core/win32/os.c
/* rewalking is set when walking existing memory mappings, and is
 * unset if called when processing a system call for (un)map 
 */
rewalking is set when walking existing memory mappings, and is
unset if called when processing a system call for (un)map
rewalking is set when walking existing memory mappings and is unset if called when processing a system call for ( un ) map
static void
process_image_post_vmarea(app_pc base, size_t size, uint prot, bool add, bool rewalking)
{
#ifdef CLIENT_INTERFACE
    if (dynamo_initialized && add)
        instrument_module_load_trigger(base);
#endif
    ASSERT(prot_is_readable(prot));
    ASSERT(!rewalking || add);  
    if (!is_readable_pe_base(base)) {
        return;
    }
#ifndef X64
    if (module_is_64bit(base))
        return;
#endif
#ifdef RCT_IND_BRANCH
    if (TEST(OPTION_ENABLED, DYNAMO_OPTION(rct_ind_call)) ||
        TEST(OPTION_ENABLED, DYNAMO_OPTION(rct_ind_jump))) {
        rct_process_module_mmap(base, size, add, rewalking);
    }
#endif 
    if (!add) 
        module_list_remove(base, size);
}
static void process_image_post_vmarea ( app_pc base , size_t size , uint prot , bool add , bool rewalking ) { #ifdef CLIENT_INTERFACE if ( dynamo_initialized && add ) instrument_module_load_trigger ( base ) ; #endif ASSERT ( prot_is_readable ( prot ) ) ; ASSERT ( ! rewalking || add ) ; if ( ! is_readable_pe_base ( base ) ) { return ; } #ifndef X64 if ( module_is_64bit ( base ) ) return ; #endif #ifdef RCT_IND_BRANCH if ( TEST ( OPTION_ENABLED , DYNAMO_OPTION ( rct_ind_call ) ) || TEST ( OPTION_ENABLED , DYNAMO_OPTION ( rct_ind_jump ) ) ) { rct_process_module_mmap ( base , size , add , rewalking ) ; } #endif if ( ! add ) module_list_remove ( base , size ) ; }
rewalking is set when walking existing memory mappings, and is
 unset if called when processing a system call for (un)map
rewalking is set when walking existing memory mappings and is unset if called when processing a system call for ( un ) map
/* ensure header is readable */ /* when rewalking can only add */ /* FIXME: we only know that we are in a MEM_IMAGE
     * we still need to be careful to check it is a real PE
     * We could optimize out these system calls, but for now staying safe
     */ /* see comments in process_image() where we SYSLOG */ /* Our WOW64 design for 32-bit DR involves ignoring all 64-bit dlls
     * (several are visible: wow64cpu.dll, wow64win.dll, wow64.dll, and ntdll.dll)
     * For 64-bit DR both should be handled.
     */ /* we need to know about module addition or removal
         * whether or not we'll act on it right now
         */ /* RCT_IND_BRANCH */ /* remove last */