November 2020 - Wine-bugs - list.winehq.org

[Bug 25362] New: Error running Return to Castle Wolfenstein
by wine-bugs＠winehq.org 12 Jul '21

12 Jul '21

http://bugs.winehq.org/show_bug.cgi?id=25362 Summary: Error running Return to Castle Wolfenstein Product: WineHQ Apps Database Version: unspecified Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: appdb-unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: mrfort(a)centurytel.net Created an attachment (id=32259) --> (http://bugs.winehq.org/attachment.cgi?id=32259) debugger report Installed ok. Allowed setup preferences such as graphics and audio preferences. When I try to run in single player I get this error: Error in file "/home/name/.local/share/applications/clamtk.desktop": "vms/exe" is an invalid MIME type ("vms" is an unregistered media type). I assume it is an easy fix but cannot locate any information online or in your repository. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 30

[Bug 25120] New: dotnet11 installation broken
by wine-bugs＠winehq.org 12 Jul '21

12 Jul '21

http://bugs.winehq.org/show_bug.cgi?id=25120 Summary: dotnet11 installation broken Product: Wine Version: 1.3.6 Platform: x86 OS/Version: Linux Status: NEW Keywords: dotnet, download, Installer Severity: normal Priority: P2 Component: msi AssignedTo: wine-bugs(a)winehq.org ReportedBy: austinenglish(a)gmail.com Created an attachment (id=31862) --> (http://bugs.winehq.org/attachment.cgi?id=31862) terminal output Regression test points to: a23514eece083011140513853c5db10357af6cea is the first bad commit commit a23514eece083011140513853c5db10357af6cea Author: Hans Leidekker <hans(a)codeweavers.com> Date: Thu Nov 11 10:45:42 2010 +0100 msi: Add support for installing side-by-side assemblies. :040000 040000 6e3244306b1cdce4af9bd963048445913433d933 820db510d39486aa37cad45d1ebeb9e2397f6224 M dlls to repeat: $ rm -rf ~/.wine $ sh winetricks -q -v winetricks terminal output attached. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 32

[Bug 26701] New: exeinfoPE crashes due to PE resource section validation being too strict
by wine-bugs＠winehq.org 12 Jul '21

12 Jul '21

http://bugs.winehq.org/show_bug.cgi?id=26701 Summary: exeinfoPE crashes due to PE resource section validation being too strict Product: Wine Version: 1.3.17 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: ntdll AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Hello, while updating some appdb entries I noticed a breakage with some PE "id" tool. The app worked some time ago but now crashes instantly. There was a minor version update: the author probably not only added more signatures but tweaked the custom PE protection the app is wrapped with. --- snip --- >$ wine ./exeinfoPE.exe wine: Unhandled exception 0x0eedfade at address 0x7b83983a:0x7b83863f (thread 0009), starting debugger... fixme:dbghelp_dwarf:dwarf2_lookup_type Unable to load forward reference for tag 26 fixme:dbghelp_dwarf:dwarf2_lookup_type Unable to load forward reference for tag 26 fixme:dbghelp_dwarf:dwarf2_lookup_type Unable to load forward reference for tag 26 err:seh:setup_exception_record stack overflow 880 bytes in thread 0009 eip 6816b5ea esp 00230fc0 stack 0x230000-0x231000-0x330000 --- snip --- relay trace yields following: --- snip --- ... 0021:Call KERNEL32.FindResourceA(00400000,00472384 "tbl_Main",0000000a) ret=00474417 0021:trace:resource:FindResourceExA 0x400000 #000a "tbl_Main" 0000 0021:trace:resource:LdrFindResource_U module 0x400000 type #000a name L"TBL_MAIN" lang 0000 level 3 0021:Ret KERNEL32.FindResourceA() retval=00000000 ret=00474417 0021:Call user32.LoadStringA(00400000,0000ffc3,0032ed34,00001000) ret=00407417 0021:trace:resource:LoadStringA instance = 0x400000, id = ffc3, buffer = 0x32ed34, length = 4096 0021:trace:resource:FindResourceExW 0x400000 #0006 #0ffd 0000 0021:trace:resource:LdrFindResource_U module 0x400000 type #0006 name #0ffd lang 0000 level 3 0021:trace:resource:LoadStringA returning "" 0021:Ret user32.LoadStringA() retval=00000000 ret=00407417 0021:Call KERNEL32.RaiseException(0eedfade,00000001,00000007,0032fd7c) ret=0047444b 0021:trace:seh:raise_exception code=eedfade flags=1 addr=0x7b83863f ip=7b83863f tid=0021 0021:trace:seh:raise_exception info[0]=0047444b 0021:trace:seh:raise_exception info[1]=05701d10 0021:trace:seh:raise_exception info[2]=0053a9e0 0021:trace:seh:raise_exception info[3]=00000000 0021:trace:seh:raise_exception info[4]=00000029 0021:trace:seh:raise_exception info[5]=0032fde8 0021:trace:seh:raise_exception info[6]=0032fd98 0021:trace:seh:raise_exception eax=7b825a75 ebx=7b88fff4 ecx=0047444b edx=0032fc94 esi=0032fd7c edi=0032fcf0 0021:trace:seh:raise_exception ebp=0032fcd8 esp=0032fc74 cs=0073 ds=007b es=007b fs=0033 gs=003b flags=00000203 0021:trace:seh:call_vectored_handlers calling handler at 0x788636c6 code=eedfade flags=1 0021:trace:seh:call_vectored_handlers handler at 0x788636c6 returned 0 0021:trace:seh:call_stack_handlers calling handler at 0x474573 code=eedfade flags=1 0021:trace:seh:call_stack_handlers handler at 0x474573 returned 1 0021:trace:seh:call_stack_handlers calling handler at 0x405149 code=eedfade flags=1 ... --- snip --- The app unpacks/decrypts PE sections into dynamic memory and patches the PE header to point to new locations. I dumped the PE header at the right place ;-) --- snip --- Wine-dbg>p *nt {Signature=0x4550, FileHeader={Machine=0x14c, NumberOfSections=0x3, TimeDateStamp=0x2a425e19, PointerToSymbolTable=0, NumberOfSymbols=0, SizeOfOptionalHeader=0xe0, Characteristics=0x818f}, OptionalHeader={Magic=0x10b, MajorLinkerVersion=2, MinorLinkerVersion=0, SizeOfCode=0x8c000, SizeOfInitializedData=0x5000, SizeOfUninitializedData=0x513a000, AddressOfEntryPoint=0x51c5810, BaseOfCode=0x513b000, BaseOfData=0x51c7000, ImageBase=0x400000, SectionAlignment=0x1000, FileAlignment=0x200, MajorOperatingSystemVersion=0x4, MinorOperatingSystemVersion=0, MajorImageVersion=0, MinorImageVersion=0, MajorSubsystemVersion=0x4, MinorSubsystemVersion=0, Win32VersionValue=0, SizeOfImage=0x51cc000, SizeOfHeaders=0x1000, CheckSum=0x51c5810, Subsystem=0x2, DllCharacteristics=0, SizeOfStackReserve=0x100000, SizeOfStackCommit=0x4000, SizeOfHeapReserve=0x100000, SizeOfHeapCommit=0x1000, LoaderFlags=0, NumberOfRvaAndSizes=0x12, DataDirectory={{VirtualAddress=0x5159000, Size=0x4f}, {VirtualAddress=0x51cb120, Size=0x2c8}, {VirtualAddress=0x51c7000, Size=0}, {VirtualAddress=0, Size=0}, {VirtualAddress=0, Size=0}, {VirtualAddress=0, Size=0}, {VirtualAddress=0, Size=0}, {VirtualAddress=0, Size=0}, {VirtualAddress=0, Size=0}, {VirtualAddress=0x51c63b0, Size=0x18}, {VirtualAddress=0, Size=0}, {VirtualAddress=0, Size=0}, {VirtualAddress=0, Size=0}, {VirtualAddress=0, Size=0}, {VirtualAddress=0, Size=0}, {VirtualAddress=0, Size=0}}}} --- snip --- The (new) PE resource section is located at 0x051c7000 with size == 0 (not recalculated to real value) Wine's resource directory entry size check is actually the problem, preventing the app from finding its resources. --- snip ntdll/resource.c --- /********************************************************************** * find_entry * * Find a resource entry */ static NTSTATUS find_entry( HMODULE hmod, const LDR_RESOURCE_INFO *info, ULONG level, const void **ret, int want_dir ) { ULONG size; const void *root; const IMAGE_RESOURCE_DIRECTORY *resdirptr; WORD list[9]; /* list of languages to try */ int i, pos = 0; root = RtlImageDirectoryEntryToData( hmod, TRUE, IMAGE_DIRECTORY_ENTRY_RESOURCE, &size ); if (!root) return STATUS_RESOURCE_DATA_NOT_FOUND; if (size < sizeof(*resdirptr)) return STATUS_RESOURCE_DATA_NOT_FOUND; resdirptr = root; ... --- snip ntdll/resource.c --- This also results in stack overflow because the app's exception handler tries to load resources too which obviously fails. Removing the size check (size < sizeof(*resdirptr)) lets the app successfully start. Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 8

[Bug 34785] New: unimplemented function shell32.dll.SHExtractIconsW called in 64-bit code (0x000000007b84980a)
by wine-bugs＠winehq.org 12 Jul '21

12 Jul '21

http://bugs.winehq.org/show_bug.cgi?id=34785 Bug #: 34785 Summary: unimplemented function shell32.dll.SHExtractIconsW called in 64-bit code (0x000000007b84980a) Product: Wine Version: unspecified Platform: x86-64 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: shell32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: LiveFreeDead(a)hotmail.com Classification: Unclassified Created attachment 46386 --> http://bugs.winehq.org/attachment.cgi?id=46386 backtrace of crash Just noticed this API wasn't implemented yet and would prefer it return a blank icon for now instead of crashing out the whole WINE app. Not sure if it affects x86 as I only have x64 installed at the moment. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 32245] New: unimplemented function shell32.dll.SHExtractIconsW
by wine-bugs＠winehq.org 12 Jul '21

12 Jul '21

http://bugs.winehq.org/show_bug.cgi?id=32245 Bug #: 32245 Summary: unimplemented function shell32.dll.SHExtractIconsW Product: Wine Version: 1.5.17 Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: shell32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: tjfoerster(a)web.de Classification: Unclassified I've coded a small GUI with a graphic menu which should run in wine. Everything works well on windows (i.e. XP) - but not in wine (Unhandled exception). It doesn't start at all. The same in wine 1.5.17 (ArchLinux) and 1.2 (Meego - WeTab). Attached the backrace.txt and the GUI. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 18

[Bug 32878] New: Classic Shell/Classic Start Menu crashes on startup due to unimplemented function shell32.dll.SHGetStockIconInfo
by wine-bugs＠winehq.org 12 Jul '21

12 Jul '21

http://bugs.winehq.org/show_bug.cgi?id=32878 Bug #: 32878 Summary: Classic Shell/Classic Start Menu crashes on startup due to unimplemented function shell32.dll.SHGetStockIconInfo Product: Wine Version: 1.5.22 Platform: arm OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: shell32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello folks, as the summary says ... Detlef is already working on that though it might be useful to have a bug report for it. I tested the port of class shell to ARM platform. The same most likely applies for x86. --- snip --- $ wine ./ClassicStartMenu.exe ... wine: Call from 0x403ec644 to unimplemented function shell32.dll.SHGetStockIconInfo, aborting fixme:seh:RtlUnwind Not implemented on ARM fixme:thread:InitializeSRWLock (0x1009cc8c): stub err:module:attach_process_dlls "ClassicStartMenuDLL.dll" failed to initialize, aborting err:module:LdrInitializeThunk Main exe initialization for L"Z:\\home\\linaro\\wine-apps\\classicmenu\\ClassicStartMenu.exe" failed, status 80000100 --- snip --- $ wine --version wine-1.5.23-7-gf0a88fb Patches from Detlef Riekenberg here: http://source.winehq.org/patches/data/94077 http://source.winehq.org/patches/data/94078 Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 7

[Bug 34400] New: Classic Shell/Classic Start Menu crashes on startup due to unimplemented function shell32.dll.SHExtractIconsW
by wine-bugs＠winehq.org 12 Jul '21

12 Jul '21

http://bugs.winehq.org/show_bug.cgi?id=34400 Bug #: 34400 Summary: Classic Shell/Classic Start Menu crashes on startup due to unimplemented function shell32.dll.SHExtractIconsW Product: Wine Version: 1.7.1 Platform: arm OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: shell32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello folks, as the summary says... --- snip --- 0026:Call KERNEL32.RaiseException(80000100,00000001,00000002,40daeb80) ret=413d0038 0026:trace:seh:raise_exception info[0]=413d00b8 0026:trace:seh:raise_exception info[1]=413d04fa wine: Call from 0x404d9388 to unimplemented function shell32.dll.SHExtractIconsW, aborting 0026:trace:seh:call_stack_handlers calling handler at 0x404f9418 code=80000100 flags=1 0026:trace:seh:RtlUnwind code=80000100 flags=3 ... 0026:err:module:attach_process_dlls "ClassicStartMenuDLL.dll" failed to initialize, aborting 0026:err:module:LdrInitializeThunk Main exe initialization for L"Z:\\home\\linaro\\wine-apps\\classicmenu\\ClassicStartMenu.exe" failed, status 80000100 --- snip --- Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 6

[Bug 34402] New: Multiple applications ported to WinRT/ARM require atl110.dll (Halite torrent client for Windows RT )
by wine-bugs＠winehq.org 12 Jul '21

12 Jul '21

http://bugs.winehq.org/show_bug.cgi?id=34402 Bug #: 34402 Summary: Multiple applications ported to WinRT/ARM require atl110.dll (Halite torrent client for Windows RT ) Product: Wine Version: 1.7.1 Platform: arm OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: atl AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello folks, as the summary says ... --- snip --- $ wine ./Halite.exe err:module:import_dll Library atl110.DLL (which is needed by L"Z:\\home\\linaro\\wine-apps\\halite\\Halite.exe") not found err:module:LdrInitializeThunk Main exe initialization for L"Z:\\home\\linaro\\wine-apps\\halite\\Halite.exe" failed, status c0000135 --- snip --- Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 7

[Bug 49706] New: Trails from Zero - Crashes in prologue and save loading menu
by WineHQ Bugzilla 11 Jul '21

11 Jul '21

https://bugs.winehq.org/show_bug.cgi?id=49706 Bug ID: 49706 Summary: Trails from Zero - Crashes in prologue and save loading menu Product: Wine Version: 5.15 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: rjtulloh(a)gmail.com Distribution: --- Created attachment 67954 --> https://bugs.winehq.org/attachment.cgi?id=67954 Console log for the prologue crash. When using the most recent Geofront translation patch(1.0.2), Trails from Zero crashes in the third room of the Prologue and in the save loading menu. To reproduce the issue in the prologue: - Launch the game. - On the main menu, start a new game. Difficulty choice does not matter. - In the prologue, advance through all the text. - Move forward until the crash occurs. To reproduce the issue in the save loading screen: - Launch the game. - On the main menu, select "Load". - Immediately exit the save menu. Console output for the prologue crash is attached. Note: To use the Geofront patch, a native dinput8 override is required. This is because the patch uses a custom dinput8 library to apply changes. Additional system info: OS: Kubuntu 20.04 Kernel: 5.4.0-42-generic GPU Driver: amdgpu -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 20

[Bug 38956] New: Creo Elements/Direct Modeling Express 6.0 .NET based licensing tool fails with .NET Framework error (Xenocode registry virtualization fails to intercept Wine's root key handles)
by wine-bugs＠winehq.org 10 Jul '21

10 Jul '21

https://bugs.winehq.org/show_bug.cgi?id=38956 Bug ID: 38956 Summary: Creo Elements/Direct Modeling Express 6.0 .NET based licensing tool fails with .NET Framework error (Xenocode registry virtualization fails to intercept Wine's root key handles) Product: Wine Version: 1.7.47 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: advapi32 Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, continuation of bug 38950 (avoid relay thunks, they interfere with Xenocode hooks). --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/PTC/Creo Elements/Direct Modeling Express 6.0/binNT/OLAPE $ WINEDEBUG=+tid,+seh,+loaddll,+process,+reg,+msgbox wine ./OLAPEP.exe >>log.txt 2>&1 ... 002c:trace:loaddll:load_native_dll Loaded L"C:\\windows\\system32\\mscoree.dll" at 0x79000000: native 002c:trace:loaddll:load_native_dll Loaded L"C:\\Program Files\\PTC\\Creo Elements\\Direct Modeling Express 6.0\\binNT\\OLAPE\\OLAPEPP.exe" at 0x400000: native 002c:trace:reg:GetSystemInfo si=0x0x2142f9d8 002c:trace:reg:GetSystemInfo si=0x0x2142f73c 002c:trace:reg:NtOpenKey (0x20,L"System\\CurrentControlSet\\Control\\Video\\{f996be7c-6eca-46cd-96df-3524ac767421}\\0000",2000000,0x2142eff0) 002c:trace:reg:NtOpenKey <- 0x24c 002c:trace:reg:RegQueryValueExW (0x24c,L"GraphicsDriver",(nil),(nil),0x2142f348,0x2142f550=520) 002c:trace:reg:NtQueryValueKey (0x24c,L"GraphicsDriver",2,0x2142f11c,256) 002c:trace:loaddll:load_builtin_dll Loaded L"C:\\windows\\system32\\winex11.drv" at 0x7e280000: builtin 002c:trace:reg:NtOpenKey (0x24,L"Software\\Wine\\X11 Driver",2000000,0x2142e6e0) 002c:trace:reg:NtOpenKey <- (nil) 002c:trace:reg:NtOpenKey (0x24,L"Software\\Wine\\AppDefaults",2000000,0x2142e6e0) 002c:trace:reg:NtOpenKey <- (nil) 002c:trace:reg:NtCreateKey (0x24,L"Keyboard Layout\\Preload",(null),0,f003f,0x2142e57c) 002c:trace:reg:NtCreateKey <- 0x25c 002c:trace:reg:RegQueryValueExW (0x25c,L"1",(nil),(nil),(nil),(nil)=0) 002c:trace:reg:NtQueryValueKey (0x25c,L"1",2,0x2142e6dc,12) 002c:trace:reg:NtOpenKey (0x2c,L"Software\\Fonts",2000000,0x2142ebe0) 002c:trace:reg:NtOpenKey <- 0x24c 002c:trace:reg:RegQueryValueExW (0x24c,L"LogPixels",(nil),0x2142ee94,0x2142ee8c,0x2142ee90=4) 002c:trace:reg:NtQueryValueKey (0x24c,L"LogPixels",2,0x2142ed0c,16) 002c:trace:reg:NtOpenKey (0x20,L"System\\CurrentControlSet\\Control\\FontAssoc\\Associated Charset",2000000,0x2142eb40) 002c:trace:reg:NtOpenKey <- (nil) 002c:trace:reg:NtOpenKey (0x20,L"Software\\Microsoft\\.NETFramework",20019,0x2142ebc0) 002c:trace:reg:NtOpenKey <- (nil) 002c:trace:reg:NtOpenKey (0x20,L"Software\\Microsoft\\.NETFramework",20019,0x2142d090) 002c:trace:reg:NtOpenKey <- (nil) 002c:trace:reg:NtOpenKey (0x20,L"Software\\Microsoft\\.NETFramework",20019,0x2142d440) 002c:trace:reg:NtOpenKey <- (nil) 002c:trace:reg:NtOpenKey (0x20,L"Software\\Microsoft\\.NETFramework",20019,0x2142cb70) 002c:trace:reg:NtOpenKey <- (nil) 002c:trace:reg:NtOpenKey (0x24,L"Software\\Microsoft\\.NETFramework\\Policy\\Upgrades",20019,0x2142d440) 002c:trace:reg:NtOpenKey <- (nil) 002c:trace:reg:NtOpenKey (0x20,L"Software\\Microsoft\\.NETFramework\\Policy\\Upgrades",20019,0x2142d440) 002c:trace:reg:NtOpenKey <- (nil) 002c:trace:reg:NtOpenKey (0x20,L"Software\\Microsoft\\.NETFramework",20019,0x2142cb70) 002c:trace:reg:NtOpenKey <- (nil) 002c:trace:reg:NtCreateKey (0x24,L"Control Panel\\Desktop\\WindowMetrics",(null),0,2000000,0x2142d82c) 002c:trace:reg:NtCreateKey <- 0x25c ... 002c:trace:msgbox:MSGBOX_OnInit L"A fatal error occurred. However, mscorees.dll could not be loaded to display the appropriate error message.\n\nPlease reinstall the .NET Framework." --- snip --- The call in question from virtualized/sandboxed .NET Framework (unwrapped in memory): --- snip --- 4252EDFC 79003ECE CALL to RegOpenKeyExW from mscoree.79003EC8 4252EE00 80000002 hKey = HKEY_LOCAL_MACHINE 4252EE04 79004010 Subkey = "Software\Microsoft\.NETFramework" 4252EE08 00000000 Reserved = 0 4252EE0C 00020019 Access = KEY_READ 4252EE10 4252EE44 pHandle = 4252EE44 4252EE14 00000000 4252EE18 4252EE48 4252EE1C 790063FD RETURN to mscoree.790063FD from mscoree.79003EA4 4252EE20 80000002 4252EE24 79004010 UNICODE "Software\Microsoft\.NETFramework" 4252EE28 00000000 ... --- snip --- Here: NtOpenKey -> lookup predefined handle for HKEY_LOCAL_MACHINE -> 0x20 (internally cached) Initial: get_special_root_hkey -> create_special_root_hkey -> create_key -> NtCreateKey Xenocode VM uses a handle tracker for objects of interest which includes registry handles. It intercepts various native API calls and injects/translates to its own data as needed. The problem here is the interception of the special registry root directory key(s). Although 'NtOpenKey' API is hooked, Xenocode fails to translate the parent key (= special root key handle), falling back by calling Wine implementation. Since .NET Framework is not installed, the .NET registry keys and values are not present in the "real" registry, leading to failure. The native API interception logic is set up after the main executable got unwrapped and mapped with imports resolved by Xenocode loader. Unfortunately the special root key handles were already created as part of original startup code by Wine hence the creation of those parent handles (out parameter) is never seen by the Xenocode handle tracker. --- For completeness the native registry API that can be potentially hooked: --- snip --- 423F0B66 68 0C754042 PUSH OLAPEP.4240750C ; "NtCompactKeys" 423F0B7F 68 1C754042 PUSH OLAPEP.4240751C ; "NtCompressKey" 423F0B98 68 2C754042 PUSH OLAPEP.4240752C ; "NtCreateKey" 423F0BB1 68 38754042 PUSH OLAPEP.42407538 ; "NtDeleteKey" 423F0BCA 68 44754042 PUSH OLAPEP.42407544 ; "NtDeleteValueKey" 423F0BE3 68 58754042 PUSH OLAPEP.42407558 ; "NtEnumerateKey" 423F0BFC 68 68754042 PUSH OLAPEP.42407568 ; "NtEnumerateValueKey" 423F0C15 68 7C754042 PUSH OLAPEP.4240757C ; "NtFlushKey" 423F0C31 68 88754042 PUSH OLAPEP.42407588 ; "NtLoadKey" 423F0C4A 68 94754042 PUSH OLAPEP.42407594 ; "NtLoadKey2" 423F0C63 68 A0754042 PUSH OLAPEP.424075A0 ; "NtLoadKeyEx" 423F0C7C 68 AC754042 PUSH OLAPEP.424075AC ; "NtLockRegistryKey" 423F0C95 68 C0754042 PUSH OLAPEP.424075C0 ; "NtNotifyChangeKey" 423F0CAE 68 D4754042 PUSH OLAPEP.424075D4 ; "NtNotifyChangeMultipleKeys" 423F0CC7 68 F0754042 PUSH OLAPEP.424075F0 ; "NtOpenKey" 423F0CE0 68 FC754042 PUSH OLAPEP.424075FC ; "NtQueryKey" 423F0CFC 68 08764042 PUSH OLAPEP.42407608 ; "NtQueryMultipleValueKey" 423F0D15 68 20764042 PUSH OLAPEP.42407620 ; "NtQueryOpenSubKeys" 423F0D2E 68 34764042 PUSH OLAPEP.42407634 ; "NtQueryOpenSubKeysEx" 423F0D47 68 4C764042 PUSH OLAPEP.4240764C ; "NtQueryValueKey" 423F0D60 68 5C764042 PUSH OLAPEP.4240765C ; "NtRenameKey" 423F0D79 68 68764042 PUSH OLAPEP.42407668 ; "NtReplaceKey" 423F0D92 68 78764042 PUSH OLAPEP.42407678 ; "NtRestoreKey" 423F0DAB 68 88764042 PUSH OLAPEP.42407688 ; "NtSaveKey" 423F0DC7 68 94764042 PUSH OLAPEP.42407694 ; "NtSaveKeyEx" 423F0DE0 68 A0764042 PUSH OLAPEP.424076A0 ; "NtSaveMergedKeys" 423F0DF9 68 B4764042 PUSH OLAPEP.424076B4 ; "NtSetInformationKey" 423F0E12 68 C8764042 PUSH OLAPEP.424076C8 ; "NtSetValueKey" 423F0E2B 68 D8764042 PUSH OLAPEP.424076D8 ; "NtUnloadKey" 423F0E44 68 E4764042 PUSH OLAPEP.424076E4 ; "NtUnloadKey2" 423F0E5D 68 F4764042 PUSH OLAPEP.424076F4 ; "NtUnloadKeyEx" --- snip --- $ sha1sum ModelingPE__setup_EN.exe 333736c553c2eb985436e63f20bfcbb59932b6fb ModelingPE__setup_EN.exe $ du -sh ModelingPE__setup_EN.exe 207M ModelingPE__setup_EN.exe $ wine --version wine-1.7.47-162-g0f9a0aa Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 6