[Bug 9685] Punkbuster removes me from game for UNKNOWN WINDOWS API FUNCTION [131124]

http://bugs.winehq.org/show_bug.cgi?id=9685

--- Comment #28 from Juan Lang   2007-09-25 19:20:04 ---
I got a hexdump of the message it's trying to decode, and it begins with the
following bytes (in hex):
38 15 00 00 00 02 02 00 30 82

That doesn't decode as a message.  The last two bytes are the beginning of an
asn.1-encoded message, but the prior bytes are not.

I believe this is a bug in either wintrust or imagehlp.  The first four bytes,
interpreted as a little-endian integer, are 5432.  This is exactly the length
being passed to CryptMsgUpdate.  So, I think the length of the message in the
file doesn't take into account the size of the WIN_CERTIFICATE header.