I've noticed something strange. OllyDbg seems to correctly load Wine's own dlls. But when I check PE header in OllyDBG it differs from that what I would expect. In all other cases file content is an exact match of PE header in OllyDbg. But in case of Wine libraries even the file signature is different.
First three bytes in file: 4D 5A 40 OllyDbg memory dump: 4D 5A 90
Then the rest of loaded library differs as well. I did not notice such behaviour with few Windows dlls that I have checked. Googling didn't help either. Does anybody know what's going on?
Example of differences
in file - OllyDbg PE header
DOS_PEOffset 60 - 40
Number of Sections 3 - 2
OllyDbg seems to be able to read exported Wine dll symbols despite of my own file analysis expecting Export Table RVA and Export Table Size to be 0. Please note that my own analysis works correctly on normal Windows dll files.
Above differences are from oleaut32.dll, but I’ve noticed similar when checking other Wine dlls. Location of Wine dlls: ~/.wine/drive_c/windows/system32
I'm using wine-1.4.1 and OllyDbg 2.01.