http://bugs.winehq.org/show_bug.cgi?id=35193
Bug ID: 35193 Summary: FL Studio 11.x VSTi 'Slayer2' plugin doesn't work after registration (ASProtect 1.4 software protection) Product: Wine Version: 1.7.9 Hardware: x86 OS: Linux Status: NEW Severity: normal Priority: P2 Component: -unknown Assignee: wine-bugs@winehq.org Reporter: focht@gmx.net Classification: Unclassified
Hello folks,
a user in #winehq reported another plugin not working with FL 11.x (after fixing bug 35178).
Plugin download: http://downloads.image-line.com/slayer/slayer2_personalcopy_install.exe
Interestingly: http://www.image-line.com/documents/slayer.html
--- quote --- FL Slayer2 is no longer available for purchase. Existing registered customers will keep receiving support. --- quote ---
Running 'VerA' (a specific tool to identify ASProtect versions) on the plugin main dll 'Slayer2.dll' reveals:
--- snip --- EntryPoint check: ASProtect .DLL style Crypto info: Block type: 1(U), Info type: 1, Attempts: 1 Application name: Slayer 2 Application version: 1.0 ASProtect version: 1.4 build 04.01 Beta ASProtect registered to: Image-Line Software
raw info data: [Slayer 2], [1.0], [1.4 build 04.01 Beta], [Image-Line Software] --- snip ---
The plugin needs to be registered with license code to reproduce the problem (the user has a legit license).
The protector decrypts the actual plugin code only with a valid license code during dll initialization. The 'plugin interface' dll export 'main' is redirected to real code which is later called by the hosting application -> FL11.
In non-registered version the plugin dll export 'main' is just a stub, returning zero:
--- snip --- 0024:Ret PE DLL (proc=0x10170001,module=0x10000000 L"Slayer2.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1 0024:Ret KERNEL32.LoadLibraryA() retval=10000000 ret=7ede9e5e 0024:Call KERNEL32.GetProcAddress(10000000,7edf0f5b "VSTPluginMain") ret=7ede9f1e 0024:Ret KERNEL32.GetProcAddress() retval=00000000 ret=7ede9f1e 0024:Call KERNEL32.GetProcAddress(10000000,7edf0f69 "VstPluginMain") ret=7ede9f42 0024:Ret KERNEL32.GetProcAddress() retval=00000000 ret=7ede9f42 0024:Call KERNEL32.GetProcAddress(10000000,7edf0f77 "main") ret=7ede9f66 0024:Ret KERNEL32.GetProcAddress() retval=1000bd70 ret=7ede9f66 0024:Call KERNEL32.FreeLibrary(10000000) ret=7ede8d31 0024:Call PE DLL (proc=0x10170001,module=0x10000000 L"Slayer2.dll",reason=PROCESS_DETACH,res=(nil)) ... RemotePlugin::DebugMessage: mainEntry prodecure returned NULL --- snip ---
The protector doesn't like relay thunks (WINEDEBUG=+relay), it will refuse to load further at some point, showing 'Error 198'.
When you simply run it within FL11 it will spit out the following messages on terminal before dying:
--- snip --- ... fixme:mountmgr:harddisk_ioctl Unsupported ioctl 4d004 (device=4 access=3 func=401 method=0) fixme:mountmgr:harddisk_ioctl Unsupported ioctl 4d004 (device=4 access=3 func=401 method=0) err:seh:setup_exception_record stack overflow 896 bytes in thread 0024 eip 7bc43cc2 esp 00240fb0 stack 0x240000-0x241000-0x340000 --- snip ---
Since the user expressed interest to investigate this problem I will back off for now ;-)
Just a hint for making analysis easier:
Write a small winelib app that acts as loader/host to avoid running the rather large/complex FL Studio 11.x Calling 'LoadLibraryA("Slayer2.dll")' is sufficient. All the magic happens within dll entry point (attach event).
===
I will happily leave any bugs to people wanting to do their own analysis for fun/learning experience.
Just indicate it: "I'm working on this" ... "I'll have a look" and I'll skip that bug (there are still thousands of bugs not analysed yet) ;-)
Regards