Click here to Skip to main content
15,848,407 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
GeneralRe: Local / unique Variable Macro question Pin
leon de boer19-Jun-17 10:16
leon de boer19-Jun-17 10:16 
AnswerRe: Local / unique Variable Macro question Pin
Bram van Kampen28-Jun-17 14:21
Bram van Kampen28-Jun-17 14:21 
GeneralRe: Local / unique Variable Macro question Pin
ForNow28-Jun-17 14:47
ForNow28-Jun-17 14:47 
GeneralRe: Local / unique Variable Macro question Pin
Bram van Kampen28-Jun-17 15:21
Bram van Kampen28-Jun-17 15:21 
QuestionDisecting a PE File Pin
Bram van Kampen16-Jun-17 15:19
Bram van Kampen16-Jun-17 15:19 
AnswerRe: Disecting a PE File Pin
leon de boer17-Jun-17 4:17
leon de boer17-Jun-17 4:17 
GeneralRe: Disecting a PE File Pin
Bram van Kampen18-Jun-17 13:46
Bram van Kampen18-Jun-17 13:46 
GeneralRe: Disecting a PE File Pin
harold aptroot18-Jun-17 4:11
harold aptroot18-Jun-17 4:11 
Bram van Kampen wrote:
"Goto <winnt.h>, where you will somwhere past halfway down, the following:-
IMAGE_DIRECTORY_ENTRY_EXPORT, and IMAGE_OPTIONAL_HEADER.DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES].

Go Back to your PE Header, do your arithmetic (Apply a Delta) to compensate for mapping the file differently than that 'LoadLibrary()' does (same as Matt does) and get it that way."
Yes, basically that. Looking for section names is not that useful, there are some conventions but in the end the name is meaningless. To make matters worse, the current convention is putting the import and export directories in .rdata.

Anyway something that catches my attention is that this:
m_pSH[ i ].VirtualAddress==pExportData->VirtualAddress

Is wrong, because the export directory does not have to be at the start of a section, it could be (and typically is) somewhere in the middle of a section. So you should test whether the section contains the virtual address of the export directory.
GeneralRe: Disecting a PE File Pin
Bram van Kampen18-Jun-17 14:05
Bram van Kampen18-Jun-17 14:05 
GeneralRe: Disecting a PE File Pin
harold aptroot18-Jun-17 14:39
harold aptroot18-Jun-17 14:39 
GeneralRe: Disecting a PE File Pin
Bram van Kampen19-Jun-17 14:27
Bram van Kampen19-Jun-17 14:27 
GeneralRe: Disecting a PE File Pin
harold aptroot19-Jun-17 15:27
harold aptroot19-Jun-17 15:27 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan19-Jun-17 21:57
mveRichard MacCutchan19-Jun-17 21:57 
GeneralRe: Disecting a PE File Pin
Bram van Kampen29-Jun-17 13:00
Bram van Kampen29-Jun-17 13:00 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan29-Jun-17 22:28
mveRichard MacCutchan29-Jun-17 22:28 
GeneralRe: Disecting a PE File Pin
Bram van Kampen30-Jun-17 15:19
Bram van Kampen30-Jun-17 15:19 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan30-Jun-17 22:30
mveRichard MacCutchan30-Jun-17 22:30 
GeneralRe: Disecting a PE File Pin
Bram van Kampen2-Jul-17 14:26
Bram van Kampen2-Jul-17 14:26 
GeneralRe: Disecting a PE File Pin
Richard MacCutchan2-Jul-17 22:42
mveRichard MacCutchan2-Jul-17 22:42 
QuestionStreamin proc for Rich edit Pin
ForNow16-Jun-17 10:27
ForNow16-Jun-17 10:27 
QuestionRe: Streamin proc for Rich edit Pin
David Crow16-Jun-17 18:40
David Crow16-Jun-17 18:40 
AnswerRe: Streamin proc for Rich edit Pin
ForNow17-Jun-17 16:43
ForNow17-Jun-17 16:43 
GeneralRe: Streamin proc for Rich edit Pin
David Crow17-Jun-17 17:09
David Crow17-Jun-17 17:09 
GeneralRe: Streamin proc for Rich edit Pin
ForNow17-Jun-17 17:28
ForNow17-Jun-17 17:28 
Questionikspropertset declaring variable ksps Pin
Member 1326135415-Jun-17 6:58
Member 1326135415-Jun-17 6:58 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.