[Bug 45819] New: Symantec Eraser Control Driver 'eeCtrl64.sys' (Norton 360 ) fails in driver entry point due to ' ntoskrnl.exe.ExInitializeResourceLite' stub (needs STATUS_SUCCESS)
https://bugs.winehq.org/show_bug.cgi?id=45819
Bug ID: 45819 Summary: Symantec Eraser Control Driver 'eeCtrl64.sys' (Norton 360) fails in driver entry point due to 'ntoskrnl.exe.ExInitializeResourceLite' stub (needs STATUS_SUCCESS) Product: Wine Version: 3.15 Hardware: x86-64 OS: Linux Status: NEW Severity: normal Priority: P2 Component: ntoskrnl Assignee: wine-bugs@winehq.org Reporter: focht@gmx.net Distribution: ---
Hello folks,
continuation of bug 45800
The driver fails in entry point:
--- snip --- $ WINEDEBUG=+seh,+relay,+ntoskrnl wineboot >>log.txt 2>&1 ... 0016:trace:ntoskrnl:load_driver_module L"C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys": relocating from 0x10000 to 0x460000 ... 0016:Call driver init 0x4c6118 (obj=0x26d70,str=L"\Registry\Machine\System\CurrentControlSet\Services\eeCtrl") ... 0016:Call ntoskrnl.exe.ExInitializeResourceLite(0002c3b8) ret=00479191 0016:fixme:ntoskrnl:ExInitializeResourceLite stub: 0x2c3b8 0016:Ret ntoskrnl.exe.ExInitializeResourceLite() retval=c0000002 ret=00479191 0016:Call ntoskrnl.exe.RtlInitUnicodeString(0033f560,00466698 L"\??\EraserCtrlDrv") ret=00471cf6 0016:Call ntdll.RtlInitUnicodeString(0033f560,00466698 L"\??\EraserCtrlDrv") ret=7bcfe083 0016:Ret ntdll.RtlInitUnicodeString() retval=0033f560 ret=7bcfe083 0016:Ret ntoskrnl.exe.RtlInitUnicodeString() retval=0033f560 ret=00471cf6 0016:Call ntoskrnl.exe.IoDeleteSymbolicLink(0033f560) ret=00471d01 0016:Call ntdll.NtOpenSymbolicLinkObject(0033f3f0,00000000,0033f3c0) ret=7f321bd86b6c 0016:Ret ntdll.NtOpenSymbolicLinkObject() retval=00000000 ret=7f321bd86b6c 0016:Call ntdll.NtClose(0000003c) ret=7f321bd86c22 0016:Ret ntdll.NtClose() retval=00000000 ret=7f321bd86c22 0016:Ret ntoskrnl.exe.IoDeleteSymbolicLink() retval=00000000 ret=00471d01 0016:Call ntoskrnl.exe.IoWMIRegistrationControl(004c5a90,80000002) ret=00471d66 0016:fixme:ntoskrnl:IoWMIRegistrationControl (0x4c5a90 2147483650) stub 0016:Ret ntoskrnl.exe.IoWMIRegistrationControl() retval=00000000 ret=00471d66 0016:Call ntoskrnl.exe.IoDeleteDevice(0002fa30) ret=00471d77 0016:trace:ntoskrnl:IoDeleteDevice 0x2fa30 ... 0016:Ret driver init 0x4c6118 (obj=0x26d70,str=L"\Registry\Machine\System\CurrentControlSet\Services\eeCtrl") retval=c0000002 ... --- snip ---
That's due to 'ntoskrnl.exe.ExInitializeResourceLite' stub.
0xc0000002 -> STATUS_NOT_IMPLEMENTED
https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/ntoskrnl.exe/ntoskrnl...
--- snip --- 2002 */ 2003 NTSTATUS WINAPI ExInitializeResourceLite(PERESOURCE Resource) 2004 { 2005 FIXME( "stub: %p\n", Resource ); 2006 return STATUS_NOT_IMPLEMENTED; 2007 } --- snip ---
Turning this into a semi-stub, that is zero-initialize the caller supplied struct and returning 'STATUS_SUCCESS' is enough.
$ sha1sum N360-TW-21.1.0-EN.exe aa05ccf9668e166ef28923d451f1c2ecad6f75f1 N360-TW-21.1.0-EN.exe
$ du -sh N360-TW-21.1.0-EN.exe 202M N360-TW-21.1.0-EN.exe
$ wine --version wine-3.15-150-gb29cdbd5f2
Regards
https://bugs.winehq.org/show_bug.cgi?id=45819
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download URL| |http://buy-download.norton. | |com/downloads/2014/21.1/N36 | |0/US/N360-TW-21.1.0-EN.exe
https://bugs.winehq.org/show_bug.cgi?id=45819
Zebediah Figura z.figura12@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |z.figura12@gmail.com Assignee|wine-bugs@winehq.org |z.figura12@gmail.com
https://bugs.winehq.org/show_bug.cgi?id=45819
Zebediah Figura z.figura12@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |STAGED Depends on| |45844 Staged patchset| |https://github.com/wine-sta | |ging/wine-staging/tree/mast | |er/patches/ntoskrnl.exe-Res | |ources
--- Comment #1 from Zebediah Figura z.figura12@gmail.com --- I have a working implementation of this which I've pushed to Staging. However, it doesn't work in Wine yet, because it needs an implementation of KeGetCurrentThread().
https://bugs.winehq.org/show_bug.cgi?id=45819
Jacek Caban jacek@codeweavers.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |jacek@codeweavers.com
--- Comment #2 from Jacek Caban jacek@codeweavers.com --- (In reply to Zebediah Figura from comment #1)
I have a working implementation of this which I've pushed to Staging. However, it doesn't work in Wine yet, because it needs an implementation of KeGetCurrentThread().
Unless I'm missing something, you don't need the actual structue, just an unique thread identifier. For that you could just use PsGetCurrentThreadId() which is already implemented.
https://bugs.winehq.org/show_bug.cgi?id=45819
--- Comment #3 from Zebediah Figura z.figura12@gmail.com --- (In reply to Jacek Caban from comment #2)
(In reply to Zebediah Figura from comment #1)
I have a working implementation of this which I've pushed to Staging. However, it doesn't work in Wine yet, because it needs an implementation of KeGetCurrentThread().
Unless I'm missing something, you don't need the actual structue, just an unique thread identifier. For that you could just use PsGetCurrentThreadId() which is already implemented.
Problem there is that programs can pass (their own or a different) thread to ExReleaseResourceForThreadLite(), and that's supposed to be a KTHREAD pointer.
I guess we can skip that for now, though.
https://bugs.winehq.org/show_bug.cgi?id=45819
--- Comment #4 from Zebediah Figura z.figura12@gmail.com --- (In reply to Zebediah Figura from comment #3)
(In reply to Jacek Caban from comment #2)
(In reply to Zebediah Figura from comment #1)
I have a working implementation of this which I've pushed to Staging. However, it doesn't work in Wine yet, because it needs an implementation of KeGetCurrentThread().
Unless I'm missing something, you don't need the actual structue, just an unique thread identifier. For that you could just use PsGetCurrentThreadId() which is already implemented.
Problem there is that programs can pass (their own or a different) thread to ExReleaseResourceForThreadLite(), and that's supposed to be a KTHREAD pointer.
I guess we can skip that for now, though.
Well, maybe. The application attached to bug 33908 uses ExReleaseResourceForThreadLite().
And presumably we'll need a KTHREAD implementation eventually anyway. I did ask for feedback on how to add one [1], but got no response.
[1] https://www.winehq.org/pipermail/wine-devel/2019-January/138609.html
https://bugs.winehq.org/show_bug.cgi?id=45819
--- Comment #5 from Jacek Caban jacek@codeweavers.com --- (In reply to Zebediah Figura from comment #4)
(In reply to Zebediah Figura from comment #3)
Problem there is that programs can pass (their own or a different) thread to ExReleaseResourceForThreadLite(), and that's supposed to be a KTHREAD pointer.
I guess we can skip that for now, though.
Well, maybe. The application attached to bug 33908 uses ExReleaseResourceForThreadLite().
FWIW, MRAC seems happy with just ExInitializeResourceLite().
And presumably we'll need a KTHREAD implementation eventually anyway. I did ask for feedback on how to add one [1], but got no response.
[1] https://www.winehq.org/pipermail/wine-devel/2019-January/138609.html
Sure, ideally we'd have it implemented. I replied to wine-devel.
https://bugs.winehq.org/show_bug.cgi?id=45819
--- Comment #6 from Zebediah Figura z.figura12@gmail.com --- (In reply to Jacek Caban from comment #5)
(In reply to Zebediah Figura from comment #4)
(In reply to Zebediah Figura from comment #3)
Problem there is that programs can pass (their own or a different) thread to ExReleaseResourceForThreadLite(), and that's supposed to be a KTHREAD pointer.
I guess we can skip that for now, though.
Well, maybe. The application attached to bug 33908 uses ExReleaseResourceForThreadLite().
FWIW, MRAC seems happy with just ExInitializeResourceLite().
Sure, I expect most applications are, but as with spinlocks, I'd rather implement the whole suite properly so we don't run into annoying race conditions down the road.
https://bugs.winehq.org/show_bug.cgi?id=45819 Bug 45819 depends on bug 45844, which changed state.
Bug 45844 Summary: Battleye's BEDaisy.sys requires correct KeGetCurrentThread implementation https://bugs.winehq.org/show_bug.cgi?id=45844
What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Resolution|--- |FIXED
https://bugs.winehq.org/show_bug.cgi?id=45819
--- Comment #7 from Gijs Vermeulen gijsvrm@gmail.com --- This should be fixed by https://source.winehq.org/git/wine.git/commit/1304b4c71b8a49d4cd76d7d4a11c64870cc17b0a
https://bugs.winehq.org/show_bug.cgi?id=45819
Zebediah Figura z.figura12@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|STAGED |RESOLVED Assignee|z.figura12@gmail.com |wine-bugs@winehq.org Fixed by SHA1| |1304b4c71b8a49d4cd76d7d4a11 | |c64870cc17b0a
--- Comment #8 from Zebediah Figura z.figura12@gmail.com --- Yes, resolving fixed.
https://bugs.winehq.org/show_bug.cgi?id=45819
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- URL|http://buy-download.norton. |https://web.archive.org/web |com/downloads/2014/21.1/N36 |/20190410163558/http://buy- |0/US/N360-TW-21.1.0-EN.exe |download.norton.com/downloa | |ds/2014/21.1/N360/US/N360-T | |W-21.1.0-EN.exe
https://bugs.winehq.org/show_bug.cgi?id=45819
Alexandre Julliard julliard@winehq.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED
--- Comment #9 from Alexandre Julliard julliard@winehq.org --- Closing bugs fixed in 4.7.
-
wine-bugs＠winehq.org