I have read about the DataDirectory field of the IMAGE_OPTIONAL_HEADER32 structure but there are some things that are still not clear to me. I understand that this field is an array of IMAGE_DATA_DIRECTORY structures. The question I have is what does the VirtualAddress field of the structure point to? The pecoff reference I have says it points to a table but I don't know what table it is talking about.
Posted on 2003-03-28 16:00:33 by Odyssey
Each DataDirectory contains a VirtualAddress which is the address to the corresponding datadirectories structure such as the Import Table, the import table is the second DataDirectory entry.
Posted on 2003-03-28 16:41:42 by SFP
I am still confused. You said that the VirtualAdress field of the IMAGE_DATA_DIRECTORY structure is the address of the corresponding datadirectories structure. But I thought those structures were members of the data directory array which is a field in the IMAGE_OPTIONAL_HEADER32 structure.
Posted on 2003-03-28 17:03:17 by Odyssey
I'll give you a C++ example off of my head...

Say pData is a pointer to the first DataDirectoryStructure


pData++; <- points to second member which is import table
PIMAGE_IMPORT_DESCRIPTOR pImport = MakePtr( PIMAGE_IMPORT_DESCRIPTOR, lpFileBase, pData->VirtualAddress; <- Make a pointer of type PIMAGE_IMPORT_DESCRIPTOR which is a pointer to a IMAGE_IMPORT_DESCRIPTOR structure, lpFileBase is the filebase you get MapViewOfFile, makeptr is a macro/define that returns the right address)

Now pImport is a pointer to the first Image Import Descriptor (first import) and for each Import Descriptor you have a pointer to an array of Thunks which is functions imported from that dll..
Posted on 2003-03-28 19:32:09 by SFP