[Bug 45249] Multiple applications wrapped with PE Compact v2.x protection scheme crash on startup (GOT/PIC code emitted at Win32 API entries)(Zockinger Facilitator TFFT v1.1x)

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=45249

Anastasius Focht <focht at gmx.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|-unknown                    |build-env
            Summary|Zockinger Facilitator       |Multiple applications
                   |(TFFT) v1.15 crashes on     |wrapped with PE Compact
                   |startup                     |v2.x protection scheme
                   |                            |crash on startup (GOT/PIC
                   |                            |code emitted at Win32 API
                   |                            |entries)(Zockinger
                   |                            |Facilitator TFFT v1.1x)
         Resolution|---                         |FIXED
      Fixed by SHA1|                            |8f732c66ab37b54c30d63c74f78
                   |                            |22ba1d4f04996
             Status|NEW                         |RESOLVED

--- Comment #6 from Anastasius Focht <focht at gmx.net> ---
Hello folks,

it seems the original "Zockinger Facilitator" (TFFT) v1.15 is no longer
available.

Unfortunately there exist no old snapshots of the v1.15 download because the
vendor uses some weird redirect+auth scheme that prevents snapshots via
Internet Archive.

https://web.archive.org/web/20180422191916/http://www.zockinger.com/downloads

Latest: TFFT v1.17 (21 Aug 2020)

http://www.zockinger.com/downloads/TFFT117.ZIP?attredirects=0&d=1

The newest version v1.17 is still wrapped with same protection scheme though:

--- snip ---
-=[ ProtectionID v0.6.9.0 DECEMBER]=-
(c) 2003-2017 CDKiLLER & TippeX
Build 24/12/17-21:05:42
Ready...
Scanning -> Z:\home\focht\Downloads\tfft117\ZOCFFT.exe
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 1921032 (01D5008h)
Byte(s) | Machine: 0x14C (I386)
Compilation TimeStamp : 0x5EA953AE -> Wed 29th Apr 2020 10:15:10 (GMT)
[TimeStamp] 0x5EA953AE -> Wed 29th Apr 2020 10:15:10 (GMT) | PE Header | - |
Offset: 0x00000088 | VA: 0x00400088 | -
-> File Appears to be Digitally Signed @ Offset 01D1A50h, size : 035B8h /
013752 byte(s)
[LoadConfig] CodeIntegrity -> Flags 0xA3F0 | Catalog 0x46 (70) | Catalog Offset
0x2000001 | Reserved 0x46A4A0
[LoadConfig] GuardAddressTakenIatEntryTable 0x8000011 | Count 0x46A558
(4629848)
[LoadConfig] GuardLongJumpTargetTable 0x8000001 | Count 0x46A5F8 (4630008)
[LoadConfig] HybridMetadataPointer 0x8000011 | DynamicValueRelocTable 0x46A66C
[LoadConfig] FailFastIndirectProc 0x8000011 | FailFastPointer 0x46C360
[LoadConfig] UnknownZero1 0x8000011
[File Heuristics] -> Flag #1 : 00000000000001011100000000100110 (0x0005C026)
[Entrypoint Section Entropy] : 8.00 (section #0) ".text   " | Size : 0x1D0200
(1901056) byte(s)
[DllCharacteristics] -> Flag : (0x0000) -> NONE
[SectionCount] 3 (0x3) | ImageSize 0x2E4000 (3031040) byte(s)
[VersionInfo] Company Name : Zockinger Technologies
[VersionInfo] Product Name : The Facilitator for TSM
[VersionInfo] Product Version : 1.17.0.609
[VersionInfo] File Description : The Facilitator for TSM
[VersionInfo] File Version : 609
[VersionInfo] Original FileName : ZOCFFT.exe
[VersionInfo] Internal Name : TFFT117
[VersionInfo] Legal Copyrights : (C) 2020 Zockinger Technologies
[ModuleReport] [IAT] Modules -> kernel32.dll
[!] PE Compact v20352 (internal version) compressed !
- Scan Took : 1.868 Second(s) [00000046Ch (1132) tick(s)] [506 of 580 scan(s)
done]
--- snip ---

>From my comment #3

--- quote ---
TFFT v1.15 doesn't crash with Wine 3.12 for me but just exits after
considerable number of seconds (maybe because I run a no-PIC build by default).
--- quote ---

Well, "no-PIC build" was actually spot on. I recently rebuilt all old Wine
releases with modern GCC 10.x and default compiler settings hence I could
reproduce the crash with Wine 3.x. I had no-PIC as default long before the time
which helped to debug various other issues but it disguised this type of issue
as well.

It was indeed fixed by commit
https://source.winehq.org/git/wine.git/commitdiff/8f732c66ab37b54c30d63c74f7822ba1d4f04996
("makefiles: Build with -fno-PIC on i386."), part of Wine 4.8 release.

Thanks Zebediah

More bug references for the same fix-commit:

https://bugs.winehq.org/buglist.cgi?bug_status=CLOSED&f1=cf_fixedby_sha1sum&list_id=716452&o1=equals&product=Wine&query_format=advanced&v1=8f732c66ab37b54c30d63c74f7822ba1d4f04996

I'm refining the summary in anticipation of more dupes for same protection
scheme. I prefer to keep this one separate from other DRM/protection schemes
which are covered by multiple collector bugs (see above list).

$ sha1sum TFFT117.ZIP 
d14358db38f6fb6f50a73c9be86e1f2169fad095  TFFT117.ZIP

$ du -sh TFFT117.ZIP 
4.2M    TFFT117.ZIP

$ wine --version
wine-6.0-rc1

Regards

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.