[Bug 47061] New: Multiple E-Banking applications by KOBIL Systems GmbH crash on startup or report 'Security issue code: 0x03938745 (60000069)' (MigrosBank EBanking 8.2.x, Sparda Bank SecureApp 1.x)
https://bugs.winehq.org/show_bug.cgi?id=47061 Bug ID: 47061 Summary: Multiple E-Banking applications by KOBIL Systems GmbH crash on startup or report 'Security issue code: 0x03938745 (60000069)' (MigrosBank EBanking 8.2.x, Sparda Bank SecureApp 1.x) Product: Wine Version: 4.6 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: kernel32 Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, continuation of bug 42391 Stable links for current installers: Sparda Bank SecureApp: https://web.archive.org/web/20190422125056/https://www.sparda.de/secureapp-p... Corresponding VirusTotal scan: https://www.virustotal.com/gui/file/444c501236d5704e43ff5238a03b2c66a08eeba0... --- MigrosBank EBanking app: https://web.archive.org/web/20190422124354/https://download.migrosbank.ch/mi... Corresponding VirusTotal scan: https://www.virustotal.com/gui/file/9cd93cc70c6a8b24dbf47a3d20c9a1ed5f634140... --- Trace log: --- snip --- $ pwd /home/focht/.wine/drive_c/users/focht/Application Data/Sparda/AST-Client $ WINEDEBUG=+seh,+relay wine ./SpardaSecureApp.exe >>log.txt 2>&1 ... 003a:Ret KERNEL32.__wine_kernel_init() retval=7b472944 ret=7bc668b7 ... 003a:Call TLS callback (proc=0x20010530,module=0x20000000,reason=PROCESS_ATTACH,reserved=0) 003a:Call KERNEL32.VirtualAlloc(00000000,00000006,00003000,00000004) ret=2001256a 003a:Ret KERNEL32.VirtualAlloc() retval=00340000 ret=2001256a 003a:Call KERNEL32.VirtualAlloc(00000000,00000017,00003000,00000004) ret=2001258d 003a:Ret KERNEL32.VirtualAlloc() retval=00350000 ret=2001258d 003a:Call KERNEL32.GetModuleHandleA(00340000 "ntdll") ret=20012652 003a:Ret KERNEL32.GetModuleHandleA() retval=7bc10000 ret=20012652 003a:Call KERNEL32.GetProcAddress(7bc10000,00350000 "NtSetInformationThread") ret=20012659 003a:Ret KERNEL32.GetProcAddress() retval=7bc24870 ret=20012659 003a:Call KERNEL32.VirtualFree(00340000,00000000,00008000) ret=2001266a 003a:Ret KERNEL32.VirtualFree() retval=00000001 ret=2001266a 003a:Call KERNEL32.VirtualFree(00350000,00000000,00008000) ret=20012688 003a:Ret KERNEL32.VirtualFree() retval=00000001 ret=20012688 003a:Call ntdll.NtSetInformationThread(fffffffe,00000011,00000000,00000000) ret=200126c8 003a:Ret ntdll.NtSetInformationThread() retval=00000000 ret=200126c8 003a:Call ntdll.NtReadVirtualMemory(ffffffff,20000028,0033e434,00000002,0033e42c) ret=2001277b 003a:Ret ntdll.NtReadVirtualMemory() retval=00000000 ret=2001277b ... 003a:Call KERNEL32.VirtualProtect(1ffb0000,00000005,00000020,0033e384) ret=20014840 003a:Ret KERNEL32.VirtualProtect() retval=00000001 ret=20014840 003a:Call KERNEL32.VirtualProtect(1ffa0000,0000000a,00000020,0033e380) ret=2001484f 003a:Ret KERNEL32.VirtualProtect() retval=00000001 ret=2001484f 003a:Call KERNEL32.FlushInstructionCache(ffffffff,1ffa0000,0000000a) ret=20014860 003a:Ret KERNEL32.FlushInstructionCache() retval=00000001 ret=20014860 003a:Call KERNEL32.VirtualProtect(7bc206ac,00000005,00000040,0033e40c) ret=20014997 003a:Ret KERNEL32.VirtualProtect() retval=00000001 ret=20014997 003a:Call ntdll.RtlMoveMemory(7bc206ac,00360021,00000005) ret=200149a4 003a:Ret ntdll.RtlMoveMemory() retval=7bc206ac ret=200149a4 003a:Call KERNEL32.VirtualProtect(7bc206ac,00000005,00000020,0033e40c) ret=200149b4 003a:Ret KERNEL32.VirtualProtect() retval=00000001 ret=200149b4 003a:Call KERNEL32.FlushInstructionCache(ffffffff,7bc206ac,00000005) ret=200149c4 003a:Ret KERNEL32.FlushInstructionCache() retval=00000001 ret=200149c4 003a:Call ntdll.LdrRegisterDllNotification(00000000,20010d80,00000000,20076e5c) ret=2001116a 003a:Ret ntdll.LdrRegisterDllNotification() retval=00000000 ret=2001116a 003a:Call KERNEL32.TlsAlloc() ret=200111dc 003a:Ret KERNEL32.TlsAlloc() retval=00000002 ret=200111dc 003a:Call KERNEL32.VirtualAlloc(00000000,000001f4,00001000,00000004) ret=20011217 003a:Ret KERNEL32.VirtualAlloc() retval=00370000 ret=20011217 003a:Call KERNEL32.VirtualFree(00370000,00000000,00008000) ret=2001129d 003a:Ret KERNEL32.VirtualFree() retval=00000001 ret=2001129d 003a:Call KERNEL32.VirtualAlloc(00000000,00000030,00001000,00000004) ret=20014b0b 003a:Ret KERNEL32.VirtualAlloc() retval=00370000 ret=20014b0b 003a:Call KERNEL32.VirtualFree(00370000,00000000,00008000) ret=20014ab4 003a:Ret KERNEL32.VirtualFree() retval=00000001 ret=20014ab4 003a:Call KERNEL32.GetProcAddress(7bc10000,2006cc74 "_snwprintf") ret=200136f7 003a:Ret KERNEL32.GetProcAddress() retval=7bc78380 ret=200136f7 003a:Call KERNEL32.GetProcAddress(7b420000,2006cd44 "FatalAppExitW") ret=2001374a 003a:Ret KERNEL32.GetProcAddress() retval=7b42575c ret=2001374a 003a:Call KERNEL32.GetModuleHandleW(00000000) ret=2000a477 003a:Ret KERNEL32.GetModuleHandleW() retval=20000000 ret=2000a477 003a:Call KERNEL32.ReadProcessMemory(ffffffff,2000002e,0033dfa8,00000004,0033dfa4) ret=2000a49d 003a:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=2000a49d 003a:Call KERNEL32.GetModuleHandleW(00000000) ret=2000a4ba 003a:Ret KERNEL32.GetModuleHandleW() retval=20000000 ret=2000a4ba 003a:Call KERNEL32.ReadProcessMemory(ffffffff,20000024,0033dfa4,00000004,0033dfa0) ret=2000a4d4 003a:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=2000a4d4 003a:Call KERNEL32.ReadProcessMemory(ffffffff,0000002e,0033dfa8,00000004,0033dfa0) ret=2000a4f5 003a:Ret KERNEL32.ReadProcessMemory() retval=00000000 ret=2000a4f5 003a:Call KERNEL32.VirtualAlloc(00000000,00000064,00001000,00000004) ret=2001376f 003a:Ret KERNEL32.VirtualAlloc() retval=00370000 ret=2001376f 003a:Call KERNEL32.FatalAppExitW(00000000,0033dfc8 L"Security issue code: 0x03938745 (60000069)") ret=2001379b 003a:warn:seh:FatalAppExitW AppExit 003a:err:seh:FatalAppExitW L"Security issue code: 0x03938745 (60000069)" ... --- snip --- The protection code doesn't use Win32 API to resolve functions hence one needs to debug here. --- snip --- ... 20011276 | E8 9592FFFF | call spardasecureapp.2000A510 | find kernel32.dll 2001127B | A3 EC6D0720 | mov dword ptr ds:[20076DEC],eax | via PEB_LDR_DATA 20011280 | 8B55 FC | mov edx,dword ptr ss:[ebp-4] | "LoadAppInitDlls" 20011283 | 8BC8 | mov ecx,eax | 20011285 | E8 E694FFFF | call spardasecureapp.2000A770 | resolve API 2001128A | 68 00800000 | push 8000 | 2001128F | 6A 00 | push 0 | 20011291 | 57 | push edi | 20011292 | A3 AC6E0720 | mov dword ptr ds:[20076EAC],eax | 20011297 | FF15 CCD00420 | call dword ptr ds:[2004D0CC] | VirtualFree() 2001129D | 6A 01 | push 1 | ... --- snip --- -> it wants 'kernel32.LoadAppInitDlls' Bunch of API it wants to resolve and hook: --- snip --- ... 00360000 4B 69 55 73 65 72 41 70 63 44 69 73 70 61 74 63 KiUserApcDispatc 00360010 68 65 72 00 00 00 00 00 00 00 00 00 00 00 00 00 her............. 00360020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00360030 00 00 4E 74 43 6F 6E 74 69 6E 75 65 00 00 00 00 ..NtContinue.... 00360040 00 00 00 00 00 00 00 00 00 00 00 00 4C 64 72 4C ............LdrL 00360050 6F 61 64 44 6C 6C 00 00 00 00 00 00 00 00 00 00 oadDll.......... 00360060 00 00 00 00 00 00 52 74 6C 4E 74 53 74 61 74 75 ......RtlNtStatu 00360070 73 54 6F 44 6F 73 45 72 72 6F 72 00 00 00 00 00 sToDosError..... 00360080 00 00 00 00 00 00 00 4C 6F 61 64 41 70 70 49 6E .......LoadAppIn 00360090 69 74 44 6C 6C 73 00 00 00 00 00 00 00 00 00 00 itDlls.......... 003600A0 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 64 72 .............Ldr 003600B0 52 65 67 69 73 74 65 72 44 6C 6C 4E 6F 74 69 66 RegisterDllNotif 003600C0 69 63 61 74 69 6F 6E 00 00 00 00 00 00 00 00 00 ication......... 003600D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 003600E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C 64 ..............Ld 003600F0 72 55 6E 72 65 67 69 73 74 65 72 44 6C 6C 4E 6F rUnregisterDllNo 00360100 74 69 66 69 63 61 74 69 6F 6E 00 00 00 00 00 00 tification...... 00360110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ ... --- snip --- Wine source: https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/kernel32/kernel32.spe... --- snip --- 1044 # @ stub LoadAppInitDlls --- snip --- With an empty stub added, the app successfully executes the TLS callback and the real entry point is executed - only to run into next problem ;-) Tidbit: The 'AppInit_DLLs' feature is described here: https://support.microsoft.com/en-us/help/197571/working-with-the-appinit-dll... That's another way of having dlls automatically injected into every process. Most likely introduced by MS to support the malware industry ... j/k (or not?) ;-) $ sha1sum spardasecureapp_p.exe d579216a3a61555c68a75636893216b8a4233737 spardasecureapp_p.exe $ du -sh spardasecureapp_p.exe 9.6M spardasecureapp_p.exe $ wine --version wine-4.6-108-g9d7d68747b Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47061 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, obfuscation URL| |https://web.archive.org/web | |/20190422125056/https://www | |.sparda.de/secureapp-pc/med | |ien/spardasecureapp_p.exe -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47061 Maik Wagner <maiktapwagner(a)aol.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |maiktapwagner(a)aol.com --- Comment #1 from Maik Wagner <maiktapwagner(a)aol.com> --- Created attachment 65240 --> https://bugs.winehq.org/attachment.cgi?id=65240 Console output - wine 4.15 (staging) Still present in wine 4.15 (staging) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47061 Johannes Pfrang <johannespfrang+wine(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |johannespfrang+wine(a)gmail.c | |om -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47061 Alex Henrie <alexhenrie24(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |alexhenrie24(a)gmail.com See Also| |https://bugs.winehq.org/sho | |w_bug.cgi?id=47062 Resolution|--- |FIXED Component|kernel32 |kernelbase --- Comment #2 from Alex Henrie <alexhenrie24(a)gmail.com> --- Fixed by https://source.winehq.org/git/wine.git/commitdiff/22cdc4e3da29578bdbf0d537e9... The next problem is Bug 47062 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47061 Alex Henrie <alexhenrie24(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |22cdc4e3da29578bdbf0d537e96 | |8217af87b720b -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47061 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #3 from Alexandre Julliard <julliard(a)winehq.org> --- Closing bugs fixed in 5.7. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47061 Zebediah Figura <z.figura12(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Component|kernelbase |kernel32 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (2)
-
wine-bugs＠winehq.org -
WineHQ Bugzilla