June 2019 - Wine-Bugs - list.winehq.org

[Bug 38836] New: PunkBuster 'PnkBstrB' service exits with failure ('StartService' must wait for driver service entry point execution before return)
by wine-bugs＠winehq.org July 24, 2021

July 24, 2021

https://bugs.winehq.org/show_bug.cgi?id=38836 Bug ID: 38836 Summary: PunkBuster 'PnkBstrB' service exits with failure ('StartService' must wait for driver service entry point execution before return) Product: Wine Version: 1.7.46 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: programs Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, found during investigation of bug 38820 (albeit unrelated). The PunkBuster service test tool 'pbsvc.exe' writes a failure during test of the services into log files. --- snip --- $ ls -1sh .wine/drive_c/windows/system32/LogFiles/PunkBuster/ total 12K 4.0K pbsvc.log 4.0K PnkBstrA.log 4.0K PnkBstrB.log --- snip --- 'pbsvc.log': --- snip --- Starting PunkBuster Service Installer (v0.994) (06/29/15 20:45:01) Windows XP (build 2600, Service Pack 3) 32-bit Checking user is Administrator OK Checking Administrator privileges OK Opening Service Control Manager OK Searching for PnkBstrA None Found - OK Extracting PnkBstrA service OK Verifying service authenticity OK Installing PunkBuster service OK Installed at "C:\windows\system32\PnkBstrA.exe" serviceInstallFile does exist Checking PunkBuster service status STOPPED Starting PunkBuster service OK Adding firewall rule for PnkBstrA OK Adding firewall rule for PnkBstrB OK Installation Finished. Please click "Next" to test the PunkBuster services.Starting PunkBuster Service Tests (v0.994) (06/29/15 20:45:09) Checking OS Windows XP (build 2600, Service Pack 3) 32-bit Checking PnkBstrA service status RUNNING Checking PnkBstrA Version OK (1041) Extracting "PnkBstrB.exe" to: "C:\users\focht\Application Data\PnkBstrB.exe" OK Checking firewall settings OFF Checking if PnkBstrB is running NOT RUNNING Getting port for PnkBstrA OK (44301) Opening socket for packet send OK Sending version packet to PnkBstrA SENT Receiving version from PnkBstrA OK Received 6 bytes from 127.0.0.1:44301 Response = 7064 (ms) Version = v1041 Getting PnkBstrB install instance NOT FOUND Sending start packet to PnkBstrA SENT Waiting for packet from PnkBstrA OK Received 3 bytes from 127.0.0.1:44301 Response = 11087 (ms) PnkBstrB started. Load SUCCESSFUL. Watching for PnkBstrB instance change (0) CHANGED (1) Getting port for PnkBstrB OK (45301) Sending version packet to PnkBstrB SENT Receiving version from PnkBstrB OK Received 5 bytes from 127.0.0.1:45301 Response = 1 (ms) Version = 2333 Checking PnkBstrK driver status NOT FOUND Extracting new PnkBstrK to: "C:\users\focht\Application Data\PnkBstrK.sys" OK Sending load packet to PnkBstrB SENT Checking PnkBstrK driver status NOT FOUND Manually stopping PnkBstrB FAILED - no handle Removing test PnkBstrB file OK PnkBstrA.log: [06.29.2015 20:45:06] PnkBstrA v1041 Service Started Successfully. This service is a component of the PunkBuster Anti-Cheat system. Visit http://www.evenbalance.com for more information. [06.29.2015 20:45:22] Attempting unload of pnkbstrb. PnkBstrB.log: [06.29.2015 20:45:19] PnkBstrB v2.333 (BF4) Service Started Successfully. This service is a component of the PunkBuster Anti-Cheat system. Visit http://www.evenbalance.com for more information. [06.29.2015 20:45:20] Attempting Component Load [PnkBstrK][drivers\][PnkBstrK.sys] [06.29.2015 20:45:21] Loaded and Started PnkBstrK [06.29.2015 20:45:21] WARNING: CRITICAL ERROR: Failed to Register Service (ffab) [06.29.2015 20:45:22] PnkBstrB v2.333 (BF4) Service Attempting Unload (ffab). This service is a component of the PunkBuster Anti-Cheat system. Visit http://www.evenbalance.com for more information. --- snip --- Relevant part of trace log. The main area of interest is how 'PnkBstrB' and 'PnkBstrK' services interact. 'PnkBstrA' service -> 'PnkBstrB' service -> 'PnkBstrK' kernel driver service. --- snip --- ... 0009:trace:process:__wine_kernel_init starting process name=L"Z:\\home\\focht\\Downloads\\pbsvc.exe" argv[0]=L"Z:\\home\\focht\\Downloads\\pbsvc.exe" ... 0026:trace:service:service_handle_start L"PnkBstrA" argsize 10 ... 0027:Starting thread proc 0x7ea8ded4 (arg=0x13bfc0) 0027:trace:service:service_thread 0x13bfc0 0027:Call advapi32.RegisterServiceCtrlHandlerA(0040d830 "PnkBstrA",00401782) ret=00401993 ... 0027:Call advapi32.CreateServiceA(0013da80,0040d2f4 "PnkBstrB",0040d2f4 "PnkBstrB",000f01ff,00000010,00000002,00000001,00410c00 "C:\\windows\\system32\\PnkBstrB.exe",00000000,00000000,00000000,00000000,00000000) ret=004014cb ... 0027:Ret advapi32.CreateServiceA() retval=0013ef60 ret=004014cb ... 0016:Call KERNEL32.CreateProcessW(00000000,0011a460 L"C:\\windows\\system32\\PnkBstrB.exe",00000000,00000000,00000000,00000400,00540000,00000000,0084e4a4,0084e4e8) ret=7ed5756f ... 0016:trace:process:create_process_impl starting L"C:\\windows\\system32\\PnkBstrB.exe" as Win32 binary (0x400000-0x446000, arch 014c) ... 0034:Call KERNEL32.__wine_kernel_init() ret=7bc69749 ... 0016:trace:process:create_process_impl started process pid 0033 tid 0034 0016:Ret KERNEL32.CreateProcessW() retval=00000001 ret=7ed5756f ... 0034:Call advapi32.StartServiceCtrlDispatcherA(0033fd44) ret=00417033 ... 0034:trace:service:service_run_main_thread Starting 1 services running as process 51 ... 0038:trace:service:service_control_dispatcher got request 1 for service L"PnkBstrB" ... 0039:trace:service:service_thread 0x13bf08 ... 0039:Call advapi32.SetServiceStatus(0013d208,0042a4e0) ret=00441731 0039:trace:service:SetServiceStatus 0x13d208 30 4 5 0 0 0 0 ... 0016:trace:service:service_wait_for_startup Service started successfully ... 0027:Ret advapi32.StartServiceA() retval=00000001 ret=00401524 ... 0039:trace:service:SERV_OpenServiceW returning (nil) ... 0039:Call KERNEL32.CreateFileA(004275b9 "C:\\users\\focht\\Application Data\\PnkBstrK.sys",c0000000,00000003,0075d850,00000003,00000080,00000000) ret=00420a9b ... 0039:Call wintrust.WinVerifyTrust(00000000,0075d174,0075d138) ret=00417317 ... 0039:Ret wintrust.WinVerifyTrust() retval=00000000 ret=00417317 ... 0039:Call crypt32.CryptQueryObject(00000001,0042d3f0,00000400,00000002,00000000,0075d290,0075d28c,0075d294,0075d2d0,0075d2c8,00000000) ret=0041791e 0039:Call KERNEL32.CreateFileW(0042d3f0 L"C:\\users\\focht\\Application Data\\PnkBstrK.sys",80000000,00000001,00000000,00000003,00000080,00000000) ret=7e5db1ec 0039:Ret KERNEL32.CreateFileW() retval=00000060 ret=7e5db1ec ... 0039:Call KERNEL32.CopyFileA(004275b9 "C:\\users\\focht\\Application Data\\PnkBstrK.sys",00426600 "C:\\windows\\system32\\drivers\\PnkBstrK.sys",00000000) ret=00408184 0039:Ret KERNEL32.CopyFileA() retval=00000001 ret=00408184 ... 0039:Call advapi32.CreateServiceA(0013d9b8,0075d980 "PnkBstrK",0075d980 "PnkBstrK",000f01ff,00000001,00000003,00000001,00426600 "C:\\windows\\system32\\drivers\\PnkBstrK.sys",00000000,00000000,00000000,00000000,00000000) ret=0040829e ... 0016:trace:service:create_serviceW (L"PnkBstrK", L"PnkBstrK", 0xf01ff, L"C:\\windows\\system32\\drivers\\PnkBstrK.sys") ... 0039:Call advapi32.OpenServiceA(0013d9b8,0075d980 "PnkBstrK",000f01ff) ret=004082ca ... 0037:trace:service:svcctl_StartServiceW (0x11aaa8, 0, (nil)) ... 0037:Call KERNEL32.CreateProcessW(00000000,0011ac88 L"C:\\windows\\system32\\winedevice.exe PnkBstrK",00000000,00000000,00000000,00000400,00540000,00000000,00c4e4a4,00c4e4e8) ret=7ed5756f ... 0037:trace:process:create_process_impl starting L"C:\\windows\\system32\\winedevice.exe" as Win32 binary (0x10000000-0x10003000, arch 014c, fakedll) ... 003d:Call KERNEL32.__wine_kernel_init() ret=7bc69749 ... 0037:trace:process:create_process_impl started process pid 003c tid 003d 0037:Ret KERNEL32.CreateProcessW() retval=00000001 ret=7ed5756f ... 003d:Call advapi32.StartServiceCtrlDispatcherW(0033fdd8) ret=7effced6 ... 003d:trace:service:service_run_main_thread Starting 1 services running as process 60 ... 0040:trace:service:service_control_dispatcher got request 1 for service L"PnkBstrK" ... 0041:Call advapi32.SetServiceStatus(0011aab0,0053e958) ret=7effcd1d 0041:trace:service:SetServiceStatus 0x11aab0 30 2 0 0 0 0 2710 ... 0037:trace:service:service_wait_for_startup Service state changed to SERVICE_START_PENDING ... 0039:Ret advapi32.StartServiceA() retval=00000001 ret=00408304 ... 0039:Call advapi32.CloseServiceHandle(001421f0) ret=0040834e ... 0039:Call advapi32.CloseServiceHandle(0013d9b8) ret=00408353 ... 0039:Ret advapi32.CloseServiceHandle() retval=00000001 ret=00408353 0039:Call KERNEL32.CreateFileA(004223f8 "\\\\.\\pnkbstrk_link",c0000000,00000001,00000000,00000003,00000000,00000000) ret=0040aa02 0039:Ret KERNEL32.CreateFileA() retval=ffffffff ret=0040aa02 ... 0041:trace:loaddll:load_native_dll Loaded L"C:\\windows\\system32\\drivers\\PnkBstrK.sys" at 0x10000000: native ... 0041:Call driver init 0x100033e0 (obj=0x7efff4a0,str=L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\PnkBstrK") ... 0041:Call ntoskrnl.exe.IoCreateDevice(7efff4a0,00000000,0053e61c,00009c40,00000000,00000000,0053e618) ret=1000344e 0041:trace:ntoskrnl:IoCreateDevice (0x7efff4a0, 0, L"\\Device\\pnkbstrk", 40000, 0, 0, 0x53e618) ... 0041:Call ntoskrnl.exe.IoCreateSymbolicLink(1000a590,0053e61c) ret=10003476 0041:trace:ntoskrnl:IoCreateSymbolicLink L"\\DosDevices\\pnkbstrk_link" -> L"\\Device\\pnkbstrk" 0041:Call ntdll.NtCreateSymbolicLinkObject(0053e5a4,000f0001,0053e58c,0053e61c) ret=7eccf0a0 0041:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7eccf0a0 0041:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=10003476 0041:Ret driver init 0x100033e0 (obj=0x7efff4a0,str=L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\PnkBstrK") retval=00000000 0041:Call advapi32.SetServiceStatus(0011aab0,0053e958) ret=7effcd50 0041:trace:service:SetServiceStatus 0x11aab0 30 4 5 0 0 0 2710 ... --- snip --- 'PnkBstrK' is extracted by the service maintenance app into a temp directory. 'PnkBstrB' service verifies the digital signature of the driver and requests creation of the actual kernel service upon success. There is a small time frame between service start call returning (state 'SERVICE_START_PENDING') and the driver service entry point being fully executed (state 'SERVICE_RUNNING') which causes the harm here. Immediately after the return from call to 'StartServiceA', 'PnkBstrB' service tries to open '\\DosDevices\\pnkbstrk_link' which fails because the device symlink is created in the driver entry point which is executing asynchronously. MSDN: https://msdn.microsoft.com/en-us/library/windows/desktop/ms686321%28v=vs.85… The 'remarks' section gives the hint: --- quote --- When a driver service is started, the StartService function does not return until the device driver has finished initializing. --- quote --- Wine must follow this requirement. $ sha1sum pbsvc.exe 06f372448af09dc1156d6710945936e028f2152a pbsvc.exe $ du -sh pbsvc.exe 1.7M pbsvc.exe $ wine --version wine-1.7.46-43-g9353a36 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 15

[Bug 45174] New: Icinga 2 'check_ping' tool with IPv6 address/ host crashes on unimplemented function ntdll.dll.RtlIpv6StringToAddressExW
by wine-bugs＠winehq.org July 24, 2021

July 24, 2021

https://bugs.winehq.org/show_bug.cgi?id=45174 Bug ID: 45174 Summary: Icinga 2 'check_ping' tool with IPv6 address/host crashes on unimplemented function ntdll.dll.RtlIpv6StringToAddressExW Product: Wine Version: 3.7 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: ntdll Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, to track: https://github.com/wine-staging/wine-staging/tree/master/patches/ntdll-RtlI… https://github.com/Icinga/icinga2 --- quote --- Icinga 2 is an open source monitoring system which checks the availability of your network resources, notifies users of outages, and generates performance data for reporting. --- quote --- Download: http://packages.icinga.com/windows/Icinga2-v2.8.4-x86.msi Source: https://github.com/Icinga/icinga2/blob/5bd69b4a490b77ac5c3bf748606d4fffb9b3… --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files (x86)/ICINGA2/sbin $ wine ./check_ping.exe -6 --host www.google.com 0074:fixme:msvcrt:_configure_wide_argv (1) stub 0074:fixme:msvcrt:_initialize_wide_environment stub 0074:fixme:msvcp:_Locinfo__Locinfo_ctor_cat_cstr (0x32fdd4 1 C) semi-stub wine: Call from 0x7bc652a4 to unimplemented function ntdll.dll.RtlIpv6StringToAddressExW, aborting wine: Unimplemented function ntdll.dll.RtlIpv6StringToAddressExW called at address 0xffff0023:0x7bc652a4 (thread 0074), starting debugger... --- snip --- The tools can also be used to validate a real implementation of 'ntdll:RtlIpv{4,6}StringToAddressW()'. $ sha1sum Icinga2-v2.8.4-x86.msi 5bd6dfdd5e437ef12e20b580a2745564055a0ea3 Icinga2-v2.8.4-x86.msi $ du -sh Icinga2-v2.8.4-x86.msi 28M Icinga2-v2.8.4-x86.msi $ wine --version wine-3.7-156-g6d6b4bffb3 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 5

[Bug 30076] New: .NET Framework 4.x with WinVer setting "Windows 7" spams terminal with "LocaleNameToLCID/LCIDToLocaleName unsupported flags 8000000" (LOCALE_ALLOW_NEUTRAL_NAMES)
by wine-bugs＠winehq.org July 24, 2021

July 24, 2021

http://bugs.winehq.org/show_bug.cgi?id=30076 Bug #: 30076 Summary: .NET Framework 4.x with WinVer setting "Windows 7" spams terminal with "LocaleNameToLCID/LCIDToLocaleName unsupported flags 8000000" (LOCALE_ALLOW_NEUTRAL_NAMES) Product: Wine Version: 1.4-rc6 Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: kernel32 AssignedTo: wine-bugs(a)winehq.org ReportedBy: focht(a)gmx.net Classification: Unclassified Hello, a minor one ... When using .NET 4.x Framework in "Windows 7" mode (at least installer requires this) the terminal is spammed with: --- snip --- $ wine ./hello.exe ... fixme:nls:LocaleNameToLCID unsupported flags 8000000 fixme:nls:LocaleNameToLCID unsupported flags 8000000 fixme:nls:LocaleNameToLCID unsupported flags 8000000 fixme:nls:LocaleNameToLCID unsupported flags 8000000 fixme:nls:LocaleNameToLCID unsupported flags 8000000 fixme:nls:LocaleNameToLCID unsupported flags 8000000 fixme:nls:LocaleNameToLCID unsupported flags 8000000 fixme:nls:LocaleNameToLCID unsupported flags 8000000 fixme:nls:LCIDToLocaleName unsupported flags 8000000 fixme:nls:LCIDToLocaleName unsupported flags 8000000 fixme:nls:LCIDToLocaleName unsupported flags 8000000 Hello C# World :-) --- snip --- This due to LOCALE_ALLOW_NEUTRAL_NAMES (0x8000000) being passed to allow returning neutral names/lcids for name. MSDN: http://msdn.microsoft.com/en-us/library/windows/desktop/dd318711%28v=vs.85%… --- quote --- Windows 7 and later: Can be set to LOCALE_ALLOW_NEUTRAL_NAMES to allow the return of a neutral LCID. --- quote --- One could set to default "Windows XP" after installation but I'm not sure about the side-effects. Regards -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 11

[Bug 47120] New: Expansive Civilian Warfare 1.0.0.0 fails to start, reports 'there was an error loading bhs.dll' (Wine's 'd3d8.dll' is preferred over native d3d8->d3d9 thunk dll, causing failure)
by wine-bugs＠winehq.org July 24, 2021

July 24, 2021

https://bugs.winehq.org/show_bug.cgi?id=47120 Bug ID: 47120 Summary: Expansive Civilian Warfare 1.0.0.0 fails to start, reports 'there was an error loading bhs.dll' (Wine's 'd3d8.dll' is preferred over native d3d8->d3d9 thunk dll, causing failure) Product: Wine Version: 4.7 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, reported here: https://forum.winehq.org/viewtopic.php?f=2&t=32324 https://w3dhub.com/forum/topic/416741-horrible-luck-cannot-get-ecw-or-w3dhl… http://www.renegadeforums.com/index.php?t=msg&th=25165 It seems various people spend a good amount of time trying to investigate without luck. Download: http://download.expansivecivilianwarfare.com/Alpha/ExpansiveCivilianWarfare… Backup: https://web.archive.org/web/20190503192509/http://download.expansivecivilia… --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/Expansive Civilian Warfare $ WINEDEBUG=+seh,+loaddll,+relay,+d3dx,+d3d8 wine ./Game300.exe >>log.txt 2>&1 ... 003e:Call KERNEL32.LoadLibraryA(007f8838 "D3D8.DLL") ret=00546c4e ... 003e:trace:loaddll:load_builtin_dll Loaded L"C:\\windows\\system32\\opengl32.dll" at 0x7c180000: builtin 003e:trace:loaddll:load_builtin_dll Loaded L"C:\\windows\\system32\\wined3d.dll" at 0x7c2c0000: builtin 003e:trace:loaddll:load_builtin_dll Loaded L"C:\\windows\\system32\\d3d8.dll" at 0x7c820000: builtin 003e:Call PE DLL (proc=0x7c83e4e0,module=0x7c820000 L"d3d8.dll",reason=WINE_PREATTACH,res=(nil)) 003e:Ret PE DLL (proc=0x7c83e4e0,module=0x7c820000 L"d3d8.dll",reason=WINE_PREATTACH,res=(nil)) retval=1 003e:Call PE DLL (proc=0x7c1fa0b0,module=0x7c180000 L"opengl32.dll",reason=PROCESS_ATTACH,res=(nil)) 003e:Ret PE DLL (proc=0x7c1fa0b0,module=0x7c180000 L"opengl32.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 003e:Call PE DLL (proc=0x7c38dda0,module=0x7c2c0000 L"wined3d.dll",reason=PROCESS_ATTACH,res=(nil)) ... 003e:Ret PE DLL (proc=0x7c83e4e0,module=0x7c820000 L"d3d8.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 003e:Ret KERNEL32.LoadLibraryA() retval=7c820000 ret=00546c4e 003e:Call KERNEL32.GetProcAddress(7c820000,007f8828 "Direct3DCreate8") ret=00546c6b 003e:Ret KERNEL32.GetProcAddress() retval=7c82cdbc ret=00546c6b 003e:Call d3d8.Direct3DCreate8(00000078) ret=00546c78 003e:trace:d3d8:Direct3DCreate8 sdk_version 0x78. ... 003e:trace:d3d8:Direct3DCreate8 Created d3d8 object 0x16d838. 003e:Ret d3d8.Direct3DCreate8() retval=0016d838 ret=00546c78 003e:trace:d3d8:d3d8_GetAdapterCount iface 0x16d838. ... 003e:trace:d3d8:device_parent_wined3d_device_created device_parent 0x1cf57c, device 0x1e00030 003e:Ret wined3d.wined3d_device_create() retval=00000000 ret=7c836eb3 ... 003e:trace:d3d8:device_parent_create_swapchain_texture device_parent 0x1cf57c, container_parent 0x16d5b0, desc 0x33dae4, texture flags 0, texture 0x1bc4c00. ... 003e:trace:d3d8:d3d8_device_QueryInterface iface 0x1cf578, riid {b4211cfa-51b9-4a9f-ab78-db99b2bb678e}, out 0x33d87c. 003e:warn:d3d8:d3d8_device_QueryInterface {b4211cfa-51b9-4a9f-ab78-db99b2bb678e} not implemented, returning E_NOINTERFACE. 003e:trace:d3d8:device_parent_texture_sub_resource_created Created surface 0x16d5d0. 003e:Ret wined3d.wined3d_texture_create() retval=00000000 ret=7c832fd1 ... 003e:Call KERNEL32.LoadLibraryA(1120ed98 "bhs.dll") ret=110022a4 ... 003e:trace:loaddll:load_builtin_dll Loaded L"C:\\windows\\system32\\d3dcompiler_47.dll" at 0x66c20000: builtin ... 003e:trace:loaddll:load_builtin_dll Loaded L"C:\\windows\\system32\\d3dxof.dll" at 0x67040000: builtin ... 003e:trace:loaddll:load_builtin_dll Loaded L"C:\\windows\\system32\\d3dx9_43.dll" at 0x66ca0000: builtin 003e:trace:loaddll:load_native_dll Loaded L"C:\\Program Files\\Expansive Civilian Warfare\\shaders.dll" at 0x12800000: native 003e:trace:loaddll:load_native_dll Loaded L"C:\\Program Files\\Expansive Civilian Warfare\\bhs.dll" at 0x45000000: native ... 003e:Call PE DLL (proc=0x66cf9960,module=0x66ca0000 L"d3dx9_43.dll",reason=PROCESS_ATTACH,res=(nil)) ... 003e:Ret PE DLL (proc=0x66cf9960,module=0x66ca0000 L"d3dx9_43.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 003e:Call PE DLL (proc=0x1281ab80,module=0x12800000 L"shaders.dll",reason=PROCESS_ATTACH,res=(nil)) ... 003e:Call KERNEL32.SetUnhandledExceptionFilter(12825aad) ret=12825b24 003e:Ret KERNEL32.SetUnhandledExceptionFilter() retval=111eb77c ret=12825b24 ... 003e:trace:seh:raise_exception code=c0000005 flags=0 addr=0x8b117508 ip=8b117508 tid=003e 003e:trace:seh:raise_exception info[0]=00000000 003e:trace:seh:raise_exception info[1]=8b117508 003e:trace:seh:raise_exception eax=7c8429a4 ebx=00000000 ecx=7c834ac0 edx=8b117508 esi=0486c56c edi=00000000 003e:trace:seh:raise_exception ebp=1283868c esp=0033d0bc cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010206 003e:trace:seh:call_stack_handlers calling handler at 0x1282a71c code=c0000005 flags=0 003e:Call KERNEL32.GetLastError() ret=1281b154 003e:Ret KERNEL32.GetLastError() retval=00000000 ret=1281b154 ... 003e:exception c0000005 in PE entry point (proc=0x1281ab80,module=0x12800000,reason=PROCESS_ATTACH,res=(nil)) ... 003e:trace:loaddll:free_modref Unloaded module L"C:\\Program Files\\Expansive Civilian Warfare\\bhs.dll" : native 003e:trace:loaddll:free_modref Unloaded module L"C:\\Program Files\\Expansive Civilian Warfare\\shaders.dll" : native 003e:trace:loaddll:free_modref Unloaded module L"C:\\windows\\system32\\d3dx9_43.dll" : builtin 003e:trace:loaddll:free_modref Unloaded module L"C:\\windows\\system32\\d3dxof.dll" : builtin 003e:trace:loaddll:free_modref Unloaded module L"C:\\windows\\system32\\d3dcompiler_47.dll" : builtin 003e:Ret KERNEL32.LoadLibraryA() retval=00000000 ret=110022a4 ... 003e:Call user32.MessageBoxA(00000000,1120eca0 "Unfortunately, there was an error loading bhs.dll. Please report this bug!",1120ee80 "Error",00040030) ret=11002328 --- snip --- One has to debug through the dll init of 'shaders.dll' to see what's going on. The ease debugging, the game should be configured to run in Windowed mode (it's not by default). See registry snippet. --- snip --- [HKEY_LOCAL_MACHINE\Software\Westwood\Rp2 \Render] ... "DriverVersionCheckDisabled"=dword:00000057 ... "RenderDeviceWindowed"=dword:00000001 --- snip --- I spare you a long trace of disassembly, only providing the final crash site: --- snip --- 12803650 push ecx 12803651 mov eax,dword ptr ds:[12838284] ; d3d8_wined3d_device_parent_ops 12803656 mov ecx,dword ptr ds:[eax] ; device_parent_wined3d_device_created 12803658 mov edx,dword ptr ds:[ecx+1C] 1280365B push shaders.128380C0 12803660 push eax 12803661 call edx ; *boom* 12803663 mov ecx,dword ptr ds:[1283818C] 12803669 movzx edx,cl 1280366C mov eax,CCCCCCCD 12803671 mul edx 12803673 movzx eax,ch 12803676 shr edx,3 12803679 add edx,eax 1280367B mov dword ptr ss:[esp],edx 1280367E fild st(0),dword ptr ss:[esp] --- snip --- --- snip --- Address To From Size Comment Party 0032D12C 128032B7 12803650 18 shaders.sub_12803639+17 User 0032D144 1282A71C 128032B7 1C shaders.128032B7 User 0032D160 1282A87B 1282A71C 80 shaders.sub_1282A71C User 0032D1E0 1281AB9E 1282A87B BC shaders.sub_1282A87B User 0032D29C 7BCC3730 1281AB9E 694 shaders.EntryPoint+1E User 0032D930 111D395D 7BCC3730 BC 7BCC3730 User 0032D9EC 7BCC3730 111D395D 243C scripts.111D395D User 0032FE28 0043D050 7BCC3730 AC 7BCC3730 User 0032FED4 7B47ACA2 0043D050 4C game300.0043D050 System 0032FF20 7B4A5A50 7B47ACA2 BC kernel32.7B47ACA2 System 0032FFDC 7B47ACAE 7B4A5A50 14 kernel32.7B4A5A50 System 0032FFF0 00000000 7B47ACAE kernel32.7B47ACAE User --- snip --- Apparently the game ships its own d3d8->d3d9 thunk dll. Similar to what this FOSS project does: https://github.com/crosire/d3d8to9 --- quote --- This is a pseudo-driver module that intends to improve compatibility and stability in games using Direct3D 8 for rendering by converting all API calls and lowlevel shaders to equivalent Direct3D 9 ones. By that it also opens those games to the new possibilities from proven tools and wrappers written for Direct3D 9. --- quote --- NOTE: The game provided thunk dlls seem to be proprietary/closed (Westwood Renegade) and have no relation to the FOSS project. Wine doesn't pick up the d3d8 thunk dll from the game directory but instead loads the builtin (preferred) one by default, causing a crash due to different vtable/interface layouts later. To avoid the crash, force Wine to load native 'd3d8.dll' (thunk/wrapper). Interestingly the game seems to only need d3d8 override, even though it ships d3d9 as well ("ShaderInjector"). Maybe it misses some functionality later, I did not create (host)/join a game to verify. --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/Expansive Civilian Warfare $ WINEDLLOVERRIDES=d3d8=n,b wine ./Game300.exe --- snip --- ProtectionID scan of shipped D3D8/9 dlls: --- snip --- -=[ ProtectionID v0.6.9.0 DECEMBER]=- (c) 2003-2017 CDKiLLER & TippeX Build 24/12/17-21:05:42 Ready... Scanning -> C:\Program Files\Expansive Civilian Warfare\d3d8.dll File Type : 32-Bit Dll (Subsystem : Win GUI / 2), Size : 128000 (01F400h) Byte(s) | Machine: 0x14C (I386) Compilation TimeStamp : 0x46E888A9 -> Thu 13th Sep 2007 00:47:37 (GMT) [TimeStamp] 0x46E888A9 -> Thu 13th Sep 2007 00:47:37 (GMT) | PE Header | - | Offset: 0x000000F0 | VA: 0x120000F0 | - [TimeStamp] 0x46E888A8 -> Thu 13th Sep 2007 00:47:36 (GMT) | Export | - | Offset: 0x0001D134 | VA: 0x1201E534 | - [TimeStamp] 0x46E888A9 -> Thu 13th Sep 2007 00:47:37 (GMT) | DebugDirectory | - | Offset: 0x00016DA4 | VA: 0x120181A4 | - [LoadConfig] Struct determined as v8 (Expected size 140 | Actual size 64) [!] Executable uses SEH Tables (/SAFESEH) (9 calculated 9 recorded... 0 invalid addresses) [LoadConfig] CodeIntegrity -> Flags 0x5 | Catalog 0x0 (0) | Catalog Offset 0x775C3A63 | Reserved 0x77747365 [LoadConfig] GuardAddressTakenIatEntryTable 0x5C646F6F | Count 0x656E6572 (1701733746) [LoadConfig] GuardLongJumpTargetTable 0x65646167 | Count 0x6433645C (1681089628) [LoadConfig] HybridMetadataPointer 0x64702E38 | DynamicValueRelocTable 0x62 [LoadConfig] FailFastIndirectProc 0x0 | FailFastPointer 0x0 [LoadConfig] UnknownZero1 0x0 [File Heuristics] -> Flag #1 : 00000100000001001100000100000000 (0x0404C100) [Entrypoint Section Entropy] : 6.70 (section #0) ".text " | Size : 0x166DF (91871) byte(s) [DllCharacteristics] -> Flag : (0x0000) -> NONE [SectionCount] 4 (0x4) | ImageSize 0x24000 (147456) byte(s) [Export] 100% of function(s) (1 of 1) are in file | 0 are forwarded | 1 code | 0 data | 0 uninit data | 0 unknown | [ModuleReport] [IAT] Modules -> d3d9.dll | KERNEL32.dll | ADVAPI32.dll [Debug Info] (record 1 of 1) (file offset 0x16DA0) Characteristics : 0x0 | TimeDateStamp : 0x46E888A9 (Thu 13th Sep 2007 00:47:37 (GMT)) | MajorVer : 0 / MinorVer : 0 -> (0.0) Type : 2 (0x2) -> CodeView | Size : 0x36 (54) AddressOfRawData : 0x1D2D8 | PointerToRawData : 0x1BED8 CvSig : 0x53445352 | SigGuid 1383BEE1-0556-4DB0-B5D8930F8B72CBF2 Age : 0x5 (5) | Pdb : c:\westwood\renegade\d3d8.pdb [CompilerDetect] -> Visual C++ 8.0 (Visual Studio 2005) [!] File appears to have no protection or is using an unknown protection - Scan Took : 0.211 Second(s) [0000000D3h (211) tick(s)] [246 of 580 scan(s) done] Scanning -> C:\Program Files\Expansive Civilian Warfare\d3d9.dll File Type : 32-Bit Dll (Subsystem : Win GUI / 2), Size : 170496 (029A00h) Byte(s) | Machine: 0x14C (I386) Compilation TimeStamp : 0x4EE53333 -> Sun 11th Dec 2011 22:48:19 (GMT) [TimeStamp] 0x4EE53333 -> Sun 11th Dec 2011 22:48:19 (GMT) | PE Header | - | Offset: 0x00000100 | VA: 0x10000100 | - [TimeStamp] 0x4EE53333 -> Sun 11th Dec 2011 22:48:19 (GMT) | Export | - | Offset: 0x000267C4 | VA: 0x10027BC4 | - [TimeStamp] 0x4EE53333 -> Sun 11th Dec 2011 22:48:19 (GMT) | DebugDirectory | - | Offset: 0x0000FD84 | VA: 0x10011184 | - [LoadConfig] Struct determined as v8 (Expected size 140 | Actual size 64) [!] Executable uses SEH Tables (/SAFESEH) (9 calculated 9 recorded... 0 invalid addresses) [LoadConfig] CodeIntegrity -> Flags 0x6 | Catalog 0x0 (0) | Catalog Offset 0x555C3A43 | Reserved 0x73726573 [LoadConfig] GuardAddressTakenIatEntryTable 0x4141485C | Count 0x5C49444E (1548305486) [LoadConfig] GuardLongJumpTargetTable 0x75636F44 | Count 0x746E656D (1953391981) [LoadConfig] HybridMetadataPointer 0x69565C73 | DynamicValueRelocTable 0x6C617573 [LoadConfig] FailFastIndirectProc 0x75745320 | FailFastPointer 0x206F6964 [LoadConfig] UnknownZero1 0x30313032 [File Heuristics] -> Flag #1 : 00000100000001001101000100000000 (0x0404D100) [Entrypoint Section Entropy] : 6.65 (section #0) ".text " | Size : 0xF6D5 (63189) byte(s) [DllCharacteristics] -> Flag : (0x0140) -> ASLR | DEP [SectionCount] 5 (0x5) | ImageSize 0x2F000 (192512) byte(s) [Export] 100% of function(s) (8 of 8) are in file | 0 are forwarded | 8 code | 0 data | 0 uninit data | 0 unknown | [ModuleReport] [IAT] Modules -> d3dx9_43.dll | KERNEL32.dll | USER32.dll [Debug Info] (record 1 of 1) (file offset 0xFD80) Characteristics : 0x0 | TimeDateStamp : 0x4EE53333 (Sun 11th Dec 2011 22:48:19 (GMT)) | MajorVer : 0 / MinorVer : 0 -> (0.0) Type : 2 (0x2) -> CodeView | Size : 0x6E (110) AddressOfRawData : 0x26C90 | PointerToRawData : 0x25890 CvSig : 0x53445352 | SigGuid 14025EC5-8B84-4BDC-BEDA3337679779DC Age : 0x6 (6) | Pdb : C:\Users\HAANDI\Documents\Visual Studio 2010\Projects\ShaderInjector\Release\d3d9.pdb [CompilerDetect] -> Visual C++ 10.0 (Visual Studio 2010) [!] File appears to have no protection or is using an unknown protection - Scan Took : 0.261 Second(s) [000000105h (261) tick(s)] [246 of 580 scan(s) done] --- snip --- Similiar class of bug as: * bug 14980 ("Wine does not automatically use the riched20 installed by Office 2003/2007/2010/2013/2016") * bug 25373 ("Nokia S60 5th Edition SDK 1.0: epoc32 emulator and other tools fail to run (Wine's 'hal.dll' is preferred over native, causing failure to load app provided library with same name)") * bug 29678 ("Multiple application installers report 'OS version is too old, requires Windows 2000 or later' (loader: builtin 'version.dll' vs. private path 'version.dll')(ER Viewer 11, Fetion 2013 January)") * bug 43472 ("Several apps (R-Link 2 Toolbox/boulangerie patisserie Mavimplant) crash on startup (Wine's 'packager.dll' is preferred over native, causing failure to load app provided library with same name)") * bug 45551 ("InstallShield exits with 0x80004002, cannot find SECURITY.MySetFileSecurity (Wine's 'security.dll' is preferred over native, causing failure to load app provided library with same name)") * bug 47053 ("Beat Saber 'BSIPA' injector using Unity Doorstop proxy (.NET 4.6) fails to hook 'winhttp.dll' (Wine's 'winhttp.dll' is preferred over native, causing failure to load app provided library with same name)") $ sha1sum ExpansiveCivilianWarfareSetup.exe b0ffbf6299dc3b1680e8208ea5da3b08ea5645d8 ExpansiveCivilianWarfareSetup.exe $ du -sh ExpansiveCivilianWarfareSetup.exe 1.3G ExpansiveCivilianWarfareSetup.exe $ wine --version wine-4.7-142-g0ece679210 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 5

[Bug 33377] New: Dependencies on third-party import dlls are undetected
by wine-bugs＠winehq.org July 23, 2021

July 23, 2021

http://bugs.winehq.org/show_bug.cgi?id=33377 Bug #: 33377 Summary: Dependencies on third-party import dlls are undetected Product: Wine-Testbot Version: unspecified Platform: x86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: unknown AssignedTo: wine-bugs(a)winehq.org ReportedBy: fgouget(a)codeweavers.com Classification: Unclassified Created attachment 44167 --> http://bugs.winehq.org/attachment.cgi?id=44167 Patch to reproduce this bug The attached patch reproduces an issue first encountered 'in the wild' with this set of patches: * [1/3] include: Add COM interface definitions needed for PrintDlgEx implementation. http://www.winehq.org/pipermail/wine-patches/2013-April/123420.html * [3/3] comdlg32: Add an interactive PrintDlgEx test. http://www.winehq.org/pipermail/wine-patches/2013-April/123422.html * Re: [3/3] comdlg32: Add an interactive PrintDlgEx test. http://www.winehq.org/pipermail/wine-devel/2013-April/099397.html Here is the core of the issue: * The patch contains a first chunk that modifies include/commdlg.h. * This causes a new symbol to be exported by libuuid.a. * The comdlg32:printdlg test needs that symbol to be relinked. The problem is that the WineTestBot does not do a full recompile (for performance reasons), and thus libuuid.a is not rebuilt. So the comdlg32 relink fails because of the missing symbol. Unfortunately there's really no clear indication in the patch that libuuid.a needs to be rebuilt. We could very well run into the same issue with dxguid or a number of other dlls. Some options: * Systematically do a full rebuild. This would be pretty wasteful. * Do a full rebuild whenever the patch touches 'include/'. * Hardcode a list of uuid-like dlls and rebuild them all whenever a patch touches 'include/'. * Detect which uuid-like dlls the test links with (by parsing the Makefile?), and rebuild those whenever the patch touches 'include/'. It's also possible that any chunk outside of the test directory could get us into trouble if we link with the corresponding dll. -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 2

[Bug 39799] New: Visilogic 8.0 needs 'ITypeInfo_fnInvoke' support for coclass objects (TKIND_COCLASS) in arguments
by wine-bugs＠winehq.org July 23, 2021

July 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=39799 Bug ID: 39799 Summary: Visilogic 8.0 needs 'ITypeInfo_fnInvoke' support for coclass objects (TKIND_COCLASS) in arguments Product: Wine Version: 1.8-rc3 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: oleaut32 Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, continuation of discussion in bug 12688 ("Unitronics OPLC IDE VisiLogic 6.0 (vb6 app) fails on startup, reports run-time error '372' (failure to load control 'ActiveBar3' from 'Actbar3.ocx')". Starting with: https://bugs.winehq.org/show_bug.cgi?id=12688#c8 There also exists bug 19016 ("Word Automation from .NET does not work") which has a Wine-Staging patchset that covers much more the app needs here. The marshalling aspect is not involved hence I decided to have a separate ticket for adding 'ITypeInfo_fnInvoke' support for coclass objects (TKIND_COCLASS) in arguments. Unitronics OPLC IDE Visilogic 8.0.1 (VB6 app) Dmitry says that current implementation still contains some issue (https://bugs.winehq.org/show_bug.cgi?id=12688#c11) and fixing that allows the applications to proceed further. Download: http://support.somex.ie/index.php/downloads/category/1-plc-utility-software… --- Visilogic 8.0.1 Installer prerequisite: 'winetricks -q jet40' Workaround for another problem: --- snip --- $ WINEDLLOVERRIDES=tapi32=d wine ./VisiLogic.exe --- snip --- --- snip --- -=[ ProtectionID v0.6.6.7 DECEMBER]=- (c) 2003-2015 CDKiLLER & TippeX Build 24/12/14-22:48:13 Ready... Scanning -> Z:\home\focht\Downloads\VisiLogicSetup_801.exe File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 118161024 (070AFE80h) Byte(s) Compilation TimeStamp : 0x3B965AC1 -> Wed 05th Sep 2001 17:02:57 (GMT) [TimeStamp] 0x3B965AC1 -> Wed 05th Sep 2001 17:02:57 (GMT) | PE Header | - | Offset: 0x000000F8 | VA: 0x004000F8 | - -> File has 117882496 (0706BE80h) bytes of appended data starting at offset 044000h [File Heuristics] -> Flag #1 : 00000000000000000000000000000100 (0x00000004) [Entrypoint Section Entropy] : 6.66 (section #0) ".text " | Size : 0x11B16 (72470) byte(s) [DllCharacteristics] -> Flag : (0x0000) -> NONE [SectionCount] 4 (0x4) | ImageSize 0x47000 (290816) byte(s) [VersionInfo] Company Name : Unitronics [VersionInfo] Product Name : VisiLogic [VersionInfo] Product Version : 8.0.1 [VersionInfo] File Description : Vision IDE [VersionInfo] File Version : 8.0.1 [VersionInfo] Original FileName : stub32i.exe [VersionInfo] Internal Name : stub32 [-= Installer =-] InstallShield v6.31.100.1221 Setup Module [CompilerDetect] -> Visual C++ 6.0 - Scan Took : 0.211 Second(s) [0000000D3h (211) tick(s)] [558 of 573 scan(s) done] Scanning -> C:\Program Files\Unitronics\Unitronics VisiLogic_C\Main\VisiLogic.exe File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 2887680 (02C1000h) Byte(s) Compilation TimeStamp : 0x49EC8D77 -> Mon 20th Apr 2009 14:57:59 (GMT) [TimeStamp] 0x49EC8D77 -> Mon 20th Apr 2009 14:57:59 (GMT) | PE Header | - | Offset: 0x000000C0 | VA: 0x004000C0 | - [File Heuristics] -> Flag #1 : 00000000000000000000000000000000 (0x00000000) [Entrypoint Section Entropy] : 5.26 (section #0) ".text " | Size : 0x2BB3A8 (2864040) byte(s) [DllCharacteristics] -> Flag : (0x0000) -> NONE [SectionCount] 3 (0x3) | ImageSize 0x2C6000 (2908160) byte(s) [VersionInfo] Company Name : Unitronics Website: www.unitronics.com Sales: export(a)untronics.com Support: support(a)unitronics.com [VersionInfo] Product Name : VisiLogic [VersionInfo] Product Version : 8.00.0001 [VersionInfo] File Description : Unitronics OPLC IDE [VersionInfo] File Version : 8.00.0001 [VersionInfo] Original FileName : VisiLogic.exe [VersionInfo] Internal Name : VisiLogic [VersionInfo] Version Comments : Unitronics OPLC IDE [VersionInfo] Legal Trademarks : OPLC is the legal trademark of Unitronics [VersionInfo] Legal Copyrights : This file is the property of Unitronics. It may not be changed without prior written permission. The company takes no responsibility for the improper use of the material contained herein. [CompilerDetect] -> Visual Basic 6 (native) [!] File appears to have no protection or is using an unknown protection - Scan Took : 0.593 Second(s) [000000251h (593) tick(s)] [499 of 573 scan(s) done] --- snip --- $ sha1sum VisiLogicSetup_801.exe 243390482d7b8023c43191772ca783665ebe7c31 VisiLogicSetup_801.exe $ du -sh VisiLogicSetup_801.exe 113M VisiLogicSetup_801.exe $ wine --version wine-1.8-rc4 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 8

[Bug 38828] New: Cerbero PE Insider 1.0.2 crashes on unimplemented function dbghelp.dll.UnDecorateSymbolNameW when viewing export directory
by wine-bugs＠winehq.org July 23, 2021

July 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=38828 Bug ID: 38828 Summary: Cerbero PE Insider 1.0.2 crashes on unimplemented function dbghelp.dll.UnDecorateSymbolNameW when viewing export directory Product: Wine Version: 1.7.46 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: dbghelp Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, as the summary says ... Reproduce: start the app -> select a PE binary -> click 'Export Directory' in left hand side tree view. --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/Cerbero/PEInsider $ wine ./peinsider.exe ... wine: Call from 0x7b8456d9 to unimplemented function dbghelp.dll.UnDecorateSymbolNameW, aborting wine: Unimplemented function dbghelp.dll.UnDecorateSymbolNameW called at address 0x7b8456d9 (thread 0009), starting debugger... --- snip --- MSDN: https://msdn.microsoft.com/en-us/library/windows/desktop/ms681400%28v=vs.85… Source: https://source.winehq.org/git/wine.git/blob/878ea7d9ea4bbb924a539ec28088674… $ sha1sum peinsider_setup.exe 81324f9802f86bb93a9440c96460f911bedcc0f6 peinsider_setup.exe $ du -sh peinsider_setup.exe 6.5M peinsider_setup.exe $ wine --version wine-1.7.46 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 6

[Bug 39961] New: steamwebhelper.exe page fault NULL pointer crash
by wine-bugs＠winehq.org July 23, 2021

July 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=39961 Bug ID: 39961 Summary: steamwebhelper.exe page fault NULL pointer crash Product: Wine Version: 1.6.2 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: jg(a)jguk.org Distribution: --- Created attachment 53394 --> https://bugs.winehq.org/attachment.cgi?id=53394 steamweb.exe crash backtrace Call Of Duty: World of War installs Steam. Which crashes after installing and running. backtrace attached from Ubuntu 64bit. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 19

[Bug 45521] New: 64-bit Sentinel HASP hardlock.sys kernel driver crashes due ntoskrnl emulate_instruction not handling 'cli' and 'sti'
by wine-bugs＠winehq.org July 23, 2021

July 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=45521 Bug ID: 45521 Summary: 64-bit Sentinel HASP hardlock.sys kernel driver crashes due ntoskrnl emulate_instruction not handling 'cli' and 'sti' Product: Wine Version: 3.13 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: ntoskrnl Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, originally reported in bug 45510 (which now covers a different issue) and extracted here. Prerequisite: * 64-bit WINEPREFIX (otherwise you run into bug 45510) Download: https://www.uwerk.de/en/images/UWerkDownLoads/HASP/GUI/HASPUserSetup.zip --- snip --- ... 0051:Call ntoskrnl.exe.RtlAppendUnicodeToString(0002a240,006bfc98 L"\\Parameters") ret=006c6b88 0051:Call ntdll.RtlAppendUnicodeToString(0002a240,006bfc98 L"\\Parameters") ret=7bcfdc7b 0051:Ret ntdll.RtlAppendUnicodeToString() retval=00000000 ret=7bcfdc7b 0051:Ret ntoskrnl.exe.RtlAppendUnicodeToString() retval=00000000 ret=006c6b88 0051:Call ntoskrnl.exe.RtlQueryRegistryValues(80000000,0002a250,0055f5e0,00000000,00000000) ret=006c6bec 0051:Call ntdll.RtlQueryRegistryValues(80000000,0002a250,0055f5e0,00000000,00000000) ret=7bcfdc7b 0051:Ret ntdll.RtlQueryRegistryValues() retval=c0000034 ret=7bcfdc7b 0051:Ret ntoskrnl.exe.RtlQueryRegistryValues() retval=c0000034 ret=006c6bec 0051:Call ntoskrnl.exe.ExFreePoolWithTag(0002a240,00000000) ret=006c6bfe 0051:trace:ntoskrnl:ExFreePoolWithTag 0x2a240 0051:Call ntdll.RtlFreeHeap(00010000,00000000,0002a240) ret=7faa2ee4dfb1 0051:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7faa2ee4dfb1 0051:Ret ntoskrnl.exe.ExFreePoolWithTag() retval=00000001 ret=006c6bfe 0051:trace:seh:NtRaiseException code=c0000096 flags=0 addr=0x6cc5f6 ip=6cc5f6 tid=0051 0051:trace:seh:NtRaiseException rax=0000000000000000 rbx=0000000000027ca8 rcx=000000000055f6b4 rdx=000000000055f6b0 0051:trace:seh:NtRaiseException rsi=0000000000026ee0 rdi=0000000000027d58 rbp=0000000000027d04 rsp=000000000055f660 0051:trace:seh:NtRaiseException r8=0000000000000000 r9=0000000000000000 r10=0000000000000000 r11=0000000000000000 0051:trace:seh:NtRaiseException r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=00000000000271b0 0051:trace:seh:call_vectored_handlers calling handler at 0x7faa2ee458d8 code=c0000096 flags=0 0051:trace:seh:call_vectored_handlers handler at 0x7faa2ee458d8 returned 0 ... 0051:trace:seh:dwarf_virtual_unwind next function rip=0000000000000000 0051:trace:seh:dwarf_virtual_unwind rax=0000000000000000 rbx=0000000000000000 rcx=00007faa2ee80fa0 rdx=00000000000c0155 0051:trace:seh:dwarf_virtual_unwind rsi=0000000000000000 rdi=0000000000000000 rbp=0000000000000000 rsp=000000000055ffe0 0051:trace:seh:dwarf_virtual_unwind r8=0000000000000000 r9=0000000000000000 r10=0000000000000000 r11=0000000000000000 0051:trace:seh:dwarf_virtual_unwind r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=00007faa2ee30000 0051:trace:seh:call_stack_handlers found wine frame 0x55fe00 rsp 55ffe0 handler 0x7bd57b2b 0051:trace:seh:call_teb_handler calling TEB handler 0x7bd57b2b (rec=0x55f520, frame=0x55fe00 context=0x55e7c0, dispatch=0x55ec90) 0051:Call KERNEL32.UnhandledExceptionFilter(0055e700) ret=7bd57b85 wine: Unhandled privileged instruction at address 0x6cc5f6 (thread 0051), starting debugger... --- snip --- Disassembly after decryption of 64-bit driver: --- snip --- ... 00000000006CC5B3 | E8 38 A5 FF FF | call hardlock.6C6AF0 00000000006CC5B8 | 84 C0 | test al, al 00000000006CC5BA | 74 04 | je hardlock.6CC5C0 00000000006CC5BC | 83 4B 58 01 | or dword ptr ds:[rbx+58], 1 00000000006CC5C0 | 4C 8D 44 24 4C | lea r8, qword ptr ss:[rsp+4C] 00000000006CC5C5 | 48 8D 15 94 35 FF FF | lea rdx, qword ptr ds:[6BFB60] 00000000006CC5CC | 49 8B CF | mov rcx, r15 00000000006CC5CF | E8 1C A5 FF FF | call hardlock.6C6AF0 00000000006CC5D4 | 84 C0 | test al, al 00000000006CC5D6 | 74 0E | je hardlock.6CC5E6 00000000006CC5D8 | 44 39 6C 24 4C | cmp dword ptr ss:[rsp+4C], r13d 00000000006CC5DD | 74 07 | je hardlock.6CC5E6 00000000006CC5DF | 81 4B 58 80 00 00 00 | or dword ptr ds:[rbx+58], 80 00000000006CC5E6 | 48 8D 54 24 50 | lea rdx, qword ptr ss:[rsp+50] 00000000006CC5EB | 48 8D 4C 24 54 | lea rcx, qword ptr ss:[rsp+54] 00000000006CC5F0 | 45 33 C9 | xor r9d, r9d 00000000006CC5F3 | 45 33 C0 | xor r8d, r8d 00000000006CC5F6 | FB | sti ; problem! 00000000006CC5F7 | E8 6A E4 FE FF | call hardlock.6BAA66 00000000006CC5FC | 44 8B 5C 24 54 | mov r11d, dword ptr ss:[rsp+54] 00000000006CC601 | 41 C1 E3 08 | shl r11d, 8 00000000006CC605 | 44 03 5C 24 50 | add r11d, dword ptr ss:[rsp+50] ... --- snip --- 'cli' and 'sti' are handled in 32-bit case: Source: https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/ntoskrnl.exe/instr.c… --- snip --- 266 /*********************************************************************** 267 * emulate_instruction 268 * 269 * Emulate a privileged instruction. 270 * Returns exception continuation status. 271 */ 272 static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT *context ) 273 { ... 437 438 case 0xfa: /* cli */ 439 case 0xfb: /* sti */ 440 context->Eip += prefixlen + 1; 441 return ExceptionContinueExecution; 442 } 443 return ExceptionContinueSearch; /* Unable to emulate it */ 444 } --- snip --- but not in 64-bit: Source: https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/ntoskrnl.exe/instr.c… --- snip --- 588 589 /*********************************************************************** 590 * emulate_instruction 591 * 592 * Emulate a privileged instruction. 593 * Returns exception continuation status. 594 */ 595 static DWORD emulate_instruction( EXCEPTION_RECORD *rec, CONTEXT *context ) 596 { ... 802 case 0xa0: /* mov Ob, AL */ 803 case 0xa1: /* mov Ovqp, rAX */ ... 818 } 819 return ExceptionContinueSearch; /* Unable to emulate it */ 820 } --- snip --- ProtectionID scan for documentation: --- snip --- -=[ ProtectionID v0.6.9.0 DECEMBER]=- (c) 2003-2017 CDKiLLER & TippeX Build 24/12/17-21:05:42 Scanning -> Z:\home\focht\Downloads\HASPUserSetup.exe File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 14533512 (0DDC388h) Byte(s) | Machine: 0x14C (I386) Compilation TimeStamp : 0x4B96E621 -> Wed 10th Mar 2010 00:21:53 (GMT) [!] Digital Signature signed by a known DRM provider -> SafeNet, Inc. [TimeStamp] 0x4B96E621 -> Wed 10th Mar 2010 00:21:53 (GMT) | PE Header | - | Offset: 0x000000F8 | VA: 0x004000F8 | - [TimeStamp] 0x4B96E620 -> Wed 10th Mar 2010 00:21:52 (GMT) | Export | - | Offset: 0x00012ED4 | VA: 0x004146D4 | - -> File Appears to be Digitally Signed @ Offset 0DDAA00h, size : 01988h / 06536 byte(s) [LoadConfig] Struct determined as v8 (Expected size 140 | Actual size 64) [!] Executable uses SEH Tables (/SAFESEH) (3 calculated 3 recorded... 0 invalid addresses) [LoadConfig] CodeIntegrity -> Flags 0x0 | Catalog 0x0 (0) | Catalog Offset 0x0 | Reserved 0x0 [LoadConfig] GuardAddressTakenIatEntryTable 0x0 | Count 0x0 (0) [LoadConfig] GuardLongJumpTargetTable 0xFFFFFFFE | Count 0x0 (0) [LoadConfig] HybridMetadataPointer 0xFFFFFF88 | DynamicValueRelocTable 0x0 [LoadConfig] FailFastIndirectProc 0xFFFFFFFE | FailFastPointer 0x407A0A [LoadConfig] UnknownZero1 0x407A0E [File Heuristics] -> Flag #1 : 00000000000001001100000100000100 (0x0004C104) [Entrypoint Section Entropy] : 6.53 (section #0) ".text " | Size : 0xF208 (61960) byte(s) [DllCharacteristics] -> Flag : (0x8000) -> TSA [SectionCount] 5 (0x5) | ImageSize 0xDEF000 (14610432) byte(s) [Export] 100% of function(s) (6 of 6) are in file | 0 are forwarded | 6 code | 0 data | 0 uninit data | 0 unknown | [VersionInfo] Company Name : SafeNet Inc. [VersionInfo] File Description : Sentinel Runtime [VersionInfo] File Version : 6.60.1.36770 [VersionInfo] Legal Copyrights : SafeNet Inc. [ModuleReport] [IAT] Modules -> WSOCK32.dll | VERSION.dll | KERNEL32.dll | USER32.dll | GDI32.dll | ADVAPI32.dll | SHELL32.dll [CdKeySerial] found "Evaluation period" @ VA: 0x00D99B54 / Offset: 0x00D85B54 [CdKeySerial] found "Evaluation period" @ VA: 0x00D99BEC / Offset: 0x00D85BEC [CdKeySerial] found "Evaluation version" @ VA: 0x00DCE8DC / Offset: 0x00DBA8DC [CdKeySerial] found "Serial Number" @ VA: 0x00DCF3C9 / Offset: 0x00DBB3C9 [CompilerDetect] -> Visual C++ 9.0 (Visual Studio 2008) [!] File appears to have no protection or is using an unknown protection - Scan Took : 2.518 Second(s) [0000009B2h (2482) tick(s)] [506 of 580 scan(s) done] --- snip --- --- snip --- Scanning -> Z:\home\focht\Downloads\hardlock.sys File Type : 64-Bit Driver (good checksum) (Subsystem : Native / 1), Size : 331328 (050E40h) Byte(s) | Machine: 0x8664 (AMD64) Compilation TimeStamp : 0x51A349DA -> Mon 27th May 2013 11:56:10 (GMT) [!] Digital Signature signed by a known DRM provider -> SafeNet, Inc. [TimeStamp] 0x51A349DA -> Mon 27th May 2013 11:56:10 (GMT) | PE Header | - | Offset: 0x00000000:000000E8 | VA: 0x00000000:000100E8 | - -> File Appears to be Digitally Signed @ Offset 04F600h, size : 01840h / 06208 byte(s) [LoadConfig] CodeIntegrity -> Flags 0xAA60 | Catalog 0x46 (70) | Catalog Offset 0x2000001 | Reserved 0x46AB40 [LoadConfig] GuardAddressTakenIatEntryTable 0x46AC88:02000011 | Count 0x46AE9C02000011 (463222033554449) [LoadConfig] GuardLongJumpTargetTable 0x46AF38:08000011 | Count 0x46AFE008000011 (4632544134217745) [LoadConfig] HybridMetadataPointer 0x46A66C:08000011 | DynamicValueRelocTable 0x8000011:0046B0A8 [LoadConfig] FailFastIndirectProc 0x8000011:0046B264 | FailFastPointer 0x8000011:0046B2FC [LoadConfig] UnknownZero1 0x8000011 46B448 [File Heuristics] -> Flag #1 : 00000000000000011100000000010111 (0x0001C017) [Entrypoint Section Entropy] : 4.38 (section #7) ".init " | Size : 0x1600 (5632) byte(s) [DllCharacteristics] -> Flag : (0x0000) -> NONE [SectionCount] 8 (0x8) | ImageSize 0x4F600 (325120) byte(s) [VersionInfo] Company Name : SafeNet Inc. [VersionInfo] Product Name : Sentinel Hardlock Device Driver for Windows x64 [VersionInfo] Product Version : 3.83 [VersionInfo] File Description : Sentinel Hardlock Device Driver for Windows x64 [VersionInfo] File Version : 3.83 [VersionInfo] Original FileName : hardlock.sys [VersionInfo] Internal Name : hardlock.sys [VersionInfo] Legal Copyrights : © 2013 SafeNet. Inc. All rights reserved. [ModuleReport] [IAT] Modules -> ntoskrnl.exe | HAL.dll [!] File appears to have no protection or is using an unknown protection - Scan Took : 0.321 Second(s) [000000141h (321) tick(s)] [134 of 580 scan(s) done] --- snip --- With that fix in place the driver loads successfully (at least it doesn't crash) but the HASP installer runs into next problem with another 64-bit kernel driver. $ sha1sum HASPUserSetup.* fa5f85d8dfbef3188087f1b6fb0ec81a16e6a26d HASPUserSetup.exe d486f63c0444e3a42b81a74ab52f99c45432e9e1 HASPUserSetup.zip $ du -sh HASPUserSetup.* 14M HASPUserSetup.exe 14M HASPUserSetup.zip $ wine --version wine-3.13 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 7

[Bug 35367] New: Cyberlink Powerdirector 8 crashes during media scan (Wine ole32 code must take implicit MTA into account)
by wine-bugs＠winehq.org July 23, 2021

July 23, 2021

https://bugs.winehq.org/show_bug.cgi?id=35367 Bug ID: 35367 Summary: Cyberlink Powerdirector 8 crashes during media scan (Wine ole32 code must take implicit MTA into account) Product: Wine Version: 1.7.10 Hardware: x86 OS: Linux Status: NEW Severity: normal Priority: P2 Component: ole32 Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Classification: Unclassified Hello folks, Prerequisite: 'winetricks -q mfc42' Upon startup the app shows a registration dialog with some options: * "Buy Now" * "Activate" * "Try Now" After selecting "Try Now" the app continues loading and starts importing some media files. "Activation" feature also works (tested with some code found here and there). There is a crash (heap corruption) in libxml2/msxml during media import. This is a different problem which can be worked around with 'winetricks -q msxml3'. This bug is about the COM/OLE part of media import crash. Relevant part of trace log: --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files/CyberLink/PowerDirector $ WINEDEBUG=+tid,+seh,+relay,+ole,+variant wine ./PDR8.exe >>log2.txt 2>&1 ... 0016:Call shlwapi.PathFileExistsW(0430b2e4 L"C:\\Program Files\\CyberLink\\PowerDirector\\SampleClips\\ntsc\\Nature.mpg") ret=02cb0bbd ... 0016:Ret shlwapi.PathFileExistsW() retval=00000001 ret=02cb0bbd 0016:Call ole32.CoCreateInstance(02ce6e68,00000000,00000007,02ce6e38,0275b5b4) ret=02cb5171 0016:trace:ole:CoCreateInstance (rclsid={889ca1c3-e115-47e1-88ec-20df644e982a}, pUnkOuter=(nil), dwClsContext=00000007, riid={38df9356-47c1-40ef-89ce-af1d019b0baa}, ppv=0x275b5b4) 0016:trace:ole:apartment_addref 2e0000cafe: before = 8 0016:trace:ole:apartment_release 2e0000cafe: after = 8 0016:trace:ole:CoGetClassObject CLSID: {889ca1c3-e115-47e1-88ec-20df644e982a},IID: {00000001-0000-0000-c000-000000000046} 0016:trace:ole:apartment_addref 2e0000cafe: before = 8 ... 0016:warn:ole:CoGetClassObject class {889ca1c3-e115-47e1-88ec-20df644e982a} not registered as in-proc server ... 0016:warn:ole:CoGetClassObject class {889ca1c3-e115-47e1-88ec-20df644e982a} not registered in-proc handler 0016:trace:ole:apartment_release 2e0000cafe: after = 8 0016:trace:ole:RPC_GetLocalClassObject rclsid={889ca1c3-e115-47e1-88ec-20df644e982a}, iid={00000001-0000-0000-c000-000000000046} 0016:trace:ole:RPC_GetLocalClassObject waiting for L"\\\\.\\pipe\\{889CA1C3-E115-47E1-88EC-20DF644E982A}" 0016:Call KERNEL32.WaitNamedPipeW(0275b228 L"\\\\.\\pipe\\{889CA1C3-E115-47E1-88EC-20DF644E982A}",ffffffff) ret=7e773bc3 0016:Ret KERNEL32.WaitNamedPipeW() retval=00000001 ret=7e773bc3 0016:Call KERNEL32.CreateFileW(0275b228 L"\\\\.\\pipe\\{889CA1C3-E115-47E1-88EC-20DF644E982A}",c0000000,00000000,00000000,00000003,00000000,00000000) ret=7e773c04 0016:Ret KERNEL32.CreateFileW() retval=00000914 ret=7e773c04 0016:Call KERNEL32.ReadFile(00000914,0275b158,000000c8,0275b220,00000000) ret=7e773e29 0016:Ret KERNEL32.ReadFile() retval=00000001 ret=7e773e29 0016:trace:ole:RPC_GetLocalClassObject read marshal id from pipe ... 0016:trace:ole:RPC_GetLocalClassObject unmarshalling local server 0016:trace:ole:CoUnmarshalInterface (0x4365a08, {6d5140c1-7436-11ce-8034-00aa006009fa}, 0x275b13c) ... 0016:trace:ole:get_unmarshaler_from_stream Using standard unmarshaling 0016:Call ntdll.RtlAllocateHeap(00110000,00000000,00000010) ret=7e75bf7e 0016:Ret ntdll.RtlAllocateHeap() retval=043fd2f8 ret=7e75bf7e 0016:trace:ole:StdMarshalImpl_UnmarshalInterface (...,{6d5140c1-7436-11ce-8034-00aa006009fa},....) 0016:err:ole:StdMarshalImpl_UnmarshalInterface Apartment not initialized 0016:err:ole:CoUnmarshalInterface IMarshal::UnmarshalInterface failed, 0x800401f0 ... 0016:trace:ole:CoUnmarshalInterface completed with hr 0x800401f0 0016:trace:seh:raise_exception code=c0000005 flags=0 addr=0x7e7740f4 ip=7e7740f4 tid=0016 0016:trace:seh:raise_exception info[0]=00000000 0016:trace:seh:raise_exception info[1]=000003de 0016:trace:seh:raise_exception eax=000003de ebx=7e854000 ecx=0275b100 edx=0275ef8c esi=0275ecc5 edi=0275eb8c 0016:trace:seh:raise_exception ebp=0275b378 esp=0275b100 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00210286 --- snip --- "{889ca1c3-e115-47e1-88ec-20df644e982a}" is registered as out-of-process COM server: --- snip --- CLSID: {889CA1C3-E115-47E1-88EC-20DF644E982A} LOCAL SERVER: %ROOT%\PROGRA~1\CYBERL~1\SHARED~1\RICHVI~1.EXE TYPELIB: {D37B5B2C-8D1B-4832-89E4-6FCE903B3A18} VERSION IND. PROGID: RichVideo.RVInterface --- snip --- The problem most likely stems from crappy vendor code. The thread in question that ought to instantiate the COM object never explicitly initializes its COM apartment. >From my experience in 99% of the cases the developers forgot the call to CoInitializeEx() on thread entry and the reason why this works for native is the so called implicit MTA. Basically another thread in the process called CoInitializeEx(0, COINIT_MULTITHREADED), which means that the thread which forgot to call CoInitializeEx() was implicitly placed in the MTA (the app creates a crapload of threads). I had to change quite some code to make a proof-of-concept. There is various code in Wine ole32 that makes use of COM_CurrentApt() which doesn't take implicit MTA into account. --- snip --- # modified: dlls/ole32/compobj.c # modified: dlls/ole32/marshal.c # modified: dlls/ole32/rpc.c --- snip --- The app/thread was finally able to instantiate the out-of-process COM server and make COM calls. Media files were successfully imported and movies/images showed up in some thumbnail-like view. $ sha1sum cyberlink2220_vde09070801.exe 2fbc508b971332872b68761ea0d56803c5d122bd cyberlink2220_vde09070801.exe $ du -sh cyberlink2220_vde09070801.exe 236M cyberlink2220_vde09070801.exe $ wine --version wine-1.7.10-343-g770d09d Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 8