Hi friends,
Here is a tool converting DLLs to module definition files. The normal MASM syntax to get info about PE structure :
assume edi:ptr IMAGE_DOS_HEADER
add edi,[edi].e_lfanew
assume edi:ptr IMAGE_NT_HEADERS
mov edi,[edi].OptionalHeader.DataDirectory.VirtualAddress
add edi,hLib
assume edi:ptr IMAGE_EXPORT_DIRECTORY
push [edi].NumberOfNames
pop NameNumb
mov esi,[edi].AddressOfNames
is translated to :
add edi,IMAGE_DOS_HEADER.e_lfanew[edi]
mov edi,IMAGE_NT_HEADERS.OptionalHeader.DataDirectory.VirtualAddress[edi]
add edi,hLib
push IMAGE_EXPORT_DIRECTORY.NumberOfNames[edi]
pop NameNumb
mov esi,IMAGE_EXPORT_DIRECTORY.AddressOfNames[edi]
http://vortex.masmcode.com/files/dll2defV11.zip
Vortex,
That's a good example of addressing structure members with POASM. It's an area I have been having trouble with. Thanks.
Does it work the other way around? ie:
[edi]IMAGE_NT_HEADERS.OptionalHeader.DataDirectory.VirtualAddress
That's only one dot short of MASM syntax (between the [edi] and the rest) and I think it's easier to read. (I never use assume, :eek ick :wink)
Hi Greg,
Thanks for you kind words.
Hi zooba,
The syntax with the leading [edi] doesn't work. You should append [edi] to the end of the line.