Re: LoadResource with module=0x00400000 followed by stack overflow

[Jonathan Clark]

On Tue, 20 Jun 2006 12:49:25 +0200, Jan-Espen Pettersen wrote:
> Can a win32 program expect that it has write access to the memory
> pointed to by the return value of LoadResource with module 0x00400000?
> Should LoadResource in some cases copy the memory and return a
> writeable copy of the resource?

I noticed a similar problem under Windows Server 2003 when DEP is enabled,
but haven't seen it on other platforms.  If I recall, there is code in
version.dll which calls LoadResource with RT_VERSION and then expects to be
able to write to pages that are clearly marked not-writable in the PE image.
The pages remain read-only until after a call to GetVersionInfo so something
in the kernel is altering them.  I didn't dig into it, but thought it was
really weird.  When I turn off DEP for that program I got different
behavior.  I don't know what this means for wine but maybe that is useful. 

 

Jonathan