[Bug 49290] New: Denuvo Anti-Cheat 'denuvo-anti-cheat.sys' crashes on access to 'ComponentGlobals' out parameter, returned by 'wdfldr.sys.WdfVersionBind'

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=49290

Bug ID: 49290
           Summary: Denuvo Anti-Cheat 'denuvo-anti-cheat.sys' crashes on
                    access to 'ComponentGlobals' out parameter, returned
                    by 'wdfldr.sys.WdfVersionBind'
           Product: Wine
           Version: 5.9
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: -unknown
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Hello folks,

continuation of bug 49193

--- snip ---
$ WINEDEBUG=+seh,+relay,+int,+ntoskrnl,+ntdll,+reg wine net start "Denuvo
Anti-Cheat" >>log.txt 2>&1
...
00d0:trace:seh:raise_exception  info[0]=0000000000000000
00d0:trace:seh:raise_exception  info[1]=0000000000000030
00d0:trace:seh:raise_exception  rax=0000000000000000 rbx=0000000000000000
rcx=5a6b5c4ad4f60000 rdx=0000000000000045
00d0:trace:seh:raise_exception  rsi=000000000078dfb8 rdi=000000000078de50
rbp=0000000000000000 rsp=0000000000b5f860
00d0:trace:seh:raise_exception   r8=0000000000000000  r9=0000000000b5ee22
r10=0000000000000000 r11=0000000000000000
00d0:trace:seh:raise_exception  r12=000000000078de50 r13=00007fffffea4000
r14=000000000078dfb8 r15=0000000000000000
00d0:trace:seh:call_vectored_handlers calling handler at 0x22d0a0 code=c0000005
flags=0
00d0:trace:seh:call_vectored_handlers handler at 0x22d0a0 returned 0
00d0:trace:seh:RtlVirtualUnwind type 1 rip c81116 rsp b5f860
00d0:trace:seh:dump_unwind_info **** func 1060-1182 
...
wine: Unhandled page fault on read access to 0000000000000030 at address
0000000000C81116 (thread 00d0), starting debugger... 
--- snip ---

Driver disassembly, showing it wants to access a field/member of opaque
'WDF_COMPONENT_GLOBALS' structure which is returned by WdfVersionBind():

--- snip ---
...
0000000140001104 | call denuvo-anti-cheat.14003AE20   |
0000000140001109 | cmp eax,ebp                        |
000000014000110B | mov ebx,eax                        |
000000014000110D | jl denuvo-anti-cheat.140001166     |
000000014000110F | mov rax,qword ptr ds:[1400AB9A8]   | ComponentGlobals
0000000140001116 | cmp byte ptr ds:[rax+30],bpl       | *boom*
000000014000111A | je denuvo-anti-cheat.140001140     |
000000014000111C | mov rax,qword ptr ds:[1400AB998]   |
0000000140001123 | cmp qword ptr ds:[rdi+68],rbp      |
0000000140001127 | cmovne rax,qword ptr ds:[rdi+68]   |
...
--- snip ---

Init/setup:

--- snip ---
...
000000014000108D | mov eax,208                        |
0000000140001092 | mov qword ptr ds:[1400AB9B0],rcx   |
0000000140001099 | lea rcx,qword ptr ds:[1400AB988]   |
00000001400010A0 | mov word ptr ds:[1400AB98A],ax     |
00000001400010A7 | lea rax,qword ptr ds:[1400AB9C0]   |
00000001400010AE | mov word ptr ds:[1400AB988],bp     |
00000001400010B5 | mov qword ptr ds:[1400AB990],rax   |
00000001400010BC | call qword ptr ds:[<&JMP.&RtlCopyUnicodeString>] |
00000001400010C2 | lea r9,qword ptr ds:[1400AB9A8]    | ComponentGlobals
00000001400010C9 | lea r8,qword ptr ds:[1400A7060]    | BindInfo
00000001400010D0 | lea rdx,qword ptr ds:[1400AB988]   | RegistryPath
00000001400010D7 | mov rcx,rdi                        | DriverObject
00000001400010DA | call denuvo-anti-cheat.14006F97A   | WdfVersionBind
00000001400010DF | cmp eax,ebp                        |
00000001400010E1 | jl denuvo-anti-cheat.14000116D     |
...
000000014006F97A | jmp qword ptr ds:[<&JMP.&WdfVersionBind>]        |
000000014006F980 | jmp qword ptr ds:[<&JMP.&WdfVersionBindClass>]   |
000000014006F986 | jmp qword ptr ds:[<&JMP.&WdfVersionUnbindClass>] |
000000014006F98C | jmp qword ptr ds:[<&JMP.&_purecall>]             |
--- snip ---

https://github.com/microsoft/Windows-Driver-Frameworks/blob/master/src/frame...

--- snip ---
//-----------------------------------------------------------------------------
// WDFLDR.SYS exported function prototype definitions
//-----------------------------------------------------------------------------
_Must_inspect_result_
NTSTATUS
WdfVersionBind(
    __in    PDRIVER_OBJECT DriverObject,
    __in    PUNICODE_STRING RegistryPath,
    __inout PWDF_BIND_INFO BindInfo,
    __out   PWDF_COMPONENT_GLOBALS* ComponentGlobals
);
--- snip ---

$ wine --version
wine-5.9-162-gcb67fb39ff

Regards

[Bug 49290] Denuvo Anti-Cheat 'denuvo-anti-cheat.sys' crashes on access to 'ComponentGlobals' out parameter, returned by 'wdfldr.sys.WdfVersionBind'

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=49290

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |obfuscation
                URL|                            |https://store.steampowered.
                   |                            |com/app/782330/

[Bug 49290] Denuvo Anti-Cheat 'denuvo-anti-cheat.sys' crashes on access to 'ComponentGlobals' out parameter, returned by 'wdfldr.sys.WdfVersionBind'

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=49290

[e-mail] changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #1 from [e-mail] ---
Hello,

The following app also requires this wdfldr.sys:
https://appdb.winehq.org/objectManager.php?sClass=application&iId=20040

--- snip ---
WINEDEBUG=+seh,+relay,+ntoskrnl wine net start mhyprot2 > mhyprot2.sys.log 2>&1
...
00c9:err:module:import_dll Library WDFLDR.SYS (which is needed by
L"C:\users\tiago\Temp\mhyprot2.sys") not found
--- snip ---
winedump -j import .wine/drive_c/users/tiago/Temp/mhyprot2.sys >
mhyprot2.sys.dump
...
--- snip ---
  offset 00009e50 WDFLDR.SYS
  Hint/Name Table: 0000E2B8
  TimeDateStamp:   00000000 (Wed Dec 31 21:00:00 1969)
  ForwarderChain:  00000000
  First thunk RVA: 00008028
   Thunk    Ordn  Name
  00008028     7  WdfVersionBindClass
  00008030     6  WdfVersionBind
  00008038     8  WdfVersionUnbind
  00008040     9  WdfVersionUnbindClass
--- snip ---
# from windows:
objdump -xs wdfldr.sys
...
[Ordinal/Name Pointer] Table
        [   0] DllInitialize
        [   1] DllUnload
        [   2] WdfLdrDiagnosticsValueByNameAsULONG
        [   3] WdfLdrQueryInterface
        [   4] WdfRegisterClassLibrary
        [   5] WdfRegisterLibrary
        [   6] WdfVersionBind
        [   7] WdfVersionBindClass
        [   8] WdfVersionUnbind
        [   9] WdfVersionUnbindClass
--- snip ---

I don't know how it works, from tag wine-5.21, I created a dlls/wdfldr.sys
based on dlls/scsiport.sys with the following stub:

--- snip ---
@ stub DllInitialize
@ stub DllUnload
@ stub WdfLdrDiagnosticsValueByNameAsULONG
@ stub WdfLdrQueryInterface
@ stub WdfRegisterClassLibrary
@ stub WdfRegisterLibrary
@ stub WdfVersionBind
@ stub WdfVersionBindClass
@ stub WdfVersionUnbind
@ stub WdfVersionUnbindClass
--- snip ---

In the end generated a file at
$WINEPREFIX/drive_c/windows/system32/drivers/wdfldr.sys the service still don't
recognize it.

[Bug 49290] Denuvo Anti-Cheat 'denuvo-anti-cheat.sys' crashes on access to 'ComponentGlobals' out parameter, returned by 'wdfldr.sys.WdfVersionBind'

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=49290

soredake  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

[Bug 49290] Denuvo Anti-Cheat 'denuvo-anti-cheat.sys' crashes on access to 'ComponentGlobals' out parameter, returned by 'wdfldr.sys.WdfVersionBind'

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=49290

soredake  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|broaden_acid002@simplelogin |
                   |.com                        |