Quantcast
Channel: Active questions tagged kernel - Stack Overflow
Viewing all articles
Browse latest Browse all 6369

Having a problem about C pointers and how they work in memory

$
0
0
 PWORD exported_ordinalsTable = (PWORD)((ULONG64)kernel_module_base + p_export_dir->AddressOfNameOrdinals); PDWORD exported_ordinalsTable = (PDWORD)((ULONG64)kernel_module_base + p_export_dir->AddressOfNameOrdinals);

i was trying to get exported functions from a running .sys kernel driver and while i was trying to figure out why it wasn't functioning right i figured out that in ms docs it said that this should be a PWORD pointer that points to an array of words now the question is what is the difference between using PWORD and PDWORD is it because when using a pointer to an array they should be the same type although i checked the size of both pointers in a x64 bit environment and both of them are the size of bytes. why couldn't i use PDWORD derf the pointer and cast it to a WORD value and get the data out of it?


Viewing all articles
Browse latest Browse all 6369

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>