[2] | 1 | /* $Id: pe.h 92 2016-09-08 15:31:37Z bird $ */
|
---|
| 2 | /** @file
|
---|
| 3 | * PE structures, types and defines.
|
---|
| 4 | */
|
---|
| 5 |
|
---|
[31] | 6 | /*
|
---|
| 7 | * Copyright (c) 2006-2007 Knut St. Osmundsen <bird-kStuff-spamix@anduin.net>
|
---|
| 8 | *
|
---|
| 9 | * Permission is hereby granted, free of charge, to any person
|
---|
| 10 | * obtaining a copy of this software and associated documentation
|
---|
| 11 | * files (the "Software"), to deal in the Software without
|
---|
| 12 | * restriction, including without limitation the rights to use,
|
---|
| 13 | * copy, modify, merge, publish, distribute, sublicense, and/or sell
|
---|
| 14 | * copies of the Software, and to permit persons to whom the
|
---|
| 15 | * Software is furnished to do so, subject to the following
|
---|
| 16 | * conditions:
|
---|
| 17 | *
|
---|
| 18 | * The above copyright notice and this permission notice shall be
|
---|
| 19 | * included in all copies or substantial portions of the Software.
|
---|
| 20 | *
|
---|
| 21 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
---|
| 22 | * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
|
---|
| 23 | * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
---|
| 24 | * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
|
---|
| 25 | * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
---|
| 26 | * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
---|
| 27 | * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
---|
| 28 | * OTHER DEALINGS IN THE SOFTWARE.
|
---|
| 29 | */
|
---|
| 30 |
|
---|
[2] | 31 | #ifndef ___k_kLdrFmts_pe_h___
|
---|
| 32 | #define ___k_kLdrFmts_pe_h___
|
---|
| 33 |
|
---|
| 34 |
|
---|
| 35 | /*******************************************************************************
|
---|
| 36 | * Header Files *
|
---|
| 37 | *******************************************************************************/
|
---|
| 38 | #include <k/kTypes.h>
|
---|
| 39 | #include <k/kDefs.h>
|
---|
| 40 |
|
---|
| 41 |
|
---|
| 42 | /*******************************************************************************
|
---|
| 43 | * Defined Constants And Macros *
|
---|
| 44 | *******************************************************************************/
|
---|
| 45 | #ifndef IMAGE_NT_SIGNATURE
|
---|
| 46 | # define IMAGE_NT_SIGNATURE K_LE2H_U32('P' | ('E' << 8))
|
---|
| 47 | #endif
|
---|
| 48 |
|
---|
| 49 | /* file header */
|
---|
[92] | 50 | #define IMAGE_FILE_MACHINE_UNKNOWN 0x0000
|
---|
[2] | 51 | #define IMAGE_FILE_MACHINE_I386 0x014c
|
---|
| 52 | #define IMAGE_FILE_MACHINE_AMD64 0x8664
|
---|
[92] | 53 | #define IMAGE_FILE_MACHINE_ARM 0x01c0
|
---|
| 54 | #define IMAGE_FILE_MACHINE_ARMNT 0x01c4
|
---|
| 55 | #define IMAGE_FILE_MACHINE_ARM64 0xaa64
|
---|
| 56 | #define IMAGE_FILE_MACHINE_EBC 0x0ebc
|
---|
[2] | 57 |
|
---|
| 58 | #define IMAGE_FILE_RELOCS_STRIPPED 0x0001
|
---|
| 59 | #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002
|
---|
| 60 | #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004
|
---|
| 61 | #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008
|
---|
| 62 | #define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010
|
---|
| 63 | #define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020
|
---|
| 64 | #define IMAGE_FILE_16BIT_MACHINE 0x0040
|
---|
| 65 | #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080
|
---|
| 66 | #define IMAGE_FILE_32BIT_MACHINE 0x0100
|
---|
| 67 | #define IMAGE_FILE_DEBUG_STRIPPED 0x0200
|
---|
| 68 | #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400
|
---|
| 69 | #define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800
|
---|
| 70 | #define IMAGE_FILE_SYSTEM 0x1000
|
---|
| 71 | #define IMAGE_FILE_DLL 0x2000
|
---|
| 72 | #define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000
|
---|
| 73 | #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000
|
---|
| 74 |
|
---|
[92] | 75 | /** Raw UUID byte for the ANON_OBJECT_HEADER_BIGOBJ::ClassID value.
|
---|
| 76 | * These make out {d1baa1c7-baee-4ba9-af20-faf66aa4dcb8}. */
|
---|
| 77 | #define ANON_OBJECT_HEADER_BIGOBJ_CLS_ID_BYTES \
|
---|
| 78 | 0xc7, 0xa1, 0xba, 0xd1,/*-*/ 0xee, 0xba,/*-*/ 0xa9, 0x4b,/*-*/ 0xaf, 0x20,/*-*/ 0xfa, 0xf6, 0x6a, 0xa4, 0xdc, 0xb8
|
---|
[2] | 79 |
|
---|
| 80 | /* optional header */
|
---|
| 81 | #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10B
|
---|
| 82 | #define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20B
|
---|
| 83 |
|
---|
| 84 | #define IMAGE_SUBSYSTEM_UNKNOWN 0x0
|
---|
| 85 | #define IMAGE_SUBSYSTEM_NATIVE 0x1
|
---|
| 86 | #define IMAGE_SUBSYSTEM_WINDOWS_GUI 0x2
|
---|
| 87 | #define IMAGE_SUBSYSTEM_WINDOWS_CUI 0x3
|
---|
| 88 | #define IMAGE_SUBSYSTEM_OS2_GUI 0x4
|
---|
| 89 | #define IMAGE_SUBSYSTEM_OS2_CUI 0x5
|
---|
| 90 | #define IMAGE_SUBSYSTEM_POSIX_CUI 0x7
|
---|
| 91 |
|
---|
| 92 | #define IMAGE_LIBRARY_PROCESS_INIT 0x0001
|
---|
| 93 | #define IMAGE_LIBRARY_PROCESS_TERM 0x0002
|
---|
| 94 | #define IMAGE_LIBRARY_THREAD_INIT 0x0004
|
---|
| 95 | #define IMAGE_LIBRARY_THREAD_TERM 0x0008
|
---|
| 96 | #define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200
|
---|
| 97 | #define IMAGE_DLLCHARACTERISTICS_NO_SEH 0x0400
|
---|
| 98 | #define IMAGE_DLLCHARACTERISTICS_NO_BIND 0x0800
|
---|
| 99 | #define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER 0x2000
|
---|
| 100 | #define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000
|
---|
| 101 |
|
---|
| 102 | #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 0x10
|
---|
| 103 |
|
---|
| 104 | #define IMAGE_DIRECTORY_ENTRY_EXPORT 0x0
|
---|
| 105 | #define IMAGE_DIRECTORY_ENTRY_IMPORT 0x1
|
---|
| 106 | #define IMAGE_DIRECTORY_ENTRY_RESOURCE 0x2
|
---|
| 107 | #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x3
|
---|
| 108 | #define IMAGE_DIRECTORY_ENTRY_SECURITY 0x4
|
---|
| 109 | #define IMAGE_DIRECTORY_ENTRY_BASERELOC 0x5
|
---|
| 110 | #define IMAGE_DIRECTORY_ENTRY_DEBUG 0x6
|
---|
| 111 | #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 0x7
|
---|
| 112 | #define IMAGE_DIRECTORY_ENTRY_COPYRIGHT IMAGE_DIRECTORY_ENTRY_ARCHITECTURE
|
---|
| 113 | #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x8
|
---|
| 114 | #define IMAGE_DIRECTORY_ENTRY_TLS 0x9
|
---|
| 115 | #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0xa
|
---|
| 116 | #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0xb
|
---|
| 117 | #define IMAGE_DIRECTORY_ENTRY_IAT 0xc
|
---|
| 118 | #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0xd
|
---|
| 119 | #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0xe
|
---|
| 120 |
|
---|
| 121 |
|
---|
| 122 | /* section header */
|
---|
| 123 | #define IMAGE_SIZEOF_SHORT_NAME 0x8
|
---|
| 124 |
|
---|
| 125 | #define IMAGE_SCN_TYPE_REG 0x00000000
|
---|
| 126 | #define IMAGE_SCN_TYPE_DSECT 0x00000001
|
---|
| 127 | #define IMAGE_SCN_TYPE_NOLOAD 0x00000002
|
---|
| 128 | #define IMAGE_SCN_TYPE_GROUP 0x00000004
|
---|
| 129 | #define IMAGE_SCN_TYPE_NO_PAD 0x00000008
|
---|
| 130 | #define IMAGE_SCN_TYPE_COPY 0x00000010
|
---|
| 131 |
|
---|
| 132 | #define IMAGE_SCN_CNT_CODE 0x00000020
|
---|
| 133 | #define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040
|
---|
| 134 | #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080
|
---|
| 135 |
|
---|
| 136 | #define IMAGE_SCN_LNK_OTHER 0x00000100
|
---|
| 137 | #define IMAGE_SCN_LNK_INFO 0x00000200
|
---|
| 138 | #define IMAGE_SCN_TYPE_OVER 0x00000400
|
---|
| 139 | #define IMAGE_SCN_LNK_REMOVE 0x00000800
|
---|
| 140 | #define IMAGE_SCN_LNK_COMDAT 0x00001000
|
---|
| 141 | #define IMAGE_SCN_MEM_PROTECTED 0x00004000
|
---|
| 142 | #define IMAGE_SCN_NO_DEFER_SPEC_EXC 0x00004000
|
---|
| 143 | #define IMAGE_SCN_GPREL 0x00008000
|
---|
| 144 | #define IMAGE_SCN_MEM_FARDATA 0x00008000
|
---|
| 145 | #define IMAGE_SCN_MEM_SYSHEAP 0x00010000
|
---|
| 146 | #define IMAGE_SCN_MEM_PURGEABLE 0x00020000
|
---|
| 147 | #define IMAGE_SCN_MEM_16BIT 0x00020000
|
---|
| 148 | #define IMAGE_SCN_MEM_LOCKED 0x00040000
|
---|
| 149 | #define IMAGE_SCN_MEM_PRELOAD 0x00080000
|
---|
| 150 |
|
---|
| 151 | #define IMAGE_SCN_ALIGN_1BYTES 0x00100000
|
---|
| 152 | #define IMAGE_SCN_ALIGN_2BYTES 0x00200000
|
---|
| 153 | #define IMAGE_SCN_ALIGN_4BYTES 0x00300000
|
---|
| 154 | #define IMAGE_SCN_ALIGN_8BYTES 0x00400000
|
---|
| 155 | #define IMAGE_SCN_ALIGN_16BYTES 0x00500000
|
---|
| 156 | #define IMAGE_SCN_ALIGN_32BYTES 0x00600000
|
---|
| 157 | #define IMAGE_SCN_ALIGN_64BYTES 0x00700000
|
---|
| 158 | #define IMAGE_SCN_ALIGN_128BYTES 0x00800000
|
---|
| 159 | #define IMAGE_SCN_ALIGN_256BYTES 0x00900000
|
---|
| 160 | #define IMAGE_SCN_ALIGN_512BYTES 0x00A00000
|
---|
| 161 | #define IMAGE_SCN_ALIGN_1024BYTES 0x00B00000
|
---|
| 162 | #define IMAGE_SCN_ALIGN_2048BYTES 0x00C00000
|
---|
| 163 | #define IMAGE_SCN_ALIGN_4096BYTES 0x00D00000
|
---|
| 164 | #define IMAGE_SCN_ALIGN_8192BYTES 0x00E00000
|
---|
| 165 | #define IMAGE_SCN_ALIGN_MASK 0x00F00000
|
---|
| 166 |
|
---|
| 167 | #define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000
|
---|
| 168 | #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
|
---|
| 169 | #define IMAGE_SCN_MEM_NOT_CACHED 0x04000000
|
---|
| 170 | #define IMAGE_SCN_MEM_NOT_PAGED 0x08000000
|
---|
| 171 | #define IMAGE_SCN_MEM_SHARED 0x10000000
|
---|
| 172 | #define IMAGE_SCN_MEM_EXECUTE 0x20000000
|
---|
| 173 | #define IMAGE_SCN_MEM_READ 0x40000000
|
---|
| 174 | #define IMAGE_SCN_MEM_WRITE 0x80000000
|
---|
| 175 |
|
---|
| 176 |
|
---|
| 177 | /* relocations */
|
---|
| 178 | #define IMAGE_REL_BASED_ABSOLUTE 0x0
|
---|
| 179 | #define IMAGE_REL_BASED_HIGH 0x1
|
---|
| 180 | #define IMAGE_REL_BASED_LOW 0x2
|
---|
| 181 | #define IMAGE_REL_BASED_HIGHLOW 0x3
|
---|
| 182 | #define IMAGE_REL_BASED_HIGHADJ 0x4
|
---|
| 183 | #define IMAGE_REL_BASED_MIPS_JMPADDR 0x5
|
---|
| 184 | #define IMAGE_REL_BASED_SECTION 0x6
|
---|
| 185 | #define IMAGE_REL_BASED_REL32 0x7
|
---|
| 186 | /*#define IMAGE_REL_BASED_RESERVED1 0x8 */
|
---|
| 187 | #define IMAGE_REL_BASED_MIPS_JMPADDR16 0x9
|
---|
| 188 | #define IMAGE_REL_BASED_IA64_IMM64 0x9
|
---|
| 189 | #define IMAGE_REL_BASED_DIR64 0xa
|
---|
| 190 | #define IMAGE_REL_BASED_HIGH3ADJ 0xb
|
---|
| 191 |
|
---|
| 192 | /* imports */
|
---|
| 193 | #define IMAGE_ORDINAL_FLAG32 0x80000000
|
---|
| 194 | #define IMAGE_ORDINAL32(ord) ((ord) & 0xffff)
|
---|
| 195 | #define IMAGE_SNAP_BY_ORDINAL32(ord) (!!((ord) & IMAGE_ORDINAL_FLAG32))
|
---|
| 196 |
|
---|
| 197 | #define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL
|
---|
| 198 | #define IMAGE_ORDINAL64(ord) ((ord) & 0xffff)
|
---|
| 199 | #define IMAGE_SNAP_BY_ORDINAL64(ord) (!!((ord) & IMAGE_ORDINAL_FLAG64))
|
---|
| 200 |
|
---|
| 201 |
|
---|
| 202 | /* dll/tls entry points argument */
|
---|
| 203 | #define DLL_PROCESS_DETACH 0
|
---|
| 204 | #define DLL_PROCESS_ATTACH 1
|
---|
| 205 | #define DLL_THREAD_ATTACH 2
|
---|
| 206 | #define DLL_THREAD_DETACH 3
|
---|
| 207 |
|
---|
| 208 |
|
---|
| 209 | /*******************************************************************************
|
---|
| 210 | * Structures and Typedefs *
|
---|
| 211 | *******************************************************************************/
|
---|
| 212 | #pragma pack(4)
|
---|
| 213 |
|
---|
| 214 | typedef struct _IMAGE_FILE_HEADER
|
---|
| 215 | {
|
---|
| 216 | KU16 Machine;
|
---|
| 217 | KU16 NumberOfSections;
|
---|
| 218 | KU32 TimeDateStamp;
|
---|
| 219 | KU32 PointerToSymbolTable;
|
---|
| 220 | KU32 NumberOfSymbols;
|
---|
| 221 | KU16 SizeOfOptionalHeader;
|
---|
| 222 | KU16 Characteristics;
|
---|
| 223 | } IMAGE_FILE_HEADER;
|
---|
| 224 | typedef IMAGE_FILE_HEADER *PIMAGE_FILE_HEADER;
|
---|
| 225 |
|
---|
| 226 |
|
---|
[92] | 227 | typedef struct _ANON_OBJECT_HEADER
|
---|
| 228 | {
|
---|
| 229 | KU16 Sig1;
|
---|
| 230 | KU16 Sig2;
|
---|
| 231 | KU16 Version; /**< >= 1 */
|
---|
| 232 | KU16 Machine;
|
---|
| 233 | KU32 TimeDataStamp;
|
---|
| 234 | KU8 ClassID[16];
|
---|
| 235 | KU32 SizeOfData;
|
---|
| 236 | } ANON_OBJECT_HEADER;
|
---|
| 237 | typedef ANON_OBJECT_HEADER *PANON_OBJECT_HEADER;
|
---|
| 238 |
|
---|
| 239 |
|
---|
| 240 | typedef struct _ANON_OBJECT_HEADER_V2
|
---|
| 241 | {
|
---|
| 242 | KU16 Sig1;
|
---|
| 243 | KU16 Sig2;
|
---|
| 244 | KU16 Version; /**< >= 2 */
|
---|
| 245 | KU16 Machine;
|
---|
| 246 | KU32 TimeDataStamp;
|
---|
| 247 | KU8 ClassID[16];
|
---|
| 248 | KU32 SizeOfData;
|
---|
| 249 | /* New fields for Version >= 2: */
|
---|
| 250 | KU32 Flags;
|
---|
| 251 | KU32 MetaDataSize; /**< CLR metadata */
|
---|
| 252 | KU32 MetaDataOffset;
|
---|
| 253 | } ANON_OBJECT_HEADER_V2;
|
---|
| 254 | typedef ANON_OBJECT_HEADER_V2 *PANON_OBJECT_HEADER_V2;
|
---|
| 255 |
|
---|
| 256 |
|
---|
| 257 | typedef struct _ANON_OBJECT_HEADER_BIGOBJ
|
---|
| 258 | {
|
---|
| 259 | KU16 Sig1;
|
---|
| 260 | KU16 Sig2;
|
---|
| 261 | KU16 Version; /**< >= 2 */
|
---|
| 262 | KU16 Machine;
|
---|
| 263 | KU32 TimeDataStamp;
|
---|
| 264 | KU8 ClassID[16]; /**< ANON_OBJECT_HEADER_BIGOBJ_CLS_ID_BYTES */
|
---|
| 265 | KU32 SizeOfData;
|
---|
| 266 | /* New fields for Version >= 2: */
|
---|
| 267 | KU32 Flags;
|
---|
| 268 | KU32 MetaDataSize; /**< CLR metadata */
|
---|
| 269 | KU32 MetaDataOffset;
|
---|
| 270 | /* Specific for bigobj: */
|
---|
| 271 | KU32 NumberOfSections;
|
---|
| 272 | KU32 PointerToSymbolTable;
|
---|
| 273 | KU32 NumberOfSymbols;
|
---|
| 274 | } ANON_OBJECT_HEADER_BIGOBJ;
|
---|
| 275 | typedef ANON_OBJECT_HEADER_BIGOBJ *PANON_OBJECT_HEADER_BIGOBJ;
|
---|
| 276 |
|
---|
| 277 |
|
---|
[2] | 278 | typedef struct _IMAGE_DATA_DIRECTORY
|
---|
| 279 | {
|
---|
| 280 | KU32 VirtualAddress;
|
---|
| 281 | KU32 Size;
|
---|
| 282 | } IMAGE_DATA_DIRECTORY;
|
---|
| 283 | typedef IMAGE_DATA_DIRECTORY *PIMAGE_DATA_DIRECTORY;
|
---|
| 284 |
|
---|
| 285 |
|
---|
| 286 | typedef struct _IMAGE_OPTIONAL_HEADER32
|
---|
| 287 | {
|
---|
| 288 | KU16 Magic;
|
---|
| 289 | KU8 MajorLinkerVersion;
|
---|
| 290 | KU8 MinorLinkerVersion;
|
---|
| 291 | KU32 SizeOfCode;
|
---|
| 292 | KU32 SizeOfInitializedData;
|
---|
| 293 | KU32 SizeOfUninitializedData;
|
---|
| 294 | KU32 AddressOfEntryPoint;
|
---|
| 295 | KU32 BaseOfCode;
|
---|
| 296 | KU32 BaseOfData;
|
---|
| 297 | KU32 ImageBase;
|
---|
| 298 | KU32 SectionAlignment;
|
---|
| 299 | KU32 FileAlignment;
|
---|
| 300 | KU16 MajorOperatingSystemVersion;
|
---|
| 301 | KU16 MinorOperatingSystemVersion;
|
---|
| 302 | KU16 MajorImageVersion;
|
---|
| 303 | KU16 MinorImageVersion;
|
---|
| 304 | KU16 MajorSubsystemVersion;
|
---|
| 305 | KU16 MinorSubsystemVersion;
|
---|
| 306 | KU32 Win32VersionValue;
|
---|
| 307 | KU32 SizeOfImage;
|
---|
| 308 | KU32 SizeOfHeaders;
|
---|
| 309 | KU32 CheckSum;
|
---|
| 310 | KU16 Subsystem;
|
---|
| 311 | KU16 DllCharacteristics;
|
---|
| 312 | KU32 SizeOfStackReserve;
|
---|
| 313 | KU32 SizeOfStackCommit;
|
---|
| 314 | KU32 SizeOfHeapReserve;
|
---|
| 315 | KU32 SizeOfHeapCommit;
|
---|
| 316 | KU32 LoaderFlags;
|
---|
| 317 | KU32 NumberOfRvaAndSizes;
|
---|
| 318 | IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
|
---|
| 319 | } IMAGE_OPTIONAL_HEADER32;
|
---|
| 320 | typedef IMAGE_OPTIONAL_HEADER32 *PIMAGE_OPTIONAL_HEADER32;
|
---|
| 321 |
|
---|
| 322 | typedef struct _IMAGE_OPTIONAL_HEADER64
|
---|
| 323 | {
|
---|
| 324 | KU16 Magic;
|
---|
| 325 | KU8 MajorLinkerVersion;
|
---|
| 326 | KU8 MinorLinkerVersion;
|
---|
| 327 | KU32 SizeOfCode;
|
---|
| 328 | KU32 SizeOfInitializedData;
|
---|
| 329 | KU32 SizeOfUninitializedData;
|
---|
| 330 | KU32 AddressOfEntryPoint;
|
---|
| 331 | KU32 BaseOfCode;
|
---|
| 332 | KU64 ImageBase;
|
---|
| 333 | KU32 SectionAlignment;
|
---|
| 334 | KU32 FileAlignment;
|
---|
| 335 | KU16 MajorOperatingSystemVersion;
|
---|
| 336 | KU16 MinorOperatingSystemVersion;
|
---|
| 337 | KU16 MajorImageVersion;
|
---|
| 338 | KU16 MinorImageVersion;
|
---|
| 339 | KU16 MajorSubsystemVersion;
|
---|
| 340 | KU16 MinorSubsystemVersion;
|
---|
| 341 | KU32 Win32VersionValue;
|
---|
| 342 | KU32 SizeOfImage;
|
---|
| 343 | KU32 SizeOfHeaders;
|
---|
| 344 | KU32 CheckSum;
|
---|
| 345 | KU16 Subsystem;
|
---|
| 346 | KU16 DllCharacteristics;
|
---|
| 347 | KU64 SizeOfStackReserve;
|
---|
| 348 | KU64 SizeOfStackCommit;
|
---|
| 349 | KU64 SizeOfHeapReserve;
|
---|
| 350 | KU64 SizeOfHeapCommit;
|
---|
| 351 | KU32 LoaderFlags;
|
---|
| 352 | KU32 NumberOfRvaAndSizes;
|
---|
| 353 | IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
|
---|
| 354 | } IMAGE_OPTIONAL_HEADER64;
|
---|
| 355 | typedef IMAGE_OPTIONAL_HEADER64 *PIMAGE_OPTIONAL_HEADER64;
|
---|
| 356 |
|
---|
| 357 |
|
---|
| 358 | typedef struct _IMAGE_NT_HEADERS
|
---|
| 359 | {
|
---|
| 360 | KU32 Signature;
|
---|
| 361 | IMAGE_FILE_HEADER FileHeader;
|
---|
| 362 | IMAGE_OPTIONAL_HEADER32 OptionalHeader;
|
---|
| 363 | } IMAGE_NT_HEADERS32;
|
---|
| 364 | typedef IMAGE_NT_HEADERS32 *PIMAGE_NT_HEADERS32;
|
---|
| 365 |
|
---|
| 366 | typedef struct _IMAGE_NT_HEADERS64
|
---|
| 367 | {
|
---|
| 368 | KU32 Signature;
|
---|
| 369 | IMAGE_FILE_HEADER FileHeader;
|
---|
| 370 | IMAGE_OPTIONAL_HEADER64 OptionalHeader;
|
---|
| 371 | } IMAGE_NT_HEADERS64;
|
---|
| 372 | typedef IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
|
---|
| 373 |
|
---|
| 374 |
|
---|
| 375 | typedef struct _IMAGE_SECTION_HEADER
|
---|
| 376 | {
|
---|
| 377 | KU8 Name[IMAGE_SIZEOF_SHORT_NAME];
|
---|
| 378 | union
|
---|
| 379 | {
|
---|
| 380 | KU32 PhysicalAddress;
|
---|
| 381 | KU32 VirtualSize;
|
---|
| 382 | } Misc;
|
---|
| 383 | KU32 VirtualAddress;
|
---|
| 384 | KU32 SizeOfRawData;
|
---|
| 385 | KU32 PointerToRawData;
|
---|
| 386 | KU32 PointerToRelocations;
|
---|
| 387 | KU32 PointerToLinenumbers;
|
---|
| 388 | KU16 NumberOfRelocations;
|
---|
| 389 | KU16 NumberOfLinenumbers;
|
---|
| 390 | KU32 Characteristics;
|
---|
| 391 | } IMAGE_SECTION_HEADER;
|
---|
| 392 | typedef IMAGE_SECTION_HEADER *PIMAGE_SECTION_HEADER;
|
---|
| 393 |
|
---|
| 394 |
|
---|
| 395 | typedef struct _IMAGE_BASE_RELOCATION
|
---|
| 396 | {
|
---|
| 397 | KU32 VirtualAddress;
|
---|
| 398 | KU32 SizeOfBlock;
|
---|
| 399 | } IMAGE_BASE_RELOCATION;
|
---|
| 400 | typedef IMAGE_BASE_RELOCATION *PIMAGE_BASE_RELOCATION;
|
---|
| 401 |
|
---|
| 402 |
|
---|
| 403 | typedef struct _IMAGE_EXPORT_DIRECTORY
|
---|
| 404 | {
|
---|
| 405 | KU32 Characteristics;
|
---|
| 406 | KU32 TimeDateStamp;
|
---|
| 407 | KU16 MajorVersion;
|
---|
| 408 | KU16 MinorVersion;
|
---|
| 409 | KU32 Name;
|
---|
| 410 | KU32 Base;
|
---|
| 411 | KU32 NumberOfFunctions;
|
---|
| 412 | KU32 NumberOfNames;
|
---|
| 413 | KU32 AddressOfFunctions;
|
---|
| 414 | KU32 AddressOfNames;
|
---|
| 415 | KU32 AddressOfNameOrdinals;
|
---|
| 416 | } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
|
---|
| 417 |
|
---|
| 418 |
|
---|
| 419 | typedef struct _IMAGE_IMPORT_DESCRIPTOR
|
---|
| 420 | {
|
---|
| 421 | union
|
---|
| 422 | {
|
---|
| 423 | KU32 Characteristics;
|
---|
| 424 | KU32 OriginalFirstThunk;
|
---|
| 425 | } u;
|
---|
| 426 | KU32 TimeDateStamp;
|
---|
| 427 | KU32 ForwarderChain;
|
---|
| 428 | KU32 Name;
|
---|
| 429 | KU32 FirstThunk;
|
---|
| 430 | } IMAGE_IMPORT_DESCRIPTOR;
|
---|
| 431 | typedef IMAGE_IMPORT_DESCRIPTOR *PIMAGE_IMPORT_DESCRIPTOR;
|
---|
| 432 |
|
---|
| 433 |
|
---|
| 434 | typedef struct _IMAGE_IMPORT_BY_NAME
|
---|
| 435 | {
|
---|
| 436 | KU16 Hint;
|
---|
[82] | 437 | KU8 Name[1];
|
---|
[2] | 438 | } IMAGE_IMPORT_BY_NAME;
|
---|
| 439 | typedef IMAGE_IMPORT_BY_NAME *PIMAGE_IMPORT_BY_NAME;
|
---|
| 440 |
|
---|
| 441 |
|
---|
| 442 | /* The image_thunk_data32/64 structures are not very helpful except for getting RSI. keep them around till all the code has been converted. */
|
---|
| 443 | typedef struct _IMAGE_THUNK_DATA64
|
---|
| 444 | {
|
---|
| 445 | union
|
---|
| 446 | {
|
---|
| 447 | KU64 ForwarderString;
|
---|
| 448 | KU64 Function;
|
---|
| 449 | KU64 Ordinal;
|
---|
| 450 | KU64 AddressOfData;
|
---|
| 451 | } u1;
|
---|
| 452 | } IMAGE_THUNK_DATA64;
|
---|
| 453 | typedef IMAGE_THUNK_DATA64 *PIMAGE_THUNK_DATA64;
|
---|
| 454 |
|
---|
| 455 | typedef struct _IMAGE_THUNK_DATA32
|
---|
| 456 | {
|
---|
| 457 | union
|
---|
| 458 | {
|
---|
| 459 | KU32 ForwarderString;
|
---|
| 460 | KU32 Function;
|
---|
| 461 | KU32 Ordinal;
|
---|
| 462 | KU32 AddressOfData;
|
---|
| 463 | } u1;
|
---|
| 464 | } IMAGE_THUNK_DATA32;
|
---|
| 465 | typedef IMAGE_THUNK_DATA32 *PIMAGE_THUNK_DATA32;
|
---|
| 466 |
|
---|
| 467 |
|
---|
| 468 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32
|
---|
| 469 | {
|
---|
| 470 | KU32 Size;
|
---|
| 471 | KU32 TimeDateStamp;
|
---|
| 472 | KU16 MajorVersion;
|
---|
| 473 | KU16 MinorVersion;
|
---|
| 474 | KU32 GlobalFlagsClear;
|
---|
| 475 | KU32 GlobalFlagsSet;
|
---|
| 476 | KU32 CriticalSectionDefaultTimeout;
|
---|
| 477 | KU32 DeCommitFreeBlockThreshold;
|
---|
| 478 | KU32 DeCommitTotalFreeThreshold;
|
---|
| 479 | KU32 LockPrefixTable;
|
---|
| 480 | KU32 MaximumAllocationSize;
|
---|
| 481 | KU32 VirtualMemoryThreshold;
|
---|
| 482 | KU32 ProcessHeapFlags;
|
---|
| 483 | KU32 ProcessAffinityMask;
|
---|
| 484 | KU16 CSDVersion;
|
---|
| 485 | KU16 Reserved1;
|
---|
| 486 | KU32 EditList;
|
---|
| 487 | KU32 SecurityCookie;
|
---|
| 488 | KU32 SEHandlerTable;
|
---|
| 489 | KU32 SEHandlerCount;
|
---|
| 490 | } IMAGE_LOAD_CONFIG_DIRECTORY32;
|
---|
| 491 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32 PIMAGE_LOAD_CONFIG_DIRECTORY32;
|
---|
| 492 |
|
---|
| 493 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64
|
---|
| 494 | {
|
---|
| 495 | KU32 Size;
|
---|
| 496 | KU32 TimeDateStamp;
|
---|
| 497 | KU16 MajorVersion;
|
---|
| 498 | KU16 MinorVersion;
|
---|
| 499 | KU32 GlobalFlagsClear;
|
---|
| 500 | KU32 GlobalFlagsSet;
|
---|
| 501 | KU32 CriticalSectionDefaultTimeout;
|
---|
| 502 | KU64 DeCommitFreeBlockThreshold;
|
---|
| 503 | KU64 DeCommitTotalFreeThreshold;
|
---|
| 504 | KU64 LockPrefixTable;
|
---|
| 505 | KU64 MaximumAllocationSize;
|
---|
| 506 | KU64 VirtualMemoryThreshold;
|
---|
| 507 | KU64 ProcessAffinityMask;
|
---|
| 508 | KU32 ProcessHeapFlags;
|
---|
| 509 | KU16 CSDVersion;
|
---|
| 510 | KU16 Reserved1;
|
---|
| 511 | KU64 EditList;
|
---|
| 512 | KU64 SecurityCookie;
|
---|
| 513 | KU64 SEHandlerTable;
|
---|
| 514 | KU64 SEHandlerCount;
|
---|
| 515 | } IMAGE_LOAD_CONFIG_DIRECTORY64;
|
---|
| 516 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64 *PIMAGE_LOAD_CONFIG_DIRECTORY64;
|
---|
| 517 |
|
---|
| 518 | typedef struct _IMAGE_DEBUG_DIRECTORY
|
---|
| 519 | {
|
---|
| 520 | KU32 Characteristics;
|
---|
[92] | 521 | KU32 TimeDateStamp;
|
---|
[2] | 522 | KU16 MajorVersion;
|
---|
| 523 | KU16 MinorVersion;
|
---|
| 524 | KU32 Type;
|
---|
| 525 | KU32 SizeOfData;
|
---|
| 526 | KU32 AddressOfRawData;
|
---|
| 527 | KU32 PointerToRawData;
|
---|
| 528 | } IMAGE_DEBUG_DIRECTORY;
|
---|
| 529 | typedef IMAGE_DEBUG_DIRECTORY *PIMAGE_DEBUG_DIRECTORY;
|
---|
| 530 |
|
---|
| 531 | #define IMAGE_DEBUG_TYPE_UNKNOWN 0
|
---|
| 532 | #define IMAGE_DEBUG_TYPE_COFF 1
|
---|
| 533 | #define IMAGE_DEBUG_TYPE_CODEVIEW 2 /* 4.0 */
|
---|
| 534 | #define IMAGE_DEBUG_TYPE_FPO 3 /* FPO = frame pointer omission */
|
---|
| 535 | #define IMAGE_DEBUG_TYPE_MISC 4
|
---|
| 536 | #define IMAGE_DEBUG_TYPE_EXCEPTION 5
|
---|
| 537 | #define IMAGE_DEBUG_TYPE_FIXUP 6
|
---|
| 538 | #define IMAGE_DEBUG_TYPE_BORLAND 9
|
---|
| 539 |
|
---|
| 540 | typedef struct _IMAGE_TLS_DIRECTORY32
|
---|
| 541 | {
|
---|
| 542 | KU32 StartAddressOfRawData;
|
---|
| 543 | KU32 EndAddressOfRawData;
|
---|
| 544 | KU32 AddressOfIndex;
|
---|
| 545 | KU32 AddressOfCallBacks;
|
---|
| 546 | KU32 SizeOfZeroFill;
|
---|
| 547 | KU32 Characteristics;
|
---|
| 548 | } IMAGE_TLS_DIRECTORY32;
|
---|
| 549 | typedef IMAGE_TLS_DIRECTORY32 *PIMAGE_TLS_DIRECTORY32;
|
---|
| 550 |
|
---|
| 551 | typedef struct _IMAGE_TLS_DIRECTORY64
|
---|
| 552 | {
|
---|
| 553 | KU64 StartAddressOfRawData;
|
---|
| 554 | KU64 EndAddressOfRawData;
|
---|
| 555 | KU64 AddressOfIndex;
|
---|
| 556 | KU64 AddressOfCallBacks;
|
---|
| 557 | KU32 SizeOfZeroFill;
|
---|
| 558 | KU32 Characteristics;
|
---|
| 559 | } IMAGE_TLS_DIRECTORY64;
|
---|
| 560 | typedef IMAGE_TLS_DIRECTORY64 *PIMAGE_TLS_DIRECTORY64;
|
---|
| 561 |
|
---|
| 562 |
|
---|
| 563 | #pragma pack()
|
---|
| 564 |
|
---|
| 565 | #endif
|
---|
| 566 |
|
---|