Re:AVG can sell your browsing and search history to advertisers
by Stratoscope on Sunday September 20, 2015 @10:00PM
(#10250001)
For the issue with McAfee interfering with file move calls, Unity was logging an error message that said something like "Cannot move file into cache." That was a good clue that a file move operation was failing.
So I ran the app under the amazing API Monitor [1] and enabled logging for MoveFileA(), MoveFileW(), MoveFileExA(), MoveFileExW(), and similar "move file" APIs. It showed a failure on a MoveFileExW() call with the address of the call.
We'd found that Unity 5 didn't have the same problem (but we weren't ready to migrate to Unity 5 yet), so I also ran a Unity 5 test app under API Monitor and found the same failure on MoveFileExW(), along with several retries on the call until it succeeded. This told me just what I needed to patch the call for the Unity 4 app.
For the issue with AVG and wyUpdate, since wyUpdate is open source I just ran it under the debugger, and as luck would have it, the failing mutex.WaitOne() call was near the beginning of Program::Main() in the C# code [2].
(I mentioned WinMain() and CreateMutex() previously - I was writing that from memory and double-checked it now.)
So I ran the app under the amazing API Monitor [1] and enabled logging for MoveFileA(), MoveFileW(), MoveFileExA(), MoveFileExW(), and similar "move file" APIs. It showed a failure on a MoveFileExW() call with the address of the call.
We'd found that Unity 5 didn't have the same problem (but we weren't ready to migrate to Unity 5 yet), so I also ran a Unity 5 test app under API Monitor and found the same failure on MoveFileExW(), along with several retries on the call until it succeeded. This told me just what I needed to patch the call for the Unity 4 app.
For the issue with AVG and wyUpdate, since wyUpdate is open source I just ran it under the debugger, and as luck would have it, the failing mutex.WaitOne() call was near the beginning of Program::Main() in the C# code [2].
(I mentioned WinMain() and CreateMutex() previously - I was writing that from memory and double-checked it now.)
[1] http://www.rohitab.com/apimonitor
[2] https://github.com/geary/wyupdate/blob/master/Program.cs#L40