[Bug 56501] New: nProtect Anti-Virus/Spyware 4.0 'tkpl2k64.sys' crashes on unimplemented function 'fltmgr.sys.FltCreateCommunicationPort'
https://bugs.winehq.org/show_bug.cgi?id=56501 Bug ID: 56501 Summary: nProtect Anti-Virus/Spyware 4.0 'tkpl2k64.sys' crashes on unimplemented function 'fltmgr.sys.FltCreateCommunicationPort' Product: Wine Version: 9.5 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: fltmgr Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, continuation of bug 49089 ("nProtect Anti-Virus/Spyware 4.0 'tkpl2k64.sys' crashes on unimplemented function 'fltmgr.sys.FltBuildDefaultSecurityDescriptor'"). To come that far one needs to work around multiple problems: * Bug 50208 ("Multiple kernel drivers need NtQuerySystemInformation(SystemModuleInformation) to return correct ImageBaseAddress and ImageSize for modules (Sentinel HASP 'hardlock.sys', SmartGaga 'AndroidKernelX64.sys')"), otherwise the driver crashes early. * Support of particular 'ImagePath' path variant: 'system32\\foobar.sys'. I mentioned some of them in https://bugs.winehq.org/show_bug.cgi?id=47175#c4 * wineserver crash in enum_handles() callback while handling 'NtQuerySystemInformation(SystemHandleInformation,...)' request for app AV autostart-services Download: https://web.archive.org/web/20160510225518/http://avsd.nprotect.net/avs40/se... --- snip --- $ WINEDEBUG=+seh,+loaddll,+ntoskrnl,+relay wine net start tkpl >>log.txt 2>&1 ... 0100:trace:ntoskrnl:load_driver loading driver L"c:\\windows\\system32\\tkpl2k64.sys" ... 0100:trace:loaddll:build_module Loaded L"C:\\windows\\system32\\drivers\\FLTMGR.SYS" at 00006FFFFE500000: builtin 0100:trace:loaddll:build_module Loaded L"c:\\windows\\system32\\tkpl2k64.sys" at 0000000000010000: native ... 0100:Call ntoskrnl.exe.ZwQuerySystemInformation(0000000b,7ffffe900970,00001000,7ffffeb1f878) ret=0001ff22 ... 0100:Ret ntoskrnl.exe.ZwQuerySystemInformation() retval=00000000 ret=0001ff22 ... 0100:Call ntoskrnl.exe.IoCreateSymbolicLink(7ffffeb1f948,7ffffeb1f930) ret=000115c3 0100:trace:ntoskrnl:IoCreateSymbolicLink L"\\DosDevices\\tkpl" -> L"\\Device\\tkpl" ... 0100:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=000115c3 0100:Call fltmgr.sys.FltRegisterFilter(7ffffe265110,00024d30,00026228) ret=00012f08 ... 0100:fixme:fltmgr:FltRegisterFilter Call KERNEL32.GetModuleHandleW(6ffffe504254 L"ntdll.dll") ret=6ffffe5028e2 ... 0100:Ret fltmgr.sys.FltRegisterFilter() retval=00000000 ret=00012f08 0100:Call fltmgr.sys.FltStartFiltering(deadbeaf) ret=00012f24 0100:fixme:fltmgr:FltStartFiltering (00000000DEADBEAF): stub 0100:Ret fltmgr.sys.FltStartFiltering() retval=00000000 ret=00012f24 0100:Call fltmgr.sys.FltBuildDefaultSecurityDescriptor(7ffffeb1f928,001f0001) ret=00012f43 ... 0100:Ret fltmgr.sys.FltBuildDefaultSecurityDescriptor() retval=00000000 ret=00012f43 0100:Call ntoskrnl.exe.RtlInitUnicodeString(7ffffeb1f910,00022310 L"\\TKPL_Port") ret=00012f65 0100:Call ntdll.RtlInitUnicodeString(7ffffeb1f910,00022310 L"\\TKPL_Port") ret=6ffffff927df 0100:Ret ntdll.RtlInitUnicodeString() retval=00000016 ret=6ffffff927df 0100:Ret ntoskrnl.exe.RtlInitUnicodeString() retval=00000016 ret=00012f65 0100:Call KERNEL32.RaiseException(80000100,00000001,00000002,7ffffeb1f870) ret=6ffffe503195 0100:trace:seh:dispatch_exception code=80000100 (EXCEPTION_WINE_STUB) flags=1 addr=00006FFFFFC64177 ... wine: Call from 00006FFFFFC64177 to unimplemented function fltmgr.sys.FltCreateCommunicationPort, aborting --- snip --- Microsoft docs: https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/fltkernel/nf-... $ sha1sum nProtectSetup_AVS40.exe 913b33ab5c9477539d4d65b9f89e67be1a6b6c13 nProtectSetup_AVS40.exe $ du -sh nProtectSetup_AVS40.exe 36M nProtectSetup_AVS40.exe $ wine --version wine-9.5-95-g8568848ba83 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=56501 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |https://web.archive.org/web | |/20160510225518/http://avsd | |.nprotect.net/avs40/setup/n | |ProtectSetup_AVS40.exe Keywords| |download -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=56501 Alois Schlögl <alois.schloegl(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alois.schloegl(a)gmail.com --- Comment #1 from Alois Schlögl <alois.schloegl(a)gmail.com> --- Created attachment 76522 --> https://bugs.winehq.org/attachment.cgi?id=76522 debug log when installing velocity 7.0 The attached debug log is produced when installing velocity 7.0 from https://www.volocity4d.com/download (32bit or 64 bit does not matter) This debug log contains also these lines: wine: Call from 00006FFFFF463E67 to unimplemented function fltmgr.sys.FltCreateCommunicationPort, aborting 0138:err:service:process_send_command service protocol error - failed to read pipe r = 0 count = 0! 011c:fixme:msi:internal_ui_handler internal UI not implemented for message 0x0b000000 (UI level = 5) 011c:fixme:msi:internal_ui_handler internal UI not implemented for message 0x0b000000 (UI level = 5) 011c:err:msi:dialog_bitmap_control Failed to load bitmap (null) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=56501 --- Comment #2 from Alois Schlögl <alois.schloegl@gmail.com> --- Created attachment 81408 --> http://bugs.winehq.org/attachment.cgi?id=81408 debug log when running the installer of volocity 7 on wine 11.13 the debug log is about 17 lines shorter. The following message is gone: wine: Call from 00006FFFFF463E67 to unimplemented function fltmgr.sys.FltCreateCommunicationPort, aborting -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=56501 Alistair Leslie-Hughes <leslie_alistair@hotmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |7a231d5bbcde9e6ba8f7a65224c | |9613ba103ef81 Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #3 from Alistair Leslie-Hughes <leslie_alistair@hotmail.com> --- Fixed by https://gitlab.winehq.org/wine/wine/-/commit/7a231d5bbcde9e6ba8f7a65224c9613... -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=56501 Alexandre Julliard <julliard@winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #4 from Alexandre Julliard <julliard@winehq.org> --- Closing bugs fixed in 11.14. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (2)
-
WineHQ Bugzilla -
WineHQ Bugzilla