Where one reads:
typedef struct _RESHDR_BASE_DISK{ULONGLONG ullSize;BYTE sizebytes[7];LARGE_INTEGER liOffset;}
It should actually be read as:
typedef struct _RESHDR_BASE_DISK{BYTE bFlags;BYTE sizebytes[7];LARGE_INTEGER liOffset;}
The only difference is replacing ullSize by bFlags. If you don't, the difference is that a BYTE on this case is only sized in 8 bits whereas ULONGLONG is sized in 64 bits.
If you're trying to read the header from a binary file then you'd be stuck with the wrong results.
I had actually noted this detail over a year ago. Now I was looking at this again and had to spent around two days doing the math and printing the hex dump to see why things were not looking right (and get some grey hairs).
So, now I've decided to write it once for all in the blog so that it won't get forgotten again. If it helped you, do let me know.
Happy Christmas!
:)
I ran into this also. But you have the first two members reversed. If you need to use the data in this struct, it should be:
ReplyDeletetypedef struct _RESHDR_BASE_DISK
{
BYTE sizeBytes[7];
BYTE bFlags;
LARGE_INTEGER liOffset;
} RESHDR_BASE_DISK;
Thank you! :)
ReplyDelete