基础问题求教，关于用地址取结构体数据

[ybblack001]

请教如下面的结构体 注释是自己算的偏移 在XPx86下这么计算对吗？

typedef struct _SYSTEM_PROCESS_INFORMATION {
		ULONG NextEntryOffset;                   //0x00
		ULONG NumberOfThreads;                   //0x04
		LARGE_INTEGER SpareLi1;                  //0x08
		LARGE_INTEGER SpareLi2;                  //0x10
		LARGE_INTEGER SpareLi3;                  //0x18
		LARGE_INTEGER CreateTime;                //0x20
		LARGE_INTEGER UserTime;                  //0x28
		LARGE_INTEGER KernelTime;                //0x30
		UNICODE_STRING ImageName;                //0x38
               ……
}

如果对的话，下面两段是否等价呢？ 其中 SystemInformation 就是 _SYSTEM_PROCESS_INFORMATION 结构体

PUNICODE_STRING pName = (PUNICODE_STRING)((DWORD)SystemInformation+ 0x38);
DbgPrint("%wZ/n",pName);

DbgPrint("%wZ/n",&(pCurrProcessInfo->ImageName));

我现在用下面的可以得到正确结果，但是用面的代码就不行

[ybblack001]

晕，自己解决了。 偏移是0x38没错

[赵4老师]

仅供参考：

#include <stdio.h>
#define field_offset(s,f) (int)(&(((struct s *)(0))->f))
struct AD  { int a; char b[13]; double c;};
#pragma pack(push)
#pragma pack(1)
struct A1  { int a; char b[13]; double c;};
#pragma pack(2)
struct A2  { int a; char b[13]; double c;};
#pragma pack(4)
struct A4  { int a; char b[13]; double c;};
#pragma pack(8)
struct A8  { int a; char b[13]; double c;};
#pragma pack(16)
struct A16 { int a; char b[13]; double c;};
#pragma pack(pop)
int main() {
    printf("AD.a %d\n",field_offset(AD,a));
    printf("AD.b %d\n",field_offset(AD,b));
    printf("AD.c %d\n",field_offset(AD,c));
    printf("\n");
    printf("A1.a %d\n",field_offset(A1,a));
    printf("A1.b %d\n",field_offset(A1,b));
    printf("A1.c %d\n",field_offset(A1,c));
    printf("\n");
    printf("A2.a %d\n",field_offset(A2,a));
    printf("A2.b %d\n",field_offset(A2,b));
    printf("A2.c %d\n",field_offset(A2,c));
    printf("\n");
    printf("A4.a %d\n",field_offset(A4,a));
    printf("A4.b %d\n",field_offset(A4,b));
    printf("A4.c %d\n",field_offset(A4,c));
    printf("\n");
    printf("A8.a %d\n",field_offset(A8,a));
    printf("A8.b %d\n",field_offset(A8,b));
    printf("A8.c %d\n",field_offset(A8,c));
    printf("\n");
    printf("A16.a %d\n",field_offset(A16,a));
    printf("A16.b %d\n",field_offset(A16,b));
    printf("A16.c %d\n",field_offset(A16,c));
    printf("\n");
    return 0;
}
//AD.a 0
//AD.b 4
//AD.c 24
//
//A1.a 0
//A1.b 4
//A1.c 17
//
//A2.a 0
//A2.b 4
//A2.c 18
//
//A4.a 0
//A4.b 4
//A4.c 20
//
//A8.a 0
//A8.b 4
//A8.c 24
//
//A16.a 0
//A16.b 4
//A16.c 24
//
//

[BurnellLiu]

LARGE_INTEGER为64位整数

typedef struct _SYSTEM_PROCESS_INFORMATION {
        ULONG NextEntryOffset;                   //0x00
        ULONG NumberOfThreads;                   //0x04
        LARGE_INTEGER SpareLi1;                  //0x08
        LARGE_INTEGER SpareLi2;                  //0x16
        LARGE_INTEGER SpareLi3;                  //0x24
        LARGE_INTEGER CreateTime;                //0x32
        LARGE_INTEGER UserTime;                  //0x40
        LARGE_INTEGER KernelTime;                //0x48
        UNICODE_STRING ImageName;                //0x56
               ……
}

[ybblack001]

引用 2 楼 TheOne_jie 的回复:

LARGE_INTEGER为64位整数

typedef struct _SYSTEM_PROCESS_INFORMATION {
        ULONG NextEntryOffset;                   //0x00
        ULONG NumberOfThreads;                   //0x04
        LARGE_INTEGER SpareLi1;                  //0x08
        LARGE_INTEGER SpareLi2;                  //0x16
        LARGE_INTEGER SpareLi3;                  //0x24
        LARGE_INTEGER CreateTime;                //0x32
        LARGE_INTEGER UserTime;                  //0x40
        LARGE_INTEGER KernelTime;                //0x48
        UNICODE_STRING ImageName;                //0x56
               ……
}

可是将下面改成0x56依然不对 还是蓝屏