[8003] | 1 | /* $Id: PEexe.h,v 1.1 2002-02-24 02:47:23 bird Exp $
|
---|
| 2 | *
|
---|
| 3 | * PE DEFINITIONS AND DECLARATIONS.
|
---|
| 4 | * --------------------------------
|
---|
| 5 | *
|
---|
| 6 | * Copyright Eric Youngdale (1994)
|
---|
| 7 | * Copyright knut st. osmundsen (2001) (I've messed them up ;-)
|
---|
| 8 | *
|
---|
| 9 | */
|
---|
| 10 |
|
---|
| 11 | #ifndef _peexe_h_
|
---|
| 12 | #define _peexe_h_
|
---|
| 13 |
|
---|
| 14 | #define IMAGE_NT_SIGNATURE 0x00004550 /* PE00 */
|
---|
| 15 |
|
---|
| 16 | /**
|
---|
| 17 | * The file header.
|
---|
| 18 | */
|
---|
| 19 | typedef struct _IMAGE_FILE_HEADER
|
---|
| 20 | {
|
---|
| 21 | unsigned short Machine;
|
---|
| 22 | unsigned short NumberOfSections;
|
---|
| 23 | unsigned long TimeDateStamp;
|
---|
| 24 | unsigned long PointerToSymbolTable;
|
---|
| 25 | unsigned long NumberOfSymbols;
|
---|
| 26 | unsigned short SizeOfOptionalHeader;
|
---|
| 27 | unsigned short Characteristics;
|
---|
| 28 | } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
|
---|
| 29 |
|
---|
| 30 | #define IMAGE_SIZEOF_FILE_HEADER 20
|
---|
| 31 |
|
---|
| 32 | /*
|
---|
| 33 | * These defines describe the meanings of the bits in the Characteristics field
|
---|
| 34 | */
|
---|
| 35 | #define IMAGE_FILE_RELOCS_STRIPPED 0x0001 /* No relocation info */
|
---|
| 36 | #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002
|
---|
| 37 | #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004
|
---|
| 38 | #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008
|
---|
| 39 | #define IMAGE_FILE_16BIT_MACHINE 0x0040
|
---|
| 40 | #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080
|
---|
| 41 | #define IMAGE_FILE_32BIT_MACHINE 0x0100
|
---|
| 42 | #define IMAGE_FILE_DEBUG_STRIPPED 0x0200
|
---|
| 43 | #define IMAGE_FILE_SYSTEM 0x1000
|
---|
| 44 | #define IMAGE_FILE_DLL 0x2000
|
---|
| 45 | #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000
|
---|
| 46 |
|
---|
| 47 | /*
|
---|
| 48 | * These are the settings of the Machine field.
|
---|
| 49 | */
|
---|
| 50 | #define IMAGE_FILE_MACHINE_UNKNOWN 0
|
---|
| 51 | #define IMAGE_FILE_MACHINE_I860 0x14d
|
---|
| 52 | #define IMAGE_FILE_MACHINE_I386 0x14c
|
---|
| 53 | #define IMAGE_FILE_MACHINE_R3000 0x162
|
---|
| 54 | #define IMAGE_FILE_MACHINE_R4000 0x166
|
---|
| 55 | #define IMAGE_FILE_MACHINE_R10000 0x168
|
---|
| 56 | #define IMAGE_FILE_MACHINE_ALPHA 0x184
|
---|
| 57 | #define IMAGE_FILE_MACHINE_POWERPC 0x1F0
|
---|
| 58 |
|
---|
| 59 |
|
---|
| 60 | /**
|
---|
| 61 | * This struct is used in the optional header.
|
---|
| 62 | */
|
---|
| 63 | typedef struct _IMAGE_DATA_DIRECTORY
|
---|
| 64 | {
|
---|
| 65 | unsigned long VirtualAddress;
|
---|
| 66 | unsigned long Size;
|
---|
| 67 | } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
|
---|
| 68 |
|
---|
| 69 | #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
|
---|
| 70 |
|
---|
| 71 |
|
---|
| 72 | /*
|
---|
| 73 | * Optional coff header - used by NT to provide additional information.
|
---|
| 74 | * (-Yeah, very optional.. in NT it's everything but optional :-)
|
---|
| 75 | * - And the one designing this struct never used it, or perhaps he had
|
---|
| 76 | * a 300 columns editor ;-) Membernames are far to long! )
|
---|
| 77 | */
|
---|
| 78 | typedef struct _IMAGE_OPTIONAL_HEADER
|
---|
| 79 | {
|
---|
| 80 | /*
|
---|
| 81 | * Standard fields.
|
---|
| 82 | */
|
---|
| 83 | unsigned short Magic;
|
---|
| 84 | unsigned char MajorLinkerVersion;
|
---|
| 85 | unsigned char MinorLinkerVersion;
|
---|
| 86 | unsigned long SizeOfCode;
|
---|
| 87 | unsigned long SizeOfInitializedData;
|
---|
| 88 | unsigned long SizeOfUninitializedData;
|
---|
| 89 | unsigned long AddressOfEntryPoint;
|
---|
| 90 | unsigned long BaseOfCode;
|
---|
| 91 | unsigned long BaseOfData;
|
---|
| 92 |
|
---|
| 93 | /*
|
---|
| 94 | * NT additional fields.
|
---|
| 95 | */
|
---|
| 96 | unsigned long ImageBase;
|
---|
| 97 | unsigned long SectionAlignment;
|
---|
| 98 | unsigned long FileAlignment;
|
---|
| 99 | unsigned short MajorOperatingSystemVersion;
|
---|
| 100 | unsigned short MinorOperatingSystemVersion;
|
---|
| 101 | unsigned short MajorImageVersion;
|
---|
| 102 | unsigned short MinorImageVersion;
|
---|
| 103 | unsigned short MajorSubsystemVersion;
|
---|
| 104 | unsigned short MinorSubsystemVersion;
|
---|
| 105 | unsigned long Reserved1;
|
---|
| 106 | unsigned long SizeOfImage;
|
---|
| 107 | unsigned long SizeOfHeaders;
|
---|
| 108 | unsigned long CheckSum;
|
---|
| 109 | unsigned short Subsystem;
|
---|
| 110 | unsigned short DllCharacteristics;
|
---|
| 111 | unsigned long SizeOfStackReserve;
|
---|
| 112 | unsigned long SizeOfStackCommit;
|
---|
| 113 | unsigned long SizeOfHeapReserve;
|
---|
| 114 | unsigned long SizeOfHeapCommit;
|
---|
| 115 | unsigned long LoaderFlags;
|
---|
| 116 | unsigned long NumberOfRvaAndSizes;
|
---|
| 117 | IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
|
---|
| 118 | } IMAGE_OPTIONAL_HEADER, *PIMAGE_OPTIONAL_HEADER;
|
---|
| 119 |
|
---|
| 120 | /* Possible Magic values */
|
---|
| 121 | #define IMAGE_NT_OPTIONAL_HDR_MAGIC 0x10b
|
---|
| 122 | #define IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107
|
---|
| 123 |
|
---|
| 124 | /* These are indexes into the DataDirectory array */
|
---|
| 125 | #define IMAGE_FILE_EXPORT_DIRECTORY 0
|
---|
| 126 | #define IMAGE_FILE_IMPORT_DIRECTORY 1
|
---|
| 127 | #define IMAGE_FILE_RESOURCE_DIRECTORY 2
|
---|
| 128 | #define IMAGE_FILE_EXCEPTION_DIRECTORY 3
|
---|
| 129 | #define IMAGE_FILE_SECURITY_DIRECTORY 4
|
---|
| 130 | #define IMAGE_FILE_BASE_RELOCATION_TABLE 5
|
---|
| 131 | #define IMAGE_FILE_DEBUG_DIRECTORY 6
|
---|
| 132 | #define IMAGE_FILE_DESCRIPTION_STRING 7
|
---|
| 133 | #define IMAGE_FILE_MACHINE_VALUE 8 /* Mips */
|
---|
| 134 | #define IMAGE_FILE_THREAD_LOCAL_STORAGE 9
|
---|
| 135 | #define IMAGE_FILE_CALLBACK_DIRECTORY 10
|
---|
| 136 |
|
---|
| 137 | /* Directory Entries, indices into the DataDirectory array */
|
---|
| 138 |
|
---|
| 139 | #define IMAGE_DIRECTORY_ENTRY_EXPORT 0
|
---|
| 140 | #define IMAGE_DIRECTORY_ENTRY_IMPORT 1
|
---|
| 141 | #define IMAGE_DIRECTORY_ENTRY_RESOURCE 2
|
---|
| 142 | #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3
|
---|
| 143 | #define IMAGE_DIRECTORY_ENTRY_SECURITY 4
|
---|
| 144 | #define IMAGE_DIRECTORY_ENTRY_BASERELOC 5
|
---|
| 145 | #define IMAGE_DIRECTORY_ENTRY_DEBUG 6
|
---|
| 146 | #define IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7
|
---|
| 147 | #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 /* (MIPS GP) */
|
---|
| 148 | #define IMAGE_DIRECTORY_ENTRY_TLS 9
|
---|
| 149 | #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10
|
---|
| 150 | #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11
|
---|
| 151 | #define IMAGE_DIRECTORY_ENTRY_IAT 12 /* Import Address Table */
|
---|
| 152 | #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13
|
---|
| 153 | #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14
|
---|
| 154 |
|
---|
| 155 | /* Subsystem Values */
|
---|
| 156 | #define IMAGE_SUBSYSTEM_UNKNOWN 0
|
---|
| 157 | #define IMAGE_SUBSYSTEM_NATIVE 1
|
---|
| 158 | #define IMAGE_SUBSYSTEM_WINDOWS_GUI 2 /* Windows GUI subsystem */
|
---|
| 159 | #define IMAGE_SUBSYSTEM_WINDOWS_CUI 3 /* Windows character subsystem*/
|
---|
| 160 | #define IMAGE_SUBSYSTEM_OS2_CUI 5
|
---|
| 161 | #define IMAGE_SUBSYSTEM_POSIX_CUI 7
|
---|
| 162 | #define IMAGE_SUBSYSTEM_WINDOWCE 8
|
---|
| 163 |
|
---|
| 164 | /*
|
---|
| 165 | * Sum header - all NT headers in one struct...
|
---|
| 166 | */
|
---|
| 167 | typedef struct _IMAGE_NT_HEADERS
|
---|
| 168 | {
|
---|
| 169 | unsigned long Signature;
|
---|
| 170 | IMAGE_FILE_HEADER FileHeader;
|
---|
| 171 | IMAGE_OPTIONAL_HEADER OptionalHeader;
|
---|
| 172 | } IMAGE_NT_HEADERS, *PIMAGE_NT_HEADERS;
|
---|
| 173 |
|
---|
| 174 |
|
---|
| 175 | #define PE_HEADER(module) \
|
---|
| 176 | ((IMAGE_NT_HEADERS*)((PUCHAR)(module) + \
|
---|
| 177 | (((IMAGE_DOS_HEADER*)(module))->e_lfanew)))
|
---|
| 178 |
|
---|
| 179 | #define PE_SECTIONS(module) \
|
---|
| 180 | ((IMAGE_SECTION_HEADER*)((PUCHAR)&PE_HEADER(module)->OptionalHeader + \
|
---|
| 181 | PE_HEADER(module)->FileHeader.SizeOfOptionalHeader))
|
---|
| 182 |
|
---|
| 183 | #define RVA_PTR(module,field) ((PUCHAR)(module) + PE_HEADER(module)->field)
|
---|
| 184 |
|
---|
| 185 |
|
---|
| 186 | /*
|
---|
| 187 | * Section header format
|
---|
| 188 | */
|
---|
| 189 | #define IMAGE_SIZEOF_SHORT_NAME 8
|
---|
| 190 | typedef struct _IMAGE_SECTION_HEADER
|
---|
| 191 | {
|
---|
| 192 | char Name[IMAGE_SIZEOF_SHORT_NAME];
|
---|
| 193 | union
|
---|
| 194 | {
|
---|
| 195 | unsigned long PhysicalAddress;
|
---|
| 196 | unsigned long VirtualSize;
|
---|
| 197 | } Misc;
|
---|
| 198 | unsigned long VirtualAddress;
|
---|
| 199 | unsigned long SizeOfRawData;
|
---|
| 200 | unsigned long PointerToRawData;
|
---|
| 201 | unsigned long PointerToRelocations;
|
---|
| 202 | unsigned long PointerToLinenumbers;
|
---|
| 203 | unsigned short NumberOfRelocations;
|
---|
| 204 | unsigned short NumberOfLinenumbers;
|
---|
| 205 | unsigned long Characteristics;
|
---|
| 206 | } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
|
---|
| 207 |
|
---|
| 208 | #define IMAGE_SIZEOF_SECTION_HEADER 40
|
---|
| 209 |
|
---|
| 210 | /* These defines are for the Characteristics bitfield. */
|
---|
| 211 | /* #define IMAGE_SCN_TYPE_REG 0x00000000 - Reserved */
|
---|
| 212 | /* #define IMAGE_SCN_TYPE_DSECT 0x00000001 - Reserved */
|
---|
| 213 | /* #define IMAGE_SCN_TYPE_NOLOAD 0x00000002 - Reserved */
|
---|
| 214 | /* #define IMAGE_SCN_TYPE_GROUP 0x00000004 - Reserved */
|
---|
| 215 | /* #define IMAGE_SCN_TYPE_NO_PAD 0x00000008 - Reserved */
|
---|
| 216 | /* #define IMAGE_SCN_TYPE_COPY 0x00000010 - Reserved */
|
---|
| 217 | #define IMAGE_SCN_CNT_CODE 0x00000020
|
---|
| 218 | #define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040
|
---|
| 219 | #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080
|
---|
| 220 | #define IMAGE_SCN_LNK_OTHER 0x00000100
|
---|
| 221 | #define IMAGE_SCN_LNK_INFO 0x00000200
|
---|
| 222 | /* #define IMAGE_SCN_TYPE_OVER 0x00000400 - Reserved */
|
---|
| 223 | #define IMAGE_SCN_LNK_REMOVE 0x00000800
|
---|
| 224 | #define IMAGE_SCN_LNK_COMDAT 0x00001000
|
---|
| 225 | /* 0x00002000 - Reserved */
|
---|
| 226 | /* #define IMAGE_SCN_MEM_PROTECTED 0x00004000 - Obsolete */
|
---|
| 227 | #define IMAGE_SCN_MEM_FARDATA 0x00008000
|
---|
| 228 | /* #define IMAGE_SCN_MEM_SYSHEAP 0x00010000 - Obsolete */
|
---|
| 229 | #define IMAGE_SCN_MEM_PURGEABLE 0x00020000
|
---|
| 230 | #define IMAGE_SCN_MEM_16BIT 0x00020000
|
---|
| 231 | #define IMAGE_SCN_MEM_LOCKED 0x00040000
|
---|
| 232 | #define IMAGE_SCN_MEM_PRELOAD 0x00080000
|
---|
| 233 | #define IMAGE_SCN_ALIGN_1BYTES 0x00100000
|
---|
| 234 | #define IMAGE_SCN_ALIGN_2BYTES 0x00200000
|
---|
| 235 | #define IMAGE_SCN_ALIGN_4BYTES 0x00300000
|
---|
| 236 | #define IMAGE_SCN_ALIGN_8BYTES 0x00400000
|
---|
| 237 | #define IMAGE_SCN_ALIGN_16BYTES 0x00500000/* Default */
|
---|
| 238 | #define IMAGE_SCN_ALIGN_32BYTES 0x00600000
|
---|
| 239 | #define IMAGE_SCN_ALIGN_64BYTES 0x00700000
|
---|
| 240 | /* 0x00800000 - Unused */
|
---|
| 241 | #define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000
|
---|
| 242 | #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
|
---|
| 243 | #define IMAGE_SCN_MEM_NOT_CACHED 0x04000000
|
---|
| 244 | #define IMAGE_SCN_MEM_NOT_PAGED 0x08000000
|
---|
| 245 | #define IMAGE_SCN_MEM_SHARED 0x10000000
|
---|
| 246 | #define IMAGE_SCN_MEM_EXECUTE 0x20000000
|
---|
| 247 | #define IMAGE_SCN_MEM_READ 0x40000000
|
---|
| 248 | #define IMAGE_SCN_MEM_WRITE 0x80000000
|
---|
| 249 |
|
---|
| 250 |
|
---|
| 251 | /**
|
---|
| 252 | * Import name entry
|
---|
| 253 | */
|
---|
| 254 | typedef struct _IMAGE_IMPORT_BY_NAME
|
---|
| 255 | {
|
---|
| 256 | unsigned short Hint;
|
---|
| 257 | char Name[1];
|
---|
| 258 | } IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
|
---|
| 259 |
|
---|
| 260 |
|
---|
| 261 | /**
|
---|
| 262 | * Import thunk
|
---|
| 263 | */
|
---|
| 264 | typedef struct _IMAGE_THUNK_DATA
|
---|
| 265 | {
|
---|
| 266 | union
|
---|
| 267 | {
|
---|
| 268 | char * ForwarderString;
|
---|
| 269 | void * Function;
|
---|
| 270 | unsigned long Ordinal;
|
---|
| 271 | PIMAGE_IMPORT_BY_NAME AddressOfData;
|
---|
| 272 | } u1;
|
---|
| 273 | } IMAGE_THUNK_DATA, *PIMAGE_THUNK_DATA;
|
---|
| 274 |
|
---|
| 275 |
|
---|
| 276 | /**
|
---|
| 277 | * Import module directory
|
---|
| 278 | */
|
---|
| 279 | typedef struct _IMAGE_IMPORT_DESCRIPTOR
|
---|
| 280 | {
|
---|
| 281 | union
|
---|
| 282 | {
|
---|
| 283 | unsigned long Characteristics; /* 0 for terminating null import descriptor */
|
---|
| 284 | PIMAGE_THUNK_DATA OriginalFirstThunk; /* RVA to original unbound IAT */
|
---|
| 285 | } u;
|
---|
| 286 | unsigned long TimeDateStamp; /* 0 if not bound,
|
---|
| 287 | * -1 if bound, and real date\time stamp
|
---|
| 288 | * in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT
|
---|
| 289 | * (new BIND)
|
---|
| 290 | * otherwise date/time stamp of DLL bound to
|
---|
| 291 | * (Old BIND)
|
---|
| 292 | */
|
---|
| 293 | unsigned long ForwarderChain; /* -1 if no forwarders */
|
---|
| 294 | unsigned long Name;
|
---|
| 295 | /* RVA to IAT (if bound this IAT has actual addresses) */
|
---|
| 296 | PIMAGE_THUNK_DATA FirstThunk;
|
---|
| 297 | } IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR;
|
---|
| 298 |
|
---|
| 299 | #define IMAGE_ORDINAL_FLAG 0x80000000
|
---|
| 300 | #define IMAGE_SNAP_BY_ORDINAL(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG) != 0)
|
---|
| 301 | #define IMAGE_ORDINAL(Ordinal) (Ordinal & 0xffff)
|
---|
| 302 |
|
---|
| 303 |
|
---|
| 304 |
|
---|
| 305 | /**
|
---|
| 306 | * Export module directory
|
---|
| 307 | */
|
---|
| 308 | typedef struct _IMAGE_EXPORT_DIRECTORY
|
---|
| 309 | {
|
---|
| 310 | unsigned long Characteristics;
|
---|
| 311 | unsigned long TimeDateStamp;
|
---|
| 312 | unsigned short MajorVersion;
|
---|
| 313 | unsigned short MinorVersion;
|
---|
| 314 | unsigned long Name;
|
---|
| 315 | unsigned long Base;
|
---|
| 316 | unsigned long NumberOfFunctions;
|
---|
| 317 | unsigned long NumberOfNames;
|
---|
| 318 | unsigned long **AddressOfFunctions;
|
---|
| 319 | unsigned long **AddressOfNames;
|
---|
| 320 | unsigned short**AddressOfNameOrdinals;
|
---|
| 321 | /* u_char ModuleName[1]; */
|
---|
| 322 | } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
|
---|
| 323 |
|
---|
| 324 |
|
---|
| 325 | /**
|
---|
| 326 | * Import directory.
|
---|
| 327 | */
|
---|
| 328 | typedef struct tagImportDirectory
|
---|
| 329 | {
|
---|
| 330 | unsigned long dwRVAFunctionNameList;
|
---|
| 331 | unsigned long dwUseless1;
|
---|
| 332 | unsigned long dwUseless2;
|
---|
| 333 | unsigned long dwRVAModuleName;
|
---|
| 334 | unsigned long dwRVAFunctionAddressList;
|
---|
| 335 | } IMAGE_IMPORT_MODULE_DIRECTORY, * PIMAGE_IMPORT_MODULE_DIRECTORY;
|
---|
| 336 |
|
---|
| 337 |
|
---|
| 338 | /**
|
---|
| 339 | * Resource directory stuff
|
---|
| 340 | */
|
---|
| 341 | typedef struct _IMAGE_RESOURCE_DIRECTORY
|
---|
| 342 | {
|
---|
| 343 | unsigned long Characteristics;
|
---|
| 344 | unsigned long TimeDateStamp;
|
---|
| 345 | unsigned short MajorVersion;
|
---|
| 346 | unsigned short MinorVersion;
|
---|
| 347 | unsigned short NumberOfNamedEntries;
|
---|
| 348 | unsigned short NumberOfIdEntries;
|
---|
| 349 | /* IMAGE_RESOURCE_DIRECTORY_ENTRY DirectoryEntries[]; */
|
---|
| 350 | } IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;
|
---|
| 351 |
|
---|
| 352 | #define IMAGE_RESOURCE_NAME_IS_STRING 0x80000000
|
---|
| 353 | #define IMAGE_RESOURCE_DATA_IS_DIRECTORY 0x80000000
|
---|
| 354 |
|
---|
| 355 | typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY
|
---|
| 356 | {
|
---|
| 357 | union
|
---|
| 358 | {
|
---|
| 359 | struct
|
---|
| 360 | {
|
---|
| 361 | unsigned NameOffset:31;
|
---|
| 362 | unsigned NameIsString:1;
|
---|
| 363 | } s;
|
---|
| 364 | unsigned long Name;
|
---|
| 365 | unsigned short Id;
|
---|
| 366 | } u1;
|
---|
| 367 | union
|
---|
| 368 | {
|
---|
| 369 | unsigned long OffsetToData;
|
---|
| 370 | struct
|
---|
| 371 | {
|
---|
| 372 | unsigned OffsetToDirectory:31;
|
---|
| 373 | unsigned DataIsDirectory:1;
|
---|
| 374 | } s;
|
---|
| 375 | } u2;
|
---|
| 376 | } IMAGE_RESOURCE_DIRECTORY_ENTRY, *PIMAGE_RESOURCE_DIRECTORY_ENTRY;
|
---|
| 377 |
|
---|
| 378 |
|
---|
| 379 | typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING
|
---|
| 380 | {
|
---|
| 381 | unsigned short Length;
|
---|
| 382 | char NameString[1];
|
---|
| 383 | } IMAGE_RESOURCE_DIRECTORY_STRING, *PIMAGE_RESOURCE_DIRECTORY_STRING;
|
---|
| 384 |
|
---|
| 385 | typedef struct _IMAGE_RESOURCE_DIR_STRING_U
|
---|
| 386 | {
|
---|
| 387 | unsigned short Length;
|
---|
| 388 | unsigned short NameString[1];
|
---|
| 389 | } IMAGE_RESOURCE_DIR_STRING_U, *PIMAGE_RESOURCE_DIR_STRING_U;
|
---|
| 390 |
|
---|
| 391 | typedef struct _IMAGE_RESOURCE_DATA_ENTRY
|
---|
| 392 | {
|
---|
| 393 | unsigned long OffsetToData;
|
---|
| 394 | unsigned long Size;
|
---|
| 395 | unsigned long CodePage;
|
---|
| 396 | unsigned long ResourceHandle;
|
---|
| 397 | } IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;
|
---|
| 398 |
|
---|
| 399 |
|
---|
| 400 | /**
|
---|
| 401 | * Message Resource Stuff
|
---|
| 402 | */
|
---|
| 403 | typedef struct tagMESSAGE_RESOURCE_ENTRY {
|
---|
| 404 | unsigned short Length;
|
---|
| 405 | unsigned short Flags;
|
---|
| 406 | char Text[1];
|
---|
| 407 | } MESSAGE_RESOURCE_ENTRY, *PMESSAGE_RESOURCE_ENTRY;
|
---|
| 408 | #define IMAGE_SEPARATE_DEBUG_SIGNATURE 0x4944
|
---|
| 409 | #define MESSAGE_RESOURCE_UNICODE 0x0001
|
---|
| 410 |
|
---|
| 411 | typedef struct tagMESSAGE_RESOURCE_BLOCK {
|
---|
| 412 | unsigned long LowId;
|
---|
| 413 | unsigned long HighId;
|
---|
| 414 | unsigned long OffsetToEntries;
|
---|
| 415 | } MESSAGE_RESOURCE_BLOCK, *PMESSAGE_RESOURCE_BLOCK;
|
---|
| 416 |
|
---|
| 417 | typedef struct tagMESSAGE_RESOURCE_DATA {
|
---|
| 418 | unsigned long NumberOfBlocks;
|
---|
| 419 | MESSAGE_RESOURCE_BLOCK Blocks[1];
|
---|
| 420 | } MESSAGE_RESOURCE_DATA, *PMESSAGE_RESOURCE_DATA;
|
---|
| 421 |
|
---|
| 422 |
|
---|
| 423 | /**
|
---|
| 424 | * Base relocations (aka fixups)
|
---|
| 425 | */
|
---|
| 426 | typedef struct _IMAGE_BASE_RELOCATION
|
---|
| 427 | {
|
---|
| 428 | unsigned long VirtualAddress;
|
---|
| 429 | unsigned long SizeOfBlock;
|
---|
| 430 | unsigned short TypeOffset[1];
|
---|
| 431 | } IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION;
|
---|
| 432 |
|
---|
| 433 | /* generic relocation types */
|
---|
| 434 | #define IMAGE_REL_BASED_ABSOLUTE 0
|
---|
| 435 | #define IMAGE_REL_BASED_HIGH 1
|
---|
| 436 | #define IMAGE_REL_BASED_LOW 2
|
---|
| 437 | #define IMAGE_REL_BASED_HIGHLOW 3
|
---|
| 438 | #define IMAGE_REL_BASED_HIGHADJ 4
|
---|
| 439 | #define IMAGE_REL_BASED_MIPS_JMPADDR 5
|
---|
| 440 | #define IMAGE_REL_BASED_SECTION 6
|
---|
| 441 | #define IMAGE_REL_BASED_REL 7
|
---|
| 442 | #define IMAGE_REL_BASED_MIPS_JMPADDR16 9
|
---|
| 443 | #define IMAGE_REL_BASED_IA64_IMM64 9 /* yes, 9 too */
|
---|
| 444 | #define IMAGE_REL_BASED_DIR64 10
|
---|
| 445 | #define IMAGE_REL_BASED_HIGH3ADJ 11
|
---|
| 446 |
|
---|
| 447 | /* I386 relocation types */
|
---|
| 448 | #define IMAGE_REL_I386_ABSOLUTE 0
|
---|
| 449 | #define IMAGE_REL_I386_DIR16 1
|
---|
| 450 | #define IMAGE_REL_I386_REL16 2
|
---|
| 451 | #define IMAGE_REL_I386_DIR 6
|
---|
| 452 | #define IMAGE_REL_I386_DIR32NB 7
|
---|
| 453 | #define IMAGE_REL_I386_SEG12 9
|
---|
| 454 | #define IMAGE_REL_I386_SECTION 10
|
---|
| 455 | #define IMAGE_REL_I386_SECREL 11
|
---|
| 456 | #define IMAGE_REL_I386_REL 20
|
---|
| 457 |
|
---|
| 458 | /* MIPS relocation types */
|
---|
| 459 | #define IMAGE_REL_MIPS_ABSOLUTE 0x0000
|
---|
| 460 | #define IMAGE_REL_MIPS_REFHALF 0x0001
|
---|
| 461 | #define IMAGE_REL_MIPS_REFWORD 0x0002
|
---|
| 462 | #define IMAGE_REL_MIPS_JMPADDR 0x0003
|
---|
| 463 | #define IMAGE_REL_MIPS_REFHI 0x0004
|
---|
| 464 | #define IMAGE_REL_MIPS_REFLO 0x0005
|
---|
| 465 | #define IMAGE_REL_MIPS_GPREL 0x0006
|
---|
| 466 | #define IMAGE_REL_MIPS_LITERAL 0x0007
|
---|
| 467 | #define IMAGE_REL_MIPS_SECTION 0x000A
|
---|
| 468 | #define IMAGE_REL_MIPS_SECREL 0x000B
|
---|
| 469 | #define IMAGE_REL_MIPS_SECRELLO 0x000C
|
---|
| 470 | #define IMAGE_REL_MIPS_SECRELHI 0x000D
|
---|
| 471 | #define IMAGE_REL_MIPS_JMPADDR16 0x0010
|
---|
| 472 | #define IMAGE_REL_MIPS_REFWORDNB 0x0022
|
---|
| 473 | #define IMAGE_REL_MIPS_PAIR 0x0025
|
---|
| 474 |
|
---|
| 475 | /* ALPHA relocation types */
|
---|
| 476 | #define IMAGE_REL_ALPHA_ABSOLUTE 0x0000
|
---|
| 477 | #define IMAGE_REL_ALPHA_REFLONG 0x0001
|
---|
| 478 | #define IMAGE_REL_ALPHA_REFQUAD 0x0002
|
---|
| 479 | #define IMAGE_REL_ALPHA_GPREL 0x0003
|
---|
| 480 | #define IMAGE_REL_ALPHA_LITERAL 0x0004
|
---|
| 481 | #define IMAGE_REL_ALPHA_LITUSE 0x0005
|
---|
| 482 | #define IMAGE_REL_ALPHA_GPDISP 0x0006
|
---|
| 483 | #define IMAGE_REL_ALPHA_BRADDR 0x0007
|
---|
| 484 | #define IMAGE_REL_ALPHA_HINT 0x0008
|
---|
| 485 | #define IMAGE_REL_ALPHA_INLINE_REFLONG 0x0009
|
---|
| 486 | #define IMAGE_REL_ALPHA_REFHI 0x000A
|
---|
| 487 | #define IMAGE_REL_ALPHA_REFLO 0x000B
|
---|
| 488 | #define IMAGE_REL_ALPHA_PAIR 0x000C
|
---|
| 489 | #define IMAGE_REL_ALPHA_MATCH 0x000D
|
---|
| 490 | #define IMAGE_REL_ALPHA_SECTION 0x000E
|
---|
| 491 | #define IMAGE_REL_ALPHA_SECREL 0x000F
|
---|
| 492 | #define IMAGE_REL_ALPHA_REFLONGNB 0x0010
|
---|
| 493 | #define IMAGE_REL_ALPHA_SECRELLO 0x0011
|
---|
| 494 | #define IMAGE_REL_ALPHA_SECRELHI 0x0012
|
---|
| 495 | #define IMAGE_REL_ALPHA_REFQ3 0x0013
|
---|
| 496 | #define IMAGE_REL_ALPHA_REFQ2 0x0014
|
---|
| 497 | #define IMAGE_REL_ALPHA_REFQ1 0x0015
|
---|
| 498 | #define IMAGE_REL_ALPHA_GPRELLO 0x0016
|
---|
| 499 | #define IMAGE_REL_ALPHA_GPRELHI 0x0017
|
---|
| 500 |
|
---|
| 501 | /* PowerPC relocation types */
|
---|
| 502 | #define IMAGE_REL_PPC_ABSOLUTE 0x0000
|
---|
| 503 | #define IMAGE_REL_PPC_ADDR64 0x0001
|
---|
| 504 | #define IMAGE_REL_PPC_ADDR 0x0002
|
---|
| 505 | #define IMAGE_REL_PPC_ADDR24 0x0003
|
---|
| 506 | #define IMAGE_REL_PPC_ADDR16 0x0004
|
---|
| 507 | #define IMAGE_REL_PPC_ADDR14 0x0005
|
---|
| 508 | #define IMAGE_REL_PPC_REL24 0x0006
|
---|
| 509 | #define IMAGE_REL_PPC_REL14 0x0007
|
---|
| 510 | #define IMAGE_REL_PPC_TOCREL16 0x0008
|
---|
| 511 | #define IMAGE_REL_PPC_TOCREL14 0x0009
|
---|
| 512 | #define IMAGE_REL_PPC_ADDR32NB 0x000A
|
---|
| 513 | #define IMAGE_REL_PPC_SECREL 0x000B
|
---|
| 514 | #define IMAGE_REL_PPC_SECTION 0x000C
|
---|
| 515 | #define IMAGE_REL_PPC_IFGLUE 0x000D
|
---|
| 516 | #define IMAGE_REL_PPC_IMGLUE 0x000E
|
---|
| 517 | #define IMAGE_REL_PPC_SECREL16 0x000F
|
---|
| 518 | #define IMAGE_REL_PPC_REFHI 0x0010
|
---|
| 519 | #define IMAGE_REL_PPC_REFLO 0x0011
|
---|
| 520 | #define IMAGE_REL_PPC_PAIR 0x0012
|
---|
| 521 | #define IMAGE_REL_PPC_SECRELLO 0x0013
|
---|
| 522 | #define IMAGE_REL_PPC_SECRELHI 0x0014
|
---|
| 523 | #define IMAGE_REL_PPC_GPREL 0x0015
|
---|
| 524 | #define IMAGE_REL_PPC_TYPEMASK 0x00FF
|
---|
| 525 | /* modifier bits */
|
---|
| 526 | #define IMAGE_REL_PPC_NEG 0x0100
|
---|
| 527 | #define IMAGE_REL_PPC_BRTAKEN 0x0200
|
---|
| 528 | #define IMAGE_REL_PPC_BRNTAKEN 0x0400
|
---|
| 529 | #define IMAGE_REL_PPC_TOCDEFN 0x0800
|
---|
| 530 |
|
---|
| 531 | /* SH3 ? relocation type */
|
---|
| 532 | #define IMAGE_REL_SH3_ABSOLUTE 0x0000
|
---|
| 533 | #define IMAGE_REL_SH3_DIRECT16 0x0001
|
---|
| 534 | #define IMAGE_REL_SH3_DIRECT 0x0002
|
---|
| 535 | #define IMAGE_REL_SH3_DIRECT8 0x0003
|
---|
| 536 | #define IMAGE_REL_SH3_DIRECT8_WORD 0x0004
|
---|
| 537 | #define IMAGE_REL_SH3_DIRECT8_LONG 0x0005
|
---|
| 538 | #define IMAGE_REL_SH3_DIRECT4 0x0006
|
---|
| 539 | #define IMAGE_REL_SH3_DIRECT4_WORD 0x0007
|
---|
| 540 | #define IMAGE_REL_SH3_DIRECT4_LONG 0x0008
|
---|
| 541 | #define IMAGE_REL_SH3_PCREL8_WORD 0x0009
|
---|
| 542 | #define IMAGE_REL_SH3_PCREL8_LONG 0x000A
|
---|
| 543 | #define IMAGE_REL_SH3_PCREL12_WORD 0x000B
|
---|
| 544 | #define IMAGE_REL_SH3_STARTOF_SECTION 0x000C
|
---|
| 545 | #define IMAGE_REL_SH3_SIZEOF_SECTION 0x000D
|
---|
| 546 | #define IMAGE_REL_SH3_SECTION 0x000E
|
---|
| 547 | #define IMAGE_REL_SH3_SECREL 0x000F
|
---|
| 548 | #define IMAGE_REL_SH3_DIRECT32_NB 0x0010
|
---|
| 549 |
|
---|
| 550 | /* ARM (Archimedes?) relocation types */
|
---|
| 551 | #define IMAGE_REL_ARM_ABSOLUTE 0x0000
|
---|
| 552 | #define IMAGE_REL_ARM_ADDR 0x0001
|
---|
| 553 | #define IMAGE_REL_ARM_ADDR32NB 0x0002
|
---|
| 554 | #define IMAGE_REL_ARM_BRANCH24 0x0003
|
---|
| 555 | #define IMAGE_REL_ARM_BRANCH11 0x0004
|
---|
| 556 | #define IMAGE_REL_ARM_SECTION 0x000E
|
---|
| 557 | #define IMAGE_REL_ARM_SECREL 0x000F
|
---|
| 558 |
|
---|
| 559 | /* IA64 relocation types */
|
---|
| 560 | #define IMAGE_REL_IA64_ABSOLUTE 0x0000
|
---|
| 561 | #define IMAGE_REL_IA64_IMM14 0x0001
|
---|
| 562 | #define IMAGE_REL_IA64_IMM22 0x0002
|
---|
| 563 | #define IMAGE_REL_IA64_IMM64 0x0003
|
---|
| 564 | #define IMAGE_REL_IA64_DIR 0x0004
|
---|
| 565 | #define IMAGE_REL_IA64_DIR64 0x0005
|
---|
| 566 | #define IMAGE_REL_IA64_PCREL21B 0x0006
|
---|
| 567 | #define IMAGE_REL_IA64_PCREL21M 0x0007
|
---|
| 568 | #define IMAGE_REL_IA64_PCREL21F 0x0008
|
---|
| 569 | #define IMAGE_REL_IA64_GPREL22 0x0009
|
---|
| 570 | #define IMAGE_REL_IA64_LTOFF22 0x000A
|
---|
| 571 | #define IMAGE_REL_IA64_SECTION 0x000B
|
---|
| 572 | #define IMAGE_REL_IA64_SECREL22 0x000C
|
---|
| 573 | #define IMAGE_REL_IA64_SECREL64I 0x000D
|
---|
| 574 | #define IMAGE_REL_IA64_SECREL 0x000E
|
---|
| 575 | #define IMAGE_REL_IA64_LTOFF64 0x000F
|
---|
| 576 | #define IMAGE_REL_IA64_DIR32NB 0x0010
|
---|
| 577 | #define IMAGE_REL_IA64_RESERVED_11 0x0011
|
---|
| 578 | #define IMAGE_REL_IA64_RESERVED_12 0x0012
|
---|
| 579 | #define IMAGE_REL_IA64_RESERVED_13 0x0013
|
---|
| 580 | #define IMAGE_REL_IA64_RESERVED_14 0x0014
|
---|
| 581 | #define IMAGE_REL_IA64_RESERVED_15 0x0015
|
---|
| 582 | #define IMAGE_REL_IA64_RESERVED_16 0x0016
|
---|
| 583 | #define IMAGE_REL_IA64_ADDEND 0x001F
|
---|
| 584 |
|
---|
| 585 |
|
---|
| 586 | /**
|
---|
| 587 | * Load Config Directory.
|
---|
| 588 | */
|
---|
| 589 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY
|
---|
| 590 | {
|
---|
| 591 | unsigned long Characteristics;
|
---|
| 592 | unsigned long TimeDateStamp;
|
---|
| 593 | unsigned short MajorVersion;
|
---|
| 594 | unsigned short MinorVersion;
|
---|
| 595 | unsigned long GlobalFlagsClear;
|
---|
| 596 | unsigned long GlobalFlagsSet;
|
---|
| 597 | unsigned long CriticalSectionDefaultTimeout;
|
---|
| 598 | unsigned long DeCommitFreeBlockThreshold;
|
---|
| 599 | unsigned long DeCommitTotalFreeThreshold;
|
---|
| 600 | void * LockPrefixTable;
|
---|
| 601 | unsigned long MaximumAllocationSize;
|
---|
| 602 | unsigned long VirtualMemoryThreshold;
|
---|
| 603 | unsigned long ProcessHeapFlags;
|
---|
| 604 | unsigned long Reserved[4];
|
---|
| 605 | } IMAGE_LOAD_CONFIG_DIRECTORY, *PIMAGE_LOAD_CONFIG_DIRECTORY;
|
---|
| 606 |
|
---|
| 607 |
|
---|
| 608 | /**
|
---|
| 609 | * TLS Stuff.
|
---|
| 610 | */
|
---|
| 611 | #ifndef STDCALL
|
---|
| 612 | # define STDCALL
|
---|
| 613 | #endif
|
---|
| 614 | typedef void (* STDCALL PIMAGE_TLS_CALLBACK) (
|
---|
| 615 | void * DllHandle, unsigned long* Reason, void *Reserved
|
---|
| 616 | );
|
---|
| 617 |
|
---|
| 618 | typedef struct _IMAGE_TLS_DIRECTORY
|
---|
| 619 | {
|
---|
| 620 | unsigned long StartAddressOfRawData;
|
---|
| 621 | unsigned long EndAddressOfRawData;
|
---|
| 622 | unsigned long* AddressOfIndex;
|
---|
| 623 | PIMAGE_TLS_CALLBACK *AddressOfCallBacks;
|
---|
| 624 | unsigned long SizeOfZeroFill;
|
---|
| 625 | unsigned long Characteristics;
|
---|
| 626 | } IMAGE_TLS_DIRECTORY, *PIMAGE_TLS_DIRECTORY;
|
---|
| 627 |
|
---|
| 628 |
|
---|
| 629 | /**
|
---|
| 630 | * The IMAGE_DEBUG_DIRECTORY data directory points to an array of
|
---|
| 631 | * these structures.
|
---|
| 632 | */
|
---|
| 633 | typedef struct _IMAGE_DEBUG_DIRECTORY
|
---|
| 634 | {
|
---|
| 635 | unsigned long Characteristics;
|
---|
| 636 | unsigned long TimeDateStamp;
|
---|
| 637 | unsigned short MajorVersion;
|
---|
| 638 | unsigned short MinorVersion;
|
---|
| 639 | unsigned long Type;
|
---|
| 640 | unsigned long SizeOfData;
|
---|
| 641 | unsigned long AddressOfRawData;
|
---|
| 642 | unsigned long PointerToRawData;
|
---|
| 643 | } IMAGE_DEBUG_DIRECTORY, *PIMAGE_DEBUG_DIRECTORY;
|
---|
| 644 |
|
---|
| 645 | /*
|
---|
| 646 | * The type field above can take these (plus a few other
|
---|
| 647 | * irrelevant) values.
|
---|
| 648 | */
|
---|
| 649 | #define IMAGE_DEBUG_TYPE_UNKNOWN 0
|
---|
| 650 | #define IMAGE_DEBUG_TYPE_COFF 1
|
---|
| 651 | #define IMAGE_DEBUG_TYPE_CODEVIEW 2
|
---|
| 652 | #define IMAGE_DEBUG_TYPE_FPO 3
|
---|
| 653 | #define IMAGE_DEBUG_TYPE_MISC 4
|
---|
| 654 | #define IMAGE_DEBUG_TYPE_EXCEPTION 5
|
---|
| 655 | #define IMAGE_DEBUG_TYPE_FIXUP 6
|
---|
| 656 | #define IMAGE_DEBUG_TYPE_OMAP_TO_SRC 7
|
---|
| 657 | #define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC 8
|
---|
| 658 |
|
---|
| 659 |
|
---|
| 660 | /**
|
---|
| 661 | * This is the structure that appears at the very start of a .DBG file.
|
---|
| 662 | */
|
---|
| 663 | typedef struct _IMAGE_SEPARATE_DEBUG_HEADER
|
---|
| 664 | {
|
---|
| 665 | unsigned short Signature;
|
---|
| 666 | unsigned short Flags;
|
---|
| 667 | unsigned short Machine;
|
---|
| 668 | unsigned short Characteristics;
|
---|
| 669 | unsigned long TimeDateStamp;
|
---|
| 670 | unsigned long CheckSum;
|
---|
| 671 | unsigned long ImageBase;
|
---|
| 672 | unsigned long SizeOfImage;
|
---|
| 673 | unsigned long NumberOfSections;
|
---|
| 674 | unsigned long ExportedNamesSize;
|
---|
| 675 | unsigned long DebugDirectorySize;
|
---|
| 676 | unsigned long Reserved[3];
|
---|
| 677 | } IMAGE_SEPARATE_DEBUG_HEADER, *PIMAGE_SEPARATE_DEBUG_HEADER;
|
---|
| 678 |
|
---|
| 679 |
|
---|
| 680 | #endif
|
---|
| 681 |
|
---|