iDate ReVibe - Xtrap int 2Eh crash in WoW64 after game update
Issue transferred from https://github.com/ValveSoftware/Proton/issues/9862.
@gmpakpak12 posted on 2026-06-07T15:49:22:
Compatibility Report
System
Description
The game worked on Proton before a recent client update. The update changed Xtrap/Aegis AC's injected shellcode — it now issues raw int 2Eh (CD 2E) syscalls from a 32-bit RWX page instead of using the standard ntdll WoW64 transition. Under WoW64, int 2Eh is a privileged instruction → #GP → SIGSEGV → EXCEPTION_ACCESS_VIOLATION → crash.
Log excerpt
05b4:warn:seh:dispatch_exception: --- Exception 0xc0000005 addr=008D0007 EAX=008D0000 EDX=00000008 ECX=E9000001 CS=0023
EDX=8 (syscall number), ECX=E9000001 (argument), CS=0023 (32-bit compat). The shellcode base varies (008D0000, 00260000) but the pattern is identical.
Additional info
The same shellcode also crashes on native Windows during server switches and session state changes (lock, UAC), confirming it's a buggy AC update that WoW64 exposes 100% of the time.
Attached: proton_log_crash_chain.txt (crash trace including the int 2Eh dispatch)
@gmpakpak12 commented on 2026-06-07T15:51:39:
@gmpakpak12 commented on 2026-06-07T15:52:58:
Confirmed on all WoW64 Proton builds tested:
Non-WoW64 builds (GE-Proton) bypass this but hit a separate winegstreamer stub crash instead.
The consistent register signature across all builds: EIP at RWX page +7, EAX=base, EDX=8, ECX=E9000001, CS=0023.
I'm still getting the same issue for Linux especially the 2Eh crash on WoW64. I hope Wine or proton can bridge this gap in the future
ge-proton10-34x2 2026-06proton experimentalx2 2026-06ir50_32.dllx1 2026-06iyuv32.dllx1 2026-06winegstreamer.dllx1 2026-060xc0000005x1 2026-060x80000100x1 2026-06
winegstreamer_crash_log.txt
Compatibility Report
System Information
Description
The function
winegstreamer.dll.winegstreamer_create_color_converteris declared in the PE DLL but has no implementation in the Unix .so side in any Wine/Proton build. When called, it raises EXCEPTION_WINE_STUB (0x80000100) instead of returning an error code.This blocks 32-bit games that use the winmm -> msvfw32 -> devenum -> dxdiagn chain for video format/color space conversion setup.
Symptoms
EXCEPTION_WINE_STUB crash during game startup with call stack:
ntdll stub at 7BE490A0 (winegstreamer_create_color_converter)
-> shellcode -> winmm -> msvfw32 -> devenum -> dxdiagn -> crashfind -> game.exe
Registers at crash
EIP = 7BE490A0, ESP = 008CD288, EBP = 008CD2E0
EAX = 7899B366 (iyuv32.dll text), ECX = 78991611, EDX = 7899B440
CS = 0023
Reproduction
Note: This is currently unreachable on upstream Proton-Experimental WoW64 because a separate WoW64 int 2Eh anti-cheat bug (WineHQ Bug 59834) blocks earlier. It is directly reachable on GE-Proton10-34 (non-WoW64) where that WoW64 bug is avoided. The underlying missing stub is the same in both builds.
Expected behavior
winegstreamer_create_color_converter should either be implemented or return a meaningful error code (e.g. E_FAIL or S_FALSE) instead of raising EXCEPTION_WINE_STUB.