[Bug 41039] Multiple kernel drivers crash on unimplemented function ntoskrnl.exe.FsRtlIsNameInExpression (VirtualBox, QQProtect for Tencent TIM (com.qq.office) 2.1.x)

[wine-bugs at winehq.org]

https://bugs.winehq.org/show_bug.cgi?id=41039

Anastasius Focht <focht at gmx.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |focht at gmx.net
            Summary|Virtualbox crashes with     |Multiple kernel drivers
                   |access violation, needs     |crash on unimplemented
                   |ntoskrnl.exe.FsRtlIsNameInE |function
                   |xpression                   |ntoskrnl.exe.FsRtlIsNameInE
                   |                            |xpression (VirtualBox,
                   |                            |QQProtect for Tencent TIM
                   |                            |(com.qq.office) 2.1.x)
           Keywords|                            |download
                URL|                            |http://dldir1.qq.com/qqfile
                   |                            |/qq/TIM2.1.5/23141/TIM2.1.5
                   |                            |.exe

--- Comment #3 from Anastasius Focht <focht at gmx.net> ---
Hello folks,

confirming, still present.

QQProtect driver from Tencent TIM (com.qq.office) 2.1.x also needs this.

--- snip ---
...
0031:Call ntoskrnl.exe.IoCreateDriver(0076fdc0,7effb106) ret=7effb7de
0031:trace:ntoskrnl:IoCreateDriver (L"\\Driver\\QQProtect", 0x7effb106) 
...
0031:Call KERNEL32.LoadLibraryW(00120d30
L"C:\\windows\\system32\\drivers\\QQProtect.sys") ret=7effaa36
0031:trace:loaddll:load_native_dll Loaded
L"C:\\windows\\system32\\drivers\\QQProtect.sys" at 0x8b0000: native
0031:Ret  KERNEL32.LoadLibraryW() retval=008b0000 ret=7effaa36 
...
0031:Call ntoskrnl.exe.PsGetVersion(0076fa50,0076fa4c,0076fa48,00000000)
ret=008bcf82
0031:Call ntdll.RtlGetVersion(0076f8b4) ret=7e98a4d7
0031:Ret  ntdll.RtlGetVersion() retval=00000000 ret=7e98a4d7
0031:Ret  ntoskrnl.exe.PsGetVersion() retval=00000001 ret=008bcf82
0031:Call ntoskrnl.exe.RtlInitUnicodeString(008ec67c,008e6a80
L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\QQProtect")
ret=008be2b0
0031:Call ntdll.RtlInitUnicodeString(008ec67c,008e6a80
L"\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\QQProtect")
ret=7bc801bb
0031:Ret  ntdll.RtlInitUnicodeString() retval=008ec67c ret=7bc801bb
0031:Ret  ntoskrnl.exe.RtlInitUnicodeString() retval=008ec67c ret=008be2b0
0031:Call ntoskrnl.exe.RtlInitUnicodeString(0076fa48,008dd146
L"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET*\\SERVICES\\QQPROTECT") ret=008c6e74
0031:Call ntdll.RtlInitUnicodeString(0076fa48,008dd146
L"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET*\\SERVICES\\QQPROTECT") ret=7bc801bb
0031:Ret  ntdll.RtlInitUnicodeString() retval=0076fa48 ret=7bc801bb
0031:Ret  ntoskrnl.exe.RtlInitUnicodeString() retval=0076fa48 ret=008c6e74
0031:Call KERNEL32.RaiseException(80000100,00000001,00000002,0076fa04)
ret=7e98cfab
0031:trace:seh:raise_exception code=80000100 flags=1 addr=0x7b446f66
ip=7b446f66 tid=0031
0031:trace:seh:raise_exception  info[0]=7e98cfe0
0031:trace:seh:raise_exception  info[1]=7e98e120
wine: Call from 0x7b446f66 to unimplemented function
ntoskrnl.exe.FsRtlIsNameInExpression, aborting 
...
--- snip ---

Source:
https://source.winehq.org/git/wine.git/blob/HEAD:/dlls/ntoskrnl.exe/ntoskrnl.exe.spec#l237

$ sha1sum TIM2.1.5.exe 
1bf1b558fcc32acf494cdf71694e9fede83e23ad  TIM2.1.5.exe

$ du -sh TIM2.1.5.exe 
67M    TIM2.1.5.exe

$ wine --version
wine-3.8-128-g8e9ea7a8a1

Regards

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.