Strange behaviour of Wine dlls under OllyDbg [duplicate]

Question

I've noticed something strange. OllyDbg seems to correctly load Wine's own dlls. But when I check PE header in OllyDBG it differs from that what I would expect. In all other cases file content is an exact match of PE header in OllyDbg. But in case of Wine libraries even the file signature is different.

First three bytes in file: 4D 5A 40 OllyDbg memory dump: 4D 5A 90

Then the rest of loaded library differs as well. I did not notice such behaviour with few Windows dlls that I have checked. Googling didn't help either. Does anybody know what's going on?

more finds

Example of differences

in file - OllyDbg PE header

DOS_PEOffset 60 - 40

Number of Sections 3 - 2

OllyDbg seems to be able to read exported Wine dll symbols despite of my own file analysis expecting Export Table RVA and Export Table Size to be 0. Please note that my own analysis works correctly on normal Windows dll files.

Above differences are from oleaut32.dll, but I’ve noticed similar when checking other Wine dlls. Location of Wine dlls: ~/.wine/drive_c/windows/system32

I'm using wine-1.4.1 and OllyDbg 2.01.

Answer 1

First three bytes in file: 4D 5A 40 OllyDbg memory dump: 4D 5A 90

As far as we can see from Wine's loader codes https://github.com/mirrors/wine/blob/master/libs/wine/loader.c

dos->e_magic    = IMAGE_DOS_SIGNATURE;
dos->e_cblp     = 0x90;                           <-- hardcoded 0x90 val
dos->e_cp       = 3;
dos->e_cparhdr  = (sizeof(*dos)+0xf)/0x10;
dos->e_minalloc = 0;
dos->e_maxalloc = 0xffff;
dos->e_ss       = 0x0000;
dos->e_sp       = 0x00b8;

Number of Sections 3 - 2

I dont know, but maybe WINE processes section with IMAGE_SCN_MEM_DISCARDABLE flag ( which is used only in r0 drivers in Windows ), so when you are standing on EntryPoint - those sections are not mapped already ?