I try to debug this code and understand why the exit from the loop occurs at the first iteration, and the value 0 is returned.

WORD GetNumberOfSections (PVOID pMem) { PIMAGE_DOS_HEADER pDOSh; PIMAGE_NT_HEADERS pNTh; PIMAGE_SECTION_HEADER pSECTh; WORD numOfSect = 0; __try { pDOSh = (PIMAGE_DOS_HEADER) pMem; pNTh = (PIMAGE_NT_HEADERS) ((DWORD) pDOSh + pDOSh->e_lfanew); pSECTh = IMAGE_FIRST_SECTION (pNTh); for (WORD i = 0; i < pNTh->FileHeader.NumberOfSections; i++) { if (!pSECTh->PointerToRelocations && !pSECTh->PointerToLinenumbers && !pSECTh->NumberOfRelocations && !pSECTh->NumberOfLinenumbers && pSECTh->Characteristics) numOfSect++; else return numOfSect; pSECTh++; } return numOfSect; } __except (EXCEPTION_EXECUTE_HANDLER) { return 0; } }

I work in VS 2010. Of local variables, only pMem and i are visible. How to make sure that the structures are initialized correctly and see the values ​​of some fields?

  • Did you put a breakpoint on your if then hover your variables? Or what's the problem? Try also to add your structure in debug mode in Watch. - koks_rs
  • I go into the function and trace to the end. In if I hover over the field names, and I don’t see their meanings. In watch, these variables are marked as not found. - typemoon
  • Strange, but now the values ​​have become visible. Then, maybe, someone will tell by the algorithm, why the structure fields in if, which must be zero for executable images, are not equal to it? - typemoon
  • Found a mistake, everything is ok. - typemoon
  • 2
    Fields could not be visible (1) if Auto is turned on in the variable viewport, switch to Local; (2) if compiled in Release mode - as a result of optimization, the "extra" variables are not visible. - nzeemin

0