I want to read the PE-Headers of an x86 executeable on windows. To do that I use the standart stcructures given by the 'windows.h'. ('image' is in this example a char* to by mapped PE-Image)
int main()
{
IMAGE_DOS_HEADER* dosheader = PIMAGE_DOS_HEADER(image);
IMAGE_NT_HEADERS32* ntheader = PIMAGE_NT_HEADERS32(DWORD(image) + dosheader->e_lfanew);
std::cout << "breakpoint 1." << std::endl;
ntheader->Signature;
std::cout << "breakpoint 2." << std::endl;
}
Output:
breakpoint 1.
Conclusion: Thn Program crashes when using a Variable of the Structure IMAGE_NT_HEADERS32.
Now the weird thing:
I compile with Visual c++ compiler (cl.exe), with
'[vcvarsall.bat] Environment initialized for: 'x64''
But if I compile my code as x86 executeable, the Structure works just fine and both breakpoints get triggered.
The IMAGE_DOS_HEADER structure works just fine, so i cant make myself any sense out of it.
My Question is now: why does that happen? I mean the IMAGE_NT_HEADERS32 structure should be the same on both x64 and x86, isnt it?