Dolphin dev builds past 5.0 3977 crash on startup with my controller plugged in

[shuffle2]

does the

Code:

setdllcharacteristics

method fix it? Dolphin could apply this workaround to itself if needed...

---

Forscythe: Also, can you tell me which exact adapter you're using? (link to mayflash's site, please).

[shuffle2]

(06-09-2017, 08:28 AM)Morku Wrote: So, whats your advise?
I also have the USB Vibration folder which the Mayflash driver created (regarding to my thread https://forums.dolphin-emu.org/Thread-mayflash-gc-controller-adapter-for-pc-makes-dolphin-crash ):


Whats the fault? Deleting/Renaming the USB Vibration folder fixes the crash for me, but without it, I don't have Rumble. Rumble is part of the GC/Wii gameplay and I don't want miss it.
People recommended the Mayflash adapter here.
Anyway the driver works fine and Build 5.0-3977 and below also do. So I can't imagine it's drivers fault.

Sorry Morku, I didn't realize you had a similar issue (but your adapter/driver is different than Forscythe)...

In any case, the W013 installer actually packages some more recent versions of the binaries:

Code:

Image path: C:\Windows\USB_Vibration\791847\EZFRD64.dll
    Image name: EZFRD64.dll
    Timestamp:        Sun Apr 12 17:50:34 2015 (552B12DA)
    CheckSum:         000290BF

I've attached the files so you don't have to get them yourself. Please try overwriting your existing files with these (might want to back them up first), and seeing if you still get the crash.

After looking closer, it appears they customize the DLL to the expected USB VID/PID, unfortunately, so one can't just copy over the old files. So, removing the attachment for now...

[shuffle2]

Some simple info across different versions:

Code:

EZFRD infos:

ProductId   Directory   Date        VID/PID
PC051       1A34F705    5/17/2013   0x1A34/0xF705
W012        791843      3/23/2015   0x0079/0x1843
W012        791844      4/13/2015   0x0079/0x1844
W013        791847      4/13/2015   0x0079/0x1847

So as you can see, the directory under c:\Windows\USB_Vibration is just the VID/PID.
I still haven't found the installer with 811EZFRD64.dll in it (which is the only one I know the crashing location for), so I haven't looked into the actual crash yet.

Forscythe: It would help to know what device you're using, and where the driver download is.

Morku: It would help to know where yours is crashing.

[shuffle2]

OK I finally found 811EZFRD64.dll (and matching version) here: http://www.driverguide.com/driver/detail.php?driverid=1865150&action=filfo
How do people even find shady websites like this and decide to install software from it?!?! "Other Companies Universal Wired Controller Free Driver Download" just sounds soooo legit. Is this even a mayflash device?

In any case, this file is for VID/PID 0x0810/0x0001. (Try a quick search for that and see how many people have problems...)

For reference, it seems the code is basically doing the same as https://github.com/arielscarpinelli/ntpad/blob/master/forcefeedback-support-dll/CForceFeedbackImpl.cpp

Now, back to the crash:
Looking at the exception context, we can see the problem is rcx:

Code:

0:005> .ecxr
rax=0000000000000000 rbx=00007ff8f6ef4bc0 rcx=0000000049d40080
rdx=0000000000000000 rsi=0000000000000010 rdi=0000000010001af0
rip=0000000010003654 rsp=000000c449f3fbc0 rbp=0000000049d40080
r8=000000c449f3fad8  r9=0000000049d40080 r10=0000000000000000
r11=0000000000000287 r12=000000007ffe000c r13=000000007ffe0008
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
811EZFRD64+0x3654:
00000000`10003654 837c011000      cmp     dword ptr [rcx+rax+10h],0 ds:00000000`49d40090=????????

Looking at the crashing code:

Code:

__int64 __fastcall sub_10003600(void *a1)
{
...
  for ( i = 0; i < 0x10; ++i )
  {
    if ( *((_DWORD *)a1 + 1226 * i + 4) )                       <--- CRASH IS HERE
    {

Looking at how this is reached:

Code:

// sub_10002110 is in some vtable+0x18. |this| is a 0x13388-byte object.
signed __int64 __fastcall sub_10002110(DWORD_PTR a1, unsigned int a2, unsigned int a3)
{
...
    *(_DWORD *)(a1 + 0x13380) = timeSetEvent(25u, 100u, (LPTIMECALLBACK)fptc, (unsigned int)a1, 1u);

void __fastcall fptc(UINT uTimerID, UINT uMsg, DWORD_PTR dwUser, DWORD_PTR dw1)
{
  sub_10003600((void *)(unsigned int)dwUser);
}

I began to suspect the issue was just that rcx is truncated from 64 to 32bits.
In fact this seems to be the case:

Code:

...
+ c4`49c4f8f8       c4`49c50000        0`00000708     Stack      [~4; 1f80.1634]
+ c4`49c50000       c4`49e40000        0`001f0000     <unknown>                    <-- object allocated into here
+ c4`49e40000       c4`49f3e398        0`000fe398     Stack      [~5; 1f80.1d00]
...

(It's <unknown> just because the dump doesn't have full info; it's the heap).

Soooo this is technically not ASLR related at all. In fact this code was just never really 64bit compatible. The ASLR change just happened to expose it. This is purely the EZFRD64's fault. timeSetEvent is documented to take dwUser param as DWORD_PTR type, which is 8bytes on 64bit. So they are doing some improper casting here which causes this.

[Morku]

Oh, I didn't expect you'll have a deeper look, when it is drivers fault.
Here is my crashdump: https://www.dropbox.com/s/09riknp2zkibs2y/Dolphin.exe.2512.dmp?dl=1

I don't know if I am doing correctly with setdllcharacteristics, I am getting this?:


I don't know if Forscythe drivers are also Mayflash related, because he said, he is using a Dualshock 1.

Honestly, I already ordered an original Nintendo WiiU Gamecube adapter, hopefully with a longer lifetime of support, because it's official accessories.
I am upset with Mayflash and apparently bad drivers. They never got updated. First the Dolphinbar which has no Bluetooth Passthrough and they are not willing at least to update firmware(v1) to make LEDs on when no controller is connected. Now the Gamecube Adapter... This all will go to trash and hopefully will burn heavily.
I am really tired of adapters which stops working and need to buy new every 2-3 years.

[shuffle2]

Thanks for the dump Morku! I've confirmed it has the same root cause as the other one.
I'll try to find if there's a way dolphin can patch the binary on the fly to workaround the problem.

[Forscythe]

Yeah, I was using an old PS2 to PC adapter for my Dualshock 1. It's not a Mayflash certified brand though and the vibration drivers I had gotten from NGEmu some years back that were for a more popular version of the adapter. It looks like you've already nailed down the issue though, as I can see the device HID/VID matches mine.

This is it btw: https://www.amazon.com/PlayStation-Controller-Converter-DualShock-Controllers-3/dp/B0096PSFBG/ref=cm_cr_arp_d_bdcrb_top?ie=UTF8

If it helps, the ones I have are signed by Shen Zhen Dragon Rise Macro Technology Limited Company.

[shuffle2]

Morku and Forscythe: could you please try this build (try to use vibration with the problematic pads): https://dl.dolphin-emu.org/prs/pr-5582-dolphin-latest-x64.7z

If it still doesn't work, please paste the output of the dolphin log:
Check View->Show Log and View->Show Log Configuation.
In Log Configuration, make sure "Write to Window" is checked, and under "Log Types", "Dolphin Console" is checked.

This build should fix the problem as long as the crash was occurring *after* you start a game.
If the crash happens as soon as you open dolphin, then I'll have to tweak it a little bit.

[Morku]

Still crash for me right after opening Dolphin.
https://www.dropbox.com/s/kxhtrvnm6mmg1u2/Dolphin.exe.8284.dmp?dl=1

I checked the log boxes as you described (when the adapter was unpluged), but I can't find the log. Where I can find? "D:\Documents\Dolphin Emulator\Logs" dolphin.log is empty.

[shuffle2]

It will write to a file in that directory if you have the "write to file" option checked. otherwise it writes to the log window (it's probably a different tab in your dolphin UI).

Can you please re-download the file and test again with that? I've updated it.