[Bug 23585] New: AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

Summary: AvaFX Trader program stop with error "The ordinal 37
                    could not be located in the DLL kernel32.dll"
           Product: Wine
           Version: 1.2-rc6
          Platform: x86
               URL: http://www.avafx.com/Download-Ava-Trader/
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: major
          Priority: P2
         Component: kernel32
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

I have downloaded the AvaFX Trader (Forex client) at
http://www.avafx.com/Download-Ava-Trader/.

I create demo account at :
https://www.avafx.com/Demo-Registration/

I use Wine 1.2-rc6 on Mandriva Linux 2010.0.
I clean the /home/user/.wine folder.

I do :
#sh winetricks winxp
#sh winetricks msxml3

During Installation, I have only this line for error :
$ wine AVA-Trader-setup.exe
fixme:shell:SHAutoComplete stub

and when I launch the AvaTrader sofware,
the program stop during the launch.
I can pass the login step

During launch I have only one error line :

$ pwd
/home/user/.wine/drive_c/Program Files/AVAFX

$ wine fx_loader.exe
fixme:shdocvw:OleObject_Close (0x126ca0)->(1)

and a wine window "Application error" with this message :
"The ordinal 37 could not be located in the DLL kernel32.dll".

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

Vitaliy Margolen  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |download
           Severity|major                       |normal

--- Comment #1 from Vitaliy Margolen   2010-07-09 22:05:03 ---
http://bugs.winehq.org/page.cgi?id=fields.html#bug_severity

Please attach as a plain text file complete terminal output.

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

--- Comment #2 from [e-mail]  2010-07-10 03:25:48 ---
I have downloaded the AvaFX Trader (Forex client) at
http://www.avafx.com/Download-Ava-Trader/.

I create demo account at :
https://www.avafx.com/Demo-Registration/

I use Wine 1.2-rc6 on Mandriva Linux 2010.0.
I clean the /home/user/.wine folder.

I do :
#sh winetricks winxp
#sh winetricks msxml3

And for the next log files, I made too :

#sh winetricks ie6

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

--- Comment #3 from [e-mail]  2010-07-10 03:26:31 ---
Created an attachment (id=29487)
 --> (http://bugs.winehq.org/attachment.cgi?id=29487)
AvaFX Trader installer log

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

--- Comment #4 from [e-mail]  2010-07-10 03:27:22 ---
Created an attachment (id=29488)
 --> (http://bugs.winehq.org/attachment.cgi?id=29488)
AvaFX Trader launch main program log

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

--- Comment #5 from [e-mail]  2010-07-10 05:47:15 ---
If I replace Wine's kernel32.dll 
with the Windows XP SP3's original kernel32.dll 
and I have still a wine window "Application error" with this message :
"The ordinal 37 could not be located in the DLL kernel32.dll".

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

--- Comment #6 from Dmitry Timoshkov   2010-07-10 11:52:28 ---
(In reply to comment #5)
> If I replace Wine's kernel32.dll 
> with the Windows XP SP3's original kernel32.dll

Don't do that, it can't work.

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

--- Comment #7 from Dmitry Timoshkov   2010-07-10 11:53:43 ---
Please attach a sceenshot of the error window.

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #8 from Anastasius Focht   2010-07-10 12:20:03 ---
Hello,

this problem can't be fixed in Wine -> WONTFIX.

The crashing app, located in "C:\users\<username>\Application
Data\AvaTrader\APP#<crc32>\Fx_Client.exe" is wrapped by PEcompact v2.x-3.x,
a PE compressor.

Most likely due to a bug in the PE compressor, there are some exports
accidentally referenced by ordinal (non-fixed ones across Windows versions).

Relevant PE compressor IAT, dumped from memory - partially restored up to
ordinals:

--- snip ---
...
00C09080  683D1EA0  offset advapi32.GetServiceKeyNameW
00C09084  683CF280  offset advapi32.EnumServicesStatusW
00C09088  683D0D10  offset advapi32.CloseServiceHandle
00C0908C  00000000
00C09090  80000025  -> kernel32 ordinal 0x25
00C09094  80000024  -> kernel32 ordinal 0x24
00C09098  80000023  -> kernel32 ordinal 0x23
00C0909C  00000000
00C090A0  0080D94E  Fx_Clien.0080D94E
00C090A4  0080D95E  Fx_Clien.0080D95E
00C090A8  0080D970  Fx_Clien.0080D970
....
--- snip ---

While restoring the IAT, the PE compressor encounters the ordinals and resolves
the first kernel32.dll ordinal 0x25 to "kernel386.exe16.GetProcAddress16".
The resolved API name is then reverse tokenized by "dot" to get the module
name: "kernel386.exe16.GetProcAddress16" -> "kernel386.exe16" and
"GetProcAddress16".

This serves as input for another consistency check: the PE compressor uses
GetModuleHandle() to fetch the module handle which fails in this case
("kernel386.exe16") because 16 bit modules are not loaded at this point - if
ever - resulting in "ordinal xx error".

In Windows these ordinals don't have that Wine-specific module name by design
and the resolved API are most likely never called by app code.
If the app calls these three ordinal-resolved imports it would crash for sure
because that kind of import-by-ordinal trickery is not applicable across
Windows versions and is only used for very specific API.

If you really want that app running in Wine, contact the vendor of the software
and ask them to repackage the client .exe with a bugfixed PE compressor version
or drop the use of PE compression/obfuscation tools at all.

Regards

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

--- Comment #9 from Alexandre Julliard   2010-07-10 12:40:41 ---
You could try setting version to win98, that would load the 16-bit modules by
default. I don't know if that would help.

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

--- Comment #10 from Anastasius Focht   2010-07-10 12:48:48 ---
Hello,

--- quote ---
You could try setting version to win98, that would load the 16-bit modules by
default. I don't know if that would help.
--- quote ---

Yes, that helps to have GetModuleHandle() return a valid module handle at this
stage and to keep the PE compressor silent (app gui comes up).

Though it doesn't change the fact that the code/PE compressor is wrong in first
place. These imports should never go by ordinal.
Any call to them would crash the whole thing -> pure luck that the app
starts/works in Windows.

Regards

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

--- Comment #11 from Anastasius Focht   2010-07-10 13:28:41 ---
Hello,

another thought: although this clearly looks like a standard 32 bit app
targeting NT-based systems there might exist some small legacy code within app
(seems to be Delphi-based) requiring 16 bit stuff, hence the PE compressor uses
the ordinals-import.

"KERNEL32 4.0 Ordinal-Only Exports":

http://www.geoffchappell.com/viewer.htm?doc=studies/windows/win32/kernel32/h...

--- quote ---
The table below lists all the KERNEL32 functions that are exported only by
ordinal in version 4.0, i.e., for Windows 95. These all continue into the
versions for Windows 98 and Windows Me. None are ever exported from any NT
build. 
--- quote ---

As stated there: this approach won't work for any NT-based system.

These ordinals will be resolved incorrectly on any native Windows NT-based
system.
If this app works in Windows NT+ it's because of pure luck (16 bit code parts
never called).

I think there is nothing to change in Wine. The user has to run this app in
Win9X mode to work around the bug.

Regards

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

Louis Lenders  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
                 CC|                            |[e-mail]
         Resolution|                            |WONTFIX

--- Comment #12 from Louis Lenders   2010-07-10 16:02:39 ---
> I think there is nothing to change in Wine. The user has to run this app in
> Win9X mode to work around the bug.
>
> Regards

We trust you ;) Then lets's resolve as WONTFIX

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

Louis Lenders  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #13 from Louis Lenders   2010-07-10 16:02:57 ---
closing

[Bug 23585] AvaFX Trader program stop with error "The ordinal 37 could not be located in the DLL kernel32.dll"

http://bugs.winehq.org/show_bug.cgi?id=23585

Dmitriy Anisimkov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #14 from Dmitriy Anisimkov   2010-08-13 00:18:48 ---
Looks like software provider would fix it in FX_Client version 4.2.63.11