X-Recipient:	archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status:	No, hits=-2.5 required=5.0 tests=AWL,BAYES_00,SPF_PASS
X-Spam-Check-By:	sourceware.org
Message-ID:	<4A9521B7.2030806@gmail.com>
Date:	Wed, 26 Aug 2009 12:51:19 +0100
From:	Dave Korn <dave DOT korn DOT cygwin AT googlemail DOT com>
User-Agent:	Thunderbird 2.0.0.17 (Windows/20080914)
MIME-Version:	1.0
To:	cygwin AT cygwin DOT com
Subject:	Re: BitDefender again
References:	<h71ugb$aav$1 AT ger DOT gmane DOT org> <20090826013626 DOT GC9672 AT ednor DOT casa DOT cgf DOT cx>
In-Reply-To:	<20090826013626.GC9672@ednor.casa.cgf.cx>
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com

Christopher Faylor wrote:
> On Tue, Aug 25, 2009 at 08:09:52PM -0400, Michael Kairys wrote:
>> BitDefender AntiVirus 2009 and Cygwin got along fine, but when I upgraded to 
>> 2010 all my Cygwin-based apps started crashing. If I turn off their "Active 
>> Virus Control" the problem goes away.
>>
>> They offer this advice:
>>
>> =====================================
>> There is an incompatibility between cygwin and BitDefender AVC (Behavioral 
>> Scanner).
>>
>> I'm going to get a little bit technical here in order to explain in detail 
>> what is happening :
>>
>> Unfortunately, cygwin1.dll has a hardcoded image loading base (0x61000000) 
>> wich conflicts with one of the BitDefender AVC plugins injected into 
>> processes for monitoring their behaviour.
> 
> This sounds fishy to me.  Cygwin does prefer to load at 0x61000000 but,
> to the best of my knowledge, there is only one thing in Cygwin that
> really cares about this and it is not crucial to the operation of the
> DLL.

  Also, the suggestion to use a base address in the 0x35000000 area (or indeed
any of the others they mentioned) is going to horribly frag your heap and bork
your maximum allocatable memory limit, isn't it?

  Wonder if it wouldn't work just as well to rebase /their/ DLL?

    cheers,
      DaveK


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -