Thread: Little question

Hello guys, I was testing something when a doubt arose.

What's the difference beetween this two codes:

First one:

Code:

PIMAGE_DOS_HEADER DOSHeader = reinterpret_cast<PIMAGE_DOS_HEADER>(GetModuleHandle(nullptr));
    PIMAGE_NT_HEADERS NTHeaders = reinterpret_cast<PIMAGE_NT_HEADERS>(DOSHeader + DOSHeader->e_lfanew);

Seconde one:

Code:

    PIMAGE_DOS_HEADER DOSHeader = reinterpret_cast<PIMAGE_DOS_HEADER>(GetModuleHandle(nullptr));
    PIMAGE_NT_HEADERS NTHeaders = reinterpret_cast<PIMAGE_NT_HEADERS>((BYTE*)DOSHeader + DOSHeader->e_lfanew);

The second one worked and the first one doesnt, why? When I will see fields of first one it's irregular, not the correct as the second one.

(windows.h)

@Julimar, are you sure converting a HMODULE to a pointer is correct? In Windows API a HANDLE isn't an address and GetModuleHandle(NULL) will return the current executable instance handle...

Assuming this would work (I think it doesn't!), DosHeader is a pointer to _IMAGE_DOS_HEADER, which is a structure. As @laserlight explained, when you add or subtracts an offset from a pointer, the compiler will multiply the size of the pointed type to the offset... The pointer DosHeader+DosHeader->e_lfanew is the same as (BYTE *)DosHeader+sizeof(_IMAGE_DOS_HEADER)*DosHeader->e_lfanew.