array of struct

Index > Windows > array of struct

Author

Thread

kaafe

Joined: 15 Oct 2003
Posts: 18

kaafe 17 Oct 2003, 03:32

I think something wrong in array of struct. When i use,

Code:

sizeof.IMAGE_NT_HEADERS

is returning "100h" but must be "F8h". My structures are as below.

Code:

struc IMAGE_DATA_DIRECTORY
{
  .VirtualAddress    DD      ?
  .isize             DD      ?
}
struct IMAGE_DATA_DIRECTORY

struc IMAGE_OPTIONAL_HEADER32
{
  .Magic                         DW       ?
  .MajorLinkerVersion            DB      ?
  .MinorLinkerVersion            DB       ?
  .SizeOfCode                    DD      ?
  .SizeOfInitializedData         DD      ?
  .SizeOfUninitializedData       DD      ?
  .AddressOfEntryPoint           DD      ?
  .BaseOfCode                    DD      ?
  .BaseOfData                    DD      ?
  .ImageBase                     DD      ?
  .SectionAlignment              DD      ?
  .FileAlignment                 DD      ?
  .MajorOperatingSystemVersion   DW       ?
  .MinorOperatingSystemVersion   DW       ?
  .MajorImageVersion             DW       ?
  .MinorImageVersion             DW       ?
  .MajorSubsystemVersion         DW       ?
  .MinorSubsystemVersion         DW       ?
  .Win32VersionValue             DD      ?
  .SizeOfImage                   DD      ?
  .SizeOfHeaders                 DD      ?
  .CheckSum                      DD      ?
  .Subsystem                     DW       ?
  .DllCharacteristics            DW       ?
  .SizeOfStackReserve            DD      ?
  .SizeOfStackCommit             DD      ?
  .SizeOfHeapReserve             DD      ?
  .SizeOfHeapCommit              DD      ?
  .LoaderFlags                   DD      ?
  .NumberOfRvaAndSizes           DD      ?
  .DataDirectory                 IMAGE_DATA_DIRECTORY
                                   rb sizeof.IMAGE_DATA_DIRECTORY * (IMAGE_NUMBEROF_DIRECTORY_ENTRIES) ; 16
}
struct IMAGE_OPTIONAL_HEADER32

IMAGE_OPTIONAL_HEADER  equ  <IMAGE_OPTIONAL_HEADER32>

struc IMAGE_FILE_HEADER
{
  .Machine               DW    ?
  .NumberOfSections      DW    ?
  .TimeDateStamp         DD   ?
  .PointerToSymbolTable  DD   ?
  .NumberOfSymbols       DD   ?
  .SizeOfOptionalHeader  DW    ?
  .Characteristics       DW    ?
}
struct IMAGE_FILE_HEADER

struc IMAGE_NT_HEADERS
{
  .Signature         DD                   ?
  .FileHeader        IMAGE_FILE_HEADER
  .OptionalHeader    IMAGE_OPTIONAL_HEADER32
}
struct IMAGE_NT_HEADERS

17 Oct 2003, 03:32

Kevin_Zheng

Joined: 04 Jul 2003
Posts: 125
Location: China

Kevin_Zheng 17 Oct 2003, 04:58

See the belowing define:(You should be use 15 replace IMAGE_NUMBEROF_DIRECTORY_ENTRIES) )

Because you have define a field prior using RB define it.

DataDirectory IMAGE_DATA_DIRECTORY
rb sizeof.IMAGE_DATA_DIRECTORY * 15 ; 15

17 Oct 2003, 04:58

kaafe

Joined: 15 Oct 2003
Posts: 18

kaafe 17 Oct 2003, 19:44

Thank you,
But it is already defined as,

Code:

IMAGE_NUMBEROF_DIRECTORY_ENTRIES  = 16

in my include. Also for tasm and masm it is defined "16". Why "15"?

17 Oct 2003, 19:44

Kevin_Zheng

Joined: 04 Jul 2003
Posts: 125
Location: China

Kevin_Zheng 18 Oct 2003, 13:39

1. Why is IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16? Please see the format struct of PE file.
2.Because FASM struct syntax doesn't support mulitple sample struct variables deines on the struct define, so we used rb syntax for avoiding the issue.

I think that the define maybe explict your idea:

Code:

DataDirectory IMAGE_DATA_DIRECTORY       ;1
rb sizeof.IMAGE_DATA_DIRECTORY * (IMAGE_NUMBEROF_DIRECTORY_ENTRIES -1)  ; 15

So we define 1+15=16 variables of IMAGE_DATA_DIRECTORY.

18 Oct 2003, 13:39

kaafe

Joined: 15 Oct 2003
Posts: 18

kaafe 19 Oct 2003, 00:12

Ok Kevin_Zheng, now understood. Thank you.

19 Oct 2003, 00:12

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum