[Bug 12948] zmud does not run under Ubuntu 8.04 (...turn off system debuggers)

[wine-bugs at winehq.org]

http://bugs.winehq.org/show_bug.cgi?id=12948


Anastasius Focht <focht at gmx.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |focht at gmx.net




--- Comment #5 from Anastasius Focht <focht at gmx.net>  2008-07-27 04:26:24 ---
Hello,

I downloaded v7.21 26-Sep-2005 (PUBLIC release) and ran it using wine-1.1.2.
Apart from gui bugs it runs fine.

Their changelog doesn't reveal something serious ...

--- snip ---
7.20a 13-Sep-2005 (PUBLIC release)

    * Removed eLicense copy protection and replaced with custom copy
protection.

6.06 13-Sep-00 (Beta version)

    * Removed old zMUD copy protection. zMUD no longer contacts server and no
longer sends any user information to zuggsoft.com.
--- snip ---

A quick scan of executables revealed following:

--- snip ---
C:\Program Files\zMUD\elicen40.dll - ASPack 2.12
C:\Program Files\zMUD\zsConvert.exe - ASPack 2.12
C:\Program Files\zMUD\Zmud.exe - Armadillo 1.xx - 2.xx
--- snip ---

In conjunction with your error message:

--- quote ---
"For security purposes, this program will not run while system debuggers are
active.  Please remove or disable the system debugger before trying to run this
program again."
--- quote ---

I've reversed several Armadillo versions and can think of following scenario:

Armadillo consists of two processes (same executable) where the father acts as
debugger, controlling the child process.
The child is actually the app code to be executed (encrypted).
Whenever code is executed in child, page faults are caused on purpose (guard
pages).
The father (debugger) decrypts and re-encrypts the code on the fly, writing
back to child (debuggee) process memory.
Usually only a certain amount of child pages stay unencrypted while the others
remain encrypted.

If the father stays - for whatever reason - in memory on exit, even for few
seconds and you attempt to restart the app, the protector mistakenly identifies
the father process as debugger (because it acts as one) and fails.

You could simulate this behaviour by trying to start the app twice.
There should be the same error message.

I'm afraid but such behaviour is not fixable.
All Armadillo protected apps are susceptible to this problem because of design.

Just make sure there are no lingering processes of the app in memory before you
start it (e.g. wineserver -k).

Regards


-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.