[Bug 30536] New: Avanquest PDF Experte Ultimate 7.0.x installer crashes with stack overflow because user32.dll AdjustWindowRect, AdjustWindowRectEx, SetWindowLongA are not hotpatchable (DECLSPEC_HOTPATCH)
http://bugs.winehq.org/show_bug.cgi?id=30536 Bug #: 30536 Summary: Avanquest PDF Experte Ultimate 7.0.x installer crashes with stack overflow because user32.dll AdjustWindowRect, AdjustWindowRectEx, SetWindowLongA are not hotpatchable (DECLSPEC_HOTPATCH) Product: Wine Version: 1.5.3 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: user32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello, "Avanquest PDF Experte Ultimate 7.0.x" installer dies quickly with a stack overflow. --- snip --- $ WINEDEBUG=+tid,+seh,+process wine ./PDF\ Experte\ 7\ Ultimate.exe 002d:trace:process:init_current_directory starting in L"Z:\\home\\focht\\Downloads\\Avanquest PDF Experte Ultimate 7.0.1370.0\\" 0x4 002d:trace:process:__wine_kernel_init starting process name=L"Z:\\home\\focht\\Downloads\\Avanquest PDF Experte Ultimate 7.0.1370.0\\PDF Experte 7 Ultimate.exe" argv[0]=L"Z:\\home\\focht\\Downloads\\Avanquest PDF Experte Ultimate 7.0.1370.0\\PDF Experte 7 Ultimate.exe" ... 0030:fixme:exec:SHELL_execute flags ignored: 0x00000100 0030:trace:process:create_process_impl app (null) cmdline L"C:\\users\\focht\\Temp\\FCW2111.tmp\\ISAdmin.exe /SETUPAQ:196646" 0030:trace:process:find_exe_file looking for L"C:\\users\\focht\\Temp\\FCW2111.tmp\\ISAdmin.exe" 0030:trace:process:find_exe_file Trying native exe L"C:\\users\\focht\\Temp\\FCW2111.tmp\\ISAdmin.exe" 0030:trace:process:create_process_impl starting L"C:\\users\\focht\\Temp\\FCW2111.tmp\\ISAdmin.exe" as Win32 binary (0x400000-0x4b1000) 0032:trace:process:init_current_directory starting in L"C:\\users\\focht\\Temp\\FCW2111.tmp\\" 0x1c 0032:trace:process:__wine_kernel_init starting process name=L"C:\\users\\focht\\Temp\\FCW2111.tmp\\ISAdmin.exe" argv[0]=L"C:\\users\\focht\\Temp\\FCW2111.tmp\\ISAdmin.exe" 0030:trace:process:create_process_impl started process pid 0031 tid 0032 ... 0032:err:rebar:REBAR_NotifyFormat wrong response to WM_NOTIFYFORMAT (0), assuming ANSI 0032:trace:seh:raise_exception code=c00000fd flags=0 addr=0xa252924 ip=0a252924 tid=0032 0032:trace:seh:raise_exception eax=0a29bc40 ebx=00000000 ecx=00000000 edx=000506f4 esi=0a2a064c edi=00000000 0032:trace:seh:raise_exception ebp=003258b4 esp=00242000 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010246 0032:trace:seh:call_stack_handlers calling handler at 0xa2973ce code=c00000fd flags=0 0032:trace:seh:call_stack_handlers handler at 0xa2973ce returned 1 0032:trace:seh:call_stack_handlers calling handler at 0xa296ceb code=c00000fd flags=0 0032:trace:seh:call_stack_handlers handler at 0xa296ceb returned 1 0032:trace:seh:call_stack_handlers calling handler at 0xa296d18 code=c00000fd flags=0 0032:trace:seh:call_stack_handlers handler at 0xa296d18 returned 1 0032:trace:seh:call_stack_handlers calling handler at 0xb93220 code=c00000fd flags=0 0032:trace:seh:call_stack_handlers handler at 0xb93220 returned 1 0032:trace:seh:call_stack_handlers calling handler at 0xb931c0 code=c00000fd flags=0 0032:trace:seh:call_stack_handlers handler at 0xb931c0 returned 1 0032:trace:seh:call_stack_handlers calling handler at 0xb92ffa code=c00000fd flags=0 0032:trace:seh:call_stack_handlers handler at 0xb92ffa returned 1 0032:trace:seh:call_stack_handlers calling handler at 0x100c503e code=c00000fd flags=0 0032:err:seh:setup_exception_record stack overflow 1360 bytes in thread 0032 eip f747bac7 esp 00240de0 stack 0x240000-0x241000-0x340000 --- snip --- "ISAdmin.exe" can be started from temp folder after extraction to reproduce/debug. Adding WINEDEBUG=+relay works around. By adding more debugging channels (without +relay) and comparing the trace logs, one can converge on certain code/addresses to start debugging. --- snip --- 0025:Call user32.GetActiveWindow() ret=0a2718ad 0025:Ret user32.GetActiveWindow() retval=00000000 ret=0a2718ad 0025:Call user32.IsZoomed(00020092) ret=0a2718c7 0025:Ret user32.IsZoomed() retval=00000000 ret=0a2718c7 0025:Call KERNEL32.LoadLibraryA(0a28bc40 "UxTheme.dll") ret=0a285cb0 0025:Ret KERNEL32.LoadLibraryA() retval=7dd60000 ret=0a285cb0 0025:Call KERNEL32.InterlockedExchange(0a2981f8,7dd60000) ret=0a285d01 0025:Ret KERNEL32.InterlockedExchange() retval=00000000 ret=0a285d01 0025:Call KERNEL32.GetProcAddress(7dd60000,0a2906f6 "IsThemeActive") ret=0a285d87 0025:Ret KERNEL32.GetProcAddress() retval=7dd6af64 ret=0a285d87 0025:Call uxtheme.IsThemeActive() ret=0a271908 0025:Ret uxtheme.IsThemeActive() retval=00000000 ret=0a271908 --- snip --- After user32.IsZoomed() it always goes berserk. The offending code is located in a dll "NewUI.dll": --- snip --- 0025:trace:loaddll:load_native_dll Loaded L"C:\\users\\focht\\Temp\\{0105E420-3327-496D-95E0-756E345AEF72}\\{FC279721-37A6-4777-AFD8-7A56681EBA14}\\Tools.dll" at 0x9fb0000: native 0025:trace:loaddll:load_native_dll Loaded L"C:\\users\\focht\\Temp\\{0105E420-3327-496D-95E0-756E345AEF72}\\{FC279721-37A6-4777-AFD8-7A56681EBA14}\\SerialNumberWrapper.dll" at 0xa120000: native 0025:trace:loaddll:load_builtin_dll Loaded L"C:\\windows\\system32\\msvfw32.dll" at 0x7d3a0000: builtin 0025:trace:loaddll:load_builtin_dll Loaded L"C:\\windows\\system32\\gdiplus.dll" at 0x7d320000: builtin 0025:trace:loaddll:load_builtin_dll Loaded L"C:\\windows\\system32\\imagehlp.dll" at 0x7d300000: builtin 0025:trace:loaddll:load_builtin_dll Loaded L"C:\\windows\\system32\\dbghelp.dll" at 0x7d290000: builtin 0025:trace:loaddll:load_native_dll Loaded L"C:\\users\\focht\\Temp\\{0105E420-3327-496D-95E0-756E345AEF72}\\{FC279721-37A6-4777-AFD8-7A56681EBA14}\\NewUI.dll" at 0xa250000: native 0025:trace:loaddll:load_builtin_dll Loaded L"C:\\windows\\system32\\windowscodecs.dll" at 0x7d1f0000: builtin --- snip --- It seems the installer code hooks various user32 API to "skin" dialogs. Part of the hooker code (annotated): --- snip --- ... 0A251C3B 66:813F 8BFF CMP WORD PTR DS:[EDI],0FF8B ; check for "MOV EDI, EDI" 0A251C40 75 39 JNE SHORT 0A251C7B 0A251C42 8A03 MOV AL,BYTE PTR DS:[EBX] ; EBX = [EDI-5] 0A251C44 3C 90 CMP AL,90 ; NOP padding? 0A251C46 75 09 JNE SHORT 0A251C51 0A251C48 817F FC 90909 CMP DWORD PTR DS:[EDI-4],90909090 ; NOP padding? 0A251C4F 74 0D JE SHORT 0A251C5E 0A251C51 3C CC CMP AL,0CC ; INT3 padding? 0A251C53 75 26 JNE SHORT 0A251C7B 0A251C55 817F FC CCCCC CMP DWORD PTR DS:[EDI-4],CCCCCCCC ; INT3 padding? 0A251C5C 75 1D JNE SHORT 0A251C7B 0A251C5E C603 E9 MOV BYTE PTR DS:[EBX],0E9 ; long jump opcode 0A251C61 8B4E 18 MOV ECX,DWORD PTR DS:[ESI+18] 0A251C64 2B4E 14 SUB ECX,DWORD PTR DS:[ESI+14] 0A251C67 894F FC MOV DWORD PTR DS:[EDI-4],ECX ; set address to API hook 0A251C6A 66:C707 EBF9 MOV WORD PTR DS:[EDI],0F9EB ; short jump to long jump 0A251C6F 8B56 14 MOV EDX,DWORD PTR DS:[ESI+14] 0A251C72 83C2 02 ADD EDX,2 0A251C75 8916 MOV DWORD PTR DS:[ESI],EDX ; save real entry addr 0A251C77 C646 20 01 MOV BYTE PTR DS:[ESI+20],1 ; set flag "hooked" 0A251C7B 8B4C24 10 MOV ECX,DWORD PTR SS:[LOCAL.0] 0A251C7F 8D4424 10 LEA EAX,[LOCAL.0] 0A251C83 50 PUSH EAX ; old protect 0A251C84 51 PUSH ECX ; new protect 0A251C85 6A 14 PUSH 14 ; size = 20 0A251C87 53 PUSH EBX ; address 0A251C88 FFD5 CALL EBP ; KERNEL32.VirtualProtect --- snip --- The entry is patched if "hotpatch" prolog is detected: 2 byte relative short jump back to Windows-style long-jump area (which is located before the API using NOPs or INT3s). Due to missing HOTPATCH area, setting hooks for following API fails as above code will not patch these API entries: user32.dll "AdjustWindowRectEx" user32.dll "AdjustWindowRect" user32.dll "SetWindowLongA" After failure a different code path is taken and several other API get patched: kernel32.dll "LoadLibraryA" kernel32.dll "LoadLibraryW" all "Ex" variants. I think that code path is actually bugged which has severe consequences. Later delayed imports are resolved using the stubs: --- snip --- ... 0A281902 FF15 407A2A0A CALL DWORD PTR DS:[0A2A7A40] ; delayed import IsThemeActive ... 0A289678 B8 407A2A0A MOV EAX,OFFSET 0A2A7A40 0A28967D E9 00000000 JMP 0A289682 0A289682 51 PUSH ECX 0A289683 52 PUSH EDX 0A289684 50 PUSH EAX 0A289685 68 4C062A0A PUSH OFFSET 0A2A064C 0A28968A E8 25C50000 CALL 0A295BB4 ; "resolver" code 0A28968F 5A POP EDX 0A289690 59 POP ECX 0A289691 FFE0 JMP EAX --- snip --- The "resolver" code uses kernel32.LoadLibraryA API which got hooked. --- snip --- 0A295CA7 FF75 C8 PUSH DWORD PTR SS:[LOCAL.14] ; filename 0A295CAA FF15 B092290A CALL DWORD PTR DS:[<&KERNEL32.LoadLibraryA>] 0A295CB0 8BF8 MOV EDI,EAX 0A295CB2 85FF TEST EDI,EDI --- snip --- --- snip --- ... 7B8564AA CC INT3 7B8564AB CC INT3 7B8564AC E9 6FC49F8E JMP 0A252920 kernel32.LoadLibraryA: 7B8564B1 EB F9 JMP SHORT 7B8564AC ; LoadLibraryA hook 7B8564B3 55 PUSH EBP 7B8564B4 8BEC MOV EBP,ESP 7B8564B6 53 PUSH EBX ... --- snip --- Out of insanity the wrapper calls kernel32.LoadLibraryA (straight IAT entry!) --- snip --- 0A252920 8B4424 04 MOV EAX,DWORD PTR SS:[ARG.1] ; filename 0A252924 56 PUSH ESI 0A252925 50 PUSH EAX ; filename 0A252926 FF15 B092290A CALL DWORD PTR DS:[<&KERNEL32.LoadLibraryA>] 0A25292C 8BF0 MOV ESI,EAX 0A25292E 6A 00 PUSH 0 0A252930 56 PUSH ESI 0A252931 E8 FAFEFFFF CALL 0A252830 0A252936 8BC6 MOV EAX,ESI 0A252938 5E POP ESI 0A252939 C2 0400 RETN 4 --- snip --- The original IAT entry contains the destination API address which points to first byte of entry (only makes sense *if* the API is *not* hooked). For whatever reason the wrapper doesn't make use of the hook-data (see function that patches the API entries: the +2 address is also saved away to continue on real API). This makes the recursion and subsequent stack overflow complete. --- If you add DECLSPEC_HOTPATCH to all three mentioned user32 API those LoadLibraryX API which cause the recursion don't get hooked, no stack overflow occurs and the installer proceeds to show a dialog. Unfortunately the dialog (that ought to be skinned) isn't redrawn possibly due to other Wine bugs in user32. You can drag it around and if you're lucky you can hit/click "next" button in the dark. $ du -sh PDF\ Experte\ 7\ Ultimate.exe 35M PDF Experte 7 Ultimate.exe $ sha1sum PDF\ Experte\ 7\ Ultimate.exe a06cf16dc98941e333d94111372358ad07286aca PDF Experte 7 Ultimate.exe $ wine --version wine-1.5.3 Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=30536 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, Installer URL| |http://www.chip.de/download | |s/PDF-Experte-Ultimate_3068 | |7397.html --- Comment #1 from Anastasius Focht <focht(a)gmx.net> 2012-04-28 15:43:33 CDT --- Hello, filling fields... Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=30536 Vitaliy Margolen <vitaliy-bugzilla(a)kievinfo.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Avanquest PDF Experte |Avanquest PDF Experte |Ultimate 7.0.x installer |Ultimate 7.0.x installer |crashes with stack overflow |crashes with stack overflow |because user32.dll |(hot patching issue) |AdjustWindowRect, | |AdjustWindowRectEx, | |SetWindowLongA are not | |hotpatchable | |(DECLSPEC_HOTPATCH) | --- Comment #2 from Vitaliy Margolen <vitaliy-bugzilla(a)kievinfo.com> 2012-04-28 16:34:03 CDT --- Shrink down summary a bit. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=30536 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |6f40cb83e95137ccf118c8cefd7 | |f9e0c867caac7 Status|NEW |RESOLVED Resolution| |FIXED --- Comment #3 from Anastasius Focht <focht(a)gmx.net> 2012-04-30 14:33:09 CDT --- Hello, this is fixed by commit http://source.winehq.org/git/wine.git/commitdiff/6f40cb83e95137ccf118c8cefd7... Thanks Austin Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=30536 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #4 from Alexandre Julliard <julliard(a)winehq.org> 2012-05-11 13:21:53 CDT --- Closing bugs fixed in 1.5.4. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=30536 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |1.4.x -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=30536 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|1.4.x |--- -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=30536 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |obfuscation -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
wine-bugs＠winehq.org