[Bug 47047] New: 64-bit MRAC Anti-Cheat (My.Com Warface) kernel service crashes in driver entry point due to missing ' ntoskrnl.exe.MmGetPhysicalAddress' stub

https://bugs.winehq.org/show_bug.cgi?id=47047

Bug ID: 47047
           Summary: 64-bit MRAC Anti-Cheat (My.Com Warface) kernel service
                    crashes in driver entry point due to missing
                    'ntoskrnl.exe.MmGetPhysicalAddress' stub
           Product: Wine
           Version: 4.6
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: ntoskrnl
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Hello folks,

continuation of bug 47044

Download:

https://web.archive.org/web/20190331063634/http://static.gc.my.com/WarfaceMy...

--- snip ---
$ WINEDEBUG=+seh,+relay,+ntoskrnl notepad >>log.txt 2>&1 &

$ wine net start mracdrv
The MRAC Driver service is starting.
No system resources.

...
00a3:Call driver init 0x140098005
(obj=0x27980,str=L"\Registry\Machine\System\CurrentControlSet\Services\mracdrv") 
...
00a3:Call ntoskrnl.exe.MmGetSystemRoutineAddress(0002ad38) ret=14062f1a6
...
00a3:Call KERNEL32.GetModuleHandleW(7efc0ebad580 L"ntoskrnl.exe")
ret=7efc0eb9b3bc
00a3:Ret  KERNEL32.GetModuleHandleW() retval=7efc0eb80000 ret=7efc0eb9b3bc
00a3:Call KERNEL32.GetProcAddress(7efc0eb80000,00010eb0 "MmGetPhysicalAddress")
ret=7efc0eb9b3c9
00a3:Ret  KERNEL32.GetProcAddress() retval=7efc0eb85328 ret=7efc0eb9b3c9
...
00a3:trace:ntoskrnl:MmGetSystemRoutineAddress L"MmGetPhysicalAddress" ->
0x7efc0eb85328
00a3:Ret  ntoskrnl.exe.MmGetSystemRoutineAddress() retval=7efc0eb85328
ret=14062f1a6 
...
00a3:Call ntoskrnl.exe.ExpInterlockedPushEntrySList(140091f80,00032030)
ret=140998163
00a3:Call ntdll.RtlInterlockedPushEntrySList(140091f80,00032030) ret=7bc8de4f
00a3:Ret  ntdll.RtlInterlockedPushEntrySList() retval=0002ce10 ret=7bc8de4f
00a3:Ret  ntoskrnl.exe.ExpInterlockedPushEntrySList() retval=0002ce10
ret=140998163
00a3:Call KERNEL32.RaiseException(80000100,00000001,00000002,0032f340)
ret=7efc0eba5b29
00a3:trace:seh:NtRaiseException code=80000100 flags=1 addr=0x7b452d3c
ip=7b452d3c tid=00a3
00a3:trace:seh:NtRaiseException  info[0]=00007efc0eba5b4d
00a3:trace:seh:NtRaiseException  info[1]=00007efc0eba877c
00a3:trace:seh:call_vectored_handlers calling handler at 0x7efc0eb8d4e0
code=80000100 flags=1
00a3:trace:seh:call_vectored_handlers handler at 0x7efc0eb8d4e0 returned 0
wine: Call from 0x7b452d3c to unimplemented function
ntoskrnl.exe.MmGetPhysicalAddress, aborting 
...
--- snip ---

Microsoft docs:

https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/content/ntddk/...

Wine source:

https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/ntoskrnl.exe/ntoskrnl...

--- snip ---
 690 @ stub MmGetPhysicalAddress
--- snip ---

Returning PHYSICAL_ADDRESS with PhysicalAddress.QuadPart == 0 won't do any
good. You have to return a non-zero address. It seems the address is located
within a non-paged pool allocation (8 KB) some calls earlier. I used kva == pa
(1:1) mapping to keep it happy.

--- snip ---
...
0031:Call ntoskrnl.exe.ExAllocatePoolWithTag(00000000,00002000,4943414d)
ret=140ab5668
0031:Call ntdll.RtlAllocateHeap(00010000,00000000,00002000) ret=7f5fb4aec158
0031:Ret  ntdll.RtlAllocateHeap() retval=000372e0 ret=7f5fb4aec158
0031:trace:ntoskrnl:ExAllocatePoolWithTag 8192 pool 0 -> 0x372e0
0031:Ret  ntoskrnl.exe.ExAllocatePoolWithTag() retval=000372e0 ret=140ab5668 
...
0031:Call ntoskrnl.exe.ExpInterlockedPushEntrySList(140091f80,00031ff0)
ret=140998163
0031:Call ntdll.RtlInterlockedPushEntrySList(140091f80,00031ff0) ret=7bc8de4f
0031:Ret  ntdll.RtlInterlockedPushEntrySList() retval=0002cdd0 ret=7bc8de4f
0031:Ret  ntoskrnl.exe.ExpInterlockedPushEntrySList() retval=0002cdd0
ret=140998163
0031:Call ntoskrnl.exe.MmGetPhysicalAddress(00038000) ret=1403a839c
0031:fixme:ntoskrnl:MmGetPhysicalAddress stub: 0x38000
0031:Ret  ntoskrnl.exe.MmGetPhysicalAddress() retval=00038000 ret=1403a839c
0031:Call ntoskrnl.exe.ExpInterlockedPopEntrySList(140091f80) ret=14008d019
0031:Call ntdll.RtlInterlockedPopEntrySList(140091f80) ret=7bc8de4f
0031:Ret  ntdll.RtlInterlockedPopEntrySList() retval=00031ff0 ret=7bc8de4f
0031:Ret  ntoskrnl.exe.ExpInterlockedPopEntrySList() retval=00031ff0
ret=14008d019
0031:Call ntoskrnl.exe.ExpInterlockedPushEntrySList(140091f80,00031ff0)
ret=140ab62ab 
...
0031:Call
ntoskrnl.exe.IoAllocateMdl(00038000,00001000,00000000,00000000,00000000)
ret=140f3d8e4
0031:trace:ntoskrnl:IoAllocateMdl (0x38000, 4096, 0, 0, (nil))
0031:Call ntdll.RtlAllocateHeap(00010000,00000008,00000034) ret=7f5fb4aef514
0031:Ret  ntdll.RtlAllocateHeap() retval=00027af0 ret=7f5fb4aef514
0031:Ret  ntoskrnl.exe.IoAllocateMdl() retval=00027af0 ret=140f3d8e4 
...
0031:Call ntoskrnl.exe.MmProbeAndLockPages(00027af0,00000000,00000000)
ret=1403e3800
0031:fixme:ntoskrnl:MmProbeAndLockPages (0x27af0, 0, 0): stub
0031:Ret  ntoskrnl.exe.MmProbeAndLockPages() retval=0000003e ret=1403e3800 
...
0031:Call
ntoskrnl.exe.MmMapLockedPagesSpecifyCache(00027af0,00000000,00000001,00000000,00000000,00000010)
ret=140a50460
0031:fixme:ntoskrnl:MmMapLockedPagesSpecifyCache (0x27af0, 0, 1, (nil), 0, 16):
stub
0031:Ret  ntoskrnl.exe.MmMapLockedPagesSpecifyCache() retval=00000000
ret=140a50460 
...
0031:Call ntoskrnl.exe.MmUnlockPages(00027af0) ret=140d4aa34
0031:fixme:ntoskrnl:MmUnlockPages (0x27af0): stub
0031:Ret  ntoskrnl.exe.MmUnlockPages() retval=00000032 ret=140d4aa34
...
0031:Call ntoskrnl.exe.IoFreeMdl(00027af0) ret=140ea7c48
0031:trace:ntoskrnl:IoFreeMdl 0x27af0
0031:Call ntdll.RtlFreeHeap(00010000,00000000,00027af0) ret=7f5fb4aef6ef
0031:Ret  ntdll.RtlFreeHeap() retval=00000001 ret=7f5fb4aef6ef
0031:Ret  ntoskrnl.exe.IoFreeMdl() retval=00000001 ret=140ea7c48 
...
0033:Call ntoskrnl.exe.PsTerminateSystemThread(00000000) ret=1400112a1
0033:trace:ntoskrnl:PsTerminateSystemThread status 0.
0033:Call KERNEL32.ExitThread(00000000) ret=7f5fb4af90ee 
...
0031:Ret  ntdll.NtWaitForMultipleObjects() retval=00000000 ret=7f5fb4afeec1 
...
0031:Ret  driver init 0x140098005
(obj=0x27940,str=L"\Registry\Machine\System\CurrentControlSet\Services\mracdrv")
retval=c000009a
...
0031:trace:ntoskrnl:init_driver init done for L"mracdrv" obj 0x27940
0031:trace:ntoskrnl:init_driver - DriverInit = 0x140098005
0031:trace:ntoskrnl:init_driver - DriverStartIo = (nil)
0031:trace:ntoskrnl:init_driver - DriverUnload = 0x1400291c0
0031:trace:ntoskrnl:init_driver - MajorFunction[0] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[1] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[2] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[3] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[4] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[5] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[6] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[7] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[8] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[9] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[10] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[11] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[12] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[13] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[14] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[15] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[16] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[17] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[18] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[19] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[20] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[21] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[22] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[23] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[24] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[25] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[26] = 0x1400291d4
0031:trace:ntoskrnl:init_driver - MajorFunction[27] = 0x7f5fb4af35c0
0031:trace:ntoskrnl:ObDereferenceObject (0x27940) ref=0
...
0031:err:ntoskrnl:ZwLoadDriver failed to create driver
L"\Registry\Machine\System\CurrentControlSet\Services\mracdrv": c000009a 
...
--- snip ---

That's bug 37355

$ sha1sum WarfaceMycomLoader_805e0da40d16630c2fe73ed12399cb48_.exe 
b07e87a029d6697ad823dc03fdbf297c406a91b9 
WarfaceMycomLoader_805e0da40d16630c2fe73ed12399cb48_.exe

$ du -sh WarfaceMycomLoader_805e0da40d16630c2fe73ed12399cb48_.exe 
6.8M    WarfaceMycomLoader_805e0da40d16630c2fe73ed12399cb48_.exe

$ wine --version
wine-4.6-61-g085e58878f

Regards

[Bug 47047] 64-bit MRAC Anti-Cheat (My.Com Warface) kernel service crashes in driver entry point due to missing ' ntoskrnl.exe.MmGetPhysicalAddress' stub

https://bugs.winehq.org/show_bug.cgi?id=47047

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download, obfuscation,
                   |                            |win64
                URL|                            |https://web.archive.org/web
                   |                            |/20190331063634/http://stat
                   |                            |ic.gc.my.com/WarfaceMycomLo
                   |                            |ader.exe#0.7927247509897362

[Bug 47047] 64-bit MRAC Anti-Cheat (My.Com Warface) kernel service crashes in driver entry point due to missing ' ntoskrnl.exe.MmGetPhysicalAddress' stub

https://bugs.winehq.org/show_bug.cgi?id=47047

Jacek Caban  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #1 from Jacek Caban  ---
Created attachment 64757
  --> https://bugs.winehq.org/attachment.cgi?id=64757
hack

The attached hack gets the driver past this bug and but 37355.

[Bug 47047] 64-bit MRAC Anti-Cheat (My.Com Warface) kernel service crashes in driver entry point due to missing 'ntoskrnl.exe.MmGetPhysicalAddress' stub

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47047

Gijs Vermeulen  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #2 from Gijs Vermeulen  ---
*** Bug 47890 has been marked as a duplicate of this bug. ***

[Bug 47047] Multiple kernel drivers crash due to missing 'ntoskrnl.exe.MmGetPhysicalAddress' semi-stub (64-bit MRAC Anti-Cheat (My.Com Warface) kernel service, DELL BIOS flash utility)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47047

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|64-bit MRAC Anti-Cheat      |Multiple kernel drivers
                   |(My.Com Warface) kernel     |crash due to missing
                   |service crashes in driver   |'ntoskrnl.exe.MmGetPhysical
                   |entry point due to missing  |Address' semi-stub (64-bit
                   |'ntoskrnl.exe.MmGetPhysical |MRAC Anti-Cheat (My.Com
                   |Address' stub               |Warface) kernel service,
                   |                            |DELL BIOS flash utility)

--- Comment #3 from Anastasius Focht  ---
Hello folks,

revisiting, still present.

The app/driver from bug 48674 (Dell Latitude E7250 System BIOS flash
utility/driver) also needs this, hence refining summary.

https://web.archive.org/web/20200228173348/https://dl.dell.com/FOLDER0562794...

--- snip ---
$ WINEDEBUG=+seh,+relay,+service,+ntoskrnl wine ./E7250A21.exe >>log.txt 2>&1

...
0009:Call KERNEL32.CreateFileA(00464fa4
"\\.\DBUtil_2_3",c0000000,00000000,00000000,00000003,00000080,00000000)
ret=004418c3 
...
0009:Ret  KERNEL32.CreateFileA() retval=00000058 ret=004418c3
...
0009:Call
KERNEL32.DeviceIoControl(00000058,9b0c1ec0,0032fa54,00000030,0032fa54,00000030,0032fa3c,00000000)
ret=00441901
...
002f:Call driver dispatch 0000000000911170
(device=00000000003E2E50,irp=0000000000450330) 
...
002f:Ret  driver dispatch 0000000000911170
(device=00000000003E2E50,irp=0000000000450330) retval=00000000 
...
002f:trace:ntoskrnl:dispatch_ioctl ioctl 9b0c1ec0 device 00000000003E2E50 file
00000000003E31B0 in_size 48 out_size 48
002f:trace:ntoskrnl:IoBuildDeviceIoControlRequest 9b0c1ec0, 00000000003E2E50,
00000000003E1920, 48, 00000000003E1920, 48, 0, 0000000000000000,
0000000000000000
...
002f:Call driver dispatch 0000000000911170
(device=00000000003E2E50,irp=0000000000450330)
002f:Call
ntoskrnl.exe.MmAllocateContiguousMemorySpecifyCache(00000050,00100000,ffff0000,00000000,00000000)
ret=0091524a
002f:fixme:ntoskrnl:MmAllocateContiguousMemorySpecifyCache 80, 100000 ffff0000
0 0 stub
002f:Call KERNEL32.VirtualAlloc(00000000,00000050,00003000,00000204)
ret=7bc9fdef
002f:Call
ntdll.NtAllocateVirtualMemory(ffffffffffffffff,008ff740,00000000,008ff748,00003000,00000204)
ret=7b027763
002f:Ret  ntdll.NtAllocateVirtualMemory() retval=00000000 ret=7b027763
002f:Ret  KERNEL32.VirtualAlloc() retval=00a60000 ret=7bc9fdef
002f:Ret  ntoskrnl.exe.MmAllocateContiguousMemorySpecifyCache() retval=00a60000
ret=0091524a
002f:Call KERNEL32.RaiseException(80000100,00000001,00000002,008ff7f0)
ret=18001c228
...
002f:trace:seh:raise_exception code=80000100 flags=1 addr=0x7b00f495
ip=7b00f495 tid=002f
002f:trace:seh:raise_exception  info[0]=0000000180036000
002f:trace:seh:raise_exception  info[1]=0000000180038b18
wine: Call from 0x7b00f495 to unimplemented function
ntoskrnl.exe.MmGetPhysicalAddress, aborting 
...
wine: Unimplemented function ntoskrnl.exe.MmGetPhysicalAddress called at
address 000000007B00F495 (thread 002f), starting debugger... 
--- snip ---

$ sha1sum E7250A21.exe 
ce5578f5c9ee0160a4a8f37c83c6a0c14c10a4f6  E7250A21.exe

$ du -sh E7250A21.exe 
8.6M    E7250A21.exe

$ wine --version
wine-5.2-312-gc6b852e3c3

Regards

[Bug 47047] Multiple kernel drivers crash due to missing 'ntoskrnl.exe.MmGetPhysicalAddress' semi-stub (64-bit MRAC Anti-Cheat (My.Com Warface) kernel service, DELL BIOS flash utility, BattlEye Anti-Cheat)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47047

Olivier F. R. Dierick  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Multiple kernel drivers     |Multiple kernel drivers
                   |crash due to missing        |crash due to missing
                   |'ntoskrnl.exe.MmGetPhysical |'ntoskrnl.exe.MmGetPhysical
                   |Address' semi-stub (64-bit  |Address' semi-stub (64-bit
                   |MRAC Anti-Cheat (My.Com     |MRAC Anti-Cheat (My.Com
                   |Warface) kernel service,    |Warface) kernel service,
                   |DELL BIOS flash utility)    |DELL BIOS flash utility,
                   |                            |BattlEye Anti-Cheat)
                 CC|                            |[e-mail]

[Bug 47047] Multiple kernel drivers crash due to missing 'ntoskrnl.exe.MmGetPhysicalAddress' semi-stub (64-bit MRAC Anti-Cheat (My.Com Warface) kernel service, DELL BIOS flash utility, BattlEye Anti-Cheat)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47047

François Gouget  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch
                 CC|                            |[e-mail]

[Bug 47047] Multiple kernel drivers crash due to missing 'ntoskrnl.exe.MmGetPhysicalAddress' semi-stub (64-bit MRAC Anti-Cheat (My.Com Warface) kernel service, DELL BIOS flash utility, BattlEye Anti-Cheat)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47047

Alex Henrie  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED
                 CC|                            |[e-mail]
      Fixed by SHA1|                            |c5c9c589743f921ce3dd0961cf0
                   |                            |51b0861fd75e7

--- Comment #4 from Alex Henrie  ---
Fixed by
https://source.winehq.org/git/wine.git/commitdiff/c5c9c589743f921ce3dd0961cf...

[Bug 47047] Multiple kernel drivers crash due to missing 'ntoskrnl.exe.MmGetPhysicalAddress' semi-stub (64-bit MRAC Anti-Cheat (My.Com Warface) kernel service, DELL BIOS flash utility, BattlEye Anti-Cheat)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47047

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #5 from Alexandre Julliard  ---
Closing bugs fixed in 6.15.

[Bug 47047] Multiple kernel drivers crash due to missing 'ntoskrnl.exe.MmGetPhysicalAddress' semi-stub (64-bit MRAC Anti-Cheat (My.Com Warface) kernel service, DELL BIOS flash utility, BattlEye Anti-Cheat)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47047

Michael Stefaniuc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |6.0.x

[Bug 47047] Multiple kernel drivers crash due to missing 'ntoskrnl.exe.MmGetPhysicalAddress' semi-stub (64-bit MRAC Anti-Cheat (My.Com Warface) kernel service, DELL BIOS flash utility, BattlEye Anti-Cheat)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=47047

Michael Stefaniuc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|6.0.x                       |---

--- Comment #6 from Michael Stefaniuc  ---
Removing the 6.0.x milestone from bug fixes included in 6.0.3.