September 2018 - Wine-Bugs - list.winehq.org

[Bug 44496] New: BattlEye 'BEDaisy' kernel service custom imports resolved can't cope with 'ntoskrnl.exe' low-level (wc)string/copy helpers being forwarded to 'msvcrt.dll'
by wine-bugs＠winehq.org March 18, 2021

March 18, 2021

https://bugs.winehq.org/show_bug.cgi?id=44496 Bug ID: 44496 Summary: BattlEye 'BEDaisy' kernel service custom imports resolved can't cope with 'ntoskrnl.exe' low-level (wc)string/copy helpers being forwarded to 'msvcrt.dll' Product: Wine Version: 3.1 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: ntoskrnl Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, follow-up of bug 37355 Small client to reproduce: http://static.tibia.com/download/Tibia_Setup.exe NOTE: Due to a regression with service state/transition handling, the kernel driver service is not started by the helper service anymore (only once upon installation). To work around bug 41670 issue 'wine net stop BEService' command from another console after the window "Starting BattlEye Service..." shows up and wait a bit. The app will detect this and restart the helper service which in turn will start the kernel service. Also suffers from bug 38836 later. --- snip --- $ pwd /home/focht/.wine/drive_c/users/focht/Local Settings/Application Data/Tibia/packages/Tibia/bin $ WINEDEBUG=+tid,+seh,+ntoskrnl,+winedevice,+process,+loaddll,+relay,+module wine ./client_launcher.exe >>log.txt 2>&1 ... 0049:Call ntoskrnl.exe.IoAllocateMdl(00780000,00040409,00000000,00000000,00000000) ret=0080bf37 0049:trace:ntoskrnl:IoAllocateMdl (0x780000, 263177, 0, 0, (nil)) 0049:Call ntdll.RtlAllocateHeap(00110000,00000008,00000120) ret=7ecd1460 0049:Ret ntdll.RtlAllocateHeap() retval=0011cd38 ret=7ecd1460 0049:fixme:ntoskrnl:IoGetCurrentProcess () semi-stub 0049:Ret ntoskrnl.exe.IoAllocateMdl() retval=0011cd38 ret=0080bf37 0049:Call ntoskrnl.exe.MmProbeAndLockPages(0011cd38,00000000,00000001) ret=0080bf37 0049:fixme:ntoskrnl:MmProbeAndLockPages (0x11cd38, 0, 1): stub 0049:Ret ntoskrnl.exe.MmProbeAndLockPages() retval=0000003f ret=0080bf37 0049:Call ntoskrnl.exe.MmMapLockedPagesSpecifyCache(0011cd38,00000000,00000000,00000001,00000000,00000000) ret=0080bf37 0049:fixme:ntoskrnl:MmMapLockedPagesSpecifyCache (0x11cd38, 0, 0, 0x1, 0, 0): stub 0049:Call ntdll.RtlAllocateHeap(00110000,00000000,00040409) ret=7ecd4509 0049:Ret ntdll.RtlAllocateHeap() retval=0011d958 ret=7ecd4509 0049:Call KERNEL32.OpenProcess(001fffff,00000000,00000043) ret=7ecd4534 0049:Ret KERNEL32.OpenProcess() retval=00000040 ret=7ecd4534 0049:Call KERNEL32.ReadProcessMemory(00000040,00780000,0011d958,00040409,00000000) ret=7ecd4567 0049:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=7ecd4567 0049:Call KERNEL32.CloseHandle(00000040) ret=7ecd458e 0049:Ret KERNEL32.CloseHandle() retval=00000001 ret=7ecd458e 0049:fixme:ntoskrnl:MmMapLockedPagesSpecifyCache Success! 0049:Ret ntoskrnl.exe.MmMapLockedPagesSpecifyCache() retval=0011d958 ret=0080bf37 0049:Call ntoskrnl.exe.ExAllocatePool(00000000,00000068) ret=0080bf37 0049:Call ntdll.RtlAllocateHeap(00110000,00000000,00000068) ret=7ecd3339 0049:Ret ntdll.RtlAllocateHeap() retval=0015f3a8 ret=7ecd3339 0049:trace:ntoskrnl:ExAllocatePoolWithTag 104 pool 0 -> 0x15f3a8 0049:Ret ntoskrnl.exe.ExAllocatePool() retval=0015f3a8 ret=0080bf37 0049:Call ntdll.NtQuerySystemInformation(0000000b,0065f39c,00000000,0065f398) ret=0080732b 0049:Ret ntdll.NtQuerySystemInformation() retval=c0000004 ret=0080732b 0049:Call ntoskrnl.exe.ExAllocatePool(00000000,00001400) ret=007fe2fc 0049:Call ntdll.RtlAllocateHeap(00110000,00000000,00001400) ret=7ecd3339 0049:Ret ntdll.RtlAllocateHeap() retval=0015f6d0 ret=7ecd3339 0049:trace:ntoskrnl:ExAllocatePoolWithTag 5120 pool 0 -> 0x15f6d0 0049:Ret ntoskrnl.exe.ExAllocatePool() retval=0015f6d0 ret=007fe2fc 0049:Call ntdll.NtQuerySystemInformation(0000000b,0015f6d0,00001400,0065f398) ret=008034e1 0049:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=008034e1 0049:Call ntoskrnl.exe.ExFreePool(0015f6d0) ret=00803229 0049:trace:ntoskrnl:ExFreePoolWithTag 0x15f6d0 0049:Call ntdll.RtlFreeHeap(00110000,00000000,0015f6d0) ret=7ecd3586 0049:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecd3586 0049:Ret ntoskrnl.exe.ExFreePool() retval=00000001 ret=00803229 0049:Call ntdll.NtQuerySystemInformation(0000000b,0065f39c,00000000,0065f398) ret=0080732b 0049:Ret ntdll.NtQuerySystemInformation() retval=c0000004 ret=0080732b 0049:Call ntoskrnl.exe.ExAllocatePool(00000000,00001400) ret=007fe2fc 0049:Call ntdll.RtlAllocateHeap(00110000,00000000,00001400) ret=7ecd3339 0049:Ret ntdll.RtlAllocateHeap() retval=0015f6d0 ret=7ecd3339 0049:trace:ntoskrnl:ExAllocatePoolWithTag 5120 pool 0 -> 0x15f6d0 0049:Ret ntoskrnl.exe.ExAllocatePool() retval=0015f6d0 ret=007fe2fc 0049:Call ntdll.NtQuerySystemInformation(0000000b,0015f6d0,00001400,0065f398) ret=008034e1 0049:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=008034e1 0049:Call ntoskrnl.exe.ExFreePool(0015f6d0) ret=00803229 0049:trace:ntoskrnl:ExFreePoolWithTag 0x15f6d0 0049:Call ntdll.RtlFreeHeap(00110000,00000000,0015f6d0) ret=7ecd3586 0049:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecd3586 0049:Ret ntoskrnl.exe.ExFreePool() retval=00000001 ret=00803229 0049:Call ntdll.NtQuerySystemInformation(0000000b,0065f354,00000000,0065f350) ret=0080732b 0049:Ret ntdll.NtQuerySystemInformation() retval=c0000004 ret=0080732b 0049:Call ntoskrnl.exe.ExAllocatePool(00000000,00001400) ret=007fe2fc 0049:Call ntdll.RtlAllocateHeap(00110000,00000000,00001400) ret=7ecd3339 0049:Ret ntdll.RtlAllocateHeap() retval=0015f6d0 ret=7ecd3339 0049:trace:ntoskrnl:ExAllocatePoolWithTag 5120 pool 0 -> 0x15f6d0 0049:Ret ntoskrnl.exe.ExAllocatePool() retval=0015f6d0 ret=007fe2fc 0049:Call ntdll.NtQuerySystemInformation(0000000b,0015f6d0,00001400,0065f350) ret=008034e1 0049:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=008034e1 0049:Call ntoskrnl.exe.ExFreePool(0015f6d0) ret=00803229 0049:trace:ntoskrnl:ExFreePoolWithTag 0x15f6d0 0049:Call ntdll.RtlFreeHeap(00110000,00000000,0015f6d0) ret=7ecd3586 0049:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecd3586 0049:Ret ntoskrnl.exe.ExFreePool() retval=00000001 ret=00803229 0049:Call ntdll.NtQuerySystemInformation(0000000b,0065f358,00000000,0065f354) ret=0080732b 0049:Ret ntdll.NtQuerySystemInformation() retval=c0000004 ret=0080732b 0049:Call ntoskrnl.exe.ExAllocatePool(00000000,00001400) ret=007fe2fc 0049:Call ntdll.RtlAllocateHeap(00110000,00000000,00001400) ret=7ecd3339 0049:Ret ntdll.RtlAllocateHeap() retval=0015f6d0 ret=7ecd3339 0049:trace:ntoskrnl:ExAllocatePoolWithTag 5120 pool 0 -> 0x15f6d0 0049:Ret ntoskrnl.exe.ExAllocatePool() retval=0015f6d0 ret=007fe2fc 0049:Call ntdll.NtQuerySystemInformation(0000000b,0015f6d0,00001400,0065f354) ret=008034e1 0049:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=008034e1 0049:Call ntoskrnl.exe.ExFreePool(0015f6d0) ret=00803229 0049:trace:ntoskrnl:ExFreePoolWithTag 0x15f6d0 0049:Call ntdll.RtlFreeHeap(00110000,00000000,0015f6d0) ret=7ecd3586 0049:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecd3586 0049:Ret ntoskrnl.exe.ExFreePool() retval=00000001 ret=00803229 0049:Call ntdll.NtQuerySystemInformation(0000000b,0065f310,00000000,0065f30c) ret=0080732b 0049:Ret ntdll.NtQuerySystemInformation() retval=c0000004 ret=0080732b 0049:Call ntoskrnl.exe.ExAllocatePool(00000000,00001400) ret=007fe2fc 0049:Call ntdll.RtlAllocateHeap(00110000,00000000,00001400) ret=7ecd3339 0049:Ret ntdll.RtlAllocateHeap() retval=0015f6d0 ret=7ecd3339 0049:trace:ntoskrnl:ExAllocatePoolWithTag 5120 pool 0 -> 0x15f6d0 0049:Ret ntoskrnl.exe.ExAllocatePool() retval=0015f6d0 ret=007fe2fc 0049:Call ntdll.NtQuerySystemInformation(0000000b,0015f6d0,00001400,0065f30c) ret=008034e1 0049:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=008034e1 0049:Call ntoskrnl.exe.ExFreePool(0015f6d0) ret=00803229 0049:trace:ntoskrnl:ExFreePoolWithTag 0x15f6d0 0049:Call ntdll.RtlFreeHeap(00110000,00000000,0015f6d0) ret=7ecd3586 0049:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecd3586 0049:Ret ntoskrnl.exe.ExFreePool() retval=00000001 ret=00803229 --- snip --- The (heavily obfuscated) kernel driver uses its own custom imports resolver. It basically walks the module list using 'NtQuerySystemInformation( SystemModuleInformation, ...)' and processes the export table of 'ntoskrnl.exe' and later 'fltmgr.sys' in order to resolve some needed functions. The resolver is rather simplistic and can't deal with Wine's forwarded exports to 'msvcrt'. Native Windows kernel doesn't do this. --- snip --- ... DbgPrint says: The procedure entry point wcsncmp could not be located in the module ntoskrnl.exe Ret driver init 0x7fdf6e (obj=0x11cb58,str=L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\BEDaisy") retval=c0000183 0049:trace:winedevice:init_driver init done for L"BEDaisy" obj 0x11cb58 0049:trace:winedevice:init_driver - DriverInit = 0x7fdf6e 0049:trace:winedevice:init_driver - DriverStartIo = (nil) 0049:trace:winedevice:init_driver - DriverUnload = (nil) 0049:trace:winedevice:init_driver - MajorFunction[0] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[1] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[2] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[3] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[4] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[5] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[6] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[7] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[8] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[9] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[10] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[11] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[12] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[13] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[14] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[15] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[16] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[17] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[18] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[19] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[20] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[21] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[22] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[23] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[24] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[25] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[26] = 0x7ecd1b10 0049:trace:winedevice:init_driver - MajorFunction[27] = 0x7ecd1b10 0049:Call ntdll.RtlFreeUnicodeString(0011cb74) ret=7ecd1d12 0049:Ret ntdll.RtlFreeUnicodeString() retval=0011cb74 ret=7ecd1d12 0049:Call ntdll.RtlFreeUnicodeString(0011cc0c) ret=7ecd1d26 0049:Ret ntdll.RtlFreeUnicodeString() retval=0011cc0c ret=7ecd1d26 0049:Call ntdll.RtlFreeHeap(00110000,00000000,0011cb48) ret=7ecd1d46 0049:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7ecd1d46 0049:Ret ntoskrnl.exe.IoCreateDriver() retval=c0000183 ret=7effb7fc 0049:err:winedevice:async_create_driver failed to create driver L"BEDaisy": c0000183 --- snip --- NOTE: This is a similar problem domain as bug 37852 ("Sentinel HASP 'hardlock.sys' kernel driver custom imports resolver can't cope with many 'ntoskrnl.exe' functions being fowarded to 'ntdll.dll' (Minitab 16 fails to start)". Although this driver requires a much smaller set of (msvcrt) functions. * native API (ntdll) -> bug 37852 * msvcrt -> this one Source: https://source.winehq.org/git/wine.git/blob/354fa7eb7921c3317e7943c18871feb… --- snip --- 1484 @ cdecl -private wcsncmp(wstr wstr long) msvcrt.wcsncmp --- snip --- The driver requires the following set of functions not be forwarded: * wcsncmp * _wcsnicmp * _strnicmp * memcpy * memset * _stricmp Wine should reimplement the low-level string/copy helpers in 'ntoskrnl' in same way as it is done for 'ntdll' core module (NTDLL_foobar). Source: https://source.winehq.org/git/wine.git/blob/354fa7eb7921c3317e7943c18871feb… --- snip --- 1457 @ cdecl -private wcsncmp(wstr wstr long) NTDLL_wcsncmp --- snip --- https://source.winehq.org/git/wine.git/blob/354fa7eb7921c3317e7943c18871feb… --- snip --- 157 /********************************************************************* 158 * wcsncmp (NTDLL.@) 159 */ 160 INT __cdecl NTDLL_wcsncmp( LPCWSTR str1, LPCWSTR str2, INT n ) 161 { 162 return strncmpW( str1, str2, n ); 163 } --- snip --- With these things fixed, the driver runs further - into next problems. $ sha1sum Tibia_Setup.exe 50951008ccc402cc32407bfc56a88da873e3e9bd Tibia_Setup.exe $ du -sh Tibia_Setup.exe 5.2M Tibia_Setup.exe $ wine --version wine-3.1-193-g354fa7eb79 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 10

[Bug 44811] New: BattlEye 'BEDaisy' kernel service requires _chkstk implementation.
by wine-bugs＠winehq.org March 18, 2021

March 18, 2021

https://bugs.winehq.org/show_bug.cgi?id=44811 Bug ID: 44811 Summary: BattlEye 'BEDaisy' kernel service requires _chkstk implementation. Product: Wine Version: 3.4 Hardware: x86 OS: Linux Status: NEW Severity: normal Priority: P2 Component: ntoskrnl Assignee: wine-bugs(a)winehq.org Reporter: leslie_alistair(a)hotmail.com Distribution: --- When the stack goes over a 4k on x86 or 8k for x64 boundary then this function is used to resolve this issue. https://msdn.microsoft.com/en-us/library/ms648426(v=vs.85).aspx -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 12

[Bug 45843] New: Battleye' s BEDaisy.sys expects memory allocated by ExAllocatePoolWithTag to be executable
by wine-bugs＠winehq.org March 18, 2021

March 18, 2021

https://bugs.winehq.org/show_bug.cgi?id=45843 Bug ID: 45843 Summary: Battleye's BEDaisy.sys expects memory allocated by ExAllocatePoolWithTag to be executable Product: Wine Version: 3.16 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: ntoskrnl Assignee: wine-bugs(a)winehq.org Reporter: dereklesho52(a)Gmail.com Distribution: --- In the NT Kernel, non-paged memory is executable, and BEDaisy.sys crashes on a page fault if this is not the case. My patch is located here: https://github.com/Guy1524/wine/commits/battleye-work-stable -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 10

[Bug 44636] New: Sentinel HASP 'hardlock.sys' kernel driver access to CR4 via %ESI register operand not handled in ntoskrnl emulate_instruction
by wine-bugs＠winehq.org March 18, 2021

March 18, 2021

https://bugs.winehq.org/show_bug.cgi?id=44636 Bug ID: 44636 Summary: Sentinel HASP 'hardlock.sys' kernel driver access to CR4 via %ESI register operand not handled in ntoskrnl emulate_instruction Product: Wine Version: 3.2 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: ntoskrnl Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, continuation of bug 37852 This time it's another variant of bug 30220 now with %ESI being register operand. --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/Minitab/Minitab 16 $ WINEDEBUG=+seh,+relay,+winedevice,+ntoskrnl wine ./Mtb.exe >>log.txt 2>&1 ... 0019:trace:winedevice:load_driver_module L"C:\\windows\\system32\\drivers\\hardlock.sys": relocating from 0x10000 to 0x780000 ... 0019:Call driver init 0x80ac20 (obj=0x11cb28,str=L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\hardlock") ... 0019:Call ntoskrnl.exe.RtlInitUnicodeString(0065fc74,007efa18 L"\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Services\\HaspNt") ret=00786720 0019:Call ntdll.RtlInitUnicodeString(0065fc74,007efa18 L"\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Services\\HaspNt") ret=7bc7e247 0019:Ret ntdll.RtlInitUnicodeString() retval=0065fc74 ret=7bc7e247 0019:Ret ntoskrnl.exe.RtlInitUnicodeString() retval=0065fc74 ret=00786720 0019:Call ntoskrnl.exe.ExAllocatePoolWithTag(00000001,00000084,36346b48) ret=00786748 0019:Call ntdll.RtlAllocateHeap(00110000,00000000,00000084) ret=7ecce269 0019:Ret ntdll.RtlAllocateHeap() retval=0011cd08 ret=7ecce269 0019:trace:ntoskrnl:ExAllocatePoolWithTag 132 pool 1 -> 0x11cd08 0019:Ret ntoskrnl.exe.ExAllocatePoolWithTag() retval=0011cd08 ret=00786748 0019:Call ntoskrnl.exe.ExAllocatePoolWithTag(00000001,00000148,34356b48) ret=007879d7 0019:Call ntdll.RtlAllocateHeap(00110000,00000000,00000148) ret=7ecce269 0019:Ret ntdll.RtlAllocateHeap() retval=0011d2e8 ret=7ecce269 0019:trace:ntoskrnl:ExAllocatePoolWithTag 328 pool 1 -> 0x11d2e8 0019:Ret ntoskrnl.exe.ExAllocatePoolWithTag() retval=0011d2e8 ret=007879d7 0019:Call ntoskrnl.exe.RtlInitUnicodeString(0011d2e8,00000000) ret=00787a0f 0019:Call ntdll.RtlInitUnicodeString(0011d2e8,00000000) ret=7bc7e247 0019:Ret ntdll.RtlInitUnicodeString() retval=0011d2e8 ret=7bc7e247 0019:Ret ntoskrnl.exe.RtlInitUnicodeString() retval=0011d2e8 ret=00787a0f 0019:trace:seh:raise_exception code=c0000096 flags=0 addr=0x787a18 ip=00787a18 tid=0019 0019:trace:seh:raise_exception eax=00110078 ebx=00000000 ecx=0011d2f0 edx=00000000 esi=0011d2e8 edi=0011cd08 0019:trace:seh:raise_exception ebp=0065fbb4 esp=0065fb64 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010202 0019:trace:seh:call_vectored_handlers calling handler at 0x7ecc9f55 code=c0000096 flags=0 0019:trace:seh:call_vectored_handlers handler at 0x7ecc9f55 returned 0 0019:trace:seh:call_stack_handlers calling handler at 0x7bcb01c8 code=c0000096 flags=0 0019:Call KERNEL32.UnhandledExceptionFilter(0065f664) ret=7bcb0203 wine: Unhandled privileged instruction at address 0x787a18 (thread 0019), starting debugger... --- snip --- Disassembly: --- snip --- .... 00787A16 FFF6 PUSH ESI 00787A18 0F20E6 MOV ESI,CR4 ; unhandled opcode 00787A1B 66:81E6 F7FF AND SI,0FFF7 00787A20 0F22E6 MOV CR4,ESI ; unhandled opcode 00787A23 5E POP ESI 00787A24 66:05 C800 ADD AX,0C8 00787A28 FFF7 PUSH EDI 00787A2A 66:8946 02 MOV WORD PTR DS:[ESI+2],AX 00787A2E E9 F4F40600 JMP hardlock.007F6F27 ... --- snip --- Source: https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/ntoskrnl.exe/instr.c… --- snip --- 329 switch(*instr) 330 { 331 case 0x0f: /* extended instruction */ 332 switch(instr[1]) 333 { 334 case 0x22: /* mov eax, crX */ 335 switch (instr[2]) 336 { 337 case 0xc0: 338 TRACE("mov eax,cr0 at 0x%08x, EAX=0x%08x\n", context->Eip,context->Eax ); 339 context->Eip += prefixlen+3; 340 return ExceptionContinueExecution; 341 case 0xe0: 342 TRACE("mov eax,cr4 at 0x%08x, EAX=0x%08x\n", context->Eip,context->Eax ); 343 context->Eip += prefixlen+3; 344 return ExceptionContinueExecution; 345 default: 346 break; /*fallthrough to bad instruction handling */ 347 } 348 ERR("Unsupported EAX -> CR register, eip+2 is %02x\n", instr[2]); 349 break; /*fallthrough to bad instruction handling */ 350 case 0x20: /* mov crX, eax */ 351 switch (instr[2]) 352 { 353 case 0xe0: /* mov cr4, eax */ 354 /* CR4 register . See linux/arch/i386/mm/init.c, X86_CR4_ defs 355 * bit 0: VME Virtual Mode Exception ? 356 * bit 1: PVI Protected mode Virtual Interrupt 357 * bit 2: TSD Timestamp disable 358 * bit 3: DE Debugging extensions 359 * bit 4: PSE Page size extensions 360 * bit 5: PAE Physical address extension 361 * bit 6: MCE Machine check enable 362 * bit 7: PGE Enable global pages 363 * bit 8: PCE Enable performance counters at IPL3 364 */ 365 TRACE("mov cr4,eax at 0x%08x\n",context->Eip); 366 context->Eax = 0; 367 context->Eip += prefixlen+3; 368 return ExceptionContinueExecution; --- snip --- %EAX as register operand is handled but %ESI not. 0x0f 0x20-0x2f 20: MOV Rd,Cd 21: MOV Rd,Dd 22: MOV Cd,Rd 23: MOV Dd,Rd $ sha1sum MTBen1610su.exe f457d13475a783a0d2fff5566c0279640ba26bc6 MTBen1610su.exe $ du -sh MTBen1610su.exe 93M MTBen1610su.exe $ wine --version wine-3.2-293-g0a72708126 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 4

[Bug 44749] New: Sentinel HASP 'hardlock.sys' kernel driver expects ntdll.RtlCheckRegistryKey to return STATUS_SUCCESS on empty path
by wine-bugs＠winehq.org March 18, 2021

March 18, 2021

https://bugs.winehq.org/show_bug.cgi?id=44749 Bug ID: 44749 Summary: Sentinel HASP 'hardlock.sys' kernel driver expects ntdll.RtlCheckRegistryKey to return STATUS_SUCCESS on empty path Product: Wine Version: 3.3 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: ntdll Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, to separate two different issues from bug 44641 Technically it was https://source.winehq.org/git/wine.git/commitdiff/f07e8ca8f01106b6d41a933f0… ("ntdll: Fix RtlCheckRegistryKey when called with empty path.") which returns 'STATUS_SUCCESS' now, causing the driver to execute a different code path, not calling 'ntoskrnl.exe.RtlCreateRegistryKey' at this point. Bug 44641 is about missing 'ntdll.RtlCreateRegistryKey' API -> fixed by https://source.winehq.org/git/wine.git/commitdiff/535419a2bf8da3fd21cfdede4… Created this ticket to avoid rechristening bug 44641 --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/Minitab/Minitab 16 $ WINEDEBUG=+seh,+relay,+winedevice,+ntoskrnl wine ./Mtb.exe >>log.txt 2>&1 ... 0019:Call ntoskrnl.exe.RtlCheckRegistryKey(00000001,0065fb20) ret=007a8edd 0019:Call ntdll.RtlCheckRegistryKey(00000001,0065fb20) ret=7bc7e2bb 0019:Ret ntdll.RtlCheckRegistryKey() retval=c0000034 ret=7bc7e2bb 0019:Ret ntoskrnl.exe.RtlCheckRegistryKey() retval=c0000034 ret=007a8edd 0019:Call KERNEL32.RaiseException(80000100,00000001,00000002,0065fad4) ret=7ecd21a7 0019:trace:seh:raise_exception code=80000100 flags=1 addr=0x7b44667f ip=7b44667f tid=0019 0019:trace:seh:raise_exception info[0]=7ecd21c0 0019:trace:seh:raise_exception info[1]=7ecd6098 wine: Call from 0x7b44667f to unimplemented function ntoskrnl.exe.RtlCreateRegistryKey, aborting 0019:trace:seh:call_vectored_handlers calling handler at 0x7ecc9e95 code=80000100 flags=1 0019:trace:seh:call_vectored_handlers handler at 0x7ecc9e95 returned 0 0019:trace:seh:call_stack_handlers calling handler at 0x7bcb023c code=80000100 flags=1 --- snip --- $ sha1sum MTBen1610su.exe f457d13475a783a0d2fff5566c0279640ba26bc6 MTBen1610su.exe $ du -sh MTBen1610su.exe 93M MTBen1610su.exe $ wine --version wine-3.2-346-gb1aee9c391 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 5

[Bug 44641] New: Sentinel HASP 'hardlock.sys' kernel driver crashes on unimplemented function ntoskrnl.exe.RtlCreateRegistryKey
by wine-bugs＠winehq.org March 18, 2021

March 18, 2021

https://bugs.winehq.org/show_bug.cgi?id=44641 Bug ID: 44641 Summary: Sentinel HASP 'hardlock.sys' kernel driver crashes on unimplemented function ntoskrnl.exe.RtlCreateRegistryKey Product: Wine Version: 3.2 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: ntdll Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, continuation of bug 44636 --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/Minitab/Minitab 16 $ WINEDEBUG=+seh,+relay,+winedevice,+ntoskrnl wine ./Mtb.exe >>log.txt 2>&1 ... 0019:Call ntoskrnl.exe.RtlCheckRegistryKey(00000001,0065fb20) ret=007a8edd 0019:Call ntdll.RtlCheckRegistryKey(00000001,0065fb20) ret=7bc7e2bb 0019:Ret ntdll.RtlCheckRegistryKey() retval=c0000034 ret=7bc7e2bb 0019:Ret ntoskrnl.exe.RtlCheckRegistryKey() retval=c0000034 ret=007a8edd 0019:Call KERNEL32.RaiseException(80000100,00000001,00000002,0065fad4) ret=7ecd21a7 0019:trace:seh:raise_exception code=80000100 flags=1 addr=0x7b44667f ip=7b44667f tid=0019 0019:trace:seh:raise_exception info[0]=7ecd21c0 0019:trace:seh:raise_exception info[1]=7ecd6098 wine: Call from 0x7b44667f to unimplemented function ntoskrnl.exe.RtlCreateRegistryKey, aborting 0019:trace:seh:call_vectored_handlers calling handler at 0x7ecc9e95 code=80000100 flags=1 0019:trace:seh:call_vectored_handlers handler at 0x7ecc9e95 returned 0 0019:trace:seh:call_stack_handlers calling handler at 0x7bcb023c code=80000100 flags=1 --- snip --- Source: https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/ntdll/ntdll.spec#l511 --- snip --- 511 @ stub RtlCreateRegistryKey --- snip --- MSDN: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/wdm/n… $ sha1sum MTBen1610su.exe f457d13475a783a0d2fff5566c0279640ba26bc6 MTBen1610su.exe $ du -sh MTBen1610su.exe 93M MTBen1610su.exe $ wine --version wine-3.2-346-gb1aee9c391 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 9

[Bug 20291] New: File Maker 10 Advanced installs fine but does not start in Debian 5 wine version 1.01
by wine-bugs＠winehq.org March 18, 2021

March 18, 2021

http://bugs.winehq.org/show_bug.cgi?id=20291 Summary: File Maker 10 Advanced installs fine but does not start in Debian 5 wine version 1.01 Product: WineHQ Bugzilla Version: unspecified Platform: PC OS/Version: Linux Status: UNCONFIRMED Severity: critical Priority: P2 Component: bugzilla-unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: ialsahili(a)gmail.com Here is the message that appears when I try to run the program in terminal: -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 4

[Bug 20289] New: File Maker 10 Advanced installs fine but does not start in Debian 5 wine version 1.01
by wine-bugs＠winehq.org March 18, 2021

March 18, 2021

http://bugs.winehq.org/show_bug.cgi?id=20289 Summary: File Maker 10 Advanced installs fine but does not start in Debian 5 wine version 1.01 Product: WineHQ Bugzilla Version: unspecified Platform: PC OS/Version: Linux Status: UNCONFIRMED Severity: critical Priority: P2 Component: bugzilla-unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: ialsahili(a)gmail.com Here is the message that appears when I try to run the program in terminal: fixme:heap:HeapSetInformation (nil) 1 (nil) 0 fixme:advapi:RegisterEventSourceW ((null),L"Bonjour Service"): stub fixme:winsock:WS_setsockopt Unknown IPPROTO_IP optname 0x00000013 fixme:winsock:WSAIoctl SIO_GET_EXTENSION_FUNCTION_POINTER {f689d7c8-6f1f-436b-8a53-e54fe351c322}: stub fixme:winsock:WS_setsockopt Unknown level: 0x00000029 fixme:winsock:WS_setsockopt Unknown level: 0x00000029 fixme:winsock:WS_setsockopt Unknown level: 0x00000029 fixme:winsock:WS_setsockopt Unknown level: 0x00000029 fixme:winsock:WSAIoctl SIO_GET_EXTENSION_FUNCTION_POINTER {f689d7c8-6f1f-436b-8a53-e54fe351c322}: stub fixme:winsock:WSAIoctl -> SIO_ADDRESS_LIST_CHANGE request: stub err:module:attach_process_dlls "odbc32.dll" failed to initialize, aborting err:module:LdrInitializeThunk Main exe initialization for L"C:\\Program Files\\FileMaker\\FileMaker Pro 10 Advanced\\FileMaker Pro Advanced.exe" failed, status c0000005 -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 7

[Bug 44718] New: Screenhero 0.14.x (.NET 4.x app) needs 'sas.dll' ( WinLogon Software SAS Library)
by wine-bugs＠winehq.org March 18, 2021

March 18, 2021

https://bugs.winehq.org/show_bug.cgi?id=44718 Bug ID: 44718 Summary: Screenhero 0.14.x (.NET 4.x app) needs 'sas.dll' (WinLogon Software SAS Library) Product: Wine Version: 3.3 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, extracted from https://bugs.winehq.org/show_bug.cgi?id=39201#c7 Louis Lenders: --- quote --- The program itsself Screenhero.exe crashes like below, with the patch (stub sas.dll) it starts fine 0009:err:module:import_dll Library SAS.dll (which is needed by L"C:\\Program Files\\Screenhero, Inc\\Screenhero\\AppSharingClasses.dll") not found 0009:fixme:nls:LCIDToLocaleName unsupported flags 8000000 0009:fixme:advapi:RegisterEventSourceW ((null),L".NET Runtime"): stub 0009:fixme:advapi:ReportEventW (0xcafe4242,0x0001,0x0000,0x00000402,(nil),0x0001,0x00000000,0x32cf38,(nil)): stub 0009:err:eventlog:ReportEventW L"Application: Screenhero.exe\nFramework Version: v4.0.30319\nDescription: The process was terminated due to an unhandled exception.\nException Info: System.IO.FileNotFoundException\nStack:\n at AppSharing.App..ctor()\n at AppSharing.App.Main()\n" --- quote --- The installer requires (install blockers): * .NET Framework 4.0 * Windows 7 setting Depends on: * bug 44704 Tidbits: https://msdn.microsoft.com/en-us/library/windows/desktop/dd979761(v=vs.85).… ("SendSAS function") https://autohotkey.com/boards/viewtopic.php?t=27119 ("SendSAS: Send Ctrl+Alt+Del") $ sha1sum Screenhero014-Latest-setup.exe ae1f5edb400bf7dd93a6730d272d8c1655302ae9 Screenhero014-Latest-setup.exe $ du -sh Screenhero014-Latest-setup.exe 29M Screenhero014-Latest-setup.exe $ wine --version wine-3.3-128-gdfde119538 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 4

[Bug 38018] New: Windows Live Essentials 2012 web installer crashes on unimplemented function ktmw32.dll.RollbackTransaction
by wine-bugs＠winehq.org March 18, 2021

March 18, 2021

https://bugs.winehq.org/show_bug.cgi?id=38018 Bug ID: 38018 Summary: Windows Live Essentials 2012 web installer crashes on unimplemented function ktmw32.dll.RollbackTransaction Product: Wine Version: 1.7.35 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, continuation of bug 32229 --- snip --- $ wine ./wlsetup-web.exe ... fixme:ktmw32:CreateTransaction ((nil) (nil) 0x0 0x0 0x0, 300000, (null)): stub fixme:file:CreateHardLinkTransactedW (L"C:\\users\\Public\\Application Data\\Microsoft\\WLSetup\\CabLogs\\Logs.CAB" L"C:\\users\\focht\\Temp\\02052230-00000008-z9tn964ati\\Logs.CAB" (nil) 0x1): stub wine: Call from 0x7b83b527 to unimplemented function ktmw32.dll.RollbackTransaction, aborting wine: Unimplemented function ktmw32.dll.RollbackTransaction called at address 0x7b83b527 (thread 0009), starting debugger... --- snip --- $ sha1sum wlsetup-web.exe 6d48f1a6734cabd435dc6ec6ba0a94ebfcf15b9f wlsetup-web.exe $ du -sh wlsetup-web.exe 1.2M wlsetup-web.exe $ wine --version wine-1.7.35-89-gbad99c9 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 6