On Jan 12 13:34, Vanda Vodkamilkevich wrote:
> Hi,
> 
> I'm reacting to this email with a long delay but I just wanted to let you
> know that this change saved my life, now I am finally able to debug again
> with cygwin (w7 64bits , 32 bits cygwin) because I was blocked by a nasty
> "security" dll (part of Arkoon Security). A big thank you...
> 
> Additionally I had another problem in gdb which is detecting kernel64.dll
> instead of kernel32.dll : am I the only one still using Cygwin 32 on
> Windows 64? Does this rings a bell for anyone?
> 
> I had to add another (uggly) patch above Tim's work, see below :
> 
> diff -ru origsrc/gdb-7.8/gdb/windows-nat.c src/gdb-7.8/gdb/windows-nat.c
> --- origsrc/gdb-7.8/gdb/windows-nat.c   2015-06-23 17:44:40.862022600 +0200
> +++ src/gdb-7.8/gdb/windows-nat.c       2015-11-25 13:28:46.893554500 +0100
> @@ -648,6 +648,14 @@
>    buf[0] = 0;
>    if (access (name, F_OK) != 0)
>      {
> +      char *found=strstr(name,"kernel64.dll");

This is very suspicious.  There's no such DLL on Windows, neither for
64 bit nor for 32 bit, nor for 32 bit under WOW64, but there's an old
exploit known to rename qmgr.dll to kernel64.dll (CVE-2010-1297).  


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat