[Bug 35193] New: FL Studio 11.x VSTi 'Slayer2' plugin doesn't work after registration (ASProtect 1.4 software protection)

[wine-bugs at winehq.org]

http://bugs.winehq.org/show_bug.cgi?id=35193

            Bug ID: 35193
           Summary: FL Studio 11.x VSTi 'Slayer2' plugin doesn't work
                    after registration (ASProtect 1.4 software protection)
           Product: Wine
           Version: 1.7.9
          Hardware: x86
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: -unknown
          Assignee: wine-bugs at winehq.org
          Reporter: focht at gmx.net
    Classification: Unclassified

Hello folks,

a user in #winehq reported another plugin not working with FL 11.x (after
fixing bug 35178).

Plugin download:
http://downloads.image-line.com/slayer/slayer2_personalcopy_install.exe

Interestingly: http://www.image-line.com/documents/slayer.html

--- quote ---
FL Slayer2 is no longer available for purchase.
Existing registered customers will keep receiving support.
--- quote ---

Running 'VerA' (a specific tool to identify ASProtect versions) on the plugin
main dll 'Slayer2.dll' reveals:

--- snip ---
EntryPoint check:  ASProtect .DLL style
Crypto info: Block type: 1(U), Info type: 1, Attempts: 1
Application name: Slayer 2
Application version: 1.0
ASProtect version: 1.4 build 04.01 Beta
ASProtect registered to: Image-Line Software

raw info data: [Slayer 2], [1.0], [1.4 build 04.01 Beta], [Image-Line Software]
--- snip ---

The plugin needs to be registered with license code to reproduce the problem
(the user has a legit license).

The protector decrypts the actual plugin code only with a valid license code
during dll initialization.
The 'plugin interface' dll export 'main' is redirected to real code which is
later called by the hosting application -> FL11.

In non-registered version the plugin dll export 'main' is just a stub,
returning zero:

--- snip ---
0024:Ret  PE DLL (proc=0x10170001,module=0x10000000
L"Slayer2.dll",reason=PROCESS_ATTACH,res=(nil)) retval=1
0024:Ret  KERNEL32.LoadLibraryA() retval=10000000 ret=7ede9e5e
0024:Call KERNEL32.GetProcAddress(10000000,7edf0f5b "VSTPluginMain")
ret=7ede9f1e
0024:Ret  KERNEL32.GetProcAddress() retval=00000000 ret=7ede9f1e
0024:Call KERNEL32.GetProcAddress(10000000,7edf0f69 "VstPluginMain")
ret=7ede9f42
0024:Ret  KERNEL32.GetProcAddress() retval=00000000 ret=7ede9f42
0024:Call KERNEL32.GetProcAddress(10000000,7edf0f77 "main") ret=7ede9f66
0024:Ret  KERNEL32.GetProcAddress() retval=1000bd70 ret=7ede9f66
0024:Call KERNEL32.FreeLibrary(10000000) ret=7ede8d31
0024:Call PE DLL (proc=0x10170001,module=0x10000000
L"Slayer2.dll",reason=PROCESS_DETACH,res=(nil))
...
RemotePlugin::DebugMessage: mainEntry prodecure returned NULL 
--- snip ---

The protector doesn't like relay thunks (WINEDEBUG=+relay), it will refuse to
load further at some point, showing 'Error 198'.

When you simply run it within FL11 it will spit out the following messages on
terminal before dying:

--- snip ---
...
fixme:mountmgr:harddisk_ioctl Unsupported ioctl 4d004 (device=4 access=3
func=401 method=0)
fixme:mountmgr:harddisk_ioctl Unsupported ioctl 4d004 (device=4 access=3
func=401 method=0)
err:seh:setup_exception_record stack overflow 896 bytes in thread 0024 eip
7bc43cc2 esp 00240fb0 stack 0x240000-0x241000-0x340000
--- snip ---

Since the user expressed interest to investigate this problem I will back off
for now ;-)

Just a hint for making analysis easier:

Write a small winelib app that acts as loader/host to avoid running the rather
large/complex FL Studio 11.x
Calling 'LoadLibraryA("Slayer2.dll")' is sufficient.
All the magic happens within dll entry point (attach event).

===

I will happily leave any bugs to people wanting to do their own analysis for
fun/learning experience.

Just indicate it: "I'm working on this" ... "I'll have a look" and I'll skip
that bug (there are still thousands of bugs not analysed yet) ;-)

Regards

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.