[Bug 42716] New: IsDebuggerPresent returning TRUE

List overview All Threads

newer

older

[Bug 40418] New: Doom 4 requires...

[Bug 44277] New: WOLF RPG Editor:...

wine-bugs＠winehq.org

27 Mar 2017 27 Mar '17

2:44 a.m.

https://bugs.winehq.org/show_bug.cgi?id=42716

Bug ID: 42716 Summary: IsDebuggerPresent returning TRUE Product: Wine Version: 2.4 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: critical Priority: P2 Component: kernel32 Assignee: wine-bugs@winehq.org Reporter: dmpeletronic@gmail.com Distribution: ---

The function above is always returning true, depending on the machine. It seems that the struct is not initialized correctly.

BOOL WINAPI IsDebuggerPresent(void) { return NtCurrentTeb()->Peb->BeingDebugged; }

Please check the Peb and BeingDebugged initialization.

As consequence, some applications sometimes cannot be run, such as MetaTrader5, and we get a DialogBox: “A debugger has been found running in your system. Please unload it from your memory and restart your program”.

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

Show replies by date

wine-bugs＠winehq.org

27 Mar 27 Mar

5:15 p.m.

New subject: [Bug 42716] IsDebuggerPresent returning TRUE

https://bugs.winehq.org/show_bug.cgi?id=42716

Olivier F. R. Dierick o.dierick@piezo-forte.be changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |o.dierick@piezo-forte.be

--- Comment #1 from Olivier F. R. Dierick o.dierick@piezo-forte.be --- Not a critical bug.

According to the AppDB entry [1], the 64-bit executable fails with that error. The 32-bit executable does not.

[1] https://appdb.winehq.org/objectManager.php?sClass=version&iId=19984

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

8:02 p.m.

New subject: [Bug 42716] MetaTrader5 64-bit refuses to start when IsDebuggerPresent returns true

https://bugs.winehq.org/show_bug.cgi?id=42716

Jeff Zaroyko jeffz@jeffz.name changed:

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

9 Apr 9 Apr

10:58 a.m.

New subject: [Bug 42716] MetaTrader5 64-bit refuses to start when IsDebuggerPresent returns true

https://bugs.winehq.org/show_bug.cgi?id=42716

proggi proggi@yandex.ru changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |proggi@yandex.ru

--- Comment #2 from proggi proggi@yandex.ru --- It is a critical error, I can't connect 64 btny DLL to MetaTrader5 64 bit.

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

11 Apr 11 Apr

11:18 a.m.

New subject: [Bug 42716] MetaTrader5 64-bit refuses to start when IsDebuggerPresent returns true

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #3 from proggi proggi@yandex.ru --- wine 2.5 a problem is also present.

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

11:20 a.m.

New subject: [Bug 42716] MetaTrader5 64-bit refuses to start when IsDebuggerPresent returns true

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #4 from proggi proggi@yandex.ru --- link to a platform: https://www.metatrader5.com/

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

14 Apr 14 Apr

1:14 p.m.

New subject: [Bug 42716] MetaTrader5 64-bit refuses to start when IsDebuggerPresent returns true

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #5 from proggi proggi@yandex.ru --- wine 2.6 a problem is also present.

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

29 Apr 29 Apr

9:44 p.m.

New subject: [Bug 42716] MetaTrader5 64-bit refuses to start when IsDebuggerPresent returns true

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #6 from proggi proggi@yandex.ru --- MetaTrader5 64-bit WINE 2.7 kernel Linux debian 4.9.0-2-amd64 #1 SMP Debian 4.9.18-1 (2017-03-30) x86_64 GNU/Linux

I can't connect 64 btny DLL to MetaTrader5 64 bit.

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

27 Jun 27 Jun

3:23 p.m.

New subject: [Bug 42716] MetaTrader5 64-bit refuses to start when IsDebuggerPresent returns true

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #7 from proggi proggi@yandex.ru --- wine 2.11 a problem is also present. link to a platform: https://www.metatrader5.com/

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

9 Jul 9 Jul

9:12 a.m.

New subject: [Bug 42716] MetaTrader5 64-bit refuses to start when IsDebuggerPresent returns true

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #8 from proggi proggi@yandex.ru --- $ wine terminal64.exe &> log.txt

fixme:winediag:start_process Wine Staging 2.11 is a testing version containing experimental patches. fixme:winediag:start_process Please mention your exact version when filing bug reports on winehq.org. fixme:service:svcctl_EnumServicesStatusExW resume handle not supported fixme:service:svcctl_EnumServicesStatusExW resume handle not supported

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

5:21 p.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

Anastasius Focht focht@gmx.net changed:

--- Comment #9 from Anastasius Focht focht@gmx.net --- Hello folks,

the conclusion is wrong, correcting summary.

The app is wrapped with Denuvo "Anti-Tamper" x64 software protection.

ProtectionID scan:

--- snip --- -=[ ProtectionID v0.6.8.5 DECEMBER]=- (c) 2003-2017 CDKiLLER & TippeX Build 24/12/16-13:09:21 Ready... Scanning -> Z:\home\focht\Downloads\MetaTrader 5\terminal64.exe File Type : 64-Bit Exe (Subsystem : Win GUI / 2), Size : 16390320 (0FA18B0h) Byte(s) | Machine: 0x8664 (AMD64) [!] Warning -> File needs higher OS (Current OS : 05.01, Requires OS: 06.00) [!] Warning : File is 64 Bit, this os is NOT Compilation TimeStamp : 0x00F30400 -> Sat 04th Jul 1970 07:57:52 (GMT) [TimeStamp] 0x00F30400 -> Sat 04th Jul 1970 07:57:52 (GMT) | PE Header | - | Offset: 0x00000000:00000150 | VA: 0x00000001:40000150 | - [TimeStamp] 0x59009228 -> Wed 26th Apr 2017 12:27:20 (GMT) | DebugDirectory | - | Offset: 0x00000000:00CCA664 | VA: 0x00000001:41F49E64 | - [TimeStamp] 0x59009228 -> Wed 26th Apr 2017 12:27:20 (GMT) | DebugDirectory | - | Offset: 0x00000000:00CCA680 | VA: 0x00000001:41F49E80 | - [TimeStamp] 0x59009228 -> Wed 26th Apr 2017 12:27:20 (GMT) | DebugDirectory | - | Offset: 0x00000000:00CCA69C | VA: 0x00000001:41F49E9C | - -> File Appears to be Digitally Signed @ Offset 0F9FFA8h, size : 01908h / 06408 byte(s) -> File has 457640 (06FBA8h) bytes of appended data starting at offset 0F30400h [!] Executable uses TLS callbacks (3 total... 0 invalid addresses) [File Heuristics] -> Flag #1 : 00000100000001001101001000000101 (0x0404D205) [Entrypoint Section Entropy] : 7.99 (section #8) ".cod1 " | Size : 0xD3142C (13833260) byte(s) [DllCharacteristics] -> Flag : (0x8160) -> HEVA | ASLR | DEP | TSA [SectionCount] 11 (0xB) | ImageSize 0x2E15000 (48320512) byte(s) [VersionInfo] Company Name : MetaQuotes Software Corp. [VersionInfo] Product Name : MetaTrader 5 Client Terminal [VersionInfo] Product Version : 5.0.0.1596 [VersionInfo] File Description : MetaTrader 5 Client Terminal [VersionInfo] File Version : 5.0.0.1596 [VersionInfo] Original FileName : terminal.exe [VersionInfo] Internal Name : terminal.exe [VersionInfo] Version Comments : http://www.metaquotes.net [VersionInfo] Legal Trademarks : MetaTrader [VersionInfo] Legal Copyrights : © 2001-2017. MetaQuotes Software Corp. [ModuleReport] [IAT] Modules -> CRYPT32.dll | WINMM.dll | VERSION.dll | NETAPI32.dll | WINHTTP.dll | gdiplus.dll | UxTheme.dll | KERNEL32.dll | USER32.dll | GDI32.dll | MSIMG32.dll | WINSPOOL.DRV | ADVAPI32.dll | SHELL32.dll | COMCTL32.dll | SHLWAPI.dll | ole32.dll | OLEAUT32.dll | oledlg.dll | urlmon.dll | IPHLPAPI.DLL | dbghelp.dll | WS2_32.dll | Secur32.dll | OLEACC.dll | IMM32.dll | WTSAPI32.dll | KERNEL32.dll | USER32.dll | ADVAPI32.dll | KERNEL32.dll | ADVAPI32.dll [Debug Info] (record 1 of 3) (file offset 0xCCA660) Characteristics : 0x0 | TimeDateStamp : 0x59009228 (Wed 26th Apr 2017 12:27:20 (GMT)) | MajorVer : 0 / MinorVer : 0 -> (0.0) Type : 2 (0x2) -> CodeView | Size : 0x5B (91) AddressOfRawData : 0x1F499C0 | PointerToRawData : 0xCCA1C0 CvSig : 0x53445352 | SigGuid 5D5F75E6-83B5-4F0F-B56BB8527C4A0449 Age : 0x1 (1) | Pdb : E:\MetaTrader5\Client\MetaTrader5Terminal\Release64\terminal64.pdb [Debug Info] (record 2 of 3) (file offset 0xCCA67C) Characteristics : 0x0 | TimeDateStamp : 0x59009228 (Wed 26th Apr 2017 12:27:20 (GMT)) | MajorVer : 0 / MinorVer : 0 -> (0.0) Type : 12 (0xC) -> Undocumented | Size : 0x14 (20) AddressOfRawData : 0x1F49A20 | PointerToRawData : 0xCCA220 [Debug Info] (record 3 of 3) (file offset 0xCCA698) Characteristics : 0x0 | TimeDateStamp : 0x59009228 (Wed 26th Apr 2017 12:27:20 (GMT)) | MajorVer : 0 / MinorVer : 0 -> (0.0) Type : 13 (0xD) -> Undocumented | Size : 0x418 (1048) AddressOfRawData : 0x1F49A40 | PointerToRawData : 0xCCA240 [?] Possibly Denuvo "Anti-Tamper" x64 [CompilerDetect] -> Borland Delphi (unknown version) - 20% probability - Scan Took : 2.322 Second(s) [000000A76h (2678) tick(s)] [234 of 580 scan(s) done] --- snip ---

Some info:

https://steamcommunity.com/app/379720/discussions/0/357286119113278148/

https://www.reddit.com/r/CrackStatus/comments/43dgej/how_denuvo_works_and_wh...

Relevant trace log:

--- snip --- $ WINEDEBUG=+tid,+seh,+relay wine64 ./terminal64.exe >>log.txt 2>&1 ... 0037:Call TLS callback (proc=0x1416b3b84,module=0x140000000,reason=PROCESS_ATTACH,reserved=0) ... 0037:Call KERNEL32.GetModuleHandleA(0023f430 "kernel32.dll") ret=1416629fb 0037:Ret KERNEL32.GetModuleHandleA() retval=7b460000 ret=1416629fb 0037:Call KERNEL32.GetModuleHandleA(0023f430 "ntdll.dll") ret=1416629fb 0037:Ret KERNEL32.GetModuleHandleA() retval=7bc80000 ret=1416629fb 0037:Call KERNEL32.IsDebuggerPresent() ret=1416b988d 0037:Ret KERNEL32.IsDebuggerPresent() retval=00000000 ret=1416b988d 0037:Call KERNEL32.CheckRemoteDebuggerPresent(ffffffffffffffff,0023f68c) ret=1416b988d 0037:Ret KERNEL32.CheckRemoteDebuggerPresent() retval=00000001 ret=1416b988d 0037:Call ntdll.NtQueryInformationProcess(ffffffffffffffff,0000001e,0023f7f0,00000008,00000000) ret=1416b988d 0037:Ret ntdll.NtQueryInformationProcess() retval=c0000353 ret=1416b988d 0037:Call ntdll.NtSetInformationThread(fffffffffffffffe,00000011,00000000,00000000) ret=1416b988d 0037:Ret ntdll.NtSetInformationThread() retval=00000000 ret=1416b988d 0037:Call ntdll.NtQuerySystemInformation(00000023,0023fb20,00000002,00000000) ret=1416b988d 0037:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=1416b988d 0037:Call ntdll.NtQuerySystemInformation(0000000b,0023f5f8,00000000,0023fb38) ret=1416b988d 0037:Ret ntdll.NtQuerySystemInformation() retval=c0000004 ret=1416b988d 0037:Call KERNEL32.LocalAlloc(00000000,00005348) ret=1416b988d 0037:Ret KERNEL32.LocalAlloc() retval=00072080 ret=1416b988d 0037:Call ntdll.NtQuerySystemInformation(0000000b,00072080,00005348,00000000) ret=1416b988d 0037:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=1416b988d 0037:Call KERNEL32.LocalFree(00072080) ret=1416b988d 0037:Ret KERNEL32.LocalFree() retval=00000000 ret=1416b988d 0037:Call KERNEL32.VirtualProtect(140c7d000,0060201c,00000040,0023f670) ret=1416b988d 0037:Ret KERNEL32.VirtualProtect() retval=00000001 ret=1416b988d 0037:Call KERNEL32.VirtualProtect(1408b6000,0026ce26,00000004,0023f670) ret=1416b988d 0037:Ret KERNEL32.VirtualProtect() retval=00000001 ret=1416b988d 0037:Call KERNEL32.VirtualProtect(140001000,008b4744,00000040,0023f670) ret=1416b988d 0037:Ret KERNEL32.VirtualProtect() retval=00000001 ret=1416b988d 0037:Call KERNEL32.VirtualProtect(140bfb000,00063b70,00000004,0023f670) ret=1416b988d 0037:Ret KERNEL32.VirtualProtect() retval=00000001 ret=1416b988d 0037:Call KERNEL32.VirtualProtect(140c5f000,0001bcb8,00000004,0023f670) ret=1416b988d 0037:Ret KERNEL32.VirtualProtect() retval=00000001 ret=1416b988d 0037:Call KERNEL32.VirtualProtect(140c7b000,00000010,00000004,0023f670) ret=1416b988d 0037:Ret KERNEL32.VirtualProtect() retval=00000001 ret=1416b988d 0037:Call KERNEL32.VirtualProtect(140cae000,00005c58,00000004,0023f670) ret=1416b988d 0037:Ret KERNEL32.VirtualProtect() retval=00000001 ret=1416b988d 0037:Call KERNEL32.VirtualProtect(141fb3000,00e61674,00000004,0023f670) ret=1416b988d 0037:Ret KERNEL32.VirtualProtect() retval=00000001 ret=1416b988d ... 0037:Call KERNEL32.CloseHandle(deadc0de) ret=1416b988d 0037:Ret KERNEL32.CloseHandle() retval=00000000 ret=1416b988d 0037:trace:seh:raise_exception code=80000004 flags=0 addr=0x141f49833 ip=141f49833 tid=0037 0037:trace:seh:raise_exception rax=00000000e9b2b85c rbx=0000000141685350 rcx=00000000deadc0de rdx=00000000000055d1 0037:trace:seh:raise_exception rsi=0000000000000000 rdi=aaaaaaaaaaaaaaab rbp=000000000023f5a0 rsp=000000000023f550 0037:trace:seh:raise_exception r8=0000000000267148 r9=000000000000a388 r10=00000000c5fb301a r11=0000000000000038 0037:trace:seh:raise_exception r12=0000000141669385 r13=0000000000000048 r14=0000000000000004 r15=000000014166898c 0037:trace:seh:RtlVirtualUnwind type 1 rip 141f49833 rsp 23f550 0037:trace:seh:dump_unwind_info **** func 1f49767-1f498fa 0037:trace:seh:dump_unwind_info unwind info at 0x14164c650 flags 1 prolog 0x19 bytes function 0x141f49767-0x141f498fa ... 0037:trace:seh:call_handler calling handler 0x140c97ee0 (rec=0x23f410, frame=0x23f550 context=0x23e790, dispatch=0x23ec60) ... 0037:trace:seh:RtlRestoreContext returning to 141f4983e stack 23f550 0037:Call KERNEL32.GetModuleFileNameW(140000000,0023eb00,00000104) ret=141f496ef 0037:Ret KERNEL32.GetModuleFileNameW() retval=00000033 ret=141f496ef 0037:Call advapi32.OpenSCManagerW(00000000,00000000,00000004) ret=1416b988d ... 0037:Ret advapi32.OpenSCManagerW() retval=000725c0 ret=1416b988d 0037:Call advapi32.EnumServicesStatusExW(000725c0,00000000,00000030,00000001,00000000,00000000,0023f568,0023eae0,0023eae4,00000000) ret=141f496f9 ... 0037:Ret advapi32.EnumServicesStatusExW() retval=00000000 ret=141f496f9 0037:Call KERNEL32.GetLastError() ret=1416b988d 0037:Ret KERNEL32.GetLastError() retval=000000ea ret=1416b988d 0037:Call KERNEL32.LocalAlloc(00000000,0000021c) ret=1416b988d 0037:Ret KERNEL32.LocalAlloc() retval=00072740 ret=1416b988d 0037:Call advapi32.EnumServicesStatusExW(000725c0,00000000,00000030,00000001,00072740,0000021c,0023f568,0023eae0,0023eae4,00000000) ret=141f49703 ... 0037:Ret advapi32.EnumServicesStatusExW() retval=00000001 ret=141f49703 ... 0037:Call advapi32.CloseServiceHandle(000725c0) ret=1416b988d ... 0037:Ret advapi32.CloseServiceHandle() retval=00000001 ret=1416b988d 0037:Call KERNEL32.LoadLibraryA(0023e970 "user32.dll") ret=141653449 0037:Ret KERNEL32.LoadLibraryA() retval=7fccac340000 ret=141653449 0037:Call user32.MessageBoxW(00000000,0023ed10 L"A debugger has been found running in your system.\nPlease, unload it from memory and restart your program.",0023eb4a L"terminal64.exe",00000010) ret=1416b988d ... --- snip ---

Those anti-debugging tricks as seen from trace log seem to work fine with 64-bit:

* IsDebuggerPresent * CheckRemoteDebuggerPresent * NtQueryInformationProcess( ProcessDebugObjectHandle) * NtSetInformationThread( ThreadHideFromDebugger) * NtQuerySystemInformation( SystemKernelDebuggerInformation) * NtQuerySystemInformation( SystemModuleInformation) * CloseHandle( invalid handle/EXCEPTION_INVALID_HANDLE)

There is a lot of 64-bit virtual machine code which makes this kinda hard to debug/analyse.

The single step trap from trace log looks suspicious though.

--- snip --- 0037:trace:seh:raise_exception code=80000004 flags=0 addr=0x141f49833 ip=141f49833 tid=0037 --- snip ---

--- snip --- ... 0x0000000141f49802: call 0x000000014128b557 0x0000000141f49807: pushq $0xd92eb714 0x0000000141f4980c: call 0x000000014128b557 0x0000000141f49811: pushq $0x18ff4951 0x0000000141f49816: call 0x000000014128b557 0x0000000141f4981b: pushq $0xd8d940e7 0x0000000141f49820: call 0x000000014128b557 0x0000000141f49825: testb %ch,0xffffffffffffffae(%rax) 0x0000000141f49828: aad $0xd8 0x0000000141f4982a: popq %rax 0x0000000141f4982b: call 0x000000014128b557 0x0000000141f49830: popfl 0x0000000141f49831: rdtsc 0x0000000141f49833: nop 0x0000000141f49834: pushq $0x592872dc 0x0000000141f49839: call 0x000000014128b557 0x0000000141f4983e: pushq $0x58d88e4f 0x0000000141f49843: call 0x000000014128b557 0x0000000141f49848: popfl 0x0000000141f49849: rdtsc 0x0000000141f4984b: nop 0x0000000141f4984c: pushq $0x98d8fed4 0x0000000141f49851: call 0x000000014128b557 ...

Wine-dbg>b *0x0000000141f49830 Breakpoint 1 at 0x0000000141f49830 Wine-dbg>b *0x0000000141f49831 Breakpoint 2 at 0x0000000141f49831 Wine-dbg>c Stopped on breakpoint 1 at 0x0000000141f49830

Wine-dbg>info reg Register dump: rip:0000000141f49830 rsp:000000000023f538 rbp:000000000023f590 eflags:00000246 ( - -- I Z- -P- ) rax:0000000000000346 rbx:0000000141685350 rcx:00000000deadc0de rdx:00000000000787c0 rsi:0000000000000000 rdi:aaaaaaaaaaaaaaab r8:0000000000267148 r9:000000000000a400 r10:00000000c5fb2fee r11:0000000000000038 r12:0000000141669385 r13:0000000000000048 r14:0000000000000004 r15:000000014166898c

Wine-dbg>si Stopped on breakpoint 2 at 0x0000000141f49831 0x0000000141f49831: rdtsc

Wine-dbg>info reg Register dump: rip:0000000141f49831 rsp:000000000023f540 rbp:000000000023f590 eflags:00000346 ( - -- IT Z- -P- ) rax:0000000000000346 rbx:0000000141685350 rcx:00000000deadc0de rdx:00000000000787c0 rsi:0000000000000000 rdi:aaaaaaaaaaaaaaab r8:0000000000267148 r9:000000000000a400 r10:00000000c5fb2fee r11:0000000000000038 r12:0000000141669385 r13:0000000000000048 r14:0000000000000004 r15:000000014166898c --- snip ---

Normally 'rdtsc' sequences are used for timing analysis, that is VM/emulation detection, single stepping detection under debugger etc. I'm not sure why Denuvo sets the trap flag (TF) before execution (popfl -> eflags), if the trap sequence is intended at all. Maybe the exception handler has some state machine/logic for timing analysis. I didn't look very hard though.

The remaining sequence, that is querying the SCM for services state is always done when something bad happened. You can simulate it by having one of the anti-debug checks intentionally fail.

$ sha1sum mt5setup.exe fe34784ab570f051ed81c6409d07becdae12aafd mt5setup.exe

$ du -sh mt5setup.exe 640K mt5setup.exe

$ wine --version wine-2.12

Regards

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

14 Jul 14 Jul

3:52 a.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #10 from proggi proggi@yandex.ru --- listing wine terminal64.exe &> log.tog

wine 2,12

err:winediag:SECUR32_initNTLMSP ntlm_auth was not found or is outdated. Make sure that ntlm_auth >= 3.0.25 is in your path. Usually, you can find it in the winbind package of your distribution. fixme:heap:RtlSetHeapInformation 0x460000 0 0x23f1d0 4 stub fixme:module:load_library unsupported flag(s) used (flags: 0x00000800) fixme:module:load_library unsupported flag(s) used (flags: 0x00000800) fixme:module:load_library unsupported flag(s) used (flags: 0x00000800) fixme:module:load_library unsupported flag(s) used (flags: 0x00000800) fixme:module:load_library unsupported flag(s) used (flags: 0x00000800) fixme:module:load_library unsupported flag(s) used (flags: 0x00000800) wine: Unhandled exception 0x80000003 in thread 11b at address 0x1402aee23 (thread 011b), starting debugger... 0x00000001402aee22: int $3 Modules: Module Address Debug info Name (139 modules) ELF 7b400000- 7b80e000 Dwarf kernel32<elf> -PE 7b420000- 7b80e000 \ kernel32 ELF 7bc00000- 7bd17000 Dwarf ntdll<elf> -PE 7bc20000- 7bd17000 \ ntdll ELF 7c000000- 7c004000 Dwarf <wine-loader> PE 140000000- 14276e000 Export terminal64 ELF 7fbed8c3b000- 7fbed8e4f000 Deferred api-ms-win-core-sysinfo-l1-2-1<e PE 7fbed8c40000- 7fbed8e4f000 Deferred api-ms-win-core-sysinfo-l1-2-1 PE 7fbed8e9b000- 7fbed90af000 Deferred api-ms-win-core-localization-l1- PE 7fbed8ea0000- 7fbed90af000 Deferred api-ms-win-core-localization-l1-C:\windows\system32\api-ms-win-core-localization-l1-2-1.dll ELF 7fbed90b3000- 7fbed92c6000 Deferred api-ms-win-core-fibers-l1-1-1<el PE 7fbed90c0000- 7fbed92c6000 Deferred api-ms-win-core-fibers-l1-1-1 ELF 7fbed92cb000- 7fbed94df000 Deferred api-ms-win-core-synch-l1-2-0<elf PE 7fbed92d0000- 7fbed94df000 Deferred api-ms-win-core-synch-l1-2-0 ELF 7fbed94e3000- 7fbed96e9000 Deferred libxfixes.so.3 ELF 7fbed96eb000- 7fbed98f6000 Deferred libxcursor.so.1 ELF 7fbed992b000- 7fbed9b3b000 Deferred libxi.so.6 ELF 7fbed9b6b000- 7fbed9d6e000 Deferred libxcomposite.so.1 ELF 7fbed9da3000- 7fbed9fae000 Deferred libxrandr.so.2 ELF 7fbed9fe3000- 7fbeda1ed000 Deferred libxrender.so.1 ELF 7fbeda223000- 7fbeda429000 Deferred libxxf86vm.so.1 ELF 7fbeda45b000- 7fbeda65e000 Deferred libxinerama.so.1 ELF 7fbeda693000- 7fbeda8a8000 Deferred libbsd.so.0 ELF 7fbeda8ab000- 7fbedaab1000 Deferred libxdmcp.so.6 ELF 7fbedaab3000- 7fbedacb7000 Deferred libxau.so.6 ELF 7fbedacbb000- 7fbedaee3000 Deferred libxcb.so.1 ELF 7fbedaee3000- 7fbedb223000 Deferred libx11.so.6 ELF 7fbedb223000- 7fbedb435000 Deferred libxext.so.6 ELF 7fbedb46b000- 7fbedb709000 Deferred winex11<elf> -PE 7fbedb480000- 7fbedb709000 \ winex11 ELF 7fbedb70b000- 7fbedb920000 Deferred libgpg-error.so.0 ELF 7fbedb923000- 7fbedbb96000 Deferred libpcre.so.3 ELF 7fbedbb9b000- 7fbedbeaa000 Deferred libgcrypt.so.20 ELF 7fbedbeab000- 7fbedc0bd000 Deferred liblz4.so.1 ELF 7fbedc0c3000- 7fbedc2e9000 Deferred liblzma.so.5 ELF 7fbedc2eb000- 7fbedc4f3000 Deferred librt.so.1 ELF 7fbedc4f3000- 7fbedc71b000 Deferred libselinux.so.1 ELF 7fbedc71b000- 7fbedc7a6000 Deferred libsystemd.so.0 ELF 7fbedc7ab000- 7fbedcb1b000 Deferred libunistring.so.2 ELF 7fbedcb1b000- 7fbedcd24000 Deferred libffi.so.6 ELF 7fbedcd2b000- 7fbedcf7b000 Deferred libdbus-1.so.3 ELF 7fbedcf7b000- 7fbedd1fe000 Deferred libgmp.so.10 ELF 7fbedd203000- 7fbedd438000 Deferred libhogweed.so.4 ELF 7fbedd43b000- 7fbedd672000 Deferred libnettle.so.6 ELF 7fbedd673000- 7fbedd886000 Deferred libtasn1.so.6 ELF 7fbedd88b000- 7fbeddaa7000 Deferred libidn2.so.0 ELF 7fbeddaab000- 7fbeddddc000 Deferred libp11-kit.so.0 ELF 7fbeddde3000- 7fbeddfe7000 Deferred libkeyutils.so.1 ELF 7fbeddfeb000- 7fbede1f7000 Deferred libkrb5support.so.0 ELF 7fbede1fb000- 7fbede3ff000 Deferred libcom_err.so.2 ELF 7fbede403000- 7fbede636000 Deferred libk5crypto.so.3 ELF 7fbede63b000- 7fbede915000 Deferred libkrb5.so.3 ELF 7fbede91b000- 7fbedeb2c000 Deferred libavahi-client.so.3 ELF 7fbedeb33000- 7fbeded40000 Deferred libavahi-common.so.3 ELF 7fbeded43000- 7fbedf0dd000 Deferred libgnutls.so.30 ELF 7fbedf0e3000- 7fbedf32e000 Deferred libgssapi_krb5.so.2 ELF 7fbedf333000- 7fbedf5c0000 Deferred libcups.so.2 ELF 7fbee002b000- 7fbee0256000 Deferred libexpat.so.1 ELF 7fbee025b000- 7fbee049f000 Deferred libfontconfig.so.1 ELF 7fbee04d3000- 7fbee0706000 Deferred libpng16.so.16 ELF 7fbee070b000- 7fbee09c0000 Deferred libfreetype.so.6 ELF 7fbee09f3000- 7fbee0c0c000 Deferred wtsapi32<elf> -PE 7fbee0a00000- 7fbee0c0c000 \ wtsapi32 ELF 7fbee0c13000- 7fbee0e3b000 Deferred imm32<elf> -PE 7fbee0c20000- 7fbee0e3b000 \ imm32 ELF 7fbee0e3b000- 7fbee10a1000 Deferred oleacc<elf> -PE 7fbee0e50000- 7fbee10a1000 \ oleacc ELF 7fbee10a3000- 7fbee12de000 Deferred secur32<elf> -PE 7fbee10b0000- 7fbee12de000 \ secur32 ELF 7fbee12e3000- 7fbee1551000 Deferred dbghelp<elf> -PE 7fbee12f0000- 7fbee1551000 \ dbghelp ELF 7fbee1553000- 7fbee177f000 Deferred mpr<elf> -PE 7fbee1560000- 7fbee177f000 \ mpr ELF 7fbee1783000- 7fbee199d000 Deferred libz.so.1 ELF 7fbee19d3000- 7fbee1c5b000 Deferred wininet<elf> -PE 7fbee19e0000- 7fbee1c5b000 \ wininet ELF 7fbee1c5b000- 7fbee1f19000 Deferred urlmon<elf> -PE 7fbee1c70000- 7fbee1f19000 \ urlmon ELF 7fbee1f1b000- 7fbee2213000 Deferred comdlg32<elf> -PE 7fbee1f20000- 7fbee2213000 \ comdlg32 ELF 7fbee2213000- 7fbee2450000 Deferred oledlg<elf> -PE 7fbee2220000- 7fbee2450000 \ oledlg ELF 7fbee2453000- 7fbee2767000 Deferred comctl32<elf> -PE 7fbee2460000- 7fbee2767000 \ comctl32 ELF 7fbee276b000- 7fbee2bfd000 Deferred shell32<elf> -PE 7fbee2790000- 7fbee2bfd000 \ shell32 ELF 7fbee2c03000- 7fbee2e4c000 Deferred winspool<elf> -PE 7fbee2c10000- 7fbee2e4c000 \ winspool ELF 7fbee2e53000- 7fbee3067000 Deferred msimg32<elf> -PE 7fbee2e60000- 7fbee3067000 \ msimg32 ELF 7fbee306b000- 7fbee32a8000 Deferred uxtheme<elf> -PE 7fbee3070000- 7fbee32a8000 \ uxtheme ELF 7fbee32ab000- 7fbee353d000 Deferred shlwapi<elf> -PE 7fbee32c0000- 7fbee353d000 \ shlwapi ELF 7fbee3543000- 7fbee37f6000 Deferred gdiplus<elf> -PE 7fbee3560000- 7fbee37f6000 \ gdiplus ELF 7fbee37fb000- 7fbee3b74000 Deferred oleaut32<elf> -PE 7fbee3820000- 7fbee3b74000 \ oleaut32 ELF 7fbee3b7b000- 7fbee3d98000 Deferred jsproxy<elf> -PE 7fbee3b80000- 7fbee3d98000 \ jsproxy ELF 7fbee3d9b000- 7fbee3fdd000 Deferred winhttp<elf> -PE 7fbee3da0000- 7fbee3fdd000 \ winhttp ELF 7fbee3fe3000- 7fbee4224000 Deferred ws2_32<elf> -PE 7fbee3ff0000- 7fbee4224000 \ ws2_32 ELF 7fbee422b000- 7fbee4442000 Deferred libresolv.so.2 ELF 7fbee4473000- 7fbee46a1000 Deferred iphlpapi<elf> -PE 7fbee4480000- 7fbee46a1000 \ iphlpapi ELF 7fbee46a3000- 7fbee48d7000 Deferred netapi32<elf> -PE 7fbee46b0000- 7fbee48d7000 \ netapi32 ELF 7fbee48db000- 7fbee4b08000 Deferred msacm32<elf> -PE 7fbee48e0000- 7fbee4b08000 \ msacm32 ELF 7fbee4b0b000- 7fbee4da5000 Deferred rpcrt4<elf> -PE 7fbee4b20000- 7fbee4da5000 \ rpcrt4 ELF 7fbee4dab000- 7fbee512b000 Deferred ole32<elf> -PE 7fbee4dd0000- 7fbee512b000 \ ole32 ELF 7fbee512b000- 7fbee53f0000 Deferred winmm<elf> -PE 7fbee5130000- 7fbee53f0000 \ winmm ELF 7fbee53f3000- 7fbee560d000 Deferred version<elf> -PE 7fbee5400000- 7fbee560d000 \ version ELF 7fbee5613000- 7fbee58a2000 Deferred advapi32<elf> -PE 7fbee5620000- 7fbee58a2000 \ advapi32 ELF 7fbee58a3000- 7fbee5c20000 Deferred gdi32<elf> -PE 7fbee58c0000- 7fbee5c20000 \ gdi32 ELF 7fbee5c23000- 7fbee5fd7000 Deferred user32<elf> -PE 7fbee5c40000- 7fbee5fd7000 \ user32 ELF 7fbee5fdb000- 7fbee62bf000 Deferred crypt32<elf> -PE 7fbee5ff0000- 7fbee62bf000 \ crypt32 ELF 7fbee62c3000- 7fbee64d5000 Deferred libnss_files.so.2 ELF 7fbee64db000- 7fbee66e7000 Deferred libnss_nis.so.2 ELF 7fbee671b000- 7fbee6933000 Deferred libnsl.so.1 ELF 7fbee6933000- 7fbee6b3b000 Deferred libnss_compat.so.2 ELF 7fbee6d0b000- 7fbee6f22000 Deferred libgcc_s.so.1 ELF 7fbee6f23000- 7fbee7227000 Deferred libm.so.6 ELF 7fbee725b000- 7fbee745f000 Deferred libdl.so.2 ELF 7fbee7463000- 7fbee7802000 Dwarf libc.so.6 ELF 7fbee7803000- 7fbee7a20000 Deferred libpthread.so.0 ELF 7fbee7a53000- 7fbee7df9000 Dwarf libwine.so.1 ELF 7fbee7dfb000- 7fbee8021000 Deferred ld-linux-x86-64.so.2 ELF 7ffdc3105000- 7ffdc3106000 Deferred [vdso].so Threads: process tid prio (all id:s are in hex) 0000000e services.exe 00000074 0 00000026 0 00000023 0 0000001e 0 00000018 0 00000013 0 00000010 0 0000000f 0 00000011 winedevice.exe 0000001d 0 00000017 0 00000016 0 00000012 0 0000001b plugplay.exe 00000020 0 0000001f 0 0000001c 0 00000021 winedevice.exe 0000002d 0 00000025 0 00000024 0 00000022 0 0000002b explorer.exe 00000036 0 00000035 0 00000034 0 0000002c 0 0000006c terminal.exe 00000116 0 000000a0 0 0000009d 0 0000009c 0 0000009b 0 0000009a 0 00000099 0 00000098 0 00000097 0 00000096 0 00000095 0 00000094 0 00000093 0 00000092 0 00000091 0 00000090 0 0000008f 0 0000008e -1 0000008d -1 0000008c 0 0000008b 0 0000008a 0 00000089 0 00000088 0 00000087 0 00000086 0 00000085 0 00000084 0 00000083 0 00000082 0 00000081 0 00000080 0 0000007f 0 0000007e 0 0000007d 0 0000007c 0 0000006e 0 0000006d 0 00000072 rpcss.exe 00000079 0 00000078 0 00000077 0 00000076 0 00000075 0 00000073 0 0000011a (D) C:\forex\Alpari Limited MT5\terminal64.exe 0000011b 0 <== System information: Wine build: wine-2.12 Platform: x86_64 Version: Windows 10 Host system: Linux Host version: 4.11.0-1-amd64

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

22 Jul 22 Jul

3:49 a.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #11 from proggi proggi@yandex.ru --- $ wine terminal64.exe fixme:heap:RtlSetHeapInformation 0x370000 0 0x23f1d0 4 stub fixme:module:load_library unsupported flag(s) used (flags: 0x00000800) fixme:module:load_library unsupported flag(s) used (flags: 0x00000800) fixme:module:load_library unsupported flag(s) used (flags: 0x00000800) fixme:module:load_library unsupported flag(s) used (flags: 0x00000800) fixme:module:load_library unsupported flag(s) used (flags: 0x00000800) fixme:module:load_library unsupported flag(s) used (flags: 0x00000800) wine: Unhandled exception 0x80000003 in thread 2c at address 0x1402b1913 (thread 002c), starting debugger... 0x00000001402b1912: int $3 Modules: Module Address Debug info Name (141 modules) ELF 7b400000- 7b80f000 Dwarf kernel32<elf> -PE 7b420000- 7b80f000 \ kernel32 ELF 7bc00000- 7bd1c000 Dwarf ntdll<elf> -PE 7bc20000- 7bd1c000 \ ntdll ELF 7c000000- 7c004000 Dwarf <wine-loader> PE 140000000- 14276d000 Export terminal64 ELF 7fc3991db000- 7fc3993ef000 Deferred api-ms-win-core-sysinfo-l1-2-1<e PE 7fc3991e0000- 7fc3993ef000 Deferred api-ms-win-core-sysinfo-l1-2-1 PE 7fc399443000- 7fc399657000 Deferred api-ms-win-core-localization-l1- PE 7fc399450000- 7fc399657000 Deferred api-ms-win-core-localization-l1-C:\windows\system32\api-ms-win-core-localization-l1-2-1.dll ELF 7fc39965b000- 7fc39986e000 Deferred api-ms-win-core-fibers-l1-1-1<el PE 7fc399660000- 7fc39986e000 Deferred api-ms-win-core-fibers-l1-1-1 ELF 7fc399873000- 7fc399a87000 Deferred api-ms-win-core-synch-l1-2-0<elf PE 7fc399880000- 7fc399a87000 Deferred api-ms-win-core-synch-l1-2-0 ELF 7fc399a8b000- 7fc399c91000 Deferred libxfixes.so.3 ELF 7fc399c93000- 7fc399e9e000 Deferred libxcursor.so.1 ELF 7fc399ea3000- 7fc39a0b3000 Deferred libxi.so.6 ELF 7fc39a0b3000- 7fc39a2b6000 Deferred libxcomposite.so.1 ELF 7fc39a2bb000- 7fc39a4c6000 Deferred libxrandr.so.2 ELF 7fc39a4cb000- 7fc39a6d5000 Deferred libxrender.so.1 ELF 7fc39a6db000- 7fc39a8e1000 Deferred libxxf86vm.so.1 ELF 7fc39a8e3000- 7fc39aae6000 Deferred libxinerama.so.1 ELF 7fc39aaeb000- 7fc39ad00000 Deferred libbsd.so.0 ELF 7fc39ad03000- 7fc39af09000 Deferred libxdmcp.so.6 ELF 7fc39af0b000- 7fc39b10f000 Deferred libxau.so.6 ELF 7fc39b113000- 7fc39b33b000 Deferred libxcb.so.1 ELF 7fc39b33b000- 7fc39b67b000 Deferred libx11.so.6 ELF 7fc39b67b000- 7fc39b88d000 Deferred libxext.so.6 ELF 7fc39b8d3000- 7fc39bb71000 Deferred winex11<elf> -PE 7fc39b8e0000- 7fc39bb71000 \ winex11 ELF 7fc39bb73000- 7fc39bde6000 Deferred libpcre.so.3 ELF 7fc39bdeb000- 7fc39c000000 Deferred libgpg-error.so.0 ELF 7fc39c003000- 7fc39c22b000 Deferred libselinux.so.1 ELF 7fc39c22b000- 7fc39c43d000 Deferred liblz4.so.1 ELF 7fc39c443000- 7fc39c669000 Deferred liblzma.so.5 ELF 7fc39c66b000- 7fc39c873000 Deferred librt.so.1 ELF 7fc39c873000- 7fc39cb82000 Deferred libgcrypt.so.20 ELF 7fc39cb83000- 7fc39ce0c000 Deferred libsystemd.so.0 ELF 7fc39ce13000- 7fc39d01c000 Deferred libffi.so.6 ELF 7fc39d023000- 7fc39d273000 Deferred libdbus-1.so.3 ELF 7fc39d273000- 7fc39d4f6000 Deferred libgmp.so.10 ELF 7fc39d4fb000- 7fc39d730000 Deferred libhogweed.so.4 ELF 7fc39d733000- 7fc39d96a000 Deferred libnettle.so.6 ELF 7fc39d96b000- 7fc39db7e000 Deferred libtasn1.so.6 ELF 7fc39db83000- 7fc39def3000 Deferred libunistring.so.2 ELF 7fc39def3000- 7fc39e110000 Deferred libidn2.so.0 ELF 7fc39e113000- 7fc39e444000 Deferred libp11-kit.so.0 ELF 7fc39e44b000- 7fc39e64f000 Deferred libkeyutils.so.1 ELF 7fc39e653000- 7fc39e85f000 Deferred libkrb5support.so.0 ELF 7fc39e863000- 7fc39ea67000 Deferred libcom_err.so.2 ELF 7fc39ea6b000- 7fc39ec9e000 Deferred libk5crypto.so.3 ELF 7fc39eca3000- 7fc39ef7d000 Deferred libkrb5.so.3 ELF 7fc39ef83000- 7fc39f194000 Deferred libavahi-client.so.3 ELF 7fc39f19b000- 7fc39f3a8000 Deferred libavahi-common.so.3 ELF 7fc39f3ab000- 7fc39f716000 Deferred libgnutls.so.30 ELF 7fc39f71b000- 7fc39f966000 Deferred libgssapi_krb5.so.2 ELF 7fc39f96b000- 7fc39fbf8000 Deferred libcups.so.2 ELF 7fc39fd9b000- 7fc39ffc6000 Deferred libexpat.so.1 ELF 7fc39ffcb000- 7fc3a020f000 Deferred libfontconfig.so.1 ELF 7fc3a0213000- 7fc3a0446000 Deferred libpng16.so.16 ELF 7fc3a044b000- 7fc3a0700000 Deferred libfreetype.so.6 ELF 7fc3a0703000- 7fc3a092d000 Deferred libtinfo.so.5 ELF 7fc3a0933000- 7fc3a0b56000 Deferred libncurses.so.5 ELF 7fc3a0b5b000- 7fc3a0d74000 Deferred wtsapi32<elf> -PE 7fc3a0b60000- 7fc3a0d74000 \ wtsapi32 ELF 7fc3a0d7b000- 7fc3a0fa3000 Deferred imm32<elf> -PE 7fc3a0d80000- 7fc3a0fa3000 \ imm32 ELF 7fc3a0fa3000- 7fc3a1209000 Deferred oleacc<elf> -PE 7fc3a0fb0000- 7fc3a1209000 \ oleacc ELF 7fc3a120b000- 7fc3a1446000 Deferred secur32<elf> -PE 7fc3a1210000- 7fc3a1446000 \ secur32 ELF 7fc3a144b000- 7fc3a16b9000 Deferred dbghelp<elf> -PE 7fc3a1450000- 7fc3a16b9000 \ dbghelp ELF 7fc3a16bb000- 7fc3a18e7000 Deferred mpr<elf> -PE 7fc3a16c0000- 7fc3a18e7000 \ mpr ELF 7fc3a18eb000- 7fc3a1b05000 Deferred libz.so.1 ELF 7fc3a1b0b000- 7fc3a1d93000 Deferred wininet<elf> -PE 7fc3a1b20000- 7fc3a1d93000 \ wininet ELF 7fc3a1d93000- 7fc3a2051000 Deferred urlmon<elf> -PE 7fc3a1da0000- 7fc3a2051000 \ urlmon ELF 7fc3a2053000- 7fc3a234b000 Deferred comdlg32<elf> -PE 7fc3a2060000- 7fc3a234b000 \ comdlg32 ELF 7fc3a234b000- 7fc3a2588000 Deferred oledlg<elf> -PE 7fc3a2350000- 7fc3a2588000 \ oledlg ELF 7fc3a258b000- 7fc3a28bf000 Deferred comctl32<elf> -PE 7fc3a2590000- 7fc3a28bf000 \ comctl32 ELF 7fc3a28c3000- 7fc3a2d55000 Deferred shell32<elf> -PE 7fc3a28e0000- 7fc3a2d55000 \ shell32 ELF 7fc3a2d5b000- 7fc3a2fa4000 Deferred winspool<elf> -PE 7fc3a2d60000- 7fc3a2fa4000 \ winspool ELF 7fc3a2fab000- 7fc3a31bf000 Deferred msimg32<elf> -PE 7fc3a2fb0000- 7fc3a31bf000 \ msimg32 ELF 7fc3a31c3000- 7fc3a3400000 Deferred uxtheme<elf> -PE 7fc3a31d0000- 7fc3a3400000 \ uxtheme ELF 7fc3a3403000- 7fc3a3695000 Deferred shlwapi<elf> -PE 7fc3a3420000- 7fc3a3695000 \ shlwapi ELF 7fc3a369b000- 7fc3a394f000 Deferred gdiplus<elf> -PE 7fc3a36b0000- 7fc3a394f000 \ gdiplus ELF 7fc3a3953000- 7fc3a3ccc000 Deferred oleaut32<elf> -PE 7fc3a3980000- 7fc3a3ccc000 \ oleaut32 ELF 7fc3a3cd3000- 7fc3a3ef0000 Deferred jsproxy<elf> -PE 7fc3a3ce0000- 7fc3a3ef0000 \ jsproxy ELF 7fc3a3ef3000- 7fc3a4136000 Deferred winhttp<elf> -PE 7fc3a3f00000- 7fc3a4136000 \ winhttp ELF 7fc3a413b000- 7fc3a437c000 Deferred ws2_32<elf> -PE 7fc3a4140000- 7fc3a437c000 \ ws2_32 ELF 7fc3a4383000- 7fc3a459a000 Deferred libresolv.so.2 ELF 7fc3a459b000- 7fc3a47c9000 Deferred iphlpapi<elf> -PE 7fc3a45a0000- 7fc3a47c9000 \ iphlpapi ELF 7fc3a47cb000- 7fc3a49ff000 Deferred netapi32<elf> -PE 7fc3a47d0000- 7fc3a49ff000 \ netapi32 ELF 7fc3a4a03000- 7fc3a4c30000 Deferred msacm32<elf> -PE 7fc3a4a10000- 7fc3a4c30000 \ msacm32 ELF 7fc3a4c33000- 7fc3a4ecd000 Deferred rpcrt4<elf> -PE 7fc3a4c40000- 7fc3a4ecd000 \ rpcrt4 ELF 7fc3a4ed3000- 7fc3a5273000 Deferred ole32<elf> -PE 7fc3a4f00000- 7fc3a5273000 \ ole32 ELF 7fc3a5273000- 7fc3a5538000 Deferred winmm<elf> -PE 7fc3a5280000- 7fc3a5538000 \ winmm ELF 7fc3a553b000- 7fc3a5755000 Deferred version<elf> -PE 7fc3a5540000- 7fc3a5755000 \ version ELF 7fc3a575b000- 7fc3a59ea000 Deferred advapi32<elf> -PE 7fc3a5770000- 7fc3a59ea000 \ advapi32 ELF 7fc3a59eb000- 7fc3a5d68000 Deferred gdi32<elf> -PE 7fc3a5a00000- 7fc3a5d68000 \ gdi32 ELF 7fc3a5d6b000- 7fc3a61a0000 Deferred user32<elf> -PE 7fc3a5d90000- 7fc3a61a0000 \ user32 ELF 7fc3a61a3000- 7fc3a6487000 Deferred crypt32<elf> -PE 7fc3a61b0000- 7fc3a6487000 \ crypt32 ELF 7fc3a648b000- 7fc3a669d000 Deferred libnss_files.so.2 ELF 7fc3a66a3000- 7fc3a68af000 Deferred libnss_nis.so.2 ELF 7fc3a68b3000- 7fc3a6acb000 Deferred libnsl.so.1 ELF 7fc3a6acb000- 7fc3a6cd3000 Deferred libnss_compat.so.2 ELF 7fc3a6e73000- 7fc3a708a000 Deferred libgcc_s.so.1 ELF 7fc3a708b000- 7fc3a738f000 Deferred libm.so.6 ELF 7fc3a7393000- 7fc3a7597000 Deferred libdl.so.2 ELF 7fc3a759b000- 7fc3a793a000 Dwarf libc.so.6 ELF 7fc3a793b000- 7fc3a7b58000 Deferred libpthread.so.0 ELF 7fc3a7b9b000- 7fc3a7f41000 Dwarf libwine.so.1 ELF 7fc3a7f43000- 7fc3a8169000 Deferred ld-linux-x86-64.so.2 ELF 7ffc453d5000- 7ffc453d6000 Deferred [vdso].so Threads: process tid prio (all id:s are in hex) 0000000e services.exe 00000026 0 00000023 0 0000001e 0 00000018 0 00000013 0 00000010 0 0000000f 0 00000011 winedevice.exe 0000001d 0 00000017 0 00000016 0 00000012 0 0000001b plugplay.exe 00000020 0 0000001f 0 0000001c 0 00000021 winedevice.exe 0000002d 0 00000025 0 00000024 0 00000022 0 00000029 explorer.exe 00000030 0 0000002f 0 0000002e 0 0000002a 0 0000002b (D) C:\forex\Alpari Limited MT5\terminal64.exe 0000002c 0 <== System information: Wine build: wine-2.13 Platform: x86_64 Version: Windows 10 Host system: Linux Host version: 4.11.0-1-amd64

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

7 Aug 7 Aug

1:36 p.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #12 from proggi proggi@yandex.ru --- 2.14

0x00000001402b1912: int $3 Modules: Module Address Debug info Name (139 modules) ELF 7b400000- 7b80e000 Dwarf kernel32<elf> -PE 7b420000- 7b80e000 \ kernel32 ELF 7bc00000- 7bd1b000 Dwarf ntdll<elf> -PE 7bc20000- 7bd1b000 \ ntdll ELF 7c000000- 7c004000 Dwarf <wine-loader> PE 140000000- 14276d000 Export terminal64 ELF 7f546af93000- 7f546b1a7000 Deferred api-ms-win-core-sysinfo-l1-2-1<e PE 7f546afa0000- 7f546b1a7000 Deferred api-ms-win-core-sysinfo-l1-2-1 PE 7f546b1fb000- 7f546b40f000 Deferred api-ms-win-core-localization-l1- PE 7f546b200000- 7f546b40f000 Deferred api-ms-win-core-localization-l1-C:\windows\system32\api-ms-win-core-localization-l1-2-1.dll ELF 7f546b413000- 7f546b626000 Deferred api-ms-win-core-fibers-l1-1-1<el PE 7f546b420000- 7f546b626000 Deferred api-ms-win-core-fibers-l1-1-1 ELF 7f546b62b000- 7f546b83f000 Deferred api-ms-win-core-synch-l1-2-0<elf PE 7f546b630000- 7f546b83f000 Deferred api-ms-win-core-synch-l1-2-0 ELF 7f546b843000- 7f546ba49000 Deferred libxfixes.so.3 ELF 7f546ba4b000- 7f546bc56000 Deferred libxcursor.so.1 ELF 7f546bc5b000- 7f546be6b000 Deferred libxi.so.6 ELF 7f546be6b000- 7f546c06e000 Deferred libxcomposite.so.1 ELF 7f546c073000- 7f546c27e000 Deferred libxrandr.so.2 ELF 7f546c283000- 7f546c48d000 Deferred libxrender.so.1 ELF 7f546c493000- 7f546c699000 Deferred libxxf86vm.so.1 ELF 7f546c69b000- 7f546c89e000 Deferred libxinerama.so.1 ELF 7f546c8a3000- 7f546cab8000 Deferred libbsd.so.0 ELF 7f546cabb000- 7f546ccc1000 Deferred libxdmcp.so.6 ELF 7f546ccc3000- 7f546cec7000 Deferred libxau.so.6 ELF 7f546cecb000- 7f546d0f3000 Deferred libxcb.so.1 ELF 7f546d0f3000- 7f546d433000 Deferred libx11.so.6 ELF 7f546d433000- 7f546d645000 Deferred libxext.so.6 ELF 7f546d64b000- 7f546d8e9000 Deferred winex11<elf> -PE 7f546d660000- 7f546d8e9000 \ winex11 ELF 7f546d8eb000- 7f546db5e000 Deferred libpcre.so.3 ELF 7f546db63000- 7f546dd78000 Deferred libgpg-error.so.0 ELF 7f546dd7b000- 7f546dfa3000 Deferred libselinux.so.1 ELF 7f546dfa3000- 7f546e1b5000 Deferred liblz4.so.1 ELF 7f546e1bb000- 7f546e3e1000 Deferred liblzma.so.5 ELF 7f546e3e3000- 7f546e5eb000 Deferred librt.so.1 ELF 7f546e5eb000- 7f546e8fa000 Deferred libgcrypt.so.20 ELF 7f546e8fb000- 7f546eb84000 Deferred libsystemd.so.0 ELF 7f546eb8b000- 7f546ed94000 Deferred libffi.so.6 ELF 7f546ed9b000- 7f546efeb000 Deferred libdbus-1.so.3 ELF 7f546efeb000- 7f546f26e000 Deferred libgmp.so.10 ELF 7f546f273000- 7f546f4a8000 Deferred libhogweed.so.4 ELF 7f546f4ab000- 7f546f6e2000 Deferred libnettle.so.6 ELF 7f546f6e3000- 7f546f8f6000 Deferred libtasn1.so.6 ELF 7f546f8fb000- 7f546fc6b000 Deferred libunistring.so.2 ELF 7f546fc6b000- 7f546fe88000 Deferred libidn2.so.0 ELF 7f546fe8b000- 7f54701bc000 Deferred libp11-kit.so.0 ELF 7f54701c3000- 7f54703c7000 Deferred libkeyutils.so.1 ELF 7f54703cb000- 7f54705d7000 Deferred libkrb5support.so.0 ELF 7f54705db000- 7f54707df000 Deferred libcom_err.so.2 ELF 7f54707e3000- 7f5470a16000 Deferred libk5crypto.so.3 ELF 7f5470a1b000- 7f5470cf5000 Deferred libkrb5.so.3 ELF 7f5470cfb000- 7f5470f0c000 Deferred libavahi-client.so.3 ELF 7f5470f13000- 7f5471120000 Deferred libavahi-common.so.3 ELF 7f5471123000- 7f547148e000 Deferred libgnutls.so.30 ELF 7f5471493000- 7f54716de000 Deferred libgssapi_krb5.so.2 ELF 7f54716e3000- 7f5471970000 Deferred libcups.so.2 ELF 7f5471b13000- 7f5471d3e000 Deferred libexpat.so.1 ELF 7f5471d43000- 7f5471f87000 Deferred libfontconfig.so.1 ELF 7f5471f8b000- 7f54721be000 Deferred libpng16.so.16 ELF 7f54721c3000- 7f5472478000 Deferred libfreetype.so.6 ELF 7f547247b000- 7f5472694000 Deferred wtsapi32<elf> -PE 7f5472480000- 7f5472694000 \ wtsapi32 ELF 7f547269b000- 7f54728c3000 Deferred imm32<elf> -PE 7f54726a0000- 7f54728c3000 \ imm32 ELF 7f54728c3000- 7f5472b29000 Deferred oleacc<elf> -PE 7f54728d0000- 7f5472b29000 \ oleacc ELF 7f5472b2b000- 7f5472d66000 Deferred secur32<elf> -PE 7f5472b30000- 7f5472d66000 \ secur32 ELF 7f5472d6b000- 7f5472fd9000 Deferred dbghelp<elf> -PE 7f5472d70000- 7f5472fd9000 \ dbghelp ELF 7f5472fdb000- 7f5473207000 Deferred mpr<elf> -PE 7f5472fe0000- 7f5473207000 \ mpr ELF 7f547320b000- 7f5473425000 Deferred libz.so.1 ELF 7f547342b000- 7f54736b2000 Deferred wininet<elf> -PE 7f5473440000- 7f54736b2000 \ wininet ELF 7f54736b3000- 7f5473971000 Deferred urlmon<elf> -PE 7f54736c0000- 7f5473971000 \ urlmon ELF 7f5473973000- 7f5473c6b000 Deferred comdlg32<elf> -PE 7f5473980000- 7f5473c6b000 \ comdlg32 ELF 7f5473c6b000- 7f5473ea7000 Deferred oledlg<elf> -PE 7f5473c70000- 7f5473ea7000 \ oledlg ELF 7f5473eab000- 7f54741df000 Deferred comctl32<elf> -PE 7f5473eb0000- 7f54741df000 \ comctl32 ELF 7f54741e3000- 7f5474674000 Deferred shell32<elf> -PE 7f5474200000- 7f5474674000 \ shell32 ELF 7f547467b000- 7f54748c4000 Deferred winspool<elf> -PE 7f5474680000- 7f54748c4000 \ winspool ELF 7f54748cb000- 7f5474adf000 Deferred msimg32<elf> -PE 7f54748d0000- 7f5474adf000 \ msimg32 ELF 7f5474ae3000- 7f5474d20000 Deferred uxtheme<elf> -PE 7f5474af0000- 7f5474d20000 \ uxtheme ELF 7f5474d23000- 7f5474fb4000 Deferred shlwapi<elf> -PE 7f5474d40000- 7f5474fb4000 \ shlwapi ELF 7f5474fbb000- 7f547526f000 Deferred gdiplus<elf> -PE 7f5474fd0000- 7f547526f000 \ gdiplus ELF 7f5475273000- 7f54755eb000 Deferred oleaut32<elf> -PE 7f54752a0000- 7f54755eb000 \ oleaut32 ELF 7f54755eb000- 7f5475808000 Deferred jsproxy<elf> -PE 7f54755f0000- 7f5475808000 \ jsproxy ELF 7f547580b000- 7f5475a4e000 Deferred winhttp<elf> -PE 7f5475810000- 7f5475a4e000 \ winhttp ELF 7f5475a53000- 7f5475c95000 Deferred ws2_32<elf> -PE 7f5475a60000- 7f5475c95000 \ ws2_32 ELF 7f5475c9b000- 7f5475eb2000 Deferred libresolv.so.2 ELF 7f5475eb3000- 7f54760e1000 Deferred iphlpapi<elf> -PE 7f5475ec0000- 7f54760e1000 \ iphlpapi ELF 7f54760e3000- 7f5476317000 Deferred netapi32<elf> -PE 7f54760f0000- 7f5476317000 \ netapi32 ELF 7f547631b000- 7f5476548000 Deferred msacm32<elf> -PE 7f5476320000- 7f5476548000 \ msacm32 ELF 7f547654b000- 7f54767e4000 Deferred rpcrt4<elf> -PE 7f5476560000- 7f54767e4000 \ rpcrt4 ELF 7f54767eb000- 7f5476b8a000 Deferred ole32<elf> -PE 7f5476810000- 7f5476b8a000 \ ole32 ELF 7f5476b8b000- 7f5476e50000 Deferred winmm<elf> -PE 7f5476b90000- 7f5476e50000 \ winmm ELF 7f5476e53000- 7f547706d000 Deferred version<elf> -PE 7f5476e60000- 7f547706d000 \ version ELF 7f5477073000- 7f5477302000 Deferred advapi32<elf> -PE 7f5477080000- 7f5477302000 \ advapi32 ELF 7f5477303000- 7f547767f000 Deferred gdi32<elf> -PE 7f5477320000- 7f547767f000 \ gdi32 ELF 7f5477683000- 7f5477ab7000 Deferred user32<elf> -PE 7f54776a0000- 7f5477ab7000 \ user32 ELF 7f5477abb000- 7f5477d9f000 Deferred crypt32<elf> -PE 7f5477ad0000- 7f5477d9f000 \ crypt32 ELF 7f5477da3000- 7f5477fb5000 Deferred libnss_files.so.2 ELF 7f5477fbb000- 7f54781c7000 Deferred libnss_nis.so.2 ELF 7f54781cb000- 7f54783e3000 Deferred libnsl.so.1 ELF 7f54783e3000- 7f54785eb000 Deferred libnss_compat.so.2 ELF 7f547878b000- 7f54789a2000 Deferred libgcc_s.so.1 ELF 7f54789a3000- 7f5478ca7000 Deferred libm.so.6 ELF 7f5478cab000- 7f5478eaf000 Deferred libdl.so.2 ELF 7f5478eb3000- 7f5479252000 Dwarf libc.so.6 ELF 7f5479253000- 7f5479470000 Deferred libpthread.so.0 ELF 7f54794b3000- 7f5479859000 Dwarf libwine.so.1 ELF 7f5479863000- 7f5479a89000 Deferred ld-linux-x86-64.so.2 ELF 7ffece8ad000- 7ffece8ae000 Deferred [vdso].so Threads: process tid prio (all id:s are in hex) 0000000e services.exe 00000026 0 00000023 0 0000001e 0 00000018 0 00000013 0 00000010 0 0000000f 0 00000011 winedevice.exe 0000001d 0 00000017 0 00000016 0 00000012 0 0000001b plugplay.exe 00000020 0 0000001f 0 0000001c 0 00000021 winedevice.exe 0000002b 0 00000025 0 00000024 0 00000022 0 00000029 explorer.exe 00000030 0 0000002f 0 0000002e 0 0000002a 0 0000002c terminal64.exe 0000002d 0 00000031 winedbg.exe 00000033 0 00000032 0 00000038 (D) C:\forex\Alpari Limited MT5\terminal64.exe 00000039 0 <== System information: Wine build: wine-2.14 Platform: x86_64 Version: Windows 10 Host system: Linux Host version: 4.11.0-1-amd64

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

22 Aug 22 Aug

12:40 p.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #13 from proggi proggi@yandex.ru --- 0x00000001402b1912: int $3 Modules: Module Address Debug info Name (139 modules) ELF 7b400000- 7b806000 Dwarf kernel32<elf> -PE 7b420000- 7b806000 \ kernel32 ELF 7bc00000- 7bd14000 Dwarf ntdll<elf> -PE 7bc20000- 7bd14000 \ ntdll ELF 7c000000- 7c004000 Dwarf <wine-loader> PE 140000000- 14276d000 Export terminal64 ELF 7f542e0ab000- 7f542e2bf000 Deferred api-ms-win-core-sysinfo-l1-2-1<e PE 7f542e0b0000- 7f542e2bf000 Deferred api-ms-win-core-sysinfo-l1-2-1 PE 7f542e313000- 7f542e527000 Deferred api-ms-win-core-localization-l1- PE 7f542e320000- 7f542e527000 Deferred api-ms-win-core-localization-l1-C:\windows\system32\api-ms-win-core-localization-l1-2-1.dll ELF 7f542e52b000- 7f542e73e000 Deferred api-ms-win-core-fibers-l1-1-1<el PE 7f542e530000- 7f542e73e000 Deferred api-ms-win-core-fibers-l1-1-1 ELF 7f542e743000- 7f542e957000 Deferred api-ms-win-core-synch-l1-2-0<elf PE 7f542e750000- 7f542e957000 Deferred api-ms-win-core-synch-l1-2-0 ELF 7f542e95b000- 7f542eb61000 Deferred libxfixes.so.3 ELF 7f542eb63000- 7f542ed6e000 Deferred libxcursor.so.1 ELF 7f542ed73000- 7f542ef83000 Deferred libxi.so.6 ELF 7f542ef83000- 7f542f186000 Deferred libxcomposite.so.1 ELF 7f542f18b000- 7f542f396000 Deferred libxrandr.so.2 ELF 7f542f39b000- 7f542f5a5000 Deferred libxrender.so.1 ELF 7f542f5ab000- 7f542f7b1000 Deferred libxxf86vm.so.1 ELF 7f542f7b3000- 7f542f9b6000 Deferred libxinerama.so.1 ELF 7f542f9bb000- 7f542fbd0000 Deferred libbsd.so.0 ELF 7f542fbd3000- 7f542fdd9000 Deferred libxdmcp.so.6 ELF 7f542fddb000- 7f542ffdf000 Deferred libxau.so.6 ELF 7f542ffe3000- 7f543020b000 Deferred libxcb.so.1 ELF 7f543020b000- 7f543054b000 Deferred libx11.so.6 ELF 7f543054b000- 7f543075d000 Deferred libxext.so.6 ELF 7f54307a3000- 7f5430a3f000 Deferred winex11<elf> -PE 7f54307b0000- 7f5430a3f000 \ winex11 ELF 7f5430a43000- 7f5430cb6000 Deferred libpcre.so.3 ELF 7f5430cbb000- 7f5430ed0000 Deferred libgpg-error.so.0 ELF 7f5430ed3000- 7f54310fb000 Deferred libselinux.so.1 ELF 7f54310fb000- 7f543130d000 Deferred liblz4.so.1 ELF 7f5431313000- 7f5431539000 Deferred liblzma.so.5 ELF 7f543153b000- 7f5431743000 Deferred librt.so.1 ELF 7f5431743000- 7f5431a52000 Deferred libgcrypt.so.20 ELF 7f5431a53000- 7f5431cdc000 Deferred libsystemd.so.0 ELF 7f5431ce3000- 7f5431eec000 Deferred libffi.so.6 ELF 7f5431ef3000- 7f5432143000 Deferred libdbus-1.so.3 ELF 7f5432143000- 7f54323c6000 Deferred libgmp.so.10 ELF 7f54323cb000- 7f5432600000 Deferred libhogweed.so.4 ELF 7f5432603000- 7f543283a000 Deferred libnettle.so.6 ELF 7f543283b000- 7f5432a4e000 Deferred libtasn1.so.6 ELF 7f5432a53000- 7f5432dc3000 Deferred libunistring.so.2 ELF 7f5432dc3000- 7f5432fe0000 Deferred libidn2.so.0 ELF 7f5432fe3000- 7f5433314000 Deferred libp11-kit.so.0 ELF 7f543331b000- 7f543351f000 Deferred libkeyutils.so.1 ELF 7f5433523000- 7f543372f000 Deferred libkrb5support.so.0 ELF 7f5433733000- 7f5433937000 Deferred libcom_err.so.2 ELF 7f543393b000- 7f5433b6e000 Deferred libk5crypto.so.3 ELF 7f5433b73000- 7f5433e4d000 Deferred libkrb5.so.3 ELF 7f5433e53000- 7f5434064000 Deferred libavahi-client.so.3 ELF 7f543406b000- 7f5434278000 Deferred libavahi-common.so.3 ELF 7f543427b000- 7f54345e6000 Deferred libgnutls.so.30 ELF 7f54345eb000- 7f5434836000 Deferred libgssapi_krb5.so.2 ELF 7f543483b000- 7f5434ac8000 Deferred libcups.so.2 ELF 7f5434c6b000- 7f5434e96000 Deferred libexpat.so.1 ELF 7f5434e9b000- 7f54350df000 Deferred libfontconfig.so.1 ELF 7f54350e3000- 7f5435316000 Deferred libpng16.so.16 ELF 7f543531b000- 7f54355d0000 Deferred libfreetype.so.6 ELF 7f54355d3000- 7f54357ec000 Deferred wtsapi32<elf> -PE 7f54355e0000- 7f54357ec000 \ wtsapi32 ELF 7f54357f3000- 7f5435a1a000 Deferred imm32<elf> -PE 7f5435800000- 7f5435a1a000 \ imm32 ELF 7f5435a1b000- 7f5435c7f000 Deferred oleacc<elf> -PE 7f5435a30000- 7f5435c7f000 \ oleacc ELF 7f5435c83000- 7f5435ebc000 Deferred secur32<elf> -PE 7f5435c90000- 7f5435ebc000 \ secur32 ELF 7f5435ec3000- 7f5436130000 Deferred dbghelp<elf> -PE 7f5435ed0000- 7f5436130000 \ dbghelp ELF 7f5436133000- 7f543635e000 Deferred mpr<elf> -PE 7f5436140000- 7f543635e000 \ mpr ELF 7f5436363000- 7f543657d000 Deferred libz.so.1 ELF 7f5436583000- 7f5436808000 Deferred wininet<elf> -PE 7f5436590000- 7f5436808000 \ wininet ELF 7f543680b000- 7f5436ac2000 Deferred urlmon<elf> -PE 7f5436820000- 7f5436ac2000 \ urlmon ELF 7f5436ac3000- 7f5436db9000 Deferred comdlg32<elf> -PE 7f5436ad0000- 7f5436db9000 \ comdlg32 ELF 7f5436dbb000- 7f5436ff7000 Deferred oledlg<elf> -PE 7f5436dc0000- 7f5436ff7000 \ oledlg ELF 7f5436ffb000- 7f5437329000 Deferred comctl32<elf> -PE 7f5437000000- 7f5437329000 \ comctl32 ELF 7f543732b000- 7f54377ae000 Deferred shell32<elf> -PE 7f5437350000- 7f54377ae000 \ shell32 ELF 7f54377b3000- 7f54379fa000 Deferred winspool<elf> -PE 7f54377c0000- 7f54379fa000 \ winspool ELF 7f54379fb000- 7f5437c0e000 Deferred msimg32<elf> -PE 7f5437a00000- 7f5437c0e000 \ msimg32 ELF 7f5437c13000- 7f5437e4f000 Deferred uxtheme<elf> -PE 7f5437c20000- 7f5437e4f000 \ uxtheme ELF 7f5437e53000- 7f54380df000 Deferred shlwapi<elf> -PE 7f5437e70000- 7f54380df000 \ shlwapi ELF 7f54380e3000- 7f5438393000 Deferred gdiplus<elf> -PE 7f5438100000- 7f5438393000 \ gdiplus ELF 7f5438393000- 7f5438703000 Deferred oleaut32<elf> -PE 7f54383c0000- 7f5438703000 \ oleaut32 ELF 7f5438703000- 7f5438920000 Deferred jsproxy<elf> -PE 7f5438710000- 7f5438920000 \ jsproxy ELF 7f5438923000- 7f5438b64000 Deferred winhttp<elf> -PE 7f5438930000- 7f5438b64000 \ winhttp ELF 7f5438b6b000- 7f5438dac000 Deferred ws2_32<elf> -PE 7f5438b70000- 7f5438dac000 \ ws2_32 ELF 7f5438db3000- 7f5438fca000 Deferred libresolv.so.2 ELF 7f5438fcb000- 7f54391f7000 Deferred iphlpapi<elf> -PE 7f5438fd0000- 7f54391f7000 \ iphlpapi ELF 7f54391fb000- 7f543942e000 Deferred netapi32<elf> -PE 7f5439200000- 7f543942e000 \ netapi32 ELF 7f5439433000- 7f5439660000 Deferred msacm32<elf> -PE 7f5439440000- 7f5439660000 \ msacm32 ELF 7f5439663000- 7f54398f8000 Deferred rpcrt4<elf> -PE 7f5439670000- 7f54398f8000 \ rpcrt4 ELF 7f54398fb000- 7f5439c89000 Deferred ole32<elf> -PE 7f5439920000- 7f5439c89000 \ ole32 ELF 7f5439c8b000- 7f5439f4e000 Deferred winmm<elf> -PE 7f5439c90000- 7f5439f4e000 \ winmm ELF 7f5439f53000- 7f543a16d000 Deferred version<elf> -PE 7f5439f60000- 7f543a16d000 \ version ELF 7f543a173000- 7f543a3fd000 Deferred advapi32<elf> -PE 7f543a180000- 7f543a3fd000 \ advapi32 ELF 7f543a403000- 7f543a77c000 Deferred gdi32<elf> -PE 7f543a420000- 7f543a77c000 \ gdi32 ELF 7f543a783000- 7f543abb1000 Deferred user32<elf> -PE 7f543a7a0000- 7f543abb1000 \ user32 ELF 7f543abb3000- 7f543ae92000 Deferred crypt32<elf> -PE 7f543abc0000- 7f543ae92000 \ crypt32 ELF 7f543ae93000- 7f543b0a5000 Deferred libnss_files.so.2 ELF 7f543b0ab000- 7f543b2b7000 Deferred libnss_nis.so.2 ELF 7f543b2bb000- 7f543b4d2000 Deferred libnsl.so.1 ELF 7f543b4d3000- 7f543b6db000 Deferred libnss_compat.so.2 ELF 7f543b87b000- 7f543ba92000 Deferred libgcc_s.so.1 ELF 7f543ba93000- 7f543bd97000 Deferred libm.so.6 ELF 7f543bd9b000- 7f543bf9f000 Deferred libdl.so.2 ELF 7f543bfa3000- 7f543c340000 Dwarf libc.so.6 ELF 7f543c343000- 7f543c560000 Deferred libpthread.so.0 ELF 7f543c5a3000- 7f543c948000 Dwarf libwine.so.1 ELF 7f543c94b000- 7f543cb71000 Deferred ld-linux-x86-64.so.2 ELF 7ffd6a9c5000- 7ffd6a9c6000 Deferred [vdso].so Threads: process tid prio (all id:s are in hex) 0000000e services.exe 00000026 0 00000023 0 0000001e 0 00000018 0 00000013 0 00000010 0 0000000f 0 00000011 winedevice.exe 0000001b 0 00000017 0 00000016 0 00000012 0 0000001c plugplay.exe 00000020 0 0000001f 0 0000001d 0 00000021 winedevice.exe 0000002d 0 00000025 0 00000024 0 00000022 0 0000002b explorer.exe 00000036 0 00000035 0 00000034 0 0000002c 0 0000005d (D) C:\forex\Alpari Limited MT5\terminal64.exe 0000005e 0 <== System information: Wine build: wine-2.15 Platform: x86_64 Version: Windows 10 Host system: Linux Host version: 4.11.0-1-amd64

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

3 Sep 3 Sep

12:39 p.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #14 from proggi proggi@yandex.ru ---

Wine build: wine-2.16

0x00000001402b1a52: int $3 Modules: Module Address Debug info Name (139 modules) ELF 7b400000- 7b807000 Dwarf kernel32<elf> -PE 7b420000- 7b807000 \ kernel32 ELF 7bc00000- 7bd14000 Dwarf ntdll<elf> -PE 7bc20000- 7bd14000 \ ntdll ELF 7c000000- 7c004000 Dwarf <wine-loader> PE 140000000- 142786000 Export terminal64 ELF 7f82b6fab000- 7f82b71bf000 Deferred api-ms-win-core-sysinfo-l1-2-1<e PE 7f82b6fb0000- 7f82b71bf000 Deferred api-ms-win-core-sysinfo-l1-2-1 PE 7f82b7213000- 7f82b7427000 Deferred api-ms-win-core-localization-l1- PE 7f82b7220000- 7f82b7427000 Deferred api-ms-win-core-localization-l1-C:\windows\system32\api-ms-win-core-localization-l1-2-1.dll ELF 7f82b742b000- 7f82b763e000 Deferred api-ms-win-core-fibers-l1-1-1<el PE 7f82b7430000- 7f82b763e000 Deferred api-ms-win-core-fibers-l1-1-1 ELF 7f82b7643000- 7f82b7857000 Deferred api-ms-win-core-synch-l1-2-0<elf PE 7f82b7650000- 7f82b7857000 Deferred api-ms-win-core-synch-l1-2-0 ELF 7f82b785b000- 7f82b7a61000 Deferred libxfixes.so.3 ELF 7f82b7a63000- 7f82b7c6e000 Deferred libxcursor.so.1 ELF 7f82b7c73000- 7f82b7e83000 Deferred libxi.so.6 ELF 7f82b7e83000- 7f82b8086000 Deferred libxcomposite.so.1 ELF 7f82b808b000- 7f82b8296000 Deferred libxrandr.so.2 ELF 7f82b829b000- 7f82b84a5000 Deferred libxrender.so.1 ELF 7f82b84ab000- 7f82b86b1000 Deferred libxxf86vm.so.1 ELF 7f82b86b3000- 7f82b88b6000 Deferred libxinerama.so.1 ELF 7f82b88bb000- 7f82b8ad0000 Deferred libbsd.so.0 ELF 7f82b8ad3000- 7f82b8cd9000 Deferred libxdmcp.so.6 ELF 7f82b8cdb000- 7f82b8edf000 Deferred libxau.so.6 ELF 7f82b8ee3000- 7f82b910b000 Deferred libxcb.so.1 ELF 7f82b910b000- 7f82b944b000 Deferred libx11.so.6 ELF 7f82b944b000- 7f82b965d000 Deferred libxext.so.6 ELF 7f82b96a3000- 7f82b993f000 Deferred winex11<elf> -PE 7f82b96b0000- 7f82b993f000 \ winex11 ELF 7f82b9943000- 7f82b9bb6000 Deferred libpcre.so.3 ELF 7f82b9bbb000- 7f82b9dd0000 Deferred libgpg-error.so.0 ELF 7f82b9dd3000- 7f82b9ffb000 Deferred libselinux.so.1 ELF 7f82b9ffb000- 7f82ba20d000 Deferred liblz4.so.1 ELF 7f82ba213000- 7f82ba439000 Deferred liblzma.so.5 ELF 7f82ba43b000- 7f82ba643000 Deferred librt.so.1 ELF 7f82ba643000- 7f82ba952000 Deferred libgcrypt.so.20 ELF 7f82ba953000- 7f82babdc000 Deferred libsystemd.so.0 ELF 7f82babe3000- 7f82badec000 Deferred libffi.so.6 ELF 7f82badf3000- 7f82bb043000 Deferred libdbus-1.so.3 ELF 7f82bb043000- 7f82bb2c6000 Deferred libgmp.so.10 ELF 7f82bb2cb000- 7f82bb500000 Deferred libhogweed.so.4 ELF 7f82bb503000- 7f82bb73a000 Deferred libnettle.so.6 ELF 7f82bb73b000- 7f82bb94e000 Deferred libtasn1.so.6 ELF 7f82bb953000- 7f82bbcc3000 Deferred libunistring.so.2 ELF 7f82bbcc3000- 7f82bbee0000 Deferred libidn2.so.0 ELF 7f82bbee3000- 7f82bc214000 Deferred libp11-kit.so.0 ELF 7f82bc21b000- 7f82bc41f000 Deferred libkeyutils.so.1 ELF 7f82bc423000- 7f82bc62f000 Deferred libkrb5support.so.0 ELF 7f82bc633000- 7f82bc837000 Deferred libcom_err.so.2 ELF 7f82bc83b000- 7f82bca6e000 Deferred libk5crypto.so.3 ELF 7f82bca73000- 7f82bcd4d000 Deferred libkrb5.so.3 ELF 7f82bcd53000- 7f82bcf64000 Deferred libavahi-client.so.3 ELF 7f82bcf6b000- 7f82bd178000 Deferred libavahi-common.so.3 ELF 7f82bd17b000- 7f82bd4e6000 Deferred libgnutls.so.30 ELF 7f82bd4eb000- 7f82bd736000 Deferred libgssapi_krb5.so.2 ELF 7f82bd73b000- 7f82bd9c8000 Deferred libcups.so.2 ELF 7f82bdb6b000- 7f82bdd96000 Deferred libexpat.so.1 ELF 7f82bdd9b000- 7f82bdfdf000 Deferred libfontconfig.so.1 ELF 7f82bdfe3000- 7f82be216000 Deferred libpng16.so.16 ELF 7f82be21b000- 7f82be4d0000 Deferred libfreetype.so.6 ELF 7f82be4d3000- 7f82be6ec000 Deferred wtsapi32<elf> -PE 7f82be4e0000- 7f82be6ec000 \ wtsapi32 ELF 7f82be6f3000- 7f82be91a000 Deferred imm32<elf> -PE 7f82be700000- 7f82be91a000 \ imm32 ELF 7f82be91b000- 7f82beb7f000 Deferred oleacc<elf> -PE 7f82be930000- 7f82beb7f000 \ oleacc ELF 7f82beb83000- 7f82bedbc000 Deferred secur32<elf> -PE 7f82beb90000- 7f82bedbc000 \ secur32 ELF 7f82bedc3000- 7f82bf030000 Deferred dbghelp<elf> -PE 7f82bedd0000- 7f82bf030000 \ dbghelp ELF 7f82bf033000- 7f82bf25e000 Deferred mpr<elf> -PE 7f82bf040000- 7f82bf25e000 \ mpr ELF 7f82bf263000- 7f82bf47d000 Deferred libz.so.1 ELF 7f82bf483000- 7f82bf708000 Deferred wininet<elf> -PE 7f82bf490000- 7f82bf708000 \ wininet ELF 7f82bf70b000- 7f82bf9c2000 Deferred urlmon<elf> -PE 7f82bf720000- 7f82bf9c2000 \ urlmon ELF 7f82bf9c3000- 7f82bfcb9000 Deferred comdlg32<elf> -PE 7f82bf9d0000- 7f82bfcb9000 \ comdlg32 ELF 7f82bfcbb000- 7f82bfef7000 Deferred oledlg<elf> -PE 7f82bfcc0000- 7f82bfef7000 \ oledlg ELF 7f82bfefb000- 7f82c0228000 Deferred comctl32<elf> -PE 7f82bff00000- 7f82c0228000 \ comctl32 ELF 7f82c022b000- 7f82c06af000 Deferred shell32<elf> -PE 7f82c0250000- 7f82c06af000 \ shell32 ELF 7f82c06b3000- 7f82c08fa000 Deferred winspool<elf> -PE 7f82c06c0000- 7f82c08fa000 \ winspool ELF 7f82c08fb000- 7f82c0b0e000 Deferred msimg32<elf> -PE 7f82c0900000- 7f82c0b0e000 \ msimg32 ELF 7f82c0b13000- 7f82c0d4f000 Deferred uxtheme<elf> -PE 7f82c0b20000- 7f82c0d4f000 \ uxtheme ELF 7f82c0d53000- 7f82c0fdf000 Deferred shlwapi<elf> -PE 7f82c0d70000- 7f82c0fdf000 \ shlwapi ELF 7f82c0fe3000- 7f82c1294000 Deferred gdiplus<elf> -PE 7f82c1000000- 7f82c1294000 \ gdiplus ELF 7f82c129b000- 7f82c160b000 Deferred oleaut32<elf> -PE 7f82c12c0000- 7f82c160b000 \ oleaut32 ELF 7f82c160b000- 7f82c1828000 Deferred jsproxy<elf> -PE 7f82c1610000- 7f82c1828000 \ jsproxy ELF 7f82c182b000- 7f82c1a6c000 Deferred winhttp<elf> -PE 7f82c1830000- 7f82c1a6c000 \ winhttp ELF 7f82c1a73000- 7f82c1cb4000 Deferred ws2_32<elf> -PE 7f82c1a80000- 7f82c1cb4000 \ ws2_32 ELF 7f82c1cbb000- 7f82c1ed2000 Deferred libresolv.so.2 ELF 7f82c1ed3000- 7f82c20ff000 Deferred iphlpapi<elf> -PE 7f82c1ee0000- 7f82c20ff000 \ iphlpapi ELF 7f82c2103000- 7f82c2336000 Deferred netapi32<elf> -PE 7f82c2110000- 7f82c2336000 \ netapi32 ELF 7f82c233b000- 7f82c2568000 Deferred msacm32<elf> -PE 7f82c2340000- 7f82c2568000 \ msacm32 ELF 7f82c256b000- 7f82c2800000 Deferred rpcrt4<elf> -PE 7f82c2580000- 7f82c2800000 \ rpcrt4 ELF 7f82c2803000- 7f82c2b91000 Deferred ole32<elf> -PE 7f82c2830000- 7f82c2b91000 \ ole32 ELF 7f82c2b93000- 7f82c2e56000 Deferred winmm<elf> -PE 7f82c2ba0000- 7f82c2e56000 \ winmm ELF 7f82c2e5b000- 7f82c3075000 Deferred version<elf> -PE 7f82c2e60000- 7f82c3075000 \ version ELF 7f82c307b000- 7f82c3305000 Deferred advapi32<elf> -PE 7f82c3090000- 7f82c3305000 \ advapi32 ELF 7f82c330b000- 7f82c3684000 Deferred gdi32<elf> -PE 7f82c3320000- 7f82c3684000 \ gdi32 ELF 7f82c368b000- 7f82c3ab9000 Deferred user32<elf> -PE 7f82c36b0000- 7f82c3ab9000 \ user32 ELF 7f82c3abb000- 7f82c3d9a000 Deferred crypt32<elf> -PE 7f82c3ad0000- 7f82c3d9a000 \ crypt32 ELF 7f82c3d9b000- 7f82c3fad000 Deferred libnss_files.so.2 ELF 7f82c3fb3000- 7f82c41bf000 Deferred libnss_nis.so.2 ELF 7f82c41c3000- 7f82c43da000 Deferred libnsl.so.1 ELF 7f82c43db000- 7f82c45e3000 Deferred libnss_compat.so.2 ELF 7f82c4783000- 7f82c499a000 Deferred libgcc_s.so.1 ELF 7f82c499b000- 7f82c4c9f000 Deferred libm.so.6 ELF 7f82c4ca3000- 7f82c4ea7000 Deferred libdl.so.2 ELF 7f82c4eab000- 7f82c5248000 Dwarf libc.so.6 ELF 7f82c524b000- 7f82c5468000 Deferred libpthread.so.0 ELF 7f82c54ab000- 7f82c5850000 Dwarf libwine.so.1 ELF 7f82c5853000- 7f82c5a79000 Deferred ld-linux-x86-64.so.2 ELF 7ffe945c6000- 7ffe945c8000 Deferred [vdso].so Threads: process tid prio (all id:s are in hex) 0000000e services.exe 00000042 0 00000026 0 00000023 0 0000001e 0 00000018 0 00000013 0 00000010 0 0000000f 0 00000011 winedevice.exe 0000001d 0 00000017 0 00000016 0 00000012 0 0000001b plugplay.exe 00000020 0 0000001f 0 0000001c 0 00000021 winedevice.exe 0000002d 0 00000025 0 00000024 0 00000022 0 00000029 explorer.exe 00000030 0 0000002f 0 0000002e 0 0000002a 0 00000040 rpcss.exe 00000046 0 00000045 0 00000044 0 00000043 0 00000041 0 0000008e (D) C:\forex\Alpari Limited MT5\terminal64.exe 0000008f 0 <== System information: Wine build: wine-2.16 Platform: x86_64 Version: Windows 10 Host system: Linux Host version: 4.12.0-1-amd64

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

21 Sep 21 Sep

4:25 p.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #15 from proggi proggi@yandex.ru --- 0x00000001402b1a52: int $3 Modules: Module Address Debug info Name (139 modules) ELF 7b400000- 7b807000 Dwarf kernel32<elf> -PE 7b420000- 7b807000 \ kernel32 ELF 7bc00000- 7bd14000 Dwarf ntdll<elf> -PE 7bc20000- 7bd14000 \ ntdll ELF 7c000000- 7c004000 Dwarf <wine-loader> PE 140000000- 142786000 Export terminal64 ELF 7f8b8a03b000- 7f8b8a24f000 Deferred api-ms-win-core-sysinfo-l1-2-1<e PE 7f8b8a040000- 7f8b8a24f000 Deferred api-ms-win-core-sysinfo-l1-2-1 PE 7f8b8a2c3000- 7f8b8a4d7000 Deferred api-ms-win-core-localization-l1- PE 7f8b8a2d0000- 7f8b8a4d7000 Deferred api-ms-win-core-localization-l1-C:\windows\system32\api-ms-win-core-localization-l1-2-1.dll ELF 7f8b8a4db000- 7f8b8a6ee000 Deferred api-ms-win-core-fibers-l1-1-1<el PE 7f8b8a4e0000- 7f8b8a6ee000 Deferred api-ms-win-core-fibers-l1-1-1 ELF 7f8b8a6f3000- 7f8b8a907000 Deferred api-ms-win-core-synch-l1-2-0<elf PE 7f8b8a700000- 7f8b8a907000 Deferred api-ms-win-core-synch-l1-2-0 ELF 7f8b8a90b000- 7f8b8ab11000 Deferred libxfixes.so.3 ELF 7f8b8ab13000- 7f8b8ad1e000 Deferred libxcursor.so.1 ELF 7f8b8ad23000- 7f8b8af33000 Deferred libxi.so.6 ELF 7f8b8af33000- 7f8b8b136000 Deferred libxcomposite.so.1 ELF 7f8b8b13b000- 7f8b8b346000 Deferred libxrandr.so.2 ELF 7f8b8b34b000- 7f8b8b555000 Deferred libxrender.so.1 ELF 7f8b8b55b000- 7f8b8b761000 Deferred libxxf86vm.so.1 ELF 7f8b8b763000- 7f8b8b966000 Deferred libxinerama.so.1 ELF 7f8b8b96b000- 7f8b8bb80000 Deferred libbsd.so.0 ELF 7f8b8bb83000- 7f8b8bd89000 Deferred libxdmcp.so.6 ELF 7f8b8bd8b000- 7f8b8bf8f000 Deferred libxau.so.6 ELF 7f8b8bf93000- 7f8b8c1bb000 Deferred libxcb.so.1 ELF 7f8b8c1bb000- 7f8b8c4fb000 Deferred libx11.so.6 ELF 7f8b8c4fb000- 7f8b8c70d000 Deferred libxext.so.6 ELF 7f8b8c713000- 7f8b8c9af000 Deferred winex11<elf> -PE 7f8b8c720000- 7f8b8c9af000 \ winex11 ELF 7f8b8c9b3000- 7f8b8cc25000 Deferred libpcre.so.3 ELF 7f8b8cc2b000- 7f8b8ce40000 Deferred libgpg-error.so.0 ELF 7f8b8ce43000- 7f8b8d06b000 Deferred libselinux.so.1 ELF 7f8b8d06b000- 7f8b8d27d000 Deferred liblz4.so.1 ELF 7f8b8d283000- 7f8b8d4a9000 Deferred liblzma.so.5 ELF 7f8b8d4ab000- 7f8b8d6b3000 Deferred librt.so.1 ELF 7f8b8d6b3000- 7f8b8d9c1000 Deferred libgcrypt.so.20 ELF 7f8b8d9c3000- 7f8b8dc4a000 Deferred libsystemd.so.0 ELF 7f8b8dc4b000- 7f8b8de54000 Deferred libffi.so.6 ELF 7f8b8de5b000- 7f8b8e0ab000 Deferred libdbus-1.so.3 ELF 7f8b8e0ab000- 7f8b8e32e000 Deferred libgmp.so.10 ELF 7f8b8e333000- 7f8b8e567000 Deferred libhogweed.so.4 ELF 7f8b8e56b000- 7f8b8e7a1000 Deferred libnettle.so.6 ELF 7f8b8e7a3000- 7f8b8e9b6000 Deferred libtasn1.so.6 ELF 7f8b8e9bb000- 7f8b8ed2b000 Deferred libunistring.so.2 ELF 7f8b8ed2b000- 7f8b8ef48000 Deferred libidn2.so.0 ELF 7f8b8ef4b000- 7f8b8f27c000 Deferred libp11-kit.so.0 ELF 7f8b8f283000- 7f8b8f487000 Deferred libkeyutils.so.1 ELF 7f8b8f48b000- 7f8b8f697000 Deferred libkrb5support.so.0 ELF 7f8b8f69b000- 7f8b8f89f000 Deferred libcom_err.so.2 ELF 7f8b8f8a3000- 7f8b8fad6000 Deferred libk5crypto.so.3 ELF 7f8b8fadb000- 7f8b8fdb5000 Deferred libkrb5.so.3 ELF 7f8b8fdbb000- 7f8b8ffcc000 Deferred libavahi-client.so.3 ELF 7f8b8ffd3000- 7f8b901e0000 Deferred libavahi-common.so.3 ELF 7f8b901e3000- 7f8b9054e000 Deferred libgnutls.so.30 ELF 7f8b90553000- 7f8b9079e000 Deferred libgssapi_krb5.so.2 ELF 7f8b907a3000- 7f8b90a31000 Deferred libcups.so.2 ELF 7f8b915db000- 7f8b91806000 Deferred libexpat.so.1 ELF 7f8b9180b000- 7f8b91a4f000 Deferred libfontconfig.so.1 ELF 7f8b91a53000- 7f8b91c86000 Deferred libpng16.so.16 ELF 7f8b91c8b000- 7f8b91f40000 Deferred libfreetype.so.6 ELF 7f8b91f43000- 7f8b9215c000 Deferred wtsapi32<elf> -PE 7f8b91f50000- 7f8b9215c000 \ wtsapi32 ELF 7f8b92163000- 7f8b9238a000 Deferred imm32<elf> -PE 7f8b92170000- 7f8b9238a000 \ imm32 ELF 7f8b9238b000- 7f8b925ef000 Deferred oleacc<elf> -PE 7f8b923a0000- 7f8b925ef000 \ oleacc ELF 7f8b925f3000- 7f8b9282c000 Deferred secur32<elf> -PE 7f8b92600000- 7f8b9282c000 \ secur32 ELF 7f8b92833000- 7f8b92aa0000 Deferred dbghelp<elf> -PE 7f8b92840000- 7f8b92aa0000 \ dbghelp ELF 7f8b92aa3000- 7f8b92cce000 Deferred mpr<elf> -PE 7f8b92ab0000- 7f8b92cce000 \ mpr ELF 7f8b92cd3000- 7f8b92eed000 Deferred libz.so.1 ELF 7f8b92ef3000- 7f8b93178000 Deferred wininet<elf> -PE 7f8b92f00000- 7f8b93178000 \ wininet ELF 7f8b9317b000- 7f8b93432000 Deferred urlmon<elf> -PE 7f8b93190000- 7f8b93432000 \ urlmon ELF 7f8b93433000- 7f8b93729000 Deferred comdlg32<elf> -PE 7f8b93440000- 7f8b93729000 \ comdlg32 ELF 7f8b9372b000- 7f8b93967000 Deferred oledlg<elf> -PE 7f8b93730000- 7f8b93967000 \ oledlg ELF 7f8b9396b000- 7f8b93c98000 Deferred comctl32<elf> -PE 7f8b93970000- 7f8b93c98000 \ comctl32 ELF 7f8b93c9b000- 7f8b9411f000 Deferred shell32<elf> -PE 7f8b93cc0000- 7f8b9411f000 \ shell32 ELF 7f8b94123000- 7f8b9436a000 Deferred winspool<elf> -PE 7f8b94130000- 7f8b9436a000 \ winspool ELF 7f8b9436b000- 7f8b9457e000 Deferred msimg32<elf> -PE 7f8b94370000- 7f8b9457e000 \ msimg32 ELF 7f8b94583000- 7f8b947bf000 Deferred uxtheme<elf> -PE 7f8b94590000- 7f8b947bf000 \ uxtheme ELF 7f8b947c3000- 7f8b94a4f000 Deferred shlwapi<elf> -PE 7f8b947e0000- 7f8b94a4f000 \ shlwapi ELF 7f8b94a53000- 7f8b94d04000 Deferred gdiplus<elf> -PE 7f8b94a70000- 7f8b94d04000 \ gdiplus ELF 7f8b94d0b000- 7f8b9507b000 Deferred oleaut32<elf> -PE 7f8b94d30000- 7f8b9507b000 \ oleaut32 ELF 7f8b9507b000- 7f8b95298000 Deferred jsproxy<elf> -PE 7f8b95080000- 7f8b95298000 \ jsproxy ELF 7f8b9529b000- 7f8b954dc000 Deferred winhttp<elf> -PE 7f8b952a0000- 7f8b954dc000 \ winhttp ELF 7f8b954e3000- 7f8b95724000 Deferred ws2_32<elf> -PE 7f8b954f0000- 7f8b95724000 \ ws2_32 ELF 7f8b9572b000- 7f8b95942000 Deferred libresolv.so.2 ELF 7f8b95943000- 7f8b95b6f000 Deferred iphlpapi<elf> -PE 7f8b95950000- 7f8b95b6f000 \ iphlpapi ELF 7f8b95b73000- 7f8b95da6000 Deferred netapi32<elf> -PE 7f8b95b80000- 7f8b95da6000 \ netapi32 ELF 7f8b95dab000- 7f8b95fd8000 Deferred msacm32<elf> -PE 7f8b95db0000- 7f8b95fd8000 \ msacm32 ELF 7f8b95fdb000- 7f8b96270000 Deferred rpcrt4<elf> -PE 7f8b95ff0000- 7f8b96270000 \ rpcrt4 ELF 7f8b96273000- 7f8b96601000 Deferred ole32<elf> -PE 7f8b962a0000- 7f8b96601000 \ ole32 ELF 7f8b96603000- 7f8b968c6000 Deferred winmm<elf> -PE 7f8b96610000- 7f8b968c6000 \ winmm ELF 7f8b968cb000- 7f8b96ae5000 Deferred version<elf> -PE 7f8b968d0000- 7f8b96ae5000 \ version ELF 7f8b96aeb000- 7f8b96d75000 Deferred advapi32<elf> -PE 7f8b96b00000- 7f8b96d75000 \ advapi32 ELF 7f8b96d7b000- 7f8b970f4000 Deferred gdi32<elf> -PE 7f8b96d90000- 7f8b970f4000 \ gdi32 ELF 7f8b970fb000- 7f8b97529000 Deferred user32<elf> -PE 7f8b97120000- 7f8b97529000 \ user32 ELF 7f8b9762b000- 7f8b9790a000 Deferred crypt32<elf> -PE 7f8b97640000- 7f8b9790a000 \ crypt32 ELF 7f8b97a0b000- 7f8b97c1d000 Deferred libnss_files.so.2 ELF 7f8b97c23000- 7f8b97e2f000 Deferred libnss_nis.so.2 ELF 7f8b97e33000- 7f8b9804a000 Deferred libnsl.so.1 ELF 7f8b9804b000- 7f8b98253000 Deferred libnss_compat.so.2 ELF 7f8b985f3000- 7f8b9880a000 Deferred libgcc_s.so.1 ELF 7f8b9880b000- 7f8b98b0f000 Deferred libm.so.6 ELF 7f8b98b13000- 7f8b98d17000 Deferred libdl.so.2 ELF 7f8b98d1b000- 7f8b990b8000 Dwarf libc.so.6 ELF 7f8b990bb000- 7f8b992d8000 Deferred libpthread.so.0 ELF 7f8b99313000- 7f8b996b8000 Dwarf libwine.so.1 ELF 7f8b996bb000- 7f8b998e1000 Deferred ld-linux-x86-64.so.2 ELF 7ffd58b56000- 7ffd58b58000 Deferred [vdso].so Threads: process tid prio (all id:s are in hex) 0000000e services.exe 00000026 0 00000023 0 0000001e 0 00000018 0 00000013 0 00000010 0 0000000f 0 00000011 winedevice.exe 0000001b 0 00000017 0 00000016 0 00000012 0 0000001c plugplay.exe 00000020 0 0000001f 0 0000001d 0 00000021 winedevice.exe 0000002d 0 00000025 0 00000024 0 00000022 0 00000029 explorer.exe 00000030 0 0000002f 0 0000002e 0 0000002a 0 0000002b (D) C:\forex\Alpari Limited MT5\terminal64.exe 0000002c 0 <== System information: Wine build: wine-2.17 Platform: x86_64 Version: Windows 10 Host system: Linux Host version: 4.12.0-2-amd64

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

15 Oct 15 Oct

6:28 a.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #16 from proggi proggi@yandex.ru --- Wine 2,19

0x00000001402b1a52: int $3 Modules: Module Address Debug info Name (139 modules) ELF 7b400000- 7b807000 Dwarf kernel32<elf> -PE 7b420000- 7b807000 \ kernel32 ELF 7bc00000- 7bd15000 Dwarf ntdll<elf> -PE 7bc20000- 7bd15000 \ ntdll ELF 7c000000- 7c004000 Deferred <wine-loader> PE 140000000- 142786000 Export terminal64 ELF 7f259ea73000- 7f259ec87000 Deferred api-ms-win-core-sysinfo-l1-2-1<e PE 7f259ea80000- 7f259ec87000 Deferred api-ms-win-core-sysinfo-l1-2-1 PE 7f259ecfb000- 7f259ef0f000 Deferred api-ms-win-core-localization-l1- PE 7f259ed00000- 7f259ef0f000 Deferred api-ms-win-core-localization-l1-C:\windows\system32\api-ms-win-core-localization-l1-2-1.dll ELF 7f259ef13000- 7f259f126000 Deferred api-ms-win-core-fibers-l1-1-1<el PE 7f259ef20000- 7f259f126000 Deferred api-ms-win-core-fibers-l1-1-1 ELF 7f259f12b000- 7f259f33f000 Deferred api-ms-win-core-synch-l1-2-0<elf PE 7f259f130000- 7f259f33f000 Deferred api-ms-win-core-synch-l1-2-0 ELF 7f259f343000- 7f259f549000 Deferred libxfixes.so.3 ELF 7f259f54b000- 7f259f756000 Deferred libxcursor.so.1 ELF 7f259f75b000- 7f259f96b000 Deferred libxi.so.6 ELF 7f259f96b000- 7f259fb6e000 Deferred libxcomposite.so.1 ELF 7f259fb73000- 7f259fd7e000 Deferred libxrandr.so.2 ELF 7f259fd83000- 7f259ff8d000 Deferred libxrender.so.1 ELF 7f259ff93000- 7f25a0199000 Deferred libxxf86vm.so.1 ELF 7f25a019b000- 7f25a039e000 Deferred libxinerama.so.1 ELF 7f25a03a3000- 7f25a05b8000 Deferred libbsd.so.0 ELF 7f25a05bb000- 7f25a07c1000 Deferred libxdmcp.so.6 ELF 7f25a07c3000- 7f25a09c7000 Deferred libxau.so.6 ELF 7f25a09cb000- 7f25a0bf3000 Deferred libxcb.so.1 ELF 7f25a0bf3000- 7f25a0f33000 Deferred libx11.so.6 ELF 7f25a0f33000- 7f25a1145000 Deferred libxext.so.6 ELF 7f25a114b000- 7f25a13e7000 Deferred winex11<elf> -PE 7f25a1160000- 7f25a13e7000 \ winex11 ELF 7f25a13eb000- 7f25a165d000 Deferred libpcre.so.3 ELF 7f25a1663000- 7f25a1878000 Deferred libgpg-error.so.0 ELF 7f25a187b000- 7f25a1aa3000 Deferred libselinux.so.1 ELF 7f25a1aa3000- 7f25a1cb5000 Deferred liblz4.so.1 ELF 7f25a1cbb000- 7f25a1ee1000 Deferred liblzma.so.5 ELF 7f25a1ee3000- 7f25a20eb000 Deferred librt.so.1 ELF 7f25a20eb000- 7f25a23f9000 Deferred libgcrypt.so.20 ELF 7f25a23fb000- 7f25a267a000 Deferred libsystemd.so.0 ELF 7f25a267b000- 7f25a2884000 Deferred libffi.so.6 ELF 7f25a288b000- 7f25a2adc000 Deferred libdbus-1.so.3 ELF 7f25a2ae3000- 7f25a2d67000 Deferred libgmp.so.10 ELF 7f25a2d6b000- 7f25a2f9f000 Deferred libhogweed.so.4 ELF 7f25a2fa3000- 7f25a31d9000 Deferred libnettle.so.6 ELF 7f25a31db000- 7f25a33ee000 Deferred libtasn1.so.6 ELF 7f25a33f3000- 7f25a3763000 Deferred libunistring.so.2 ELF 7f25a3763000- 7f25a3980000 Deferred libidn2.so.0 ELF 7f25a3983000- 7f25a3cb2000 Deferred libp11-kit.so.0 ELF 7f25a3cb3000- 7f25a3eb7000 Deferred libkeyutils.so.1 ELF 7f25a3ebb000- 7f25a40c7000 Deferred libkrb5support.so.0 ELF 7f25a40cb000- 7f25a42cf000 Deferred libcom_err.so.2 ELF 7f25a42d3000- 7f25a4506000 Deferred libk5crypto.so.3 ELF 7f25a450b000- 7f25a47e5000 Deferred libkrb5.so.3 ELF 7f25a47eb000- 7f25a49fc000 Deferred libavahi-client.so.3 ELF 7f25a4a03000- 7f25a4c10000 Deferred libavahi-common.so.3 ELF 7f25a4c13000- 7f25a4f7e000 Deferred libgnutls.so.30 ELF 7f25a4f83000- 7f25a51ce000 Deferred libgssapi_krb5.so.2 ELF 7f25a51d3000- 7f25a5462000 Deferred libcups.so.2 ELF 7f25a600b000- 7f25a6236000 Deferred libexpat.so.1 ELF 7f25a623b000- 7f25a647f000 Deferred libfontconfig.so.1 ELF 7f25a6483000- 7f25a66b6000 Deferred libpng16.so.16 ELF 7f25a66bb000- 7f25a6970000 Deferred libfreetype.so.6 ELF 7f25a6973000- 7f25a6b8c000 Deferred wtsapi32<elf> -PE 7f25a6980000- 7f25a6b8c000 \ wtsapi32 ELF 7f25a6b93000- 7f25a6dba000 Deferred imm32<elf> -PE 7f25a6ba0000- 7f25a6dba000 \ imm32 ELF 7f25a6dbb000- 7f25a701f000 Deferred oleacc<elf> -PE 7f25a6dd0000- 7f25a701f000 \ oleacc ELF 7f25a7023000- 7f25a725c000 Deferred secur32<elf> -PE 7f25a7030000- 7f25a725c000 \ secur32 ELF 7f25a7263000- 7f25a74d0000 Deferred dbghelp<elf> -PE 7f25a7270000- 7f25a74d0000 \ dbghelp ELF 7f25a74d3000- 7f25a76fe000 Deferred mpr<elf> -PE 7f25a74e0000- 7f25a76fe000 \ mpr ELF 7f25a7703000- 7f25a791d000 Deferred libz.so.1 ELF 7f25a7923000- 7f25a7ba8000 Deferred wininet<elf> -PE 7f25a7930000- 7f25a7ba8000 \ wininet ELF 7f25a7bab000- 7f25a7e62000 Deferred urlmon<elf> -PE 7f25a7bc0000- 7f25a7e62000 \ urlmon ELF 7f25a7e63000- 7f25a8159000 Deferred comdlg32<elf> -PE 7f25a7e70000- 7f25a8159000 \ comdlg32 ELF 7f25a815b000- 7f25a8397000 Deferred oledlg<elf> -PE 7f25a8160000- 7f25a8397000 \ oledlg ELF 7f25a839b000- 7f25a86c9000 Deferred comctl32<elf> -PE 7f25a83a0000- 7f25a86c9000 \ comctl32 ELF 7f25a86cb000- 7f25a8b56000 Deferred shell32<elf> -PE 7f25a86f0000- 7f25a8b56000 \ shell32 ELF 7f25a8b5b000- 7f25a8da2000 Deferred winspool<elf> -PE 7f25a8b60000- 7f25a8da2000 \ winspool ELF 7f25a8da3000- 7f25a8fb6000 Deferred msimg32<elf> -PE 7f25a8db0000- 7f25a8fb6000 \ msimg32 ELF 7f25a8fbb000- 7f25a91f7000 Deferred uxtheme<elf> -PE 7f25a8fc0000- 7f25a91f7000 \ uxtheme ELF 7f25a91fb000- 7f25a9487000 Deferred shlwapi<elf> -PE 7f25a9210000- 7f25a9487000 \ shlwapi ELF 7f25a948b000- 7f25a973c000 Deferred gdiplus<elf> -PE 7f25a94a0000- 7f25a973c000 \ gdiplus ELF 7f25a9743000- 7f25a9ab3000 Deferred oleaut32<elf> -PE 7f25a9770000- 7f25a9ab3000 \ oleaut32 ELF 7f25a9ab3000- 7f25a9cd0000 Deferred jsproxy<elf> -PE 7f25a9ac0000- 7f25a9cd0000 \ jsproxy ELF 7f25a9cd3000- 7f25a9f14000 Deferred winhttp<elf> -PE 7f25a9ce0000- 7f25a9f14000 \ winhttp ELF 7f25a9f1b000- 7f25aa15c000 Deferred ws2_32<elf> -PE 7f25a9f20000- 7f25aa15c000 \ ws2_32 ELF 7f25aa163000- 7f25aa37a000 Deferred libresolv.so.2 ELF 7f25aa37b000- 7f25aa5a7000 Deferred iphlpapi<elf> -PE 7f25aa380000- 7f25aa5a7000 \ iphlpapi ELF 7f25aa5ab000- 7f25aa7de000 Deferred netapi32<elf> -PE 7f25aa5b0000- 7f25aa7de000 \ netapi32 ELF 7f25aa7e3000- 7f25aaa10000 Deferred msacm32<elf> -PE 7f25aa7f0000- 7f25aaa10000 \ msacm32 ELF 7f25aaa13000- 7f25aaca8000 Deferred rpcrt4<elf> -PE 7f25aaa20000- 7f25aaca8000 \ rpcrt4 ELF 7f25aacab000- 7f25ab039000 Deferred ole32<elf> -PE 7f25aacd0000- 7f25ab039000 \ ole32 ELF 7f25ab03b000- 7f25ab2fe000 Deferred winmm<elf> -PE 7f25ab040000- 7f25ab2fe000 \ winmm ELF 7f25ab303000- 7f25ab51d000 Deferred version<elf> -PE 7f25ab310000- 7f25ab51d000 \ version ELF 7f25ab523000- 7f25ab7ad000 Deferred advapi32<elf> -PE 7f25ab530000- 7f25ab7ad000 \ advapi32 ELF 7f25ab7b3000- 7f25abb2c000 Deferred gdi32<elf> -PE 7f25ab7d0000- 7f25abb2c000 \ gdi32 ELF 7f25abb33000- 7f25abf62000 Deferred user32<elf> -PE 7f25abb50000- 7f25abf62000 \ user32 ELF 7f25ac063000- 7f25ac342000 Deferred crypt32<elf> -PE 7f25ac070000- 7f25ac342000 \ crypt32 ELF 7f25ac443000- 7f25ac655000 Deferred libnss_files.so.2 ELF 7f25ac65b000- 7f25ac867000 Deferred libnss_nis.so.2 ELF 7f25ac86b000- 7f25aca82000 Deferred libnsl.so.1 ELF 7f25aca83000- 7f25acc8b000 Deferred libnss_compat.so.2 ELF 7f25ad02b000- 7f25ad242000 Deferred libgcc_s.so.1 ELF 7f25ad243000- 7f25ad547000 Deferred libm.so.6 ELF 7f25ad54b000- 7f25ad74f000 Deferred libdl.so.2 ELF 7f25ad753000- 7f25adaf0000 Deferred libc.so.6 ELF 7f25adaf3000- 7f25add10000 Deferred libpthread.so.0 ELF 7f25add4b000- 7f25ae0f0000 Dwarf libwine.so.1 ELF 7f25ae0f3000- 7f25ae319000 Deferred ld-linux-x86-64.so.2 ELF 7ffe06de6000- 7ffe06de8000 Deferred [vdso].so Threads: process tid prio (all id:s are in hex) 0000000e services.exe 00000021 0 0000001c 0 00000013 0 00000010 0 0000000f 0 00000011 winedevice.exe 00000026 0 00000017 0 00000016 0 00000012 0 0000001a plugplay.exe 0000001e 0 0000001d 0 0000001b 0 0000001f winedevice.exe 0000002d 0 00000023 0 00000022 0 00000020 0 00000029 explorer.exe 00000034 0 00000033 0 00000032 0 0000002a 0 00000068 (D) C:\forex\Alpari Limited MT5\terminal64.exe 00000069 0 <== System information: Wine build: wine-2.19 Platform: x86_64 Version: Windows 10 Host system: Linux Host version: 4.13.0-1-amd64

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

2 Nov 2 Nov

2:31 p.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #17 from proggi proggi@yandex.ru --- Do not run!

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

2:32 p.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #18 from proggi proggi@yandex.ru --- WINE 2.20

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

9 Nov 9 Nov

11:36 p.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #19 from Olivier F. R. Dierick o.dierick@piezo-forte.be --- @proggi: Please, stop pasting backtrace in comments. Attach them instead.

Also, one "int $3" backtrace is sufficent. No need to send multiple backtraces when nothing has changed. Saying "bug is still present in wine x.x" is enough.

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

10 Nov 10 Nov

12:26 a.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #20 from Olivier F. R. Dierick o.dierick@piezo-forte.be --- @proggi: Your issue is different than the OP. Please, add yourself to bug 43997 instead.

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

16 Nov 16 Nov

5:14 p.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #21 from proggi proggi@yandex.ru --- Identical error.

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

11 Dec 11 Dec

8:58 p.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

--- Comment #22 from proggi proggi@yandex.ru --- MetaTrader 5 bild 1702 is RUNNING! to 08.12.2017

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

29 Jan 29 Jan

1:16 p.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

Anastasius Focht focht@gmx.net changed:

--- Comment #23 from Anastasius Focht focht@gmx.net --- Hello folks,

--- quote --- MetaTrader 5 bild 1702 is RUNNING! to 08.12.2017 --- quote ---

interesting.

Latest ProtectionID version doesn't detect Denuvo software protection scheme on these newer binaries though:

--- snip --- -=[ ProtectionID v0.6.9.0 DECEMBER]=- (c) 2003-2017 CDKiLLER & TippeX Build 24/12/17-21:05:42 Ready... Scanning -> Z:\home\focht\Downloads\wine64\drive_c\Program Files\MetaTrader 5\terminal64.exe File Type : 64-Bit Exe (Subsystem : Win GUI / 2), Size : 45739592 (02B9EE48h) Byte(s) | Machine: 0x8664 (AMD64) [!] Warning : File is 64 Bit, this os is NOT Compilation TimeStamp : 0x02B2AE00 -> Tue 08th Jun 1971 21:26:24 (GMT) [TimeStamp] 0x02B2AE00 -> Tue 08th Jun 1971 21:26:24 (GMT) | PE Header | - | Offset: 0x00000000:00000130 | VA: 0x00000001:40000130 | - [TimeStamp] 0x5A6110C2 -> Thu 18th Jan 2018 21:25:22 (GMT) | DebugDirectory | - | Offset: 0x00000000:00B9F6D4 | VA: 0x00000001:40BA04D4 | - [TimeStamp] 0x5A6110C2 -> Thu 18th Jan 2018 21:25:22 (GMT) | DebugDirectory | - | Offset: 0x00000000:00B9F6F0 | VA: 0x00000001:40BA04F0 | - [TimeStamp] 0x5A6110C2 -> Thu 18th Jan 2018 21:25:22 (GMT) | DebugDirectory | - | Offset: 0x00000000:00B9F70C | VA: 0x00000001:40BA050C | - -> File Appears to be Digitally Signed @ Offset 02B9D450h, size : 019F8h / 06648 byte(s) -> File has 468560 (072650h) bytes of appended data starting at offset 02B2AE00h [!] Executable uses TLS callbacks (3 total... 0 invalid addresses) [LoadConfig] Struct determined as v8 (Expected size 232 | Actual size 256) [LoadConfig] CFG (/Guard) - Handler @ 0x1:40A0DFF0 [LoadConfig] CFG Table @ 0x0:00000000 | 0x00 (00) entries [LoadConfig] CFG Flags : 0x100 [LoadConfig] CodeIntegrity -> Flags 0x0 | Catalog 0x0 (0) | Catalog Offset 0x0 | Reserved 0x0 [LoadConfig] GuardAddressTakenIatEntryTable 0x0:00000000 | Count 0x000000000 (00) [LoadConfig] GuardLongJumpTargetTable 0x0:00000000 | Count 0x000000000 (00) [LoadConfig] HybridMetadataPointer 0x1:00000000 | DynamicValueRelocTable 0x0:00000000 [LoadConfig] FailFastIndirectProc 0x0:00000000 | FailFastPointer 0x0:00000000 [LoadConfig] UnknownZero1 0x0 0 [LoadConfig] CFG Data Present, yet setting is not present in the DllCharacteristics.. patched out? [File Heuristics] -> Flag #1 : 00000100000001001101000000000101 (0x0404D005) [Entrypoint Section Entropy] : 7.56 (section #5) ".cod1 " | Size : 0x37DF9C (3661724) byte(s) [DllCharacteristics] -> Flag : (0x8160) -> HEVA | ASLR | DEP | TSA [SectionCount] 8 (0x8) | ImageSize 0x2BB0000 (45809664) byte(s) [VersionInfo] Company Name : MetaQuotes Software Corp. [VersionInfo] Product Name : MetaTrader 5 Client Terminal [VersionInfo] Product Version : 5.0.0.1755 [VersionInfo] File Description : MetaTrader 5 Client Terminal [VersionInfo] File Version : 5.0.0.1755 [VersionInfo] Original FileName : terminal.exe [VersionInfo] Internal Name : terminal.exe [VersionInfo] Version Comments : https://www.metaquotes.net [VersionInfo] Legal Trademarks : MetaTrader [VersionInfo] Legal Copyrights : © 2001-2018. MetaQuotes Software Corp. [ModuleReport] [IAT] Modules -> CRYPT32.dll | WINMM.dll | VERSION.dll | NETAPI32.dll | WINHTTP.dll | gdiplus.dll | UxTheme.dll | KERNEL32.dll | USER32.dll | GDI32.dll | MSIMG32.dll | WINSPOOL.DRV | ADVAPI32.dll | SHELL32.dll | COMCTL32.dll | SHLWAPI.dll | ole32.dll | OLEAUT32.dll | oledlg.dll | urlmon.dll | IPHLPAPI.DLL | dbghelp.dll | WS2_32.dll | Secur32.dll | OLEACC.dll | IMM32.dll | WTSAPI32.dll | KERNEL32.dll | USER32.dll | KERNEL32.dll | USER32.dll [Debug Info] (record 1 of 3) (file offset 0xB9F6D0) Characteristics : 0x0 | TimeDateStamp : 0x5A6110C2 (Thu 18th Jan 2018 21:25:22 (GMT)) | MajorVer : 0 / MinorVer : 0 -> (0.0) Type : 2 (0x2) -> CodeView | Size : 0x5B (91) AddressOfRawData : 0xBB0CAC | PointerToRawData : 0xBAFEAC CvSig : 0x53445352 | SigGuid 2C4D8F0E-AD9F-41D8-8A44C97DD6BDC20C Age : 0x1 (1) | Pdb : E:\MetaTrader5\Client\MetaTrader5Terminal\Release64\terminal64.pdb [Debug Info] (record 2 of 3) (file offset 0xB9F6EC) Characteristics : 0x0 | TimeDateStamp : 0x5A6110C2 (Thu 18th Jan 2018 21:25:22 (GMT)) | MajorVer : 0 / MinorVer : 0 -> (0.0) Type : 12 (0xC) -> Undocumented | Size : 0x14 (20) AddressOfRawData : 0xBB0D08 | PointerToRawData : 0xBAFF08 [Debug Info] (record 3 of 3) (file offset 0xB9F708) Characteristics : 0x0 | TimeDateStamp : 0x5A6110C2 (Thu 18th Jan 2018 21:25:22 (GMT)) | MajorVer : 0 / MinorVer : 0 -> (0.0) Type : 13 (0xD) -> Undocumented | Size : 0x3EC (1004) AddressOfRawData : 0xBB0D1C | PointerToRawData : 0xBAFF1C [CompilerDetect] -> Borland Delphi (unknown version) - 20% probability [CompilerDetect] -> Visual C/C++ [!] File appears to have no protection or is using an unknown protection - Scan Took : 6.486 Second(s) [000001972h (6514) tick(s)] [234 of 580 scan(s) done] --- snip ---

virustotal.com scan:

https://www.virustotal.com/#/file/0c35cfa4458f4c07b6cae1d88b3c58b3c44cb9eb8c...

Tracing/debugging reveals it still has the same anti-debugging code:

--- snip --- ... 002e:Call KERNEL32.GetModuleHandleA(0023dd70 "kernel32.dll",) ret=141aa6c88 002e:Ret KERNEL32.GetModuleHandleA() retval=7b460000 ret=141aa6c88 002e:Call KERNEL32.GetModuleHandleA(0023dd70 "ntdll.dll",) ret=141aa6c88 002e:Ret KERNEL32.GetModuleHandleA() retval=7bc80000 ret=141aa6c88 002e:Call KERNEL32.IsDebuggerPresent() ret=141bb3358 002e:Ret KERNEL32.IsDebuggerPresent() retval=00000000 ret=141bb3358 002e:Call KERNEL32.CheckRemoteDebuggerPresent(ffffffffffffffff,0023dff4,) ret=141bf4512 002e:Ret KERNEL32.CheckRemoteDebuggerPresent() retval=00000001 ret=141bf4512 002e:Call ntdll.NtQueryInformationProcess(ffffffffffffffff,0000001e,0023e278,00000008,00000000,) ret=141b8d5e6 002e:Ret ntdll.NtQueryInformationProcess() retval=c0000353 ret=141b8d5e6 002e:Call ntdll.NtSetInformationThread(fffffffffffffffe,00000011,00000000,00000000,) ret=141b1cbbb 002e:Ret ntdll.NtSetInformationThread() retval=00000000 ret=141b1cbbb 002e:Call ntdll.NtQuerySystemInformation(00000023,0023e580,00000002,00000000,) ret=141b7f723 002e:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=141b7f723 002e:Call ntdll.NtQuerySystemInformation(0000000b,0023df68,00000000,0023df40,) ret=141c45332 002e:Ret ntdll.NtQuerySystemInformation() retval=c0000004 ret=141c45332 002e:Call KERNEL32.LocalAlloc(00000000,00005348,) ret=141badf30 002e:Ret KERNEL32.LocalAlloc() retval=00075730 ret=141badf30 002e:Call ntdll.NtQuerySystemInformation(0000000b,00075730,00005348,00000000,) ret=141be95f0 002e:Ret ntdll.NtQuerySystemInformation() retval=00000000 ret=141be95f0 002e:Call KERNEL32.LocalFree(00075730,) ret=141bca348 002e:Ret KERNEL32.LocalFree() retval=00000000 ret=141bca348 002e:Call ntdll.NtProtectVirtualMemory(ffffffffffffffff,0023dfe0,0023e1c0,00000040,0023dfc0,) ret=141bd42d0 002e:Ret ntdll.NtProtectVirtualMemory() retval=00000000 ret=141bd42d0 002e:Call ntdll.NtProtectVirtualMemory(ffffffffffffffff,0023dfe0,0023e1c0,00000004,0023dfc0,) ret=141bd42d0 002e:Ret ntdll.NtProtectVirtualMemory() retval=00000000 ret=141bd42d0 002e:Call ntdll.NtProtectVirtualMemory(ffffffffffffffff,0023dfe0,0023e1c0,00000004,0023dfc0,) ret=141bd42d0 002e:Ret ntdll.NtProtectVirtualMemory() retval=00000000 ret=141bd42d0 002e:Call KERNEL32.CloseHandle(deadc0de,) ret=141b7896a 002e:Ret KERNEL32.CloseHandle() retval=00000000 ret=141b7896a 002e:trace:seh:NtRaiseException code=80000004 flags=0 addr=0x141ac6a77 ip=141ac6a77 tid=002e 002e:trace:seh:NtRaiseException rax=000000005295e074 rbx=0000000141aa97a0 rcx=00000000deadc0de rdx=000000000000036a 002e:trace:seh:NtRaiseException rsi=0000000000000000 rdi=0000000140e18390 rbp=000000000023dee0 rsp=000000000023de90 002e:trace:seh:NtRaiseException r8=0000000000265148 r9=000000000000a4a8 r10=00000000c62cf451 r11=0000000000000039 002e:trace:seh:NtRaiseException r12=00000000286d5aa5 r13=0000000140000000 r14=0000000000000004 r15=aaaaaaaaaaaaaaab ... 002e:trace:seh:call_handler calling handler 0x140e0dd80 (rec=0x23dd50, frame=0x23de90 context=0x23d000, dispatch=0x23d4d0) 002e:Call ntdll.RtlUnwindEx(0023de90,141ac6a82,0023dd50,ffffffff80000004,0023d000,0023d520,) ret=140e0de85 ... 002e:trace:seh:RtlRestoreContext returning to 141ac6a82 stack 23de90 002e:Call KERNEL32.GetProcessAffinityMask(ffffffffffffffff,0023e0e8,0023dfb8,) ret=141ba20ee 002e:Ret KERNEL32.GetProcessAffinityMask() retval=00000001 ret=141ba20ee 002e:Call KERNEL32.SetThreadAffinityMask(fffffffffffffffe,00000001,) ret=141aca08b 002e:Ret KERNEL32.SetThreadAffinityMask() retval=000000ff ret=141aca08b 002e:Call KERNEL32.Sleep(00000000,) ret=141ad0deb 002e:Ret KERNEL32.Sleep() retval=00000000 ret=141ad0deb 002e:Call KERNEL32.SetThreadAffinityMask(fffffffffffffffe,000000ff,) ret=141c04852 002e:Ret KERNEL32.SetThreadAffinityMask() retval=00000001 ret=141c04852 002e:Call KERNEL32.SetThreadAffinityMask(fffffffffffffffe,00000002,) ret=141aca08b 002e:Ret KERNEL32.SetThreadAffinityMask() retval=000000ff ret=141aca08b 002e:Call KERNEL32.Sleep(00000000,) ret=141ad0deb 002e:Ret KERNEL32.Sleep() retval=00000000 ret=141ad0deb ... --- snip ---

Out of interest I ran the older MetaTrader5 15xx build this bug was reported against and it also worked with Wine 3.0

Fortunately I had the full install directory of MetaTrader5 snapshotted some time ago otherwise even old installers would try to bootstrap recent version from vendor website when being run (no offline install).

I did a reverse regression test and it turns out it was fixed by commit https://source.winehq.org/git/wine.git/commitdiff/a1b563f41c2246f94467b17d67... ("ntdll: Add support for debug registers in exceptions on x86-64."), included in Wine 2.13 release.

Thanks to Alexandre.

---

Not directly related: It seems Denuvo has been acquired by some company called "Irdeto".

https://www.denuvo.com/

https://www.kitguru.net/tech-news/featured-tech-news/matthew-wilson/denuvo-i...

Regards

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

31 Jan 31 Jan

1:11 a.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

Matteo Bruni matteo.mystral@gmail.com changed:

What |Removed |Added ---------------------------------------------------------------------------- CC| |will.cutlass@gmail.com

--- Comment #24 from Matteo Bruni matteo.mystral@gmail.com --- *** Bug 43712 has been marked as a duplicate of this bug. ***

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

wine-bugs＠winehq.org

2 Feb 2 Feb

6:27 p.m.

New subject: [Bug 42716] 64-bit MetaTrader5 refuses to start, reports ' A debugger has been found running in your system' (Denuvo Anti-Tamper x64)

https://bugs.winehq.org/show_bug.cgi?id=42716

Alexandre Julliard julliard@winehq.org changed:

What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED

--- Comment #25 from Alexandre Julliard julliard@winehq.org --- Closing bugs fixed in 3.1.

-- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.

2517

Age (days ago)

2829

Last active (days ago)

wine-bugs@winehq.org

26 comments

1 participants

tags (0)

participants (1)

wine-bugs＠winehq.org