https://bugs.winehq.org/show_bug.cgi?id=44499
Bug ID: 44499
Summary: BattlEye 'BEDaisy' kernel service crashes on
unimplemented function
ntoskrnl.exe.PsSetCreateProcessNotifyRoutineEx
Product: Wine
Version: 3.1
Hardware: x86-64
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: ntoskrnl
Assignee: wine-bugs(a)winehq.org
Reporter: focht(a)gmx.net
Distribution: ---
Hello folks,
continuation of bug 44497
The kernel driver uses multiple methods to implement process
protection/supervision.
* ObRegisterCallbacks
* ObUnRegisterCallbacks
* ObGetFilterVersion
-> covered by bug 44497
Another method:
* PsSetCreateProcessNotifyRoutineEx
Example kernel driver code to show how the API is being used:
https://github.com/Microsoft/Windows-driver-samples/tree/master/general/obc…
--- quote ---
ObCallback Callback Registration Driver
The ObCallback sample driver demonstrates the use of registered callbacks for
process protection. The driver registers control callbacks which are called at
process creation.
Design and Operation
The sample exercises both the PsSetCreateProcessNotifyRoutineEx and the
ObRegisterCallbacks routines. The first example uses the ObRegisterCallbacks
routine and a callback to restrict requested access rights during a open
process action. The second example uses the PsSetCreateProcessNotifyRoutineEx
routine to reject a process creation by examining the command line.
--- quote ---
Another article:
https://malwaretips.com/threads/av-self-protection-process-c-c.66200/
For BattlEye 'BEDaisy' service to succeed the driver init routine it is enough
to implement a stub for 'PsSetCreateProcessNotifyRoutineEx' like it was done
with 'PsSetCreateProcessNotifyRoutine' -> return STATUS_SUCCESS
https://source.winehq.org/git/wine.git/blob/354fa7eb7921c3317e7943c18871feb…
--- snip ---
2381 /***********************************************************************
2382 * PsSetCreateProcessNotifyRoutine (NTOSKRNL.EXE.@)
2383 */
2384 NTSTATUS WINAPI PsSetCreateProcessNotifyRoutine(
PCREATE_PROCESS_NOTIFY_ROUTINE callback, BOOLEAN remove )
2385 {
2386 FIXME( "stub: %p %d\n", callback, remove );
2387 return STATUS_SUCCESS;
2388 }
--- snip ---
$ sha1sum Tibia_Setup.exe
50951008ccc402cc32407bfc56a88da873e3e9bd Tibia_Setup.exe
$ du -sh Tibia_Setup.exe
5.2M Tibia_Setup.exe
$ wine --version
wine-3.1-193-g354fa7eb79
Regards
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
https://bugs.winehq.org/show_bug.cgi?id=44497
Bug ID: 44497
Summary: BattlEye 'BEDaisy' kernel service crashes on
unimplemented ntoskrnl.exe ObCallback (object manager)
functions
Product: Wine
Version: 3.1
Hardware: x86-64
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: ntoskrnl
Assignee: wine-bugs(a)winehq.org
Reporter: focht(a)gmx.net
Distribution: ---
Hello folks,
continuation of bug 44496
The kernel driver uses object manager callbacks in order to implement process
protection.
* ObRegisterCallbacks
* ObUnRegisterCallbacks
* ObGetFilterVersion
Example kernel driver code to show how the API is being used:
https://github.com/Microsoft/Windows-driver-samples/tree/master/general/obc…
--- quote ---
ObCallback Callback Registration Driver
The ObCallback sample driver demonstrates the use of registered callbacks for
process protection. The driver registers control callbacks which are called at
process creation.
Design and Operation
The sample exercises both the PsSetCreateProcessNotifyRoutineEx and the
ObRegisterCallbacks routines. The first example uses the ObRegisterCallbacks
routine and a callback to restrict requested access rights during a open
process action. The second example uses the PsSetCreateProcessNotifyRoutineEx
routine to reject a process creation by examining the command line.
--- quote ---
Another article:
https://malwaretips.com/threads/av-self-protection-process-c-c.66200/
BattlEye 'BEDaisy' needs semi-stubs. Pure stubs returning
'STATUS_NOT_IMPLEMENTED' is not enough. The driver init routine will fail.
* ObRegisterCallbacks -> return STATUS_SUCCESS (and fake handle)
* ObUnRegisterCallbacks -> just empty stub is enough
* ObGetFilterVersion -> return OB_FLT_REGISTRATION_VERSION
Also mentioned in tps://bugs.winehq.org/show_bug.cgi?id=41039#c0 ("Virtualbox
crashes with access violation, needs ntoskrnl.exe.FsRtlIsNameInExpression")
although not the problem there.
--- snip ---
fixme:ntoskrnl:MmGetSystemRoutineAddress L"ObRegisterCallbacks" not found
fixme:ntoskrnl:MmGetSystemRoutineAddress L"ObUnRegisterCallbacks" not found
--- snip ---
With these things fixed, the driver runs further - into next problems.
$ sha1sum Tibia_Setup.exe
50951008ccc402cc32407bfc56a88da873e3e9bd Tibia_Setup.exe
$ du -sh Tibia_Setup.exe
5.2M Tibia_Setup.exe
$ wine --version
wine-3.1-193-g354fa7eb79
Regards
--
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=13463
Summary: 000
Product: WineHQ Bugzilla
Version: unspecified
Platform: PC
OS/Version: Linux
Status: UNCONFIRMED
Severity: critical
Priority: P5
Component: bugzilla-unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: maty1206(a)maryanlinux.com
Wine can't uninstall the trial of Filemaker Pro.
Please, improve this feature.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=14844
Summary: Filemaker 9- freezes when loading .fmx plugins
Product: WineHQ Apps Database
Version: unspecified
Platform: Other
OS/Version: other
Status: UNCONFIRMED
Severity: enhancement
Priority: P2
Component: appdb-unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: mosborne(a)ashs.school.nz
Filemaker 9 runs perfectly in Wine until it tries to load plugins, such as
Troi_*.fmx
Normally these extensions are (I think) located in the Application data folder
in windows so Wine might be looking for them in the wrong place. Ideas?
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=12356
Summary: FileMaker 8.5 and 9 crash after a few second on startup
Product: Wine
Version: 0.9.58.
Platform: PC
OS/Version: Linux
Status: UNCONFIRMED
Severity: major
Priority: P2
Component: winedbg
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: mihael.krauth(a)gmail.com
FileMaker 8.5 and 9 crash after a few second on startup, just afer displaying
the splash screen.
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=14963
Summary: Filemaker pro 8.5 apps crash easily (version 6.0 didn't)
Product: Wine
Version: 1.0.0
Platform: PC
OS/Version: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: -unknown
AssignedTo: wine-bugs(a)winehq.org
ReportedBy: julien.puydt(a)laposte.net
Created an attachment (id=15570)
--> (http://bugs.winehq.org/attachment.cgi?id=15570)
Crash trace
A small app (named rech_pb.exe) to query a database "written" with filemaker
pro 8.5 shows empty dropdown menus, and can crash pretty easily when used ; it
shows many :
fixme:ole:OleQueryLinkFromData (0x13a448),stub!
and many :
fixme:font:SetMapperFlags (0x8258, 0x00000000): stub - harmless
An older version of the same app "written" with filemaker pro 6.0 works
correctly, but shows many :
fixme:ole:OleQueryLinkFromData (0x13a448),stub!
so I guess those warnings are pretty harmless, but the "harmless" ones aren't
that much.
See the attached log of a crash of the newer version.
Hope that helps.
PS: I'm using debian unstable's 1.0.0-1 package, in case the precision can help
PS2: I'm probably tech-savvy enough to install svn+patch if needed
--
Configure bugmail: http://bugs.winehq.org/userprefs.cgi?tab=email
Do not reply to this email, post in Bugzilla using the
above URL to reply.
------- You are receiving this mail because: -------
You are watching all bug changes.