This is the mail archive of the cygwin@cygwin.com mailing list for the Cygwin project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

RE: Jason! rebinding problems idea...


> > do they have INT's
> > (Import Name Tables?) that are fully valid (no auto-import tricks etc
> > etc)?
>
> I believe so, but how do I check for sure?  I perused the output of
> "objdump -p".  Should I have done something else?

with objdump -x ...

Standard import table are identified by two points.

1. FirstThunk is greater than the HintTable entry.
2. The message "The Import Address Table is identical" is printed.

The Import Tables (interpreted .idata section contents)
 vma:            Hint    Time      Forward  DLL       First
                 Table   Stamp     Chain    Name      Thunk
 00005000       00005040 00000000 00000000 00005148 00005074
                ^^^^^^^^                            ^^^^^^^^
        DLL Name: cygwin1.dll
        vma:  Hint/Ord Member-Name
        50a4      581  calloc
        50b0      632  cygwin_detach_dll
        50c4      634  cygwin_internal
        50d8      653  dll_dllcrt0
        50e8      722  free
        50f0      876  malloc
        50fc      925  printf
        5108     1006  realloc
        The Import Address Table is identical
        ^^^^^^^^^^^^^^^^^^^

DLL's with auto-imported data are itentificable be the following points:

1. There are more than one IMAGE_IMPORT_DESCRIPTOR (IID) entry for the same dll.
2. In the second and following IID FirstThunk is lower than the HintTable entry.
3. The current objdump release crashes on displaying dlls/apps with
auto-imported data.

 vma:            Hint    Time      Forward  DLL       First
                 Table   Stamp     Chain    Name      Thunk
 00004000       00004068 00000000 00000000 00004270 000040cc

        DLL Name: dll.dll
        vma:  Hint/Ord Member-Name
        4124        0  printfunc0000__1Av
        413c        1  printfunc0001__1Av
        4154        2  printfunc0002__1Av
        416c        3  printfunc0003__1Av
        4184        4  printfunc0004__1Av
        419c        5  var0000
        The Import Address Table is identical


 vma:            Hint    Time      Forward  DLL       First
                 Table   Stamp     Chain    Name      Thunk
 0000403c       000040c0 00000000 00000000 00004270 0000108d
                ^^^^^^^^^                           ^^^^^^^^
        DLL Name: dll.dll
        vma:  Hint/Ord Member-Name
        419c        5  var0000
segmentation fault(core dumped)

Ralf


BTW: If my auto-import relating objdump patch is once applied to the biniutils
cvs, the segfault will be fixed and the following message would be printed.

 vma:            Hint    Time      Forward  DLL       First
                 Table   Stamp     Chain    Name      Thunk
 0000403c       000040c0 00000000 00000000 00004270 0000108d
        DLL Name: dll.dll
        vma:  Hint/Ord Member-Name
        419c        5  var0000
	  The Import Address Table isn't identical (auto-import descriptor)

Ralf




--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]