Re: [PATCH v2] Fix WOW64 process system DLL paths

[Hannes Domani <ssbssa@yahoo.de>]

 Am Mittwoch, 25. März 2020, 00:56:09 MEZ hat Jon Turney <jon.turney@dronecode.org.uk> Folgendes geschrieben:

> On 24/03/2020 19:23, Hannes Domani via Gdb-patches wrote:
>
> > GetModuleFileNameEx returns for some DLLs of WOW64 processes
> > the path inside the 64bit system directory instead of the 32bit
> > syswow64 directory.
> >
> > Problem happens e.g. with dbghelp.dll:
> >
> > (gdb) start
> > Temporary breakpoint 1 at 0x415a00: file fiber.cpp, line 430.
> > Starting program: C:\src\tests\fiber.exe
> > warning: `C:\Windows\system32\dbghelp.dll': Shared library architecture i386:x86-64 is not compatible with target architecture i386.
> >
> > Temporary breakpoint 1, main () at fiber.cpp:430
> > 430    {
> > (gdb) info sharedlibrary
> >  From        To          Syms Read  Shared Object Library
> > 0x77070000  0x771d4d20  Yes (*)    C:\Windows\SysWOW64\ntdll.dll
> > 0x74dc0000  0x74ebad9c  Yes (*)    C:\Windows\syswow64\kernel32.dll
> > 0x75341000  0x75386a18  Yes (*)    C:\Windows\syswow64\KernelBase.dll
> > 0x6f6a1000  0x6f7c48fc  Yes (*)    C:\Windows\system32\dbghelp.dll
> > 0x74d01000  0x74dab2c4  Yes (*)    C:\Windows\syswow64\msvcrt.dll
> > (*): Shared library is missing debugging information.
> >
> > This detects this situation and converts the DLL path to the
> > syswow64 equivalent.
> >
> [...]
> >  #else
> >        name = dll_name;
> >  #endif
> > +#ifdef __x86_64__
> > +      /* Convert the DLL path of WOW64 processes returned by
> > +    GetModuleFileNameEx from the 64bit system directory to the
> > +    32bit syswow64 directory if necessary.  */
> > +      std::string syswow_dll_path;
> > +      if (wow64_process
> > +      && strncasecmp (name, system_dir, system_dir_len) == 0
> > +      && strchr (name + system_dir_len, '\\') == nullptr)
> > +    {
> > +      syswow_dll_path = syswow_dir;
> > +      syswow_dll_path += name + system_dir_len;
> > +      name = syswow_dll_path.c_str();
> > +    }
> > +#endif
>
> >
>
> DLLs we become aware of via handle_load_dll() don't get this treatment.
>
> Can you share your reasoning about that?

Because I get these wrong paths only with GetModuleFileNameEx, and
LOAD_DLL_DEBUG_EVENT reports for the same dlls the correct path.