Re: [Cegcc-devel] Can't see the exports table

[Dave K. <dav...@go...>]

Danny Backx wrote:
> On Wed, 2009-12-09 at 15:01 +0000, Dave Korn wrote:
>>   Also, what's going on there with the VMA/LMA for .data?  It can't possibly
>> really be supposed to be 32 meg below the base address that the DLL gets
>> loaded at!
> 
> Considering that these are "system DLLs", I am not sure whether what
> we're seeing is so wrong. I would expect coredll.dll to point into
> kernel memory and therefore not all rules for normal dlls to apply.

  But that's not in the kernel memory range, is it?  It's just somewhere
random in the middle of slot space IIUC.  And although its true that in theory
the OS could bend the rules, without having been specifically told so I'd
assume that coredll was just a user mode dll like any other, and bound by the
same user/kernel-space divide anyway.

  Anyway, as we've seen it turns out that it most likely really is a slightly
corrupted DLL and that objdump is doing its best in a GIGO situation.

    cheers,
      DaveK