[Bug 47783] New: Rockstar Games Launcher installer crashes
https://bugs.winehq.org/show_bug.cgi?id=47783 Bug ID: 47783 Summary: Rockstar Games Launcher installer crashes Product: Wine Version: 4.16 Hardware: x86 URL: https://gamedownloads.rockstargames.com/public/install er/Rockstar-Games-Launcher.exe OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: ntdll Assignee: wine-bugs(a)winehq.org Reporter: bshanks(a)codeweavers.com Distribution: --- The Rockstar Games Launcher installer (downloadable from https://gamedownloads.rockstargames.com/public/installer/Rockstar-Games-Laun...) displays a window and then crashes quickly after launching. Running the installer with "warn+all" generates constant heap corruption errors ( i.e. "err:heap:HEAP_ValidateInUseArena Heap 0x110000: block 0x198350 tail overwritten at 0x198388 (byte 0/8 == 0x52)"), but the installer does not crash and successfully installs. The installer is built with NSIS v3.04, and essentially does the following: WINDOWINFO *wi = GlobalAlloc(GMEM_ZEROINIT, 56); wi->cbSize = 56; GetWindowInfo(hWnd, wi); GlobalFree(wi); The problem is that sizeof(WINDOWINFO) is actually 60. For some reason Windows has always ignored cbSize and writes 60 bytes into the buffer, Wine does the same. The hard-coded 56 has been in NSIS example code (https://nsis.sourceforge.io/GetWindowInfo) for years, it's very possible there are other installers having this problem. Based on this article (https://blogs.msdn.microsoft.com/jiangyue/2010/03/15/windows-heap-overrun-mo...) and some testing I did in a debugger, it appears that Windows heap allocations leave healthy padding/unused bytes at the end, and this must be why the installer doesn't crash on Windows. Running Wine with "warn+heap" adds padding to the end of heap allocations, which is why the installer doesn't crash there. I think the fix for this is to increase/add padding to the end of heap allocations. Also a WARN should be added to GetWindowInfo() if cbSize is incorrect. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47783 Andrew Eikum <aeikum(a)codeweavers.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |aeikum(a)codeweavers.com -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47783 Maik Wagner <maiktapwagner(a)aol.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |maiktapwagner(a)aol.com --- Comment #1 from Maik Wagner <maiktapwagner(a)aol.com> --- Created attachment 65294 --> https://bugs.winehq.org/attachment.cgi?id=65294 Console output - wine 4.15 (staging) Confirming with wine 4.15 (Staging). On my first installation the launcher starts up but I had some font problems with language selection so I thought I do a winetricks corefonts which resulted in the attached console output. The launcher opens briefly but closes shortly afterwards. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47783 --- Comment #2 from Gijs Vermeulen <gijsvrm(a)gmail.com> --- Brendan, was this fixed by: <https://source.winehq.org/git/wine.git/commit/c8dbb0c4c1ec4cc7979715a6ebc02ece90ae220e>? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47783 --- Comment #3 from Brendan Shanks <bshanks(a)codeweavers.com> --- (In reply to Gijs Vermeulen from comment #2)
Brendan, was this fixed by: <https://source.winehq.org/git/wine.git/commit/ c8dbb0c4c1ec4cc7979715a6ebc02ece90ae220e>?
No it wasn't. A patch like https://github.com/ValveSoftware/wine/commit/e485252dfad51a7e463643d56fe1381... is what's needed. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47783 Louis Lenders <xerox.xerox2000x(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |NEW CC| |xerox.xerox2000x(a)gmail.com Ever confirmed|0 |1 Keywords| |download --- Comment #4 from Louis Lenders <xerox.xerox2000x(a)gmail.com> --- Still present. A user reported this as rated garbage in AppDB Tested wine-5.8 (Staging) sha1sum Rockstar-Games-Launcher.exe 46575e80cc5c3a6c99e0ec364cb1489dc6b16aca Rockstar-Games-Launcher.exe -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47783 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |focht(a)gmx.net --- Comment #5 from Anastasius Focht <focht(a)gmx.net> --- Hello folks, I've encountered this as well while testing for a different issue, still present. Good job, Brendan. --- snip --- $ pwd /home/focht/wine-games/wineprefix64-steam/drive_c/Program Files (x86)/Steam/steamapps/common/Grand Theft Auto V/Installers $ WINEDEBUG=+seh,+relay,+server wine ./Rockstar-Games-Launcher.exe >>log.txt 2>&1 ... 0024:Call KERNEL32.GetModuleHandleW(0040bf38 L"C:\\users\\focht\\Temp\\nse7cc6.tmp\\System.dll") ret=004022d3 ... 0024:Ret KERNEL32.GetModuleHandleW() retval=01810000 ret=004022d3 ... 0024:Call KERNEL32.GlobalAlloc(00000040,00000038) ret=01811035 0024:Call ntdll.RtlAllocateHeap(00110000,00000008,00000038) ret=7b02791f 0024:Ret ntdll.RtlAllocateHeap() retval=00d0daa8 ret=7b02791f 0024:Ret KERNEL32.GlobalAlloc() retval=00d0daa8 ret=01811035 ... 0024:Call user32.GetWindowInfo(00010082,00d0daa8) ret=01812b35 0024: get_thread_input( tid=0024 ) 0024: get_thread_input() = 0 { focus=00010060, capture=00000000, active=00020040, foreground=00020040, menu_owner=00000000, move_size=00000000, caret=00000000, cursor=00000000, show_count=0, rect={0,0;0,0} } 0024:Ret user32.GetWindowInfo() retval=00000001 ret=01812b35 ... 0024:Call user32.wvsprintfW(0042ab40,0040a8c0 L"File: overwriteflag=%d, allowskipfilesflag=%d, name=\"%s\"",0031e578) ret=00406dc1 0024:Ret user32.wvsprintfW() retval=0000005e ret=00406dc1 ... 0024:Call KERNEL32.GetFileAttributesW(0040b738 L"C:\\users\\focht\\Temp\\nse7cc6.tmp\\System.dll") ret=00406338 0024:Call ntdll.RtlDosPathNameToNtPathName_U(0040b738 L"C:\\users\\focht\\Temp\\nse7cc6.tmp\\System.dll",0031e4f0,00000000,00000000) ret=7b01380a 0024:Ret ntdll.RtlDosPathNameToNtPathName_U() retval=00000001 ret=7b01380a 0024:Call ntdll.NtQueryAttributesFile(0031e4d8,0031e4f8) ret=7b013847 0024:Ret ntdll.NtQueryAttributesFile() retval=00000000 ret=7b013847 0024:Call ntdll.RtlFreeUnicodeString(0031e4f0) ret=7b013850 0024:trace:seh:KiUserExceptionDispatcher code=c0000005 flags=0 addr=0x7bc5935b ip=7bc5935b tid=0024 0024:trace:seh:KiUserExceptionDispatcher info[0]=00000000 0024:trace:seh:KiUserExceptionDispatcher info[1]=00000000 0024:trace:seh:KiUserExceptionDispatcher eax=00000000 ebx=00c10000 ecx=00000070 edx=00d0dae0 esi=00000000 edi=00110000 0024:trace:seh:KiUserExceptionDispatcher ebp=0031e3b8 esp=0031e350 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00210202 0024:trace:seh:call_vectored_handlers calling handler at 0x7b637a80 code=c0000005 flags=0 0024:trace:seh:call_vectored_handlers handler at 0x7b637a80 returned 0 0024:trace:seh:call_stack_handlers calling handler at 0x7e9cd860 code=c0000005 flags=0 ... 0024:Ret dialog proc 0x1da1407 (hwnd=0x20040,msg=WM_NCACTIVATE,wp=00000000,lp=00000000) retval=00000000 result=00000000 0024:trace:seh:KiUserExceptionDispatcher code=c0000005 flags=0 addr=0x7e9971c3 ip=7e9971c3 tid=0024 0024:trace:seh:KiUserExceptionDispatcher info[0]=00000000 0024:trace:seh:KiUserExceptionDispatcher info[1]=01ee75b4 0024:trace:seh:KiUserExceptionDispatcher eax=00000000 ebx=01ee75a0 ecx=0031e360 edx=00000000 esi=00010053 edi=00000000 0024:trace:seh:KiUserExceptionDispatcher ebp=0031e3a8 esp=0031e380 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00210246 0024:trace:seh:call_vectored_handlers calling handler at 0x7b637a80 code=c0000005 flags=0 0024:trace:seh:call_vectored_handlers handler at 0x7b637a80 returned 0 0024:trace:seh:call_stack_handlers calling handler at 0x7b657c40 code=c0000005 flags=0 ... wine: Unhandled page fault on read access to 01EE75B4 at address 7E9971C3 (thread 0024), starting debugger... --- snip --- ProtectionID scan: --- snip --- -=[ ProtectionID v0.6.9.0 DECEMBER]=- (c) 2003-2017 CDKiLLER & TippeX Build 24/12/17-21:05:42 Ready... Scanning -> C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto V\Installers\Rockstar-Games-Launcher.exe File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 81577008 (04DCC430h) Byte(s) | Machine: 0x14C (I386) Compilation TimeStamp : 0x5C157FD0 -> Sat 15th Dec 2018 22:27:28 (GMT) [TimeStamp] 0x5C157FD0 -> Sat 15th Dec 2018 22:27:28 (GMT) | PE Header | - | Offset: 0x000000D0 | VA: 0x004000D0 | - -> File Appears to be Digitally Signed @ Offset 04DCA7A0h, size : 01C90h / 07312 byte(s) -> File has 81222048 (04D759A0h) bytes of appended data starting at offset 054E00h [File Heuristics] -> Flag #1 : 00000000000001011101000000000100 (0x0005D004) [Entrypoint Section Entropy] : 6.48 (section #0) ".text " | Size : 0x6AA7 (27303) byte(s) [DllCharacteristics] -> Flag : (0x8540) -> ASLR | DEP | NOSEH | TSA [SectionCount] 5 (0x5) | ImageSize 0xFB000 (1028096) byte(s) [VersionInfo] Company Name : Rockstar Games. [VersionInfo] Product Name : Rockstar Games Launcher [VersionInfo] File Description : Rockstar Games Launcher [VersionInfo] File Version : 1.0.19.234 [VersionInfo] Version Comments : Rockstar Games Launcher [VersionInfo] Legal Trademarks : Rockstar Games Inc. (C) 2005-2019 Take Two Interactive. All rights reserved [VersionInfo] Legal Copyrights : Rockstar Games Inc. (C) 2005-2019 Take Two Interactive. All rights reserved [ModuleReport] [IAT] Modules -> KERNEL32.dll | USER32.dll | GDI32.dll | SHELL32.dll | ADVAPI32.dll | COMCTL32.dll | ole32.dll [-= Installer =-] Nullsoft SFX Setup v3.04 - Scan Took : 0.295 Second(s) [000000127h (295) tick(s)] [566 of 580 scan(s) done] --- snip --- The decompiled script from the NSIS installer matches Brendan's link to the example. You can use 7-Zip 15.05 or earlier versions to extract/decompile it from the installer. --- snip --- ... System::Alloc 56 ; Call Initialize_____Plugins ; SetOverwrite off ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push 56 ; CallInstDLL $PLUGINSDIR\System.dll Alloc Pop $0 System::Call "*$0(i 56)" ; Call Initialize_____Plugins ; AllowSkipFiles off ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push "*$0(i 56)" ; CallInstDLL $PLUGINSDIR\System.dll Call System::Call "User32::GetWindowInfo(i $HWNDPARENT,i r0) i .r1" ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push "User32::GetWindowInfo(i $HWNDPARENT,i r0) i .r1" ; CallInstDLL $PLUGINSDIR\System.dll Call IntOp $R0 $0 + 4 System::Call "*$R0(i .r1,i .r2,i .r3,i .r4)" ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push "*$R0(i .r1,i .r2,i .r3,i .r4)" ; CallInstDLL $PLUGINSDIR\System.dll Call System::Free $0 ; Call Initialize_____Plugins ; File $PLUGINSDIR\System.dll ; SetDetailsPrint lastused ; Push $0 ; CallInstDLL $PLUGINSDIR\System.dll Free --- snip --- There are many occurrences of same pattern in the decompiled '[NSIS].nsi' file. As Brendan said, it's likely that more NSIS 3.x installers suffer from this problem under Wine as packagers rarely bother to pay attention to these details in example code. --- snip --- $ pwd /home/focht/wine-games/wineprefix64-steam/drive_c/Program Files (x86)/Steam/steamapps/common/Grand Theft Auto V/Installers $ sha1sum * b4e5e3045dba165127b7ce846560f25bd4c25d5b Rockstar-Games-Launcher.exe 95ac91cabe50e2338805c07bd0808f809e92a39d Social-Club-Setup.exe $ du -sh * 78M Rockstar-Games-Launcher.exe 92M Social-Club-Setup.exe --- snip --- $ wine --version wine-5.10-247-gf8955cfb0f Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47783 Brendan Shanks <bshanks(a)codeweavers.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |NOTOURBUG --- Comment #6 from Brendan Shanks <bshanks(a)codeweavers.com> --- Last September, the Rockstar Games Launcher installer was rewritten. It's now a 64-bit EXE and no longer uses NSIS. This bug is no longer present. Note that games which package the RGL installer (such as GTA IV or V from Steam/EGS) may still have an old version which contains this bug, but the latest one downloadable from Rockstar does not. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=47783 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |Installer URL|https://gamedownloads.rocks |https://web.archive.org/web |targames.com/public/install |/20201012181705/https://gam |er/Rockstar-Games-Launcher. |edownloads.rockstargames.co |exe |m/public/installer/Rockstar | |-Games-Launcher.exe --- Comment #7 from Anastasius Focht <focht(a)gmx.net> --- Hello folks, adding stable download link via Internet Archive for documentation. https://web.archive.org/web/20201012181705/https://gamedownloads.rockstargam... https://www.virustotal.com/gui/file/207b996eb9106c01e62695b7ef5f8618ca5e31c7... $ sha1sum Rockstar-Games-Launcher.exe da28fdfc0c8ed40ada375b764fd03bfb8800b200 Rockstar-Games-Launcher.exe $ du -sh Rockstar-Games-Launcher.exe 82M Rockstar-Games-Launcher.exe Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla