problem regrading PIMAGE_DOS_HEADER

This is a discussion on problem regrading PIMAGE_DOS_HEADER within the Windows Programming forums, part of the Platform Specific Boards category; My program code is given bellow..... Code: #include <windows.h> #include <stdio.h> #include <conio.h> #include<winnt.h> #define BUF_SIZE 256 TCHAR szName[]=TEXT("process.c"); TCHAR ...

  1. #1
    Registered User
    Join Date
    Sep 2006
    Posts
    19

    problem regrading PIMAGE_DOS_HEADER

    My program code is given bellow.....


    Code:
    #include <windows.h>
    #include <stdio.h>
    #include <conio.h>
    #include<winnt.h>
    
    #define BUF_SIZE 256
    TCHAR szName[]=TEXT("process.c");
    TCHAR szMsg[]=TEXT("Message from first process");
    
    int main()
    {
       HANDLE hMapFile;
       LPCTSTR pBuf;
       PIMAGE_NT_HEADERS pimage_nt_headers;
    
       hMapFile = CreateFileMapping(
                     INVALID_HANDLE_VALUE,    // use paging file
                     NULL,                    // default security 
                     PAGE_READWRITE,          // read/write access
                     0,                       // max. object size 
                     BUF_SIZE,                // buffer size  
                     szName);                 // name of mapping object
     
       if (hMapFile == NULL || hMapFile == INVALID_HANDLE_VALUE) 
       { 
          printf("Could not create file mapping object (%d).\n", 
                 GetLastError());
          return 1;
       }
       pBuf = (LPTSTR) MapViewOfFile(hMapFile,   // handle to map object
                            FILE_MAP_ALL_ACCESS, // read/write permission
                            0,                   
                            0,                   
                            BUF_SIZE);           
    
       printf("%d",pBuf);
       if (pBuf == NULL) 
       { 
          printf("Could not map view of file (%d).\n", 
                 GetLastError()); 
          return 2;
       }
    
       CopyMemory((PVOID)pBuf, szMsg, strlen(szMsg));
      
       PIMAGE_DOS_HEADER pimage_dos_header = PIMAGE_DOS_HEADER(pBuf);
    
       pimage_nt_headers = (PIMAGE_NT_HEADERS)
        (pBuf + pimage_dos_header->e_lfanew);
       printf("\n%d\n",pimage_nt_headers);
       DWORD it_voffset = pimage_nt_headers->OptionalHeader.
       DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
    
      printf("%d",it_voffset);
       getch();
    
       UnmapViewOfFile(pBuf);
    
       CloseHandle(hMapFile);
    
       return 0;
    }

    when i am displaying the value in it_voffset .....it is showing 0.
    why it is so ?
    can anyone explain this.......
    pBuf is having valid value......
    Last edited by Salem; 09-09-2006 at 04:37 AM. Reason: Added code tags - learn to use them yourself

  2. #2
    Reverse Engineer maxorator's Avatar
    Join Date
    Aug 2005
    Location
    Estonia
    Posts
    2,318
    Why are you displaying it in double? (%d)

  3. #3
    Registered User
    Join Date
    Sep 2006
    Posts
    19
    hii

    i should use %lu in place of %d .. but even after using it i am still getting 0.

  4. #4
    and the hat of wrongness Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    32,588
    > TCHAR szName[]=TEXT("process.c");
    Maybe it's something to do with the fact that you're looking for an exe header in something which isn't an exe file.
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.
    I support http://www.ukip.org/ as the first necessary step to a free Europe.

  5. #5
    Reverse Engineer maxorator's Avatar
    Join Date
    Aug 2005
    Location
    Estonia
    Posts
    2,318
    MSDN says:
    If hFile is INVALID_HANDLE_VALUE, the calling process must also specify a mapping object size in the dwMaximumSizeHigh and dwMaximumSizeLow parameters. In this scenario, CreateFileMapping creates a file mapping object of a specified size that the operating system paging file backs, instead of by a named file in the file system.

    What does it actually do? Open process.c file as a PE executable to see the virtual addresses of that "program's" sections?
    Last edited by maxorator; 09-09-2006 at 06:07 AM.

  6. #6
    Yes, my avatar is stolen anonytmouse's Avatar
    Join Date
    Dec 2002
    Posts
    2,544
    As maxorator said, your code does not actually open process.c (the last argument to CreateFileMapping is the name of the file mapping object, not a filename), and as Salem said, even if it did, process.c is unlikely to contain an executable header.

    There is an example of mapping a file for read access.

  7. #7
    Registered User
    Join Date
    Sep 2006
    Posts
    19
    could u please explain how to open process.c as a PE executable .
    actually i am new to windows programming

  8. #8
    Registered User Tonto's Avatar
    Join Date
    Jun 2005
    Location
    New York
    Posts
    1,465
    process.c is most likely a source file, not a portable executable, and should not tried to be opened as such. any executable, .exe extension, is probably a portable executable.

    ╔╗╔╦══╦╗╔╦══╦╗
    ║╚╝║╔╗║╚╝║╔╗║║
    ║╔╗║╠╣║╔╗║╠╣╠╣
    ╚╝╚╩╝╚╩╝╚╩╝╚╩╝

    codez http://code.google.com/p/zxcvbn/

  9. #9
    Registered User
    Join Date
    Sep 2006
    Posts
    19
    Code:
    #include <windows.h>
    #include <stdio.h>
    
    
    //#include <windows.h>
    //#include <stdio.h>
    #include <conio.h>
    #include<winnt.h>
    
    #define BUF_SIZE 256
    TCHAR szName[]=TEXT("process.c");
    TCHAR szMsg[]=TEXT("Message from first process");
    /*
     * Map a file for read access. Returns size of view in lpcbSize
     */
    LPCTSTR MapFileRead(LPCTSTR szFileName, size_t * lpcbSize)
    {
    	HANDLE hFile, hMapping;
    	DWORD  dwFileSize;
    	LPCTSTR lpView;
    	MEMORY_BASIC_INFORMATION mbi;
    
    	HANDLE hMapFile;
       LPCTSTR pBuf;
       PIMAGE_NT_HEADERS pimage_nt_headers;
    
    	*lpcbSize = 0;
    
    	hFile = CreateFile(szFileName, GENERIC_READ, FILE_SHARE_READ, NULL,
    	                   OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    	if (INVALID_HANDLE_VALUE == hFile)
    	{
    		return NULL;
    	}
    
    	dwFileSize = GetFileSize(hFile, NULL);
    	if (INVALID_FILE_SIZE == dwFileSize)
    	{
    		CloseHandle(hFile);
    		return NULL;
    	}
    
    	hMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY, 0, 0, NULL);
    	if (NULL == hMapping)
    	{
    		CloseHandle(hFile);
    		return NULL;
    	}
    
    	lpView = (LPTSTR)MapViewOfFile(hMapping, FILE_MAP_READ, 0, 0, 0);
    
    printf("%d",lpView);
    
    
    	  
       PIMAGE_DOS_HEADER pimage_dos_header = PIMAGE_DOS_HEADER(lpView);
       printf("%d...",pimage_dos_header->e_lfanew+lpView);
    
       pimage_nt_headers = (PIMAGE_NT_HEADERS)
       (lpView + pimage_dos_header->e_lfanew);
       DWORD it_voffset = pimage_nt_headers->OptionalHeader.
       DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;  printf("%lu",it_voffset);
       getch();
    
    
    	CloseHandle(hMapping);
    	CloseHandle(hFile);
    
    	if (NULL != lpView)
    	{
    		if (VirtualQuery(lpView, &mbi, sizeof(mbi)) >= sizeof(mbi))
    		{
    			*lpcbSize = min(dwFileSize, mbi.RegionSize);
    		}
    		else
    		{
    			*lpcbSize = dwFileSize;
    		}
    	}
    
    	return lpView;
    }
    
    
    /*
     * Close a file mapping view.
     */
    BOOL MapFileClose(LPCVOID lpView)
    {
    	return UnmapViewOfFile(lpView);
    }
    
    
    int main(void)
    {
    	size_t cbSize, i;
    	const char * file_view;
    
    	file_view = (const char *) MapFileRead(TEXT("const.cpp"), &cbSize);
    
    	if (file_view)
    	{
    		try
    		{
    			for (i = 0;i < cbSize; i++)
    			{
    				printf("%c", file_view[i]);
    			}
    		}
    		catch (...)
    		{
    			printf("Oh oh, not good doctor.");
    		}
    
    		MapFileClose(file_view);
    	}
    
    	getchar();
    	return 0;
    }
    Code is given above .....

    the point where i am getting error is underlined in italic...
    and error is Memory could not be read
    Last edited by Ken Fitlike; 09-10-2006 at 02:25 PM. Reason: code tags added

  10. #10
    and the hat of wrongness Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    32,588
    > printf("%c", file_view[i]);
    This will just puke on a binary file.

    > file_view = (const char *) MapFileRead(TEXT("const.cpp"), &cbSize);
    How about trying to read your .exe file instead of your source file?
    3 people have said the same thing now, but you still don't seem to get it.
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.
    I support http://www.ukip.org/ as the first necessary step to a free Europe.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Need help understanding a problem
    By dnguyen1022 in forum C++ Programming
    Replies: 2
    Last Post: 04-29-2009, 04:21 PM
  2. Memory problem with Borland C 3.1
    By AZ1699 in forum C Programming
    Replies: 16
    Last Post: 11-16-2007, 10:22 AM
  3. Someone having same problem with Code Block?
    By ofayto in forum C++ Programming
    Replies: 1
    Last Post: 07-12-2007, 08:38 AM
  4. A question related to strcmp
    By meili100 in forum C++ Programming
    Replies: 6
    Last Post: 07-07-2007, 02:51 PM
  5. WS_POPUP, continuation of old problem
    By blurrymadness in forum Windows Programming
    Replies: 1
    Last Post: 04-20-2007, 06:54 PM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21