[Bug 49193] New: Denuvo Anti-Cheat 'denuvo-anti-cheat.sys' needs 'wdfldr.sys'
https://bugs.winehq.org/show_bug.cgi?id=49193 Bug ID: 49193 Summary: Denuvo Anti-Cheat 'denuvo-anti-cheat.sys' needs 'wdfldr.sys' Product: Wine Version: 5.8 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs(a)winehq.org Reporter: focht(a)gmx.net Distribution: --- Hello folks, as it says. Continuation of bug 49192 Disclaimer for the general populace, to avoid these stupid comments on Reddit/your-favourite-gossip-site: This is not an attempt to make anything work. --- snip --- $ WINEDEBUG=+seh,+relay,+ntoskrnl wine net start "Denuvo Anti-Cheat" >>log.txt 2>&1 ... 00d0:trace:ntoskrnl:load_driver loading driver L"C:\\Program Files\\Denuvo Anti-Cheat\\denuvo-anti-cheat.sys" 00d0:Call KERNEL32.LoadLibraryW(0078eff0 L"C:\\Program Files\\Denuvo Anti-Cheat\\denuvo-anti-cheat.sys") ret=00236828 ... 00d0:err:module:import_dll Library netio.sys (which is needed by L"C:\\Program Files\\Denuvo Anti-Cheat\\denuvo-anti-cheat.sys") not found ... 00d0:err:module:import_dll Library wdfldr.sys (which is needed by L"C:\\Program Files\\Denuvo Anti-Cheat\\denuvo-anti-cheat.sys") not found 00d0:Ret ntdll.LdrLoadDll() retval=c0000135 ret=7b01d770 ... 00d0:Ret KERNEL32.LoadLibraryW() retval=00000000 ret=00236828 ... 00d0:trace:ntoskrnl:IoDeleteDriver (00000000000FB930) ... 00d0:err:ntoskrnl:ZwLoadDriver failed to create driver L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\Denuvo Anti-Cheat": c0000142 --- snip --- --- snip --- $ winedump -j import drive_c/Program\ Files/Denuvo\ Anti-Cheat/denuvo-anti-cheat.sys Contents of drive_c/Program Files/Denuvo Anti-Cheat/denuvo-anti-cheat.sys: 1553128 bytes Import Table size: 00000050 offset 0017381c netio.sys Hint/Name Table: 0017F670 TimeDateStamp: 00000000 (Thu Jan 1 01:00:00 1970) ForwarderChain: 00000000 First thunk RVA: 0017F000 Thunk Ordn Name 0017f000 1 WskDeregister 0017f008 2 WskRegister 0017f010 3 WskReleaseProviderNPI 0017f018 0 WskCaptureProviderNPI offset 00173830 ntoskrnl.exe Hint/Name Table: 0017F698 TimeDateStamp: 00000000 (Thu Jan 1 01:00:00 1970) ForwarderChain: 00000000 First thunk RVA: 0017F028 Thunk Ordn Name 0017f028 0 ExAcquireFastMutex 0017f030 1 ExAllocatePoolWithQuotaTag 0017f038 2 ExAllocatePoolWithTag 0017f040 3 ExCreateCallback 0017f048 4 ExFreePoolWithTag 0017f050 5 ExRegisterCallback 0017f058 6 ExReleaseFastMutex 0017f060 7 ExUnregisterCallback 0017f068 8 IoAllocateIrp 0017f070 9 IoAllocateMdl 0017f078 10 IoFreeIrp 0017f080 11 IoFreeMdl 0017f088 12 IoGetCurrentProcess 0017f090 13 IoGetInitialStack 0017f098 14 IoReuseIrp 0017f0a0 15 KdDebuggerEnabled 0017f0a8 16 KdRefreshDebuggerNotPresent 0017f0b0 17 KeAcquireSpinLockAtDpcLevel 0017f0b8 18 KeAcquireSpinLockRaiseToDpc 0017f0c0 19 KeBugCheckEx 0017f0c8 20 KeCancelTimer 0017f0d0 21 KeDelayExecutionThread 0017f0d8 22 KeGenericCallDpc 0017f0e0 23 KeGetCurrentProcessorNumberEx 0017f0e8 24 KeInitializeDpc 0017f0f0 25 KeInitializeEvent 0017f0f8 26 KeInitializeMutex 0017f100 27 KeInitializeTimer 0017f108 28 KeLowerIrql 0017f110 29 KeQueryActiveProcessorCountEx 0017f118 30 KeReleaseMutex 0017f120 31 KeReleaseSpinLock 0017f128 32 KeReleaseSpinLockFromDpcLevel 0017f130 33 KeRevertToUserAffinityThreadEx 0017f138 34 KeSetEvent 0017f140 35 KeSetSystemAffinityThreadEx 0017f148 36 KeSetTimer 0017f150 37 KeSignalCallDpcDone 0017f158 38 KeSignalCallDpcSynchronize 0017f160 39 KeStackAttachProcess 0017f168 40 KeUnstackDetachProcess 0017f170 41 KeWaitForSingleObject 0017f178 42 KfRaiseIrql 0017f180 43 MmBuildMdlForNonPagedPool 0017f188 44 MmGetPhysicalAddress 0017f190 45 MmGetSystemRoutineAddress 0017f198 46 MmGetVirtualForPhysical 0017f1a0 47 MmIsAddressValid 0017f1a8 48 MmMapIoSpace 0017f1b0 49 MmUnmapIoSpace 0017f1b8 50 ObOpenObjectByPointer 0017f1c0 51 ObReferenceObjectByHandle 0017f1c8 52 ObRegisterCallbacks 0017f1d0 53 ObUnRegisterCallbacks 0017f1d8 54 ObfDereferenceObject 0017f1e0 55 ObfReferenceObject 0017f1e8 56 PsCreateSystemThread 0017f1f0 57 PsGetCurrentProcessId 0017f1f8 58 PsGetCurrentThreadTeb 0017f200 59 PsGetProcessId 0017f208 60 PsGetThreadProcessId 0017f210 61 PsGetVersion 0017f218 62 PsLookupProcessByProcessId 0017f220 63 PsProcessType 0017f228 64 PsRemoveLoadImageNotifyRoutine 0017f230 65 PsSetLoadImageNotifyRoutine 0017f238 66 PsTerminateSystemThread 0017f240 67 PsThreadType 0017f248 68 RtlAnsiCharToUnicodeChar 0017f250 69 RtlAnsiStringToUnicodeString 0017f258 70 RtlCheckRegistryKey 0017f260 71 RtlCopyUnicodeString 0017f268 72 RtlFreeUnicodeString 0017f270 73 RtlGetVersion 0017f278 74 RtlInitAnsiString 0017f280 75 RtlInitUnicodeString 0017f288 76 RtlQueryRegistryValues 0017f290 77 RtlRandomEx 0017f298 78 RtlUnicodeToMultiByteN 0017f2a0 79 ZwClose 0017f2a8 80 ZwCreateFile 0017f2b0 81 ZwCreateKey 0017f2b8 82 ZwDeleteFile 0017f2c0 83 ZwDeleteKey 0017f2c8 84 ZwDeleteValueKey 0017f2d0 85 ZwDuplicateObject 0017f2d8 86 ZwLoadDriver 0017f2e0 87 ZwOpenFile 0017f2e8 88 ZwOpenProcess 0017f2f0 89 ZwQuerySystemInformation 0017f2f8 90 ZwQueryVirtualMemory 0017f300 91 ZwReadFile 0017f308 92 ZwSetValueKey 0017f310 93 ZwUnloadDriver 0017f318 94 ZwWriteFile 0017f320 95 __C_specific_handler 0017f328 96 __chkstk 0017f330 97 _purecall offset 00173844 wdfldr.sys Hint/Name Table: 0017F9B0 TimeDateStamp: 00000000 (Thu Jan 1 01:00:00 1970) ForwarderChain: 00000000 First thunk RVA: 0017F340 Thunk Ordn Name 0017f340 1 WdfVersionBindClass 0017f348 2 WdfVersionUnbind 0017f350 3 WdfVersionUnbindClass 0017f358 0 WdfVersionBind Done dumping drive_c/Program Files/Denuvo Anti-Cheat/denuvo-anti-cheat.sys --- snip --- When looking for interface/prototype definitions: Microsoft KMDF is open source. https://github.com/Microsoft/Windows-Driver-Frameworks https://github.com/microsoft/Windows-Driver-Frameworks/blob/master/src/frame... $ wine --version wine-5.8-173-g9e26bc8116 Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 Anastasius Focht <focht(a)gmx.net> changed: What |Removed |Added ---------------------------------------------------------------------------- URL| |https://store.steampowered. | |com/app/782330/ Keywords| |obfuscation -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 Zebediah Figura <z.figura12(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Denuvo Anti-Cheat |Multiple kernel drivers |'denuvo-anti-cheat.sys' |need |needs 'wdfldr.sys' |wdfldr.sys.WdfVersionBind | |function (Denuvo Anti-Cheat | |"denuvo-anti-cheat.sys", | |Steel Series Engine | |"ssdevfactory.sys") CC| |z.figura12(a)gmail.com --- Comment #1 from Zebediah Figura <z.figura12(a)gmail.com> --- Microsoft has made the actual source code of WDF available under the MIT license: <https://github.com/microsoft/Windows-Driver-Frameworks> This doesn't include the loader (either the driver or wdfldr.sys components), but if that can be implemented through normal black-box methods, I think we could make use of the published source to actually implement Wdf* functions. That said, I'm not sure how best to actually do so. The source is predictably ugly and all in C++, which makes importing it not particularly appealing, but there's no good reason to leave it in an external library. Perhaps porting it to C and rearranging it is the best option, but seems to be getting updates at least along with major releases of Windows 10... -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 --- Comment #2 from Anastasius Focht <focht(a)gmx.net> --- Hello Zeb, --- quote --- That said, I'm not sure how best to actually do so. The source is predictably ugly and all in C++, which makes importing it not particularly appealing, but there's no good reason to leave it in an external library. Perhaps porting it to C and rearranging it is the best option, but seems to be getting updates at least along with major releases of Windows 10... --- quote --- Microsoft promotes the porting of traditional WDM drivers to KDMF or UMDF for some years now. Vendors are catching up on this, specifically with Windows 10. https://docs.microsoft.com/en-us/windows-hardware/drivers/wdf/wdf-porting-gu... https://docs.microsoft.com/en-us/windows-hardware/drivers/wdf/differences-be... I've only seen two drivers (with your addition) mentioned with Wine bug reports as of now. Paul's stubbed wdfldr seemed to work for one driver but in the long run it's probably better to have a proper design/lib port as we're likely going to see more and more drivers using it. It might be worth to bring up the topic on wine-devel. Some opinions if a C port/internalization of the lib using Microsoft's WDF GitHub repo as reference is feasible. Regards -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 Paul Gofman <pgofman(a)codeweavers.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pgofman(a)codeweavers.com --- Comment #3 from Paul Gofman <pgofman(a)codeweavers.com> --- (In reply to Zebediah Figura from comment #1) Did you have a chance to see what kernel functions MS implementation depends on? I. e., how hard will it be to implement missing ones if we integrate that? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 --- Comment #4 from Zebediah Figura <z.figura12(a)gmail.com> --- I spent some time trying to compile the source, and also some time trying to port things to C. It may be too early to say this, but I'm leaning in favour of porting it all to C (or, really, rewriting it from scratch using the source as a reference). In particular: * There's quite a lot of internal headers missing, mostly around the area of the loader / glue to the public definitions. It doesn't seem to hard to reverse-engineer these bits, but the problem is that there are quite a lot of them. * Lots of missing pieces in mingw headers (or worse, Wine headers...) that would have to be filled in. * At least one WDF header (fxirp.h) is badly broken due to (accidentally?) deleted lines. * The C++ source depends on wdmlib, which would have to be reverse-engineered. I don't think this is a huge task, though. * Despite the obsessive versioning, I suspect that new updates aren't going to change the source for existing functions very much if at all. A brief look at the last update commit shows not a lot of functional change... I guess there's danger in thinking that a rewrite is less work just because I can get it to successfully call WdfDriverCreate() and return with relatively little effort, but when you combine that with the ugliness that maintaining that much C++ would imply... (In reply to Paul Gofman from comment #3)
Did you have a chance to see what kernel functions MS implementation depends on? I. e., how hard will it be to implement missing ones if we integrate that?
I did a quick grep for Io*, Ex*, Ke* functions used in the source. There don't actually seem to be a lot that we don't have already, and I wouldn't particularly expect there to be—inasmuch as WDF is a replacement for WDM but also built on top of it. Plus, if we do a source port/rewrite, we don't necessarily have to implement everything (or do it all at once), and we don't have to worry about things like bug-check callbacks or tracing... -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 qsniyg <qsniyg(a)mail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |qsniyg(a)mail.com --- Comment #5 from qsniyg <qsniyg(a)mail.com> --- Created attachment 68363 --> https://bugs.winehq.org/attachment.cgi?id=68363 wdfldr.sys stub I found this issue while looking for a wdfldr.sys stub, but for some reason I was unable to find Paul Gofman's patches anywhere. Gijs graciously provided them, so I've attached the patch (rebased on 5.18-git as of yesterday) in case anyone else might benefit from it. Is there an update on what is decided for how to upstream wdfldr.sys? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 --- Comment #6 from Zebediah Figura <z.figura12(a)gmail.com> --- I have some work on WDF in my local tree, but it's incomplete. I'd like to do more testing and fleshing out, including with a real WDF driver, before I finalize the architecture design. I haven't gotten to working on it in a while; I have more than a few other projects which I've given higher priority... -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 Anya <maniikarabera(a)protonmail.ch> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |maniikarabera(a)protonmail.ch -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 Pepper <tiagoapimenta(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |tiagoapimenta(a)gmail.com --- Comment #7 from Pepper <tiagoapimenta(a)gmail.com> --- Hello, The following app also requires this wdfldr.sys: https://appdb.winehq.org/objectManager.php?sClass=application&iId=20040 --- snip --- WINEDEBUG=+seh,+relay,+ntoskrnl wine net start mhyprot2 > mhyprot2.sys.log 2>&1 ... 00c9:err:module:import_dll Library WDFLDR.SYS (which is needed by L"C:\\users\\tiago\\Temp\\mhyprot2.sys") not found --- snip --- winedump -j import .wine/drive_c/users/tiago/Temp/mhyprot2.sys > mhyprot2.sys.dump ... --- snip --- offset 00009e50 WDFLDR.SYS Hint/Name Table: 0000E2B8 TimeDateStamp: 00000000 (Wed Dec 31 21:00:00 1969) ForwarderChain: 00000000 First thunk RVA: 00008028 Thunk Ordn Name 00008028 7 WdfVersionBindClass 00008030 6 WdfVersionBind 00008038 8 WdfVersionUnbind 00008040 9 WdfVersionUnbindClass --- snip --- # from windows: objdump -xs wdfldr.sys ... [Ordinal/Name Pointer] Table [ 0] DllInitialize [ 1] DllUnload [ 2] WdfLdrDiagnosticsValueByNameAsULONG [ 3] WdfLdrQueryInterface [ 4] WdfRegisterClassLibrary [ 5] WdfRegisterLibrary [ 6] WdfVersionBind [ 7] WdfVersionBindClass [ 8] WdfVersionUnbind [ 9] WdfVersionUnbindClass --- snip --- I don't know how it works, from tag wine-5.21, I created a dlls/wdfldr.sys based on dlls/scsiport.sys with the following stub: --- snip --- @ stub DllInitialize @ stub DllUnload @ stub WdfLdrDiagnosticsValueByNameAsULONG @ stub WdfLdrQueryInterface @ stub WdfRegisterClassLibrary @ stub WdfRegisterLibrary @ stub WdfVersionBind @ stub WdfVersionBindClass @ stub WdfVersionUnbind @ stub WdfVersionUnbindClass --- snip --- In the end generated a file at $WINEPREFIX/drive_c/windows/system32/drivers/wdfldr.sys the service still don't recognize it. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 Zebediah Figura <z.figura12(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Multiple kernel drivers |Multiple kernel drivers |need |need |wdfldr.sys.WdfVersionBind |wdfldr.sys.WdfVersionBind |function (Denuvo Anti-Cheat |function (Denuvo |"denuvo-anti-cheat.sys", |Anti-Cheat, Steel Series |Steel Series Engine |Engine, Genshin Impact) |"ssdevfactory.sys") | -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 --- Comment #8 from Pepper <tiagoapimenta(a)gmail.com> --- In fact there is some progress using a similar patch for stub wdfldr.sys after patch: --- snip --- WINEDEBUG=+seh,+relay,+ntoskrnl,wdfldr+all,ntoskrnl+all wine net start mhyprot2
mhyprot2.sys.log 2>&1 fgrep -i WDFLDR mhyprot2.sys.log ... 0108:trace:ntoskrnl:ldr_notify_callback loading L"WDFLDR.SYS" 0108:Call wdfldr.sys.WdfVersionBind(00042eb0,14000b3b8,14000a020,14000b3d8) ret=1400010ef 0108:fixme:wdfldr:WdfVersionBind Call KERNEL32.GetModuleHandleA(6c285180 "ntdll.dll") ret=6c2816db 0108:fixme:wdfldr:WdfVersionBind BindInfo Size 0x30, Component L"KmdfLibrary", Version 1.9.7600, FuncCount 396, f[0] 0000000000000000. 0108:Ret wdfldr.sys.WdfVersionBind() retval=00000000 ret=1400010ef 0108:Call wdfldr.sys.WdfVersionUnbind(14000b3b8,14000a020,6c288000) ret=14000117b 0108:fixme:wdfldr:WdfVersionUnbind RegistryPath L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\mhyprot2", BindInfo 000000014000A020, ComponentGlobals 000000006C288000. 0108:Ret wdfldr.sys.WdfVersionUnbind() retval=00000000 ret=14000117b --- snip ---
But the driver seems not to be created, should I file another bug for this one? --- snip --- fgrep ntoskrnl mhyprot2.sys.log ... 0108:Call ntoskrnl.exe.RtlInitUnicodeString(00c8fba0,00041520 L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\mhyprot2") ret=004012b2 0108:Ret ntoskrnl.exe.RtlInitUnicodeString() retval=0000007a ret=004012b2 0108:Call ntoskrnl.exe.ZwLoadDriver(00c8fba0) ret=004015f8 010c:Call ntoskrnl.exe.wine_ntoskrnl_main_loop(00000044) ret=00401ae0 0108:trace:ntoskrnl:ZwLoadDriver (L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\mhyprot2") 010c:trace:ntoskrnl:IoCreateDriver (L"\\Driver\\PnpManager", 0000000068C99350) 0108:trace:ntoskrnl:open_driver opened service for driver L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\mhyprot2" 0108:trace:ntoskrnl:IoCreateDriver (L"\\Driver\\mhyprot2", 0000000068C8FAF0) 0108:trace:ntoskrnl:load_driver loading driver L"C:\\users\\tiago\\Temp\\mhyprot2.sys" 0108:trace:ntoskrnl:ldr_notify_callback loading L"WDFLDR.SYS" 0108:trace:ntoskrnl:ldr_notify_callback loading L"mhyprot2.sys" ... 0108:trace:ntoskrnl:IoDeleteDriver (0000000000042EB0) 0108:trace:ntoskrnl:ObDereferenceObject (0000000000042EB0) ref=0 0108:err:ntoskrnl:ZwLoadDriver failed to create driver L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\mhyprot2": c0000008 0108:Ret ntoskrnl.exe.ZwLoadDriver() retval=c0000008 ret=004015f8 0108:Call ntoskrnl.exe.RtlNtStatusToDosError(c0000008) ret=00401600 0108:Ret ntoskrnl.exe.RtlNtStatusToDosError() retval=00000006 ret=00401600 0108:Call ntoskrnl.exe.RtlFreeUnicodeString(00c8fba0) ret=004012dc 0108:Ret ntoskrnl.exe.RtlFreeUnicodeString() retval=00000001 ret=004012dc --- snip --- I'm still trying to understand this ZwLoadDriver issue... -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 --- Comment #9 from Austin English <austinenglish(a)gmail.com> --- The patch doesn't install the driver in system32/syswow64 (which should go in loader/wine.inf.in) -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 --- Comment #10 from Pepper <tiagoapimenta(a)gmail.com> --- Created attachment 68632 --> https://bugs.winehq.org/attachment.cgi?id=68632 Patch to create wdfdr.sys (In reply to Austin English from comment #9)
The patch doesn't install the driver in system32/syswow64 (which should go in loader/wine.inf.in)
Well, I did a empty stub before seeing this bug, after realizing someone had alread done a patch I just incremented with the one qsniyg uploaded, my full environment is forked from tag wine-5.21, I have attached my patch for references, but is not so different from qsniyg one, and besides still not works due to ntoskrnl.ZwLoadDriver so... -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 Yajo <yajo.sk8(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |yajo.sk8(a)gmail.com -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 Esdras Tarsis <esdrastarsis(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |esdrastarsis(a)gmail.com -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 Zebediah Figura <z.figura12(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download URL|https://store.steampowered. |https://web.archive.org/web |com/app/782330/ |/20210101175629/https://eng | |ine.steelseriescdn.com/Stee | |lSeriesEngine3.17.3Setup.ex | |e -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 Jactry Zeng <jactry92(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jactry92(a)gmail.com -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 François Gouget <fgouget(a)codeweavers.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fgouget(a)codeweavers.com Keywords| |patch -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 selurvedu(a)dismail.de changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |selurvedu(a)dismail.de -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 Fabian Maurer <dark.shadow4(a)web.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |dark.shadow4(a)web.de --- Comment #11 from Fabian Maurer <dark.shadow4(a)web.de> --- Any progress or news on this one? -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 --- Comment #12 from Zebediah Figura <z.figura12(a)gmail.com> --- (In reply to Fabian Maurer from comment #11)
Any progress or news on this one?
Not since last time, no. It hasn't been high on my priority list and I haven't found a WDF driver that I can reasonably test with yet. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 Alex Henrie <alexhenrie24(a)gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |alexhenrie24(a)gmail.com --- Comment #13 from Alex Henrie <alexhenrie24(a)gmail.com> --- The Dell XPS 15 9570 System BIOS installer also needs this: https://dl.dell.com/FOLDER08877983M/1/XPS_9570_1.27.0.exe I don't expect Wine to actually be able to update the BIOS, but I was hoping to be able to extract the BIOS file and then trigger a BIOS update by writing the file to a magic location on the EFI partition. $ sha256sum XPS_9570_1.27.0.exe 2425954ba9a7cf7dc6571aaa68d6054a78f8e1349f714a4a0d5a3b8177caebdb -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=49193 soredake <broaden_acid002(a)simplelogin.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC|broaden_acid002(a)simplelogin | |.com | -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=49193 Stian Low <wineryyyyy@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wineryyyyy@gmail.com --- Comment #14 from Stian Low <wineryyyyy@gmail.com> --- Created attachment 81014 --> http://bugs.winehq.org/attachment.cgi?id=81014 vJoy logs err:module:import_dll Library WDFLDR.SYS WDFLDR.SYS missing also seems to bug vJoy: https://github.com/BrunnerInnovation/vJoy Found while testing joysticks virtually for: https://bugs.winehq.org/show_bug.cgi?id=59764 vJoy seems a useful tool worth supporting for testing purposes. Please let me know if other virtual joysticks may be used instead. Also, please let me know if there are more recent updates for WDF. I'll try some of these patches in the meantime. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=49193 --- Comment #15 from Stian Low <wineryyyyy@gmail.com> --- Created attachment 81015 --> http://bugs.winehq.org/attachment.cgi?id=81015 Logs after applying patch for https://bugs.winehq.org/show_bug.cgi?id=49193#c10 wine: Call from 00006FFFFFC4C368 to unimplemented function WDFLDR.SYS.WdfVersionBind, aborting wine: Unimplemented function WDFLDR.SYS.WdfVersionBind called at address 00006FFFFFC4C368 (thread 01d8), starting debugger... 01e8:fixme:dbghelp:elf_search_auxv can't find symbol in module 01e8:fixme:dbghelp:elf_search_auxv can't find symbol in module wine: Call from 00006FFFFFC4C368 to unimplemented function WDFLDR.SYS.WdfVersionBind, aborting -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=49193 Bgungor <baris.gungor.it@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |baris.gungor.it@gmail.com --- Comment #16 from Bgungor <baris.gungor.it@gmail.com> --- Created attachment 82050 --> http://bugs.winehq.org/attachment.cgi?id=82050 Terminal output, wine-11.17, Genshin Impact 7.0.0, clean win64 prefix Still reproducible with Genshin Impact 7.0.0 (Global) on plain upstream wine-11.17, clean win64 prefix. The game registers its own kernel service "HoYoProtect" for HoYoKProtect.sys, then fails to load it because WDFLDR.SYS is not present: err:module:import_dll Library WDFLDR.SYS (which is needed by L"C:\windows\system32\HoYoKProtect.sys") not found err:ntoskrnl:ZwLoadDriver failed to create driver L"...\Services\HoYoProtect": c0000142 The game then aborts via NtRaiseHardError 0x50000018 before creating any window and before writing its own output_log.txt, so there is no in-game log to attach. Exit code is 5. On builds that do ship a wdfldr stub (GE-Proton11-6 / wine-staging 11.0, GE-Proton10-34, proton-cachyos 11.0-20260703, wine-dwproton-wow64 11.0-11) the load gets one step further and fails at the stubbed entry points instead: fixme:wdfldr:WdfVersionBind ... L"...\Services\HoYoProtect" ... stub! fixme:wdfldr:WdfVersionUnbind ... L"...\Services\HoYoProtect" ... stub! err:ntoskrnl:ZwLoadDriver failed to create driver L"...\Services\HoYoProtect": c0000355 The outcome is identical in both cases. Three additional data points that may help triage: 1. Deleting HoYoKProtect.sys from both the game directory and system32 does not help. The driver load is then never attempted, but the game still opens an error dialog (window class #32769) and exits the same way. So the driver load is not the only gate. 2. In that configuration the last meaningful call before the error dialog is NtQuerySystemInformation with SystemCodeIntegrityInformation, which Wine currently reports as a stub: fixme:ntdll:NtQuerySystemInformation SystemCodeIntegrityInformation, size 8, info 0x..., stub! That is information class 103, returning SYSTEM_CODEINTEGRITY_INFORMATION (Length, CodeIntegrityOptions). Unlike the driver itself, this looks like an ordinary unimplemented information class and might be worth handling independently of the wdfldr question. Happy to file it as a separate bug if that is preferred. 3. The service control manager also denies a handle right before the driver load: err:service:validate_context_handle Access denied - handle created with access 34, needed 10000 This may be the same "Access denied" reported in bug 59437, where the reporter supplied a real WDFLDR.SYS, got past the import error, and then hit an access-denied wall. If so, providing wdfldr alone would not be sufficient. I am aware that running Windows kernel-mode drivers is out of scope for Wine and I am not requesting that. This is filed as a data point for the existing report, and because points 2 and 3 look separable from the driver question. System: CachyOS, kernel 7.2.2, Wayland/KDE Plasma, NVIDIA RTX 4070 Laptop (driver 610.57.04) + Intel UHD Raptor Lake-S, Mesa 26.2.2. Terminal output attached. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (2)
-
WineHQ Bugzilla -
WineHQ Bugzilla