On Tue, 20 Jun 2006 12:49:25 +0200, Jan-Espen Pettersen wrote:

> Can a win32 program expect that it has write access to the memory

> pointed to by the return value of LoadResource with module 0x00400000?

> Should LoadResource in some cases copy the memory and return a

> writeable copy of the resource?

I noticed a similar problem under Windows Server 2003 when DEP is enabled, but haven’t seen it on other platforms.  If I recall, there is code in version.dll which calls LoadResource with RT_VERSION and then expects to be able to write to pages that are clearly marked not-writable in the PE image.  The pages remain read-only until after a call to GetVersionInfo so something in the kernel is altering them.  I didn’t dig into it, but thought it was really weird.  When I turn off DEP for that program I got different behavior.  I don’t know what this means for wine but maybe that is useful…

Jonathan