delorie.com/archives/browse.cgi | search |
Mailing-List: | contact cygwin-help AT cygwin DOT com; run by ezmlm |
List-Subscribe: | <mailto:cygwin-subscribe AT cygwin DOT com> |
List-Archive: | <http://sources.redhat.com/ml/cygwin/> |
List-Post: | <mailto:cygwin AT cygwin DOT com> |
List-Help: | <mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs> |
Sender: | cygwin-owner AT cygwin DOT com |
Mail-Followup-To: | cygwin AT cygwin DOT com |
Delivered-To: | mailing list cygwin AT cygwin DOT com |
From: | "Ralf Habacker" <Ralf DOT Habacker AT freenet DOT de> |
To: | "cygwin" <cygwin AT cygwin DOT com> |
Subject: | RE: Jason! rebinding problems idea... |
Date: | Tue, 30 Apr 2002 08:10:50 +0200 |
Message-ID: | <000901c1f00d$c69e0390$651c440a@BRAMSCHE> |
MIME-Version: | 1.0 |
X-Priority: | 3 (Normal) |
X-MSMail-Priority: | Normal |
In-Reply-To: | <20020429145305.GE1152@tishler.net> |
X-MimeOLE: | Produced By Microsoft MimeOLE V5.50.4133.2400 |
Importance: | Normal |
> > do they have INT's > > (Import Name Tables?) that are fully valid (no auto-import tricks etc > > etc)? > > I believe so, but how do I check for sure? I perused the output of > "objdump -p". Should I have done something else? with objdump -x ... Standard import table are identified by two points. 1. FirstThunk is greater than the HintTable entry. 2. The message "The Import Address Table is identical" is printed. The Import Tables (interpreted .idata section contents) vma: Hint Time Forward DLL First Table Stamp Chain Name Thunk 00005000 00005040 00000000 00000000 00005148 00005074 ^^^^^^^^ ^^^^^^^^ DLL Name: cygwin1.dll vma: Hint/Ord Member-Name 50a4 581 calloc 50b0 632 cygwin_detach_dll 50c4 634 cygwin_internal 50d8 653 dll_dllcrt0 50e8 722 free 50f0 876 malloc 50fc 925 printf 5108 1006 realloc The Import Address Table is identical ^^^^^^^^^^^^^^^^^^^ DLL's with auto-imported data are itentificable be the following points: 1. There are more than one IMAGE_IMPORT_DESCRIPTOR (IID) entry for the same dll. 2. In the second and following IID FirstThunk is lower than the HintTable entry. 3. The current objdump release crashes on displaying dlls/apps with auto-imported data. vma: Hint Time Forward DLL First Table Stamp Chain Name Thunk 00004000 00004068 00000000 00000000 00004270 000040cc DLL Name: dll.dll vma: Hint/Ord Member-Name 4124 0 printfunc0000__1Av 413c 1 printfunc0001__1Av 4154 2 printfunc0002__1Av 416c 3 printfunc0003__1Av 4184 4 printfunc0004__1Av 419c 5 var0000 The Import Address Table is identical vma: Hint Time Forward DLL First Table Stamp Chain Name Thunk 0000403c 000040c0 00000000 00000000 00004270 0000108d ^^^^^^^^^ ^^^^^^^^ DLL Name: dll.dll vma: Hint/Ord Member-Name 419c 5 var0000 segmentation fault(core dumped) Ralf BTW: If my auto-import relating objdump patch is once applied to the biniutils cvs, the segfault will be fixed and the following message would be printed. vma: Hint Time Forward DLL First Table Stamp Chain Name Thunk 0000403c 000040c0 00000000 00000000 00004270 0000108d DLL Name: dll.dll vma: Hint/Ord Member-Name 419c 5 var0000 The Import Address Table isn't identical (auto-import descriptor) Ralf -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Bug reporting: http://cygwin.com/bugs.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
webmaster | delorie software privacy |
Copyright © 2019 by DJ Delorie | Updated Jul 2019 |