@@ -10,7 +10,7 @@ pub struct LdrDataTableEntry64 {
1010 pub in_initialization_order_links : ListEntry64 ,
1111 pub dll_base : u64 ,
1212 pub entry_point : u64 ,
13- pub size_of_image : u64 ,
13+ pub size_of_image : u32 ,
1414 pub full_dll_name : UnicodeString64 ,
1515 pub base_dll_name : UnicodeString64 ,
1616 pub flags : u32 ,
@@ -56,7 +56,7 @@ impl LdrDataTableEntry64 {
5656 in_initialization_order_links : ListEntry64 :: load ( addr + 0x20 , maps) ,
5757 dll_base : maps. read_qword ( addr + 0x30 ) . unwrap ( ) ,
5858 entry_point : maps. read_qword ( addr + 0x38 ) . unwrap ( ) ,
59- size_of_image : maps. read_qword ( addr + 0x40 ) . unwrap ( ) ,
59+ size_of_image : maps. read_dword ( addr + 0x40 ) . unwrap ( ) , // dword aligned to qword
6060 full_dll_name : UnicodeString64 :: load ( addr + 0x48 , maps) ,
6161 base_dll_name : UnicodeString64 :: load ( addr + 0x58 , maps) ,
6262 flags : maps. read_dword ( addr + 0x68 ) . unwrap ( ) , // cc 22 00 00 c4 a2 00 00 cc a2 c0 00
@@ -73,7 +73,7 @@ impl LdrDataTableEntry64 {
7373 self . in_initialization_order_links . save ( addr + 0x20 , maps) ;
7474 maps. write_qword ( addr + 0x30 , self . dll_base ) ;
7575 maps. write_qword ( addr + 0x38 , self . entry_point ) ;
76- maps. write_qword ( addr + 0x40 , self . size_of_image ) ;
76+ maps. write_dword ( addr + 0x40 , self . size_of_image ) ;
7777 self . full_dll_name . save ( addr + 0x48 , maps) ;
7878 self . base_dll_name . save ( addr + 0x58 , maps) ;
7979 maps. write_dword ( addr + 0x68 , self . flags ) ;
0 commit comments