Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Delivered-To: mailing list cygwin@cygwin.com Message-ID: <42FD0E9F.5030508@club-internet.fr> Date: Fri, 12 Aug 2005 23:03:27 +0200 From: Louis Lecaroz User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206) MIME-Version: 1.0 To: Dave Korn Cc: cygwin@cygwin.com, Brian.Ford@flightsafety.com Subject: Re: "Segmentation fault" CygWin tools with code Injection-MS Detours References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-IsSubscribed: yes Hi all, Let me thx all the CygWin team ! I tested your modifications, & now I can hook native Win32 systems calls (like CreateFile you call indirectly by your libc fake methods) with the Microsoft Detours Toolkit) by using LD_PRELOAD, also in forkee ! Your LD_PRELOAD simply replace the Microsoft injection step which makes cygwin crashing. & I did not modify anything in my Microsoft Detours Hooking dll ! Really great job ! (I saw you have modified fork.cc to call ld_preload() on forkee instances). The only modification but already made not to crash on cygwin was, when I received a call in my CreateProcess Hook version, is not to inject new code by Calling DetoursCreateProcess (ms detours api) when the process requested by CreateProcess is stored under c:\cygwin, assuming that all processes under c:\cygwin are cygwin process & code is automatically inject througth LD_PRELOAD. My CreateProcess hook only rechain to the DetoursCreateProcess (not the original CreateProcess) only when it is a non cygwin process. By this way, all child processes (cygwin or win32 native programs) are hooked !!!! Again, really thx for your modification, you are all doing a really great job, Louis Dave Korn wrote: >----Original Message---- > > >>From: Brian Ford >>Sent: 11 August 2005 19:06 >> >> > > > >>Just to add a useless speculation that I don't currently have time to >>follow up on... >> >>I'd bet this is the mechanism used by SysInternals Process Explorer for >>the currently broken (on Cygwin) DLL list and thread list features. If >>and when I have time to confirm this useless speculation, I'll report >>back. Unless someone else gets to it first... ;-). >> >> > > I'll bet it isn't. And what's more, I reckon I can prove it without even >needing to look! > > > cheers, > DaveK > > -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/