search for: 0806d398

...ferent place under winedbg, although it crashes in the same winedbg place under gdb. I took a closer look at wine --winver nt40 --debugmsg +all. I found something interesting. If I search for queue_exception, I find that there is an exception raised before the LoadOEMCall, about 328klines in: 0806d398:Call kernel32.VirtualProtect(00459000,00000018,00000002,40616e74) ret=0075fd82 0806d398:trace:virtual:VirtualProtect 0x459000 00000018 00000002 0806d398:trace:virtual:VIRTUAL_SetProt 0x459000-0x459fff c-r-- View: 0x400000 - 0x765fff 28 0x400000 - 0x400fff c-r-- 0x401000 - 0x458fff c-...

...oad Bss Readable Writable 00456000 ; Alignment : 16 bytes by default 00456000 00456000 .shrink1 segment para public '' use32 00456000 assume cs:.shrink1 00456000 ;org 456000h In addition, the trace of the last call to VirtualProtect shows this: 0806d398:Call kernel32.VirtualProtect(00459000,00000018,00000002,40616e74) ret=0075fd82 0806d398:trace:virtual:VirtualProtect 0x459000 00000018 00000002 0806d398:trace:virtual:VIRTUAL_SetProt 0x459000-0x459fff c-r-- View: 0x400000 - 0x765fff 28 0x400000 - 0x400fff c-r-- 0x401000 - 0x458fff c-...

...ch access throwing an exception, until it hit the last exception at 0x757000, and then then program ran normally. Probably no coincidence, since the next writable segment starts at 0x759000. So apparently the program is designed to throw the exceptions. Just before the call to VirtualProtect: 0806d398:Call kernel32.SetUnhandledExceptionFilter(0075f447) ret=0075f0cb 0806d398:Ret kernel32.SetUnhandledExceptionFilter() retval=00000000 ret=0075f0cb This function is this: 0075F447 sub_75F447 proc near 0075F447 call sub_75F047 0075F44C xor eax, eax 0075F...

Oh, I think I see now. There was a call to VIRTUAL_SetProt, which protected memory mapped regions of memory, before the first exception: 0806d398:trace:virtual:VIRTUAL_SetProt 0x459000-0x459fff c-r-- View: 0x400000 - 0x765fff 28 0x400000 - 0x400fff c-r-- 0x401000 - 0x458fff c---- 0x459000 - 0x459fff c-r-- 0x45a000 - 0x758fff c---- 0x759000 - 0x765fff c-rw- And address 0x45f000 is inside of a c---- segment....