【发布时间】:2020-10-05 18:14:36
【问题描述】:
我正在尝试让 IMAGE_NT_HEADERS 工作。
为此,我创建了一个这样的结构:
[StructLayout(LayoutKind.Explicit)]
public struct IMAGE_NT_HEADERS64
{
[FieldOffset(0)]
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
public char[] Signature;
//Incorrect aligned error if uncommented
[FieldOffset(4)]
public IMAGE_FILE_HEADER FileHeader;
[FieldOffset(24)]
public IMAGE_OPTIONAL_HEADER64 OptionalHeader;
private string _Signature {
get { return new string(Signature); }
}
public bool isValid {
get { return _Signature == "PE\0\0" && OptionalHeader.Magic == MagicType.IMAGE_NT_OPTIONAL_HDR64_MAGIC; }
}
}
使用这样的 IMAGE_FILE_HEADER 结构:
[StructLayout(LayoutKind.Explicit, Size = 20)]
public struct IMAGE_FILE_HEADER {
[FieldOffset(0)]
public UInt16 Machine;
[FieldOffset(2)]
public UInt16 NumberOfSections;
[FieldOffset(4)]
public UInt32 TimeDateStamp;
[FieldOffset(8)]
public UInt32 PointerToSymbolTable;
[FieldOffset(12)]
public UInt32 NumberOfSymbols;
[FieldOffset(16)]
public UInt16 SizeOfOptionalHeader;
[FieldOffset(18)]
public UInt16 Characteristics;
}
但尝试运行脚本时,我收到以下错误消息:
System.TypeLoadException: 'Could not load type 'IMAGE_NT_HEADERS64' from assembly 'Test, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null' 因为它在偏移量 4 处包含一个对象字段,该对象字段不正确地对齐或重叠一个非对象字段。'
当使用 IMAGE_FILE_HEADER 注释掉代码时,我能够正确编译程序并且一切都按需要加载。但我需要 FileHeaders。
我在这里做错了什么?
【问题讨论】:
-
您设置 size = 20,但您只使用了 18。尝试使用额外的 UInt16
-
但是尺码不是20吗? 4*UInt16 = 4*2 = 8 + 3*UInt32 = 8 + 12 = 20?
-
应该是
[FieldOffset(16)] public UInt16 SizeOfOptionalHeader;和[FieldOffset(18)] public UInt16 Characteristics; -
@viveknuna 谢谢,我也发现了。不幸的是它仍然抛出同样的错误
标签: c#