CODEWITHSUNDEEP
cwindowskernelportable-executable
zeroaceee
zeroaceee

Reputation: 79

Having a problem about C pointers and how they work in memory

 PWORD exported_ordinalsTable = (PWORD)((ULONG64)kernel_module_base + p_export_dir->AddressOfNameOrdinals);

 PDWORD exported_ordinalsTable = (PDWORD)((ULONG64)kernel_module_base + p_export_dir->AddressOfNameOrdinals);

i was trying to get exported functions from a running .sys kernel driver and while i was trying to figure out why it wasn't functioning right i figured out that in ms docs it said that this should be a PWORD pointer that points to an array of words now the question is what is the difference between using PWORD and PDWORD is it because when using a pointer to an array they should be the same type although i checked the size of both pointers in a x64 bit environment and both of them are the size of bytes. why couldn't i use PDWORD derf the pointer and cast it to a WORD value and get the data out of it?

Upvotes: 0

Views: 86

Answers (1)

Xypron
Xypron

Reputation: 2483

The size of all pointers is the same 8 bytes on a 64bit system, 4 bytes on a 32bit system. The difference of PWORD and PDWORD is in what they are pointing to.

PWORD points to a WORD. PDWORD points to a DWORD.

Using the correct pointer type avoids illegal accesses, unnecessary casts and ensures that incrementing, decrementing and indexing work correctly.

Upvotes: 2

Related Questions