Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

winspool.drv name aliasing with winspool.dll #185

Open
janbbeck opened this issue May 16, 2021 · 4 comments
Open

winspool.drv name aliasing with winspool.dll #185

janbbeck opened this issue May 16, 2021 · 4 comments
Assignees
Labels

Comments

@janbbeck
Copy link
Contributor

Using the same file and methodology as #153
I get

APID[TRACE]: API Lookup: WINSPOOL:DocumentPropertiesW
APID[WHERE]: JSON API database /usr/local/share/pharos/apidb/pharos-api-additions.json has no data for DLL: WINSPOOL
APID[WHERE]: SQLite API database /usr/local/share/pharos/apidb/pharos-apidb.sqlite has no data for DLL: WINSPOOL
APID[WHERE]: Decorated name parser has no data for DLL: WINSPOOL
APID[WARN ]: API database has no data for DLL: WINSPOOL
OOAN[WARN ]: No stack delta information for: WINSPOOL.DRV:DocumentPropertiesW

This is very interesting. There is a file for winspool.dll in share/contrib which defines this and other missing names.

After some looking around, it appears that the very same file is sometimes called winspool.drv and at other times winspool.dll
https://answers.microsoft.com/en-us/windows/forum/windows_xp-performance/winspooldll-issue/89594fcf-ed04-4b16-bc93-9fbdbbdf4884

so should the name parser check for .dll definitions when finding .drv imports, or should some definitions be added replacing

"dll": "winspool.dll",

with

"dll": "winspool.drv",

?

@sei-gwassermann
Copy link
Contributor

Interestingly we've already run into this problem of searching for winspool.drv but I suspect the information was added to the database as winspool.dll only. Will check.

@janbbeck
Copy link
Contributor Author

No need to check. It is exactly as you say, at least for the winspool in share/contrib

@sei-gwassermann
Copy link
Contributor

I believe it should be in the database and the share/contrib entry is unnecessary, will look into it.

@sei-eschwartz
Copy link
Collaborator

@sei-gwassermann Ping

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants