Windows/Visual c++ | Weird behaviour of Struct in x64

65 views Asked by At

I want to read the PE-Headers of an x86 executeable on windows. To do that I use the standart stcructures given by the 'windows.h'. ('image' is in this example a char* to by mapped PE-Image)

int main()
{
    IMAGE_DOS_HEADER* dosheader = PIMAGE_DOS_HEADER(image);
    IMAGE_NT_HEADERS32* ntheader = PIMAGE_NT_HEADERS32(DWORD(image) + dosheader->e_lfanew);
    std::cout << "breakpoint 1." << std::endl;
    ntheader->Signature;
    std::cout << "breakpoint 2." << std::endl;
}

Output:

breakpoint 1.

Conclusion: Thn Program crashes when using a Variable of the Structure IMAGE_NT_HEADERS32.

Now the weird thing:
I compile with Visual c++ compiler (cl.exe), with
'[vcvarsall.bat] Environment initialized for: 'x64''

But if I compile my code as x86 executeable, the Structure works just fine and both breakpoints get triggered.
The IMAGE_DOS_HEADER structure works just fine, so i cant make myself any sense out of it.
My Question is now: why does that happen? I mean the IMAGE_NT_HEADERS32 structure should be the same on both x64 and x86, isnt it?

0

There are 0 answers