Edit

IDebugDataSpaces3::ReadImageNtHeaders method (dbgeng.h)

  • Article

The ReadImageNtHeaders method returns the NT headers for the specified image loaded in the target.

Syntax

HRESULT ReadImageNtHeaders(
  [in]  ULONG64             ImageBase,
  [out] PIMAGE_NT_HEADERS64 Headers
);

Parameters

[in] ImageBase

Specifies the location in the target's virtual address space of the image whose NT headers are being requested.

[out] Headers

Receives the NT headers for the specified image.

Return value

Return code Description
S_OK
 The method was successful.
E_INVALIDARG
 No NT headers were found for the specified image.
 

This method can also return error values. See Return Values for more details.

Remarks

If the image's NT headers are 32-bit, they are automatically converted to 64-bit for consistency. To determine if the headers were originally 32-bit, look at the value of Headers.OptionalHeader.Magic. If the value is IMAGE_NT_OPTIONAL_HDR32_MAGIC, the NT headers were originally 32-bit; otherwise the value is IMAGE_NT_OPTIONAL_HDR64_MAGIC, indicating the NT headers were originally 64-bit.

This method will not read ROM headers.

IMAGE_NT_HEADERS64, IMAGE_NT_OPTIONAL_HDR32_MAGIC, and IMAGE_NT_OPTIONAL_HDR64_MAGIC appear in the Microsoft Windows SDK header file winnt.h. IMAGE_NT_HEADERS64 is the 64-bit equivalent of IMAGE_NT_HEADERS, which is described in the Windows SDK documentation.

Requirements

Requirement Value
Target Platform Desktop
Header dbgeng.h (include Dbgeng.h)