Incorrect alignment in `IMAGE_OPTIONAL_HEADER64` struct
Opened this issue · 0 comments
soheil-01 commented
Description
The current definition of the IMAGE_OPTIONAL_HEADER64
struct in the library has incorrect alignment specifications. Each field is currently aligned to 4 bytes (align(4)
), which causes issues when reading PE NT headers using reader.readStruct()
.
Expected behavior
The IMAGE_OPTIONAL_HEADER64
struct should be defined without individual field alignemnts.
Here is a corrected version of the struct definition:
pub const IMAGE_OPTIONAL_HEADER64 = extern struct {
Magic: IMAGE_OPTIONAL_HEADER_MAGIC,
MajorLinkerVersion: u8,
MinorLinkerVersion: u8,
SizeOfCode: u32,
SizeOfInitializedData: u32,
SizeOfUninitializedData: u32,
AddressOfEntryPoint: u32,
BaseOfCode: u32,
ImageBase: u64,
SectionAlignment: u32,
FileAlignment: u32,
MajorOperatingSystemVersion: u16,
MinorOperatingSystemVersion: u16,
MajorImageVersion: u16,
MinorImageVersion: u16,
MajorSubsystemVersion: u16,
MinorSubsystemVersion: u16,
Win32VersionValue: u32,
SizeOfImage: u32,
SizeOfHeaders: u32,
CheckSum: u32,
Subsystem: IMAGE_SUBSYSTEM,
DllCharacteristics: IMAGE_DLL_CHARACTERISTICS,
SizeOfStackReserve: u64,
SizeOfStackCommit: u64,
SizeOfHeapReserve: u64,
SizeOfHeapCommit: u64,
/// Deprecated
LoaderFlags: u32,
NumberOfRvaAndSizes: u32,
DataDirectory: [16]IMAGE_DATA_DIRECTORY,
};