Discovery
We found this issue while investigating a Comet issue. It turned out to be a much deeper problem than initially thought – a regression introduced by GOG Galaxy by the change in permission access to GOG registry.
Together with Kevin04, we dug deep to find the underlying cause.
The Problem
The issue stems from the ghost_api wrapper that’s shipped with certain games. This wrapper performs a custom GOG Galaxy check by verifying the existence of the registry key:
HKLM\SOFTWARE\WOW6432Node\GOG.com\GalaxyClient
At the lower level, this key is opened with read and write access using the 0x2011f permission flag. However, write access is no longer permitted with the latest versions of Galaxy, causing the registry operation to fail.
This forced the community to discover a workaround: running the game as administrator (See relevant forum thread). While this works, it’s far from an ideal solution.
Investigation
To understand what was happening at the system level, we debugged the process using x64dbg. The debugger captured the exact point where the registry access was being attempted:
This screenshot shows the debugger halted at RegOpenKeyExW, the Windows API function responsible for opening registry keys. By analyzing the stack and parameters at this breakpoint, we could identify the exact permission flags being used and trace back to the root cause.
Affected Games
- Mafia: Definitive Edition (game mentioned in this issue)
- Mafia III: Definitive Edition
- Kane & Lynch 2: Dog Days - Complete Edition
- Just Cause 2 - Complete Edition
Solution
We shared the steps to workaround those issues with GOG. They quickly updated builds with patched binaries.