converting a c++ pointer cast to delphi - delphi

Question

actually i am converting a c++ code to delphi, but i have problem to translate this line
PIMAGE_NT_HEADERS header = (BYTE *)lib + ((PIMAGE_DOS_HEADER)lib)->e_lfanew;
to delphi (this is my result at the moment)
var
lib : THandle;
header : PImageNtHeaders;
begin
//....
//.....
header := Pointer(PByte(lib) + PImageDosHeader(lib)._lfanew);
end;
but the compiler gives me this message operator not applicable to this operand type
can you help me to translate this line.

Answer 1

header := Pointer(Integer(PByte(lib)) + PImageDosHeader(lib)._lfanew);

Answer 2

You might be able to sidestep a lot of this. If you're looking for PE image header routines, look up the ImageHlp unit from the RTL, and the JclPeImage unit from the JCL. They've got lots of prebuilt code to make image and image header header work easier.

Answer 3

the _lfanew member is most likely an offset so it needs to be an integer or DWORD instead of a pointer. Just guessing as I don't use Delhpi but have you tried :-
header := Pointer(PByte(lib) + (DWORD)(PImageDosHeader(lib)._lfanew));
A web search came up with the following : http://www.cheesydoodle.com/?p=175
This code is Delphi based and is using the same library you are. You will most likely find a solution hidden in this code listing on CheesyDoodle.

Answer 4

Pointer arithmetic is much more limited in delphi, and direct addition is not allowed. You'll have to use the Inc function on your pointers.
example(source ):
program PointerArithmetic;
{$APPTYPE CONSOLE}
uses
SysUtils;
procedureWritePointer(P: PDouble);
begin
Writeln(Format('%8p', [P]));
end;
var
P: PDouble;
begin
P := Pointer($50000);
WritePointer(P);
Inc(P); // 00050008 = 00050000 + 1*SizeOf(Double)
WritePointer(P);
Inc(P, 6); // 00050038 = 00050000 + 7*Sizeof(Double)
WritePointer(P);
Dec(P, 4); // 00050018 = 00050000 + 3*Sizeof(Double)
WritePointer(P);
Readln;
end.

Answer 5

What you are working on is called RVA (Relative Virtual Address). Basic formula is
Address = Base + Displacement. Naturally, Address and Base are untyped pointers while Displacement is signed integer. Object Pascal disallows pointer arithmetics, so typecasting is required.
So:
var
Address, Base: Pointer;
Displacement: Integer;
{ ... }
Address := Pointer(Cardinal(Base) + Displacement);
{ or, in your case }
var
Module: HMODULE; { opaque type designates module handle and equals to load address }
NTHeaders: PImageNtHeaders;
begin
NTHeaders := Pointer(Cardinal(Module) + PImageDosHeader(Module)^._lfanew);
if NTHeaders^.Signature = ......

Answer 6

I don't work in Delphi day-to-day, but I suspect the error is due to one of two things:
Pointer math is not enabled. Delphi, by default, does not allow you to to C-style pointer manipulation, eg adding a number to a pointer to get another pointer - remember Delphi is a 'safe' language. To enable this, turn on pointer math using the {$POINTERMATH ON} directive. This forum posting has some more info too.
This is the bit I can't remember because it's been a while: You may not be able to add pointers of different types - remember the size of what the pointer points to is different. Without knowing what _lfanew is I can't give you more information. If this is the case, get everything in bytes and add those.
You may want to use the Inc function too, to convert your code to be more Delphi-like. Inc will increment a typed pointer by the size of the structure that pointer points to, not by one byte. Pointer math generally is not quite C-style :) I think it's better though, since it's type-aware.
Edit: I noticed Martin Broadhurst's comment on your question pointing out this is probably parsing a PE image. If so, look up the Jedi Code Library's PE image unit. I've never used it but I know it exists, and it's a translation of the C headers. It may include helper functions too. Using it might mean rewriting code rather than converting it, but you'll probably get cleaner, more Delphi-style code at the end.