Skip to content

Access to IMAGE_DATA_DIRECTORY

AFP edited this page Jun 16, 2022 · 1 revision

How to Access the IMAGE_DATA_DIRECTORY structure

after initialize the PE class, accessing Nt Header and Optional Header you can get access the IMAGE_DATA_DIRECTORY structure by calling DataDirectory() method. by calling this function, you get the object of ImageDataDirectory class, so you can retrieve IMAGE_DATA_DIRECTORY fields, changed or modify them.

Note: Every field in ImageDataDirectory class has two overload method. first overload is getter function to just retrieve the specific field and second overload is a setter for change and modify the specific field.

#include <iostream>
#include <POEX.h> // include POEX header

int main()
{
    auto pe = POEX::PE(L"1.exe");

    // Access to Image Nt Header
    auto nt = pe.GetImageNtHeader();

    /// Access to Image Optional Header
    auto oh = nt.OptionalHeader();

    // Access to Data Directories (get all list)
    auto dd = oh.DataDirectory();

    for (size_t i = 0; i < dd.size(); i++)
    {
        // print 'size' field of each data directories
        std::cout << dd[i]->Size() << std::endl;

        // change the value of `size` field
        dd[i]->Size(17233);

        // Print again `size` feild value after changing
        std::cout << dd[i]->Size() << std::endl;
    }

    return 0;
}

List of all available method in ImageDataDirectory class

auto VirtualAddress() const->unsigned int;
auto VirtualAddress(const unsigned int& virtualAddress)->void;

auto Size() const->unsigned int;
auto Size(const unsigned int& size)->void;

Clone this wiki locally