[Bug 45910] New: GameGuard requires [wevtapi.dll.EvtExportLog] function

https://bugs.winehq.org/show_bug.cgi?id=45910

Bug ID: 45910
           Summary: GameGuard requires [wevtapi.dll.EvtExportLog] function
           Product: Wine
           Version: 3.14
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: wevtapi
          Assignee: [e-mail]
          Reporter: [e-mail]
      Distribution: ---

Created attachment 62439
  --> https://bugs.winehq.org/attachment.cgi?id=62439
backtrace

Hello,

I would like to first thank all contributors to this amazing project. You've
done so much for us Linux users and gamers! Thank you!!

As described, it appears GameGuard anti-cheat solution requires an wevtapi
function that has yet to be implemented.

The solution is used for Phantasy Star Online 2 and the game cannot starts
subsequently to what appears to be GameGuard crashing.

Unfortunately, I obtained a first backtrace that I cannot reproduce anymore
though the game still doesn't start.

[Bug 45910] GameGuard requires [wevtapi.dll.EvtExportLog] function

https://bugs.winehq.org/show_bug.cgi?id=45910

Louis Lenders  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #1 from Louis Lenders  ---
Created attachment 62441
  --> https://bugs.winehq.org/attachment.cgi?id=62441
patch

Looks like spec file was not updated right/forgotten. Does this patch change
anything?

[Bug 45910] nProtect GameGuard used by multiple MMORPG games crashes on unimplemented function wevtapi.dll.EvtExportLog (4Story, Phantasy Star Online 2)

https://bugs.winehq.org/show_bug.cgi?id=45910

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]
           Keywords|                            |download, obfuscation
            Summary|GameGuard requires          |nProtect GameGuard used by
                   |[wevtapi.dll.EvtExportLog]  |multiple MMORPG games
                   |function                    |crashes on unimplemented
                   |                            |function
                   |                            |wevtapi.dll.EvtExportLog
                   |                            |(4Story, Phantasy Star
                   |                            |Online 2)
             Status|UNCONFIRMED                 |NEW
           See Also|                            |https://bugs.winehq.org/sho
                   |                            |w_bug.cgi?id=3952
     Ever confirmed|0                           |1
                URL|                            |http://download.pso2.jp/cli
                   |                            |ent/PSO2_SETUP.exe

--- Comment #2 from Anastasius Focht  ---
Hello folks,

confirming.

Offending commit:
https://source.winehq.org/git/wine.git/commitdiff/ecbb4fa3ea2d3a9e1d3f560c7e...

Mentioned here:

https://www.winehq.org/pipermail/wine-devel/2018-March/124696.html

Please always refer to the ticket id when sending in patches. Using a link to
an attachment results in unnecessary work (and load) to reverse-lookup the
ticket.

https://bugs.winehq.org/buglist.cgi?bug_status=UNCONFIRMED&bug_status=NE...

-> https://bugs.winehq.org/show_bug.cgi?id=3952 ->
https://bugs.winehq.org/show_bug.cgi?id=3952#c76

HOWTOs for installing PSO2:

https://mmos.com/editorials/how-to-register-for-and-install-phantasy-star-on...
http://pso2.jp/players/manual/setup/pc/
http://arks-layer.com/setup.html#tweaker-setup

Regards

[Bug 45910] nProtect GameGuard used by multiple MMORPG games crashes on unimplemented function wevtapi.dll.EvtExportLog (4Story, Phantasy Star Online 2)

https://bugs.winehq.org/show_bug.cgi?id=45910

--- Comment #3 from DX099  ---
Created attachment 62448
  --> https://bugs.winehq.org/attachment.cgi?id=62448
backtrace 2 warn

Hi,

I tested the game with the patche, but it still crashes. Whatever triggered
GameGuard to crash on evtlog seems gone.

It still crashes, with error code 114 for which it sends back to  :
http://www.gameguard.co.kr/gameguard/faq/eng/FAQ_114.htm

Attached is a +warn trace.

I'll try to figure out winedbg to get a proper backtrace of when the GameGuard
process fails.

[Bug 45910] nProtect GameGuard used by multiple MMORPG games crashes on unimplemented function wevtapi.dll.EvtExportLog (4Story, Phantasy Star Online 2)

https://bugs.winehq.org/show_bug.cgi?id=45910

--- Comment #4 from DX099  ---
Created attachment 62449
  --> https://bugs.winehq.org/attachment.cgi?id=62449
BT 3 winedbg

This is the best that I could do to try and dump the state of all relevant
processes (PSO2.exe and ggerror.des) after they have crashed.

[Bug 45910] nProtect GameGuard used by multiple MMORPG games crashes on unimplemented function wevtapi.dll.EvtExportLog (4Story, Phantasy Star Online 2)

https://bugs.winehq.org/show_bug.cgi?id=45910

Anastasius Focht  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
      Fixed by SHA1|                            |0892cdf761a2f0320b1b59c39be
                   |                            |d43e4c8a5476a
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #5 from Anastasius Focht  ---
Hello folks,

this is fixed by commit
https://source.winehq.org/git/wine.git/commitdiff/0892cdf761a2f0320b1b59c39b...

Thanks Louis

--- snip ---
$  WINEDEBUG=+seh,+relay wine ./PSO2\ Tweaker.exe >>log.txt 2>&1
...
0093:Call KERNEL32.CreateProcessA(00000000,0033d8cc "C:\Program Files
(x86)\PSO2\PHANTASYSTARONLINE2\pso2_bin\GameGuard\ggerror.des 1 PSO2JP
1",00000000,00000000,00000000,00000000,00000000,00000000,0033d784,0033d724)
ret=046d3214 
...
00af:Call KERNEL32.__wine_kernel_init() ret=7bc6d698
0093:Ret  KERNEL32.CreateProcessA() retval=00000001 ret=046d3214
...
00af:Call KERNEL32.GetProcAddress(7cd10000,004cc464 "EvtExportLog")
ret=00418557
00af:Ret  KERNEL32.GetProcAddress() retval=7cd17100 ret=00418557
...
00af:Call wevtapi.EvtExportLog(00000000,004cc5bc L"Application",004cc4b0
L"*[System[(Level = 2) and TimeCreated[timediff(@SystemTime) <=
86400000]]][EventData[Data="GameMon.des" or
Data="GameMon64.des"]]",004cc490 L".\event.erv",00000001) ret=004185e6
00af:fixme:wevtapi:EvtExportLog ((nil) L"Application" L"*[System[(Level = 2)
and TimeCreated[timediff(@SystemTime) <=
86400000]]][EventData[Data="GameMon.des" or Data="GameMon64.des"]]"
L".\event.erv" 0x1) stub!
00af:Ret  wevtapi.EvtExportLog() retval=00000000 ret=004185e6 
...
--- snip ---

That export is called when it's already too late (post-mortem log/reporting).
Anything else should be discussed in separate tickets -> no recycling!

$ wine --version
wine-3.17-32-gd8249c638c

Regards

[Bug 45910] nProtect GameGuard used by multiple MMORPG games crashes on unimplemented function wevtapi.dll.EvtExportLog (4Story, Phantasy Star Online 2)

https://bugs.winehq.org/show_bug.cgi?id=45910

--- Comment #6 from DX099  ---
So I should open another to follow up on further crashes?

[Bug 45910] nProtect GameGuard used by multiple MMORPG games crashes on unimplemented function wevtapi.dll.EvtExportLog (4Story, Phantasy Star Online 2)

https://bugs.winehq.org/show_bug.cgi?id=45910

Alexandre Julliard  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |CLOSED

--- Comment #7 from Alexandre Julliard  ---
Closing bugs fixed in 3.18.

[Bug 45910] nProtect GameGuard used by multiple MMORPG games crashes on unimplemented function wevtapi.dll.EvtExportLog (4Story, Phantasy Star Online 2)

https://bugs.winehq.org/show_bug.cgi?id=45910

Michael Stefaniuc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |3.0.x

[Bug 45910] nProtect GameGuard used by multiple MMORPG games crashes on unimplemented function wevtapi.dll.EvtExportLog (4Story, Phantasy Star Online 2)

https://bugs.winehq.org/show_bug.cgi?id=45910

Michael Stefaniuc  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|3.0.x                       |---

--- Comment #8 from Michael Stefaniuc  ---
Removing the 3.0.x milestone from bug fixes included in 3.0.5.