struc IMAGE_DATA_DIRECTORY {

.VirtualAddress dd ?
.isize dd ?
}
struct IMAGE_DATA_DIRECTORY

struc IMAGE_OPTIONAL_HEADER32 {
.Magic dw ?
.MajorLinkerVersion db ?
.MinorLinkerVersion db ?
.SizeOfCode dd ?
.SizeOfInitializedData dd ?
.SizeOfUninitializedData dd ?
.AddressOfEntryPoint dd ?
.BaseOfCode dd ?
.BaseOfData dd ?
.ImageBase dd ?
.SectionAlignment dd ?
.FileAlignment dd ?
.MajorOperatingSystemVersion dw ?
.MinorOperatingSystemVersion dw ?
.MajorImageVersion dw ?
.MinorImageVersion dw ?
.MajorSubsystemVersion dw ?
.MinorSubsystemVersion dw ?
.Win32VersionValue dd ?
.SizeOfImage dd ?
.SizeOfHeaders dd ?
.CheckSum dd ?
.Subsystem dw ?
.DllCharacteristics dw ?
.SizeOfStackReserve dd ?
.SizeOfStackCommit dd ?
.SizeOfHeapReserve dd ?
.SizeOfHeapCommit dd ?
.LoaderFlags dd ?
.NumberOfRvaAndSizes dd ?
.DataDirectory rb sizeof.IMAGE_DATA_DIRECTORY*16
}
struct IMAGE_OPTIONAL_HEADER32


Last structure's last member has 16 IMAGE_DATA_DIRECTORY structures. I have tried to use times directive, but with no luck. I searched on this forum, but found no applicable solution except this one. It will allocate correct amount of bytes for DataDirectory member, but I cannot access it like (VirtualAddress is member of IMAGE_DATA_DIRECTORY structure).
Posted on 2003-05-17 18:23:07 by comrade
How about altering the last part to:



.DataDirectory IMAGE_DATA_DIRECTORY
.DataDirectory rb sizeof.IMAGE_DATA_DIRECTORY*15

Posted on 2003-05-18 07:59:49 by revolution
How is that possible? Then it is two elements under same name. And I still wouldn't be able to access it like I wrote in previous post.
Posted on 2003-05-18 11:51:58 by comrade
The code below allows you to access the first IMAGE_DATA_DIRECTORY. Hope this provides some insight. 8^)




.DataDirectory rb IMAGE_DATA_DIRECTORY*16 <-- Change in the the struct

.data
IOH IMAGE_OPTIONAL_HEADER32

.code
lea eax, [IOH.DataDirectory]
virtual at eax
IDD IMAGE_DATA_DIRECTORY
end virtual
mov [IDD.isize], 16

lea eax, [IOH.DataDirectory+IMAGE_DATA_DIRECTORY] ;<-- This will give the second IMAGE_DATA_DIRECTORY and the you can just add *2 to get the third, *3 to get the fourth and so on.
virtual at eax
IDD2 IMAGE_DATA_DIRECTORY
end virtual
mov [IDD2.isize], 16

Posted on 2003-05-18 18:47:24 by jInuQ

How is that possible? Then it is two elements under same name. And I still wouldn't be able to access it like I wrote in previous post.


Yeah, I forgot to delete the other name. I think this will work the way you want.



.DataDirectory IMAGE_DATA_DIRECTORY
rb sizeof.IMAGE_DATA_DIRECTORY*15



That way ".DataDirectory" is now of type "IMAGE_DATA_DIRECTORY" and elements can be accessed with:

[code]


or

;for the tenth element

[/code]
Posted on 2003-05-18 20:02:50 by revolution
Here's a way.....


DataDirectory IMAGE_DATA_DIRECTORY
rb sizeof.IMAGE_DATA_DIRECTORY*15

SIZE equ sizeof.IMAGE_DATA_DIRECTORY

then you could just do...

mov ,value
mov ,value

Hope it helps a little....
Posted on 2003-05-19 14:08:50 by CyberGuy
Thanks for all replies!
Posted on 2003-05-20 07:16:25 by comrade