Jump to content

ImportPatcher.41 - Find and fix dependency problems


jumper

Recommended Posts


The latest version 2.5.6 crashes in libADM_core.dll unfortunately.

I've got similar crash with Avidemux 2.5.5.

Additionally there's message about missing ktmdll.dll(?)

I have just googled for that filename and it seems like it's part of some old and obsolete version of Revolutions Pack so it would perhaps mean that you've got some old RP files hooking in your system and causing those problems.

Perhaps I should disable RP9 myself and see if Avidemux 2.5.6 still crashes in libadm_core, additionally there's message about missing quserex.dll (now that more mysterious), 2.5.5 runs fine here with msvcr70 in place of msvcrt, I have done some video transcoding with it.

Link to comment
Share on other sites

I have just googled for that filename and it seems like it's part of some old and obsolete version of Revolutions Pack so it would perhaps mean that you've got some old RP files hooking in your system and causing those problems.

Maybe indeed this an old Revolutions Pack but if I remember correctly, it was called Windows 98 32-Bit Icon Patch.

I haven't idea how to remove it.

Edited by rainyd
Link to comment
Share on other sites

IP.33 is finally done. VC6-style delay load imports took longer than expected. Some design changes were needed that affected a lot of the little details. After much testing and code clean-up, the only casualty was 'Link to copies.' Since this feature is only needed when walking and patching dependent DLLs, I decide not to hold up the release any longer.

From ImportPatcher.c:


  • // To do:
    // create DLL with families of stubs with various parameter counts and return values
    // fix 'Link to copies'
    // if bind mismatch, unbind by restoring parallel lists, then reprocess
    // if ILT null, set to IAT
    // list imports even if DLL missing or has no exports
    // ordinal support: replace, check, look up name
    // function substitution within a bound DLL implies unbinding!
    // display TimeDateStamp as words
    // custom file search path order w/o app folder, w/ KnownDLLs
    // batch process a folder of files: no-walk analyze only; first/last MB or progress window
    // dialog box interface
    // stub insertion
    // Future expansion:
    // create inf un/installer for patched file(s)
    // After patching, launch
    // ExportPatcher: add to a DLL's exports function forwards to a custom DLL

Link to comment
Share on other sites

now we have a crash.post-220425-0-76458200-1326906702_thumb.

The ini and log files would have been nice to see, but looking at what we have:


  • Image base is $400000
    Code base is $401000

Map file says:


0001:0000038a _PatchFile 0040138a f ImportPatcher.obj

so error is at b91 - 38a = 807 in PatchFile()

Cod file says:


; 682 : wsprintf (szBuff, "%s\t(%d)\t* not found", pSearch, ByName->Hint);

00804 8b 45 e8 mov eax, DWORD PTR _ByName$17417[ebp]
00807 0f b7 00 movzx eax, WORD PTR [eax]

A function search by name has just failed. Eax appears just a tad high, so must be pointing past end of file mapping.

From the information here, it looks like the file is truncated. Or maybe it was produced by an early Borland linker without an ILT:

  • // if ILT null, set to IAT

Such files can't be bound, so evidence of binding in the log file would discount this theory.

If the file works in IP.32, it is likely a problem with the delay-import data stuctures. A DW test would also be a good idea.

Please post the text of the .ini and .log files (in spoilers if large).

Thank you for testing! :yes:

Edited by jumper
Link to comment
Share on other sites

I am sending here the files.

It looks like either your overclocked memory glitched or your copy of shell32.dll has been corrupted.


...
Importing from module: 'SHELL32.dll'
TimeDateStamp: 3c106ecb
Target OS: 4.0
(300) Shell_NotifyIconA
(288) ShellExecuteExA
(224) SHGetSpecialFolderPathA
Importing from module: 'KERNEL32.DLL'
TimeDateStamp: 3caba233
Target OS: 4.0

Clues:

  • These TimeDateStamps for Shell32 and Kernel32 match those in SP3.
  • Kernel32 is processed higher in the log with no problems.
  • I can successfully walk Shell32 directly with IP.33 and also indirectly via Explorer.
  • Shell32 should be importing from GDI32 first, not Kernel32 (confirmed with DW and other sources).

Please try analyzing Shell32 directly, with and without walking dependencies. Also see if you can analyze coretemp10rc2_1236.exe (Walk=N), then try to reproduce the error with Walk=Y.

Meanwhile, I'll continue to investigate the twelve trailing spaces that don't seem to jive with the rest of the clues....

Link to comment
Share on other sites

Don't waste your time trying to run the coretemp installer divad, as 1) there is a zipped no-install download and 2) Coretemp doesn't work on 9x/ME as it relies on NT drivers. If you want a CPU voltage/temperature/fan speed monitor that works, get the latest 9x/ME compatible version of HWMonitor here: http://www.cpuid.com/downloads/hwmonitor/1.17-win98.zip

Edited by loblo
Link to comment
Share on other sites

I do not know why, it works now but it works.

thanks

After modding PEfinder to search for local files without ILTs, I discovered it's not just a few files from old linkers (as mentioned in one of the classic '90s PE guides). Many new apps (including a .NET installer!) suffer from this malady.

So I quickly added support for missing ILTs and a related unbinding issue last night and posted IP.34 a few minutes ago. I don't think this was the problem, but uninitialized variables and bad pointers are leading causes of sporadic program behavior.

In the course of this investigation, I also noticed that DW reports that COMCTL32.DLL and USER32.DLL both want to load at the same preferred base! That means every time the second one loads, there is a performance hit as it is relocated. :(

Link to comment
Share on other sites

IPstub.dll is a library of 42 small functions that can be used to plug holes left by missing imports. There are four basic stub families and three debugging stubs.

Basic stub families:

  • n = 0..9 (0 to 9 32-bit parameters)
  • pn (p1..p9): return <parameter 1>
  • fn (f0..f9): return flast / 0
  • on (o0..o9): return one / 1
  • tn (t0..t9): return true / -1 Ordinal assignment (@1..@39): 4*n + { pn:0 | fn:1 | on:2 | tn:3 }
    (There is no p0: can't return 1 of 0 parameters, ordinals start at 1)

Debugging stubs:

  • yn @ 40 : Yes/No/Cancel messagebox
    [ Yes ] returns true
    [ No ] returns false
    [ Cancel ] calls ExitProcess(-1)
    - zero parameters
  • op @ 41 : Cascading Yes/No/Cancel messageboxes
    [ Yes ] returns true
    [ No ] returns false
    [ Cancel ] invokes 2nd messagebox

    • [ Yes ] returns <param1>
      [ No ] returns 1
      [ Cancel ] calls ExitProcess(-1)

- one parameter

[*] bp @ 42 : calls MessageBeep (MB_ICONHAND), returns 0, zero parameters

Tested with IP.7 (first to display usage MessageBox):


[ImportPatcher.34]
;Edit parameters and replacement strings, then Retry or run again to patch. <=

[Parameters]
Walk dependencies=N
Link to copies=N
Unbind broken bindings=N
Target OS=4.10

[DLL substitutions]
USER32.dll=IPstub.dll

[IPstub.dll]
MessageBoxA=op
wsprintfA=yn

[Patch list]
ip7.exe=DLLs, Functions

Fun, fun! Did I mention it comes with source code? :boring:

Link to comment
Share on other sites

IPstub.dll is a library of 42 small functions that can be used to plug holes left by missing imports. There are four basic stub families and three debugging stubs.

Basic stub families:

  • n = 0..9 (0 to 9 32-bit parameters)
  • pn (p1..p9): return <parameter 1>
  • fn (f0..f9): return flast / 0
  • on (o0..o9): return one / 1
  • tn (t0..t9): return true / -1 Ordinal assignment (@1..@39): 4*n + { pn:0 | fn:1 | on:2 | tn:3 }
    (There is no p0: can't return 1 of 0 parameters, ordinals start at 1)

You will need to cover more than 9 parameters. CreateFontA uses 14 parameters. There probably are larger ones elsewhere.

Link to comment
Share on other sites

You will need to cover more than 9 parameters. CreateFontA uses 14 parameters. There probably are larger ones elsewhere.

Fortunately CreateFontA has been in GDI32 since Win32s so we don't need a stub for it. We can cross other bridges when we come to them.

Do you know of any recent comprehensive lists of functions similar to the old WIN32API.CSV? I may need to bite the bullet and download a recent platform SDK, then look at the header files.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...