: directx-d3dx9 Assignee: wine-bugs(a)winehq.org Reporter: billy3321(a)gmail.com Created attachment 53199 --> https://bugs.winehq.org/attachment.cgi?id=53199 the log I use steam to install the King of Fighters'98 Ultimate Match, the install is success. I can enter the game, but the menu seems broken; I can select characters, but while I go into the game, like set the match order, or enter the match, the game will crash. the log has a lot of "err:d3d:resource_init Out of adapter memory", does there has any way to fix this? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 8

[Bug 39703] New: Switching from a Windows app to an OS X app and then back causes the spinning ball of death
by wine-bugs＠winehq.org 19 Feb '16

19 Feb '16

https://bugs.winehq.org/show_bug.cgi?id=39703 Bug ID: 39703 Summary: Switching from a Windows app to an OS X app and then back causes the spinning ball of death Product: Wine Version: unspecified Hardware: x86 OS: Mac OS X Status: UNCONFIRMED Severity: major Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: professormrh(a)gmail.com Sometime after 1.6.2_4 a bug was introduced in Wine that causes any Windows application under Wine to crash with the spinning ball of death if you switch to an OS X application and then return to the Windows application under Wine. Example: 1. Open Notepad++ 2. Switch to an OS X application (say TextEdit or Chrome) 3. Copy some text to the clipboard 4. Switch back to Notepad++ 5. Encounter the spinning ball of death However, if you just switched to an OS X application and then switched back without interacting with the clipboard, there is still a 50/50 chance you will encounter the spinning ball of death. Once you have the spinning ball of death you have to force quite out of Wine. Wine 1.6.x does not exhibit this bug. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 5

[Bug 39976] New: King's Bounty - Islands of Freedom loading crash
by wine-bugs＠winehq.org 19 Feb '16

19 Feb '16

https://bugs.winehq.org/show_bug.cgi?id=39976 Bug ID: 39976 Summary: King's Bounty - Islands of Freedom loading crash Product: Wine Version: 1.8 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: emanuele.emalele(a)gmail.com Distribution: --- Created attachment 53413 --> https://bugs.winehq.org/attachment.cgi?id=53413 Final error message Hi, in King's Bounty The Legend GOG version (1.7) the game perfectly runs in Wine 1.8 until you'll finish the first set of location (it could take some hours) and set sail to Islands of Freedom. When the loading circle is full Wine crash with the attached error message; the screen doesn't change and the music continues on: you must do ALT-F4 or ALT-TAB. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 6