[PATCH 0/1] MR6761: Draft: kernelbase: Fix return on failed VirtualQueryEx

[Evelynne Young (＠nulleve)]

Fixes Dark and Darker's Anti-Cheat "TavernWorker"; Original issue thread on Proton's repo [#2016590](https://github.com/ValveSoftware/Proton/issues/8208).
> From the issue thread: Glaring issue seems to be the inability to load past the main menu in Dark and Darker without getting a pop-up that says "Tavern is not working! Please restart your game.", resulting in a forced exit.

I've marked this as Draft as I am not entirely sure returning the `NTSTATUS` of `NtWriteVirtualMemory` is the proper solution here (I have not found any other working solutions so-far). Returning the `NTSTATUS` of `NtQueryVirtualMemory` seems to not achieve working results, however I am not an expert by any means.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/6761

[PATCH 1/1] kernelbase: Fix return on Failed VirtualQueryEx

[Evelynne]

From: Evelynne <nullevelynne(a)gmail.com>

---
 dlls/kernelbase/memory.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/kernelbase/memory.c b/dlls/kernelbase/memory.c
index 10745303499..ae64cc5b9d0 100644
--- a/dlls/kernelbase/memory.c
+++ b/dlls/kernelbase/memory.c
@@ -613,7 +613,7 @@ BOOL WINAPI DECLSPEC_HOTPATCH WriteProcessMemory( HANDLE process, void *addr, co
     if (!VirtualQueryEx( process, addr, &info, sizeof(info) ))
     {
         close_cross_process_connection( list );
-        return FALSE;
+        return set_ntstatus( NtWriteVirtualMemory( process, addr, buffer, size, bytes_written ));
     }
 
     switch (info.Protect & ~(PAGE_GUARD | PAGE_NOCACHE))
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/6761

[PATCH 1/1] kernelbase: Fix return on Failed VirtualQueryEx

[Marvin]

Hi,

It looks like your patch introduced the new failures shown below.
Please investigate and fix them before resubmitting your patch.
If they are not new, fixing them anyway would help a lot. Otherwise
please ask for the known failures list to be updated.

The tests also ran into some preexisting test failures. If you know how
to fix them that would be helpful. See the TestBot job for the details:

The full results can be found at:
https://testbot.winehq.org/JobDetails.pl?Key=149443

Your paranoid android.


=== debian11b (64 bit WoW report) ===

Report validation errors:
ws2_32:protocol crashed (c0000005)

[PATCH 0/1] MR6761: kernelbase: Fix return on failed VirtualQueryEx

[Evelynne Young (＠nulleve)]

After more debugging and testing, attempting to return `set_ntstatus` of anything but `NtWriteVirtualMemory` seems to always fail. In Dark and Darker's case the Error Codes for `WriteProcessMemory` can jump from 0 `(ERROR_SUCCESS)`, 5 `(ERROR_ACCESS_DENIED)`, and 487 `(ERROR_INVALID_ADDRESS)` while `VirtualQueryEx` always responds with 5 in this case. 

As the return needs to be flexible for these scenarios it seems as though the original fix was correct?

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/6761#note_86484

[PATCH 0/1] MR6761: kernelbase: Fix return on failed VirtualQueryEx

[eric pouech (＠epo)]

> From your explanation, it rather looks that VirtualQueryEx() fails because the access rights of the process handle don't have the PROCESS_QUERY_INFORMATION bit set.
> (tested on Win10 and WriteProcessMemory() succeeds if the PROCESS_QUERY_INFORMATION isn't set).
> Does the attached patch works as well?

(and calling directly NtWriteVirtualMemory() doesn't look fully correct: it should follow the rest of the code to potentially change protection of some pages)

[writevirt.patch](/uploads/e2b61d4a5da0f9990c0488273dd3f834/writevirt.patch).

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/6761#note_86497

[PATCH 0/1] MR6761: kernelbase: Fix return on failed VirtualQueryEx

[eric pouech (＠epo)]

actually submitted MR 6767 with the patch above and some related tests.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/6761#note_86527

[PATCH 0/1] MR6761: kernelbase: Fix return on failed VirtualQueryEx

[Evelynne Young (＠nulleve)]

On Mon Nov  4 18:42:54 2024 +0000, eric pouech wrote:
> actually submitted MR 6767 with the patch above and some related tests.
> Woah thank you! The patch above does indeed work, should I go ahead and close this merge request as it's moved?

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/6761#note_86533

[PATCH 0/1] MR6761: kernelbase: Fix return on failed VirtualQueryEx

[eric pouech (＠epo)]

On Mon Nov  4 18:42:54 2024 +0000, Evelynne Young wrote:
> Woah thank you! The patch above does indeed work, should I go ahead and
> close this merge request as it's moved?
> yes, you can close this MR.
> Note that the MR I submitted will evolve (solving the problem a bit lower in the layers, but that should be transparent).

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/6761#note_86603

[PATCH 0/1] MR6761: kernelbase: Fix return on failed VirtualQueryEx - closed

[Evelynne Young (＠nulleve)]

This merge request was closed by Evelynne Young.
-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/6761