October 2013 - Wine-Bugs - list.winehq.org

[Bug 34623] New: NCsoft's Aion (MMORPG) crashes on startup (WinLicense software protection, avoid forwarding some msvcr80 API to msvcrt)
by wine-bugs＠winehq.org Oct. 11, 2013

Oct. 11, 2013

http://bugs.winehq.org/show_bug.cgi?id=34623 Bug #: 34623 Summary: NCsoft's Aion (MMORPG) crashes on startup (WinLicense software protection, avoid forwarding some msvcr80 API to msvcrt) Product: Wine Version: 1.7.3 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: msvcrt AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello folks, continuation of bug 34470 We're still 'purist' here, no winetricks (VC++ runtimes). With msvcp80 fordwards fixed, the dll entry points from crysystem.dll and friends are successfully passed (no more exceptions with loader lock held). Crashes at this point now invoke the registered crash handler/debugger which is obviously more helpful ;-) Besides Winedbg, AION's own crash tool "SendLogClient.exe" gives a bit of information: --- snip --- ... Registers: EAX=0343e13c CS=0023 EIP=f348e160 EFLGS=00010246 EBX=5653ffd8 SS=002b ESP=0032c63c EBP=0032c6a0 ECX=0349a9c0 DS=002b ESI=564dff90 FS=0063 EDX=032fe560 ES=002b EDI=0349a9c0 GS=006b Bytes at CS:EIP: 6d 73 76 63 72 74 2e 3f 3f 39 74 79 70 65 5f 69 Stack dump: 0032C63C: 032FE5AD 0349A9C0 03455245 0343E13D 564DFF90 00000000 00000000 00000000 0032C65C: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 0032C67C: 00000000 00000000 00000000 00000000 F73EE680 00000000 00000000 00000000 ... Call Stack Information F348E160 0032C6A0 0002:00008160 C:\windows\system32\msvcr80.dll Params: 0343E13C 0349A9C0 5653FFD8 5649FE00 [msvcr80.dll] Bytes at CS:EIP: 6d 73 76 63 72 74 2e 3f 3f 39 74 79 70 65 5f 69 0338A3F1 0032C710 0001:000B93F1 C:\Program Files\NCSOFT\Aion\bin32\CrySystem.dll Params: 0343E13C 0349A9C0 5653FFD8 5653FFC0 [CrySystem.dll] Bytes at CS:EIP: 5f b0 01 5e 88 43 09 5b 8b e5 5d c2 0c 00 5f 5e ... --- snip --- The protection actually detects certain debuggers when being attached at runtime/crash time and kills them off through watcher threads. Using tools like Imprec and LordPE one can dissemble/dump from process address space without attaching to the actual process (non-invasive method). Using last good return address -> 0x0338A3F1 (CrySystem.dll): --- snip --- 0338A3DC 8B45 10 mov eax,[ebp+10] 0338A3DF 8B4D 0C mov ecx,[ebp+C] 0338A3E2 8B13 mov edx,[ebx] 0338A3E4 8B52 04 mov edx,[edx+4] 0338A3E7 50 push eax 0338A3E8 8B45 08 mov eax,[ebp+8] 0338A3EB 51 push ecx 0338A3EC 50 push eax 0338A3ED 8BCB mov ecx,ebx 0338A3EF FFD2 call edx 0338A3F1 5F pop edi 0338A3F2 B0 01 mov al,1 0338A3F4 5E pop esi 0338A3F5 8843 09 mov [ebx+9],al 0338A3F8 5B pop ebx 0338A3F9 8BE5 mov esp,ebp 0338A3FB 5D pop ebp 0338A3FC C2 0C00 retn C --- snip --- "call edx" -> edx from faulting thread context = 0x032fe560 gets the callee address: --- snip --- 032FE560 55 push ebp 032FE561 8BEC mov ebp,esp 032FE563 83EC 50 sub esp,50 032FE566 833D B00B4C03 00 cmp dword ptr [34C0BB0],0 032FE56D 53 push ebx 032FE56E 8B5D 10 mov ebx,[ebp+10] 032FE571 56 push esi 032FE572 57 push edi 032FE573 8B7D 0C mov edi,[ebp+C] 032FE576 8BF1 mov esi,ecx 032FE578 74 27 je short 032FE5A1 032FE57A 68 7CA54903 push 349A57C 032FE57F B9 C0A94903 mov ecx,349A9C0 032FE584 90 nop 032FE585 E8 B5FB18F0 call F348E13F 032FE58A 84C0 test al,al 032FE58C 74 13 je short 032FE5A1 032FE58E 8D46 10 lea eax,[esi+10] 032FE591 50 push eax 032FE592 53 push ebx 032FE593 57 push edi 032FE594 FF15 B00B4C03 call [34C0BB0] ... --- snip --- The interesting call is at 0x032FE585 -> "call F348E13F" No need to disassemble the call target as it's obvious from the backtrace that the fault is caused by executing ascii characters and not opcodes. " Bytes at CS:EIP: 6d 73 76 63 72 74 2e 3f 3f 39 74 79 70 65 5f 69 " Dump gives: --- snip --- F348E13F 6D 73 76 63 72 74 2E 3F 3F 38 74 79 70 65 5F 69 msvcrt.??8type_i F348E14F 6E 66 6F 40 40 51 42 45 48 41 42 56 30 40 40 5A nfo@@QBEHABV0@@Z F348E15F 00 6D 73 76 63 72 74 2E 3F 3F 39 74 79 70 65 5F .msvcrt.??9type_ F348E16F 69 6E 66 6F 40 40 51 42 45 48 41 42 56 30 40 40 info@@QBEHABV0@@ F348E17F 5A 00 6D 73 76 63 72 74 2E 3F 3F 5F 37 5F 5F 6E Z.msvcrt.??_7__n F348E18F 6F 6E 5F 72 74 74 69 5F 6F 62 6A 65 63 74 40 40 on_rtti_object@@ --- snip --- It wants msvcr80.dll "??8type_info@@QBE_NABV0@@Z" which is unfortunately forwarded to msvcrt.dll Source: http://source.winehq.org/git/wine.git/blob/dadb2fdfa9f73ef49a71837c3a214830… --- snip --- 49 @ thiscall -arch=i386 ??8type_info@@QBE_NABV0@@Z(ptr ptr) msvcrt.??8type_info@@QBEHABV0@@Z --- snip --- Source: http://source.winehq.org/git/wine.git/blob/e931b5d17ee481798a72de2bd3103ed2… --- quote --- 538 /****************************************************************** 539 * ??8type_info@@QBEHABV0@@Z (MSVCRT.@) 540 */ 541 DEFINE_THISCALL_WRAPPER(MSVCRT_type_info_opequals_equals,8) 542 int __thiscall MSVCRT_type_info_opequals_equals(type_info * _this, const type_info * rhs) 543 { 544 int ret = !strcmp(_this->mangled + 1, rhs->mangled + 1); 545 TRACE("(%p %p) returning %d\n", _this, rhs, ret); 546 return ret; 547 } --- quote --- Figuring out the list imports that can't be forwarded to msvcrt is usually done using following approach (assuming no IAT/indirect calls)... Basically you search the mapped range of unpacked dll code section(s), checking all call/jmp destinations that match the range of mapped system dll (all sections), throw away the ones that point to code section and analyse the ones that point to other (data) section(s). The following APIs that should not be forwarded to msvcrt: --- quote --- msvcr80.dll.??0exception(a)std@@QAE(a)ABQBD@Z msvcr80.dll.??0exception(a)std@@QAE(a)ABQBDH@Z msvcr80.dll.??0exception(a)std@@QAE(a)ABV01@@Z msvcr80.dll.??0exception(a)std@@QAE(a)XZ msvcr80.dll.??1exception(a)std@@UAE(a)XZ msvcr80.dll.??8type_info@@QBE_NABV0@@Z msvcr80.dll.??9type_info@@QBE_NABV0@@Z msvcr80.dll.?_name_internal_method(a)type_info@@QBEPBDPAU__type_info_node@@@Z --- quote --- Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 19200] New: Neverwinter Nights 2 crashes
by wine-bugs＠winehq.org Oct. 11, 2013

Oct. 11, 2013

http://bugs.winehq.org/show_bug.cgi?id=19200 Summary: Neverwinter Nights 2 crashes Product: Wine Version: 1.1.25 Platform: PC-x86-64 OS/Version: Linux Status: UNCONFIRMED Severity: critical Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: axelgenus(a)gmail.com Created an attachment (id=22199) --> (http://bugs.winehq.org/attachment.cgi?id=22199) Error log The game starts with no problems. When I play the official campaign nwn2main.exe crashes as soon as I exit the Daegun house. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 11

[Bug 16935] New: BCG Slider thumb doesnt display correctly
by wine-bugs＠winehq.org Oct. 11, 2013

Oct. 11, 2013

http://bugs.winehq.org/show_bug.cgi?id=16935 Summary: BCG Slider thumb doesnt display correctly Product: Wine Version: 1.1.12 Platform: Other URL: http://www.bcgsoft.com/download.htm OS/Version: other Status: NEW Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: leslie_alistair(a)hotmail.com Downlaod the "BCGControlBar Professional Edition demonstration" Run the Slider.exe example Try to move the slider across, it doesn't move. The new value is recorded, as a Dialog appears stating the value. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 9

[Bug 26384] New: BabasChess crashed after examining a game for a while
by wine-bugs＠winehq.org Oct. 11, 2013

Oct. 11, 2013

http://bugs.winehq.org/show_bug.cgi?id=26384 Summary: BabasChess crashed after examining a game for a while Product: Wine Version: 1.3.15 Platform: x86-64 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: jonathan.natewood(a)gmail.com Created an attachment (id=33599) --> (http://bugs.winehq.org/attachment.cgi?id=33599) Terminal output To reproduce: Examine a game in BabasChess 4.0. Use the mouse scroll wheel to navigate between moves. Keep repeating previous step until it will crash. Will take between immediate to a few minutes, unknown what it depends on. Download link: http://www.babaschess.net/download/SetupBabasChess_4_0_XP.exe -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 31140] New: BCG Gantt Demo crashes when large date ranged enter.
by wine-bugs＠winehq.org Oct. 11, 2013

Oct. 11, 2013

http://bugs.winehq.org/show_bug.cgi?id=31140 Bug #: 31140 Summary: BCG Gantt Demo crashes when large date ranged enter. Product: Wine Version: 1.5.8 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: leslie_alistair(a)hotmail.com Classification: Unclassified Run the BCGPGanttDemo.exe demo On "Task 11", set the year to 2009 and press enter. Wine crashes. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 4

[Bug 8848] SWAT4 Areas that should be in shadow and people are rendered solid black
by wine-bugs＠winehq.org Oct. 10, 2013

Oct. 10, 2013

http://bugs.winehq.org/show_bug.cgi?id=8848 Andrey Gusev <andrey.goosev(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |andrey.goosev(a)gmail.com --- Comment #20 from Andrey Gusev <andrey.goosev(a)gmail.com> 2013-10-10 07:56:22 CDT --- Yeah, still in 1.7.3 -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 6955] Software vertex blending not implemented (affects NOLF2, Divinity 2, ...)
by wine-bugs＠winehq.org Oct. 9, 2013

Oct. 9, 2013

http://bugs.winehq.org/show_bug.cgi?id=6955 --- Comment #132 from exclusive_tm(a)mail.ru 2013-10-09 09:19:14 CDT --- Created attachment 46242 --> http://bugs.winehq.org/attachment.cgi?id=46242 Patch implementing software vertex blending for wine 1.7.0 -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 9159] shell32/explorer: Add support for Progman DDE interface
by wine-bugs＠winehq.org Oct. 8, 2013

Oct. 8, 2013

http://bugs.winehq.org/show_bug.cgi?id=9159 Jason Spiro <jasonspiro3(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |damjan.jov(a)gmail.com -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 9159] shell32/explorer: Add support for Progman DDE interface
by wine-bugs＠winehq.org Oct. 8, 2013

Oct. 8, 2013

http://bugs.winehq.org/show_bug.cgi?id=9159 Jason Spiro <jasonspiro3(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jasonspiro3(a)gmail.com --- Comment #27 from Jason Spiro <jasonspiro3(a)gmail.com> 2013-10-07 22:42:52 CDT --- Cc added: Damjan Jovanovic. Hi Damjan. I see that, in 2011, you sent a patch[1] to resolve this issue; thank you very much. The patch still applies to Git HEAD without problems. And it looks like tests/progman_dde.c,[2] by Mikey Alexander, covers your patch. It would be good if your patch's functionality got into Wine. I wonder if you could please resend it and let us know what the patch status page[3] reports? Maybe this time a committer will accept it. While resending it, please do point out that nobody replied, and it looks[4] like nobody even looked at it, and so you are resending it now, two years later. I thank you in advance. ^ [1]. http://marc.info/?l=wine-patches&m=130946473324773 ^ [2]. http://source.winehq.org/git/wine.git/blob/HEAD:/dlls/shell32/tests/progman… [3]. http://source.winehq.org/patches/ ^ [4]. http://web.archive.org/web/20110710075642/http://source.winehq.org/patches/ -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 0

[Bug 28042] New: [regression] deadlock introduced/exposed with recent changes to winmm
by wine-bugs＠winehq.org Oct. 8, 2013

Oct. 8, 2013

http://bugs.winehq.org/show_bug.cgi?id=28042 Summary: [regression] deadlock introduced/exposed with recent changes to winmm Product: Wine Version: 1.3.26 Platform: x86 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: cfiend(a)talent.edu.pl Running recent versions of Wine (1.3.25 or 1.3.26) causes "Cuban Missile Crisis: The Aftermath" (known also as "The Day After: Fight for Promised Land") to hang during startup with a message similar to: err:ntdll:RtlpWaitForCriticalSection section 0x7efec8e4 "loader.c: loader_section" wait timed out in thread 001f, blocked by 0009, retrying (60 sec) I cannot test this as currently I'm not in possesion of suitable software but there is a possibility that other games using the Enigma engine might suffer in the same way: Blitzkrieg, Blitzkrieg 2, Stalingrad. This needs confirmation though. git bisect converges on the following commit: 30eeb996edc3be14b06244ed13b2b8f84be5f400 is the first bad commit commit 30eeb996edc3be14b06244ed13b2b8f84be5f400 Author: Andrew Eikum <aeikum(a)codeweavers.com> Date: Wed Jul 13 14:20:40 2011 -0500 winmm: Implement mixer* on top of MMDevAPI. :040000 040000 3d0e5786be14ebaa13b08f4cd4234ddcbf112eb1 2ba46764f5cf7c6d823ce3a2d9d6132d43db7013 M dlls Switching between hardware or emulation in sound settings does not help, neither does turning off sound entirely. I will gladly provide any additional logs or information on request. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

1 25