PWORD exported_ordinalsTable = (PWORD)((ULONG64)kernel_module_base + p_export_dir->AddressOfNameOrdinals); PDWORD exported_ordinalsTable = (PDWORD)((ULONG64)kernel_module_base + p_export_dir->AddressOfNameOrdinals);
i was trying to get exported functions from a running .sys kernel driver and while i was trying to figure out why it wasn't functioning right i figured out that in ms docs it said that this should be a PWORD
pointer that points to an array of words now the question is what is the difference between using PWORD
and PDWORD
is it because when using a pointer to an array they should be the same type although i checked the size of both pointers in a x64 bit environment and both of them are the size of bytes. why couldn't i use PDWORD
derf the pointer and cast it to a WORD value and get the data out of it?