https://bugs.winehq.org/show_bug.cgi?id=43307
Bug ID: 43307
Summary: Wargaming Game Center periodically crashes with
msvcp140.dll._Current_get
Product: Wine
Version: 2.12
Hardware: x86-64
URL: http://redirect.wargaming.net/WGC/Wargaming_Game_Cente
r_Install_EU.exe
OS: Linux
Status: NEW
Keywords: download
Severity: minor
Priority: P2
Component: msvcp
Assignee: wine-bugs(a)winehq.org
Reporter: andrey.goosev(a)gmail.com
Distribution: ---
Application crashes with wgc_watchdog.exe but continue running. After a few
seconds crash repeats again.
wine: Call from 0x7b43b95c to unimplemented function msvcp140.dll._Current_get
wine-2.12-49-g35f82ba
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=46179
Bug ID: 46179
Summary: Multiple Windows 10 ARM64 apps need
'kernel32.dll.GetCurrentThreadStackLimits' to get
stack start address
Product: Wine
Version: 3.20
Hardware: aarch64
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: kernel32
Assignee: wine-bugs(a)winehq.org
Reporter: focht(a)gmx.net
Distribution: ---
Hello folks,
another valuable resource of improving/fixing Wine on ARM64 is the Chrome
browser port to Windows 10 ARM64 platform that is currently underway and going
to continue for some months.
I'm following various Chromium and LLVM/Clang pull requests related to Win10
ARM64 porting activities.
Related PR to this ticket:
https://chromium-review.googlesource.com/c/chromium/src/+/1344870https://chromium-review.googlesource.com/c/chromium/src/+/1344870/3/third_p…
--- snip ---
// On Windows stack limits for the current thread are available in
// the thread information block (TIB). Its fields can be accessed through
// FS segment register on x86 and GS segment register on x86_64.
// On Windows ARM64, stack limits could be retrieved by calling
// GetCurrentThreadStackLimits. This API doesn't work on x86 and x86_64 here
// because it requires Windows 8+.
#if defined(ARCH_CPU_X86_64)
return reinterpret_cast<void*>(__readgsqword(offsetof(NT_TIB64, StackBase)));
#elif defined(ARCH_CPU_X86)
return reinterpret_cast<void*>(__readfsdword(offsetof(NT_TIB, StackBase)));
#elif defined(ARCH_CPU_ARM64)
ULONG_PTR lowLimit, highLimit;
::GetCurrentThreadStackLimits(&lowLimit, &highLimit);
return reinterpret_cast<void*>(highLimit);
#endif
--- snip ---
Microsoft docs:
https://docs.microsoft.com/en-us/windows/desktop/api/processthreadsapi/nf-p…
Regards
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=44499
Bug ID: 44499
Summary: BattlEye 'BEDaisy' kernel service crashes on
unimplemented function
ntoskrnl.exe.PsSetCreateProcessNotifyRoutineEx
Product: Wine
Version: 3.1
Hardware: x86-64
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: ntoskrnl
Assignee: wine-bugs(a)winehq.org
Reporter: focht(a)gmx.net
Distribution: ---
Hello folks,
continuation of bug 44497
The kernel driver uses multiple methods to implement process
protection/supervision.
* ObRegisterCallbacks
* ObUnRegisterCallbacks
* ObGetFilterVersion
-> covered by bug 44497
Another method:
* PsSetCreateProcessNotifyRoutineEx
Example kernel driver code to show how the API is being used:
https://github.com/Microsoft/Windows-driver-samples/tree/master/general/obc…
--- quote ---
ObCallback Callback Registration Driver
The ObCallback sample driver demonstrates the use of registered callbacks for
process protection. The driver registers control callbacks which are called at
process creation.
Design and Operation
The sample exercises both the PsSetCreateProcessNotifyRoutineEx and the
ObRegisterCallbacks routines. The first example uses the ObRegisterCallbacks
routine and a callback to restrict requested access rights during a open
process action. The second example uses the PsSetCreateProcessNotifyRoutineEx
routine to reject a process creation by examining the command line.
--- quote ---
Another article:
https://malwaretips.com/threads/av-self-protection-process-c-c.66200/
For BattlEye 'BEDaisy' service to succeed the driver init routine it is enough
to implement a stub for 'PsSetCreateProcessNotifyRoutineEx' like it was done
with 'PsSetCreateProcessNotifyRoutine' -> return STATUS_SUCCESS
https://source.winehq.org/git/wine.git/blob/354fa7eb7921c3317e7943c18871feb…
--- snip ---
2381 /***********************************************************************
2382 * PsSetCreateProcessNotifyRoutine (NTOSKRNL.EXE.@)
2383 */
2384 NTSTATUS WINAPI PsSetCreateProcessNotifyRoutine(
PCREATE_PROCESS_NOTIFY_ROUTINE callback, BOOLEAN remove )
2385 {
2386 FIXME( "stub: %p %d\n", callback, remove );
2387 return STATUS_SUCCESS;
2388 }
--- snip ---
$ sha1sum Tibia_Setup.exe
50951008ccc402cc32407bfc56a88da873e3e9bd Tibia_Setup.exe
$ du -sh Tibia_Setup.exe
5.2M Tibia_Setup.exe
$ wine --version
wine-3.1-193-g354fa7eb79
Regards
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=44907
Bug ID: 44907
Summary: BattlEye 'BEDaisy' kernel service crashes on
unimplemented function
'fltmgr.sys.FltGetRoutineAddress'
Product: Wine
Version: 3.5
Hardware: x86-64
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: fltmgr
Assignee: wine-bugs(a)winehq.org
Reporter: focht(a)gmx.net
Distribution: ---
Hello folks,
already mentioned in bug 44500
It seems the author of the BattlEye driver is actively working on it, adding
new API dependencies/imports every week ;-)
Prerequisite:
* bug 44837 -> missing
'ntoskrnl.exe.Ps{Acquire,Release}ProcessExitSynchronization'
* bug 44906 -> missing 'ntoskrnl.exe.ExfUnblockPushLock'
There is now an additional one:
--- snip ---
$ WINEDEBUG=+seh,+relay,+ntoskrnl wine net start BEDaisy >>log.txt 2>&1
...
0035:Call ntoskrnl.exe.MmGetSystemRoutineAddress(0065ecac) ret=008560ad
...
0035:Call KERNEL32.GetProcAddress(7ec00000,0011d528 "IoDriverObjectType")
ret=7ec18587
0035:Ret KERNEL32.GetProcAddress() retval=7ec0700c ret=7ec18587
...
0035:trace:ntoskrnl:MmGetSystemRoutineAddress L"IoDriverObjectType" ->
0x7ec0700c
...
0035:Ret ntoskrnl.exe.MmGetSystemRoutineAddress() retval=7ec0700c ret=008560ad
...
0035:Call KERNEL32.RaiseException(80000100,00000001,00000002,0065eb78)
ret=f7dd1b0f
0035:trace:seh:raise_exception code=80000100 flags=1 addr=0x7b446c33
ip=7b446c33 tid=0035
0035:trace:seh:raise_exception info[0]=f7dd1b28
0035:trace:seh:raise_exception info[1]=f7dd228b
wine: Call from 0x7b446c33 to unimplemented function
fltmgr.sys.FltGetRoutineAddress, aborting
--- snip ---
$ sha1sum Tibia_Setup.exe
50951008ccc402cc32407bfc56a88da873e3e9bd Tibia_Setup.exe
$ du -sh Tibia_Setup.exe
5.2M Tibia_Setup.exe
$ wine --version
wine-3.5-106-g182c12c403
Regards
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=44497
Bug ID: 44497
Summary: BattlEye 'BEDaisy' kernel service crashes on
unimplemented ntoskrnl.exe ObCallback (object manager)
functions
Product: Wine
Version: 3.1
Hardware: x86-64
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: ntoskrnl
Assignee: wine-bugs(a)winehq.org
Reporter: focht(a)gmx.net
Distribution: ---
Hello folks,
continuation of bug 44496
The kernel driver uses object manager callbacks in order to implement process
protection.
* ObRegisterCallbacks
* ObUnRegisterCallbacks
* ObGetFilterVersion
Example kernel driver code to show how the API is being used:
https://github.com/Microsoft/Windows-driver-samples/tree/master/general/obc…
--- quote ---
ObCallback Callback Registration Driver
The ObCallback sample driver demonstrates the use of registered callbacks for
process protection. The driver registers control callbacks which are called at
process creation.
Design and Operation
The sample exercises both the PsSetCreateProcessNotifyRoutineEx and the
ObRegisterCallbacks routines. The first example uses the ObRegisterCallbacks
routine and a callback to restrict requested access rights during a open
process action. The second example uses the PsSetCreateProcessNotifyRoutineEx
routine to reject a process creation by examining the command line.
--- quote ---
Another article:
https://malwaretips.com/threads/av-self-protection-process-c-c.66200/
BattlEye 'BEDaisy' needs semi-stubs. Pure stubs returning
'STATUS_NOT_IMPLEMENTED' is not enough. The driver init routine will fail.
* ObRegisterCallbacks -> return STATUS_SUCCESS (and fake handle)
* ObUnRegisterCallbacks -> just empty stub is enough
* ObGetFilterVersion -> return OB_FLT_REGISTRATION_VERSION
Also mentioned in tps://bugs.winehq.org/show_bug.cgi?id=41039#c0 ("Virtualbox
crashes with access violation, needs ntoskrnl.exe.FsRtlIsNameInExpression")
although not the problem there.
--- snip ---
fixme:ntoskrnl:MmGetSystemRoutineAddress L"ObRegisterCallbacks" not found
fixme:ntoskrnl:MmGetSystemRoutineAddress L"ObUnRegisterCallbacks" not found
--- snip ---
With these things fixed, the driver runs further - into next problems.
$ sha1sum Tibia_Setup.exe
50951008ccc402cc32407bfc56a88da873e3e9bd Tibia_Setup.exe
$ du -sh Tibia_Setup.exe
5.2M Tibia_Setup.exe
$ wine --version
wine-3.1-193-g354fa7eb79
Regards
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.