我传递了dosHeader作为对Test方法的引用,该方法应该打印出ntHeader的签名。但是,我在*dosHeader->e_lfanew
下遇到编译器错误-“表达式必须具有指向结构或指针的指针类型”。我尝试将其强制转换为(PIMAGE_DOS_HEADER *),它确实消除了编译器错误,但不起作用。我有什么误会?
PIMAGE_NT_HEADERS ntHeader;
Test(PIMAGE_DOS_HEADER *dosHeader)
{
*dosHeader = (PIMAGE_DOS_HEADER)PEBytes;
ntHeader = (PIMAGE_NT_HEADERS)((LONG)*dosHeader + *dosHeader->e_lfanew);
printf("%d", ntHeader->Signature);
}
void main()
{
PIMAGE_DOS_HEADER dosHeader = 0;
Test(&dosHeader);
}
这是结构定义
typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header
WORD e_magic; // Magic number
WORD e_cblp; // Bytes on last page of file
WORD e_cp; // Pages in file
WORD e_crlc; // Relocations
WORD e_cparhdr; // Size of header in paragraphs
WORD e_minalloc; // Minimum extra paragraphs needed
WORD e_maxalloc; // Maximum extra paragraphs needed
WORD e_ss; // Initial (relative) SS value
WORD e_sp; // Initial SP value
WORD e_csum; // Checksum
WORD e_ip; // Initial IP value
WORD e_cs; // Initial (relative) CS value
WORD e_lfarlc; // File address of relocation table
WORD e_ovno; // Overlay number
WORD e_res[4]; // Reserved words
WORD e_oemid; // OEM identifier (for e_oeminfo)
WORD e_oeminfo; // OEM information; e_oemid specific
WORD e_res2[10]; // Reserved words
LONG e_lfanew; // File address of new exe header
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;