WineHQ
Bug Tracking Database – Bug 24328

 Bugzilla

 

Last modified: 2013-12-20 12:42:57 UTC  

Filter Forge 2 demo fails to launch with error: <class XFW::OSCallError> ::GetScrollInfo failed. (ExeCryptor protection)

First Last Prev Next    This bug is not in your last search results.
Bug 24328 - Filter Forge 2 demo fails to launch with error: <class XFW::OSCallError> ::GetScrollInfo failed. (ExeCryptor protection)
Filter Forge 2 demo fails to launch with error: <class XFW::OSCallError> ::Ge...
Status: CLOSED FIXED
AppDB: Show Apps affected by this bug
Product: Wine
Classification: Unclassified
Component: user32
1.3.2
x86-64 Linux
: P2 normal
: ---
Assigned To: Mr. Bugs
http://www.filterforge.com/download/F...
: download, obfuscation
Depends on:
Blocks:
  Show dependency tree
 
Reported: 2010-09-09 19:19 UTC by anomalydetected
Modified: 2013-12-20 12:42 UTC (History)
3 users (show)

See Also:
Regression SHA1:
Fixed by SHA1: 1cd5e69478afe031566fc265c7c1ecec318e936c
Distribution: ---
Staged patchset:

Attachments
Screenshot of error message (10.90 KB, image/png)
2010-09-09 19:19 UTC, anomalydetected 		Details
Terminal output (1.04 KB, text/plain)
2010-09-09 19:20 UTC, anomalydetected 		Details
View All Add an attachment (back traces, logs, proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description anomalydetected 2010-09-09 19:19:04 UTC 
Created attachment 30664 [details]
Screenshot of error message

Filter Forge 2 demo installs without an error message, but when attempting to launch it and clicking "Use Trial - 30 days left", an error message pops up <class XFW::OSCallError> ::GetScrollInfo failed. (screenshot attached) and the program crashes.
Demo is available for download here: http://www.filterforge.com/download/
Regular Terminal output and terminal output with WINEDEBUG=+relay,+seh,+tid attached also.
Comment 1 anomalydetected 2010-09-09 19:20:20 UTC 
Created attachment 30665 [details]
Terminal output
Comment 2 anomalydetected 2010-09-09 19:23:05 UTC 
Terminal output with WINEDEBUG=+relay,+seh,+tid available here:
(too big to attach to this bug)
http://www.mediafire.com/?6rjhl98br68lclj
Comment 3 Béla Gyebrószki 2012-02-13 11:38:07 UTC 
Still a problem in Wine-1.4rc3.
Both Filter Forge 2 and FF 3 share the reported problem (download link for FF2 Trial added to url).

Filter Forge 2 Setup.exe   md5sum: baf5f49ff0f56f3e859d6df4fd6ce3d5

Running the application after a clean install I am greeted with a window, offering 2 options: <Buy Filter Forge> and <Use Trial - 30 Days Left>.
Clicking on <Use Trial...> results in the error message mentioned in the bug title.

This could be another bug caused by the copy-protection scheme named ExeCryptor.
See also bug #28001 and bug #29567.

-=[ ProtectionID v0.6.4.0 JULY]=-
(c) 2003-2010 CDKiLLER & TippeX
Build 07/08/10-17:57:05
Ready...
Scanning -> C:\Program Files\Filter Forge 2\Bin\FFXCmdRenderer-x86.exe
File Type : 32-Bit Exe (Subsystem : Win CUI / 3), Size : 3232112 (0315170h) Byte(s)
-> File Appears to be Digitally Signed @ Offset 0313E00h, size : 01370h / 04976 byte(s)
[File Heuristics] -> Flag : 00000000000000011100001000100111 (0x0001C227)
[!] EXE Cryptor v2.4.0 RC v1.02 (with un-compressed code section) detected !
- Scan Took : 1.429 Second(s)

Scanning -> C:\Program Files\Filter Forge 2\Bin\Filter Forge x86.exe
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 8144752 (07C4770h) Byte(s)
[x] Warning - FileAlignment seems wrong.. is 0x00000200, calculated 0x00000400
-> File Appears to be Digitally Signed @ Offset 07C3400h, size : 01370h / 04976 byte(s)
[File Heuristics] -> Flag : 00000000000000011100001000100111 (0x0001C227)
[!] EXE Cryptor v2.4.0 RC v1.02 (with un-compressed code section) detected !
[!] Possible CD/DVD-Key or Serial Check -> SerialNumber
[CompilerDetect] -> Visual C++ 7.1 (Visual Studio 2003)
- Scan Took : 0.62 Second(s)

Scanning -> C:\Program Files\Filter Forge 2\Bin\Filter Forge x86-SSE2.exe
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 8197488 (07D1570h) Byte(s)
-> File Appears to be Digitally Signed @ Offset 07D0200h, size : 01370h / 04976 byte(s)
[File Heuristics] -> Flag : 00000000000000011100001000100111 (0x0001C227)
[!] EXE Cryptor v2.4.0 RC v1.02 (with un-compressed code section) detected !
[!] Possible CD/DVD-Key or Serial Check -> SerialNumber
[CompilerDetect] -> Visual C++ 7.1 (Visual Studio 2003)
- Scan Took : 0.58 Second(s)

Scanning -> C:\Program Files\Filter Forge 2\Bin\Filter Forge.exe
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 3130224 (02FC370h) Byte(s)
-> File Appears to be Digitally Signed @ Offset 02FB000h, size : 01370h / 04976 byte(s)
[File Heuristics] -> Flag : 00000000000000000000000000000100 (0x00000004)
[!] Possible CD/DVD-Key or Serial Check -> SerialNumber
[CompilerDetect] -> Visual C++ 7.1 (Visual Studio 2003)
[!] File appears to have no protection or is using an unknown protection
- Scan Took : 0.350 Second(s)
Comment 4 Anastasius Focht 2012-04-10 16:16:53 UTC 
Hello,

confirming.

That app protection is a bit annoying, employing several anti-debugging/anti-attach tricks (openprocess security, high priority watchdog threads, TLS callbacks with debugger threads/entry points detection etc.).

The problem seems to be GetScrollInfo() -> SCROLL_GetScrollInfo() -> SCROLL_GetInternalInfo() failing due to returned infoPtr == NULL and alloc == FALSE.
The internal SCROLLBAR_INFO structure (wndPtr->pScroll) has not yet been allocated yet in message sequence between window creation and GetScrollInfo() call.

Relevant trace log, window with v+h scroll bar styles gets created:

--- snip ---
...
0026:Call user32.CreateWindowExW(00000004,0000c043,00b2fd78 L"",52300000,00000000,00000000,00000000,00000000,000100dc,00000000,00400000,00000000) ret=00595fd3
0026:trace:win:WIN_CreateWindowEx L"" #c043 ex=00000004 style=52300000 0,0 0x0 parent=0x100dc menu=(nil) inst=0x400000 params=(nil)
0026:trace:win:dump_window_styles style: WS_CHILD WS_VISIBLE WS_CLIPCHILDREN WS_VSCROLL WS_HSCROLL
0026:trace:win:dump_window_styles exstyle: WS_EX_NOPARENTNOTIFY 
...
0026:trace:win:WIN_CreateWindowEx created window 0x100de
0026:Ret  user32.CreateWindowExW() retval=000100de ret=00595fd3
...
0026:trace:win:WIN_SetWindowLong 0x100de -12 248b090 W
0026:Ret  user32.SetWindowLongW() retval=00000000 ret=0057a241 
...
0026:Call user32.SetWindowLongW(000100de,fffffffc,0057ca50) ret=0057a3c0
0026:trace:win:WIN_SetWindowLong 0x100de -4 57ca50 W
0026:trace:win:alloc_winproc reusing 0xffff0025 for 0x57ca50
0026:Ret  user32.SetWindowLongW() retval=7ec6896c ret=0057a3c0 
...
0026:Call user32.ShowScrollBar(000100de,00000003,00000001) ret=005a15a0
0026:trace:scroll:SCROLL_ShowScrollBar hwnd=0x100de bar=3 horz=1, vert=1
0026:Ret  user32.ShowScrollBar() retval=00000001 ret=005a15a0
...
0026:Call user32.ShowScrollBar(000100de,00000003,00000000) ret=005a1628
0026:trace:scroll:SCROLL_ShowScrollBar hwnd=0x100de bar=3 horz=0, vert=0 
...
0026:Ret  user32.ShowScrollBar() retval=00000001 ret=005a1628
...
0026:Call user32.GetWindowRect(000100de,0033265c) ret=00577190
0026:trace:win:GetWindowRect hwnd 0x100de (12,297)-(12,297)
0026:Ret  user32.GetWindowRect() retval=00000001 ret=00577190 
...
0026:Call user32.TranslateMessage(003328b4) ret=0057b80d
0026:Ret  user32.TranslateMessage() retval=00000000 ret=0057b80d
0026:Call user32.CallWindowProcW(7ec6896c,000100de,00000083,00000001,00334e74) ret=0057b83e
0026:Call window proc 0x7ec6896c (hwnd=0x100de,msg=WM_NCCALCSIZE,wp=00000001,lp=00334e74)
0026:Call user32.DefWindowProcW(000100de,00000083,00000001,00334e74) ret=7ed0f832
0026:Ret  user32.DefWindowProcW() retval=00000000 ret=7ed0f832
0026:Ret  window proc 0x7ec6896c (hwnd=0x100de,msg=WM_NCCALCSIZE,wp=00000001,lp=00334e74) retval=00000000
0026:Ret  user32.CallWindowProcW() retval=00000000 ret=0057b83e
0026:Ret  window proc 0x57ca50 (hwnd=0x100de,msg=WM_NCCALCSIZE,wp=00000001,lp=00334e74) retval=00000000
0026:trace:win:SWP_DoNCCalcSize hwnd 0x100de old win (0,0)-(0,0) old client (0,0)-(0,0) new win (0,0)-(293,371) new client (0,0)-(293,371)
0026:trace:win:GetWindowRect hwnd 0x100de (12,297)-(305,668)
0026:trace:win:invalidate_dce 0x100de scope hwnd = 0x100dc (12,297)-(305,668) ((12,297)-(12,297))
0026:trace:win:invalidate_dce 0x14f600: hwnd 0x20034 dcx 00000013 Cache 
0026:trace:win:invalidate_dce 0x147d58: hwnd (nil) dcx 00000002 Cache 
0026:trace:win:USER_SetWindowPos 	status flags = 1006
0026:Call window proc 0x57ca50 (hwnd=0x100de,msg=WM_WINDOWPOSCHANGED,wp=00000000,lp=00334fd8)
0026:Call user32.IsWindowVisible(000100de) ret=0057867f
0026:Ret  user32.IsWindowVisible() retval=00000000 ret=0057867f
0026:Call user32.GetScrollInfo(000100de,00000001,003316c4) ret=005a182e
0026:trace:scroll:GetScrollInfo hwnd=0x100de nBar=1 info=0x3316c4
0026:Ret  user32.GetScrollInfo() retval=00000000 ret=005a182e
...
0026:Call KERNEL32.RaiseException(e06d7363,00000001,00000003,00331694) ret=00a25cbc
0026:trace:seh:raise_exception code=e06d7363 flags=1 addr=0x7b839357 ip=7b839357 tid=0026
0026:trace:seh:raise_exception  info[0]=19930520
0026:trace:seh:raise_exception  info[1]=00331868
0026:trace:seh:raise_exception  info[2]=00bc8d80
0026:trace:seh:raise_exception  eax=7b826381 ebx=7b8aa708 ecx=00bc8d80 edx=003315a0 esi=00331678 edi=003315f0
0026:trace:seh:raise_exception  ebp=003315d8 esp=00331574 cs=0023 ds=002b es=002b fs=0063 gs=006b flags=00200287
0026:trace:seh:call_stack_handlers calling handler at 0xa68966 code=e06d7363 flags=1
0026:trace:seh:call_stack_handlers handler at 0xa68966 returned 1
0026:trace:seh:call_stack_handlers calling handler at 0xa683e8 code=e06d7363 flags=1
0026:Call ntdll.RtlUnwind(003328bc,00a25d22,00331580,00000000) ret=00a25d22 
...
0026:Call KERNEL32.GetStringTypeW(00000001,0014af2a L"class XFW::OSCallError> ::GetScrollInfo failed.",00000001,0033dd66) ret=7df3042d 
--- snip ---

Source: http://source.winehq.org/git/wine.git/blob/74159467168c7925857267f3aef71f09face2c9c:/dlls/user32/scroll.c#l1197

--- snip ---
1210 static BOOL SCROLL_GetScrollInfo(HWND hwnd, INT nBar, LPSCROLLINFO info)
1211 {
1212     LPSCROLLBAR_INFO infoPtr;
1213 
1214     /* handle invalid data structure */
1215     if (!SCROLL_ScrollInfoValid(info)
1216         || !(infoPtr = SCROLL_GetInternalInfo(hwnd, nBar, FALSE)))
1217             return FALSE;
1218 
...
--- snip ---

If I allow allocation within SCROLL_GetScrollInfo(), the app starts successfully and works fine.

$ du -sh Filter\ Forge\ 2\ Setup.exe 
47M	Filter Forge 2 Setup.exe

$ sha1sum Filter\ Forge\ 2\ Setup.exe 
98e28e013934fc4fd209e9b7f6315e654f9e57bc  Filter Forge 2 Setup.exe

$ wine --version
wine-1.5.1-240-g31f6f48

Regards
Comment 5 Marc Olivier Chouinard 2012-08-17 13:04:01 UTC 
I have the same issue with V3 of filter forge. Any update on @Anastasius Focht solution been the good one or not ?
Comment 6 Anastasius Focht 2013-12-18 13:27:26 UTC 
Hello folks,

revisiting.

This was fixed by commit http://source.winehq.org/git/wine.git/commitdiff/1cd5e69478afe031566fc265c7c1ecec318e936c

Thanks Sergey (@etersoft)

There is another problem with 30-day trial period expiring too fast (really!).

Except for 'Filter Forge.exe' all executables (x86, SSE2) refuse to start, claiming 'trial expired' after fresh installation.
'Filter Forge.exe' start succeeds the first time, initializes the period and fails on subsequent runs with same message.

Use the following 'workaround' for the time being before starting 'Filter Forge.exe':

--- snip ---
$ wine reg delete "HKLM\\Software\\Classes\\CLSID\\{56AB089D-B9DB-A853-14CD-51B5F1F34426}"

$ wine reg delete "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Approved\\{56AB089D-B9DB-A853-14CD-51B5F1F34426}"
--- snip ---

Regards
Comment 7 Alexandre Julliard 2013-12-20 12:42:57 UTC 
Closing bugs fixed in 1.7.9.
First Last Prev Next    This bug is not in your last search results.

Privacy Policy
If you have a privacy inquiry regarding this site, please write to [email protected]

Hosted By CodeWeavers