http://bugs.winehq.org/show_bug.cgi?id=34774 thehack904 <thehack904@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |thehack904@gmail.com --- Comment #12 from thehack904 <thehack904@gmail.com> --- I have identified and tested a working workaround for the Crimson Skies (2000) crashes affecting the Preferences menu and Quit Mission functionality. **Workaround and source code:** https://github.com/thehack904/CrimsonSkies-Wine-Fix **Stable release v1.0.0:** https://github.com/thehack904/CrimsonSkies-Wine-Fix/releases/tag/v1.0.0 ### Investigation Using GDB, I traced a SIGSEGV in `roffile.dll` at RVA `0x22E0`, where the parser attempts to read beyond accessible memory. The investigation identified a problem in the ROF resource line parser's end-of-input handling. The game loads `LAYOUT.CSV` from the `crimson.rof` resource archive. The resource decompresses successfully, but the parser advances beyond the layout data and continues into unrelated memory. A GDB trace recorded more than 1,200 parser calls, showing the cursor progressing past the resource contents and eventually reaching an unmapped memory page. The relevant instruction sequence in `roffile.dll` is: ```asm cmp byte ptr [esi], 0x20 jge short keep_cursor inc esi keep_cursor: mov [edi], esi ``` When the parser encounters a NUL byte (`0x00`), the `INC ESI` instruction advances the cursor past it. This can cause subsequent calls to continue reading beyond the terminator. ### Working workaround For the verified `roffile.dll` build, changing one instruction prevents the observed crash: - DLL: `roffile.dll` - RVA: `0x231E` - Original instruction: `INC ESI` (`0x46`) - Replacement: `NOP` (`0x90`) Original bytes: ```text 80 3E 20 7D 01 46 89 37 ``` Patched bytes: ```text 80 3E 20 7D 01 90 89 37 ``` Original DLL SHA-256: ```text 1bc7b4b1adba1bf6a510e62f93473824c662acbf2a2176087b7b4b85338ba58a ``` This is a game DLL workaround, not a Wine source-code patch. The underlying cause is strongly supported by the debugger evidence and successful functional testing, but broader validation is still needed. ### Testing results With the patched DLL, I successfully tested: - Opening Preferences during a mission. - Changing settings and returning to the mission. - Quitting a mission and returning to the correct menu. - Returning to the main menu. - Starting another mission and repeating these operations. - Saving and loading. - Exiting the game normally. - Restarting the game and repeating the tests. All completed successfully. Both previously reproducible crashes were eliminated in the tested installation. ### Test environment - Game: Crimson Skies (2000), original Windows PC version - Operating system: Kubuntu 26.04.1 - Compatibility layer: GE-Proton 11-9 via Lutris/UMU Steam Runtime 4 - GPU: Intel HD Graphics 4000 - Hardware: HP Elite 8300 USDT ### Public workaround I published a Python 3 patching utility under the MIT license. The utility: - Verifies the original DLL using SHA-256. - Applies the single-byte modification. - Creates and verifies a backup. - Supports status checking and restoration. - Allows safe reapplication after restoration. - Rejects unsupported DLL builds. - Does not distribute copyrighted game files. Repository: https://github.com/thehack904/CrimsonSkies-Wine-Fix Release: https://github.com/thehack904/CrimsonSkies-Wine-Fix/releases/tag/v1.0.0 ### Limitations The workaround has been validated against one specific `roffile.dll` build and one Wine/Proton environment. Because the modification is within the game DLL, it is not inherently tied to GE-Proton 11-9, but I have not verified it against other Wine/Proton versions or different game DLL builds. I am sharing these findings in the hope that they help other Crimson Skies users and provide useful diagnostic information for a potential upstream Wine fix. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.