[Bug 34479] Multiple apps wrapped with Armadillo software protection scheme fail with unexpected guard page fault caused by Wine's ATL thunk check (Advantage Cooking, Wayne Gould's Sudoku)

[wine-bugs at winehq.org]

http://bugs.winehq.org/show_bug.cgi?id=34479

Anastasius Focht <focht at gmx.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Advantage Cooking: crashes  |Multiple apps wrapped with
                   |on start (check for ATL     |Armadillo software
                   |thunk triggers unexpected   |protection scheme fail with
                   |guard page fault)           |unexpected guard page fault
                   |                            |caused by Wine's ATL thunk
                   |                            |check (Advantage Cooking,
                   |                            |Wayne Gould's Sudoku)

--- Comment #3 from Anastasius Focht <focht at gmx.net> 2013-11-30 14:21:34 CST ---
Hello folks,

another victim: "Wayne Gould's Sudoku" v1.1 by Pappocom

A user reported this app here:
http://forum.winehq.org/viewtopic.php?f=8&t=20422

Download: http://gencon.crius.feralhosting.com/files/SudokuSetup.zip

The app is protected by Armadillo software protection scheme (two processes
where one acts as debugger of the other).

--- snip ---
-=[ ProtectionID v0.6.4.0 JULY]=-
(c) 2003-2010 CDKiLLER & TippeX
Build 07/08/10-17:57:05
Ready...
Scanning -> Z:\home\focht\.wine\drive_c\Program Files\Pappocom\Sudoku\Sud.exe
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 839680 (0CD000h)
Byte(s)
[File Heuristics] -> Flag : 00000000000000001100001000000011 (0x0000C203)
[!] Armadillo v3.78 detected !
[CompilerDetect] -> Visual C/C++
- Scan Took : 0.638 Second(s)
--- snip ---

Trace log:

--- snip ---
$ pwd
/home/focht/.wine/drive_c/Program Files/Pappocom/Sudoku

$ WINEDEBUG=+tid,+seh,+relay wine ./Sud.exe >>log.txt 2>&1
...
0026:Call user32.RegisterClassA(0033d590) ret=0034fcf4
0026:Ret  user32.RegisterClassA() retval=0000c04f ret=0034fcf4
0026:Call
KERNEL32.CreateThread(00000000,00000000,00350459,00000000,00000000,0033d5c4)
ret=0034fc2a
0026:Ret  KERNEL32.CreateThread() retval=000000ac ret=0034fc2a
0026:trace:seh:raise_exception code=80000001 flags=0 addr=0x7bc83bbe
ip=7bc83bbe tid=0026
0024:Ret  KERNEL32.WaitForDebugEvent() retval=00000001 ret=00488e75
0024:Call KERNEL32.GetLocalTime(0033bad4) ret=00498b56
0024:Ret  KERNEL32.GetLocalTime() retval=00000001 ret=00498b56
0024:Call KERNEL32.GetSystemTime(0033bac4) ret=00498b60
0024:Ret  KERNEL32.GetSystemTime() retval=00000001 ret=00498b60
0024:Call ntdll.RtlAllocateHeap(005b8000,00000000,00000010) ret=00498f79
0024:Ret  ntdll.RtlAllocateHeap() retval=005b9040 ret=00498f79
0024:Call KERNEL32.ContinueDebugEvent(00000025,00000028,00010002) ret=0048b574
0024:Ret  KERNEL32.ContinueDebugEvent() retval=00000001 ret=0048b574
0024:Call KERNEL32.GetExitCodeProcess(00000058,004b4a58) ret=00486e45
0026:trace:seh:raise_exception  info[0]=00000000
0028:Call PE DLL (proc=0x7ed2af30,module=0x7ec70000
L"user32.dll",reason=THREAD_ATTACH,res=(nil))
0024:Ret  KERNEL32.GetExitCodeProcess() retval=00000001 ret=00486e45
0026:trace:seh:raise_exception  info[1]=00453976
0028:Ret  PE DLL (proc=0x7ed2af30,module=0x7ec70000
L"user32.dll",reason=THREAD_ATTACH,res=(nil)) retval=1
0024:Call KERNEL32.WaitForDebugEvent(0033cbbc,000003e8) ret=00488e75
0028:Call PE DLL (proc=0x7e82ce9c,module=0x7e7d0000
L"winex11.drv",reason=THREAD_ATTACH,res=(nil))
0026:trace:seh:raise_exception  eax=00453976 ebx=7bccf000 ecx=9b0e6441
edx=0033d168 esi=0033d294 edi=00453976
0028:Ret  PE DLL (proc=0x7e82ce9c,module=0x7e7d0000
L"winex11.drv",reason=THREAD_ATTACH,res=(nil)) retval=1
0026:trace:seh:raise_exception  ebp=0033d238 esp=0033d140 cs=0023 ds=002b
es=002b fs=0063 gs=006b flags=00010246
0028:Call PE DLL (proc=0x7e702500,module=0x7e6e0000
L"ws2_32.dll",reason=THREAD_ATTACH,res=(nil))
0028:Ret  PE DLL (proc=0x7e702500,module=0x7e6e0000
L"ws2_32.dll",reason=THREAD_ATTACH,res=(nil)) retval=1
0028:Call PE DLL (proc=0x7d9fa5e0,module=0x7d9a0000
L"rpcrt4.dll",reason=THREAD_ATTACH,res=(nil))
0024:Ret  KERNEL32.WaitForDebugEvent() retval=00000001 ret=00488e75
0024:Call KERNEL32.GetLocalTime(0033bad4) ret=00498b56
0024:Ret  KERNEL32.GetLocalTime() retval=00000001 ret=00498b56
0024:Call KERNEL32.GetSystemTime(0033bac4) ret=00498b60
0024:Ret  KERNEL32.GetSystemTime() retval=00000001 ret=00498b60
0024:Call KERNEL32.GetThreadContext(0000005c,0033c8d4) ret=004890bd
0024:Ret  KERNEL32.GetThreadContext() retval=00000001 ret=004890bd
0024:Call KERNEL32.ContinueDebugEvent(00000025,00000026,80010001) ret=0048b574
0024:Ret  KERNEL32.ContinueDebugEvent() retval=00000001 ret=0048b574
0024:Call KERNEL32.GetExitCodeProcess(00000058,004b4a58) ret=00486e45
0026:trace:seh:call_stack_handlers calling handler at 0x7bc9dc83 code=80000001
flags=0
...
--- snip ---

The debugger process doesn't expect the guard page fault.

$ sha1sum SudokuSetup.exe
2b33811b1456689939676908f036f5e0df45b4d5  SudokuSetup.exe

$ du -sh SudokuSetup.exe 
2.1M    SudokuSetup.exe

$ wine --version
wine-1.7.7-230-g2507330

Regards

-- 
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.