DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 7EDFD385DC16
Received-SPF: Pass (protection.outlook.com: domain of hcl.com designates
 192.8.195.57 as permitted sender) receiver=protection.outlook.com;
 client-ip=192.8.195.57; helo=APC01-PSA-obe.outbound.protection.outlook.com;
 pr=C
To: Jon Turney <jon DOT turney AT dronecode DOT org DOT uk>,
        "cygwin AT cygwin DOT com"
 <cygwin AT cygwin DOT com>
Subject: RE: Does the Cygwin setup program do internal sanity checks on
 startup?
Thread-Topic: Does the Cygwin setup program do internal sanity checks on
 startup?
Thread-Index: Adi3+hHHhKMoiaL6R9m2krjgLkvOZgAqQWoAAACoiYAAAhyk0A==
Date: Thu, 25 Aug 2022 18:14:15 +0000
Message-ID: <SI2PR04MB58215F05E08B8CFC2C29DA45FE729@SI2PR04MB5821.apcprd04.prod.outlook.com>
References: <SI2PR04MB5821A74D1F4EA6E27DEA3D82FE739 AT SI2PR04MB5821 DOT apcprd04 DOT prod DOT outlook DOT com>
 <20220825165242 DOT pkxoey67iyvmdqim AT lucy DOT dinwoodie DOT org>
 <c4261e67-f6ee-20e4-50f3-335783ba558b AT dronecode DOT org DOT uk>
In-Reply-To: <c4261e67-f6ee-20e4-50f3-335783ba558b@dronecode.org.uk>
Accept-Language: en-US
Content-Language: en-US
Authentication-Results-Original: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=hcl.com;
X-Microsoft-Antispam-Message-Info-Original: fAD6RT1yego+yqLvGbIpQIYN7VheyHq/XpLGCo1nM+P8cXUtTBwtqQPlEgZfVvLRCSbuMdyEm/QF8xiMWOra4WtKj3tU/Kw7QmThm3J2i2POtDGGZyk/QnZ1FJySoQNoVwrNRXQCI8LCKp08d/xohW31ZDJPgo3UdZUI7AmesIkFNtJZlgLzhvfv1RNszK7ahye5soSM9YEUyoqFBl0kS8U+hmAZqqtd0IS3pU0CobYhzWfxOhxDICjhi1fBxpA0fNeMcq5anI60G+geOMNPiiKJcuVmrjzXehrG208KgwKwpA2qemEHu7eXtzAcwtIEGLQFeCSKlDXnBiBRznp+pqmCUIXCXHGtlYQpBS+xYY/UHWVVn+h4sC8bbyKxAQYBpPBAcC06FrFpknrK4x2OC8V1fvPvXdV4TfNX0eVAfRzTRQYwa5+xA4Edo4DwWp0I57mPA4XhtTedW+uWMJWJ+BzKAoXsgUrR3Xb0/9wzczQOeToC2xEamvH8/Tq0hju0fqCeMz8HltZaXlYoPUsZuwcp9/aStiYHse1EdBPLoJ0E65RKL5h2js5u7uH2ek2O1W2HghvT3YWB2g/QJ/T3K69/PTWWq22sHxCQ+SAWVlj+Lqz0Qq1W/BgAKe/rDAATOiVMi5sRifUeUa0R3ENPwvCEyWw8Gc6Wxanacx/9KhRkR7MlP7gg28fTy+xC/TK+CbthxN4ulnZAr+v9mS1miE1xD/sERQNOZYYnmZgBWjIG6r5rexw0BSwVMcCo+sedy7gdF4a2cf51YcaQ06C4EMOo6cs5a13ZSDIQ+barKYc=
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en;
 SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:SI2PR04MB5821.apcprd04.prod.outlook.com;
 PTR:; CAT:NONE;
 SFS:(13230016)(4636009)(346002)(376002)(136003)(39860400002)(366004)(396003)(53546011)(71200400001)(966005)(26005)(55016003)(86362001)(7696005)(9686003)(38070700005)(478600001)(122000001)(38100700002)(83380400001)(82960400001)(6506007)(41300700001)(66476007)(186003)(2906002)(64756008)(5660300002)(76116006)(66946007)(66556008)(45080400002)(66446008)(8676002)(44832011)(33656002)(316002)(110136005)(52536014)(8936002);
 DIR:OUT; SFP:1102; 
MIME-Version: 1.0
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PSBPR04MB4053
X-DLP: MSGProcess
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: PSAAPC01FT049.eop-APC01.prod.protection.outlook.com
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id-Prvs: 7133eac8-1266-436c-0b1f-08da86c59eb0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: cTOX2674L8HxPnS+VyFw8B6U2W7GFePFWFRUqOUPnnSfKC0IPFF1ZcWsQPC971Uiw9FkMfF9sCwETWAI1DxSqSF3/MPn0RebFnxpYBHWATJtKxVOFkl8gjWST1G9QuBp/TkJb9p6ehTPHF3l5VMMRfXwpJZ9W2xjObVVQ4o8LqHU1eMW57Hj4ykPeX9HU3YaqW5uAyA4pUqkgb6gH7JPWhFZK3HrcF+I577jlE01QslAHYWGggp6bVy6Vl+TvXV5JUoHwTeoA2TVngGMzOYV68azEq1GpPesoU/35XljjSiENMm2BLQQvX3LrCeAZN4ay19KSc87cT7RL22IFilw1dRh1kCkx5i87Dh5WJcEh5alhQ7K/mudAtVh/Q+D+WggV470nhAD5UO8xCXXz0PG5qzBjzwlZ9eMbzc+3/jg7hzQnjDnIcAbPo+2rf2vc4cPXpj8BaTPpggEPoGN8Nb7XH7y1p6NEgtagTZ+jXwwnOxiRao68czG4vcpPiOyZ1Iaye3xuPUjfZqXfC6bGDT3t99+ZQJe0NIE72EyQ6utl4i3iEvC619FXeTAvgLCciW68+jHDNopzkuFUaXvc5qRR3soHWmoC+ihpS16h8p7e+Q3UyuPqaZfSV1En03X+SVAec+TxgK5UXJs9qHR1GpCahhkbwc78d2pUDqGQXXV14OaErGWkSExCBEXrIAg7ejDZckVs+hLmsH6n+oTmz5CfV3DFERMTesS5JiW1w+SjFxjxgLFdq5LMdkuofVcW/3Or0ci8zZ3zmTzYjpkqG9BEDyTH8G10n7XygqKuFYLfgdcgE8h+XSrlH6gemzallgTnTG7VfOzBvdoCGRMjQjCsw==
X-Forefront-Antispam-Report: CIP:192.8.195.57; CTRY:IN; LANG:en; SCL:1; SRV:;
 IPV:NLI; SFV:NSPM; H:APC01-PSA-obe.outbound.protection.outlook.com;
 PTR:InfoDomainNonexistent; CAT:NONE;
 SFS:(13230016)(4636009)(376002)(39860400002)(346002)(396003)(136003)(36840700001)(40470700004)(46966006)(8676002)(33656002)(5660300002)(52536014)(44832011)(70586007)(966005)(70206006)(55016003)(45080400002)(2906002)(316002)(40480700001)(82310400005)(9686003)(7696005)(6506007)(478600001)(53546011)(26005)(41300700001)(8936002)(336012)(47076005)(186003)(356005)(83380400001)(81166007)(110136005)(36860700001)(36906005)(86362001)(40460700003)(82740400003)(82960400001)(36900700001);
 DIR:OUT; SFP:1102; 
X-OriginatorOrg: HCL.COM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Aug 2022 18:14:19.2508 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 14a39617-cd0e-4d48-bf6f-08da86c5a130
X-MS-Exchange-CrossTenant-Id: 189de737-c93a-4f5a-8b68-6f4ca9941912
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=189de737-c93a-4f5a-8b68-6f4ca9941912; Ip=[192.8.195.57];
 Helo=[APC01-PSA-obe.outbound.protection.outlook.com]
X-MS-Exchange-CrossTenant-AuthSource: PSAAPC01FT049.eop-APC01.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SEZPR04MB5779
X-Spam-Status: No, score=-1.0 required=5.0 tests=BAYES_00, DKIM_SIGNED,
 DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FORGED_SPF_HELO, RCVD_IN_DNSWL_NONE,
 RCVD_IN_MSPIKE_H2, SPF_HELO_PASS, SPF_NONE, TXREP,
 T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
 server2.sourceware.org
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.29
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: Brian Cowan via Cygwin <cygwin AT cygwin DOT com>
Reply-To: Brian Cowan <brian DOT cowan AT hcl DOT com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>

And this was exactly it. I downloaded the latest UPX version, and it crashed on startup. I downloaded the Linux version on another host, copied the setup program to that host and extracted it there. NOW I can update Cygwin...

Brian Cowan
HCL Software
Technical Specialist, ClearCase SWAT
brian DOT cowan AT hcl DOT com


-----Original Message-----
From: Jon Turney <jon DOT turney AT dronecode DOT org DOT uk>
Sent: Thursday, August 25, 2022 1:12 PM
To: cygwin AT cygwin DOT com; Brian Cowan <brian DOT cowan AT hcl DOT com>
Subject: Re: Does the Cygwin setup program do internal sanity checks on startup?

[CAUTION: This Email is from outside the Organization. Unless you trust the sender, Don't click links or open attachments as it may be a Phishing email, which can steal your Information and compromise your Computer.]

On 25/08/2022 17:52, Adam Dinwoodie wrote:
> On Wed, Aug 24, 2022 at 08:46:10PM +0000, Brian Cowan via Cygwin wrote:
 >>Does the Cygwin setup program do internal sanity checks on startup?

Not as such.  And if it did, the behaviour when the fails should be to say those checks have failed, rather than crash apparently randomly...

>> Why would I ask that question? Because I have a host running a
>> hodgepodge of company-mandated security software, and -- only on that
>> host -- the Cygwin setup tool crashes...
>>
>> Oddities:
>> 1. The crash generates 3 dump files when I use procdump, which is odd
>> since I "normally" only get 2 identical dumps from procdump.
>> 2. A Websense ForcePoint DLP DLL is loaded in the process space,
>> apparently through DLL injection.
>> 3. There seem to be 3 threads started, only one of which is the setup
>> program's "main" function. I had to get that out of a Process Monitor
>> log since the dump files are largely content free.
>> 4. The crash is unique to the setup program. Nothing else appears to
>> fail.
>>
>> The crash is an "illegal instruction" dump, which of course doesn't
>> make a lot of sense... This could be one of the other security
>> packages/policies on this host being "helpful."
>>
>> I need ammunition to take to my internal Mordak's so I can update
>> Cygwin... Sure I can use WSL, but not for everything.
>
> This sounds like classic "BLODA": applications that interfere with how
> Cygwin provides *nix compatibility.  There's more info in the FAQs at
> https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcygw
> in.com%2Ffaq%2Ffaq.html%23faq.using.bloda&amp;data=05%7C01%7Cbrian.cow
> an%40hcl.com%7C0bc9158dc671450d207e08da86bcde4c%7C189de737c93a4f5a8b686f4ca9941912%7C0%7C0%7C637970442994701514%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=k%2FghFN8u0Yp5xDsUp8fJ61uceTUpwLEKdF8SRMCFGOk%3D&amp;reserved=0, but in short it seems very likely that this problem is caused by some security software running on this system.

This does indeed sound like interference by some other software.

But the setup program is not a Cygwin executable (it's not linked with the cygwin DLL because (i) it's not present before setup has installed it, and (ii) updating that DLL from setup while setup is using is problematic...

Note that the Cygwin setup executable as distributed is packed with UPX, which could very well interfere with the expectations of a poorly written injected DLL.

(You can reverse that compression by running 'upx -d' on the setup
executable)
::DISCLAIMER::
________________________________
The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only. E-mail transmission is not guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or may contain viruses in transmission. The e mail and its contents (with or without referred errors) shall therefore not attach any liability on the originator or HCL or its affiliates. Views or opinions, if any, presented in this email are solely those of the author and may not necessarily reflect the views or opinions of HCL or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification, distribution and / or publication of this message without the prior written consent of authorized representative of HCL is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately. Before opening any email and/or attachments, please check them for
  viruses and other defects.
________________________________

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple