DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=BfEXkF6Y7gLXj/FU3Uiag+ouZeJ5csbJ0ExIM7U2DrwVlE96jR2qT
	KUcAuI7BRN7+CcgPyvHMM6u6ZbDBJzYHGoSyd28FouRXEJ8a1RdNjPsAaesFHcrH
	5wt3VLNVNDIZThJPJENkucy1RmtvvXd4LcXDEe0/kXk23ry3QjwXhs=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Date: Tue, 12 Jan 2016 17:15:48 +0100
From: Corinna Vinschen <corinna-cygwin@cygwin.com>
To: cygwin@cygwin.com
Subject: Re: gdb 7.8 consistently fails to run executable - error is
Message-ID: <20160112161548.GI15034@calimero.vinschen.de>
Reply-To: cygwin@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
References: <1408580171694-110722.post@n5.nabble.com> <loom.20140821T100019-590@post.gmane.org> <1408732343936-110800.post@n5.nabble.com> <5423F775.7030208@onespin-solutions.com> <54294CED.9050602@onespin-solutions.com> <20141008121224.GB29235@calimero.vinschen.de> <5435302A.6030800@onespin-solutions.com> <1448289893881-122909.post@n5.nabble.com> <CA+GYywDiPUTZ=9+YJb5vgFWvQ+gEebkqf+86Mtv0qq3ArrJPzQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;	protocol="application/pgp-signature"; boundary="w3uUfsyyY1Pqa/ej"
Content-Disposition: inline
In-Reply-To: <CA+GYywDiPUTZ=9+YJb5vgFWvQ+gEebkqf+86Mtv0qq3ArrJPzQ@mail.gmail.com>
User-Agent: Mutt/1.5.24 (2015-08-30)

--w3uUfsyyY1Pqa/ej
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Jan 12 13:34, Vanda Vodkamilkevich wrote:
> Hi,
>=20
> I'm reacting to this email with a long delay but I just wanted to let you
> know that this change saved my life, now I am finally able to debug again
> with cygwin (w7 64bits , 32 bits cygwin) because I was blocked by a nasty
> "security" dll (part of Arkoon Security). A big thank you...
>=20
> Additionally I had another problem in gdb which is detecting kernel64.dll
> instead of kernel32.dll : am I the only one still using Cygwin 32 on
> Windows 64? Does this rings a bell for anyone?
>=20
> I had to add another (uggly) patch above Tim's work, see below :
>=20
> diff -ru origsrc/gdb-7.8/gdb/windows-nat.c src/gdb-7.8/gdb/windows-nat.c
> --- origsrc/gdb-7.8/gdb/windows-nat.c   2015-06-23 17:44:40.862022600 +02=
00
> +++ src/gdb-7.8/gdb/windows-nat.c       2015-11-25 13:28:46.893554500 +01=
00
> @@ -648,6 +648,14 @@
>    buf[0] =3D 0;
>    if (access (name, F_OK) !=3D 0)
>      {
> +      char *found=3Dstrstr(name,"kernel64.dll");

This is very suspicious.  There's no such DLL on Windows, neither for
64 bit nor for 32 bit, nor for 32 bit under WOW64, but there's an old
exploit known to rename qmgr.dll to kernel64.dll (CVE-2010-1297).=20=20


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--w3uUfsyyY1Pqa/ej
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJWlSa0AAoJEPU2Bp2uRE+ghWMP/RdLzFe1MucjfFIqdfoiGxib
OdJYp7LC3vf/KwPQ3AakLocZxCyOcRcVzJ/Tuns68H/0ZxC6wP4s8c+K0cTd0GET
dY9dJMidthYR5i8wrKHKQCqApCRbmohlMIgiGBWmU1rNeQUiVL6k7Y2eI4stBRvU
G3lKy3jdlodvVyTiZXDHVVoGGgi4Hshr6I6fLL2YUvkRNhrvxG97Gc1ippT5oMx2
TgTH4nTuc3UYxxxhmhR+CdJHPBgaBfwKSedSgOL602p+LGunk7LWakWbA/TsgqBt
sr4peWVkNT6JZsjBwjqo3OLfrDkJSwQ/APOyjFfDvz4ssigzSh1xFl/aY6sbALmN
9GJ96qd1Zp2v6eMZHUmElHUXnorUYRmGE5tBbJc+bGFODl6vzJTOFW0R7O7KX7Wp
jQjfqmA49DzgWJQuEIrC9VAYsp+ZYLwW6loCDSOK3T3Mpk0ghfE986m4LFjylLF/
5Y0MRq9aqnwF3OW4G7hd9YOjDyoXbxWprdrSiQKtP1aJ5UvZiROgtgJ/P8uXechZ
t6CD5NzIJJc+JFdO14VfkTV+hx2iXOuhhPVqxt0QeGbe77FHvQ7DSgR5fF0WJbgh
iQBO8DvZePl4An2b7C9qytRp+buZ6QDfsNa9qLxw1B80Lb0WvgU1lpGZWV8shVmO
lQNUIo9+swNubI+BG4Mt
=H2Uh
-----END PGP SIGNATURE-----

--w3uUfsyyY1Pqa/ej--