Could someone break this structure down to me in like a DWORD/Word arrangement?
IMAGE_RESOURCE_DIRECTORY_ENTRY STRUCT
union
rName RECORD NameIsString:1,NameOffset:31
Name1 dd ?
Id dw ?
ends
union
OffsetToData dd ?
rDirectory RECORD DataIsDirectory:1,OffsetToDirectory:31
ends
IMAGE_RESOURCE_DIRECTORY_ENTRY ENDS
Pietrek breaks it down to this:
Is he right? ;)
IMAGE_RESOURCE_DIRECTORY_ENTRY STRUCT
Name dd ?
OffsetToData dd ?
IMAGE_RESOURCE_DIRECTORY_ENTRY ENDS
Is he right? ;)
That would work. In a UNION all the listed members begin at the same offset, so they actually point to the same thing but give it different aliases. The only thing you have to watch out for is that the size of the UNION is always the size of the largest member. So
UNION
qwrd dq ?
dwrd dd ?
ENDS
would be 8 bytes even if dwrd was selected. Without this it would be impossible to calculate offsets within the stucture at compile time. Also a UNION is only for one member of the structure at a time, so no matter how many things are in the UNION it only represents alot of aliases for 1 structure member.
UNION
qwrd dq ?
dwrd dd ?
ENDS
would be 8 bytes even if dwrd was selected. Without this it would be impossible to calculate offsets within the stucture at compile time. Also a UNION is only for one member of the structure at a time, so no matter how many things are in the UNION it only represents alot of aliases for 1 structure member.
From winnt.h:
// Each directory contains the 32-bit Name of the entry and an offset,
// relative to the beginning of the resource directory of the data associated
// with this directory entry. If the name of the entry is an actual text
// string instead of an integer Id, then the high order bit of the name field
// is set to one and the low order 31-bits are an offset, relative to the
// beginning of the resource directory of the string, which is of type
// IMAGE_RESOURCE_DIRECTORY_STRING. Otherwise the high bit is clear and the
// low-order 16-bits are the integer Id that identify this resource directory
// entry. If the directory entry is yet another resource directory (i.e. a
// subdirectory), then the high order bit of the offset field will be
// set to indicate this. Otherwise the high bit is clear and the offset
// field points to a resource data entry.
The data is indeed two DWORDs, that can be interpreted in different ways (it is two unions, each of DWORD size).
// Each directory contains the 32-bit Name of the entry and an offset,
// relative to the beginning of the resource directory of the data associated
// with this directory entry. If the name of the entry is an actual text
// string instead of an integer Id, then the high order bit of the name field
// is set to one and the low order 31-bits are an offset, relative to the
// beginning of the resource directory of the string, which is of type
// IMAGE_RESOURCE_DIRECTORY_STRING. Otherwise the high bit is clear and the
// low-order 16-bits are the integer Id that identify this resource directory
// entry. If the directory entry is yet another resource directory (i.e. a
// subdirectory), then the high order bit of the offset field will be
// set to indicate this. Otherwise the high bit is clear and the offset
// field points to a resource data entry.
The data is indeed two DWORDs, that can be interpreted in different ways (it is two unions, each of DWORD size).
Oh thanks...appreciated a lot!
Also what does this RECORD stuff mean though? for example
rName RECORD NameIsString:1,NameOffset:31
The masm manual says:
recordname RECORD fieldname:width [[= expression]]
[[, fieldname:width [[= expression]]]]...
Declares a record type consisting of the specified fields. The fieldname names the field, width specifies the number of bits, and expression gives its initial value.
A record named rName with a what and why? And where would I use that if I ever needed it? Or find it?
Also what does this RECORD stuff mean though? for example
rName RECORD NameIsString:1,NameOffset:31
The masm manual says:
recordname RECORD fieldname:width [[= expression]]
[[, fieldname:width [[= expression]]]]...
Declares a record type consisting of the specified fields. The fieldname names the field, width specifies the number of bits, and expression gives its initial value.
A record named rName with a what and why? And where would I use that if I ever needed it? Or find it?
Afternoon, JimmyClif.
rName RECORD NameIsString:1,NameOffset:31
means that NameIsString is one bit in length and
NameOffset is 31 bits in length.
Together, they make up one dword (32 bits).
I suppose this allows the programmer to either use Name1 as a pointer to a string or to check NameIsString to see whether it's a pointer to a string and NameOffset for the address.
Cheers,
Scronty
rName RECORD NameIsString:1,NameOffset:31
means that NameIsString is one bit in length and
NameOffset is 31 bits in length.
Together, they make up one dword (32 bits).
I suppose this allows the programmer to either use Name1 as a pointer to a string or to check NameIsString to see whether it's a pointer to a string and NameOffset for the address.
Cheers,
Scronty
Cheers Scronty..