search for: image_file_head

...eader, to validate if a given File is a PE-File and to read the Machine Field I was experiencing some troubles. It seemed the Fields were somehow misaligned and I could pinpoint the source of the misalignment to be the "NumberOfSections" field inside the "header"-struct (a.k.a. IMAGE_FILE_HEADER in winnt.h). It is defined as "int32_t" in COFF.h, while in winnt.h it is defined as "WORD" and in the "Microsoft Portable Executable and Common Object File Format Specification", which is also cited on top of the COFF.h, also defines the Field to be 2 Bytes in Size...

...erates a very simple function import object. IMPORT_OBJECT[1-N] -> contains an IMPORT_OBJECT_HEADER and DATA data example -> _MessageBoxA.USER32.dll dlltool however doesn't create an import object but infact has a complete IMAGE_FILE IMPORT_OBJECT[1-N] -> contains an IMAGE_FILE_HEADER and is a full object with SECTIONS the .text section has the stub code. the .idata$6 section has the name of the function it starts with 0x01 0x4D then MessageBoxA without an underscore The dll is not referenced and is assumed to be the one listed in the first object in .idata$6...

After some more digging and creating a few testcases in lld I have narrowed it down to The fact that dlltool generates Contents of section .idata$7: 0000 55534552 33322e64 6c6c0000 USER32.dll.. Where as lld expects Contents of section .idata$6: 0000 55534552 33322e64 6c6c0000 USER32.dll.. I recreated the hello64.test using dlltool for the lib and here is the asm dump of

...t; > IMPORT_OBJECT[1-N] > -> contains an IMPORT_OBJECT_HEADER and DATA > data example -> _MessageBoxA.USER32.dll > > dlltool however doesn't create an import object but infact has a complete > IMAGE_FILE > > IMPORT_OBJECT[1-N] > -> contains an IMAGE_FILE_HEADER and is a full object with SECTIONS > the .text section has the stub code. > the .idata$6 section has the name of the function > it starts with 0x01 0x4D then MessageBoxA without an underscore > The dll is not referenced and is assumed to be the one listed in the > f...