llvm dev - Oct 2015 - Support/COFF.h NumberOfSections size-mismatch inside "header"-struct

Hello everyone,

while working on a simple PE-Parser, using the llvm/Support/COFF.h Header, to
validate if a given File is a PE-File and to read the Machine Field I was
experiencing some troubles.

It seemed the Fields were somehow misaligned and I could pinpoint the source of
the misalignment to be the "NumberOfSections" field inside the
"header"-struct (a.k.a. IMAGE_FILE_HEADER in winnt.h).

It is defined as "int32_t" in COFF.h, while in winnt.h it is defined
as "WORD" and in the "Microsoft Portable Executable and Common
Object File Format Specification", which is also cited on top of the
COFF.h, also defines the Field to be 2 Bytes in Size.

A simple change to "uint16_t" did the trick.

Correct me if I am wrong, or if I was using it wrongly somehow.

Kind Regards
Roman

-- 
______________________________________________________________

The information contained in this electronic mail transmission 
may be privileged and confidential, and therefore, protected 
from disclosure. If you have received this communication in 
error, please notify us immediately by replying to this 
message and deleting it from your computer without copying 
or disclosing it.
______________________________________________________________
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20151019/241201af/attachment.html>

On Mon, Oct 19, 2015 at 8:11 AM, Rohleder, Roman (Contractor) via llvm-dev <
llvm-dev at lists.llvm.org> wrote:
> Hello everyone,
>
> while working on a simple PE-Parser, using the llvm/Support/COFF.h Header,
> to validate if a given File is a PE-File and to read the Machine Field I
> was experiencing some troubles.
>
> It seemed the Fields were somehow misaligned and I could pinpoint the
> source of the misalignment to be the "NumberOfSections" field
inside the
> "header"-struct (a.k.a. IMAGE_FILE_HEADER in winnt.h).
>
> It is defined as "int32_t" in COFF.h, while in winnt.h it is
defined as
> "WORD" and in the "Microsoft Portable Executable and Common
Object File
> Format Specification", which is also cited on top of the COFF.h, also
> defines the Field to be 2 Bytes in Size.
>
> A simple change to "uint16_t" did the trick.
>
> Correct me if I am wrong, or if I was using it wrongly somehow.
>
Hi,

The contents of Support/COFF.h are intended to be useful as a temporary,
in-memory, representation for LLVM's COFF writing implementation.  It is
not intended to be layout compatible with the bytes inside of a COFF file.
Layout compatible COFF types are defined in Object/COFF.h

>
> Kind Regards
> Roman
>
> ______________________________________________________________
>
> The information contained in this electronic mail transmission
> may be privileged and confidential, and therefore, protected
> from disclosure. If you have received this communication in
> error, please notify us immediately by replying to this
> message and deleting it from your computer without copying
> or disclosing it.
> ______________________________________________________________
>
> _______________________________________________
> LLVM Developers mailing list
> llvm-dev at lists.llvm.org
> http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20151019/7f82411c/attachment.html>

Just rewrote my Code to use the headers from the object folder instead and
tested it, works like a charm.
Thank you David!


From: David Majnemer [mailto:david.majnemer at gmail.com]
Sent: Montag, 19. Oktober 2015 19:57
To: Rohleder, Roman (Contractor)
Cc: llvm-dev at lists.llvm.org
Subject: Re: [llvm-dev] Support/COFF.h NumberOfSections size-mismatch inside
"header"-struct



On Mon, Oct 19, 2015 at 8:11 AM, Rohleder, Roman (Contractor) via llvm-dev
<llvm-dev at lists.llvm.org<mailto:llvm-dev at lists.llvm.org>>
wrote:
Hello everyone,

while working on a simple PE-Parser, using the llvm/Support/COFF.h Header, to
validate if a given File is a PE-File and to read the Machine Field I was
experiencing some troubles.

It seemed the Fields were somehow misaligned and I could pinpoint the source of
the misalignment to be the "NumberOfSections" field inside the
"header"-struct (a.k.a. IMAGE_FILE_HEADER in winnt.h).

It is defined as "int32_t" in COFF.h, while in winnt.h it is defined
as "WORD" and in the "Microsoft Portable Executable and Common
Object File Format Specification", which is also cited on top of the
COFF.h, also defines the Field to be 2 Bytes in Size.

A simple change to "uint16_t" did the trick.

Correct me if I am wrong, or if I was using it wrongly somehow.

Hi,

The contents of Support/COFF.h are intended to be useful as a temporary,
in-memory, representation for LLVM's COFF writing implementation.  It is not
intended to be layout compatible with the bytes inside of a COFF file.  Layout
compatible COFF types are defined in Object/COFF.h


Kind Regards
Roman

______________________________________________________________

The information contained in this electronic mail transmission
may be privileged and confidential, and therefore, protected
from disclosure. If you have received this communication in
error, please notify us immediately by replying to this
message and deleting it from your computer without copying
or disclosing it.
______________________________________________________________

_______________________________________________
LLVM Developers mailing list
llvm-dev at lists.llvm.org<mailto:llvm-dev at lists.llvm.org>
http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev


-- 
______________________________________________________________

The information contained in this electronic mail transmission 
may be privileged and confidential, and therefore, protected 
from disclosure. If you have received this communication in 
error, please notify us immediately by replying to this 
message and deleting it from your computer without copying 
or disclosing it.
______________________________________________________________
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20151019/8cfad80f/attachment.html>