X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=BfEXkF6Y7gLXj/FU3Uiag+ouZeJ5csbJ0ExIM7U2DrwVlE96jR2qT
	KUcAuI7BRN7+CcgPyvHMM6u6ZbDBJzYHGoSyd28FouRXEJ8a1RdNjPsAaesFHcrH
	5wt3VLNVNDIZThJPJENkucy1RmtvvXd4LcXDEe0/kXk23ry3QjwXhs=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; s=default;
	 bh=by4kxIrW25zGxP7HZt2YRD0fIQ0=; b=EH9RfyAZzgQh7VDgpgFRw6+AhsiK
	41GKn+M4XRHD7jwq/ofbPd70H+LFMARTf4b2EhEyyk/ufFUjsm3TSc38R1o9wsaG
	D/nWNNP/UBAH62gKWhvZlTZ+atwqzqEVaGtDBIGeiYk2walufBEXduOoKfaMKkHt
	08LO5fXB0GEtTB0=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-92.6 required=5.0 tests=AWL,BAYES_50,KAM_LAZY_DOMAIN_SECURITY,KHOP_DYNAMIC,RCVD_IN_BRBL_LASTEXT,RCVD_IN_PBL,RDNS_DYNAMIC,USER_IN_WHITELIST autolearn=no version=3.3.2 spammy=bell, rings, 78, nasty
X-HELO: calimero.vinschen.de
Date: Tue, 12 Jan 2016 17:15:48 +0100
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: gdb 7.8 consistently fails to run executable - error is
Message-ID: <20160112161548.GI15034@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <1408580171694-110722 DOT post AT n5 DOT nabble DOT com> <loom DOT 20140821T100019-590 AT post DOT gmane DOT org> <1408732343936-110800 DOT post AT n5 DOT nabble DOT com> <5423F775 DOT 7030208 AT onespin-solutions DOT com> <54294CED DOT 9050602 AT onespin-solutions DOT com> <20141008121224 DOT GB29235 AT calimero DOT vinschen DOT de> <5435302A DOT 6030800 AT onespin-solutions DOT com> <1448289893881-122909 DOT post AT n5 DOT nabble DOT com> <CA+GYywDiPUTZ=9+YJb5vgFWvQ+gEebkqf+86Mtv0qq3ArrJPzQ AT mail DOT gmail DOT com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;	protocol="application/pgp-signature"; boundary="w3uUfsyyY1Pqa/ej"
Content-Disposition: inline
In-Reply-To: <CA+GYywDiPUTZ=9+YJb5vgFWvQ+gEebkqf+86Mtv0qq3ArrJPzQ@mail.gmail.com>
User-Agent: Mutt/1.5.24 (2015-08-30)

--w3uUfsyyY1Pqa/ej
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Jan 12 13:34, Vanda Vodkamilkevich wrote:
> Hi,
>=20
> I'm reacting to this email with a long delay but I just wanted to let you
> know that this change saved my life, now I am finally able to debug again
> with cygwin (w7 64bits , 32 bits cygwin) because I was blocked by a nasty
> "security" dll (part of Arkoon Security). A big thank you...
>=20
> Additionally I had another problem in gdb which is detecting kernel64.dll
> instead of kernel32.dll : am I the only one still using Cygwin 32 on
> Windows 64? Does this rings a bell for anyone?
>=20
> I had to add another (uggly) patch above Tim's work, see below :
>=20
> diff -ru origsrc/gdb-7.8/gdb/windows-nat.c src/gdb-7.8/gdb/windows-nat.c
> --- origsrc/gdb-7.8/gdb/windows-nat.c   2015-06-23 17:44:40.862022600 +02=
00
> +++ src/gdb-7.8/gdb/windows-nat.c       2015-11-25 13:28:46.893554500 +01=
00
> @@ -648,6 +648,14 @@
>    buf[0] =3D 0;
>    if (access (name, F_OK) !=3D 0)
>      {
> +      char *found=3Dstrstr(name,"kernel64.dll");

This is very suspicious.  There's no such DLL on Windows, neither for
64 bit nor for 32 bit, nor for 32 bit under WOW64, but there's an old
exploit known to rename qmgr.dll to kernel64.dll (CVE-2010-1297).=20=20


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--w3uUfsyyY1Pqa/ej
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJWlSa0AAoJEPU2Bp2uRE+ghWMP/RdLzFe1MucjfFIqdfoiGxib
OdJYp7LC3vf/KwPQ3AakLocZxCyOcRcVzJ/Tuns68H/0ZxC6wP4s8c+K0cTd0GET
dY9dJMidthYR5i8wrKHKQCqApCRbmohlMIgiGBWmU1rNeQUiVL6k7Y2eI4stBRvU
G3lKy3jdlodvVyTiZXDHVVoGGgi4Hshr6I6fLL2YUvkRNhrvxG97Gc1ippT5oMx2
TgTH4nTuc3UYxxxhmhR+CdJHPBgaBfwKSedSgOL602p+LGunk7LWakWbA/TsgqBt
sr4peWVkNT6JZsjBwjqo3OLfrDkJSwQ/APOyjFfDvz4ssigzSh1xFl/aY6sbALmN
9GJ96qd1Zp2v6eMZHUmElHUXnorUYRmGE5tBbJc+bGFODl6vzJTOFW0R7O7KX7Wp
jQjfqmA49DzgWJQuEIrC9VAYsp+ZYLwW6loCDSOK3T3Mpk0ghfE986m4LFjylLF/
5Y0MRq9aqnwF3OW4G7hd9YOjDyoXbxWprdrSiQKtP1aJ5UvZiROgtgJ/P8uXechZ
t6CD5NzIJJc+JFdO14VfkTV+hx2iXOuhhPVqxt0QeGbe77FHvQ7DSgR5fF0WJbgh
iQBO8DvZePl4An2b7C9qytRp+buZ6QDfsNa9qLxw1B80Lb0WvgU1lpGZWV8shVmO
lQNUIo9+swNubI+BG4Mt
=H2Uh
-----END PGP SIGNATURE-----

--w3uUfsyyY1Pqa/ej--