On Feb 9 14:50, Heiko Elger wrote:
> Corinna Vinschen writes:
>
> > So with the latest snapshot we can at least see which DLL is affected
> > by this problem. Then we can check where this DLL is really supposed to
> > be in memory (objdump -h) and then we can check what really is at this
> > location in the process VM (/proc/$PID/maps)
> [...]
> Using SEP there is a service running called sysplant ("Application and Device
> Control", system32\Drivers\SysPlant.sys).
> Disabling this service on cmd line (cmd.exe)
> sc config sysplant start= disabled
> rebooting all seems to work fine!
>
> I will contact Symantec for more details about this service.
>
> The output of objdump -h is the following:
> $ objdump -h cygperl5_10.dll
>
> cygperl5_10.dll: file format pei-i386
>
> Sections:
> Idx Name Size VMA LMA File off Algn
> 0 .text 001386fc 57011000 57011000 00000400 2**4
> CONTENTS, ALLOC, LOAD, READONLY, CODE, DATA
> 1 .data 0001f1e4 5714a000 5714a000 00138c00 2**5
> CONTENTS, ALLOC, LOAD, DATA
> 2 .rdata 00000780 5716a000 5716a000 00157e00 2**2
> CONTENTS, ALLOC, LOAD, READONLY, DATA
> 3 .eh_frame 00000004 5716b000 5716b000 00158600 2**2
> CONTENTS, ALLOC, LOAD, DATA
> 4 .bss 00000610 5716c000 5716c000 00000000 2**5
> ALLOC
> 5 .edata 0000dcd0 5716d000 5716d000 00158800 2**2
> CONTENTS, ALLOC, LOAD, READONLY, DATA
> 6 .idata 00001a08 5717b000 5717b000 00166600 2**2
> CONTENTS, ALLOC, LOAD, DATA
> 7 .reloc 00008818 5717d000 5717d000 00168200 2**2
> CONTENTS, ALLOC, LOAD, READONLY, DATA
> 8 .gnu_debuglink 00000014 57186000 57186000 00170c00 2**2
> CONTENTS, READONLY
>
> What is the recommended address layout?
> Should DATA be mapped to 0x5714a000 and BSS to 0x5716c000?
DLLs (and FWIW all binary images) are mapped as one piece into the VM of
the process. From the above you can see that the start address of the
DLL is supposed to be 57010000 (== VMA(.text) - 4K) Since the image is
mapped in a single piece, the address you see in the object header are
real VM addresses. Unless, of course, the DLL is rebased on the fly
by the Windows loader. But that only means the *entire* DLL is rebased,
so the relative offsets of the segments from the load address are the
same as they are in the file header.
Corinna
--
Corinna Vinschen Please, send mails regarding Cygwin to
Cygwin Project Co-Leader cygwin AT cygwin DOT com
Red Hat
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
