January 2024 - Wine-Bugs - list.winehq.org

[Bug 30144] New: Art of Murder - Hunt for the Puppeteer audio issue: speech cut off prematurely
by wine-bugs＠winehq.org Jan. 17, 2024

Jan. 17, 2024

http://bugs.winehq.org/show_bug.cgi?id=30144 Bug #: 30144 Summary: Art of Murder - Hunt for the Puppeteer audio issue: speech cut off prematurely Product: Wine Version: 1.3.30 Platform: x86 URL: http://www.fileplanet.com/197199/190000/fileinfo/Art-o f-Murder:-Hunt-for-the-Puppeteer-Demo OS/Version: Linux Status: NEW Keywords: download, regression Severity: minor Priority: P2 Component: winealsa.drv AssignedTo: wine-bugs(a)winehq.org ReportedBy: gyebro69(a)gmail.com CC: aeikum(a)codeweavers.com Classification: Unclassified Regression SHA1: 8258a5188cc36563809ac7495e49bc43ae4326e4 In Art of Murder 2 dialogues are corrupted: in a spoken sentence only the first few words can be heard, the rest is skipped. This is after 8258a5188cc36563809ac7495e49bc43ae4326e4 is the first bad commit commit 8258a5188cc36563809ac7495e49bc43ae4326e4 Author: Andrew Eikum <aeikum(a)codeweavers.com> Date: Fri Sep 23 15:03:51 2011 -0500 winealsa.drv: Remove wave, mixer, and dsound driver code. :040000 040000 e34e9dab6f585755d23f4cad91d4af6dc37b786b bf2a47c73bcdd75db339177384a4d566c4fa41e6 M dlls Still present as of wine-1.4-78-g94953f1. Other bugs related to this commit: bug #28856, bug #29497, bug #30143. The linked demo version is in Polish, but speech is in English. Installation of the demo is straightforward. In the main menu click on the topmost button to start a new game. While in the game, right click on any of the inventory items to hear the broken dialogues. The game starts with a long intro video, which is unskippable, thus the generated debug log was 65 MB. I couldn't compress the log below 1 MB, so I uploaded the file here: https://docs.google.com/open?id=0B-tTbLKBl-tOVXlTTjdNMXVRd2FtbF9LRGUxc1FZUQ Fedora 16 x86 Alsa 1.0.25 Pulseaudio is not running Audio device: nVidia Corporation MCP61 High Definition Audio (rev a2) -- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

2 16

[Bug 56200] New: Wine (crashing) causing to open a small window then disappear after half a second.
by WineHQ Bugzilla Jan. 17, 2024

Jan. 17, 2024

https://bugs.winehq.org/show_bug.cgi?id=56200 Bug ID: 56200 Summary: Wine (crashing) causing to open a small window then disappear after half a second. Product: Wine Version: unspecified Hardware: x86-64 OS: MacOS Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: mxrs992(a)gmail.com When I try to open a .exe file with Wine a small window appears then half a second later it disappears. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 2

[Bug 50265] New: Grandia2 Sound Underrun
by WineHQ Bugzilla Jan. 17, 2024

Jan. 17, 2024

https://bugs.winehq.org/show_bug.cgi?id=50265 Bug ID: 50265 Summary: Grandia2 Sound Underrun Product: Wine Version: 6.0-rc1 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: SolisX007(a)yahoo.com Distribution: --- Created attachment 68804 --> https://bugs.winehq.org/attachment.cgi?id=68804 Grandia2-Terminal.txt Grandia2 movies sound like it's skipping on wine-6.0rc1 on a clean wine prefix. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 2

[Bug 48812] New: Sounds don't play in Blood 2: Choosen
by WineHQ Bugzilla Jan. 17, 2024

Jan. 17, 2024

https://bugs.winehq.org/show_bug.cgi?id=48812 Bug ID: 48812 Summary: Sounds don't play in Blood 2: Choosen Product: Wine Version: 5.0 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: roland(a)mxchange.org Distribution: --- The sounds, including music don't work in Blood 2: Choosen (game id 29095) but worked in earlier versions. If you need some debug logs, please write back. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 9

[Bug 38028] New: 163music can not glibly playback music
by wine-bugs＠winehq.org Jan. 17, 2024

Jan. 17, 2024

https://bugs.winehq.org/show_bug.cgi?id=38028 Bug ID: 38028 Summary: 163music can not glibly playback music Product: Wine Version: 1.7.35 Hardware: x86 URL: http://music.163.com OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: directx-dsound Assignee: wine-bugs(a)winehq.org Reporter: hillwoodroc(a)gmail.com CC: fracting(a)gmail.com Distribution: SUSE But We can use winetricks to install directx9 to fix it. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2 5

[Bug 56198] New: X11 driver seems to assume horizontal multi-screen layout
by WineHQ Bugzilla Jan. 16, 2024

Jan. 16, 2024

https://bugs.winehq.org/show_bug.cgi?id=56198 Bug ID: 56198 Summary: X11 driver seems to assume horizontal multi-screen layout Product: Wine Version: 9.0-rc5 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: winex11.drv Assignee: wine-bugs(a)winehq.org Reporter: mia(a)srsfckn.biz Distribution: --- System info: Distro: openSUSE Tumbleweed 20240114 WM: Sway 1.8.1 XWayland: 23.2.2 (12302002) When running on display configurations where screens are not on a horizontal line (e.g. stacked on top of each other), the X11 driver, at least running under XWayland, makes it impossible to use part of the screen that a window is on. Examples: [3840x2160] [3840x2160] In this case, only the left half of each screen is usable. The right half does not respond to any mouse events, and programs such as winecfg will not redraw in that region. [2160x3840][3840x2160] [3840x2160] Most of each screen is usable, except for a region on the right side. It appears that Wine divides the total width of the X11 display by the number of screens in order to determine the active region. I am not sure if this is an XWayland bug, but I have not observed this behavior with other X11 applications. (The Wayland driver unsurprisingly does not have this problem, but is also not yet ready for general use.) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 1

[Bug 56199] New: Japanese Visual Novel "Natural Vacation" hangs on start forever (Probably race condition)
by WineHQ Bugzilla Jan. 16, 2024

Jan. 16, 2024

https://bugs.winehq.org/show_bug.cgi?id=56199 Bug ID: 56199 Summary: Japanese Visual Novel "Natural Vacation" hangs on start forever (Probably race condition) Product: Wine Version: 9.0-rc5 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: dark.shadow4(a)web.de Distribution: --- Unfortunately this is a paid game and the demo doesn't have this issue (at least not for me). The only thing that happens is console output > 01b4:fixme:ntdll:EtwEventSetInformation (deadbeef, 2, 76245BE0, 43) stub Then the program hangs forever, while maxing one CPU core. The program is protected by Enigma (5.x) and really dislikes getting debugged. +relay works when using RelayExclude "ntdll.*", otherways the relay breaks the program. Although, using relay makes the issue disappear. I figured out that "taskset 1" also makes the issue disappear. Another way to "work around" the issue is to hack "use_futexes" to return 0. Note: When working around the issue (either way) you sometimes get a deadlock (loader lock?), not sure if related or not. Apart from that, it seems to work reliably - It won't just randomly hang. A bit more investigation reveals the following: - It creates a file like evbdfdc.tmp in the temp directory - It calls LoadLibraryW("plugin.dll") - This (for some reason) loads the temporary file, which seems to have some anti-tamper logic that is needed - Meanwhile, the main thread spams GetModuleHandleW("plugin.dll") until it gets something non zero. In the error case something goes wrong and it doesn't even create the file, while still waiting for it to be loaded. No idea what, though. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 50108] New: Multiple applications using native API sandboxing / virtualization crash when being relay traced (Adobe Reader 11)
by WineHQ Bugzilla Jan. 16, 2024

Jan. 16, 2024

https://bugs.winehq.org/show_bug.cgi?id=50108 Bug ID: 50108 Summary: Multiple applications using native API sandboxing / virtualization crash when being relay traced (Adobe Reader 11) Product: Wine Version: 5.21 Hardware: x86 OS: Linux Status: NEW Severity: normal Priority: P2 Component: tools Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, encountered while revisiting some Adobe bugs with native API sandboxing enabled (default). Native API sandboxing works as designed under normal conditions, see my no-relay references later. Relay debugging is a developer / triager use-case. Stable download link via Internet Archive: https://web.archive.org/web/20200522053748/http://ardownload.adobe.com/pub/… Acrobat Reader creates a sandboxed process (initially suspended) which crashes in entry point when being relay traced. --- snip --- $ pwd /home/focht/.wine/drive_c/Program Files (x86)/Adobe/Reader 11.0/Reader $ WINEDEBUG=+seh,+relay,+server,+ntdll wine ./AcroRd32.exe >>log.txt 2>&1 ... 0024:Call KERNEL32.CreateProcessAsUserW(00000100,0198e508 L"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe",0198e618 L"\"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" --channel=32.1.1899522388 --type=renderer",00000000,00000000,00000000,0100040c,00df6f68,00000000,0031f644,0031f694) ret=0042b162 ... 0130: init_process_done( gui=1, module=00400000, ldt_copy=f7d5d9c0, entry=00401039 ) 0024: *wakeup* signaled=0 0130: init_process_done() = 0 { suspend=1 } ... 0024:Ret KERNEL32.CreateProcessAsUserW() retval=00000001 ret=0042b162 ... 0130:Call ntdll.RtlInitNlsTables(011d0000,011f0000,00fed810,7b081484) ret=7b01d500 0130:Ret ntdll.RtlInitNlsTables() retval=7b081484 ret=7b01d500 0130:Call ntdll.RtlResetRtlTranslations(7b081484) ret=7b01d50b 0130:Ret ntdll.RtlResetRtlTranslations() retval=00000400 ret=7b01d50b 0130:Call ntdll.RtlInitUnicodeString(0031eb78,7b069b30 L"\\Registry\\Machine") ret=7b0387b3 0130:Ret ntdll.RtlInitUnicodeString() retval=00000024 ret=7b0387b3 0130:trace:seh:dispatch_exception code=c0000096 flags=0 addr=00A8C960 ip=00a8c960 tid=0130 0130:trace:seh:dispatch_exception eax=7bc6c000 ebx=0031eb80 ecx=0031eb50 edx=02000000 esi=00000000 edi=00000000 0130:trace:seh:dispatch_exception ebp=0031eb04 esp=0031ea64 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00010202 0130:trace:seh:call_stack_handlers calling handler at 0040C7F0 code=c0000096 flags=0 0130:trace:seh:call_stack_handlers handler at 0040C7F0 returned 1 0130:trace:seh:call_stack_handlers calling handler at 7BC513A0 code=c0000096 flags=0 0130:trace:seh:__regs_RtlUnwind code=c0000096 flags=2 0130:trace:seh:__regs_RtlUnwind eax=00000000 ebx=0031eed8 ecx=0031e8a8 edx=0031eed8 esi=00000001 edi=00000000 0130:trace:seh:__regs_RtlUnwind ebp=0031e508 esp=0031e500 eip=7bc512a6 cs=0023 ds=002b fs=0063 gs=006b flags=00000206 0130:trace:seh:__regs_RtlUnwind calling handler at 7BC460F0 code=c0000096 flags=2 0130:trace:seh:__regs_RtlUnwind handler at 7BC460F0 returned 1 0130:trace:seh:__regs_RtlUnwind calling handler at 0040C7F0 code=c0000096 flags=2 0130:trace:seh:__regs_RtlUnwind handler at 0040C7F0 returned 1 0130: select( flags=3, cookie=0031d88c, timeout=0, size=0, prev_apc=0000, result={}, data={}, context={} ) 0130: select() = TIMEOUT { call={APC_NONE}, apc_handle=0000, context={} } 0130:exception c0000096 in PE entry point (proc=7B0272D0,module=7B000000,reason=PROCESS_ATTACH,res=0031FD24) 0130:Ret PE DLL (proc=7B0272D0,module=7B000000 L"kernelbase.dll",reason=PROCESS_ATTACH,res=0031FD24) retval=0 0130:Call PE DLL (proc=7B0272D0,module=7B000000 L"kernelbase.dll",reason=PROCESS_DETACH,res=0031FD24) 0130:Ret PE DLL (proc=7B0272D0,module=7B000000 L"kernelbase.dll",reason=PROCESS_DETACH,res=0031FD24) retval=1 0130:err:module:LdrInitializeThunk "kernelbase.dll" failed to initialize, aborting 0130:err:module:LdrInitializeThunk Initializing dlls for L"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe" failed, status c0000096 0130: terminate_process( handle=ffffffff, exit_code=-1073741674 ) 0130: terminate_process() = 0 { self=1 } 0130: *killed* exit_code=-1073741674 --- snip --- The crash is in kernelbase:init_locale() which calls RegCreateKeyExW -> NtCreateKey() NtCreateKey() happens to be the first of the hooked native API functions being called. Wine source: https://source.winehq.org/git/wine.git/blob/70d77a439ab58dcf56664d1545aa0c4… --- snip --- 699 /*********************************************************************** 700 * init_locale 701 */ 702 void init_locale(void) 703 { 704 UINT ansi_cp = 0, oem_cp = 0; 705 USHORT *ansi_ptr, *oem_ptr; 706 void *sort_ptr; 707 LCID lcid = GetUserDefaultLCID(); 708 WCHAR bufferW[80]; 709 DYNAMIC_TIME_ZONE_INFORMATION timezone; 710 GEOID geoid = GEOID_NOT_AVAILABLE; 711 DWORD count, dispos, i; 712 SIZE_T size; 713 HKEY hkey; 714 715 kernel32_handle = GetModuleHandleW( L"kernel32.dll" ); 716 717 GetLocaleInfoW( LOCALE_SYSTEM_DEFAULT, LOCALE_IDEFAULTANSICODEPAGE | LOCALE_RETURN_NUMBER, 718 (WCHAR *)&ansi_cp, sizeof(ansi_cp)/sizeof(WCHAR) ); 719 GetLocaleInfoW( LOCALE_SYSTEM_DEFAULT, LOCALE_IDEFAULTMACCODEPAGE | LOCALE_RETURN_NUMBER, 720 (WCHAR *)&mac_cp, sizeof(mac_cp)/sizeof(WCHAR) ); 721 GetLocaleInfoW( LOCALE_SYSTEM_DEFAULT, LOCALE_IDEFAULTCODEPAGE | LOCALE_RETURN_NUMBER, 722 (WCHAR *)&oem_cp, sizeof(oem_cp)/sizeof(WCHAR) ); 723 724 NtGetNlsSectionPtr( 9, 0, NULL, &sort_ptr, &size ); 725 NtGetNlsSectionPtr( 12, NormalizationC, NULL, (void **)&norm_info, &size ); 726 init_sortkeys( sort_ptr ); 727 728 if (!ansi_cp || NtGetNlsSectionPtr( 11, ansi_cp, NULL, (void **)&ansi_ptr, &size )) 729 NtGetNlsSectionPtr( 11, 1252, NULL, (void **)&ansi_ptr, &size ); 730 if (!oem_cp || NtGetNlsSectionPtr( 11, oem_cp, 0, (void **)&oem_ptr, &size )) 731 NtGetNlsSectionPtr( 11, 437, NULL, (void **)&oem_ptr, &size ); 732 NtCurrentTeb()->Peb->AnsiCodePageData = ansi_ptr; 733 NtCurrentTeb()->Peb->OemCodePageData = oem_ptr; 734 NtCurrentTeb()->Peb->UnicodeCaseTableData = sort.casemap; 735 RtlInitNlsTables( ansi_ptr, oem_ptr, sort.casemap, &nls_info ); 736 RtlResetRtlTranslations( &nls_info ); 737 738 RegCreateKeyExW( HKEY_LOCAL_MACHINE, L"System\\CurrentControlSet\\Control\\Nls", 739 0, NULL, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, NULL, &nls_key, NULL ); ... --- snip --- Entry point code of <ntdll.NtCreateKey> is read two times: --- snip --- 0024:Call KERNEL32.ReadProcessMemory(0000010c,7bc036ac,0031f7d0,00000018,0031f7cc) ret=004614db ... 0024: read_process_memory( handle=010c, addr=7bc036ac ) 0130: *signal* signal=19 0024: read_process_memory() = 0 { data={8b,ff,55,8b,ec,5d,68,83,00,07,00,b8,00,c0,c6,7b,50,ff,50,04,c2,1c,00,90} } ... 0024:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=004614db 0024:Call KERNEL32.ReadProcessMemory(0000010c,7bc036ac,0031f7d4,00000010,0031f7d0) ret=004617e7 0024: read_process_memory( handle=010c, addr=7bc036ac ) 0130: *signal* signal=19 0024: read_process_memory() = 0 { data={8b,ff,55,8b,ec,5d,68,83,00,07,00,b8,00,c0,c6,7b} } ... 0024:Ret KERNEL32.ReadProcessMemory() retval=00000001 ret=004617e7 --- snip --- * 0x18 bytes = pre-analysis * 0x10 bytes = unknown native API entry signature -> defaults to syscall style The <ntdll.NtCreateKey> relay entry disassembly: --- snip --- 7BC036AC | 8BFF | mov edi,edi | hotpatch prolog start 7BC036AE | 55 | push ebp | 7BC036AF | 8BEC | mov ebp,esp | 7BC036B1 | 5D | pop ebp | hotpatch prolog end 7BC036B2 | 68 83000700 | push 70083 | 7BC036B7 | B8 00C0C67B | mov eax,ntdll.7BC6C000 | 7BC036BC | 50 | push eax | not copied 7BC036BD | FF50 04 | call dword ptr ds:[eax+4] | not copied 7BC036C0 | C2 1C00 | ret 1C | not copied 7BC036C3 | 90 | nop | --- snip --- Wine source, emitting relay entry: https://source.winehq.org/git/wine.git/blob/70d77a439ab58dcf56664d1545aa0c4… --- snip --- 212 /******************************************************************* 213 * output_relay_debug 214 * 215 * Output entry points for relay debugging 216 */ 217 static void output_relay_debug( DLLSPEC *spec ) 218 { ... 244 output( "\t.text\n" ); 245 output( "__wine_spec_relay_entry_points:\n" ); 246 output( "\tnop\n" ); /* to avoid 0 offset */ 247 248 for (i = spec->base; i <= spec->limit; i++) 249 { 250 ORDDEF *odp = spec->ordinals[i]; 251 252 if (!needs_relay( odp )) continue; 253 254 switch (target_cpu) 255 { 256 case CPU_x86: 257 output( "\t.align %d\n", get_alignment(4) ); 258 output( "\t.long 0x90909090,0x90909090\n" ); 259 output( ".L__wine_spec_relay_entry_point_%d:\n", i ); 260 output_cfi( ".cfi_startproc" ); 261 output( "\t.byte 0x8b,0xff,0x55,0x8b,0xec,0x5d\n" ); /* hotpatch prolog */ 262 if (odp->flags & (FLAG_THISCALL | FLAG_FASTCALL)) /* add the register arguments */ 263 { 264 output( "\tpopl %%eax\n" ); 265 if ((odp->flags & FLAG_FASTCALL) && get_args_size( odp ) > 4) output( "\tpushl %%edx\n" ); 266 output( "\tpushl %%ecx\n" ); 267 output( "\tpushl %%eax\n" ); 268 } 269 output( "\tpushl $%u\n", (odp->u.func.args_str_offset << 16) | (i - spec->base) ); 270 output_cfi( ".cfi_adjust_cfa_offset 4" ); 271 272 if (UsePIC) 273 { 274 output( "\tcall %s\n", asm_name("__wine_spec_get_pc_thunk_eax") ); 275 output( "1:\tleal .L__wine_spec_relay_descr-1b(%%eax),%%eax\n" ); 276 needs_get_pc_thunk = 1; 277 } 278 else output( "\tmovl $.L__wine_spec_relay_descr,%%eax\n" ); 279 output( "\tpushl %%eax\n" ); 280 output_cfi( ".cfi_adjust_cfa_offset 4" ); 281 282 output( "\tcall *4(%%eax)\n" ); 283 output_cfi( ".cfi_adjust_cfa_offset -8" ); 284 if (odp->type == TYPE_STDCALL) 285 output( "\tret $%u\n", get_args_size( odp )); 286 else 287 output( "\tret\n" ); 288 output_cfi( ".cfi_endproc" ); 289 break; --- snip --- For reference, <ntdll.NtCreateKey> without relay trace (syscall style,fits into 16 bytes): --- snip --- 7BC0B9B0 | B8 1C000000 | mov eax,1C | 7BC0B9B5 | BA D0C5C07B | mov edx,ntdll.7BC0C5D0 | 7BC0B9BA | FFD2 | call edx | 7BC0B9BC | C2 1C00 | ret 1C | 7BC0B9BF | 90 | nop | ... 7BC0C5D0 | FF25 18C0C67B | jmp dword ptr ds:[<__wine_syscall_dispatcher>] | --- snip --- The parent process writes a copy of the original native API entry and trampoline code into child process (sandbox) address space: --- snip --- 0024:Call KERNEL32.WriteProcessMemory(0000010c,00a8c950,019da140,00000036,0031f7cc) ret=00430409 ... 0024: write_process_memory( handle=010c, addr=00a8c950, data={8b,ff,55,8b,ec,5d,68,83,00,07,00,b8,00,c0,c6,7b,6c,00,00,00,00,00,00,00,83,ec,08,52,8b,54,24,0c,89,54,24,08,c7,44,24,0c,50,c9,a8,00,c7,44,24,04,70,8a,41,00,5a,c3} ) 0130: *signal* signal=19 0024: write_process_memory() = 0 ... 0024:Ret KERNEL32.WriteProcessMemory() retval=00000001 ret=00430409 --- snip --- --- snip --- 00A8C950 | 8BFF | mov edi,edi | org copy of 00A8C952 | 55 | push ebp | NtCreateKey 00A8C953 | 8BEC | mov ebp,esp | relay entry 00A8C955 | 5D | pop ebp | 00A8C956 | 68 83000700 | push 70083 | 00A8C95B | B8 00C0C67B | mov eax,ntdll.7BC6C000 | 00A8C960 | 6C | insb | *boom* 00A8C962 | 0000 | add byte ptr ds:[eax],al | 00A8C964 | 0000 | add byte ptr ds:[eax],al | 00A8C966 | 0000 | add byte ptr ds:[eax],al | 00A8C967 | 00 00A8C968 | 83EC 08 | sub esp,8 | trampoline 00A8C96C | 52 | push edx | 00A8C970 | 8B5424 0C | mov edx,dword ptr ss:[esp+C] | 00A8C974 | 895424 08 | mov dword ptr ss:[esp+8],edx | 00A8C978 | C74424 0C 50C9A800 | mov dword ptr ss:[esp+C],A8C950 | NtCreateKey 00A8C980 | C74424 04 708A4100 | mov dword ptr ss:[esp+4],acrord32.418A70 | hook impl. 00A8C988 | 5A | pop edx | 00A8C989 | C3 | ret | --- snip --- and patches original <ntdll.NtCreateKey> relay entry: --- snip --- 0024:Call KERNEL32.WriteProcessMemory(0000010c,7bc036ac,0031f7d4,0000000c,0031f798) ret=004304ed ... 0024: write_process_memory( handle=010c, addr=7bc036ac, data={b8,ff,55,8b,ec,ba,68,c9,a8,00,ff,e2} ) 0130: *signal* signal=19 0024: write_process_memory() = 0 ... 0024:Ret KERNEL32.WriteProcessMemory() retval=00000001 ret=004304ed --- snip --- Patched <ntdll.NtCreateKey> relay entry: --- snip --- 7BC036AC | B8 FF558BEC | mov eax,EC8B55FF | garbage #sysc 7BC036B1 | BA 68C9A800 | mov edx,A8C968 | trampoline 7BC036B6 | FFE2 | jmp edx | --- snip --- It crashes when the hook calls the original relay entry code which was only partially copied. For reference how it looks like without relay - working as intended: --- snip --- 00576950 | B8 1C000000 | mov eax,1C | org copy of 00576955 | BA D0C5C07B | mov edx,ntdll.7BC0C5D0 | NtCreateKey 0057695A | FFD2 | call edx | entry 0057695C | C2 1C00 | ret 1C | 0057695F | 90 | nop | 00576960 | 6C | insb | fill 00576961 | 0000 | add byte ptr ds:[eax],al | 00576963 | 0000 | add byte ptr ds:[eax],al | 00576965 | 0000 | add byte ptr ds:[eax],al | 00576967 | 00 00576968 | 83EC 08 | sub esp,8 | trampoline 0057696C | 52 | push edx | 00576970 | 895424 08 | mov dword ptr ss:[esp+8],edx | 00576974 | C74424 0C 50695700 | mov dword ptr ss:[esp+C],576950 | NtCreateKey 0057697C | C74424 04 708A4100 | mov dword ptr ss:[esp+4],acrord32.418A70 | hook impl. 00576984 | 5A | pop edx | 00576985 | C3 | ret | --- snip --- Patched <ntdll.NtCreateKey> entry: --- snip --- 7BC0B9B0 | B8 1C000000 | mov eax,1C | org #sysc 7BC0B9B5 | BA 68695700 | mov edx,576968 | trampoline 7BC0B9BA | FFE2 | jmp edx 7BC0B9BC | C2 1C00 | retn 1C 7BC0B9BF | 90 | nop --- snip --- Yes, I know it's possible to disable relay thunks for native API (RelayExclude -> ntdll.*), even for a sub-set (the ones being hooked) to avoid crashes. Maybe something can be done without resorting to that functionality. If it's not worth to do extra handling for NT syscall relay thunks then you might resolve this one as 'WONTFIX'. $ sha1sum AdbeRdr11004_en_US.exe 9c295c16d374735bf292ef6c630c9ab392c22500 AdbeRdr11004_en_US.exe $ du -sh AdbeRdr11004_en_US.exe 49M AdbeRdr11004_en_US.exe $ wine --version wine-5.21 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 3

[Bug 56197] New: Blur sometimes crashes: 0024:err:virtual:virtual_setup_exception stack overflow
by WineHQ Bugzilla Jan. 16, 2024

Jan. 16, 2024

https://bugs.winehq.org/show_bug.cgi?id=56197 Bug ID: 56197 Summary: Blur sometimes crashes: 0024:err:virtual:virtual_setup_exception stack overflow Product: Wine Version: 9.0-rc3 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: cedric.dewijs(a)eclipso.eu Distribution: --- Created attachment 75907 --> https://bugs.winehq.org/attachment.cgi?id=75907 output from the command: journalctl MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1 -o verbose Blur sometimes crashes. When it does, the following is visible in the console: FIRST : Potentially bad data : 638 DiffPrev :2.460445 DiffNext :1.706726 FIRST : Potentially bad data : 640 DiffPrev :7.508575 DiffNext :7.046486 0130:err:virtual:allocate_virtual_memory out of memory for allocation, base (nil) size 000b0000 0130:err:d3d:wined3d_resource_allocate_sysmem Failed to allocate system memory. 0130:err:d3d:texture_resource_sub_resource_map Failed to prepare location. 0024:err:virtual:virtual_setup_exception stack overflow 1064 bytes addr 0x5b7d4352 stack 0x2070bd8 (0x2070000-0x2071000-0x2570000) Segmentation fault (core dumped) To reproduce: Download Blur from here: https://www.myabandonware.com/download/y5l-blur $ md5sum ~/Downloads/Blur_Win_EN_Full-Rip.zip 1828b38fbaf4f6590b0d8453a5c0c2ea /home/cedric/Downloads/Blur_Win_EN_Full-Rip.zip unzip the game, and run it. After a various amount of time, the game crashes. Usually after about an hour of playing. [cedric(a)cedric BLUR]$ wine Blur.exe I've found the core file here, but it's bigger than I can attach here (424MB): $ ls -lh /var/lib/systemd/coredump/ -rw-r-----+ 1 root root 424M Jan 16 18:14 'core.Game\x20Master.1000.449d77bb791e4c56a3cea8da590fe8d1.4692.1705425290000000.zst' Information about the crash is recorded in the system journal, I've attached the output of this command: $ journalctl MESSAGE_ID=fc2e22bc6ee647b6b90729ab34a250b1 -o verbose My system: Arch linux, XFCE on Xorg AMD video card, open source driver $ wine --version wine-9.0-rc3 $ uname -a Linux cedric 6.6.7-arch1-1 #1 SMP PREEMPT_DYNAMIC Thu, 14 Dec 2023 03:45:42 +0000 x86_64 GNU/Linux -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 51955] New: Fusion 360: Certain elements from the UI remain drawn on screen when switching to other applications
by WineHQ Bugzilla Jan. 16, 2024

Jan. 16, 2024

https://bugs.winehq.org/show_bug.cgi?id=51955 Bug ID: 51955 Summary: Fusion 360: Certain elements from the UI remain drawn on screen when switching to other applications Product: Wine Version: 6.16 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: alex.lemony(a)gmail.com Distribution: --- Created attachment 70935 --> https://bugs.winehq.org/attachment.cgi?id=70935 Screenshot showing bug Fusion 360 was installed with the following installer on Manjaro KDE Edition(x86): https://github.com/cryinkfly/Autodesk-Fusion-360-for-Linux Possibly of relevance is that the Bismuth tiling windows KWin script has been in use is the current session, though the bug persists also when it is deactivated. Bug: Certain elements of the UI such as the top left folder view under `BROWSER:`, the dialogue indicating that the current file is unsaved, the heading `COMMENTS:` in the bottom left, and the view manipulation bar at the bottom in the center, remain drawn on screen when switching to other applications on the same and on different virtual desktops. This persists even when Fusion 360 is minimized. (see screenshot). The dialogues remain interactable with buttons reacting to mouseover, though clicking appears to have no effect. Thanks, please email for further details if needed. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

1 3