[Bug 11038] New: spurious messages and calls to unimplemented ntoskrnl. exe functions

http://bugs.winehq.org/show_bug.cgi?id=11038

Summary: spurious messages and calls to unimplemented
                    ntoskrnl.exe functions
           Product: Wine
           Version: CVS/GIT
          Platform: PC
        OS/Version: Linux
            Status: UNCONFIRMED
          Severity: minor
          Priority: P2
         Component: wine-kernel
        AssignedTo: [e-mail]
        ReportedBy: [e-mail]

This just started happening today. Oftentimes when I quit a program like
notepad, a message like the following would appear on the terminal a few
seconds later:

0x81c6a08:1: Event manual=1 signaled=0 name=""
0x81c9828:2: Thread id=000d unix pid=27619 unix tid=27619 teb=0x7ffd8000
state=1
0x81c9548:1: Security token
0x81c92c8:2: Process id=000c handles=(nil)
0x81c5b28:1: Security token
0x81c58a8:1: Process id=000a handles=(nil)
0x81b2288:1: Security token
0x80a1cf0:1: Process id=0008 handles=(nil)

Other times, I get non-fatal crashes with messages like the following:
wine: Call from 0x7b8404c0 to unimplemented function
ntoskrnl.exe.KeInitializeTimerEx, aborting
wine: Call from 0x7b8404c0 to unimplemented function
ntoskrnl.exe.KeInitializeSpinLock, aborting

Also, running wineprefixcreate now says:
err:wineboot:ProcessRunKeys RegOpenKey failed on
Software\Microsoft\Windows\CurrentVersion (2)

I tracked all this down to the following patch:

commit d55b2de5747da90666065b5ed2fdeb8049282419
Author: Alexandre Julliard 
Date:   Fri Jan 4 12:51:04 2008 +0100

kernel32: Launch wineboot on first startup of a wine process.

[Bug 11038] spurious messages and calls to unimplemented ntoskrnl. exe functions

http://bugs.winehq.org/show_bug.cgi?id=11038

--- Comment #1 from Vitaliy Margolen   2008-01-04 23:06:10 ---
You sure this is with clean ~/.wine dir? Sounds more like you got yourself a
virus/root-kit that wants to mess with the kernel.

[Bug 11038] spurious messages and calls to unimplemented ntoskrnl. exe functions

http://bugs.winehq.org/show_bug.cgi?id=11038

--- Comment #2 from Alexandre Julliard   2008-01-05 03:31:44 ---
(In reply to comment #0)
> This just started happening today. Oftentimes when I quit a program like
> notepad, a message like the following would appear on the terminal a few
> seconds later:
>
> 0x81c6a08:1: Event manual=1 signaled=0 name=""
> 0x81c9828:2: Thread id=000d unix pid=27619 unix tid=27619 teb=0x7ffd8000
> state=1
> 0x81c9548:1: Security token
> 0x81c92c8:2: Process id=000c handles=(nil)
> 0x81c5b28:1: Security token
> 0x81c58a8:1: Process id=000a handles=(nil)
> 0x81b2288:1: Security token
> 0x80a1cf0:1: Process id=0008 handles=(nil)

This is an object leak inside the wineserver, probably triggered by one of the
apps you have in your auto-run keys. A +server trace may help.

[Bug 11038] spurious messages and calls to unimplemented ntoskrnl. exe functions

http://bugs.winehq.org/show_bug.cgi?id=11038

--- Comment #3 from Lei Zhang   2008-01-06 03:50:10 ---
(In reply to comment #1)
> You sure this is with clean ~/.wine dir? Sounds more like you got yourself a
> virus/root-kit that wants to mess with the kernel.

Hrm, no, I wasn't using a clean .wine directory. It turns out culprit is
pxhelp20.sys, bundled with Picasa. (and many other windows software that do cd
burning)

[Bug 11038] spurious messages and calls to unimplemented ntoskrnl. exe functions

http://bugs.winehq.org/show_bug.cgi?id=11038

--- Comment #4 from Lei Zhang   2008-01-06 04:05:56 ---
Created an attachment (id=10072)
 --> (http://bugs.winehq.org/attachment.cgi?id=10072)
+server log

This +server log is from running notepad in a clean .wine directory.

[Bug 11038] spurious messages and calls to unimplemented ntoskrnl. exe functions

http://bugs.winehq.org/show_bug.cgi?id=11038

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |FIXED

--- Comment #5 from Alexandre Julliard   2008-01-08 05:19:21 ---
It should be fixed now.

[Bug 11038] spurious messages and calls to unimplemented ntoskrnl. exe functions

http://bugs.winehq.org/show_bug.cgi?id=11038

Lei Zhang  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #6 from Lei Zhang   2008-01-08 11:44:28 ---
Doesn't happen anymore with today's git.

[Bug 11038] spurious messages and calls to unimplemented ntoskrnl.exe functions

http://bugs.winehq.org/show_bug.cgi?id=11038

Austin English  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|CVS/GIT                     |unspecified