[Bug 58043] New: DVDFab won't run on Wine 10.3 because it thinks that there is a debugger running when there isn't

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=58043

Bug ID: 58043
           Summary: DVDFab won't run on Wine 10.3 because it thinks that
                    there is a debugger running when there isn't
           Product: Wine
           Version: 10.3
          Hardware: x86-64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: ntdll
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Created attachment 78297
  --> https://bugs.winehq.org/attachment.cgi?id=78297
Screenshot

To reproduce, run `wine dvdfab13_online_13037.exe`. When installation is
complete, an error dialog appears that says "A debugger has been found running
in your system. Please, unload it from memory and restart your program."

This error did not happen before Wine 10.3. `git bisect` says:

dc718fd33b23a6104a0fa2e971a358662bf766af is the first bad commit
commit dc718fd33b23a6104a0fa2e971a358662bf766af (HEAD)
Author:     Alexandre Julliard 
AuthorDate: Tue Feb 25 13:45:33 2025 +0100
Commit:     Alexandre Julliard 
CommitDate: Tue Feb 25 23:01:11 2025 +0100

ntdll: Add some missing Zw exports.

dlls/ntdll/ntdll.spec | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

$ sha256sum dvdfab13_online_13037.exe
9260ecbad0ddeeca876ff7adb35d26cffc7fb40399c814ae6fd369d2d7708791

[Bug 58043] DVDFab won't run on Wine 10.3 because it thinks that there is a debugger running when there isn't

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=58043

Alex Henrie  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                URL|                            |https://dl.dvdfab.cn/downlo
                   |                            |ad/67_13037_016df4ec/dvdfab
                   |                            |13_online_13037.exe
    Regression SHA1|                            |dc718fd33b23a6104a0fa2e971a
                   |                            |358662bf766af
           Keywords|                            |download, regression

[Bug 58043] DVDFab won't run on Wine 10.3 because it thinks that there is a debugger running when there isn't

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=58043

--- Comment #1 from Alex Henrie  ---
Commenting out both ZwAllocateReserveObject and ZwCallbackReturn in ntdll.spec
avoids the error.

[Bug 58043] DVDFab won't run on Wine 10.3 because it thinks that there is a debugger running when there isn't

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58043

--- Comment #2 from Alex Henrie  ---
Adding a non-existent function that starts with "Zw" to ntdll.spec, for example
"@stub ZwFoobar", also triggers the error. That makes me think that DVDFab is
looking at all ntdll functions that start with "Zw" and checking them for
something. I still don't know what exactly it doesn't like about
ZwAllocateReserveObject and ZwCallbackReturn though.

[Bug 58043] DVDFab won't run on Wine 10.3 because it thinks that there is a debugger running when there isn't

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58043

--- Comment #3 from Alex Henrie  ---
Okay, the problem is not with ZwAllocateReserveObject and ZwCallbackReturn
specifically: Commenting out any two (or more) Zw functions in ntdll.spec
before ZwClose avoids the error.

[Bug 58043] DVDFab won't run on Wine 10.3 because it thinks that there is a debugger running when there isn't

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58043

Paul Gofman  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #4 from Paul Gofman  ---
I had a look, with the current upstream Wine DRM takes a path which is bypassed
with the specified exports missing. With those present with the current Wine
git it is missing two things:

1. It starts doing direct syscalls.

https://gitlab.winehq.org/wine/wine-staging/-/blob/master/patches/ntdll-Sysc...
allows to do that in principle (although proper solution should be different).
Yet it hits p. 2. on the way.

2. With default Win10 version in the prefix those syscall numbers are hardcoded
in the DRM (matching those on Windows for specified version). So that would
need to match in Wine (or, as a hack, mapped in sigsys handler although that
can't be done unconditionally, more often DRMs detect actual syscall numbers
from syscall thunks or from Nt functions order). With Win version set to Win11
DRM fallbacks to detecting the numbers from actual ntdll and DVDFab starts with
the patch from p. 1.

[Bug 58043] DVDFab won't run on Wine 10.3 because it thinks that there is a debugger running when there isn't

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=58043

--- Comment #5 from Alex Henrie  ---
Thank you! I confirmed that DVDFab starts without error on Wine Staging 10.7
with the Windows version set to 11 in winecfg.