Debugging Tools for Windows

ReadImageNtHeaders

The ReadImageNtHeaders method returns the NT headers for the specified image loaded in the target.

HRESULT
  IDebugDataSpaces3::ReadImageNtHeaders(
    IN ULONG64  ImageBase,
    OUT IMAGE_NT_HEADERS64 *  Headers
    );

Parameters

ImageBase
Specifies the location in the target's virtual address space of the image whose NT headers are being requested.
Headers
Receives the NT headers for the specified image.

Return Value

S_OK
The method was successful.
E_INVALIDARG
No NT headers were found for the specified image.

This method can also return error values. See Return Values for more details.

Interface Version

ReadImageNtHeaders is available in IDebugDataSpaces3 and later versions.

Comments

If the image's NT headers are 32-bit, they are automatically converted to 64-bit for consistency. To determine if the headers were originally 32-bit, look at the value of Headers.OptionalHeader.Magic. If the value is IMAGE_NT_OPTIONAL_HDR32_MAGIC, the NT headers were originally 32-bit; otherwise the value is IMAGE_NT_OPTIONAL_HDR64_MAGIC, indicating the NT headers were originally 64-bit.

This method will not read ROM headers.

IMAGE_NT_HEADERS64, IMAGE_NT_OPTIONAL_HDR32_MAGIC, and IMAGE_NT_OPTIONAL_HDR64_MAGIC appear in the Microsoft Windows SDK header file winnt.h. IMAGE_NT_HEADERS64 is the 64-bit equivalent of IMAGE_NT_HEADERS, which is described in the Windows SDK documentation.

Requirements

Headers: Defined in Dbgeng.h. Include Dbgeng.h.

Build machine: CAPEBUILD