Take a look for Why is it said that IMAGE_OPTIONAL_HEADER doesn't have a fixed size?
Why would you compare SizeOfOptionalHeader
instead of using OptionalHeader.Magic
?
because of this comment:
This is stated in the documentation for
IMAGE_OPTIONAL_HEADER32
andIMAGE_OPTIONAL_HEADER64
: "The number of directories is not fixed. Check theNumberOfRvaAndSizes
member before looking for a specific directory." So, while the struct has a fixed size, the header does not
So you shouldn't compare using SizeOfOptionalHeader
, instead comparing by OptionalHeader.Magic
.