Someone's using exceptions as goto statements

[[reaVerNL@Rumble]ᚱᛖᚨᚠᛖᚱ]

Or he's trying to tell the OS how to run its business. Either way, it's stupid, and it's even more stupid doing this every ♥♥♥♥ing frame.

Here is the evidence:
======================
Proton: 1576681293 proton-4.11-11
SteamGameId: 582010
Command: ['/home/reaver/.local/share/Steam/SteamApps/common/Monster Hunter World/MonsterHunterWorld.exe']
Options: set()
======================
ERROR: ld.so: object '/home/reaver/.local/share/Steam/ubuntu12_32/gameoverlayrenderer.so' from LD_PRELOAD cannot be preloaded (wrong ELF class: ELFCLASS32): ignored.
ERROR: ld.so: object '/home/reaver/.local/share/Steam/ubuntu12_64/gameoverlayrenderer.so' from LD_PRELOAD cannot be preloaded (wrong ELF class: ELFCLASS64): ignored.
ERROR: ld.so: object '/home/reaver/.local/share/Steam/ubuntu12_64/gameoverlayrenderer.so' from LD_PRELOAD cannot be preloaded (wrong ELF class: ELFCLASS64): ignored.
ERROR: ld.so: object '/home/reaver/.local/share/Steam/ubuntu12_32/gameoverlayrenderer.so' from LD_PRELOAD cannot be preloaded (wrong ELF class: ELFCLASS32): ignored.
fsync: up and running.

...

L"C:\\windows\\system32\\winevulkan.dll" at 0x7fa1b3fa0000: builtin
289107.225:002e:002f:trace:loaddll:load_native_dll Loaded L"C:\\windows\\system32\\d3d11.dll" at 0x6a340000: native
289107.303:002e:002f:trace:loaddll:load_so_dll Loaded L"C:\\windows\\system32\\lsteamclient.dll" at 0x7fa1b3cf0000: builtin
289107.816:002e:002f:trace:seh:NtRaiseException code=406d1388 flags=0 addr=0x7b45318c ip=7b45318c tid=002f
289107.816:002e:002f:trace:seh:NtRaiseException info[0]=0000000100001000
289107.816:002e:002f:trace:seh:NtRaiseException info[1]=0000000144e42cad
289107.816:002e:002f:trace:seh:NtRaiseException info[2]=0000000000000031
289107.816:002e:002f:trace:seh:NtRaiseException rax=000000000022fc10 rbx=0000000144e42c60 rcx=000000000022fc10 rdx=000000000022fc30
289107.816:002e:002f:trace:seh:NtRaiseException rsi=000000000022fd08 rdi=000000000022fc48 rbp=000000000022fcc0 rsp=000000000022fbf0
289107.816:002e:002f:trace:seh:NtRaiseException r8=0000000000000003 r9=000000000022fcf0 r10=000000007b453120 r11=0000000000000246
289107.816:002e:002f:trace:seh:NtRaiseException r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000
289107.816:002e:002f:trace:seh:call_vectored_handlers calling handler at 0x6a435200 code=406d1388 flags=0
289107.816:002e:002f:trace:seh:call_vectored_handlers handler at 0x6a435200 returned ffffffff
289107.816:002e:002f:trace:seh:NtRaiseException code=406d1388 flags=0 addr=0x7b45318c ip=7b45318c tid=002f
289107.817:002e:002f:trace:seh:NtRaiseException info[0]=0000000100001000
289107.817:002e:002f:trace:seh:NtRaiseException info[1]=0000000144e42d4d
289107.817:002e:002f:trace:seh:NtRaiseException info[2]=0000000000000032
289107.817:002e:002f:trace:seh:NtRaiseException rax=000000000022fc10 rbx=0000000144e42d00 rcx=000000000022fc10 rdx=000000000022fc30
289107.817:002e:002f:trace:seh:NtRaiseException rsi=000000000022fd08 rdi=000000000022fc48 rbp=000000000022fcc0 rsp=000000000022fbf0
289107.817:002e:002f:trace:seh:NtRaiseException r8=0000000000000003 r9=000000000022fcf0 r10=000000007b453120 r11=0000000000000246
289107.817:002e:002f:trace:seh:NtRaiseException r12=0000000000000000 r13=0000000000000000 r14=0000000000000000 r15=0000000000000000
289107.817:002e:002f:trace:seh:call_vectored_handlers calling handler at 0x6a435200 code=406d1388 flags=0
289107.817:002e:002f:trace:seh:call_vectored_handlers handler at 0x6a435200 returned ffffffff

EDIT: logfile for completeness: https://gist.github.com/GoLD-ReaVeR/e9109cebad3b766d07973dfeb053dbfb

[Seamus]

You mean a newly updated game isn't compatible with a hacked together linux program for running windows software?

Shocking.

[[reaVerNL@Rumble]ᚱᛖᚨᚠᛖᚱ]

No, I'm saying some ♥♥♥♥♥♥♥♥ can't code applications. Has CAPCUM been hiring game urinalists?

[Toxi]

I'm only a few years in C# as far as programming goes, what exactly is the application telling the OS to do here, it raises an exceptions because it's not finding the windows related data, entries?

[[reaVerNL@Rumble]ᚱᛖᚨᚠᛖᚱ]

As far as I can tell, that exception is used to set the thread name. It basically throws to the parent thread (the OS or the main thread) to make the change, the parent does something and then sends something back to tell the thread to continue as planned. However the exception type name in question doesn't seem to be very specific and may be used to trigger code elsewhere in the application (aka cross function goto statement).

And if you code C# then you know, when you raise an exception, the OS literally drops everything its doing within the program space, and starts the exception handling procedure. I'm unsure, but I think ALL threads are halted when this is called. If you do this to set up threads once then noone would really notice this. But the logs show that this is being spammed, the framerate indicates this is being done almost every frame. The wineserver that is responsible for simulating the windows OS under Linux chokes to death on these calls because nobody figured someone would be dumb enough to implement something this way.

[Toxi]

I was skeptical that go to could do all that much to our computers, but now that you brought it up the bigger the exception obviously the worse the performance, like you said I thought that would be obvious that it's not a good idea to use that way as it's even in the name of the thing for us, exception handling.

Anyway, thanks explaining that. I have a bit of interest in these things to see why performance seems to drop in games, I'm sure the problem existed since a long time, but it's become more and more apparent to me these days.

[[reaVerNL@Rumble]ᚱᛖᚨᚠᛖᚱ]

We just ruled out the MS_VC_EXCEPTION being used by mistake. The game doesn't start when this exception is ignored by proton.

Has the game been cracked yet?

And capcom, you wouldn't be stupid enough to keep DRM in your game that prevents the majority of players that paid for the game from playing the game now would you?

[Kaldaien]

Originally posted by ᚱᛖᚨᚠᛖᚱ:

We just ruled out the MS_VC_EXCEPTION being used by mistake. The game doesn't start when this exception is ignored by proton.

Has the game been cracked yet?

And capcom, you wouldn't be stupid enough to keep DRM in your game that prevents the majority of players that paid for the game from playing the game now would you?

This is par for the course with anti-debug. What they are trying to do here is actually fux0r any traditional debugger that may be trying to insert breakpoints in the code and trace execution. Unfortunately, some of these anti-debug strategies are more invasive than others are.

I often get called a shill for Denuvo, but I have respect for the guys since they -- yes -- are using anti-debug, but -- no -- are not blindly applying techniques they read about in some malware researcher's whitepaper and calling that mission accomplished when they manage to confuse traditional debug tools. Denuvo actually looks at the performance impact their stuff has, your run of the mill non-purpose-built software to do anti-debug has no consideration given to performance deterioration.


This is Capcom's own custom rolled solution. I know this because I knocked heads with their first iteration on day one and back then I could see the actual debug symbols the exception handling nonsense wanted. If it were a solution inserted by Denuvo when the executable were packed, there would be no debug symbol names covering the code executing.

Capcom have never given sufficient thought to 1. what they are protecting and 2. what the measures they are employing appear to be (malware) to the security layer in modern versions of Windows. DO NOT roll your own anti-debug, don't even unleash this stuff on customers, it only makes your software worse in really esoteric users scenarios you did not test on :-\

[GamingWithSilvertail]

Originally posted by Kaldaien:

Originally posted by ᚱᛖᚨᚠᛖᚱ:

We just ruled out the MS_VC_EXCEPTION being used by mistake. The game doesn't start when this exception is ignored by proton.

Has the game been cracked yet?

And capcom, you wouldn't be stupid enough to keep DRM in your game that prevents the majority of players that paid for the game from playing the game now would you?

This is par for the course with anti-debug. What they are trying to do here is actually fux0r any traditional debugger that may be trying to insert breakpoints in the code and trace execution. Unfortunately, some of these anti-debug strategies are more invasive than others are.

I often get called a shill for Denuvo, but I have respect for the guys since they -- yes -- are using anti-debug, but -- no -- are not blindly applying techniques they read about in some malware researcher's whitepaper and calling that mission accomplished when they manage to confuse traditional debug tools. Denuvo actually looks at the performance impact their stuff has, your run of the mill non-purpose-built software to do anti-debug has no consideration given to performance deterioration.


This is Capcom's own custom rolled solution. I know this because I knocked heads with their first iteration on day one and back then I could see the actual debug symbols the exception handling nonsense wanted. If it were a solution inserted by Denuvo when the executable were packed, there would be no debug symbol names covering the code executing.

Capcom have never given sufficient thought to 1. what they are protecting and 2. what the measures they are employing appear to be (malware) to the security layer in modern versions of Windows. DO NOT roll your own anti-debug, don't even unleash this stuff on customers, it only makes your software worse in really esoteric users scenarios you did not test on :-\

Nice bump on an OS not officially supported by capcom... lol

[Kaldaien]

Happy to offer my assistance. The best way to ensure customers do not have unforeseen problems is to study execution on alternate implementations. There is wisdom worth its weight in unobtanium there.