[Bug 27550] New: SafeDisc 4.x: first opcode byte of kernel32.DebugBreak() API entry must not be "int 3" (0xCC) (Rainbow Six: Vegas 2 fails on startup)
http://bugs.winehq.org/show_bug.cgi?id=27550 Summary: SafeDisc 4.x: first opcode byte of kernel32.DebugBreak() API entry must not be "int 3" (0xCC) (Rainbow Six: Vegas 2 fails on startup) Product: Wine Version: 1.3.22 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: kernel32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Hello, "Rainbow Six: Vegas 2" complains about a debugger being present. The game shows a message box on startup: "A debugger has been detected" "Unload the debugger and try again" --- snip --- =[ ProtectionID v0.6.4.0 JULY]=- (c) 2003-2010 CDKiLLER & TippeX Build 07/08/10-17:57:05 Ready... Scanning -> Z:\home\focht\.wine\drive_c\Program Files\Ubisoft\Tom Clancy's Rainbow Six Vegas 2\Binaries\R6Vegas2_Game.exe File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 30277768 (01CE0088h) Byte(s) -> File Appears to be Digitally Signed @ Offset 01CDEE00h, size : 01288h / 04744 byte(s) -> File has 1449472 (0161E00h) bytes of appended data starting at offset 01B7D000h [File Heuristics] -> Flag : 00000000000000000100000000000111 (0x00004007) [!] Safedisc v4.85.000 detected ! [i] Appended data contents.... [.] o: 0x01B7D028 / t: <0xA8726B03> <0xEF01996C> <0x00000001> / s: 00302963 byte(s) -> ~deaa13.tmp [.] o: 0x01BC6FC2 / t: <0xA8726B03> <0xEF01996C> <0x0000044C> / s: 00015887 byte(s) -> clcd32.dll [.] o: 0x01BCADF8 / t: <0xA8726B03> <0xEF01996C> <0x0000044C> / s: 00004122 byte(s) -> clcd16.dll [.] o: 0x01BCBE36 / t: <0xA8726B03> <0xEF01996C> <0x0000044D> / s: 00037971 byte(s) -> mcp.dll [.] o: 0x01BD52B2 / t: <0xA8726B03> <0xEF01996C> <0x0000000B> / s: 00005446 byte(s) -> SecDrv04.VxD [.] o: 0x01BD681D / t: <0xA8726B03> <0xEF01996C> <0x00000000> / s: 00072192 byte(s) -> ~e5.0001 [.] o: 0x01BE8244 / t: <0xA8726B03> <0xEF01996C> <0x00000000> / s: 00045056 byte(s) -> PfdRun.pfd [.] o: 0x01BF326C / t: <0xA8726B03> <0xEF01996C> <0x00000000> / s: 00965148 byte(s) -> ~df394b.tmp [CompilerDetect] -> Visual C++ 8.0 (Visual Studio 2005) - Scan Took : 1.569 Second(s) --- snip --- I debugged the protection through various anti-debugging checks and found out a specific check failed. SafeDisc 4.x checks all kernel32 exports and specifically looks for soft-breakpoints (0xcc) on API entries. This fails now for kernel32.DebugBreak() because AJ used an inline asm int 3 (0xcc) to fix bug 24157 The protection treats this as "malicious" soft breakpoint and flags this entry as "bad". bug 24157 -> http://source.winehq.org/git/wine.git/commitdiff/5f06809ab3339e2001de57f18be... - technically a regression. Fortunately SafeDisc only checks the first opcode byte so one could prepend a simple "HOTPATCH" instruction to work around that. Though I'm not sure if this is a "safe" long term solution (in this case it's sufficient). Another way could be forwarding kernel32.DebugBreak to ntdll.DbgBreakPoint I only tested both methods, they work. Though the copy protection later fails for DVD media validation but this is another bug. Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=27550 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |regression --- Comment #1 from Anastasius Focht <focht(a)gmx.net> 2011-06-20 18:27:38 CDT --- Hello, k^Hfilling fields... Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=27550 Austin English <austinenglish(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #2 from Austin English <austinenglish(a)gmail.com> 2011-06-21 12:32:04 CDT --- Should be fixed by http://source.winehq.org/git/wine.git/commitdiff/71ae4774938ee6a5d7988abedc7... -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=27550 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #3 from Alexandre Julliard <julliard(a)winehq.org> 2011-06-24 17:43:51 CDT --- Closing bugs fixed in 1.3.23. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=27550 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |obfuscation Fixed by SHA1| |71ae4774938ee6a5d7988abedc7 | |ec3630b0ab488 Regression SHA1| |5f06809ab3339e2001de57f18be | |988146915bb7b --- Comment #4 from Anastasius Focht <focht(a)gmx.net> 2011-10-11 14:53:57 CDT --- Hello, filling/correcting fields ... Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.
participants (1)
-
wine-bugs＠winehq.org