[Bug 35193] New: FL Studio 11.x VSTi 'Slayer2' plugin doesn't work after registration (ASProtect 1.4 software protection)
http://bugs.winehq.org/show_bug.cgi?id=35193 Bug ID: 35193 Summary: FL Studio 11.x VSTi 'Slayer2' plugin doesn't work after registration (ASProtect 1.4 software protection) Product: Wine Version: 1.7.9 Hardware: x86 OS: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Classification: Unclassified Hello folks, a user in #winehq reported another plugin not working with FL 11.x (after fixing bug 35178). Plugin download: http://downloads.image-line.com/slayer/slayer2_personalcopy_install.exe Interestingly: http://www.image-line.com/documents/slayer.html --- quote --- FL Slayer2 is no longer available for purchase. Existing registered customers will keep receiving support. --- quote --- Running 'VerA' (a specific tool to identify ASProtect versions) on the plugin main dll 'Slayer2.dll' reveals: --- snip --- EntryPoint check: ASProtect .DLL style Crypto info: Block type: 1(U), Info type: 1, Attempts: 1 Application name: Slayer 2 Application version: 1.0 ASProtect version: 1.4 build 04.01 Beta ASProtect registered to: Image-Line Software raw info data: [Slayer 2], [1.0], [1.4 build 04.01 Beta], [Image-Line Software] --- snip --- The plugin needs to be registered with license code to reproduce the problem (the user has a legit license). The protector decrypts the actual plugin code only with a valid license code during dll initialization. The 'plugin interface' dll export 'main' is redirected to real code which is later called by the hosting application -> FL11. In non-registered version the plugin dll export 'main' is just a stub, returning zero: --- snip --- 0024:Ret PE DLL (proc=0x10170001,module=0x10000000 L"Slayer2.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 0024:Ret KERNEL32.LoadLibraryA() retval=10000000 ret=7ede9e5e 0024:Call KERNEL32.GetProcAddress(10000000,7edf0f5b "VSTPluginMain") ret=7ede9f1e 0024:Ret KERNEL32.GetProcAddress() retval=00000000 ret=7ede9f1e 0024:Call KERNEL32.GetProcAddress(10000000,7edf0f69 "VstPluginMain") ret=7ede9f42 0024:Ret KERNEL32.GetProcAddress() retval=00000000 ret=7ede9f42 0024:Call KERNEL32.GetProcAddress(10000000,7edf0f77 "main") ret=7ede9f66 0024:Ret KERNEL32.GetProcAddress() retval=1000bd70 ret=7ede9f66 0024:Call KERNEL32.FreeLibrary(10000000) ret=7ede8d31 0024:Call PE DLL (proc=0x10170001,module=0x10000000 L"Slayer2.dll",reason=PROCESS_DETACH,res=(nil)) ... RemotePlugin::DebugMessage: mainEntry prodecure returned NULL --- snip --- The protector doesn't like relay thunks (WINEDEBUG=+relay), it will refuse to load further at some point, showing 'Error 198'. When you simply run it within FL11 it will spit out the following messages on terminal before dying: --- snip --- ... fixme:mountmgr:harddisk_ioctl Unsupported ioctl 4d004 (device=4 access=3 func=401 method=0) fixme:mountmgr:harddisk_ioctl Unsupported ioctl 4d004 (device=4 access=3 func=401 method=0) err:seh:setup_exception_record stack overflow 896 bytes in thread 0024 eip 7bc43cc2 esp 00240fb0 stack 0x240000-0x241000-0x340000 --- snip --- Since the user expressed interest to investigate this problem I will back off for now ;-) Just a hint for making analysis easier: Write a small winelib app that acts as loader/host to avoid running the rather large/complex FL Studio 11.x Calling 'LoadLibraryA("Slayer2.dll")' is sufficient. All the magic happens within dll entry point (attach event). === I will happily leave any bugs to people wanting to do their own analysis for fun/learning experience. Just indicate it: "I'm working on this" ... "I'll have a look" and I'll skip that bug (there are still thousands of bugs not analysed yet) ;-) Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=35193 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, obfuscation URL| |http://downloads.image-line | |.com/flstudio/flstudio_11.0 | |.4.exe --- Comment #1 from Anastasius Focht <focht(a)gmx.net> --- Hello folks, filling fields ... $ sha1sum flstudio_11.0.4.exe f9bdc2fb0b8d18ffce90e048b12a0c196d0b82d0 flstudio_11.0.4.exe $ du -sh flstudio_11.0.4.exe 301M flstudio_11.0.4.exe $ wine --version wine-1.7.9-138-g773697a Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=35193 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Component|-unknown |ntdll Resolution|--- |DUPLICATE --- Comment #2 from Anastasius Focht <focht(a)gmx.net> --- Hello folks, resolving my own report as dupe of bug 34558 which I'll promote as collector for this problem. I'll put an analysis shortly there. Regards *** This bug has been marked as a duplicate of bug 34558 *** -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=35193 Ken Sharp <imwellcushtymelike(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #3 from Ken Sharp <imwellcushtymelike(a)gmail.com> --- Closing -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=35193 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- URL|http://downloads.image-line |https://web.archive.org/web |.com/flstudio/flstudio_11.0 |/20131208151255/http://demo |.4.exe |download.image-line.com/fls | |tudio/flstudio_11.0.4.exe -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (2)
-
wine-bugs＠winehq.org -
WineHQ Bugzilla