Investigating a crash at startup

Filip Navara navaraf at
Sat Jun 12 07:12:04 CDT 2004


In ReactOS we are unprotecting the IAT (Import Address Table) before 
every modification and restoring the previous access rights after all 
the modifications are done using NtProtectVirtualMemory. I'll try to 
write a patch for Wine tommorow if no one will do it earlier, but I 
can't test it...


Phil Krylov wrote:

>I have a program here (IBM Translation Manager v.6.0.4) which crashes
>wine at startup. The program loads a DLL, and Wine starts importing
>this DLL's imports from kernel32.dll. It crashes on the first import
>in dlls/ntdll/loader.c:453, which says:
>thunk_list->u1.Function = (PDWORD)find_named_export( imp_mod, exports, exp_size,
>                                                     pe_name->Name, pe_name->Hint );
>This causes an exception because thunk_list happens to be located in
>.rdata section of the DLL, which is readonly.
>Currently I have hacked this around by making all PE sections
>read-write in map_image() in dlls/ntdll/virtual.c, and the program
>If a Wine guru would like to investigate this problem, I can give any
>support (e.g., ssh access to my computer with the program).
>If not - I will be using this hacked version of Wine.

More information about the wine-devel mailing list