This repository has been archived by the owner on Jan 17, 2024. It is now read-only.
-
Hello. I have to questions:
typedef struct _TEST_NAME {
// variables
union
{
UCHAR FlagGroup[4];
ULONG Flags;
struct
{
ULONG PackagedBinary : 1;
ULONG MarkedForRemoval : 1;
ULONG ImageDll : 1;
ULONG LoadNotificationsSent : 1;
ULONG TelemetryEntryProcessed : 1;
ULONG ProcessStaticImport : 1;
ULONG InLegacyLists : 1;
ULONG InIndexes : 1;
ULONG ShimDll : 1;
ULONG InExceptionTable : 1;
ULONG ReservedFlags1 : 2;
ULONG LoadInProgress : 1;
ULONG ReservedFlags2 : 1;
ULONG EntryProcessed : 1;
ULONG ReservedFlags3 : 3;
ULONG DontCallForThreads : 1;
ULONG ProcessAttachCalled : 1;
ULONG ProcessAttachFailed : 1;
ULONG CorDeferredValidate : 1;
ULONG CorImage : 1;
ULONG DontRelocate : 1;
ULONG CorILOnly : 1;
ULONG ReservedFlags5 : 3;
ULONG Redirected : 1;
ULONG ReservedFlags6 : 2;
ULONG CompatDatabaseProcessed : 1;
};
};
// variables
} TEST_NAME, PTEST_NAME*; sealed class TEST_NAME extends Struct {
// variables
external _union1 union;
// variables
}
sealed class _union1 extends Union {
@Array(4)
external Array<Uint8> FlagGroup;
@Uint32()
external int Flags;
external _nestedStruct1 nestedStruct;
}
sealed class _nestedStruct1 extends Struct {
// What here? Like this? How do i specify this ": 1"? If i do something like
// "= 1", it shows an error. Do i even need to specify this values?
@Uint32()
external int packagedBinary;
@Uint32()
external int markedForRemoval;
@Uint32()
external int imageDll;
@Uint32()
external int loadNotificationsSent;
@Uint32()
external int telemetryEntryProcessed;
@Uint32()
external int processStaticImport;
@Uint32()
external int inLegacyLists;
@Uint32()
external int inIndexes;
@Uint32()
external int shimDll;
@Uint32()
external int inExceptionTable;
@Uint32()
external int reservedFlags1;
@Uint32()
external int loadInProgress;
@Uint32()
external int reservedFlags2;
@Uint32()
external int entryProcessed;
@Uint32()
external int reservedFlags3;
@Uint32()
external int dontCallForThreads;
@Uint32()
external int processAttachCalled;
@Uint32()
external int processAttachFailed;
@Uint32()
external int corDeferredValidate;
@Uint32()
external int corImage;
@Uint32()
external int dontRelocate;
@Uint32()
external int corILOnly;
@Uint32()
external int reservedFlags5;
@Uint32()
external int redirected;
@Uint32()
external int reservedFlags6;
@Uint32()
external int compatDatabaseProcessed;
}
typedef enum _LDR_DLL_LOAD_REASON
{
LoadReasonStaticDependency,
LoadReasonStaticForwarderDependency,
LoadReasonDynamicForwarderDependency,
LoadReasonDelayloadDependency,
LoadReasonDynamicLoad,
LoadReasonAsImageLoad,
LoadReasonAsDataLoad,
LoadReasonEnclavePrimary, // REDSTONE3
LoadReasonEnclaveDependency,
LoadReasonUnknown = -1
} LDR_DLL_LOAD_REASON, *PLDR_DLL_LOAD_REASON;
typedef struct _TEST_NAME {
// variables
LDR_DLL_LOAD_REASON LoadReason;
ULONG ImplicitPathOptions;
// variables
} |
Beta Was this translation helpful? Give feedback.
Answered by
dcharkes
Sep 7, 2023
Replies: 2 comments 9 replies
-
Hey @kirill-21, have you checked out |
Beta Was this translation helpful? Give feedback.
0 replies
-
I tried, it generated an empty struct) |
Beta Was this translation helpful? Give feedback.
9 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 bytes on x64: https://godbolt.org/z/jn7G33zKP
4 bytes on ia32: https://godbolt.org/z/oxa41jnr1
(You can sum up the bits manually as well 😄 which is precisely 32, but it's probably safer to use
sizeof
to see what the compiler is actually doing.)