[Bug 45926] New: Windows Sysinternals ProcessExplorer v12-16+ crashes due to missing advapi32.I_QueryTagInformation () stub
https://bugs.winehq.org/show_bug.cgi?id=45926 Bug ID: 45926 Summary: Windows Sysinternals ProcessExplorer v12-16+ crashes due to missing advapi32.I_QueryTagInformation() stub Product: Wine Version: 3.17 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: advapi32 Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, as it says. --- snip --- $ WINEDEBUG=+seh,+relay wine ./procexp64.exe >>log.txt 2>&1 ... 002d:Call KERNEL32.LoadLibraryW(1400d20a8 L"advapi32.dll") ret=140080b4a 002d:Ret KERNEL32.LoadLibraryW() retval=7f4d2a1a0000 ret=140080b4a 002d:Call KERNEL32.GetProcAddress(7f4d2a1a0000,1400ecf08 "I_QueryTagInformation") ret=140080b5a 002d:Ret KERNEL32.GetProcAddress() retval=00000000 ret=140080b5a ... 002d:trace:seh:NtRaiseException code=c0000005 flags=0 addr=(nil) ip=0 tid=002d 002d:trace:seh:NtRaiseException info[0]=0000000000000008 002d:trace:seh:NtRaiseException info[1]=0000000000000000 002d:trace:seh:NtRaiseException rax=0000000000000001 rbx=000000014012c9c8 rcx=0000000000000000 rdx=0000000000000003 002d:trace:seh:NtRaiseException rsi=000000014012c9c0 rdi=000000014012c9d0 rbp=0000000000000000 rsp=000000000023f9b8 002d:trace:seh:NtRaiseException r8=000000000023f9e0 r9=000000014012c9c8 r10=0000000000000000 r11=0000000000000246 002d:trace:seh:NtRaiseException r12=0000000140126560 r13=0000000000000000 r14=000000000000000a r15=0000000140000000 002d:trace:seh:RtlVirtualUnwind type 1 rip 14006377a rsp 23f9c0 002d:trace:seh:dump_unwind_info **** func 63720-637a6 --- snip --- Disassembly at crash site (running under x64dbg): --- snip --- 0000000140063720 | mov qword ptr ss:[rsp+8],rbx | 0000000140063725 | mov qword ptr ss:[rsp+10],rbp | 000000014006372A | mov qword ptr ss:[rsp+18],rsi | 000000014006372F | push rdi | 0000000140063730 | sub rsp,30 | 0000000140063734 | mov rsi,rcx | 0000000140063737 | mov rcx,qword ptr ds:[rcx] | 000000014006373A | mov rbx,r9 | 000000014006373D | mov rdi,r8 | 0000000140063740 | mov rbp,rdx | 0000000140063743 | test rcx,rcx | 0000000140063746 | je procexp64.14006375B | 0000000140063748 | call qword ptr ds:[1400D0958] | 000000014006374E | mov qword ptr ds:[rbx],0 | 0000000140063755 | mov dword ptr ds:[rdi],0 | 000000014006375B | lea r8,qword ptr ss:[rsp+20] | 0000000140063760 | mov edx,3 | 0000000140063765 | xor ecx,ecx | 0000000140063767 | mov dword ptr ss:[rsp+20],ebp | 000000014006376B | mov qword ptr ss:[rsp+28],0 | 0000000140063774 | call qword ptr ds:[14012CC68] | NULL *boom* 000000014006377A | test eax,eax | 000000014006377C | jne procexp64.140063791 | 000000014006377E | mov rdx,qword ptr ss:[rsp+28] | 0000000140063783 | mov ecx,dword ptr ds:[rdx] | 0000000140063785 | mov dword ptr ds:[rdi],ecx | 0000000140063787 | mov rcx,qword ptr ds:[rdx+8] | 000000014006378B | mov qword ptr ds:[rbx],rcx | 000000014006378E | mov qword ptr ds:[rsi],rdx | 0000000140063791 | mov rbx,qword ptr ss:[rsp+40] | 0000000140063796 | mov rbp,qword ptr ss:[rsp+48] | 000000014006379B | mov rsi,qword ptr ss:[rsp+50] | 00000001400637A0 | add rsp,30 | 00000001400637A4 | pop rdi | 00000001400637A5 | ret | --- snip --- Using the "find references to address" method for 0x14012CC68 one comes across this: --- snip --- 0000000140080B4A | lea rdx,qword ptr ds:[1400ECF08] | "I_QueryTagInformation" 0000000140080B51 | mov rcx,rax | 0000000140080B54 | call qword ptr ds:[1400D0968] | 0000000140080B5A | lea rcx,qword ptr ds:[1400ECF30] | L"wow64cpu" 0000000140080B61 | mov qword ptr ds:[14012CC68],rax | --- snip --- which corresponds to the trace log snippet earlier. At one point Wine might implement service process tags as well for mapping service hosting threads with their owner service. Service tags were introduced with Windows Vista. The tag is contained in the TEB of every thread (sub-process tag) and is used in threads owned by service processes as a way to link them with their owning service name. https://github.com/processhacker/processhacker/blob/master/phlib/svcsup.c#L4... --- snip --- PPH_STRING PhGetServiceNameFromTag( _In_ HANDLE ProcessId, _In_ PVOID ServiceTag ) { static PQUERY_TAG_INFORMATION I_QueryTagInformation = NULL; PPH_STRING serviceName = NULL; TAG_INFO_NAME_FROM_TAG nameFromTag; if (!I_QueryTagInformation) { I_QueryTagInformation = PhGetDllProcedureAddress(L"advapi32.dll", "I_QueryTagInformation", 0); if (!I_QueryTagInformation) return NULL; } memset(&nameFromTag, 0, sizeof(TAG_INFO_NAME_FROM_TAG)); nameFromTag.InParams.dwPid = HandleToUlong(ProcessId); nameFromTag.InParams.dwTag = PtrToUlong(ServiceTag); I_QueryTagInformation(NULL, eTagInfoLevelNameFromTag, &nameFromTag); if (nameFromTag.OutParams.pszName) { serviceName = PhCreateString(nameFromTag.OutParams.pszName); LocalFree(nameFromTag.OutParams.pszName); } return serviceName; } --- snip --- https://github.com/processhacker/processhacker/blob/2bb718f36a702fde6cb346e9... --- snip --- _Must_inspect_result_ DWORD WINAPI I_QueryTagInformation( _In_opt_ LPCWSTR pszMachineName, _In_ TAG_INFO_LEVEL eInfoLevel, _Inout_ PVOID pTagInfo ); --- snip --- $ sha1sum ProcessExplorer.zip 97d882b15890471ea9942c80997c180fbfcbba26 ProcessExplorer.zip $ du -sh ProcessExplorer.zip 1.9M ProcessExplorer.zip $wine --version wine-3.17-39-gc96eba60e3 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45926 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download URL| |https://docs.microsoft.com/ | |en-us/sysinternals/download | |s/process-explorer -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45926 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Windows Sysinternals |Windows Sysinternals |ProcessExplorer v12-16+ |ProcessExplorer |crashes due to missing |v12.x-v16.21 crashes due to |advapi32.I_QueryTagInformat |missing |ion() stub |advapi32.I_QueryTagInformat | |ion() stub URL|https://docs.microsoft.com/ |https://web.archive.org/web |en-us/sysinternals/download |/20181107082314/http://down |s/process-explorer |load.sysinternals.com/Files | |/ProcessExplorer.zip --- Comment #1 from Anastasius Focht <focht(a)gmx.net> --- Hello folks, revisiting, still present. It seems they fixed the NULL access in newer ProcessExplorer versions. From v16.22 onwards it doesn't crash anymore - at least on startup. * https://web.archive.org/web/20181107082314/http://download.sysinternals.com/... -> v16.21 = crash * https://web.archive.org/web/20190502025058if_/http://download.sysinternals.c... -> v16.22 = no crash Wine source: https://source.winehq.org/git/wine.git/blob/123c0543e0bb4c99fbee0a568e786405... --- snip --- 387 # @ stub I_QueryTagInformation --- snip --- $ du -sh ProcessExplorer.zip 1.9M ProcessExplorer.zip $ sha1sum ProcessExplorer.zip 97d882b15890471ea9942c80997c180fbfcbba26 ProcessExplorer.zip $ du -sh ProcessExplorer.zip 1.8M ProcessExplorer.zip $ wine --version wine-5.5 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=45926 Bernhard Übelacker <bernhardu(a)mailbox.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alexchandel(a)gmail.com --- Comment #2 from Bernhard Übelacker <bernhardu(a)mailbox.org> --- *** Bug 43507 has been marked as a duplicate of this bug. *** -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (2)
-
wine-bugs＠winehq.org -
WineHQ Bugzilla