[Bug 47145] New: Esportal client 1.0 (CS:GO anti-cheat) fails to start, reporting ' The procedure entry point K32GetWsChangesEx could not be located in the dynamic link library KERNEL32.dll '
https://bugs.winehq.org/show_bug.cgi?id=47145
Bug ID: 47145 Summary: Esportal client 1.0 (CS:GO anti-cheat) fails to start, reporting 'The procedure entry point K32GetWsChangesEx could not be located in the dynamic link library KERNEL32.dll' Product: Wine Version: 4.7 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: kernel32 Assignee: wine-bugs@winehq.org Reporter: focht@gmx.net Distribution: ---
Hello folks,
continuation of bug 47142
--- snip --- $ WINEDEBUG=+seh,+relay wine ./esportal-client.exe >>log.txt 2>&1 ... 002c:Starting process L"Z:\home\focht\Downloads\esportal-client.exe" (entryproc=0x141af9548) 002c:Call KERNEL32.LocalAlloc(00000000,00000150) ret=141c241f0 002c:Ret KERNEL32.LocalAlloc() retval=0008d220 ret=141c241f0 002c:Call KERNEL32.GetModuleHandleA(0024f5f0 "kernel32.dll") ret=141b63305 002c:Ret KERNEL32.GetModuleHandleA() retval=7b420000 ret=141b63305 002c:Call KERNEL32.GetModuleHandleA(0024f5f0 "ntdll.dll") ret=141b63305 002c:Ret KERNEL32.GetModuleHandleA() retval=7bc20000 ret=141b63305 002c:Call KERNEL32.IsDebuggerPresent() ret=141c73b0e 002c:Ret KERNEL32.IsDebuggerPresent() retval=00000000 ret=141c73b0e 002c:Call KERNEL32.CheckRemoteDebuggerPresent(ffffffffffffffff,0024f880) ret=141ba3cd6 002c:Ret KERNEL32.CheckRemoteDebuggerPresent() retval=00000001 ret=141ba3cd6 002c:Call ntdll.NtQueryInformationProcess(ffffffffffffffff,0000001e,0024fa98,00000008,00000000) ret=141c727c9 002c:Ret ntdll.NtQueryInformationProcess() retval=c0000353 ret=141c727c9 002c:Call ntdll.NtSetInformationThread(fffffffffffffffe,00000011,00000000,00000000) ret=141ca10c0 002c:Ret ntdll.NtSetInformationThread() retval=00000000 ret=141ca10c0 002c:Call ntdll.NtQuerySystemInformation(00000023,0024fda0,00000002,00000000) ret=141bea146 002c:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=141bea146 002c:Call ntdll.NtQuerySystemInformation(0000000b,0024f7e8,00000000,0024f7b8) ret=141bbf765 002c:Ret ntdll.NtQuerySystemInformation() retval=c0000004 ret=141bbf765 002c:Call KERNEL32.LocalAlloc(00000000,00003e78) ret=141c0fe1d 002c:Ret KERNEL32.LocalAlloc() retval=0008e2b0 ret=141c0fe1d 002c:Call ntdll.NtQuerySystemInformation(0000000b,0008e2b0,00003e78,00000000) ret=141cdf7d5 002c:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=141cdf7d5 002c:Call KERNEL32.LocalFree(0008e2b0) ret=141cb3812 002c:Ret KERNEL32.LocalFree() retval=00000000 ret=141cb3812 002c:Call KERNEL32.GetModuleFileNameW(140000000,0024fb4c,000000fe) ret=141cb3980 002c:Ret KERNEL32.GetModuleFileNameW() retval=0000002b ret=141cb3980 002c:Call ntdll.NtOpenFile(0024f908,80100080,0024f918,0024fb28,00000003,3100000000000060) ret=141c84e72 002c:Ret ntdll.NtOpenFile() retval=00000000 ret=141c84e72 002c:Call ntdll.NtCreateSection(0024f8e8,00000004,0024f918,00000000,00000002,3100000008000000,00000054) ret=141cbe391 002c:Ret ntdll.NtCreateSection() retval=00000000 ret=141cbe391 002c:Call ntdll.NtMapViewOfSection(00000058,ffffffffffffffff,0024f7f0,00000000,00000000,0024f8e0,0024f8f8,39f34cf100000001,00000000,00000002) ret=141c8c022 002c:Ret ntdll.NtMapViewOfSection() retval=00000000 ret=141c8c022 002c:Call ntdll.NtUnmapViewOfSection(ffffffffffffffff,00260000) ret=141c3da86 002c:Ret ntdll.NtUnmapViewOfSection() retval=00000000 ret=141c3da86 002c:Call ntdll.NtClose(00000058) ret=141c4450d 002c:Ret ntdll.NtClose() retval=00000000 ret=141c4450d 002c:Call ntdll.NtClose(00000054) ret=141cbe62c 002c:Ret ntdll.NtClose() retval=00000000 ret=141cbe62c 002c:Call ntdll.NtProtectVirtualMemory(ffffffffffffffff,0024f878,0024f9f8,00000040,0024f848) ret=141cc6fd0 002c:Ret ntdll.NtProtectVirtualMemory() retval=00000000 ret=141cc6fd0 002c:Call ntdll.NtProtectVirtualMemory(ffffffffffffffff,0024f878,0024f9f8,00000004,0024f848) ret=141cc6fd0 002c:Ret ntdll.NtProtectVirtualMemory() retval=00000000 ret=141cc6fd0 002c:Call ntdll.NtProtectVirtualMemory(ffffffffffffffff,0024f878,0024f9f8,00000040,0024f848) ret=141cc6fd0 002c:Ret ntdll.NtProtectVirtualMemory() retval=00000000 ret=141cc6fd0 002c:Call ntdll.NtProtectVirtualMemory(ffffffffffffffff,0024f878,0024f9f8,00000004,0024f848) ret=141cc6fd0 002c:Ret ntdll.NtProtectVirtualMemory() retval=00000000 ret=141cc6fd0 002c:Call ntdll.NtProtectVirtualMemory(ffffffffffffffff,0024f878,0024f9f8,00000004,0024f848) ret=141cc6fd0 002c:Ret ntdll.NtProtectVirtualMemory() retval=00000000 ret=141cc6fd0 002c:Call ntdll.NtProtectVirtualMemory(ffffffffffffffff,0024f878,0024f9f8,00000004,0024f848) ret=141cc6fd0 002c:Ret ntdll.NtProtectVirtualMemory() retval=00000000 ret=141cc6fd0 002c:Call KERNEL32.LocalAlloc(00000000,00003e6c) ret=141c5e9c3 002c:Ret KERNEL32.LocalAlloc() retval=0008e2b0 ret=141c5e9c3 002c:Call KERNEL32.LocalFree(0008e2b0) ret=141cdc635 002c:Ret KERNEL32.LocalFree() retval=00000000 ret=141cdc635 002c:Call KERNEL32.GetModuleHandleA(0024f5f0 "VERSION.dll") ret=141b63305 002c:Ret KERNEL32.GetModuleHandleA() retval=7f5e93ea0000 ret=141b63305 002c:Call KERNEL32.GetModuleHandleA(0024f5f0 "USER32.dll") ret=141b63305 002c:Ret KERNEL32.GetModuleHandleA() retval=7f5e858a0000 ret=141b63305 002c:Call KERNEL32.GetModuleHandleA(0024f5f0 "ADVAPI32.dll") ret=141b63305 002c:Ret KERNEL32.GetModuleHandleA() retval=7f5e85650000 ret=141b63305 002c:Call KERNEL32.GetModuleHandleA(0024f5f0 "RPCRT4.dll") ret=141b63305 002c:Ret KERNEL32.GetModuleHandleA() retval=7f5e85590000 ret=141b63305 002c:Call KERNEL32.GetModuleHandleA(0024f5f0 "ntdll.dll") ret=141b63305 002c:Ret KERNEL32.GetModuleHandleA() retval=7bc20000 ret=141b63305 002c:Call KERNEL32.GetModuleHandleA(0024f5f0 "SHLWAPI.dll") ret=141b63305 002c:Ret KERNEL32.GetModuleHandleA() retval=7f5e854f0000 ret=141b63305 002c:Call KERNEL32.GetModuleHandleA(0024f5f0 "CRYPT32.dll") ret=141b63305 002c:Ret KERNEL32.GetModuleHandleA() retval=7f5e853e0000 ret=141b63305 002c:Call KERNEL32.GetModuleHandleA(0024f5f0 "bcrypt.dll") ret=141b63305 002c:Ret KERNEL32.GetModuleHandleA() retval=7f5e853b0000 ret=141b63305 002c:Call KERNEL32.GetModuleHandleA(0024f5f0 "KERNEL32.dll") ret=141b63305 002c:Ret KERNEL32.GetModuleHandleA() retval=7b420000 ret=141b63305 002c:Call KERNEL32.GetModuleHandleA(0024f5d0 "ntdll") ret=140fbb088 002c:Ret KERNEL32.GetModuleHandleA() retval=7bc20000 ret=140fbb088 002c:Call KERNEL32.GetModuleHandleA(0024f5d0 "ntdll") ret=140fbb088 002c:Ret KERNEL32.GetModuleHandleA() retval=7bc20000 ret=140fbb088 002c:Call KERNEL32.GetModuleHandleA(0024f5d0 "ntdll") ret=140fbb088 002c:Ret KERNEL32.GetModuleHandleA() retval=7bc20000 ret=140fbb088 002c:Call KERNEL32.GetModuleHandleA(0024f5d0 "ntdll") ret=140fbb088 002c:Ret KERNEL32.GetModuleHandleA() retval=7bc20000 ret=140fbb088 002c:Call KERNEL32.GetModuleHandleA(0024f5d0 "ntdll") ret=140fbb088 002c:Ret KERNEL32.GetModuleHandleA() retval=7bc20000 ret=140fbb088 002c:Call KERNEL32.GetModuleHandleA(0024f5d0 "ntdll") ret=140fbb088 002c:Ret KERNEL32.GetModuleHandleA() retval=7bc20000 ret=140fbb088 002c:Call KERNEL32.GetModuleHandleA(0024f5d0 "ntdll") ret=140fbb088 002c:Ret KERNEL32.GetModuleHandleA() retval=7bc20000 ret=140fbb088 002c:Call KERNEL32.GetModuleHandleA(0024f5d0 "ntdll") ret=140fbb088 002c:Ret KERNEL32.GetModuleHandleA() retval=7bc20000 ret=140fbb088 002c:Call KERNEL32.GetModuleHandleA(0024f5d0 "ntdll") ret=140fbb088 002c:Ret KERNEL32.GetModuleHandleA() retval=7bc20000 ret=140fbb088 002c:Call KERNEL32.GetModuleHandleA(0024f5d0 "ntdll") ret=140fbb088 002c:Ret KERNEL32.GetModuleHandleA() retval=7bc20000 ret=140fbb088 002c:Call KERNEL32.GetModuleHandleA(0024f5d0 "ntdll") ret=140fbb088 002c:Ret KERNEL32.GetModuleHandleA() retval=7bc20000 ret=140fbb088 002c:Call KERNEL32.GetModuleFileNameW(140000000,0024ecd0,00000104) ret=141c89c87 002c:Ret KERNEL32.GetModuleFileNameW() retval=0000002b ret=141c89c87 002c:Call user32.GetProcessWindowStation() ret=141c20392 002c:Ret user32.GetProcessWindowStation() retval=00000034 ret=141c20392 002c:Call user32.GetUserObjectInformationW(00000034,00000001,0024ecb0,0000000c,0024f728) ret=141b8f51d 002c:Ret user32.GetUserObjectInformationW() retval=00000001 ret=141b8f51d 002c:Call KERNEL32.LoadLibraryA(0024eb40 "user32.dll") ret=141b8edf6 002c:Ret KERNEL32.LoadLibraryA() retval=7f5e858a0000 ret=141b8edf6 002c:Call user32.MessageBoxW(00000000,0024eee0 L"The procedure entry point K32GetWsChangesEx could not be located in the dynamic link library KERNEL32.dll",0024ed00 L"esportal-client.exe",00000010) ret=141be4e0e --- snip ---
$ sha1sum esportal-client.exe 356be58c352fe9e1ffbbf742393875806910e3d1 esportal-client.exe
$ du -sh esportal-client.exe 14M esportal-client.exe
$ wine --version wine-4.7-265-g622422e67b
Regards
https://bugs.winehq.org/show_bug.cgi?id=47145
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- URL| |https://web.archive.org/web | |/20190507163228/https://sta | |tic.esportal.com/esportal-c | |lient.exe Keywords| |download, obfuscation
--- Comment #1 from Anastasius Focht focht@gmx.net --- Hello folks,
filling fields ...
Patch: https://source.winehq.org/patches/data/164242 (although referencing the initial "meta" bug 47131)
Regards
https://bugs.winehq.org/show_bug.cgi?id=47145
pattietreutel katyaberezyaka@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |katyaberezyaka@gmail.com
https://bugs.winehq.org/show_bug.cgi?id=47145
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Fixed by SHA1| |fb4116ee02cb4e8f31a2f4de7bd | |3b6ebfdfc7a2d Status|NEW |RESOLVED Resolution|--- |FIXED
--- Comment #2 from Anastasius Focht focht@gmx.net --- Hello folks,
this is fixed by commit https://source.winehq.org/git/wine.git/commitdiff/fb4116ee02cb4e8f31a2f4de7b... ("kernel32: Add K32GetWsChangesEx stub")
Thanks Louis
The next problem is already covered by existing issues. The protection scheme directly loads Wine placeholder/fake dlls and traverses the PE structure/directories on its own.
--- snip --- $ WINEDEBUG=+seh,+relay,+ntdll wine ./esportal-client.exe >>log.txt 2>&1 ... 002c:Call KERNEL32.GetSystemDirectoryW(0024ee70,00000104) ret=140f9bca3 002c:Ret KERNEL32.GetSystemDirectoryW() retval=00000013 ret=140f9bca3 002c:Call KERNEL32.GetLastError() ret=1403b5644 002c:Ret KERNEL32.GetLastError() retval=00000000 ret=1403b5644 002c:Call KERNEL32.CreateFileW(0024f080 L"C:\windows\system32\ntdll.dll",80000000,00000005,00000000,00000003,100000080,00000000) ret=140f9bcb9 002c:trace:ntdll:FILE_CreateFile handle=0x24eae8 access=80100080 name=L"\??\C:\windows\system32\ntdll.dll" objattr=00000040 root=(nil) sec=(nil) io=0x24eb00 alloc_size=(nil) attr=00000080 sharing=00000005 disp=1 options=00000060 ea=(nil).0x00000000 002c:Ret KERNEL32.CreateFileW() retval=00000074 ret=140f9bcb9 002c:Call KERNEL32.GetFileSize(00000074,00000000) ret=140f9bccc 002c:trace:ntdll:NtQueryInformationFile (0x74,0x24ecd0,0x24ece0,0x00000018,0x00000005) 002c:Ret KERNEL32.GetFileSize() retval=000009ac ret=140f9bccc 002c:Call KERNEL32.CreateFileMappingW(00000074,00000000,00000002,00000000,00000000,00000000) ret=140f9bcd7 002c:Ret KERNEL32.CreateFileMappingW() retval=00000078 ret=140f9bcd7 002c:Call KERNEL32.MapViewOfFile(00000078,00000004,00000000,00000000,00000000) ret=140f9bcea 002c:Ret KERNEL32.MapViewOfFile() retval=006a0000 ret=140f9bcea 002c:trace:seh:NtRaiseException code=c0000005 flags=0 addr=0x14089eef4 ip=14089eef4 tid=002c 002c:trace:seh:NtRaiseException info[0]=0000000000000000 002c:trace:seh:NtRaiseException info[1]=00000000006b6934 002c:trace:seh:NtRaiseException rax=00000000006b6934 rbx=000000000024ed00 rcx=00000001406fcd02 rdx=00000000006a0000 002c:trace:seh:NtRaiseException rsi=000000000024edd4 rdi=0000000000000090 rbp=000000014089eee8 rsp=000000000024ebc0 002c:trace:seh:NtRaiseException r8=9856141f3472f13f r9=00000000000a4602 r10=0000000140ce0f97 r11=00000000000966fb 002c:trace:seh:NtRaiseException r12=0000000000000202 r13=6600000000f972df r14=fffffffffffc9c43 r15=0000000140ce11c4 002c:trace:seh:RtlVirtualUnwind type 1 rip 14089eef4 rsp 24ebc0 002c:trace:seh:dump_unwind_info **** func 7a15bf-95c9c7 002c:trace:seh:dump_unwind_info unwind info at 0x1407eceb4 flags 1 prolog 0x0 bytes function 0x1407a15bf-0x14095c9c7 002c:trace:seh:dump_unwind_info 0x5: subq $0xd0,%rsp 002c:trace:seh:dump_unwind_info 0x4: pushq %rbp 002c:trace:seh:dump_unwind_info 0x3: pushq %rsi 002c:trace:seh:dump_unwind_info 0x2: pushq %rdi 002c:trace:seh:dump_unwind_info 0x1: pushq %rbx 002c:trace:seh:dump_unwind_info handler 0x14079c5a5 data at 0x1407ecec8 002c:trace:seh:call_handler calling handler 0x14079c5a5 (rec=0x24ea80, frame=0x24ebc0 context=0x24df50, dispatch=0x24dcf0) 002c:warn:seh:setup_exception exception outside of stack limits in thread 002c eip 0000000140d5c789 esp fffffffffffffe80 stack 0x152000-0x250000 ... --- snip ---
* bug 4666 ("Many games bundled with HackShield anti-cheat system abort on startup with Hackshield error 108 (copy of system dlls, native vs. Wine placeholder)")
* bug 15437 ("Multiple programs using madCodeHook crash (in-memory PE image of Wine builtins vs. ELF image on disk)") -> 'kernel32.dll' etc.
* bug 45377 ("StreetFighter V Arcade Edition (Steam) custom protection scheme fails to validate in-memory 'ntdll.dll' PE header against on-disk fake-dll") -> 'ntdll.dll' etc.
Alexandre is still working on that part.
https://www.winehq.org/pipermail/wine-devel/2019-April/144818.html
$ wine --version wine-4.7-305-g9bcaf9769c
Regards
https://bugs.winehq.org/show_bug.cgi?id=47145
Alexandre Julliard julliard@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #3 from Alexandre Julliard julliard@winehq.org --- Closing bugs fixed in 4.8.
-
wine-bugs＠winehq.org