On Mon, 3 Mar 2025, Corinna Vinschen wrote:
> > diff --git a/winsup/cygwin/path.cc b/winsup/cygwin/path.cc
> > index 599809f941..49740ac465 100644
> > --- a/winsup/cygwin/path.cc
> > +++ b/winsup/cygwin/path.cc
> > @@ -4539,6 +4539,18 @@ find_fast_cwd_pointer ()
> > %rcx for the subsequent RtlEnterCriticalSection call. */
> > lock = (const uint8_t *) memmem ((const char *) use_cwd, 80,
> > "\x48\x8d\x0d", 3);
> > + if (lock)
> > + {
> > + /* A recent Windows 11 Preview calls `lea rel(rip),%rcx' then
> > + a `mov` and a `movups` instruction, and only then
> > + `callq RtlEnterCriticalSection'.
> > + */
> > + if (memmem (lock + 7, 8, "\x4c\x89\x78\x10\x0f\x11\x40\xc8", 8))
>
> Is it really necessary to check for each and every byte between lea and
> callq? I wonder if this can't be simpler by simply checking for the
> '\x48\x8d\x0d` needle and then, instead of just assuming a fixed
> call_rtl_offset, skip programatically to the next callq 0xe8 byte
> within the next 16 bytes or so?
I think looking for only a single byte might have too high a probability
of a false-positive match inside a multi-byte instruction. As you said
> It needs a lot of knowledge of instructons and their respective length,
> to skip the uninteresting parts.
