DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 7E6673858D38
Subject: Re: [PATCH 8/8] Cygwin: Consider DLL rebasing when computing dumper
 exclusions
To: The Cygwin Mailing List <cygwin@cygwin.com>
References: <20200701212529.13998-1-jon.turney@dronecode.org.uk>
 <20200701212529.13998-9-jon.turney@dronecode.org.uk>
 <20200702074317.GM3499@calimero.vinschen.de>
 <20200702074857.GP3499@calimero.vinschen.de>
 <9b0e3ddf-2fdd-990a-00f4-22939e21fa2b@dronecode.org.uk>
 <20200703193436.GC3499@calimero.vinschen.de>
From: Jon Turney <jon.turney@dronecode.org.uk>
Message-ID: <562a2148-355d-8351-3451-b1549aa81062@dronecode.org.uk>
Date: Sun, 5 Jul 2020 17:43:04 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <20200703193436.GC3499@calimero.vinschen.de>
Content-Language: en-GB
Precedence: list
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: cygwin-bounces@cygwin.com
Sender: "Cygwin" <cygwin-bounces@cygwin.com>

On 03/07/2020 20:34, Corinna Vinschen wrote:
>>
>> The problem is in the opposite direction.
>>
>> We have the actual base address the DLL was loaded at in the process being
>> dumped, and it's filename, from the LOAD_DLL_DEBUG_EVENT event.
>>
>> (To my amazement) we then read that DLL using bfd, and examine it for
>> sections with the 'CODE' or 'DEBUGGING' flags, the address ranges
>> corresponding to which we believe we want to exclude from the dump.
>>
>> Unfortunately, these addresses are based on the ImageBase in the PE header.
>>
>> If that's different to the actual base address the PE was loaded at, we need
>> to adjust these addresses appropriately.  But libbfd doesn't appear to
>> provide a public interface to get at the ImageBase.
> 
> Ok, but you have the filename, so you can map the file and read it's
> header and thus imagebase.  Still not nice, sure... but it would work
> without guessing, I guess? :)

So, I misread this as "look in the header that's already mapped by the 
Windows loader", but it seems that the ImageBase in that has been 
modified to the actual load address (not that there are any guarantee 
about it even existing).

I'm really struggling to see all this complexity as actually needed, 
though. See follow up patches which just remove it all.
--
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple