[Bug 33849] New: Unhandled exception: page fault on read access to 0xfffff78000000014 in 64-bit code (0x000000000048e10f).

List overview All Threads

newer

older

[Bug 19157] New: CoGetContextToken...

[Bug 37537] New: Tages v5.x DRM...

wine-bugs＠winehq.org

21 Jun 2013 21 Jun '13

9:45 a.m.

http://bugs.winehq.org/show_bug.cgi?id=33849

Bug #: 33849 Summary: Unhandled exception: page fault on read access to 0xfffff78000000014 in 64-bit code (0x000000000048e10f). Product: Wine Version: 1.6-rc2 Platform: arm64 OS/Version: Linux Status: UNCONFIRMED Severity: normal Priority: P2 Component: winedbg AssignedTo: wine-bugs@winehq.org ReportedBy: local1907@gmail.com Classification: Unclassified

giving this error when I try to open any program. Opening the program is operating normally, but there is an error.

google translate

wine-1.6-rc2 Ubuntu 12.10 kernel 3.8.10-030810-generic Nvidia 319.23

-- Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email Do not reply to this email, post in Bugzilla using the above URL to reply. ------- You are receiving this mail because: ------- You are watching all bug changes.

Show replies by date

wine-bugs＠winehq.org

21 Jun 21 Jun

9:48 a.m.

New subject: [Bug 33849] Unhandled exception: page fault on read access to 0xfffff78000000014 in 64-bit code (0x000000000048e10f).

http://bugs.winehq.org/show_bug.cgi?id=33849

--- Comment #1 from Koray Özcan local1907@gmail.com 2013-06-21 04:48:07 CDT --- Created attachment 44892 --> http://bugs.winehq.org/attachment.cgi?id=44892 backtrace

wine-bugs＠winehq.org

11:17 a.m.

New subject: [Bug 33849] Unhandled exception: page fault on read access to 0xfffff78000000014 in 64-bit code (0x000000000048e10f).

http://bugs.winehq.org/show_bug.cgi?id=33849

Rosanne DiMesio dimesio@earthlink.net changed:

What |Removed |Added ---------------------------------------------------------------------------- Component|winedbg |-unknown

--- Comment #2 from Rosanne DiMesio dimesio@earthlink.net 2013-06-21 06:17:51 CDT --- ------ =>0 0x000000000048e10f in atksgt.sys (+0x4e10f) (0x000000000048e010) ------

That's a Tages driver. Duplicate of bug 10264?

wine-bugs＠winehq.org

12:27 p.m.

New subject: [Bug 33849] Unhandled exception: page fault on read access to 0xfffff78000000014 in 64-bit code (0x000000000048e10f).

http://bugs.winehq.org/show_bug.cgi?id=33849

--- Comment #3 from Bruno Jesus 00cpxxx@gmail.com 2013-06-21 07:27:54 CDT --- Reminds me of bug 31268.

wine-bugs＠winehq.org

6:29 p.m.

New subject: [Bug 33849] Unhandled exception: page fault on read access to 0xfffff78000000014 in 64-bit code (0x000000000048e10f).

http://bugs.winehq.org/show_bug.cgi?id=33849

Austin English austinenglish@gmail.com changed:

--- Comment #4 from Austin English austinenglish@gmail.com 2013-06-21 13:29:36 CDT --- Dupe.

*** This bug has been marked as a duplicate of bug 10264 ***

wine-bugs＠winehq.org

8:09 p.m.

New subject: [Bug 33849] Tages 64-bit software protection driver crashes on access to KI_USER_SHARED_DATA range (0xfffff78000000000)

http://bugs.winehq.org/show_bug.cgi?id=33849

Anastasius Focht focht@gmx.net changed:

--- Comment #5 from Anastasius Focht focht@gmx.net 2013-06-21 15:09:47 CDT --- Hello folks,

just closing bugs as dupe of some metabug because of "it looks like" won't do any good.

The problem here can be indeed treated as isolated issue.

--- snip --- Unhandled exception: page fault on read access to 0xfffff78000000320 in 64-bit code (0x00000000004561b0). Register dump: rip:00000000004561b0 rsp:000000000043ddc8 rbp:000000000043deb0 eflags:00010246 ( R- -- I Z- -P- ) rax:fffff78000000320 rbx:00007fffff7ef000 rcx:0000000000452100 rdx:00002b992ddfa232 rsi:000000000043e100 rdi:00007f1fc06ea580 r8:000000000043e100 r9:00007f1fc06ea5e0 r10:0000000000000008 r11:0000003be2f7c950 r12:0000000000000000 r13:00007ffff3cd3cb0 r14:000000000043f700 r15:0000000000000000 Stack dump: ... Backtrace: =>0 0x00000000004561b0 in atksgt.sys (+0x161b0) (0x000000000043deb0) 1 0x00000000004561ef in atksgt.sys (+0x161ee) (0x000000000043deb0) 2 0x00007f1fc04e8167 init_driver+0x138(module=0x440000, keyname=0x43e100) [/home/focht/projects/wine/wine-git/programs/winedevice/device.c:154] in winedevice (0x000000000043deb0) 3 0x00007f1fc04e8929 load_driver+0x569() [/home/focht/projects/wine/wine-git/programs/winedevice/device.c:254] in winedevice (0x000000000043e1b0) 4 0x00007f1fc04e8cc3 ServiceMain+0x16b(argc=0x1, argv=0x118f0) [/home/focht/projects/wine/wine-git/programs/winedevice/device.c:308] in winedevice (0x000000000043e2e0) 5 0x00007f1fc029fe84 service_thread+0x238(arg=0x10d70) [/home/focht/projects/wine/wine-git/dlls/advapi32/service.c:302] in advapi32 (0x000000000043e480) 6 0x00007f1fc6d84c7b call_thread_func+0x4e(entry=0x7f1fc029fc4b, arg=0x10d70, frame=0x43e5e0) [/home/focht/projects/wine/wine-git/dlls/ntdll/signal_x86_64.c:3230] in ntdll (0x000000000043e5d0) ... 0x00000000004561b0: movq (%rax),%rax Modules: Module Address Debug info Name (28 modules) PE 440000- 457000 Export atksgt.sys ELF 7b800000- 7bb3e000 Deferred kernel32<elf> -PE 7b820000- 7bb3e000 \ kernel32 ... Threads: process tid prio (all id:s are in hex) ... 00000012 (D) C:\windows\system32\winedevice.exe 00000019 0 <== 00000017 0 00000013 0 --- snip ---

Disassembly of relevant driver code snippet:

--- snip --- ... 00000000004561A6 mov rax, 0FFFFF78000000320h 00000000004561B0 mov rax, [rax] 00000000004561B3 xor rax, rcx ... --- snip ---

The address lies within the range of kernel mode shadow mapping of USER_SHARED_DATA for x64.

See: http://www.virtualbox.org/svn/vbox/trunk/src/VBox/Debugger/DBGPlugInWinNt.cp...

--- snip --- /** KI_USER_SHARED_DATA for i386 */ #define NTKUSERSHAREDDATA_WINNT32 UINT32_C(0xffdf0000) /** KI_USER_SHARED_DATA for AMD64 */ #define NTKUSERSHAREDDATA_WINNT64 UINT64_C(0xfffff78000000000) --- snip ---

Unfortunately that memory range can't be mapped in Linux user process address space. One way could be to handle traps specifically for this address range and emulate member accesses (shadow data structure).

The driver seems to access only two members of KI_USER_SHARED_DATA:

KI_USER_SHARED_DATA+0x014 -> SharedSystemTime KI_USER_SHARED_DATA+0x320 -> SharedTickCount

Regards

wine-bugs＠winehq.org

10:52 p.m.

New subject: [Bug 33849] Tages 64-bit software protection driver crashes on access to KI_USER_SHARED_DATA range (0xfffff78000000000)

http://bugs.winehq.org/show_bug.cgi?id=33849

Reading launcher configuration...

Do you want to check for updates (y/N)? y Checking for updates... wine: Unhandled page fault on read access to 0xfffff78000000014 at address 0x48e10f (thread 0019), starting debugger... err:service:service_send_start_message service L"Stereo Service" failed to start Connecting to patch.lotro.com:80 Checking files...files to patch: 0 bytes to download: 0 Patching files: File patching complete Connecting to patch.lotro.com:80 checking data...data patches: 0 bytes to download: 0 unlock: 0 empty: 0 result code: 0x00000000 Patching data:

Data patching complete. All patching complete.

Please enter your account details now. account:

wine-bugs＠winehq.org

22 Jun 22 Jun

8:20 a.m.

New subject: [Bug 33849] Tages 64-bit software protection driver crashes on access to KI_USER_SHARED_DATA range (0xfffff78000000000)

http://bugs.winehq.org/show_bug.cgi?id=33849

Anastasius Focht focht@gmx.net changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEW

--- Comment #7 from Anastasius Focht focht@gmx.net 2013-06-22 03:20:02 CDT --- Hello Koray,

posting/pasting further output is _pointless_ as I already explained the driver crash. Problems encountered _after_ the non-functioning driver/service don't belong to this bug.

Regards

wine-bugs＠winehq.org

9 Aug 9 Aug

12:02 p.m.

New subject: [Bug 33849] Tages 64-bit software protection driver crashes on access to KI_USER_SHARED_DATA range (0xfffff78000000000)

http://bugs.winehq.org/show_bug.cgi?id=33849

Anastasius Focht focht@gmx.net changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |mathle@bas.ac.uk

--- Comment #8 from Anastasius Focht focht@gmx.net --- *** Bug 35960 has been marked as a duplicate of this bug. ***

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

31 Aug 31 Aug

11:19 a.m.

New subject: [Bug 33849] Multiple 64-bit kernel drivers crash on access to KI_USER_SHARED_DATA range (0xfffff78000000000) (Tages DRM, Comodo Backup)

https://bugs.winehq.org/show_bug.cgi?id=33849

Anastasius Focht focht@gmx.net changed:

--- Comment #9 from Anastasius Focht focht@gmx.net --- Hello folks,

64-bit 'Comodo Backup' also ships kernel drivers which try to access this range.

Download: http://download.comodo.com/cbu/download/setups/CB_setup.exe

Adjusting summary to collect more dupes here.

--- snip --- Unhandled exception: page fault on read access to 0xfffff78000000320 in 64-bit code (0x0000000000455034). Register dump: rip:0000000000455034 rsp:000000000043deb8 rbp:000000000043df90 eflags:00010246 ( R- -- I Z- -P- ) rax:fffff78000000320 rbx:000000000043f700 rcx:0000000000453100 rdx:00002b992ddfa232 rsi:000000000043e1e0 rdi:00007f1183a7a580 r8:000000000043e1e0 r9:00007f1183a7a5e0 r10:0000000000000008 r11:0000003157381420 r12:0000000000000000 r13:00007fff03d1d9b0 r14:000000000043f700 r15:0000000000000000 ... Backtrace: =>0 0x0000000000455034 in bdisk.sys (+0x15034) (0x000000000043df90) 1 0x0000000000455073 in bdisk.sys (+0x15072) (0x000000000043df90) 2 0x00007f1183878113 init_driver+0x11f(module=0x440000, keyname=0x43e1e0) [/home/focht/projects/wine/wine.repo/src/programs/winedevice/device.c:154] in winedevice (0x000000000043df90) 3 0x00007f11838788ca load_driver+0x569() [/home/focht/projects/wine/wine.repo/src/programs/winedevice/device.c:254] in winedevice (0x000000000043e290) ... 0x0000000000455034: movq (%rax),%rax Modules: Module Address Debug info Name (25 modules) PE 440000- 458000 Export bdisk.sys ELF 7b800000- 7bc87000 Deferred kernel32<elf> -PE 7b820000- 7bc87000 \ kernel32 ... Threads: process tid prio (all id:s are in hex) ... 00000012 (D) C:\windows\system32\winedevice.exe 00000018 0 <== 00000017 0 00000013 0 --- snip ---

$ sha1sum CB_setup.exe b5d3eddfca8605e9b96e4e080aedfce83c0ee883 CB_setup.exe

$ du -sh CB_setup.exe 25M CB_setup.exe

$ wine --version wine-1.7.25-51-g60de497

Regards

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

26 Sep 26 Sep

7:11 p.m.

New subject: [Bug 33849] Multiple 64-bit kernel drivers crash on access to KI_USER_SHARED_DATA range (0xfffff78000000000) (Tages DRM, Comodo Backup)

https://bugs.winehq.org/show_bug.cgi?id=33849

Anastasius Focht focht@gmx.net changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |shannongraham74@gmail.com

--- Comment #10 from Anastasius Focht focht@gmx.net --- *** Bug 37170 has been marked as a duplicate of this bug. ***

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

10 Nov 10 Nov

11:44 a.m.

New subject: [Bug 33849] Multiple 64-bit kernel drivers crash on access to KI_USER_SHARED_DATA range (0xfffff78000000000) (Tages DRM, Comodo Backup)

https://bugs.winehq.org/show_bug.cgi?id=33849

Sebastian Lackner sebastian@fds-team.de changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |sebastian@fds-team.de

--- Comment #11 from Sebastian Lackner sebastian@fds-team.de --- Created attachment 49951 --> https://bugs.winehq.org/attachment.cgi?id=49951 preliminary 64-bit instruction emulator for ntoskrnl

The following quick & dirty patch implements a 64-bit ntoskrnl instruction emulator for the KI_USER_SHARED_DATA page. I'll clean it up / check for errors during the next few days and then add it to the staging tree / try to submit it.

Please note that the data is not filled yet, but even a buffer filled with zeros seems to be sufficient to get around the first crash. Nevertheless, shortly afterwards, we get immediately the next crash.

--- snip --- 0044:trace:seh:raise_exception code=c0000005 flags=0 addr=0x447117 ip=447117 tid=0044 0044:trace:seh:raise_exception rax=5555555555555555 rbx=0000000000000000 rcx=0000000000011ed0 rdx=000000000043dfa0 0044:trace:seh:raise_exception rsi=00007fd69798fcc1 rdi=00007fd695e24bf1 rbp=000000000043e0a0 rsp=000000000043dd30 0044:trace:seh:raise_exception r8=00007fd6975f0a75 r9=000000000043e184 r10=000000000022e013 r11=0000000000000293 0044:trace:seh:raise_exception r12=0000000000012018 r13=000000000043f700 r14=0000000000000000 r15=000000000033df90 --- snip ---

Instruction causing the exception: --- snip --- .data:0x00000000 8b4818 mov ecx,DWORD PTR [rax+0x18] --- snip ---

No exception information is available, which means we arrived there using the following code path in ntdll/signal_x86_64.c (sic!):

--- snip --- case TRAP_x86_SEGNPFLT: /* Segment not present exception */ case TRAP_x86_PROTFLT: /* General protection fault */ case TRAP_x86_UNKNOWN: /* Unknown fault code */ rec->ExceptionCode = ERROR_sig(ucontext) ? EXCEPTION_ACCESS_VIOLATION : EXCEPTION_PRIV_INSTRUCTION; rec->ExceptionCode = EXCEPTION_ACCESS_VIOLATION; break; --- snip ---

The number 0x55555... looks like it could come from the following function in ntoskrnl.c:

--- snip --- /* process an ioctl request for a given device */ static NTSTATUS process_ioctl( DEVICE_OBJECT *device, ULONG code, void *in_buff, ULONG in_size, void *out_buff, ULONG *out_size ) { IRP irp; MDL mdl; IO_STACK_LOCATION irpsp; PDRIVER_DISPATCH dispatch = device->DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL]; NTSTATUS status; LARGE_INTEGER count;

TRACE( "ioctl %x device %p in_size %u out_size %u\n", code, device, in_size, *out_size );

/* so we can spot things that we should initialize */ memset( &irp, 0x55, sizeof(irp) ); <--------------- memset( &irpsp, 0x66, sizeof(irpsp) ); memset( &mdl, 0x77, sizeof(mdl) ); --- snip ---

@Anastatius: Could you please confirm that this is a different bug?

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

9:06 p.m.

New subject: [Bug 33849] Multiple 64-bit kernel drivers crash on access to KI_USER_SHARED_DATA range (0xfffff78000000000) (Tages DRM, Comodo Backup)

https://bugs.winehq.org/show_bug.cgi?id=33849

--- Comment #12 from Sebastian Lackner sebastian@fds-team.de --- Updated version of the patch was added to the staging tree:

https://github.com/wine-compholio/wine-staging/tree/master/patches/ntoskrnl-...

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

10:58 p.m.

New subject: [Bug 33849] Multiple 64-bit kernel drivers crash on access to KI_USER_SHARED_DATA range (0xfffff78000000000) (Tages DRM, Comodo Backup)

https://bugs.winehq.org/show_bug.cgi?id=33849

--- Comment #13 from Sebastian Lackner sebastian@fds-team.de --- Next two issues:

* Tages tries to access irp.Tail.Overlay.OriginalFileObject (that was the remaining issue I mentioned in comment 11). Patch:

https://github.com/wine-compholio/wine-staging/tree/master/patches/ntoskrnl-...

* Tages gets stuck because dispatch routine status and irp.IoStatus.u.Status are different (bug 30155). Patch:

https://github.com/wine-compholio/wine-staging/tree/master/patches/ntoskrnl-...

With that fixed I now get a messagebox complaining about error 1. Log shows:

--- snip --- 002c:trace:ntoskrnl:process_ioctl ioctl 22e013 device 0x245f0 in_size 0 out_size 0 002c:Call ntdll.NtGetTickCount() ret=7f51994d9be7 002c:Ret ntdll.NtGetTickCount() retval=0e0d458e ret=7f51994d9be7 002c:Call driver dispatch 0x4470e0 (device=0x245f0,irp=0x43def0) 002c:trace:ntoskrnl:IofCompleteRequest 0x43def0 0 002c:trace:ntoskrnl:IoCompleteRequest 0x43def0 0 002c:Ret driver dispatch 0x4470e0 (device=0x245f0,irp=0x43def0) retval=c0000002 002c:fixme:ntoskrnl:process_ioctl driver returned status=c0000002 != irp.IoStatus.u.Status=55555555 002c:Call KERNEL32.WaitForMultipleObjects(00000002,0043e0f0,00000000,ffffffff) ret=7f51994d54d5 --- snip ---

c0000002 = STATUS_NOT_IMPLEMENTED, so we most likely hit some unimplemented code path. Unfortunately not even +relay is helpful. :/

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

15 Jan 15 Jan

9:21 a.m.

New subject: [Bug 33849] Multiple 64-bit kernel drivers crash on access to KI_USER_SHARED_DATA range (0xfffff78000000000) (Tages DRM, Comodo Backup)

https://bugs.winehq.org/show_bug.cgi?id=33849

Saulius K. saulius2@gmail.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |saulius2@gmail.com

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

18 Apr 18 Apr

9:58 p.m.

New subject: [Bug 33849] Multiple 64-bit kernel drivers crash on access to KI_USER_SHARED_DATA range (0xfffff78000000000) (Tages DRM, Comodo Backup)

https://bugs.winehq.org/show_bug.cgi?id=33849

Anastasius Focht focht@gmx.net changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |meyer.adrian@bluewin.ch

--- Comment #14 from Anastasius Focht focht@gmx.net --- *** Bug 38430 has been marked as a duplicate of this bug. ***

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

19 Jun 19 Jun

2:09 p.m.

New subject: [Bug 33849] Multiple 64-bit kernel drivers crash on access to KI_USER_SHARED_DATA range (0xfffff78000000000) (Tages DRM, Comodo Backup)

https://bugs.winehq.org/show_bug.cgi?id=33849

--- Comment #15 from Sebastian Lackner sebastian@fds-team.de --- Should be fixed with http://source.winehq.org/git/wine.git/commit/9c789f2949faa14dc98df6a42b7e04b... and previous patches, please retest. If there are additional assembler instructions which have to be emulated, please open a new bug report (and add me as CC).

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

8 p.m.

New subject: [Bug 33849] Multiple 64-bit kernel drivers crash on access to KI_USER_SHARED_DATA range (0xfffff78000000000) (Tages DRM, Comodo Backup)

https://bugs.winehq.org/show_bug.cgi?id=33849

Anastasius Focht focht@gmx.net changed:

--- Comment #16 from Anastasius Focht focht@gmx.net --- Hello folks,

this is fixed by commits:

https://source.winehq.org/git/wine.git/commitdiff/0b06d4c4a36e34b314c1886a30... ("ntoskrnl: Add initial code to emulate memory access to USER_SHARED_DATA on x86_64.")

https://source.winehq.org/git/wine.git/commitdiff/411cdebaede4274d43e1ad4d1b... ("ntoskrnl: Add emulation for 'mov Ob, AL' and 'mov Ovqp, rAX' instruction.")

https://source.winehq.org/git/wine.git/commitdiff/9c789f2949faa14dc98df6a42b... ("ntoskrnl: Add emulation for 'movzx {Eb,Ew}, Gv' instruction.")

Thanks Sebastian.

--- snip --- ... 000f:Call KERNEL32.CreateProcessW(00000000,000206a0 L"C:\windows\system32\winedevice.exe bdisk",00000000,00000000,00000000,00000400,00440000,00000000,0023f980,0023f9f0) ret=7f02b884d82c ... 0013:Call KERNEL32.__wine_kernel_init() ret=7f0a05072709 000f:Ret KERNEL32.CreateProcessW() retval=00000001 ret=7f02b884d82c ... 0018:Call advapi32.RegisterServiceCtrlHandlerExW(0001967e L"bdisk",7f09fe2ca27b,00000000) ret=7f09fe2ca635 0018:Ret advapi32.RegisterServiceCtrlHandlerExW() retval=00023e00 ret=7f09fe2ca635 ... 0018:Call KERNEL32.LoadLibraryW(00024850 L"system32\drivers\bdisk.sys") ret=7f09fe2c916f ... 0018:Ret KERNEL32.LoadLibraryW() retval=00440000 ret=7f09fe2c916f ... 0018:Call driver init 0x455064 (obj=0x7f09fe4cc5a0,str=L"\Registry\Machine\System\CurrentControlSet\Services\bdisk") 0018:trace:seh:raise_exception code=c0000005 flags=0 addr=0x455034 ip=455034 tid=0018 0018:trace:seh:raise_exception info[0]=0000000000000000 0018:trace:seh:raise_exception info[1]=fffff78000000320 0018:trace:seh:raise_exception rax=fffff78000000320 rbx=00007f09fe4cc5a0 rcx=0000000000453100 rdx=00002b992ddfa232 0018:trace:seh:raise_exception rsi=000000000043eb9b rdi=000000000043eb20 rbp=000000000043dfd0 rsp=000000000043dee8 0018:trace:seh:raise_exception r8=000000000043e220 r9=00007f09fe4cc5a0 r10=6b736964625c5c73 r11=0000003f72b8cd30 0018:trace:seh:raise_exception r12=000000000033ddff r13=000000000043f700 r14=0000000000000000 r15=0000000000000000 0018:trace:seh:call_vectored_handlers calling handler at 0x7f09fddbe0d5 code=c0000005 flags=0 0018:trace:int:vectored_handler next instruction rip=455037 0018:trace:int:vectored_handler rax=0000000000000050 rbx=00007f09fe4cc5a0 rcx=0000000000453100 rdx=00002b992ddfa232 0018:trace:int:vectored_handler rsi=000000000043eb9b rdi=000000000043eb20 rbp=000000000043dfd0 rsp=000000000043dee8 0018:trace:int:vectored_handler r8=000000000043e220 r9=00007f09fe4cc5a0 r10=6b736964625c5c73 r11=0000003f72b8cd30 0018:trace:int:vectored_handler r12=000000000033ddff r13=000000000043f700 r14=0000000000000000 r15=0000000000000000 0018:trace:seh:call_vectored_handlers handler at 0x7f09fddbe0d5 returned ffffffff 0018:Call ntdll.RtlInitUnicodeString(0043def0,00448250 L"\Device\BDisk") ret=00445455 0018:Ret ntdll.RtlInitUnicodeString() retval=0043def0 ret=00445455 0018:Call ntoskrnl.exe.IoCreateDevice(7f09fe4cc5a0,00000400,0043def0,00000022,00000100,7f0a0536a600,0043df30) ret=00445488 0018:trace:ntoskrnl:IoCreateDevice (0x7f09fe4cc5a0, 1024, L"\Device\BDisk", 34, 100, 0, 0x43df30) 0018:Call ntdll.RtlAllocateHeap(00010000,00000008,00000548) ret=7f09fddc12d0 0018:Ret ntdll.RtlAllocateHeap() retval=0002a940 ret=7f09fddc12d0 0018:Ret ntoskrnl.exe.IoCreateDevice() retval=00000000 ret=00445488 0018:Call ntdll.RtlInitUnicodeString(0043df00,00448290 L"\DosDevices\BDisk") ret=004454b4 0018:Ret ntdll.RtlInitUnicodeString() retval=0043df00 ret=004454b4 0018:Call ntoskrnl.exe.IoCreateSymbolicLink(0043df00,0043def0) ret=004454c4 0018:trace:ntoskrnl:IoCreateSymbolicLink L"\DosDevices\BDisk" -> L"\Device\BDisk" 0018:Call ntdll.NtCreateSymbolicLinkObject(0043dd48,000f0001,0043dd10,0043def0) ret=7f09fddc18e6 0018:Ret ntdll.NtCreateSymbolicLinkObject() retval=00000000 ret=7f09fddc18e6 0018:Ret ntoskrnl.exe.IoCreateSymbolicLink() retval=00000000 ret=004454c4 0018:trace:seh:raise_exception code=c0000005 flags=0 addr=0x441e97 ip=441e97 tid=0018 0018:trace:seh:raise_exception info[0]=0000000000000000 0018:trace:seh:raise_exception info[1]=fffff78000000014 0018:trace:seh:raise_exception rax=fffff78000000014 rbx=000000000000016d rcx=000000000043de10 rdx=000000000043de10 0018:trace:seh:raise_exception rsi=0000000000448330 rdi=00007f09fe4cc6e8 rbp=000000000043dfd0 rsp=000000000043dd90 0018:trace:seh:raise_exception r8=00000000004482f0 r9=000000000043ded0 r10=0000000000000008 r11=000000000043de78 0018:trace:seh:raise_exception r12=00000000004482f0 r13=000000000043ded0 r14=0000000000000000 r15=0000000000000000 0018:trace:seh:call_vectored_handlers calling handler at 0x7f09fddbe0d5 code=c0000005 flags=0 0018:trace:int:vectored_handler next instruction rip=441e9a 0018:trace:int:vectored_handler rax=01d0aac9a737e5d6 rbx=000000000000016d rcx=000000000043de10 rdx=000000000043de10 0018:trace:int:vectored_handler rsi=0000000000448330 rdi=00007f09fe4cc6e8 rbp=000000000043dfd0 rsp=000000000043dd90 0018:trace:int:vectored_handler r8=00000000004482f0 r9=000000000043ded0 r10=0000000000000008 r11=000000000043de78 0018:trace:int:vectored_handler r12=00000000004482f0 r13=000000000043ded0 r14=0000000000000000 r15=0000000000000000 0018:trace:seh:call_vectored_handlers handler at 0x7f09fddbe0d5 returned ffffffff 0018:Call ntdll.RtlSystemTimeToLocalTime(0043de10,0043de10) ret=00441ea4 0018:Ret ntdll.RtlSystemTimeToLocalTime() retval=00000000 ret=00441ea4 0018:Call ntdll.ZwQueryInformationThread(fffffffffffffffe,00000000,0043de28,00000030,0043de20) ret=00441ee9 0018:Ret ntdll.ZwQueryInformationThread() retval=00000000 ret=00441ee9 ... 0018:Call msvcrt._vsnprintf(00024850,0000004d,004482f0 "BDisk Driver Started! Compilation date %s Compilation time %s\n",0043ded0) ret=00442040 0018:Ret msvcrt._vsnprintf() retval=0000004d ret=00442040 ... 0018:Ret driver init 0x455064 (obj=0x7f09fe4cc5a0,str=L"\Registry\Machine\System\CurrentControlSet\Services\bdisk") retval=00000000 0018:Call advapi32.SetServiceStatus(00023e00,0043e300) ret=7f09fe2ca715 --- snip ---

$ wine --version wine-1.7.45-147-gba00762

Regards

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

9:07 p.m.

New subject: [Bug 33849] Multiple 64-bit kernel drivers crash on access to KI_USER_SHARED_DATA range (0xfffff78000000000) (Tages DRM, Comodo Backup)

https://bugs.winehq.org/show_bug.cgi?id=33849

--- Comment #17 from Anastasius Focht focht@gmx.net --- Hello folks,

addendum for the curious ...

The 64-bit kernel drivers here don't suffer from bug 29168 ("Multiple games and applications need realtime updates to KSYSTEM_TIME members in KUSER_SHARED_DATA (Star Wars: The Old Republic game client, GO 1.4+ runtime)").

The KI_USER_SHARED_DATA+0x320 -> SharedTickCount is used to initialize the driver stack security cookie. Yes, even kernel drivers make use of this security concept (Windows Kernel-mode GS Cookies) and "fastfail" with bugcheck code 0x2 (kernel driver security cookie exception).

In newer Windows versions the OS loader generates a new security cookie, locates old security cookie in PE and replaces it - including kernel modules.