[Bug 52312] Multiple kernel drivers crash due to missing 'ntoskrnl.IoCreateDeviceSecure' stub (Dokan 'dokan1.sys', LabVIEW 201x CVI 'cvintdrv.sys', F-Secure BlackLight Engine 2.2 'fsbldrv.sys' )

Sat Jan 1 14:34:08 CST 2022

https://bugs.winehq.org/show_bug.cgi?id=52312

Anastasius Focht <focht at gmx.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|-unknown                    |ntoskrnl
           Keywords|                            |download
                URL|                            |https://web.archive.org/web
                   |                            |/20220101193836/https://git
                   |                            |hub.com/dokan-dev/dokany/re
                   |                            |leases/download/v1.5.0.3000
                   |                            |/Dokan_x64.msi
            Summary|Dokan file system driver    |Multiple kernel drivers
                   |'dokan1.sys' kernel driver  |crash due to missing
                   |crashes                     |'ntoskrnl.IoCreateDeviceSec
                   |                            |ure' stub (Dokan
                   |                            |'dokan1.sys', LabVIEW 201x
                   |                            |CVI 'cvintdrv.sys',
                   |                            |F-Secure BlackLight Engine
                   |                            |2.2 'fsbldrv.sys' )

--- Comment #6 from Anastasius Focht <focht at gmx.net> ---
Hello folks,

I've archived one installer from Dokany 1.x release series which installs
64-bit 'dokan1.sys':

https://github.com/dokan-dev/dokany/releases/tag/v1.5.0.3000

https://web.archive.org/web/20220101193836/https://github.com/dokan-dev/dokany/releases/download/v1.5.0.3000/Dokan_x64.msi

https://www.virustotal.com/gui/file/701b56281010adf9fc401d5189dd223b1b300d4d123980a32a57f242a6a651d1

$ sha1sum Dokan_x64.msi 
0661e14c01785fdf636d826fee34e556b02dc7d4  Dokan_x64.msi

$ du -sh Dokan_x64.msi 
12M    Dokan_x64.msi

The installer refuses to run due to absence of Windows KB4474419 which
obviously isn't present since this is Wine and not Windows :)

https://support.microsoft.com/en-us/topic/sha-2-code-signing-support-update-for-windows-server-2008-r2-windows-7-and-windows-server-2008-september-23-2019-84a8aad5-d8d9-2d5c-6d78-34f9aa5f8339

You can trick the installer without authoring the MSI package by passing the
property directly via command line:

--- snip ---
$ wine msiexec -i Dokan_x64.msi WIN7KB4474419INSTALLED=1
--- snip ---

The installer still fails in the end though:

--- snip ---
...
012c:err:msi:ITERATE_Actions Execution halted, action L"InstallFinalize"
returned 1603
012c:fixme:msi:internal_ui_handler internal UI not implemented for message
0x0b000000 (UI level = 5)
012c:fixme:msi:internal_ui_handler internal UI not implemented for message
0x0b000000 (UI level = 5)
012c:err:msi:ITERATE_Actions Execution halted, action L"ExecuteAction" returned
1603
01c4:fixme:setupapi:pSetupGetGlobalFlags stub
01c4:fixme:setupapi:pSetupGetGlobalFlags stub
012c:err:msi:execute_script Execution of script 2 halted; action
L"[2.1\00015\0001{1AFEA463-3DB8-48FA-87D1-7151BE92DB4B}\000128\00012\0001Dokan
Library 1.5.0.3000 (x64)\0001Dokany
Project<=>S-1-5-21-0-0-0-1000<=>{65A3A964-3DC3-0105-0000-210531145800}]MsiRollbackInstall"
returned 1603
--- snip ---

If you terminate the installer right away using 'wineserver -k' nothing is
rolled back and the install artifacts are retained.

The reason for the crash here is bug 39406 ("Multiple kernel drivers crash due
to missing 'ntoskrnl.SeExports' export (SE_EXPORTS structure)(LabVIEW 201x CVI
'cvintdrv.sys', F-Secure BlackLight Engine 2.2 'fsbldrv.sys')").

The crash "magically" disappeared with commit
https://source.winehq.org/git/wine.git/commitdiff/162991a03ceb4b45963b7129bffa89ee443c7e32
("ntoskrnl: Add IoCreateDeviceSecure semi-stub.") which lets the driver take a
different code path.

--- snip ---
$ wineboot
...
00c8:fixme:ntoskrnl:IoCreateDeviceSecure (000000000014A650, 408,
L"\\Device\\Dokan_1", 34, 0, 0,
L"D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGWGX;;;WD)(A;;GRGX;;;RC)", (null),
0000000000C5F5F0): semi-stub
00c8:fixme:ntoskrnl:IoCreateDeviceSecure (000000000014A650, 0,
L"\\Device\\DokanFs1", 8, 0, 0,
L"D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGWGX;;;WD)(A;;GRGX;;;RC)", (null),
0000000000C5F5E0): semi-stub
00c8:fixme:ntoskrnl:IoCreateDeviceSecure (000000000014A650, 0,
L"\\Device\\DokanCdFs1", 3, 0, 0,
L"D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GRGWGX;;;WD)(A;;GRGX;;;RC)", (null),
0000000000C5F5E8): semi-stub
00c8:fixme:ntoskrnl:IoRegisterFileSystem (000000000014B330): stub
00c8:fixme:ntoskrnl:IoRegisterFileSystem (000000000014B4A0): stub
00c8:fixme:ntoskrnl:RtlIsNtDdiVersionAvailable stub: 100794368
00c8:fixme:ntoskrnl:FsRtlRegisterFileSystemFilterCallbacks stub:
000000000014A650 0000000000C5F810
00c8:fixme:ntoskrnl:IoUnregisterFileSystem (000000000014B330): stub
00c8:fixme:ntoskrnl:IoUnregisterFileSystem (000000000014B4A0): stub
00c8:err:ntoskrnl:ZwLoadDriver failed to create driver
L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\dokan1": c0000002
003c:fixme:service:scmdatabase_autostart_services Auto-start service L"dokan1"
failed to start: 1
--- snip ---

You either use a recent Wine 6.22+/7.0-ish release which avoids the crash or
you disable the kernel driver as follows by running:

--- snip ---
$ wine reg add "HKLM\\System\\CurrentControlSet\\Services\\dokan1" \
         /v Start /t REG_DWORD /d 4 /f
--- snip ---

General advice:

Please avoid re-using the same WINEPREFIX with multiple software installations
unless you know what you are doing and can help yourself. It's like with
Windows: if you install too much crap it will break the prefix at one point.
Isolate your main apps/games into own prefixes.

https://wiki.winehq.org/FAQ#Wineprefixes

If you have still questions, please visit WineHQ user forums. Wine Bugzilla is
not for end-user support (sometimes an exception is made though).

Regards

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.