[Bug 47047] New: 64-bit MRAC Anti-Cheat (My.Com Warface) kernel service crashes in driver entry point due to missing ' ntoskrnl.exe.MmGetPhysicalAddress' stub
https://bugs.winehq.org/show_bug.cgi?id=47047 Bug ID: 47047 Summary: 64-bit MRAC Anti-Cheat (My.Com Warface) kernel service crashes in driver entry point due to missing 'ntoskrnl.exe.MmGetPhysicalAddress' stub Product: Wine Version: 4.6 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: ntoskrnl Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, continuation of bug 47044 Download: https://web.archive.org/web/20190331063634/http://static.gc.my.com/WarfaceMy... --- snip --- $ WINEDEBUG=+seh,+relay,+ntoskrnl notepad >>log.txt 2>&1 & $ wine net start mracdrv The MRAC Driver service is starting. No system resources. ... 00a3:Call driver init 0x140098005 (obj=0x27980,str=L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\mracdrv") ... 00a3:Call ntoskrnl.exe.MmGetSystemRoutineAddress(0002ad38) ret=14062f1a6 ... 00a3:Call KERNEL32.GetModuleHandleW(7efc0ebad580 L"ntoskrnl.exe") ret=7efc0eb9b3bc 00a3:Ret KERNEL32.GetModuleHandleW() retval=7efc0eb80000 ret=7efc0eb9b3bc 00a3:Call KERNEL32.GetProcAddress(7efc0eb80000,00010eb0 "MmGetPhysicalAddress") ret=7efc0eb9b3c9 00a3:Ret KERNEL32.GetProcAddress() retval=7efc0eb85328 ret=7efc0eb9b3c9 ... 00a3:trace:ntoskrnl:MmGetSystemRoutineAddress L"MmGetPhysicalAddress" -> 0x7efc0eb85328 00a3:Ret ntoskrnl.exe.MmGetSystemRoutineAddress() retval=7efc0eb85328 ret=14062f1a6 ... 00a3:Call ntoskrnl.exe.ExpInterlockedPushEntrySList(140091f80,00032030) ret=140998163 00a3:Call ntdll.RtlInterlockedPushEntrySList(140091f80,00032030) ret=7bc8de4f 00a3:Ret ntdll.RtlInterlockedPushEntrySList() retval=0002ce10 ret=7bc8de4f 00a3:Ret ntoskrnl.exe.ExpInterlockedPushEntrySList() retval=0002ce10 ret=140998163 00a3:Call KERNEL32.RaiseException(80000100,00000001,00000002,0032f340) ret=7efc0eba5b29 00a3:trace:seh:NtRaiseException code=80000100 flags=1 addr=0x7b452d3c ip=7b452d3c tid=00a3 00a3:trace:seh:NtRaiseException info[0]=00007efc0eba5b4d 00a3:trace:seh:NtRaiseException info[1]=00007efc0eba877c 00a3:trace:seh:call_vectored_handlers calling handler at 0x7efc0eb8d4e0 code=80000100 flags=1 00a3:trace:seh:call_vectored_handlers handler at 0x7efc0eb8d4e0 returned 0 wine: Call from 0x7b452d3c to unimplemented function ntoskrnl.exe.MmGetPhysicalAddress, aborting ... --- snip --- Microsoft docs: https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntddk/... Wine source: https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/ntoskrnl.exe/ntoskrnl... --- snip --- 690 @ stub MmGetPhysicalAddress --- snip --- Returning PHYSICAL_ADDRESS with PhysicalAddress.QuadPart == 0 won't do any good. You have to return a non-zero address. It seems the address is located within a non-paged pool allocation (8 KB) some calls earlier. I used kva == pa (1:1) mapping to keep it happy. --- snip --- ... 0031:Call ntoskrnl.exe.ExAllocatePoolWithTag(00000000,00002000,4943414d) ret=140ab5668 0031:Call ntdll.RtlAllocateHeap(00010000,00000000,00002000) ret=7f5fb4aec158 0031:Ret ntdll.RtlAllocateHeap() retval=000372e0 ret=7f5fb4aec158 0031:trace:ntoskrnl:ExAllocatePoolWithTag 8192 pool 0 -> 0x372e0 0031:Ret ntoskrnl.exe.ExAllocatePoolWithTag() retval=000372e0 ret=140ab5668 ... 0031:Call ntoskrnl.exe.ExpInterlockedPushEntrySList(140091f80,00031ff0) ret=140998163 0031:Call ntdll.RtlInterlockedPushEntrySList(140091f80,00031ff0) ret=7bc8de4f 0031:Ret ntdll.RtlInterlockedPushEntrySList() retval=0002cdd0 ret=7bc8de4f 0031:Ret ntoskrnl.exe.ExpInterlockedPushEntrySList() retval=0002cdd0 ret=140998163 0031:Call ntoskrnl.exe.MmGetPhysicalAddress(00038000) ret=1403a839c 0031:fixme:ntoskrnl:MmGetPhysicalAddress stub: 0x38000 0031:Ret ntoskrnl.exe.MmGetPhysicalAddress() retval=00038000 ret=1403a839c 0031:Call ntoskrnl.exe.ExpInterlockedPopEntrySList(140091f80) ret=14008d019 0031:Call ntdll.RtlInterlockedPopEntrySList(140091f80) ret=7bc8de4f 0031:Ret ntdll.RtlInterlockedPopEntrySList() retval=00031ff0 ret=7bc8de4f 0031:Ret ntoskrnl.exe.ExpInterlockedPopEntrySList() retval=00031ff0 ret=14008d019 0031:Call ntoskrnl.exe.ExpInterlockedPushEntrySList(140091f80,00031ff0) ret=140ab62ab ... 0031:Call ntoskrnl.exe.IoAllocateMdl(00038000,00001000,00000000,00000000,00000000) ret=140f3d8e4 0031:trace:ntoskrnl:IoAllocateMdl (0x38000, 4096, 0, 0, (nil)) 0031:Call ntdll.RtlAllocateHeap(00010000,00000008,00000034) ret=7f5fb4aef514 0031:Ret ntdll.RtlAllocateHeap() retval=00027af0 ret=7f5fb4aef514 0031:Ret ntoskrnl.exe.IoAllocateMdl() retval=00027af0 ret=140f3d8e4 ... 0031:Call ntoskrnl.exe.MmProbeAndLockPages(00027af0,00000000,00000000) ret=1403e3800 0031:fixme:ntoskrnl:MmProbeAndLockPages (0x27af0, 0, 0): stub 0031:Ret ntoskrnl.exe.MmProbeAndLockPages() retval=0000003e ret=1403e3800 ... 0031:Call ntoskrnl.exe.MmMapLockedPagesSpecifyCache(00027af0,00000000,00000001,00000000,00000000,00000010) ret=140a50460 0031:fixme:ntoskrnl:MmMapLockedPagesSpecifyCache (0x27af0, 0, 1, (nil), 0, 16): stub 0031:Ret ntoskrnl.exe.MmMapLockedPagesSpecifyCache() retval=00000000 ret=140a50460 ... 0031:Call ntoskrnl.exe.MmUnlockPages(00027af0) ret=140d4aa34 0031:fixme:ntoskrnl:MmUnlockPages (0x27af0): stub 0031:Ret ntoskrnl.exe.MmUnlockPages() retval=00000032 ret=140d4aa34 ... 0031:Call ntoskrnl.exe.IoFreeMdl(00027af0) ret=140ea7c48 0031:trace:ntoskrnl:IoFreeMdl 0x27af0 0031:Call ntdll.RtlFreeHeap(00010000,00000000,00027af0) ret=7f5fb4aef6ef 0031:Ret ntdll.RtlFreeHeap() retval=00000001 ret=7f5fb4aef6ef 0031:Ret ntoskrnl.exe.IoFreeMdl() retval=00000001 ret=140ea7c48 ... 0033:Call ntoskrnl.exe.PsTerminateSystemThread(00000000) ret=1400112a1 0033:trace:ntoskrnl:PsTerminateSystemThread status 0. 0033:Call KERNEL32.ExitThread(00000000) ret=7f5fb4af90ee ... 0031:Ret ntdll.NtWaitForMultipleObjects() retval=00000000 ret=7f5fb4afeec1 ... 0031:Ret driver init 0x140098005 (obj=0x27940,str=L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\mracdrv") retval=c000009a ... 0031:trace:ntoskrnl:init_driver init done for L"mracdrv" obj 0x27940 0031:trace:ntoskrnl:init_driver - DriverInit = 0x140098005 0031:trace:ntoskrnl:init_driver - DriverStartIo = (nil) 0031:trace:ntoskrnl:init_driver - DriverUnload = 0x1400291c0 0031:trace:ntoskrnl:init_driver - MajorFunction[0] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[1] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[2] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[3] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[4] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[5] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[6] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[7] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[8] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[9] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[10] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[11] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[12] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[13] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[14] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[15] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[16] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[17] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[18] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[19] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[20] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[21] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[22] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[23] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[24] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[25] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[26] = 0x1400291d4 0031:trace:ntoskrnl:init_driver - MajorFunction[27] = 0x7f5fb4af35c0 0031:trace:ntoskrnl:ObDereferenceObject (0x27940) ref=0 ... 0031:err:ntoskrnl:ZwLoadDriver failed to create driver L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\mracdrv": c000009a ... --- snip --- That's bug 37355 $ sha1sum WarfaceMycomLoader_805e0da40d16630c2fe73ed12399cb48_.exe b07e87a029d6697ad823dc03fdbf297c406a91b9 WarfaceMycomLoader_805e0da40d16630c2fe73ed12399cb48_.exe $ du -sh WarfaceMycomLoader_805e0da40d16630c2fe73ed12399cb48_.exe 6.8M WarfaceMycomLoader_805e0da40d16630c2fe73ed12399cb48_.exe $ wine --version wine-4.6-61-g085e58878f Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47047 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, obfuscation, | |win64 URL| |https://web.archive.org/web | |/20190331063634/http://stat | |ic.gc.my.com/WarfaceMycomLo | |ader.exe#0.7927247509897362 -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47047 Jacek Caban <jacek(a)codeweavers.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jacek(a)codeweavers.com --- Comment #1 from Jacek Caban <jacek(a)codeweavers.com> --- Created attachment 64757 --> https://bugs.winehq.org/attachment.cgi?id=64757 hack The attached hack gets the driver past this bug and but 37355. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47047 Gijs Vermeulen <gijsvrm(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |werifGX(a)gmail.com --- Comment #2 from Gijs Vermeulen <gijsvrm(a)gmail.com> --- *** Bug 47890 has been marked as a duplicate of this bug. *** -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47047 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|64-bit MRAC Anti-Cheat |Multiple kernel drivers |(My.Com Warface) kernel |crash due to missing |service crashes in driver |'ntoskrnl.exe.MmGetPhysical |entry point due to missing |Address' semi-stub (64-bit |'ntoskrnl.exe.MmGetPhysical |MRAC Anti-Cheat (My.Com |Address' stub |Warface) kernel service, | |DELL BIOS flash utility) --- Comment #3 from Anastasius Focht <focht(a)gmx.net> --- Hello folks, revisiting, still present. The app/driver from bug 48674 (Dell Latitude E7250 System BIOS flash utility/driver) also needs this, hence refining summary. https://web.archive.org/web/20200228173348/https://dl.dell.com/FOLDER0562794... --- snip --- $ WINEDEBUG=+seh,+relay,+service,+ntoskrnl wine ./E7250A21.exe >>log.txt 2>&1 ... 0009:Call KERNEL32.CreateFileA(00464fa4 "\\\\.\\DBUtil_2_3",c0000000,00000000,00000000,00000003,00000080,00000000) ret=004418c3 ... 0009:Ret KERNEL32.CreateFileA() retval=00000058 ret=004418c3 ... 0009:Call KERNEL32.DeviceIoControl(00000058,9b0c1ec0,0032fa54,00000030,0032fa54,00000030,0032fa3c,00000000) ret=00441901 ... 002f:Call driver dispatch 0000000000911170 (device=00000000003E2E50,irp=0000000000450330) ... 002f:Ret driver dispatch 0000000000911170 (device=00000000003E2E50,irp=0000000000450330) retval=00000000 ... 002f:trace:ntoskrnl:dispatch_ioctl ioctl 9b0c1ec0 device 00000000003E2E50 file 00000000003E31B0 in_size 48 out_size 48 002f:trace:ntoskrnl:IoBuildDeviceIoControlRequest 9b0c1ec0, 00000000003E2E50, 00000000003E1920, 48, 00000000003E1920, 48, 0, 0000000000000000, 0000000000000000 ... 002f:Call driver dispatch 0000000000911170 (device=00000000003E2E50,irp=0000000000450330) 002f:Call ntoskrnl.exe.MmAllocateContiguousMemorySpecifyCache(00000050,00100000,ffff0000,00000000,00000000) ret=0091524a 002f:fixme:ntoskrnl:MmAllocateContiguousMemorySpecifyCache 80, 100000 ffff0000 0 0 stub 002f:Call KERNEL32.VirtualAlloc(00000000,00000050,00003000,00000204) ret=7bc9fdef 002f:Call ntdll.NtAllocateVirtualMemory(ffffffffffffffff,008ff740,00000000,008ff748,00003000,00000204) ret=7b027763 002f:Ret ntdll.NtAllocateVirtualMemory() retval=00000000 ret=7b027763 002f:Ret KERNEL32.VirtualAlloc() retval=00a60000 ret=7bc9fdef 002f:Ret ntoskrnl.exe.MmAllocateContiguousMemorySpecifyCache() retval=00a60000 ret=0091524a 002f:Call KERNEL32.RaiseException(80000100,00000001,00000002,008ff7f0) ret=18001c228 ... 002f:trace:seh:raise_exception code=80000100 flags=1 addr=0x7b00f495 ip=7b00f495 tid=002f 002f:trace:seh:raise_exception info[0]=0000000180036000 002f:trace:seh:raise_exception info[1]=0000000180038b18 wine: Call from 0x7b00f495 to unimplemented function ntoskrnl.exe.MmGetPhysicalAddress, aborting ... wine: Unimplemented function ntoskrnl.exe.MmGetPhysicalAddress called at address 000000007B00F495 (thread 002f), starting debugger... --- snip --- $ sha1sum E7250A21.exe ce5578f5c9ee0160a4a8f37c83c6a0c14c10a4f6 E7250A21.exe $ du -sh E7250A21.exe 8.6M E7250A21.exe $ wine --version wine-5.2-312-gc6b852e3c3 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47047 Olivier F. R. Dierick <o.dierick(a)piezo-forte.be> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Multiple kernel drivers |Multiple kernel drivers |crash due to missing |crash due to missing |'ntoskrnl.exe.MmGetPhysical |'ntoskrnl.exe.MmGetPhysical |Address' semi-stub (64-bit |Address' semi-stub (64-bit |MRAC Anti-Cheat (My.Com |MRAC Anti-Cheat (My.Com |Warface) kernel service, |Warface) kernel service, |DELL BIOS flash utility) |DELL BIOS flash utility, | |BattlEye Anti-Cheat) CC| |o.dierick(a)piezo-forte.be -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47047 François Gouget <fgouget(a)codeweavers.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |patch CC| |fgouget(a)codeweavers.com -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47047 Alex Henrie <alexhenrie24(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|NEW |RESOLVED CC| |alexhenrie24(a)gmail.com Fixed by SHA1| |c5c9c589743f921ce3dd0961cf0 | |51b0861fd75e7 --- Comment #4 from Alex Henrie <alexhenrie24(a)gmail.com> --- Fixed by https://source.winehq.org/git/wine.git/commitdiff/c5c9c589743f921ce3dd0961cf... -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47047 Alexandre Julliard <julliard(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #5 from Alexandre Julliard <julliard(a)winehq.org> --- Closing bugs fixed in 6.15. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47047 Michael Stefaniuc <mstefani(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|--- |6.0.x -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47047 Michael Stefaniuc <mstefani(a)winehq.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Target Milestone|6.0.x |--- --- Comment #6 from Michael Stefaniuc <mstefani(a)winehq.org> --- Removing the 6.0.x milestone from bug fixes included in 6.0.3. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (2)
-
wine-bugs＠winehq.org -
WineHQ Bugzilla