[Bug 59644] New: Enigma Virtual Box packed applications fail with file access errors since commit 35916176078

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59644

            Bug ID: 59644
           Summary: Enigma Virtual Box packed applications fail with file
                    access errors since commit 35916176078
           Product: Wine
           Version: 11.6
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: kernel32
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail]
   Regression SHA1: 3591617607890a1443c4b0bc2586a27f0c24608d
      Distribution: ArchLinux

Applications packed with Enigma Virtual Box (EVB) that use file virtualization
fail to start on Wine since commit 3591617607890a14 (
"kernelbase: Replace FileAllInformation with FileStatInformation in
GetFileInformationByHandle()".

EVB embeds application files inside the executable and hooks
NtQueryInformationFile to intercept file metadata queries for its virtual
files. The hook handles known info classes including FileAllInformation (class
18) but does not handle the newer FileStatInformation (class 68). When the
unrecognized class 68 passes through the hook, Wine's native handler queries
the raw stand-in device handle and returns incorrect data.

Steps to reproduce:
1. Obtain an application packed with Enigma Virtual Box that virtualizes files
(application assets embedded inside executable, not on disk). A NW.js
application with EVB packing is a common example.
2. Run the packed executable under Wine:
   WINEPREFIX=/path/to/prefix wine application.exe

Expected results:
The application starts normally. EVB's file virtualization works and the
application can access its embedded files.

Actual results:
The application fails with file access errors. For NW.js applications this
manifests as "UNKNOWN, unknown error" or "TypeError: Bad argument" because
GetFileInformationByHandle returns incorrect file metadata.

Regression test:
Bisected to the exact commit. Three Wine builds tested 3 times each, each with
its own dedicated clean WINEPREFIX (initialized with wineboot -i, no DLL
overrides, no third-party wrappers):

=== 5641e4aa83b (parent of breaking commit) ===
Run 1: (no error)
Run 2: (no error)
Run 3: (no error)

=== 35916176078 (breaking commit — FileStatInformation) ===
Run 1: [err] Uncaught Error: UNKNOWN, unknown error 'S:\'
Run 2: [err] Uncaught TypeError: Bad argument
Run 3: [err] Uncaught Error: UNKNOWN, unknown error 'S:\'

=== 01c0792b42f (revert on top of Wine 11.6 504683b22d3)  ===
Run 1: (no error)
Run 2: (no error)
Run 3: (no error)

Analysis:
EVB hooks NtQueryInformationFile with an inline JMP patch (0xE9). The hook
dispatches on the FileInformationClass parameter. It handles
FileBasicInformation (4), FileStandardInformation (5), and FileAllInformation
(18), but does NOT handle FileStatInformation (68).

EVB virtualizes files by returning a \Device\Null stand-in handle from
NtCreateFile. When GetFileInformationByHandle uses class 18, EVB intercepts and
returns correct virtual file attributes. When it uses class 68, EVB doesn't
recognize it, the call falls through to Wine's native handler which queries the
raw NUL device, and the returned metadata is meaningless.

Confirmed by calling NtQueryInformationFile directly on an EVB stand-in handle
with a sentinel-filled buffer:
- Class 5 and 18: EVB intercepts, returns correct EndOfFile (17714 bytes), zero
unwritten sentinel bytes
- Class 68: EVB does not intercept, falls through, returns device attributes

GetFileInformationByHandle in kernelbase is NOT hooked by EVB — it relies on
intercepting the NtQueryInformationFile call that kernelbase makes internally.

Proposed fix:
Revert the FileStatInformation change in GetFileInformationByHandle back to
FileAllInformation. If the original fix for Wine-Bug #46070 regresses, a more
targeted fix for that specific case would be preferable to changing the info
class globally.

Test application characteristics:
- PE32 (x86), 30.5 MB, 11 unnamed sections (Enigma Protector characteristic)
- Entry point 0x0308fd9c inside writable .data section (EP unpacker stub)
- Linker version 10.0, PE timestamp 2014-02-25
- Enigma Protector CA certificate issued 2016-01-27 (EP version circa 4.x-5.x)
- Inner application: NW.js 0.12.3 (Chromium 41 / io.js 1.2 / V8 4.1)
- Enigma Virtual Box virtualizes src/, node_modules/, package.json and other
assets inside the executable

Environment:
- Arch Linux x86_64 (kernel 6.19.11)
- Wine 11.6 (master at 504683b22d3)

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59644] Enigma Virtual Box packed applications fail with file access errors since commit 35916176078

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59644

--- Comment #1 from [e-mail] ---
For reproduction, a freely available application that exhibits this bug can be
downloaded from https://www.dlsite.com/soft/work/=/product_id/VJ012491.html

This is a freeware title distributed through DLsite that uses Enigma Virtual
Box
for file virtualization.
Note that a free DLsite account registration is required
to download it.
The download provides a startup.exe packed with EVB.

If anyone knows of a more easily obtainable EVB-packed application that can
serve as a test case, please suggest it.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59644] Enigma Virtual Box packed applications fail with file access errors since commit 35916176078

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59644

[e-mail] changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://bugs.winehq.org/sho
                   |                            |w_bug.cgi?id=46070

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59644] Enigma Virtual Box packed applications fail with file access errors since commit 35916176078

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59644

Austin English <[e-mail]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |regression

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59644] Enigma Virtual Box packed applications fail with file access errors since commit 35916176078

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59644

--- Comment #2 from Jinoh Kang <[e-mail]> ---
Mere revert will bring bug #46070 back.

The real problem is that FileAllInformation erroneously returns
STATUS_INVALID_INFO_CLASS for unix-originating files, instead of returning at
least some dummy path.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59644] Enigma Virtual Box packed applications fail with file access errors since commit 35916176078

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59644

Sagawa <[e-mail]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sagawa.aki+winebugs@gmail.c
                   |                            |om

--- Comment #3 from Sagawa <[e-mail]> ---
a1678991, could you retest this with the current git or with Wine 11.7 and see
if the problem persists?

Jinoh's merge request[1] was merged into the main trunk before the 11.7
release.

[1] https://gitlab.winehq.org/wine/wine/-/merge_requests/10651

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59644] Enigma Virtual Box packed applications fail with file access errors since commit 35916176078

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59644

[e-mail] changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Fixed by SHA1|                            |afdd5788037194a3d25ad5db091
                   |                            |a965e28b8144a

--- Comment #4 from [e-mail] ---
I have confirmed fix on wine build from current git.

Retested with the same EVB-packed test application in a fresh WINEPREFIX.
The application now starts normally and can access its virtualized files.

Thanks to Jinoh Kang for the quick turnaround.
This bug can be closed as RESOLVED FIXED.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59644] Enigma Virtual Box packed applications fail with file access errors since commit 35916176078

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59644

--- Comment #5 from Jinoh Kang <[e-mail]> ---
(In reply to a1678991 from comment #4)
> I have confirmed fix on wine build from current git.
>
> Retested with the same EVB-packed test application in a fresh WINEPREFIX.
> The application now starts normally and can access its virtualized files.
>
> Thanks to Jinoh Kang for the quick turnaround.
> This bug can be closed as RESOLVED FIXED.

Feel free to change the status yourself.

Also note that "Fixed by SHA1" will be ignored unless you change the status at
the same time.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59644] Enigma Virtual Box packed applications fail with file access errors since commit 35916176078

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59644

[e-mail] changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #6 from [e-mail] ---
Change status to RESOLVED FIXED

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.

[Bug 59644] Enigma Virtual Box packed applications fail with file access errors since commit 35916176078

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=59644

Alexandre Julliard <[e-mail]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #7 from Alexandre Julliard <[e-mail]> ---
Closing bugs fixed in 11.8.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.