https://bugs.winehq.org/show_bug.cgi?id=45703
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- URL| |http://officecdn.microsoft. | |com.edgesuite.net/db/492350 | |F6-3A01-4F97-B9C0-C7C6DDF67 | |D60/media/en-US/WordRetail. | |img Summary|Microsoft Office 365 |Microsoft Office 365 |applications crash on WINE |applications crash on |3.14 |startup (Microsoft AppV ISV | |virtual filesystem | |technology requires several | |native and core API to be | |hot-patchable) Component|-unknown |ntdll Keywords|regression |obfuscation CC| |focht@gmx.net
--- Comment #9 from Anastasius Focht focht@gmx.net --- Hello folks,
confirming.
The main problem here is Microsoft Application Packaging and Virtualization technology "App-V". It relies on hooking of native API and other core dlls to implement virtual filesystems.
Download links for testing:
https://www.ryadel.com/en/ms-office-2016-365-official-iso-img-images-for-dow...
Example of virtualized filesystem within MS Office 2016 (365) installation, with redirection target directory structure:
--- snip --- $ tree --charset=ANSI -L 2 -d .wine/drive_c/Program\ Files/Microsoft\ Office/root/vfs/
.wine/drive_c/Program Files/Microsoft Office/root/vfs/ |-- Common AppData | |-- Microsoft | `-- Microsoft Help |-- Common Programs | `-- Microsoft Office 2016 Tools |-- Fonts | `-- private |-- ProgramFilesCommonX86 | |-- DESIGNER | |-- Microsoft Shared | `-- ODBC |-- ProgramFilesX86 | `-- Microsoft Office |-- SystemX86 `-- Windows |-- Installer `-- PCHEALTH
17 directories --- snip ---
The crash from initial bug report in debugger:
--- snip --- Unhandled exception: page fault on read access to 0x6809f184 in 32-bit code (0x7bc3f58d). Register dump: CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b EIP:7bc3f58d ESP:0033cf50 EBP:0033d378 EFLAGS:00010206( R- -- I - -P- ) EAX:680956f0 EBX:0033d400 ECX:0033d388 EDX:10082601 ESI:00000000 EDI:00000000 ... Backtrace: =>0 0x7bc3f58d NtQueryDirectoryFile+0x7d(handle=<couldn't compute location>, event=<couldn't compute location>, apc_routine=<couldn't compute location>, apc_context=<couldn't compute location>, io=<couldn't compute location>, buffer=<couldn't compute location>, length=<couldn't compute location>, info_class=<couldn't compute location>, single_entry=<couldn't compute location>, mask=<couldn't compute location>, restart_scan=<couldn't compute location>) [/home/focht/projects/wine/mainline-src/dlls/ntdll/directory.c:1949] in ntdll (0x0033d378) 1 0x100a3f7e in appvisvsubsystems32 (+0xa3f7d) (0x0033d3c0) 2 0x1008272e in appvisvsubsystems32 (+0x8272d) (0x0033d454) 3 0x1008362c in appvisvsubsystems32 (+0x8362b) (0x0033d488) 4 0x7bc28d01 lookup_manifest_file+0x160(dir=0x98, ai=0x33f5cc) [/home/focht/projects/wine/mainline-src/dlls/ntdll/actctx.c:3100] in ntdll (0x0033f538) 5 0x7bc3462d RtlCreateActivationContext+0x67c(handle=<couldn't compute location>, ptr=<couldn't compute location>) [/home/focht/projects/wine/mainline-src/dlls/ntdll/actctx.c:3199] in ntdll (0x0033f608) 6 0x7bc579f0 fixup_imports+0xcbf(wm=0x17fa70, load_path="C:\Program Files\Microsoft Office\root\Office16;C:\windows\system32") [/home/focht/projects/wine/mainline-src/dlls/ntdll/loader.c:810] in ntdll (0x0033f718) 7 0x7bc581cd load_native_dll+0x71c(load_path="C:\Program Files\Microsoft Office\root\Office16;C:\windows\system32", name=<is not available>, file=<is not available>) [/home/focht/projects/wine/mainline-src/dlls/ntdll/loader.c:2070] in ntdll (0x0033f968) 8 0x7bc589c4 load_dll+0x5d3(load_path="C:\Program Files\Microsoft Office\root\Office16;C:\windows\system32", libname="wwlib.dll", flags=0x1000) [/home/focht/projects/wine/mainline-src/dlls/ntdll/loader.c:2570] in ntdll (0x0033fb18) 9 0x7bc59223 LdrLoadDll+0x5d(path_name=<couldn't compute location>, flags=<couldn't compute location>, libname=<couldn't compute location>, hModule=<couldn't compute location>) [/home/focht/projects/wine/mainline-src/dlls/ntdll/loader.c:2603] in ntdll (0x0033fb68) 10 0x7b45a4ec load_library+0xdb(libname=0x33fc08, flags=0x1000) [/home/focht/projects/wine/mainline-src/dlls/kernel32/module.c:975] in kernel32 (0x0033fbe8) 11 0x7b45ac01 LoadLibraryExW+0xdb() [/home/focht/projects/wine/mainline-src/dlls/kernel32/module.c:1035] in kernel32 (0x0033fc28) 12 0x0040178f in winword (+0x178e) (0x0033fe74) 13 0x00401163 in winword (+0x1162) (0x0033fec0) 14 0x7b461b82 call_process_entry+0x11() in kernel32 (0x0033fed8) 15 0x7b463d00 start_process+0x14f(entry=<couldn't compute location>, peb=<couldn't compute location>) [/home/focht/projects/wine/mainline-src/dlls/kernel32/process.c:1273] in kernel32 (0x0033ffd8) 16 0x7b461b8e start_process_wrapper+0x9() in kernel32 (0x0033ffec) 0x7bc3f58d NtQueryDirectoryFile+0x7d [/home/focht/projects/wine/mainline-src/dlls/ntdll/directory.c:1949] in ntdll: testb $0x8,0x9a94(%eax) 1949 TRACE("(%p %p %p %p %p %p 0x%08x 0x%08x 0x%08x %s 0x%08x\n", --- snip ---
Wine calls native API in internal function 'lookup_manifest_file':
--- snip --- ... 7BC28CD0 8985 BCDFFFFF MOV DWORD PTR SS:[LOCAL.2065],EAX 7BC28CD6 6A 01 PUSH 1 7BC28CD8 56 PUSH ESI 7BC28CD9 6A 00 PUSH 0 7BC28CDB 6A 03 PUSH 3 7BC28CDD 68 00200000 PUSH 2000 7BC28CE2 50 PUSH EAX 7BC28CE3 8D85 E0DFFFFF LEA EAX,[LOCAL.2056] 7BC28CE9 50 PUSH EAX 7BC28CEA 6A 00 PUSH 0 7BC28CEC 6A 00 PUSH 0 7BC28CEE 6A 00 PUSH 0 7BC28CF0 FFB5 B0DFFFFF PUSH DWORD PTR SS:[LOCAL.2068] 7BC28CF6 8985 A4DFFFFF MOV DWORD PTR SS:[LOCAL.2071],EAX 7BC28CFC E8 0F680100 CALL NtQueryDirectoryFile ... --- snip ---
ntdll.dll NtQueryDirectoryFile (hooked):
--- snip --- 7BC3F510 E9 DB404494 JMP 100835F0 7BC3F515 05 EB4A0A00 ADD EAX,0A4AEB ; base pointer to GOT 7BC3F51A 8D4C24 04 LEA ECX,[ESP+4] 7BC3F51E 83E4 F0 AND ESP,FFFFFFF0 7BC3F521 FF71 FC PUSH DWORD PTR DS:[ECX-4] 7BC3F524 55 PUSH EBP 7BC3F525 89E5 MOV EBP,ESP 7BC3F527 57 PUSH EDI 7BC3F528 56 PUSH ESI 7BC3F529 53 PUSH EBX 7BC3F52A 51 PUSH ECX 7BC3F52B 81EC 18040000 SUB ESP,418 7BC3F531 8B59 10 MOV EBX,DWORD PTR DS:[ECX+10] 7BC3F534 8B11 MOV EDX,DWORD PTR DS:[ECX] --- snip ---
App-V client side: 'AppVIsvSubsystems32.dll' App-V remote/server side: 'OfficeClickToRun.exe' (RPC server)
Another native API example to also show the detour lib uses instruction boundary padding.
ntdll.dll NtOpenKeyEx (patched):
--- snip --- 7BC6EC50 E9 4BD43F94 JMP 1006C0A0 7BC6EC55 CC INT3 7BC6EC56 CC INT3 7BC6EC57 FF71 FC PUSH DWORD PTR DS:[ECX-4] 7BC6EC5A 55 PUSH EBP 7BC6EC5B 89E5 MOV EBP,ESP 7BC6EC5D 53 PUSH EBX 7BC6EC5E 89CB MOV EBX,ECX 7BC6EC60 51 PUSH ECX 7BC6EC61 8B01 MOV EAX,DWORD PTR DS:[ECX] 7BC6EC63 8B51 04 MOV EDX,DWORD PTR DS:[ECX+4] 7BC6EC66 8B49 08 MOV ECX,DWORD PTR DS:[ECX+8] 7BC6EC69 83EC 0C SUB ESP,0C 7BC6EC6C FF73 0C PUSH DWORD PTR DS:[EBX+0C] 7BC6EC6F E8 FCF9FFFF CALL 7BC6E670 7BC6EC74 8D65 F8 LEA ESP,[EBP-8] 7BC6EC77 59 POP ECX 7BC6EC78 5B POP EBX 7BC6EC79 5D POP EBP 7BC6EC7A 8D61 FC LEA ESP,[ECX-4] 7BC6EC7D C2 1000 RETN 10 --- snip ---
ntdll.dll NtOpenKeyEx (unmodified):
--- snip --- 7BC6EC50 8D4C24 04 LEA ECX,[ARG.1] 7BC6EC54 83E4 F0 AND ESP,FFFFFFF0 7BC6EC57 FF71 FC PUSH DWORD PTR DS:[ECX-4] 7BC6EC5A 55 PUSH EBP 7BC6EC5B 89E5 MOV EBP,ESP 7BC6EC5D 53 PUSH EBX 7BC6EC5E 89CB MOV EBX,ECX 7BC6EC60 51 PUSH ECX 7BC6EC61 8B01 MOV EAX,DWORD PTR DS:[ECX] 7BC6EC63 8B51 04 MOV EDX,DWORD PTR DS:[ECX+4] 7BC6EC66 8B49 08 MOV ECX,DWORD PTR DS:[ECX+8] 7BC6EC69 83EC 0C SUB ESP,0C 7BC6EC6C FF73 0C PUSH DWORD PTR DS:[EBX+0C] 7BC6EC6F E8 FCF9FFFF CALL 7BC6E670 7BC6EC74 8D65 F8 LEA ESP,[LOCAL.3] 7BC6EC77 59 POP ECX 7BC6EC78 5B POP EBX 7BC6EC79 5D POP EBP 7BC6EC7A 8D61 FC LEA ESP,[ECX-4] 7BC6EC7D C2 1000 RETN 10 --- snip ---
List of potentially hooked native and core API using one-liner on trace log file:
--- snip --- $ WINEDEBUG=+seh,+relay wine ./WINWORD.EXE >>log2.txt 2>&1 ...
$ egrep "(GetProcAddress(7.*ret=10.*)" log.txt
0051:Call KERNEL32.GetProcAddress(7b420000,10155a28 "FlsAlloc") ret=1011c695 0051:Call KERNEL32.GetProcAddress(7b420000,10155a34 "FlsFree") ret=1011c6a8 0051:Call KERNEL32.GetProcAddress(7b420000,10155a3c "FlsGetValue") ret=1011c6bb 0051:Call KERNEL32.GetProcAddress(7b420000,10155a48 "FlsSetValue") ret=1011c6ce 0051:Call KERNEL32.GetProcAddress(7b420000,10155a54 "InitializeCriticalSectionEx") ret=1011c6e1 0051:Call KERNEL32.GetProcAddress(7b420000,10171a54 "CreateEventExW") ret=1011c6f4 0051:Call KERNEL32.GetProcAddress(7b420000,10171a74 "CreateSemaphoreExW") ret=1011c707 0051:Call KERNEL32.GetProcAddress(7b420000,10155a70 "SetThreadStackGuarantee") ret=1011c71a 0051:Call KERNEL32.GetProcAddress(7b420000,101796e8 "CreateThreadpoolTimer") ret=1011c72d 0051:Call KERNEL32.GetProcAddress(7b420000,10155a88 "SetThreadpoolTimer") ret=1011c740 0051:Call KERNEL32.GetProcAddress(7b420000,10155a9c "WaitForThreadpoolTimerCallbacks") ret=1011c753 0051:Call KERNEL32.GetProcAddress(7b420000,10155abc "CloseThreadpoolTimer") ret=1011c766 0051:Call KERNEL32.GetProcAddress(7b420000,101796a0 "CreateThreadpoolWait") ret=1011c779 0051:Call KERNEL32.GetProcAddress(7b420000,10155ad4 "SetThreadpoolWait") ret=1011c78c 0051:Call KERNEL32.GetProcAddress(7b420000,10155ae8 "CloseThreadpoolWait") ret=1011c79f 0051:Call KERNEL32.GetProcAddress(7b420000,10155afc "FlushProcessWriteBuffers") ret=1011c7b2 0051:Call KERNEL32.GetProcAddress(7b420000,10155b18 "FreeLibraryWhenCallbackReturns") ret=1011c7c5 0051:Call KERNEL32.GetProcAddress(7b420000,10155b38 "GetCurrentProcessorNumber") ret=1011c7d8 0051:Call KERNEL32.GetProcAddress(7b420000,10155b54 "GetLogicalProcessorInformation") ret=1011c7eb 0051:Call KERNEL32.GetProcAddress(7b420000,10155b74 "CreateSymbolicLinkW") ret=1011c7fe 0051:Call KERNEL32.GetProcAddress(7b420000,10155b88 "SetDefaultDllDirectories") ret=1011c811 0051:Call KERNEL32.GetProcAddress(7b420000,10155ba4 "EnumSystemLocalesEx") ret=1011c824 0051:Call KERNEL32.GetProcAddress(7b420000,10155bb8 "CompareStringEx") ret=1011c837 0051:Call KERNEL32.GetProcAddress(7b420000,10155bc8 "GetDateFormatEx") ret=1011c84a 0051:Call KERNEL32.GetProcAddress(7b420000,10155bd8 "GetLocaleInfoEx") ret=1011c85d 0051:Call KERNEL32.GetProcAddress(7b420000,10155be8 "GetTimeFormatEx") ret=1011c870 0051:Call KERNEL32.GetProcAddress(7b420000,10155bf8 "GetUserDefaultLocaleName") ret=1011c883 0051:Call KERNEL32.GetProcAddress(7b420000,10155c14 "IsValidLocaleName") ret=1011c896 0051:Call KERNEL32.GetProcAddress(7b420000,10155c28 "LCMapStringEx") ret=1011c8a9 0051:Call KERNEL32.GetProcAddress(7b420000,10155c38 "GetCurrentPackageId") ret=1011c8bc 0051:Call KERNEL32.GetProcAddress(7b420000,10155c4c "GetTickCount64") ret=1011c8cf 0051:Call KERNEL32.GetProcAddress(7b420000,10155c5c "GetFileInformationByHandleExW") ret=1011c8e2 0051:Call KERNEL32.GetProcAddress(7b420000,10155c7c "SetFileInformationByHandleW") ret=1011c8f5 0051:Call KERNEL32.GetProcAddress(7bc10000,001a4628 "NtOpenKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a4668 "NtOpenKeyEx") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a3738 "NtOpenKeyTransacted") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a3760 "NtOpenKeyTransactedEx") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a4728 "NtDeleteKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a4768 "NtFlushKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a47a8 "NtCreateKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a3788 "NtCreateKeyTransacted") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a4828 "NtEnumerateKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a4868 "NtQueryKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a48a8 "NtQueryObject") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a37b0 "NtSetInformationKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a4928 "NtQueryValueKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a37d8 "NtEnumerateValueKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a49a8 "NtSetValueKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a3800 "NtDeleteValueKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a4a28 "NtRenameKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a3828 "NtQueryMultipleValueKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a3850 "NtNotifyChangeKey") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a36c0 "NtNotifyChangeMultipleKeys") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a36e8 "NtQuerySecurityObject") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a3698 "NtSetSecurityObject") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a2d60 "NtDuplicateObject") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001a4be8 "NtClose") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7b420000,101715dc "IsWow64Process") ret=10087759 0051:Call KERNEL32.GetProcAddress(7bc10000,00184bb0 "NtCreateFile") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,00184bf0 "NtOpenFile") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,00184c30 "NtDeleteFile") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,0018d360 "NtQueryAttributesFile") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,0018d388 "NtQueryFullAttributesFile") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,001941f0 "NtQueryDirectoryFile") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,00194218 "NtSetInformationFile") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,00184d70 "NtClose") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7b420000,00184db0 "CreateActCtxA") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7b420000,00184df0 "CreateActCtxW") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7bc10000,00194240 "NtQueryInformationFile") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7b420000,00194268 "GetModuleFileNameA") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7b420000,00193428 "GetModuleFileNameW") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7b420000,001964c8 "GetCurrentDirectoryA") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7b420000,00185bd8 "GetCurrentDirectoryW") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,00184bb0 "CoInitializeEx") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,00184bf0 "CoUninitialize") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,0018da60 "CoCreateInstanceEx") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,001949e0 "CoCreateInstance") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,0018ec10 "CoRegisterClassObject") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,001a3698 "CoRevokeClassObject") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,001a36c0 "CoGetClassObject") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,001a36e8 "CoGetInstanceFromFile") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,00197548 "CoResumeClassObjects") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,00197570 "CoSuspendClassObjects") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,00184e30 "OleInitialize") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,00184e70 "OleUninitialize") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,00197598 "OleRegEnumFormatEtc") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e7d0000,00184ef0 "OleRun") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e920000,00192678 "RegisterActiveObject") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e920000,00194a38 "RevokeActiveObject") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e920000,00184fb0 "GetActiveObject") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7b420000,001957c8 "CreateProcessW") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7b420000,00195808 "CreateProcessA") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7b420000,00195848 "WinExec") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e750000,00196820 "CreateProcessAsUserW") ret=1001d194 0051:Call KERNEL32.GetProcAddress(7e750000,00191390 "CreateProcessAsUserA") ret=1001d194 --- snip ---
Another one-liner to show which API functions that are being looked up are currently not 'DECLSPEC_HOTPATCH' in Wine source.
* filter for all core dlls (prelink/load base address range) API functions that are getting looked up from specific dll (load base address range) * filter for all function body (definition) occurrences in Wine sources, which have no DECLSPEC_HOTPATCH
--- snip --- $ egrep "(GetProcAddress(7.*ret=10.*)" log.txt | cut -d """ -f2 | xargs -n1 -I '{}' egrep -R 'WINAPI.*{}(' /home/focht/projects/wine/mainline-src/dlls/ | grep -v DECLSPEC_HOTPATCH /home/focht/projects/wine/mainline-src/dlls/kernel32/fiber.c:DWORD WINAPI FlsAlloc( PFLS_CALLBACK_FUNCTION callback ) /home/focht/projects/wine/mainline-src/dlls/kernel32/fiber.c:BOOL WINAPI FlsFree( DWORD index ) /home/focht/projects/wine/mainline-src/dlls/kernel32/fiber.c:PVOID WINAPI FlsGetValue( DWORD index ) /home/focht/projects/wine/mainline-src/dlls/kernel32/fiber.c:BOOL WINAPI FlsSetValue( DWORD index, PVOID data ) /home/focht/projects/wine/mainline-src/dlls/kernel32/sync.c:BOOL WINAPI InitializeCriticalSectionEx( CRITICAL_SECTION *crit, DWORD spincount, DWORD flags ) /home/focht/projects/wine/mainline-src/dlls/ntdll/critsection.c:NTSTATUS WINAPI RtlInitializeCriticalSectionEx( RTL_CRITICAL_SECTION *crit, ULONG spincount, ULONG flags ) /home/focht/projects/wine/mainline-src/dlls/kernel32/thread.c:BOOL WINAPI SetThreadStackGuarantee(PULONG stacksize) /home/focht/projects/wine/mainline-src/dlls/kernel32/thread.c:PTP_TIMER WINAPI CreateThreadpoolTimer( PTP_TIMER_CALLBACK callback, PVOID userdata, /home/focht/projects/wine/mainline-src/dlls/kernel32/thread.c:VOID WINAPI SetThreadpoolTimer( TP_TIMER *timer, FILETIME *due_time, /home/focht/projects/wine/mainline-src/dlls/kernel32/thread.c:PTP_WAIT WINAPI CreateThreadpoolWait( PTP_WAIT_CALLBACK callback, PVOID userdata, /home/focht/projects/wine/mainline-src/dlls/kernel32/thread.c:VOID WINAPI SetThreadpoolWait( TP_WAIT *wait, HANDLE handle, FILETIME *due_time ) /home/focht/projects/wine/mainline-src/dlls/kernel32/process.c:VOID WINAPI FlushProcessWriteBuffers(void) /home/focht/projects/wine/mainline-src/dlls/ntdll/thread.c:ULONG WINAPI NtGetCurrentProcessorNumber(void) /home/focht/projects/wine/mainline-src/dlls/kernel32/process.c:BOOL WINAPI GetLogicalProcessorInformation(PSYSTEM_LOGICAL_PROCESSOR_INFORMATION buffer, PDWORD pBufLen) /home/focht/projects/wine/mainline-src/dlls/kernel32/path.c:BOOLEAN WINAPI CreateSymbolicLinkW(LPCWSTR link, LPCWSTR target, DWORD flags) /home/focht/projects/wine/mainline-src/dlls/kernel32/module.c:BOOL WINAPI SetDefaultDllDirectories( DWORD flags ) /home/focht/projects/wine/mainline-src/dlls/kernel32/locale.c:BOOL WINAPI EnumSystemLocalesEx( LOCALE_ENUMPROCEX proc, DWORD flags, LPARAM lparam, LPVOID reserved ) /home/focht/projects/wine/mainline-src/dlls/kernel32/locale.c:INT WINAPI CompareStringEx(LPCWSTR locale, DWORD flags, LPCWSTR str1, INT len1, /home/focht/projects/wine/mainline-src/dlls/kernel32/lcformat.c:INT WINAPI GetDateFormatEx(LPCWSTR localename, DWORD flags, /home/focht/projects/wine/mainline-src/dlls/kernel32/locale.c:INT WINAPI GetLocaleInfoEx(LPCWSTR locale, LCTYPE info, LPWSTR buffer, INT len) /home/focht/projects/wine/mainline-src/dlls/kernel32/lcformat.c:INT WINAPI GetTimeFormatEx(LPCWSTR localename, DWORD flags, /home/focht/projects/wine/mainline-src/dlls/kernel32/locale.c:INT WINAPI GetUserDefaultLocaleName(LPWSTR localename, int buffersize) /home/focht/projects/wine/mainline-src/dlls/kernel32/locale.c:BOOL WINAPI IsValidLocaleName( LPCWSTR locale ) /home/focht/projects/wine/mainline-src/dlls/kernel32/locale.c:INT WINAPI LCMapStringEx(LPCWSTR name, DWORD flags, LPCWSTR src, INT srclen, LPWSTR dst, INT dstlen, /home/focht/projects/wine/mainline-src/dlls/kernel32/version.c:LONG WINAPI GetCurrentPackageId(UINT32 *len, BYTE *buffer) /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtOpenKey( PHANDLE retkey, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr ) /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI RtlpNtOpenKey( PHANDLE retkey, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr ) /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtOpenKeyEx( PHANDLE retkey, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr, ULONG options ) /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtOpenKeyTransacted( PHANDLE retkey, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr, /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtOpenKeyTransactedEx( PHANDLE retkey, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr, /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtDeleteKey( HANDLE hkey ) /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtFlushKey(HANDLE key) /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtCreateKey( PHANDLE retkey, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr, /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI RtlpNtCreateKey( PHANDLE retkey, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr, /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtCreateKeyTransacted( PHANDLE retkey, ACCESS_MASK access, const OBJECT_ATTRIBUTES *attr, /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtEnumerateKey( HANDLE handle, ULONG index, KEY_INFORMATION_CLASS info_class, /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtQueryKey( HANDLE handle, KEY_INFORMATION_CLASS info_class, /home/focht/projects/wine/mainline-src/dlls/ntdll/om.c:NTSTATUS WINAPI NtQueryObject(IN HANDLE handle, /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtSetInformationKey( /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtQueryValueKey( HANDLE handle, const UNICODE_STRING *name, /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI RtlpNtQueryValueKey( HANDLE handle, ULONG *result_type, PBYTE dest, /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtEnumerateValueKey( HANDLE handle, ULONG index, /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtSetValueKey( HANDLE hkey, const UNICODE_STRING *name, ULONG TitleIndex, /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI RtlpNtSetValueKey( HANDLE hkey, ULONG type, const void *data, /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtDeleteValueKey( HANDLE hkey, const UNICODE_STRING *name ) /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtRenameKey( HANDLE handle, UNICODE_STRING *name ) /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtQueryMultipleValueKey( /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtNotifyChangeKey( /home/focht/projects/wine/mainline-src/dlls/ntdll/reg.c:NTSTATUS WINAPI NtNotifyChangeMultipleKeys( /home/focht/projects/wine/mainline-src/dlls/ntdll/sec.c:NTSTATUS WINAPI NtSetSecurityObject(HANDLE Handle, /home/focht/projects/wine/mainline-src/dlls/ntdll/om.c:NTSTATUS WINAPI NtDuplicateObject( HANDLE source_process, HANDLE source, /home/focht/projects/wine/mainline-src/dlls/ntdll/om.c:NTSTATUS WINAPI NtClose( HANDLE Handle ) /home/focht/projects/wine/mainline-src/dlls/kernel32/process.c:BOOL WINAPI IsWow64Process(HANDLE hProcess, PBOOL Wow64Process) /home/focht/projects/wine/mainline-src/dlls/ntdll/file.c:NTSTATUS WINAPI NtCreateFile( PHANDLE handle, ACCESS_MASK access, POBJECT_ATTRIBUTES attr, /home/focht/projects/wine/mainline-src/dlls/ntdll/file.c:NTSTATUS WINAPI NtOpenFile( PHANDLE handle, ACCESS_MASK access, /home/focht/projects/wine/mainline-src/dlls/ntdll/file.c:NTSTATUS WINAPI NtDeleteFile( POBJECT_ATTRIBUTES ObjectAttributes ) /home/focht/projects/wine/mainline-src/dlls/ntdll/file.c:NTSTATUS WINAPI NtQueryAttributesFile( const OBJECT_ATTRIBUTES *attr, FILE_BASIC_INFORMATION *info ) /home/focht/projects/wine/mainline-src/dlls/ntdll/file.c:NTSTATUS WINAPI NtQueryFullAttributesFile( const OBJECT_ATTRIBUTES *attr, /home/focht/projects/wine/mainline-src/dlls/ntdll/directory.c:NTSTATUS WINAPI NtQueryDirectoryFile( HANDLE handle, HANDLE event, /home/focht/projects/wine/mainline-src/dlls/ntdll/file.c:NTSTATUS WINAPI NtSetInformationFile(HANDLE handle, PIO_STATUS_BLOCK io, /home/focht/projects/wine/mainline-src/dlls/ntdll/om.c:NTSTATUS WINAPI NtClose( HANDLE Handle ) /home/focht/projects/wine/mainline-src/dlls/kernel32/actctx.c:HANDLE WINAPI CreateActCtxA(PCACTCTXA pActCtx) /home/focht/projects/wine/mainline-src/dlls/kernel32/actctx.c:HANDLE WINAPI CreateActCtxW(PCACTCTXW pActCtx) /home/focht/projects/wine/mainline-src/dlls/ntdll/file.c:NTSTATUS WINAPI NtQueryInformationFile( HANDLE hFile, PIO_STATUS_BLOCK io, /home/focht/projects/wine/mainline-src/dlls/kernel32/module.c:DWORD WINAPI GetModuleFileNameA( /home/focht/projects/wine/mainline-src/dlls/kernel32/module.c:DWORD WINAPI GetModuleFileNameW( HMODULE hModule, LPWSTR lpFileName, DWORD size ) /home/focht/projects/wine/mainline-src/dlls/wininet/ftp.c:BOOL WINAPI FtpGetCurrentDirectoryA(HINTERNET hFtpSession, LPSTR lpszCurrentDirectory, /home/focht/projects/wine/mainline-src/dlls/kernel32/path.c:UINT WINAPI GetCurrentDirectoryA( UINT buflen, LPSTR buf ) /home/focht/projects/wine/mainline-src/dlls/wininet/ftp.c:BOOL WINAPI FtpGetCurrentDirectoryW(HINTERNET hFtpSession, LPWSTR lpszCurrentDirectory, /home/focht/projects/wine/mainline-src/dlls/kernel32/path.c:UINT WINAPI GetCurrentDirectoryW( UINT buflen, LPWSTR buf ) /home/focht/projects/wine/mainline-src/dlls/shell32/shellole.c:HRESULT WINAPI SHCoCreateInstance( /home/focht/projects/wine/mainline-src/dlls/ole32/compobj.c:HRESULT WINAPI CoRegisterClassObject( /home/focht/projects/wine/mainline-src/dlls/ole32/compobj.c:HRESULT WINAPI CoResumeClassObjects(void) /home/focht/projects/wine/mainline-src/dlls/ole32/compobj.c:HRESULT WINAPI CoSuspendClassObjects(void) --- snip ---
It seems *not* all API looked up are actually getting detoured. All native API for sure and a good chunk of the others. It's possible to figure out the exact number that are getting hot-patched at runtime using scriptable debugger that scans all core dll entries for out-of-module/inter-modular jumps.
Tidbit: I've tested the same install with Wine 3.0 and it doesn't work there either. It even suffers from additional problems. So your claim "it worked" - it was likely just by chance. A debug build of Wine (-O0, -O1), no GOT/PIC at entry, older GCC versions etc.
Anyway, this problem domain is known for years. There were various discussions in the past on how to mitigate this. More recent one: https://bugs.winehq.org/show_bug.cgi?id=45199#c30 (and follow-up comments).
* making Win32 API hot-patchable by default * use '-fno-PIC' by default * implement proper NT-style syscall thunks for native API (Wine-Staging)
Yet we still keep to continue the practice "as needed", polluting the tree source with 'DECLSPEC_HOTPATCH'. Analysing/debugging that is just monkey work.
$ sha1sum WordRetail.img 7e327f7d685ff6da81e831e918959380908b25b7 WordRetail.img
$ du -sh WordRetail.img 4.2G WordRetail.img
$ wine --version wine-3.21
Regards