Eric Pouech eric.pouech@gmail.com writes:
When:
- caller of dbghelp is a 64bit process,
- invoking SymInitialize on a 32bit live target running under WOW64
SymInitialize fails because:
- check_live_target() erroneously reads the 64bit PEB of the target, while it actually wants the 32bit PEB.
- as the ELF base header address isn't set (hidden in CloudFileFlags) in the 64bit PEB, hence causing the failure
So ensure that check_live_target() actually reads the 32bit PEB when handling a 32bit process.
I couldn't find a simpler way to fix it :-( (offsetting PEB address by 0x1000 works but is way too hacky)
Offsetting by 0x1000 is fine.
But I'd say that the ELF data should be stored in the 64-bit PEB. Also note that once the new Wow64 architecture is enabled, all ELF data inside 32-bit processes is going to be 64-bit.