https://bugs.winehq.org/show_bug.cgi?id=49666
Bug ID: 49666 Summary: Red Dead Redemption 2 requires HEAP flags offset to match Windows Product: Wine Version: 5.14 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: ntdll Assignee: wine-bugs@winehq.org Reporter: bshanks@codeweavers.com Distribution: ---
Red Dead Redemption 2 gets ProcessHeap from the PEB, and directly accesses the 'flags' and 'force_flags' fields of the HEAP structure.
Those fields need to be at the same offset as they are on WinVista through current Win10, 0x40/0x70. Wine currently pads the struct so 'flags' is in the correct place (0xC) vs. WinNT/2000/XP
https://ctf-wiki.github.io/ctf-wiki/reverse/windows/anti-debug/heap-flags/