VirtualBox

source: vbox/trunk/include/iprt/formats/pecoff.h

Last change on this file was 100914, checked in by vboxsync, 9 months ago

IPRT/pdbvfs: Parse the DBI header and optional header and pick up stream names from it. Also provide the DBI substreams as individual files for simpler access.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 121.0 KB
Line 
1/* $Id: pecoff.h 100914 2023-08-21 02:32:45Z vboxsync $ */
2/** @file
3 * IPRT - Windows NT PE & COFF Structures and Constants.
4 */
5
6/*
7 * Copyright (C) 2006-2023 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * The contents of this file may alternatively be used under the terms
26 * of the Common Development and Distribution License Version 1.0
27 * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28 * in the VirtualBox distribution, in which case the provisions of the
29 * CDDL are applicable instead of those of the GPL.
30 *
31 * You may elect to license modified versions of this file under the
32 * terms and conditions of either the GPL or the CDDL or both.
33 *
34 * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35 */
36
37#ifndef IPRT_INCLUDED_formats_pecoff_h
38#define IPRT_INCLUDED_formats_pecoff_h
39#ifndef RT_WITHOUT_PRAGMA_ONCE
40# pragma once
41#endif
42
43#include <iprt/types.h>
44#include <iprt/assertcompile.h>
45
46
47/** @defgroup grp_rt_formats_pecoff PE & Microsoft COFF structures and definitions
48 * @ingroup grp_rt_formats
49 * @{
50 */
51
52
53/**
54 * PE & COFF file header.
55 *
56 * This starts COFF files, while in PE files it's preceeded by the PE signature
57 * (see IMAGE_NT_HEADERS32, IMAGE_NT_HEADERS64).
58 */
59typedef struct _IMAGE_FILE_HEADER
60{
61 uint16_t Machine; /**< 0x00 */
62 uint16_t NumberOfSections; /**< 0x02 */
63 uint32_t TimeDateStamp; /**< 0x04 */
64 uint32_t PointerToSymbolTable; /**< 0x08 */
65 uint32_t NumberOfSymbols; /**< 0x0c */
66 uint16_t SizeOfOptionalHeader; /**< 0x10 */
67 uint16_t Characteristics; /**< 0x12 */
68} IMAGE_FILE_HEADER; /* size: 0x14 */
69AssertCompileSize(IMAGE_FILE_HEADER, 0x14);
70typedef IMAGE_FILE_HEADER *PIMAGE_FILE_HEADER;
71typedef IMAGE_FILE_HEADER const *PCIMAGE_FILE_HEADER;
72
73
74/** @name IMAGE_FILE_MACHINE_XXX - PE & COFF machine types.
75 * Used by IMAGE_FILE_HEADER::Machine and IMAGE_SEPARATE_DEBUG_HEADER::Machine.
76 * @{ */
77/** X86 compatible CPU, 32-bit instructions. */
78#define IMAGE_FILE_MACHINE_I386 UINT16_C(0x014c)
79/** AMD64 compatible CPU, 64-bit instructions. */
80#define IMAGE_FILE_MACHINE_AMD64 UINT16_C(0x8664)
81
82/** Unknown target CPU. */
83#define IMAGE_FILE_MACHINE_UNKNOWN UINT16_C(0x0000)
84/** Basic-16 (whatever that is). */
85#define IMAGE_FILE_MACHINE_BASIC_16 UINT16_C(0x0142)
86/** Basic-16 (whatever that is) w/ transfer vector(s?) (TV). */
87#define IMAGE_FILE_MACHINE_BASIC_16_TV UINT16_C(0x0143)
88/** Intel iAPX 16 (8086?). */
89#define IMAGE_FILE_MACHINE_IAPX16 UINT16_C(0x0144)
90/** Intel iAPX 16 (8086?) w/ transfer vector(s?) (TV). */
91#define IMAGE_FILE_MACHINE_IAPX16_TV UINT16_C(0x0145)
92/** Intel iAPX 20 (80286?). */
93#define IMAGE_FILE_MACHINE_IAPX20 UINT16_C(0x0144)
94/** Intel iAPX 20 (80286?) w/ transfer vector(s?) (TV). */
95#define IMAGE_FILE_MACHINE_IAPX20_TV UINT16_C(0x0145)
96/** X86 compatible CPU, 8086. */
97#define IMAGE_FILE_MACHINE_I8086 UINT16_C(0x0148)
98/** X86 compatible CPU, 8086 w/ transfer vector(s?) (TV). */
99#define IMAGE_FILE_MACHINE_I8086_TV UINT16_C(0x0149)
100/** X86 compatible CPU, 80286 small model program. */
101#define IMAGE_FILE_MACHINE_I286_SMALL UINT16_C(0x014a)
102/** Motorola 68000. */
103#define IMAGE_FILE_MACHINE_MC68 UINT16_C(0x0150)
104/** Motorola 68000 w/ writable text sections. */
105#define IMAGE_FILE_MACHINE_MC68_WR UINT16_C(0x0150)
106/** Motorola 68000 w/ transfer vector(s?). */
107#define IMAGE_FILE_MACHINE_MC68_TV UINT16_C(0x0151)
108/** Motorola 68000 w/ demand paged text.
109 * @note shared with 80286 large model program. */
110#define IMAGE_FILE_MACHINE_MC68_PG UINT16_C(0x0152)
111/** X86 compatible CPU, 80286 large model program.
112 * @note shared with MC68000 w/ demand paged text */
113#define IMAGE_FILE_MACHINE_I286_LARGE UINT16_C(0x0152)
114/** IBM 370 (writable text). */
115#define IMAGE_FILE_MACHINE_U370_WR UINT16_C(0x0158)
116/** Amdahl 470/580 (writable text). */
117#define IMAGE_FILE_MACHINE_AMDAHL_470_WR UINT16_C(0x0159)
118/** Amdahl 470/580 (read only text). */
119#define IMAGE_FILE_MACHINE_AMDAHL_470_RO UINT16_C(0x015c)
120/** IBM 370 (read only text). */
121#define IMAGE_FILE_MACHINE_U370_RO UINT16_C(0x015d)
122/** MIPS R4000 CPU, little endian. */
123#define IMAGE_FILE_MACHINE_R4000 UINT16_C(0x0166)
124/** MIPS CPU, little endian, Windows CE (?) v2 designation. */
125#define IMAGE_FILE_MACHINE_WCEMIPSV2 UINT16_C(0x0169)
126/** VAX-11/750 and VAX-11/780 (writable text). */
127#define IMAGE_FILE_MACHINE_VAX_WR UINT16_C(0x0178)
128/** VAX-11/750 and VAX-11/780 (read-only text). */
129#define IMAGE_FILE_MACHINE_VAX_RO UINT16_C(0x017d)
130/** Hitachi SH3 CPU. */
131#define IMAGE_FILE_MACHINE_SH3 UINT16_C(0x01a2)
132/** Hitachi SH3 DSP. */
133#define IMAGE_FILE_MACHINE_SH3DSP UINT16_C(0x01a3)
134/** Hitachi SH4 CPU. */
135#define IMAGE_FILE_MACHINE_SH4 UINT16_C(0x01a6)
136/** Hitachi SH5 CPU. */
137#define IMAGE_FILE_MACHINE_SH5 UINT16_C(0x01a8)
138/** Little endian ARM CPU. */
139#define IMAGE_FILE_MACHINE_ARM UINT16_C(0x01c0)
140/** ARM or Thumb stuff. */
141#define IMAGE_FILE_MACHINE_THUMB UINT16_C(0x01c2)
142/** ARMv7 or higher CPU, Thumb mode. */
143#define IMAGE_FILE_MACHINE_ARMNT UINT16_C(0x01c4)
144/** Matshushita AM33 CPU. */
145#define IMAGE_FILE_MACHINE_AM33 UINT16_C(0x01d3)
146/** Power PC CPU, little endian. */
147#define IMAGE_FILE_MACHINE_POWERPC UINT16_C(0x01f0)
148/** Power PC CPU with FPU, also little endian? */
149#define IMAGE_FILE_MACHINE_POWERPCFP UINT16_C(0x01f1)
150/** "Itanic" CPU. */
151#define IMAGE_FILE_MACHINE_IA64 UINT16_C(0x0200)
152/** MIPS CPU, compact 16-bit instructions only? */
153#define IMAGE_FILE_MACHINE_MIPS16 UINT16_C(0x0266)
154/** MIPS CPU with FPU, full 32-bit instructions only? */
155#define IMAGE_FILE_MACHINE_MIPSFPU UINT16_C(0x0366)
156/** MIPS CPU with FPU, compact 16-bit instructions? */
157#define IMAGE_FILE_MACHINE_MIPSFPU16 UINT16_C(0x0466)
158/** EFI byte code. */
159#define IMAGE_FILE_MACHINE_EBC UINT16_C(0x0ebc)
160/** Mitsubishi M32R CPU, little endian. */
161#define IMAGE_FILE_MACHINE_M32R UINT16_C(0x9041)
162/** ARMv8 CPU, 64-bit mode. */
163#define IMAGE_FILE_MACHINE_ARM64 UINT16_C(0xaa64)
164/** @} */
165
166/** @name File header characteristics (IMAGE_FILE_HEADER::Characteristics)
167 * @{ */
168#define IMAGE_FILE_RELOCS_STRIPPED UINT16_C(0x0001)
169#define IMAGE_FILE_EXECUTABLE_IMAGE UINT16_C(0x0002)
170#define IMAGE_FILE_LINE_NUMS_STRIPPED UINT16_C(0x0004)
171#define IMAGE_FILE_LOCAL_SYMS_STRIPPED UINT16_C(0x0008)
172#define IMAGE_FILE_AGGRESIVE_WS_TRIM UINT16_C(0x0010)
173#define IMAGE_FILE_LARGE_ADDRESS_AWARE UINT16_C(0x0020)
174#define IMAGE_FILE_16BIT_MACHINE UINT16_C(0x0040)
175#define IMAGE_FILE_BYTES_REVERSED_LO UINT16_C(0x0080)
176#define IMAGE_FILE_32BIT_MACHINE UINT16_C(0x0100)
177#define IMAGE_FILE_DEBUG_STRIPPED UINT16_C(0x0200)
178#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP UINT16_C(0x0400)
179#define IMAGE_FILE_NET_RUN_FROM_SWAP UINT16_C(0x0800)
180#define IMAGE_FILE_SYSTEM UINT16_C(0x1000) /**< (COFF/IAPX*: Used to indicate 80186 instructions) */
181#define IMAGE_FILE_DLL UINT16_C(0x2000) /**< (COFF/IAPX*: Used to indicate 80286 instructions) */
182#define IMAGE_FILE_UP_SYSTEM_ONLY UINT16_C(0x4000)
183#define IMAGE_FILE_BYTES_REVERSED_HI UINT16_C(0x8000)
184/** @} */
185
186
187/**
188 * PE data directory.
189 *
190 * This is used to locate data in the loaded image so the dynamic linker or
191 * others can make use of it. However, in the case of
192 * IMAGE_DIRECTORY_ENTRY_SECURITY it is referring to raw file offsets.
193 */
194typedef struct _IMAGE_DATA_DIRECTORY
195{
196 uint32_t VirtualAddress;
197 uint32_t Size;
198} IMAGE_DATA_DIRECTORY;
199AssertCompileSize(IMAGE_DATA_DIRECTORY, 0x8);
200typedef IMAGE_DATA_DIRECTORY *PIMAGE_DATA_DIRECTORY;
201typedef IMAGE_DATA_DIRECTORY const *PCIMAGE_DATA_DIRECTORY;
202
203/** The standard number of data directories in the optional header.
204 * I.e. the dimensions of IMAGE_OPTIONAL_HEADER32::DataDirectory and
205 * IMAGE_OPTIONAL_HEADER64::DataDirectory.
206 */
207#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 0x10
208
209
210/**
211 * PE optional header, 32-bit version.
212 */
213typedef struct _IMAGE_OPTIONAL_HEADER32
214{
215 uint16_t Magic; /**< 0x00 */
216 uint8_t MajorLinkerVersion; /**< 0x02 */
217 uint8_t MinorLinkerVersion; /**< 0x03 */
218 uint32_t SizeOfCode; /**< 0x04 */
219 uint32_t SizeOfInitializedData; /**< 0x08 */
220 uint32_t SizeOfUninitializedData; /**< 0x0c */
221 uint32_t AddressOfEntryPoint; /**< 0x10 */
222 uint32_t BaseOfCode; /**< 0x14 */
223 uint32_t BaseOfData; /**< 0x18 */
224 uint32_t ImageBase; /**< 0x1c */
225 uint32_t SectionAlignment; /**< 0x20 */
226 uint32_t FileAlignment; /**< 0x24 */
227 uint16_t MajorOperatingSystemVersion; /**< 0x28 */
228 uint16_t MinorOperatingSystemVersion; /**< 0x2a */
229 uint16_t MajorImageVersion; /**< 0x2c */
230 uint16_t MinorImageVersion; /**< 0x2e */
231 uint16_t MajorSubsystemVersion; /**< 0x30 */
232 uint16_t MinorSubsystemVersion; /**< 0x32 */
233 uint32_t Win32VersionValue; /**< 0x34 */
234 uint32_t SizeOfImage; /**< 0x38 */
235 uint32_t SizeOfHeaders; /**< 0x3c */
236 uint32_t CheckSum; /**< 0x40 */
237 uint16_t Subsystem; /**< 0x44 */
238 uint16_t DllCharacteristics; /**< 0x46 */
239 uint32_t SizeOfStackReserve; /**< 0x48 */
240 uint32_t SizeOfStackCommit; /**< 0x4c */
241 uint32_t SizeOfHeapReserve; /**< 0x50 */
242 uint32_t SizeOfHeapCommit; /**< 0x54 */
243 uint32_t LoaderFlags; /**< 0x58 */
244 uint32_t NumberOfRvaAndSizes; /**< 0x5c */
245 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x60; 0x10*8 = 0x80 */
246} IMAGE_OPTIONAL_HEADER32; /* size: 0xe0 */
247AssertCompileSize(IMAGE_OPTIONAL_HEADER32, 0xe0);
248typedef IMAGE_OPTIONAL_HEADER32 *PIMAGE_OPTIONAL_HEADER32;
249typedef IMAGE_OPTIONAL_HEADER32 const *PCIMAGE_OPTIONAL_HEADER32;
250
251/**
252 * PE optional header, 64-bit version.
253 */
254typedef struct _IMAGE_OPTIONAL_HEADER64
255{
256 uint16_t Magic; /**< 0x00 */
257 uint8_t MajorLinkerVersion; /**< 0x02 */
258 uint8_t MinorLinkerVersion; /**< 0x03 */
259 uint32_t SizeOfCode; /**< 0x04 */
260 uint32_t SizeOfInitializedData; /**< 0x08 */
261 uint32_t SizeOfUninitializedData; /**< 0x0c */
262 uint32_t AddressOfEntryPoint; /**< 0x10 */
263 uint32_t BaseOfCode; /**< 0x14 */
264 uint64_t ImageBase; /**< 0x18 */
265 uint32_t SectionAlignment; /**< 0x20 */
266 uint32_t FileAlignment; /**< 0x24 */
267 uint16_t MajorOperatingSystemVersion; /**< 0x28 */
268 uint16_t MinorOperatingSystemVersion; /**< 0x2a */
269 uint16_t MajorImageVersion; /**< 0x2c */
270 uint16_t MinorImageVersion; /**< 0x2e */
271 uint16_t MajorSubsystemVersion; /**< 0x30 */
272 uint16_t MinorSubsystemVersion; /**< 0x32 */
273 uint32_t Win32VersionValue; /**< 0x34 */
274 uint32_t SizeOfImage; /**< 0x38 */
275 uint32_t SizeOfHeaders; /**< 0x3c */
276 uint32_t CheckSum; /**< 0x40 */
277 uint16_t Subsystem; /**< 0x44 */
278 uint16_t DllCharacteristics; /**< 0x46 */
279 uint64_t SizeOfStackReserve; /**< 0x48 */
280 uint64_t SizeOfStackCommit; /**< 0x50 */
281 uint64_t SizeOfHeapReserve; /**< 0x58 */
282 uint64_t SizeOfHeapCommit; /**< 0x60 */
283 uint32_t LoaderFlags; /**< 0x68 */
284 uint32_t NumberOfRvaAndSizes; /**< 0x6c */
285 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x70; 0x10*8 = 0x80 */
286} IMAGE_OPTIONAL_HEADER64; /* size: 0xf0 */
287AssertCompileSize(IMAGE_OPTIONAL_HEADER64, 0xf0);
288typedef IMAGE_OPTIONAL_HEADER64 *PIMAGE_OPTIONAL_HEADER64;
289typedef IMAGE_OPTIONAL_HEADER64 const *PCIMAGE_OPTIONAL_HEADER64;
290
291/** @name Optional header magic values.
292 * @{ */
293#define IMAGE_NT_OPTIONAL_HDR32_MAGIC UINT16_C(0x010b)
294#define IMAGE_NT_OPTIONAL_HDR64_MAGIC UINT16_C(0x020b)
295/** @} */
296
297/** @name IMAGE_SUBSYSTEM_XXX - Optional header subsystems.
298 * IMAGE_OPTIONAL_HEADER32::Subsystem, IMAGE_OPTIONAL_HEADER64::Subsystem
299 * @{ */
300#define IMAGE_SUBSYSTEM_UNKNOWN UINT16_C(0x0000)
301#define IMAGE_SUBSYSTEM_NATIVE UINT16_C(0x0001)
302#define IMAGE_SUBSYSTEM_WINDOWS_GUI UINT16_C(0x0002)
303#define IMAGE_SUBSYSTEM_WINDOWS_CUI UINT16_C(0x0003)
304#define IMAGE_SUBSYSTEM_OS2_GUI UINT16_C(0x0004)
305#define IMAGE_SUBSYSTEM_OS2_CUI UINT16_C(0x0005)
306#define IMAGE_SUBSYSTEM_POSIX_CUI UINT16_C(0x0007)
307/** @} */
308
309/** @name Optional header characteristics.
310 * @{ */
311#define IMAGE_LIBRARY_PROCESS_INIT UINT16_C(0x0001)
312#define IMAGE_LIBRARY_PROCESS_TERM UINT16_C(0x0002)
313#define IMAGE_LIBRARY_THREAD_INIT UINT16_C(0x0004)
314#define IMAGE_LIBRARY_THREAD_TERM UINT16_C(0x0008)
315#define IMAGE_DLLCHARACTERISTICS_RESERVED UINT16_C(0x0010)
316#define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA UINT16_C(0x0020)
317#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE UINT16_C(0x0040)
318#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY UINT16_C(0x0080)
319#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT UINT16_C(0x0100)
320#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION UINT16_C(0x0200)
321#define IMAGE_DLLCHARACTERISTICS_NO_SEH UINT16_C(0x0400)
322#define IMAGE_DLLCHARACTERISTICS_NO_BIND UINT16_C(0x0800)
323#define IMAGE_DLLCHARACTERISTICS_APPCONTAINER UINT16_C(0x1000)
324#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER UINT16_C(0x2000)
325#define IMAGE_DLLCHARACTERISTICS_GUARD_CF UINT16_C(0x4000)
326#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE UINT16_C(0x8000)
327/** @} */
328
329
330/** @name IMAGE_DIRECTORY_ENTRY_XXX - Data directory indexes.
331 * Used to index IMAGE_OPTIONAL_HEADER32::DataDirectory and
332 * IMAGE_OPTIONAL_HEADER64::DataDirectory
333 * @{ */
334#define IMAGE_DIRECTORY_ENTRY_EXPORT 0x0
335#define IMAGE_DIRECTORY_ENTRY_IMPORT 0x1
336#define IMAGE_DIRECTORY_ENTRY_RESOURCE 0x2
337#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x3
338#define IMAGE_DIRECTORY_ENTRY_SECURITY 0x4
339#define IMAGE_DIRECTORY_ENTRY_BASERELOC 0x5
340#define IMAGE_DIRECTORY_ENTRY_DEBUG 0x6
341#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 0x7
342#define IMAGE_DIRECTORY_ENTRY_COPYRIGHT IMAGE_DIRECTORY_ENTRY_ARCHITECTURE
343#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x8
344#define IMAGE_DIRECTORY_ENTRY_TLS 0x9
345#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0xa
346#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0xb
347#define IMAGE_DIRECTORY_ENTRY_IAT 0xc
348#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0xd
349#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0xe
350/** @} */
351
352
353/**
354 * PE (NT) headers, 32-bit version.
355 */
356typedef struct _IMAGE_NT_HEADERS32
357{
358 uint32_t Signature; /**< 0x00 */
359 IMAGE_FILE_HEADER FileHeader; /**< 0x04 */
360 IMAGE_OPTIONAL_HEADER32 OptionalHeader; /**< 0x18 */
361} IMAGE_NT_HEADERS32; /* size: 0xf8 */
362AssertCompileSize(IMAGE_NT_HEADERS32, 0xf8);
363AssertCompileMemberOffset(IMAGE_NT_HEADERS32, FileHeader, 4);
364AssertCompileMemberOffset(IMAGE_NT_HEADERS32, OptionalHeader, 24);
365typedef IMAGE_NT_HEADERS32 *PIMAGE_NT_HEADERS32;
366typedef IMAGE_NT_HEADERS32 const *PCIMAGE_NT_HEADERS32;
367
368/**
369 * PE (NT) headers, 64-bit version.
370 */
371typedef struct _IMAGE_NT_HEADERS64
372{
373 uint32_t Signature; /**< 0x00 */
374 IMAGE_FILE_HEADER FileHeader; /**< 0x04 */
375 IMAGE_OPTIONAL_HEADER64 OptionalHeader; /**< 0x18 */
376} IMAGE_NT_HEADERS64; /**< 0x108 */
377AssertCompileSize(IMAGE_NT_HEADERS64, 0x108);
378AssertCompileMemberOffset(IMAGE_NT_HEADERS64, FileHeader, 4);
379AssertCompileMemberOffset(IMAGE_NT_HEADERS64, OptionalHeader, 24);
380typedef IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
381typedef IMAGE_NT_HEADERS64 const *PCIMAGE_NT_HEADERS64;
382
383/** The PE signature.
384 * Used by IMAGE_NT_HEADERS32::Signature, IMAGE_NT_HEADERS64::Signature. */
385#define IMAGE_NT_SIGNATURE UINT32_C(0x00004550)
386
387
388/** Section header short name length (IMAGE_SECTION_HEADER::Name). */
389#define IMAGE_SIZEOF_SHORT_NAME 0x8
390
391/**
392 * PE & COFF section header.
393 */
394typedef struct _IMAGE_SECTION_HEADER
395{
396 uint8_t Name[IMAGE_SIZEOF_SHORT_NAME];
397 union
398 {
399 uint32_t PhysicalAddress;
400 uint32_t VirtualSize;
401 } Misc;
402 uint32_t VirtualAddress;
403 uint32_t SizeOfRawData;
404 uint32_t PointerToRawData;
405 uint32_t PointerToRelocations;
406 uint32_t PointerToLinenumbers;
407 uint16_t NumberOfRelocations;
408 uint16_t NumberOfLinenumbers;
409 uint32_t Characteristics;
410} IMAGE_SECTION_HEADER;
411AssertCompileSize(IMAGE_SECTION_HEADER, 40);
412typedef IMAGE_SECTION_HEADER *PIMAGE_SECTION_HEADER;
413typedef IMAGE_SECTION_HEADER const *PCIMAGE_SECTION_HEADER;
414
415/** @name IMAGE_SCN_XXX - Section header characteristics.
416 * Used by IMAGE_SECTION_HEADER::Characteristics.
417 * @{ */
418#define IMAGE_SCN_TYPE_REG UINT32_C(0x00000000)
419#define IMAGE_SCN_TYPE_DSECT UINT32_C(0x00000001)
420#define IMAGE_SCN_TYPE_NOLOAD UINT32_C(0x00000002)
421#define IMAGE_SCN_TYPE_GROUP UINT32_C(0x00000004)
422#define IMAGE_SCN_TYPE_NO_PAD UINT32_C(0x00000008)
423#define IMAGE_SCN_TYPE_COPY UINT32_C(0x00000010)
424
425#define IMAGE_SCN_CNT_CODE UINT32_C(0x00000020)
426#define IMAGE_SCN_CNT_INITIALIZED_DATA UINT32_C(0x00000040)
427#define IMAGE_SCN_CNT_UNINITIALIZED_DATA UINT32_C(0x00000080)
428
429#define IMAGE_SCN_LNK_OTHER UINT32_C(0x00000100)
430#define IMAGE_SCN_LNK_INFO UINT32_C(0x00000200)
431#define IMAGE_SCN_TYPE_OVER UINT32_C(0x00000400)
432#define IMAGE_SCN_LNK_REMOVE UINT32_C(0x00000800)
433#define IMAGE_SCN_LNK_COMDAT UINT32_C(0x00001000)
434#define IMAGE_SCN_MEM_PROTECTED UINT32_C(0x00004000)
435#define IMAGE_SCN_NO_DEFER_SPEC_EXC UINT32_C(0x00004000)
436#define IMAGE_SCN_GPREL UINT32_C(0x00008000)
437#define IMAGE_SCN_MEM_FARDATA UINT32_C(0x00008000)
438#define IMAGE_SCN_MEM_SYSHEAP UINT32_C(0x00010000)
439#define IMAGE_SCN_MEM_PURGEABLE UINT32_C(0x00020000)
440#define IMAGE_SCN_MEM_16BIT UINT32_C(0x00020000)
441#define IMAGE_SCN_MEM_LOCKED UINT32_C(0x00040000)
442#define IMAGE_SCN_MEM_PRELOAD UINT32_C(0x00080000)
443
444#define IMAGE_SCN_ALIGN_1BYTES UINT32_C(0x00100000)
445#define IMAGE_SCN_ALIGN_2BYTES UINT32_C(0x00200000)
446#define IMAGE_SCN_ALIGN_4BYTES UINT32_C(0x00300000)
447#define IMAGE_SCN_ALIGN_8BYTES UINT32_C(0x00400000)
448#define IMAGE_SCN_ALIGN_16BYTES UINT32_C(0x00500000)
449#define IMAGE_SCN_ALIGN_32BYTES UINT32_C(0x00600000)
450#define IMAGE_SCN_ALIGN_64BYTES UINT32_C(0x00700000)
451#define IMAGE_SCN_ALIGN_128BYTES UINT32_C(0x00800000)
452#define IMAGE_SCN_ALIGN_256BYTES UINT32_C(0x00900000)
453#define IMAGE_SCN_ALIGN_512BYTES UINT32_C(0x00A00000)
454#define IMAGE_SCN_ALIGN_1024BYTES UINT32_C(0x00B00000)
455#define IMAGE_SCN_ALIGN_2048BYTES UINT32_C(0x00C00000)
456#define IMAGE_SCN_ALIGN_4096BYTES UINT32_C(0x00D00000)
457#define IMAGE_SCN_ALIGN_8192BYTES UINT32_C(0x00E00000)
458#define IMAGE_SCN_ALIGN_MASK UINT32_C(0x00F00000)
459#define IMAGE_SCN_ALIGN_SHIFT 20
460
461#define IMAGE_SCN_LNK_NRELOC_OVFL UINT32_C(0x01000000)
462#define IMAGE_SCN_MEM_DISCARDABLE UINT32_C(0x02000000)
463#define IMAGE_SCN_MEM_NOT_CACHED UINT32_C(0x04000000)
464#define IMAGE_SCN_MEM_NOT_PAGED UINT32_C(0x08000000)
465#define IMAGE_SCN_MEM_SHARED UINT32_C(0x10000000)
466#define IMAGE_SCN_MEM_EXECUTE UINT32_C(0x20000000)
467#define IMAGE_SCN_MEM_READ UINT32_C(0x40000000)
468#define IMAGE_SCN_MEM_WRITE UINT32_C(0x80000000)
469/** @} */
470
471
472/**
473 * PE image base relocations block header.
474 *
475 * This found in IMAGE_DIRECTORY_ENTRY_BASERELOC. Each entry is follow
476 * immediately by an array of 16-bit words, where the lower 12-bits are used
477 * for the page offset and the upper 4-bits for the base relocation type
478 * (IMAGE_REL_BASE_XXX). The block should be padded with
479 * IMAGE_REL_BASED_ABSOLUTE entries to ensure 32-bit alignment of this header.
480 */
481typedef struct _IMAGE_BASE_RELOCATION
482{
483 /** The RVA of the page/block the following ase relocations applies to. */
484 uint32_t VirtualAddress;
485 /** The size of this relocation block, including this header. */
486 uint32_t SizeOfBlock;
487} IMAGE_BASE_RELOCATION;
488AssertCompileSize(IMAGE_BASE_RELOCATION, 8);
489typedef IMAGE_BASE_RELOCATION *PIMAGE_BASE_RELOCATION;
490typedef IMAGE_BASE_RELOCATION const *PCIMAGE_BASE_RELOCATION;
491
492/** @name IMAGE_REL_BASED_XXX - PE base relocations.
493 * Found in the IMAGE_DIRECTORY_ENTRY_BASERELOC data directory.
494 * @{ */
495#define IMAGE_REL_BASED_ABSOLUTE UINT16_C(0x0)
496#define IMAGE_REL_BASED_HIGH UINT16_C(0x1)
497#define IMAGE_REL_BASED_LOW UINT16_C(0x2)
498#define IMAGE_REL_BASED_HIGHLOW UINT16_C(0x3)
499#define IMAGE_REL_BASED_HIGHADJ UINT16_C(0x4)
500#define IMAGE_REL_BASED_MIPS_JMPADDR UINT16_C(0x5)
501#define IMAGE_REL_BASED_MIPS_JMPADDR16 UINT16_C(0x9)
502#define IMAGE_REL_BASED_IA64_IMM64 UINT16_C(0x9)
503#define IMAGE_REL_BASED_DIR64 UINT16_C(0xa)
504#define IMAGE_REL_BASED_HIGH3ADJ UINT16_C(0xb)
505/** @} */
506
507/**
508 * PE export directory entry.
509 */
510typedef struct _IMAGE_EXPORT_DIRECTORY
511{
512 uint32_t Characteristics;
513 uint32_t TimeDateStamp;
514 uint16_t MajorVersion;
515 uint16_t MinorVersion;
516 uint32_t Name;
517 uint32_t Base;
518 uint32_t NumberOfFunctions;
519 uint32_t NumberOfNames;
520 uint32_t AddressOfFunctions;
521 uint32_t AddressOfNames;
522 uint32_t AddressOfNameOrdinals;
523} IMAGE_EXPORT_DIRECTORY;
524AssertCompileSize(IMAGE_EXPORT_DIRECTORY, 40);
525typedef IMAGE_EXPORT_DIRECTORY *PIMAGE_EXPORT_DIRECTORY;
526typedef IMAGE_EXPORT_DIRECTORY const *PCIMAGE_EXPORT_DIRECTORY;
527
528
529/**
530 * PE import directory entry.
531 */
532typedef struct _IMAGE_IMPORT_DESCRIPTOR
533{
534 union
535 {
536 uint32_t Characteristics;
537 uint32_t OriginalFirstThunk;
538 } u;
539 uint32_t TimeDateStamp;
540 uint32_t ForwarderChain;
541 uint32_t Name;
542 uint32_t FirstThunk;
543} IMAGE_IMPORT_DESCRIPTOR;
544AssertCompileSize(IMAGE_IMPORT_DESCRIPTOR, 20);
545typedef IMAGE_IMPORT_DESCRIPTOR *PIMAGE_IMPORT_DESCRIPTOR;
546typedef IMAGE_IMPORT_DESCRIPTOR const *PCIMAGE_IMPORT_DESCRIPTOR;
547
548/**
549 * Something we currently don't make use of...
550 */
551typedef struct _IMAGE_IMPORT_BY_NAME
552{
553 uint16_t Hint;
554 uint8_t Name[1];
555} IMAGE_IMPORT_BY_NAME;
556AssertCompileSize(IMAGE_IMPORT_BY_NAME, 4);
557typedef IMAGE_IMPORT_BY_NAME *PIMAGE_IMPORT_BY_NAME;
558typedef IMAGE_IMPORT_BY_NAME const *PCIMAGE_IMPORT_BY_NAME;
559
560
561#if 0
562/* The image_thunk_data32/64 structures are not very helpful except for getting RSI.
563 keep them around till all the code has been converted. */
564typedef struct _IMAGE_THUNK_DATA64
565{
566 union
567 {
568 uint64_t ForwarderString;
569 uint64_t Function;
570 uint64_t Ordinal;
571 uint64_t AddressOfData;
572 } u1;
573} IMAGE_THUNK_DATA64;
574typedef IMAGE_THUNK_DATA64 *PIMAGE_THUNK_DATA64;
575typedef IMAGE_THUNK_DATA64 const *PCIMAGE_THUNK_DATA64;
576
577typedef struct _IMAGE_THUNK_DATA32
578{
579 union
580 {
581 uint32_t ForwarderString;
582 uint32_t Function;
583 uint32_t Ordinal;
584 uint32_t AddressOfData;
585 } u1;
586} IMAGE_THUNK_DATA32;
587typedef IMAGE_THUNK_DATA32 *PIMAGE_THUNK_DATA32;
588typedef IMAGE_THUNK_DATA32 const *PCIMAGE_THUNK_DATA32;
589#endif
590
591/** @name PE import directory macros.
592 * @{ */
593#define IMAGE_ORDINAL_FLAG32 UINT32_C(0x80000000)
594#define IMAGE_ORDINAL32(ord) ((ord) & UINT32_C(0xffff))
595#define IMAGE_SNAP_BY_ORDINAL32(ord) (!!((ord) & IMAGE_ORDINAL_FLAG32))
596
597#define IMAGE_ORDINAL_FLAG64 UINT64_C(0x8000000000000000)
598#define IMAGE_ORDINAL64(ord) ((ord) & UINT32_C(0xffff))
599#define IMAGE_SNAP_BY_ORDINAL64(ord) (!!((ord) & IMAGE_ORDINAL_FLAG64))
600/** @} */
601
602/** @name PE Resource directory
603 * @{ */
604typedef struct _IMAGE_RESOURCE_DIRECTORY
605{
606 uint32_t Characteristics;
607 uint32_t TimeDateStamp;
608 uint16_t MajorVersion;
609 uint16_t MinorVersion;
610 uint16_t NumberOfNamedEntries;
611 uint16_t NumberOfIdEntries;
612} IMAGE_RESOURCE_DIRECTORY;
613typedef IMAGE_RESOURCE_DIRECTORY *PIMAGE_RESOURCE_DIRECTORY;
614typedef IMAGE_RESOURCE_DIRECTORY const *PCIMAGE_RESOURCE_DIRECTORY;
615
616typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY
617{
618 union
619 {
620 struct
621 {
622 uint32_t NameOffset : 31;
623 uint32_t NameIsString : 1; /**< IMAGE_RESOURCE_NAME_IS_STRING */
624 } s;
625 uint32_t Name;
626 uint16_t Id;
627 } u;
628 union
629 {
630 struct
631 {
632 uint32_t OffsetToDirectory : 31;
633 uint32_t DataIsDirectory : 1; /**< IMAGE_RESOURCE_DATA_IS_DIRECTORY*/
634 } s2;
635 uint32_t OffsetToData;
636 } u2;
637} IMAGE_RESOURCE_DIRECTORY_ENTRY;
638typedef IMAGE_RESOURCE_DIRECTORY_ENTRY *PIMAGE_RESOURCE_DIRECTORY_ENTRY;
639typedef IMAGE_RESOURCE_DIRECTORY_ENTRY const *PCIMAGE_RESOURCE_DIRECTORY_ENTRY;
640
641#define IMAGE_RESOURCE_NAME_IS_STRING UINT32_C(0x80000000)
642#define IMAGE_RESOURCE_DATA_IS_DIRECTORY UINT32_C(0x80000000)
643
644typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING
645{
646 uint16_t Length;
647 char NameString[1];
648} IMAGE_RESOURCE_DIRECTORY_STRING;
649typedef IMAGE_RESOURCE_DIRECTORY_STRING *PIMAGE_RESOURCE_DIRECTORY_STRING;
650typedef IMAGE_RESOURCE_DIRECTORY_STRING const *PCIMAGE_RESOURCE_DIRECTORY_STRING;
651
652
653typedef struct _IMAGE_RESOURCE_DIR_STRING_U
654{
655 uint16_t Length;
656 RTUTF16 NameString[1];
657} IMAGE_RESOURCE_DIR_STRING_U;
658typedef IMAGE_RESOURCE_DIR_STRING_U *PIMAGE_RESOURCE_DIR_STRING_U;
659typedef IMAGE_RESOURCE_DIR_STRING_U const *PCIMAGE_RESOURCE_DIR_STRING_U;
660
661
662typedef struct _IMAGE_RESOURCE_DATA_ENTRY
663{
664 uint32_t OffsetToData;
665 uint32_t Size;
666 uint32_t CodePage;
667 uint32_t Reserved;
668} IMAGE_RESOURCE_DATA_ENTRY;
669typedef IMAGE_RESOURCE_DATA_ENTRY *PIMAGE_RESOURCE_DATA_ENTRY;
670typedef IMAGE_RESOURCE_DATA_ENTRY const *PCIMAGE_RESOURCE_DATA_ENTRY;
671
672/** @} */
673
674/** @name Image exception information
675 * @{ */
676
677/** This structure is used by AMD64 and "Itanic".
678 * MIPS uses a different one. ARM, SH3, SH4 and PPC on WinCE also uses a different one. */
679typedef struct _IMAGE_RUNTIME_FUNCTION_ENTRY
680{
681 uint32_t BeginAddress;
682 uint32_t EndAddress;
683 uint32_t UnwindInfoAddress;
684} IMAGE_RUNTIME_FUNCTION_ENTRY;
685AssertCompileSize(IMAGE_RUNTIME_FUNCTION_ENTRY, 12);
686typedef IMAGE_RUNTIME_FUNCTION_ENTRY *PIMAGE_RUNTIME_FUNCTION_ENTRY;
687typedef IMAGE_RUNTIME_FUNCTION_ENTRY const *PCIMAGE_RUNTIME_FUNCTION_ENTRY;
688
689/**
690 * An unwind code for AMD64 and ARM64.
691 *
692 * @note Also known as UNWIND_CODE or _UNWIND_CODE.
693 */
694typedef union IMAGE_UNWIND_CODE
695{
696 struct
697 {
698 /** The prolog offset where the change takes effect.
699 * This means the instruction following the one being described. */
700 uint8_t CodeOffset;
701 /** Unwind opcode.
702 * For AMD64 see IMAGE_AMD64_UNWIND_OP_CODES. */
703 RT_GCC_EXTENSION uint8_t UnwindOp : 4;
704 /** Opcode specific. */
705 RT_GCC_EXTENSION uint8_t OpInfo : 4;
706 } u;
707 uint16_t FrameOffset;
708} IMAGE_UNWIND_CODE;
709AssertCompileSize(IMAGE_UNWIND_CODE, 2);
710
711/**
712 * Unwind information for AMD64 and ARM64.
713 *
714 * Pointed to by IMAGE_RUNTIME_FUNCTION_ENTRY::UnwindInfoAddress,
715 *
716 * @note Also known as UNWIND_INFO or _UNWIND_INFO.
717 */
718typedef struct IMAGE_UNWIND_INFO
719{
720 /** Version, currently 1 or 2. The latter if IMAGE_AMD64_UWOP_EPILOG is used. */
721 RT_GCC_EXTENSION uint8_t Version : 3;
722 /** IMAGE_UNW_FLAG_XXX */
723 RT_GCC_EXTENSION uint8_t Flags : 5;
724 /** Size of function prolog. */
725 uint8_t SizeOfProlog;
726 /** Number of opcodes in aOpcodes. */
727 uint8_t CountOfCodes;
728 /** Initial frame register. */
729 RT_GCC_EXTENSION uint8_t FrameRegister : 4;
730 /** Scaled frame register offset. */
731 RT_GCC_EXTENSION uint8_t FrameOffset : 4;
732 /** Unwind opcodes. */
733 RT_FLEXIBLE_ARRAY_EXTENSION
734 IMAGE_UNWIND_CODE aOpcodes[RT_FLEXIBLE_ARRAY];
735} IMAGE_UNWIND_INFO;
736AssertCompileMemberOffset(IMAGE_UNWIND_INFO, aOpcodes, 4);
737typedef IMAGE_UNWIND_INFO *PIMAGE_UNWIND_INFO;
738typedef IMAGE_UNWIND_INFO const *PCIMAGE_UNWIND_INFO;
739
740/** IMAGE_UNW_FLAGS_XXX - IMAGE_UNWIND_INFO::Flags.
741 * @{ */
742/** No handler.
743 * @note Also know as UNW_FLAG_NHANDLER. */
744#define IMAGE_UNW_FLAGS_NHANDLER 0
745/** Have exception handler (RVA after codes, dword aligned.)
746 * @note Also know as UNW_FLAG_NHANDLER. */
747#define IMAGE_UNW_FLAGS_EHANDLER 1
748/** Have unwind handler (RVA after codes, dword aligned.)
749 * @note Also know as UNW_FLAG_NHANDLER. */
750#define IMAGE_UNW_FLAGS_UHANDLER 2
751/** Set if not primary unwind info for a function. An
752 * IMAGE_RUNTIME_FUNCTION_ENTRY giving the chained unwind info follows the
753 * aOpcodes array at a dword aligned offset. */
754#define IMAGE_UNW_FLAGS_CHAININFO 4
755/** @} */
756
757/**
758 * AMD64 unwind opcodes.
759 */
760typedef enum IMAGE_AMD64_UNWIND_OP_CODES
761{
762 /** Push non-volatile register (OpInfo).
763 * YASM: [pushreg reg]
764 * MASM: .PUSHREG reg */
765 IMAGE_AMD64_UWOP_PUSH_NONVOL = 0,
766 /** Stack allocation: Size stored in scaled in the next slot if OpInfo == 0,
767 * otherwise stored unscaled in the next two slots.
768 * YASM: [allocstack size]
769 * MASM: .ALLOCSTACK size */
770 IMAGE_AMD64_UWOP_ALLOC_LARGE,
771 /** Stack allocation: OpInfo = size / 8 - 1.
772 * YASM: [allocstack size]
773 * MASM: .ALLOCSTACK size */
774 IMAGE_AMD64_UWOP_ALLOC_SMALL,
775 /** Set frame pointer register: RSP + FrameOffset * 16.
776 * YASM: [setframe reg, offset]
777 * MASM: .SETFRAME reg, offset
778 * @code
779 * LEA RBP, [RSP + 20h]
780 * [setframe RBP, 20h]
781 * @endcode */
782 IMAGE_AMD64_UWOP_SET_FPREG,
783 /** Save non-volatile register (OpInfo) on stack (RSP/FP + next slot).
784 * YASM: [savereg reg, offset]
785 * MASM: .SAVEREG reg, offset */
786 IMAGE_AMD64_UWOP_SAVE_NONVOL,
787 /** Save non-volatile register (OpInfo) on stack (RSP/FP + next two slots).
788 * YASM: [savereg reg, offset]
789 * MASM: .SAVEREG reg, offset */
790 IMAGE_AMD64_UWOP_SAVE_NONVOL_FAR,
791 /** Epilog info, version 2+.
792 *
793 * The first time this opcode is used, the CodeOffset gives the size of the
794 * epilog and bit 0 of the OpInfo field indicates that there is only one
795 * epilog at the very end of the function.
796 *
797 * Subsequent uses of this opcode specifies epilog start offsets relative to
798 * the end of the function, using CodeOffset for the 8 lower bits and OpInfo
799 * for bits 8 thru 11.
800 *
801 * The compiler seems to stack allocations and register saving opcodes and
802 * indicates the location mirroring the first IMAGE_AMD64_UWOP_PUSH_NONVOL. */
803 IMAGE_AMD64_UWOP_EPILOG,
804 /** Undefined. */
805 IMAGE_AMD64_UWOP_RESERVED_7,
806 /** Save 128-bit XMM register (OpInfo) on stack (RSP/FP + next slot).
807 * YASM: [savexmm128 reg, offset]
808 * MASM: .SAVEXMM128 reg, offset */
809 IMAGE_AMD64_UWOP_SAVE_XMM128,
810 /** Save 128-bit XMM register (OpInfo) on stack (RSP/FP + next two slots).
811 * YASM: [savexmm128 reg, offset]
812 * MASM: .SAVEXMM128 reg, offset */
813 IMAGE_AMD64_UWOP_SAVE_XMM128_FAR,
814 /** IRET frame, OpInfo serves as error code indicator.
815 * YASM: [pushframe with-code]
816 * MASM: .pushframe with-code */
817 IMAGE_AMD64_UWOP_PUSH_MACHFRAME
818} IMAGE_AMD64_UNWIND_OP_CODES;
819/** @} */
820
821
822
823/** @name Image load config directories
824 * @{ */
825
826/** @since Windows 10 (preview 9879) */
827typedef struct _IMAGE_LOAD_CONFIG_CODE_INTEGRITY
828{
829 uint16_t Flags;
830 uint16_t Catalog;
831 uint32_t CatalogOffset;
832 uint32_t Reserved;
833} IMAGE_LOAD_CONFIG_CODE_INTEGRITY;
834AssertCompileSize(IMAGE_LOAD_CONFIG_CODE_INTEGRITY, 12);
835typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY *PIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
836typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY const *PCIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
837
838typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V1
839{
840 uint32_t Size;
841 uint32_t TimeDateStamp;
842 uint16_t MajorVersion;
843 uint16_t MinorVersion;
844 uint32_t GlobalFlagsClear;
845 uint32_t GlobalFlagsSet;
846 uint32_t CriticalSectionDefaultTimeout;
847 uint32_t DeCommitFreeBlockThreshold;
848 uint32_t DeCommitTotalFreeThreshold;
849 uint32_t LockPrefixTable;
850 uint32_t MaximumAllocationSize;
851 uint32_t VirtualMemoryThreshold;
852 uint32_t ProcessHeapFlags;
853 uint32_t ProcessAffinityMask;
854 uint16_t CSDVersion;
855 uint16_t DependentLoadFlags;
856 uint32_t EditList;
857 uint32_t SecurityCookie;
858} IMAGE_LOAD_CONFIG_DIRECTORY32_V1;
859AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V1, 0x40);
860typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
861typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
862
863typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V2
864{
865 uint32_t Size;
866 uint32_t TimeDateStamp;
867 uint16_t MajorVersion;
868 uint16_t MinorVersion;
869 uint32_t GlobalFlagsClear;
870 uint32_t GlobalFlagsSet;
871 uint32_t CriticalSectionDefaultTimeout;
872 uint32_t DeCommitFreeBlockThreshold;
873 uint32_t DeCommitTotalFreeThreshold;
874 uint32_t LockPrefixTable;
875 uint32_t MaximumAllocationSize;
876 uint32_t VirtualMemoryThreshold;
877 uint32_t ProcessHeapFlags;
878 uint32_t ProcessAffinityMask;
879 uint16_t CSDVersion;
880 uint16_t DependentLoadFlags;
881 uint32_t EditList;
882 uint32_t SecurityCookie;
883 uint32_t SEHandlerTable;
884 uint32_t SEHandlerCount;
885} IMAGE_LOAD_CONFIG_DIRECTORY32_V2;
886AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V2, 0x48);
887typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
888typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
889
890typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V3
891{
892 uint32_t Size;
893 uint32_t TimeDateStamp;
894 uint16_t MajorVersion;
895 uint16_t MinorVersion;
896 uint32_t GlobalFlagsClear;
897 uint32_t GlobalFlagsSet;
898 uint32_t CriticalSectionDefaultTimeout;
899 uint32_t DeCommitFreeBlockThreshold;
900 uint32_t DeCommitTotalFreeThreshold;
901 uint32_t LockPrefixTable;
902 uint32_t MaximumAllocationSize;
903 uint32_t VirtualMemoryThreshold;
904 uint32_t ProcessHeapFlags;
905 uint32_t ProcessAffinityMask;
906 uint16_t CSDVersion;
907 uint16_t DependentLoadFlags;
908 uint32_t EditList;
909 uint32_t SecurityCookie;
910 uint32_t SEHandlerTable;
911 uint32_t SEHandlerCount;
912 uint32_t GuardCFCCheckFunctionPointer;
913 uint32_t GuardCFDispatchFunctionPointer;
914 uint32_t GuardCFFunctionTable;
915 uint32_t GuardCFFunctionCount;
916 uint32_t GuardFlags;
917} IMAGE_LOAD_CONFIG_DIRECTORY32_V3;
918AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V3, 0x5c);
919typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
920typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
921
922/** @since Windows 10 (preview 9879) */
923typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V4
924{
925 uint32_t Size;
926 uint32_t TimeDateStamp;
927 uint16_t MajorVersion;
928 uint16_t MinorVersion;
929 uint32_t GlobalFlagsClear;
930 uint32_t GlobalFlagsSet;
931 uint32_t CriticalSectionDefaultTimeout;
932 uint32_t DeCommitFreeBlockThreshold;
933 uint32_t DeCommitTotalFreeThreshold;
934 uint32_t LockPrefixTable;
935 uint32_t MaximumAllocationSize;
936 uint32_t VirtualMemoryThreshold;
937 uint32_t ProcessHeapFlags;
938 uint32_t ProcessAffinityMask;
939 uint16_t CSDVersion;
940 uint16_t DependentLoadFlags;
941 uint32_t EditList;
942 uint32_t SecurityCookie;
943 uint32_t SEHandlerTable;
944 uint32_t SEHandlerCount;
945 uint32_t GuardCFCCheckFunctionPointer;
946 uint32_t GuardCFDispatchFunctionPointer;
947 uint32_t GuardCFFunctionTable;
948 uint32_t GuardCFFunctionCount;
949 uint32_t GuardFlags;
950 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
951} IMAGE_LOAD_CONFIG_DIRECTORY32_V4;
952AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V4, 0x68);
953typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
954typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
955
956/** @since Windows 10 build 14286 (or maybe earlier). */
957typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V5
958{
959 uint32_t Size;
960 uint32_t TimeDateStamp;
961 uint16_t MajorVersion;
962 uint16_t MinorVersion;
963 uint32_t GlobalFlagsClear;
964 uint32_t GlobalFlagsSet;
965 uint32_t CriticalSectionDefaultTimeout;
966 uint32_t DeCommitFreeBlockThreshold;
967 uint32_t DeCommitTotalFreeThreshold;
968 uint32_t LockPrefixTable;
969 uint32_t MaximumAllocationSize;
970 uint32_t VirtualMemoryThreshold;
971 uint32_t ProcessHeapFlags;
972 uint32_t ProcessAffinityMask;
973 uint16_t CSDVersion;
974 uint16_t DependentLoadFlags;
975 uint32_t EditList;
976 uint32_t SecurityCookie;
977 uint32_t SEHandlerTable;
978 uint32_t SEHandlerCount;
979 uint32_t GuardCFCCheckFunctionPointer;
980 uint32_t GuardCFDispatchFunctionPointer;
981 uint32_t GuardCFFunctionTable;
982 uint32_t GuardCFFunctionCount;
983 uint32_t GuardFlags;
984 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
985 uint32_t GuardAddressTakenIatEntryTable;
986 uint32_t GuardAddressTakenIatEntryCount;
987 uint32_t GuardLongJumpTargetTable;
988 uint32_t GuardLongJumpTargetCount;
989} IMAGE_LOAD_CONFIG_DIRECTORY32_V5;
990AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V5, 0x78);
991typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V5 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V5;
992typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V5 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V5;
993
994/** @since Windows 10 build 14383 (or maybe earlier). */
995typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V6
996{
997 uint32_t Size; /**< 0x00 */
998 uint32_t TimeDateStamp; /**< 0x04 */
999 uint16_t MajorVersion; /**< 0x08 */
1000 uint16_t MinorVersion; /**< 0x0a */
1001 uint32_t GlobalFlagsClear; /**< 0x0c */
1002 uint32_t GlobalFlagsSet; /**< 0x10 */
1003 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1004 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1005 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1006 uint32_t LockPrefixTable; /**< 0x20 */
1007 uint32_t MaximumAllocationSize; /**< 0x24 */
1008 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1009 uint32_t ProcessHeapFlags; /**< 0x2c */
1010 uint32_t ProcessAffinityMask; /**< 0x30 */
1011 uint16_t CSDVersion; /**< 0x34 */
1012 uint16_t DependentLoadFlags; /**< 0x36 */
1013 uint32_t EditList; /**< 0x38 */
1014 uint32_t SecurityCookie; /**< 0x3c */
1015 uint32_t SEHandlerTable; /**< 0x40 */
1016 uint32_t SEHandlerCount; /**< 0x44 */
1017 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1018 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1019 uint32_t GuardCFFunctionTable; /**< 0x50 */
1020 uint32_t GuardCFFunctionCount; /**< 0x54 */
1021 uint32_t GuardFlags; /**< 0x58 */
1022 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1023 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1024 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1025 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1026 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1027 uint32_t DynamicValueRelocTable; /**< 0x78 */
1028 uint32_t HybridMetadataPointer; /**< 0x7c */
1029} IMAGE_LOAD_CONFIG_DIRECTORY32_V6;
1030AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V6, 0x80);
1031typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V6 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V6;
1032typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V6 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V6;
1033
1034/** @since Windows 10 build 14901 (or maybe earlier). */
1035typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V7
1036{
1037 uint32_t Size; /**< 0x00 */
1038 uint32_t TimeDateStamp; /**< 0x04 */
1039 uint16_t MajorVersion; /**< 0x08 */
1040 uint16_t MinorVersion; /**< 0x0a */
1041 uint32_t GlobalFlagsClear; /**< 0x0c */
1042 uint32_t GlobalFlagsSet; /**< 0x10 */
1043 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1044 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1045 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1046 uint32_t LockPrefixTable; /**< 0x20 */
1047 uint32_t MaximumAllocationSize; /**< 0x24 */
1048 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1049 uint32_t ProcessHeapFlags; /**< 0x2c */
1050 uint32_t ProcessAffinityMask; /**< 0x30 */
1051 uint16_t CSDVersion; /**< 0x34 */
1052 uint16_t DependentLoadFlags; /**< 0x36 */
1053 uint32_t EditList; /**< 0x38 */
1054 uint32_t SecurityCookie; /**< 0x3c */
1055 uint32_t SEHandlerTable; /**< 0x40 */
1056 uint32_t SEHandlerCount; /**< 0x44 */
1057 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1058 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1059 uint32_t GuardCFFunctionTable; /**< 0x50 */
1060 uint32_t GuardCFFunctionCount; /**< 0x54 */
1061 uint32_t GuardFlags; /**< 0x58 */
1062 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1063 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1064 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1065 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1066 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1067 uint32_t DynamicValueRelocTable; /**< 0x78 */
1068 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1069 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1070 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1071 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1072 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1073 uint16_t Reserved2; /**< 0x8e */
1074} IMAGE_LOAD_CONFIG_DIRECTORY32_V7;
1075AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V7, 0x90);
1076typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V7 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V7;
1077typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V7 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V7;
1078
1079/** @since Windows 10 build 15002 (or maybe earlier). */
1080typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V8
1081{
1082 uint32_t Size; /**< 0x00 */
1083 uint32_t TimeDateStamp; /**< 0x04 */
1084 uint16_t MajorVersion; /**< 0x08 */
1085 uint16_t MinorVersion; /**< 0x0a */
1086 uint32_t GlobalFlagsClear; /**< 0x0c */
1087 uint32_t GlobalFlagsSet; /**< 0x10 */
1088 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1089 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1090 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1091 uint32_t LockPrefixTable; /**< 0x20 */
1092 uint32_t MaximumAllocationSize; /**< 0x24 */
1093 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1094 uint32_t ProcessHeapFlags; /**< 0x2c */
1095 uint32_t ProcessAffinityMask; /**< 0x30 */
1096 uint16_t CSDVersion; /**< 0x34 */
1097 uint16_t DependentLoadFlags; /**< 0x36 */
1098 uint32_t EditList; /**< 0x38 */
1099 uint32_t SecurityCookie; /**< 0x3c */
1100 uint32_t SEHandlerTable; /**< 0x40 */
1101 uint32_t SEHandlerCount; /**< 0x44 */
1102 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1103 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1104 uint32_t GuardCFFunctionTable; /**< 0x50 */
1105 uint32_t GuardCFFunctionCount; /**< 0x54 */
1106 uint32_t GuardFlags; /**< 0x58 */
1107 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1108 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1109 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1110 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1111 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1112 uint32_t DynamicValueRelocTable; /**< 0x78 */
1113 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1114 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1115 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1116 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1117 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1118 uint16_t Reserved2; /**< 0x8e */
1119 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1120 uint32_t HotPatchTableOffset; /**< 0x94 */
1121} IMAGE_LOAD_CONFIG_DIRECTORY32_V8;
1122AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V8, 0x98);
1123typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V8 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V8;
1124typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V8 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V8;
1125
1126/** @since Windows 10 build 16237 (or maybe earlier). */
1127typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V9
1128{
1129 uint32_t Size; /**< 0x00 */
1130 uint32_t TimeDateStamp; /**< 0x04 */
1131 uint16_t MajorVersion; /**< 0x08 */
1132 uint16_t MinorVersion; /**< 0x0a */
1133 uint32_t GlobalFlagsClear; /**< 0x0c */
1134 uint32_t GlobalFlagsSet; /**< 0x10 */
1135 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1136 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1137 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1138 uint32_t LockPrefixTable; /**< 0x20 */
1139 uint32_t MaximumAllocationSize; /**< 0x24 */
1140 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1141 uint32_t ProcessHeapFlags; /**< 0x2c */
1142 uint32_t ProcessAffinityMask; /**< 0x30 */
1143 uint16_t CSDVersion; /**< 0x34 */
1144 uint16_t DependentLoadFlags; /**< 0x36 */
1145 uint32_t EditList; /**< 0x38 */
1146 uint32_t SecurityCookie; /**< 0x3c */
1147 uint32_t SEHandlerTable; /**< 0x40 */
1148 uint32_t SEHandlerCount; /**< 0x44 */
1149 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1150 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1151 uint32_t GuardCFFunctionTable; /**< 0x50 */
1152 uint32_t GuardCFFunctionCount; /**< 0x54 */
1153 uint32_t GuardFlags; /**< 0x58 */
1154 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1155 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1156 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1157 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1158 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1159 uint32_t DynamicValueRelocTable; /**< 0x78 */
1160 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1161 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1162 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1163 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1164 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1165 uint16_t Reserved2; /**< 0x8e */
1166 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1167 uint32_t HotPatchTableOffset; /**< 0x94 */
1168 uint32_t Reserved3; /**< 0x98 */
1169 uint32_t EnclaveConfigurationPointer; /**< 0x9c */
1170} IMAGE_LOAD_CONFIG_DIRECTORY32_V9;
1171AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V9, 0xa0);
1172typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V9 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V9;
1173typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V9 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V9;
1174
1175/** @since Windows 10 build 18362 (or maybe earlier). */
1176typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V10
1177{
1178 uint32_t Size; /**< 0x00 */
1179 uint32_t TimeDateStamp; /**< 0x04 */
1180 uint16_t MajorVersion; /**< 0x08 */
1181 uint16_t MinorVersion; /**< 0x0a */
1182 uint32_t GlobalFlagsClear; /**< 0x0c */
1183 uint32_t GlobalFlagsSet; /**< 0x10 */
1184 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1185 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1186 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1187 uint32_t LockPrefixTable; /**< 0x20 */
1188 uint32_t MaximumAllocationSize; /**< 0x24 */
1189 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1190 uint32_t ProcessHeapFlags; /**< 0x2c */
1191 uint32_t ProcessAffinityMask; /**< 0x30 */
1192 uint16_t CSDVersion; /**< 0x34 */
1193 uint16_t DependentLoadFlags; /**< 0x36 */
1194 uint32_t EditList; /**< 0x38 */
1195 uint32_t SecurityCookie; /**< 0x3c */
1196 uint32_t SEHandlerTable; /**< 0x40 */
1197 uint32_t SEHandlerCount; /**< 0x44 */
1198 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1199 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1200 uint32_t GuardCFFunctionTable; /**< 0x50 */
1201 uint32_t GuardCFFunctionCount; /**< 0x54 */
1202 uint32_t GuardFlags; /**< 0x58 */
1203 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1204 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1205 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1206 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1207 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1208 uint32_t DynamicValueRelocTable; /**< 0x78 */
1209 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1210 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1211 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1212 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1213 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1214 uint16_t Reserved2; /**< 0x8e */
1215 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1216 uint32_t HotPatchTableOffset; /**< 0x94 */
1217 uint32_t Reserved3; /**< 0x98 */
1218 uint32_t EnclaveConfigurationPointer; /**< 0x9c */
1219 uint32_t VolatileMetadataPointer; /**< 0xa0 */
1220} IMAGE_LOAD_CONFIG_DIRECTORY32_V10;
1221AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V10, 0xa4);
1222typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V10 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V10;
1223typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V10 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V10;
1224
1225/** @since Windows 10 build 19564 (or maybe earlier). */
1226typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V11
1227{
1228 uint32_t Size; /**< 0x00 */
1229 uint32_t TimeDateStamp; /**< 0x04 */
1230 uint16_t MajorVersion; /**< 0x08 */
1231 uint16_t MinorVersion; /**< 0x0a */
1232 uint32_t GlobalFlagsClear; /**< 0x0c */
1233 uint32_t GlobalFlagsSet; /**< 0x10 */
1234 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1235 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1236 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1237 uint32_t LockPrefixTable; /**< 0x20 */
1238 uint32_t MaximumAllocationSize; /**< 0x24 */
1239 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1240 uint32_t ProcessHeapFlags; /**< 0x2c */
1241 uint32_t ProcessAffinityMask; /**< 0x30 */
1242 uint16_t CSDVersion; /**< 0x34 */
1243 uint16_t DependentLoadFlags; /**< 0x36 */
1244 uint32_t EditList; /**< 0x38 */
1245 uint32_t SecurityCookie; /**< 0x3c */
1246 uint32_t SEHandlerTable; /**< 0x40 */
1247 uint32_t SEHandlerCount; /**< 0x44 */
1248 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1249 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1250 uint32_t GuardCFFunctionTable; /**< 0x50 */
1251 uint32_t GuardCFFunctionCount; /**< 0x54 */
1252 uint32_t GuardFlags; /**< 0x58 */
1253 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1254 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1255 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1256 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1257 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1258 uint32_t DynamicValueRelocTable; /**< 0x78 */
1259 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1260 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1261 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1262 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1263 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1264 uint16_t Reserved2; /**< 0x8e */
1265 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1266 uint32_t HotPatchTableOffset; /**< 0x94 */
1267 uint32_t Reserved3; /**< 0x98 */
1268 uint32_t EnclaveConfigurationPointer; /**< 0x9c - virtual address */
1269 uint32_t VolatileMetadataPointer; /**< 0xa0 */
1270 uint32_t GuardEHContinuationTable; /**< 0xa4 - virtual address */
1271 uint32_t GuardEHContinuationCount; /**< 0xa8 */
1272} IMAGE_LOAD_CONFIG_DIRECTORY32_V11;
1273AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V11, 0xac);
1274typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V11 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V11;
1275typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V11 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V11;
1276
1277/** @since Visual C++ 2019 / RS5_IMAGE_LOAD_CONFIG_DIRECTORY32. */
1278typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V12
1279{
1280 uint32_t Size; /**< 0x00 */
1281 uint32_t TimeDateStamp; /**< 0x04 */
1282 uint16_t MajorVersion; /**< 0x08 */
1283 uint16_t MinorVersion; /**< 0x0a */
1284 uint32_t GlobalFlagsClear; /**< 0x0c */
1285 uint32_t GlobalFlagsSet; /**< 0x10 */
1286 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1287 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1288 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1289 uint32_t LockPrefixTable; /**< 0x20 */
1290 uint32_t MaximumAllocationSize; /**< 0x24 */
1291 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1292 uint32_t ProcessHeapFlags; /**< 0x2c */
1293 uint32_t ProcessAffinityMask; /**< 0x30 */
1294 uint16_t CSDVersion; /**< 0x34 */
1295 uint16_t DependentLoadFlags; /**< 0x36 */
1296 uint32_t EditList; /**< 0x38 */
1297 uint32_t SecurityCookie; /**< 0x3c */
1298 uint32_t SEHandlerTable; /**< 0x40 */
1299 uint32_t SEHandlerCount; /**< 0x44 */
1300 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1301 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1302 uint32_t GuardCFFunctionTable; /**< 0x50 */
1303 uint32_t GuardCFFunctionCount; /**< 0x54 */
1304 uint32_t GuardFlags; /**< 0x58 */
1305 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1306 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1307 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1308 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1309 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1310 uint32_t DynamicValueRelocTable; /**< 0x78 */
1311 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1312 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1313 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1314 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1315 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1316 uint16_t Reserved2; /**< 0x8e */
1317 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1318 uint32_t HotPatchTableOffset; /**< 0x94 */
1319 uint32_t Reserved3; /**< 0x98 */
1320 uint32_t EnclaveConfigurationPointer; /**< 0x9c - virtual address */
1321 uint32_t VolatileMetadataPointer; /**< 0xa0 */
1322 uint32_t GuardEHContinuationTable; /**< 0xa4 - virtual address */
1323 uint32_t GuardEHContinuationCount; /**< 0xa8 */
1324 uint32_t GuardXFGCheckFunctionPointer; /**< 0xac */
1325 uint32_t GuardXFGDispatchFunctionPointer; /**< 0xb0 */
1326 uint32_t GuardXFGTableDispatchFunctionPointer; /**< 0xb4 */
1327} IMAGE_LOAD_CONFIG_DIRECTORY32_V12;
1328AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V12, 0xb8);
1329typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V12 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V12;
1330typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V12 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V12;
1331
1332/** @since Visual C++ 2019 16.x (found in 16.11.9) / RS5_IMAGE_LOAD_CONFIG_DIRECTORY32. */
1333typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V13
1334{
1335 uint32_t Size; /**< 0x00 - virtual address */
1336 uint32_t TimeDateStamp; /**< 0x04 */
1337 uint16_t MajorVersion; /**< 0x08 */
1338 uint16_t MinorVersion; /**< 0x0a */
1339 uint32_t GlobalFlagsClear; /**< 0x0c */
1340 uint32_t GlobalFlagsSet; /**< 0x10 */
1341 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1342 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 - virtual address */
1343 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c - virtual address */
1344 uint32_t LockPrefixTable; /**< 0x20 */
1345 uint32_t MaximumAllocationSize; /**< 0x24 */
1346 uint32_t VirtualMemoryThreshold; /**< 0x28 - virtual address of pointer variable */
1347 uint32_t ProcessHeapFlags; /**< 0x2c - virtual address of pointer variable */
1348 uint32_t ProcessAffinityMask; /**< 0x30 - virtual address */
1349 uint16_t CSDVersion; /**< 0x34 */
1350 uint16_t DependentLoadFlags; /**< 0x36 */
1351 uint32_t EditList; /**< 0x38 */
1352 uint32_t SecurityCookie; /**< 0x3c - virtual address */
1353 uint32_t SEHandlerTable; /**< 0x40 */
1354 uint32_t SEHandlerCount; /**< 0x44 - virtual address */
1355 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1356 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c - virtual address */
1357 uint32_t GuardCFFunctionTable; /**< 0x50 */
1358 uint32_t GuardCFFunctionCount; /**< 0x54 - virtual address */
1359 uint32_t GuardFlags; /**< 0x58 - virtual address of pointer variable */
1360 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1361 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 - virtual address */
1362 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1363 uint32_t GuardLongJumpTargetTable; /**< 0x70 - virtual address */
1364 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1365 uint32_t DynamicValueRelocTable; /**< 0x78 - virtual address */
1366 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1367 uint32_t GuardRFFailureRoutine; /**< 0x80 - virtual address */
1368 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 - virtual address of pointer variable */
1369 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1370 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1371 uint16_t Reserved2; /**< 0x8e */
1372 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 - virtual address of pointer variable */
1373 uint32_t HotPatchTableOffset; /**< 0x94 */
1374 uint32_t Reserved3; /**< 0x98 */
1375 uint32_t EnclaveConfigurationPointer; /**< 0x9c - virtual address of pointer variable */
1376 uint32_t VolatileMetadataPointer; /**< 0xa0 - virtual address of pointer variable */
1377 uint32_t GuardEHContinuationTable; /**< 0xa4 - virtual address */
1378 uint32_t GuardEHContinuationCount; /**< 0xa8 */
1379 uint32_t GuardXFGCheckFunctionPointer; /**< 0xac - virtual address of pointer variable */
1380 uint32_t GuardXFGDispatchFunctionPointer; /**< 0xb0 - virtual address of pointer variable */
1381 uint32_t GuardXFGTableDispatchFunctionPointer; /**< 0xb4 - virtual address of pointer variable */
1382 uint32_t CastGuardOsDeterminedFailureMode; /**< 0xb8 - virtual address */
1383} IMAGE_LOAD_CONFIG_DIRECTORY32_V13;
1384AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V13, 0xbc);
1385typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V13 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V13;
1386typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V13 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V13;
1387
1388typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V13 IMAGE_LOAD_CONFIG_DIRECTORY32;
1389typedef PIMAGE_LOAD_CONFIG_DIRECTORY32_V13 PIMAGE_LOAD_CONFIG_DIRECTORY32;
1390typedef PCIMAGE_LOAD_CONFIG_DIRECTORY32_V13 PCIMAGE_LOAD_CONFIG_DIRECTORY32;
1391
1392
1393/* No _IMAGE_LOAD_CONFIG_DIRECTORY64_V1 exists. */
1394
1395typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V2
1396{
1397 uint32_t Size;
1398 uint32_t TimeDateStamp;
1399 uint16_t MajorVersion;
1400 uint16_t MinorVersion;
1401 uint32_t GlobalFlagsClear;
1402 uint32_t GlobalFlagsSet;
1403 uint32_t CriticalSectionDefaultTimeout;
1404 uint64_t DeCommitFreeBlockThreshold;
1405 uint64_t DeCommitTotalFreeThreshold;
1406 uint64_t LockPrefixTable;
1407 uint64_t MaximumAllocationSize;
1408 uint64_t VirtualMemoryThreshold;
1409 uint64_t ProcessAffinityMask;
1410 uint32_t ProcessHeapFlags;
1411 uint16_t CSDVersion;
1412 uint16_t DependentLoadFlags;
1413 uint64_t EditList;
1414 uint64_t SecurityCookie;
1415 uint64_t SEHandlerTable;
1416 uint64_t SEHandlerCount;
1417} IMAGE_LOAD_CONFIG_DIRECTORY64_V2;
1418AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V2, 0x70);
1419typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
1420typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
1421
1422#pragma pack(4) /* Why not 8 byte alignment, baka microsofties?!? */
1423typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V3
1424{
1425 uint32_t Size;
1426 uint32_t TimeDateStamp;
1427 uint16_t MajorVersion;
1428 uint16_t MinorVersion;
1429 uint32_t GlobalFlagsClear;
1430 uint32_t GlobalFlagsSet;
1431 uint32_t CriticalSectionDefaultTimeout;
1432 uint64_t DeCommitFreeBlockThreshold;
1433 uint64_t DeCommitTotalFreeThreshold;
1434 uint64_t LockPrefixTable;
1435 uint64_t MaximumAllocationSize;
1436 uint64_t VirtualMemoryThreshold;
1437 uint64_t ProcessAffinityMask;
1438 uint32_t ProcessHeapFlags;
1439 uint16_t CSDVersion;
1440 uint16_t DependentLoadFlags;
1441 uint64_t EditList;
1442 uint64_t SecurityCookie;
1443 uint64_t SEHandlerTable;
1444 uint64_t SEHandlerCount;
1445 uint64_t GuardCFCCheckFunctionPointer;
1446 uint64_t GuardCFDispatchFunctionPointer;
1447 uint64_t GuardCFFunctionTable;
1448 uint64_t GuardCFFunctionCount;
1449 uint32_t GuardFlags;
1450} IMAGE_LOAD_CONFIG_DIRECTORY64_V3;
1451#pragma pack()
1452AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V3, 0x94);
1453typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
1454typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
1455
1456/** @since Windows 10 (Preview (9879). */
1457typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V4
1458{
1459 uint32_t Size; /**< 0x00 */
1460 uint32_t TimeDateStamp; /**< 0x04 */
1461 uint16_t MajorVersion; /**< 0x08 */
1462 uint16_t MinorVersion; /**< 0x0a */
1463 uint32_t GlobalFlagsClear; /**< 0x0c */
1464 uint32_t GlobalFlagsSet; /**< 0x10 */
1465 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1466 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1467 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1468 uint64_t LockPrefixTable; /**< 0x28 */
1469 uint64_t MaximumAllocationSize; /**< 0x30 */
1470 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1471 uint64_t ProcessAffinityMask; /**< 0x40 */
1472 uint32_t ProcessHeapFlags; /**< 0x48 */
1473 uint16_t CSDVersion; /**< 0x4c */
1474 uint16_t DependentLoadFlags; /**< 0x4e */
1475 uint64_t EditList; /**< 0x50 */
1476 uint64_t SecurityCookie; /**< 0x58 */
1477 uint64_t SEHandlerTable; /**< 0x60 */
1478 uint64_t SEHandlerCount; /**< 0x68 */
1479 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1480 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1481 uint64_t GuardCFFunctionTable; /**< 0x80 */
1482 uint64_t GuardCFFunctionCount; /**< 0x88 */
1483 uint32_t GuardFlags; /**< 0x90 */
1484 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1485} IMAGE_LOAD_CONFIG_DIRECTORY64_V4;
1486AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V4, 0xa0);
1487typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
1488typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
1489
1490/** @since Windows 10 build 14286 (or maybe earlier). */
1491typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V5
1492{
1493 uint32_t Size; /**< 0x00 */
1494 uint32_t TimeDateStamp; /**< 0x04 */
1495 uint16_t MajorVersion; /**< 0x08 */
1496 uint16_t MinorVersion; /**< 0x0a */
1497 uint32_t GlobalFlagsClear; /**< 0x0c */
1498 uint32_t GlobalFlagsSet; /**< 0x10 */
1499 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1500 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1501 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1502 uint64_t LockPrefixTable; /**< 0x28 */
1503 uint64_t MaximumAllocationSize; /**< 0x30 */
1504 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1505 uint64_t ProcessAffinityMask; /**< 0x40 */
1506 uint32_t ProcessHeapFlags; /**< 0x48 */
1507 uint16_t CSDVersion; /**< 0x4c */
1508 uint16_t DependentLoadFlags; /**< 0x4e */
1509 uint64_t EditList; /**< 0x50 */
1510 uint64_t SecurityCookie; /**< 0x58 */
1511 uint64_t SEHandlerTable; /**< 0x60 */
1512 uint64_t SEHandlerCount; /**< 0x68 */
1513 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1514 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1515 uint64_t GuardCFFunctionTable; /**< 0x80 */
1516 uint64_t GuardCFFunctionCount; /**< 0x88 */
1517 uint32_t GuardFlags; /**< 0x90 */
1518 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1519 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1520 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1521 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1522 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1523} IMAGE_LOAD_CONFIG_DIRECTORY64_V5;
1524AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V5, 0xc0);
1525typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V5 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V5;
1526typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V5 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V5;
1527
1528/** @since Windows 10 build 14393 (or maybe earlier). */
1529typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V6
1530{
1531 uint32_t Size; /**< 0x00 */
1532 uint32_t TimeDateStamp; /**< 0x04 */
1533 uint16_t MajorVersion; /**< 0x08 */
1534 uint16_t MinorVersion; /**< 0x0a */
1535 uint32_t GlobalFlagsClear; /**< 0x0c */
1536 uint32_t GlobalFlagsSet; /**< 0x10 */
1537 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1538 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1539 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1540 uint64_t LockPrefixTable; /**< 0x28 */
1541 uint64_t MaximumAllocationSize; /**< 0x30 */
1542 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1543 uint64_t ProcessAffinityMask; /**< 0x40 */
1544 uint32_t ProcessHeapFlags; /**< 0x48 */
1545 uint16_t CSDVersion; /**< 0x4c */
1546 uint16_t DependentLoadFlags; /**< 0x4e */
1547 uint64_t EditList; /**< 0x50 */
1548 uint64_t SecurityCookie; /**< 0x58 */
1549 uint64_t SEHandlerTable; /**< 0x60 */
1550 uint64_t SEHandlerCount; /**< 0x68 */
1551 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1552 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1553 uint64_t GuardCFFunctionTable; /**< 0x80 */
1554 uint64_t GuardCFFunctionCount; /**< 0x88 */
1555 uint32_t GuardFlags; /**< 0x90 */
1556 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1557 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1558 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1559 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1560 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1561 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1562 uint64_t HybridMetadataPointer; /**< 0xc8 */
1563} IMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1564AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V6, 0xd0);
1565typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V6 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1566typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V6 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1567
1568/** @since Windows 10 build 14901 (or maybe earlier). */
1569typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V7
1570{
1571 uint32_t Size; /**< 0x00 */
1572 uint32_t TimeDateStamp; /**< 0x04 */
1573 uint16_t MajorVersion; /**< 0x08 */
1574 uint16_t MinorVersion; /**< 0x0a */
1575 uint32_t GlobalFlagsClear; /**< 0x0c */
1576 uint32_t GlobalFlagsSet; /**< 0x10 */
1577 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1578 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1579 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1580 uint64_t LockPrefixTable; /**< 0x28 */
1581 uint64_t MaximumAllocationSize; /**< 0x30 */
1582 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1583 uint64_t ProcessAffinityMask; /**< 0x40 */
1584 uint32_t ProcessHeapFlags; /**< 0x48 */
1585 uint16_t CSDVersion; /**< 0x4c */
1586 uint16_t DependentLoadFlags; /**< 0x4e */
1587 uint64_t EditList; /**< 0x50 */
1588 uint64_t SecurityCookie; /**< 0x58 */
1589 uint64_t SEHandlerTable; /**< 0x60 */
1590 uint64_t SEHandlerCount; /**< 0x68 */
1591 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1592 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1593 uint64_t GuardCFFunctionTable; /**< 0x80 */
1594 uint64_t GuardCFFunctionCount; /**< 0x88 */
1595 uint32_t GuardFlags; /**< 0x90 */
1596 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1597 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1598 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1599 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1600 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1601 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1602 uint64_t CHPEMetadataPointer; /**< 0xc8 Not sure when this was renamed from HybridMetadataPointer. */
1603 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1604 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1605 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1606 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1607 uint16_t Reserved2; /**< 0xe6 */
1608} IMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1609AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V7, 0xe8);
1610typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V7 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1611typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V7 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1612
1613/** @since Windows 10 build 15002 (or maybe earlier). */
1614#pragma pack(4) /* Stupid, stupid microsofties! */
1615typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V8
1616{
1617 uint32_t Size; /**< 0x00 */
1618 uint32_t TimeDateStamp; /**< 0x04 */
1619 uint16_t MajorVersion; /**< 0x08 */
1620 uint16_t MinorVersion; /**< 0x0a */
1621 uint32_t GlobalFlagsClear; /**< 0x0c */
1622 uint32_t GlobalFlagsSet; /**< 0x10 */
1623 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1624 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1625 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1626 uint64_t LockPrefixTable; /**< 0x28 */
1627 uint64_t MaximumAllocationSize; /**< 0x30 */
1628 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1629 uint64_t ProcessAffinityMask; /**< 0x40 */
1630 uint32_t ProcessHeapFlags; /**< 0x48 */
1631 uint16_t CSDVersion; /**< 0x4c */
1632 uint16_t DependentLoadFlags; /**< 0x4e */
1633 uint64_t EditList; /**< 0x50 */
1634 uint64_t SecurityCookie; /**< 0x58 */
1635 uint64_t SEHandlerTable; /**< 0x60 */
1636 uint64_t SEHandlerCount; /**< 0x68 */
1637 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1638 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1639 uint64_t GuardCFFunctionTable; /**< 0x80 */
1640 uint64_t GuardCFFunctionCount; /**< 0x88 */
1641 uint32_t GuardFlags; /**< 0x90 */
1642 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1643 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1644 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1645 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1646 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1647 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1648 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1649 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1650 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1651 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1652 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1653 uint16_t Reserved2; /**< 0xe6 */
1654 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1655 uint32_t HotPatchTableOffset; /**< 0xf0 */
1656} IMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1657#pragma pack()
1658AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V8, 0xf4);
1659typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V8 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1660typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V8 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1661
1662/** @since Windows 10 build 15002 (or maybe earlier). */
1663typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V9
1664{
1665 uint32_t Size; /**< 0x00 */
1666 uint32_t TimeDateStamp; /**< 0x04 */
1667 uint16_t MajorVersion; /**< 0x08 */
1668 uint16_t MinorVersion; /**< 0x0a */
1669 uint32_t GlobalFlagsClear; /**< 0x0c */
1670 uint32_t GlobalFlagsSet; /**< 0x10 */
1671 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1672 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1673 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1674 uint64_t LockPrefixTable; /**< 0x28 */
1675 uint64_t MaximumAllocationSize; /**< 0x30 */
1676 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1677 uint64_t ProcessAffinityMask; /**< 0x40 */
1678 uint32_t ProcessHeapFlags; /**< 0x48 */
1679 uint16_t CSDVersion; /**< 0x4c */
1680 uint16_t DependentLoadFlags; /**< 0x4e */
1681 uint64_t EditList; /**< 0x50 */
1682 uint64_t SecurityCookie; /**< 0x58 */
1683 uint64_t SEHandlerTable; /**< 0x60 */
1684 uint64_t SEHandlerCount; /**< 0x68 */
1685 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1686 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1687 uint64_t GuardCFFunctionTable; /**< 0x80 */
1688 uint64_t GuardCFFunctionCount; /**< 0x88 */
1689 uint32_t GuardFlags; /**< 0x90 */
1690 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1691 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1692 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1693 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1694 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1695 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1696 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1697 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1698 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1699 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1700 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1701 uint16_t Reserved2; /**< 0xe6 */
1702 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1703 uint32_t HotPatchTableOffset; /**< 0xf0 */
1704 uint32_t Reserved3; /**< 0xf4 */
1705 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
1706} IMAGE_LOAD_CONFIG_DIRECTORY64_V9;
1707AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V9, 0x100);
1708typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V9 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V9;
1709typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V9 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V9;
1710
1711/** @since Windows 10 build 18362 (or maybe earlier). */
1712typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V10
1713{
1714 uint32_t Size; /**< 0x00 */
1715 uint32_t TimeDateStamp; /**< 0x04 */
1716 uint16_t MajorVersion; /**< 0x08 */
1717 uint16_t MinorVersion; /**< 0x0a */
1718 uint32_t GlobalFlagsClear; /**< 0x0c */
1719 uint32_t GlobalFlagsSet; /**< 0x10 */
1720 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1721 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1722 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1723 uint64_t LockPrefixTable; /**< 0x28 */
1724 uint64_t MaximumAllocationSize; /**< 0x30 */
1725 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1726 uint64_t ProcessAffinityMask; /**< 0x40 */
1727 uint32_t ProcessHeapFlags; /**< 0x48 */
1728 uint16_t CSDVersion; /**< 0x4c */
1729 uint16_t DependentLoadFlags; /**< 0x4e */
1730 uint64_t EditList; /**< 0x50 */
1731 uint64_t SecurityCookie; /**< 0x58 */
1732 uint64_t SEHandlerTable; /**< 0x60 */
1733 uint64_t SEHandlerCount; /**< 0x68 */
1734 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1735 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1736 uint64_t GuardCFFunctionTable; /**< 0x80 */
1737 uint64_t GuardCFFunctionCount; /**< 0x88 */
1738 uint32_t GuardFlags; /**< 0x90 */
1739 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1740 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1741 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1742 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1743 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1744 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1745 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1746 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1747 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1748 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1749 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1750 uint16_t Reserved2; /**< 0xe6 */
1751 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1752 uint32_t HotPatchTableOffset; /**< 0xf0 */
1753 uint32_t Reserved3; /**< 0xf4 */
1754 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
1755 uint64_t VolatileMetadataPointer; /**< 0x100 */
1756} IMAGE_LOAD_CONFIG_DIRECTORY64_V10;
1757AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V10, 0x108);
1758typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V10 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V10;
1759typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V10 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V10;
1760
1761/** @since Windows 10 build 19534 (or maybe earlier). */
1762typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V11
1763{
1764 uint32_t Size; /**< 0x00 */
1765 uint32_t TimeDateStamp; /**< 0x04 */
1766 uint16_t MajorVersion; /**< 0x08 */
1767 uint16_t MinorVersion; /**< 0x0a */
1768 uint32_t GlobalFlagsClear; /**< 0x0c */
1769 uint32_t GlobalFlagsSet; /**< 0x10 */
1770 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1771 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1772 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1773 uint64_t LockPrefixTable; /**< 0x28 */
1774 uint64_t MaximumAllocationSize; /**< 0x30 */
1775 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1776 uint64_t ProcessAffinityMask; /**< 0x40 */
1777 uint32_t ProcessHeapFlags; /**< 0x48 */
1778 uint16_t CSDVersion; /**< 0x4c */
1779 uint16_t DependentLoadFlags; /**< 0x4e */
1780 uint64_t EditList; /**< 0x50 */
1781 uint64_t SecurityCookie; /**< 0x58 */
1782 uint64_t SEHandlerTable; /**< 0x60 */
1783 uint64_t SEHandlerCount; /**< 0x68 */
1784 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1785 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1786 uint64_t GuardCFFunctionTable; /**< 0x80 */
1787 uint64_t GuardCFFunctionCount; /**< 0x88 */
1788 uint32_t GuardFlags; /**< 0x90 */
1789 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1790 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1791 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1792 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1793 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1794 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1795 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1796 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1797 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1798 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1799 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1800 uint16_t Reserved2; /**< 0xe6 */
1801 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1802 uint32_t HotPatchTableOffset; /**< 0xf0 */
1803 uint32_t Reserved3; /**< 0xf4 */
1804 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
1805 uint64_t VolatileMetadataPointer; /**< 0x100 */
1806 uint64_t GuardEHContinuationTable; /**< 0x108 - virtual address */
1807 uint64_t GuardEHContinuationCount; /**< 0x110 */
1808} IMAGE_LOAD_CONFIG_DIRECTORY64_V11;
1809AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V11, 0x118);
1810typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V11 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V11;
1811typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V11 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V11;
1812
1813/** @since Visual C++ 2019 / RS5_IMAGE_LOAD_CONFIG_DIRECTORY64. */
1814typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V12
1815{
1816 uint32_t Size; /**< 0x00 */
1817 uint32_t TimeDateStamp; /**< 0x04 */
1818 uint16_t MajorVersion; /**< 0x08 */
1819 uint16_t MinorVersion; /**< 0x0a */
1820 uint32_t GlobalFlagsClear; /**< 0x0c */
1821 uint32_t GlobalFlagsSet; /**< 0x10 */
1822 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1823 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1824 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1825 uint64_t LockPrefixTable; /**< 0x28 */
1826 uint64_t MaximumAllocationSize; /**< 0x30 */
1827 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1828 uint64_t ProcessAffinityMask; /**< 0x40 */
1829 uint32_t ProcessHeapFlags; /**< 0x48 */
1830 uint16_t CSDVersion; /**< 0x4c */
1831 uint16_t DependentLoadFlags; /**< 0x4e */
1832 uint64_t EditList; /**< 0x50 */
1833 uint64_t SecurityCookie; /**< 0x58 */
1834 uint64_t SEHandlerTable; /**< 0x60 */
1835 uint64_t SEHandlerCount; /**< 0x68 */
1836 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1837 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1838 uint64_t GuardCFFunctionTable; /**< 0x80 */
1839 uint64_t GuardCFFunctionCount; /**< 0x88 */
1840 uint32_t GuardFlags; /**< 0x90 */
1841 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1842 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1843 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1844 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1845 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1846 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1847 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1848 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1849 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1850 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1851 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1852 uint16_t Reserved2; /**< 0xe6 */
1853 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1854 uint32_t HotPatchTableOffset; /**< 0xf0 */
1855 uint32_t Reserved3; /**< 0xf4 */
1856 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
1857 uint64_t VolatileMetadataPointer; /**< 0x100 */
1858 uint64_t GuardEHContinuationTable; /**< 0x108 - virtual address */
1859 uint64_t GuardEHContinuationCount; /**< 0x110 */
1860 uint64_t GuardXFGCheckFunctionPointer; /**< 0x118 */
1861 uint64_t GuardXFGDispatchFunctionPointer; /**< 0x120 */
1862 uint64_t GuardXFGTableDispatchFunctionPointer; /**< 0x128 */
1863} IMAGE_LOAD_CONFIG_DIRECTORY64_V12;
1864AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V12, 0x130);
1865typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V12 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V12;
1866typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V12 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V12;
1867
1868/** @since Visual C++ 2019 16.x (found in 16.11.9) / RS5_IMAGE_LOAD_CONFIG_DIRECTORY32. */
1869typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V13
1870{
1871 uint32_t Size; /**< 0x00 */
1872 uint32_t TimeDateStamp; /**< 0x04 */
1873 uint16_t MajorVersion; /**< 0x08 */
1874 uint16_t MinorVersion; /**< 0x0a */
1875 uint32_t GlobalFlagsClear; /**< 0x0c */
1876 uint32_t GlobalFlagsSet; /**< 0x10 */
1877 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1878 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1879 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1880 uint64_t LockPrefixTable; /**< 0x28 - virtual address */
1881 uint64_t MaximumAllocationSize; /**< 0x30 */
1882 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1883 uint64_t ProcessAffinityMask; /**< 0x40 */
1884 uint32_t ProcessHeapFlags; /**< 0x48 */
1885 uint16_t CSDVersion; /**< 0x4c */
1886 uint16_t DependentLoadFlags; /**< 0x4e */
1887 uint64_t EditList; /**< 0x50 - virtual address */
1888 uint64_t SecurityCookie; /**< 0x58 - virtual address */
1889 uint64_t SEHandlerTable; /**< 0x60 */
1890 uint64_t SEHandlerCount; /**< 0x68 */
1891 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 - virtual address of pointer variable */
1892 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 - virtual address of pointer variable */
1893 uint64_t GuardCFFunctionTable; /**< 0x80 - virtual address */
1894 uint64_t GuardCFFunctionCount; /**< 0x88 */
1895 uint32_t GuardFlags; /**< 0x90 */
1896 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1897 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 - virtual address */
1898 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1899 uint64_t GuardLongJumpTargetTable; /**< 0xb0 - virtual address */
1900 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1901 uint64_t DynamicValueRelocTable; /**< 0xc0 - virtual address */
1902 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1903 uint64_t GuardRFFailureRoutine; /**< 0xd0 - virtual address */
1904 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 - virtual address of pointer variable */
1905 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1906 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1907 uint16_t Reserved2; /**< 0xe6 */
1908 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 - virtual address of pointer variable */
1909 uint32_t HotPatchTableOffset; /**< 0xf0 */
1910 uint32_t Reserved3; /**< 0xf4 */
1911 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
1912 uint64_t VolatileMetadataPointer; /**< 0x100 - virtual address of pointer variable */
1913 uint64_t GuardEHContinuationTable; /**< 0x108 - virtual address */
1914 uint64_t GuardEHContinuationCount; /**< 0x110 */
1915 uint64_t GuardXFGCheckFunctionPointer; /**< 0x118 - virtual address of pointer variable */
1916 uint64_t GuardXFGDispatchFunctionPointer; /**< 0x120 - virtual address of pointer variable */
1917 uint64_t GuardXFGTableDispatchFunctionPointer; /**< 0x128 - virtual address of pointer variable */
1918 uint64_t CastGuardOsDeterminedFailureMode; /**< 0x130 - virtual address */
1919} IMAGE_LOAD_CONFIG_DIRECTORY64_V13;
1920AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V13, 0x138);
1921typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V13 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V13;
1922typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V13 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V13;
1923
1924typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V13 IMAGE_LOAD_CONFIG_DIRECTORY64;
1925typedef PIMAGE_LOAD_CONFIG_DIRECTORY64_V13 PIMAGE_LOAD_CONFIG_DIRECTORY64;
1926typedef PCIMAGE_LOAD_CONFIG_DIRECTORY64_V13 PCIMAGE_LOAD_CONFIG_DIRECTORY64;
1927
1928/** @} */
1929
1930
1931/**
1932 * PE certificate directory.
1933 *
1934 * Found in IMAGE_DIRECTORY_ENTRY_SECURITY.
1935 */
1936typedef struct WIN_CERTIFICATE
1937{
1938 uint32_t dwLength;
1939 uint16_t wRevision;
1940 uint16_t wCertificateType;
1941 uint8_t bCertificate[8];
1942} WIN_CERTIFICATE;
1943AssertCompileSize(WIN_CERTIFICATE, 16);
1944typedef WIN_CERTIFICATE *PWIN_CERTIFICATE;
1945typedef WIN_CERTIFICATE const *PCWIN_CERTIFICATE;
1946
1947/** @name WIN_CERT_REVISION_XXX - Certificate data directory revision.
1948 * Used WIN_CERTIFICATE::wRevision found in the IMAGE_DIRECTORY_ENTRY_SECURITY
1949 * data directory.
1950 * @{ */
1951#define WIN_CERT_REVISION_1_0 UINT16_C(0x0100)
1952#define WIN_CERT_REVISION_2_0 UINT16_C(0x0200)
1953/** @} */
1954
1955/** @name WIN_CERT_TYPE_XXX - Signature type.
1956 * Used by WIN_CERTIFICATE::wCertificateType.
1957 * @{ */
1958#define WIN_CERT_TYPE_X509 UINT16_C(1)
1959#define WIN_CERT_TYPE_PKCS_SIGNED_DATA UINT16_C(2)
1960#define WIN_CERT_TYPE_RESERVED_1 UINT16_C(3)
1961#define WIN_CERT_TYPE_TS_STACK_SIGNED UINT16_C(4)
1962#define WIN_CERT_TYPE_EFI_PKCS115 UINT16_C(0x0ef0)
1963#define WIN_CERT_TYPE_EFI_GUID UINT16_C(0x0ef1)
1964/** @} */
1965
1966/** The alignment of the certificate table.
1967 * @remarks Found thru signtool experiments.
1968 * @note There is a copy of this in RTSignTool.cpp. */
1969#define WIN_CERTIFICATE_ALIGNMENT UINT32_C(8)
1970
1971
1972/**
1973 * Debug directory.
1974 *
1975 * Found in IMAGE_DIRECTORY_ENTRY_DEBUG.
1976 */
1977typedef struct _IMAGE_DEBUG_DIRECTORY
1978{
1979 uint32_t Characteristics;
1980 uint32_t TimeDateStamp;
1981 uint16_t MajorVersion;
1982 uint16_t MinorVersion;
1983 uint32_t Type;
1984 uint32_t SizeOfData;
1985 uint32_t AddressOfRawData;
1986 uint32_t PointerToRawData;
1987} IMAGE_DEBUG_DIRECTORY;
1988AssertCompileSize(IMAGE_DEBUG_DIRECTORY, 28);
1989typedef IMAGE_DEBUG_DIRECTORY *PIMAGE_DEBUG_DIRECTORY;
1990typedef IMAGE_DEBUG_DIRECTORY const *PCIMAGE_DEBUG_DIRECTORY;
1991
1992/** @name IMAGE_DEBUG_TYPE_XXX - Debug format types.
1993 * Used by IMAGE_DEBUG_DIRECTORY::Type.
1994 * @{ */
1995#define IMAGE_DEBUG_TYPE_UNKNOWN UINT32_C(0x00)
1996#define IMAGE_DEBUG_TYPE_COFF UINT32_C(0x01)
1997#define IMAGE_DEBUG_TYPE_CODEVIEW UINT32_C(0x02)
1998#define IMAGE_DEBUG_TYPE_FPO UINT32_C(0x03)
1999#define IMAGE_DEBUG_TYPE_MISC UINT32_C(0x04)
2000#define IMAGE_DEBUG_TYPE_EXCEPTION UINT32_C(0x05)
2001#define IMAGE_DEBUG_TYPE_FIXUP UINT32_C(0x06)
2002#define IMAGE_DEBUG_TYPE_OMAP_TO_SRC UINT32_C(0x07)
2003#define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC UINT32_C(0x08)
2004#define IMAGE_DEBUG_TYPE_BORLAND UINT32_C(0x09)
2005#define IMAGE_DEBUG_TYPE_RESERVED10 UINT32_C(0x0a)
2006#define IMAGE_DEBUG_TYPE_CLSID UINT32_C(0x0b)
2007#define IMAGE_DEBUG_TYPE_VC_FEATURE UINT32_C(0x0c)
2008#define IMAGE_DEBUG_TYPE_POGO UINT32_C(0x0d)
2009#define IMAGE_DEBUG_TYPE_ILTCG UINT32_C(0x0e)
2010#define IMAGE_DEBUG_TYPE_MPX UINT32_C(0x0f)
2011#define IMAGE_DEBUG_TYPE_REPRO UINT32_C(0x10)
2012/** @} */
2013
2014/** @name IMAGE_DEBUG_MISC_XXX - Misc debug data type.
2015 * Used by IMAGE_DEBUG_MISC::DataType.
2016 * @{ */
2017#define IMAGE_DEBUG_MISC_EXENAME UINT32_C(1)
2018/** @} */
2019
2020
2021/**
2022 * The format of IMAGE_DEBUG_TYPE_MISC debug info.
2023 */
2024typedef struct _IMAGE_DEBUG_MISC
2025{
2026 uint32_t DataType;
2027 uint32_t Length;
2028 uint8_t Unicode;
2029 uint8_t Reserved[3];
2030 uint8_t Data[1];
2031} IMAGE_DEBUG_MISC;
2032AssertCompileSize(IMAGE_DEBUG_MISC, 16);
2033typedef IMAGE_DEBUG_MISC *PIMAGE_DEBUG_MISC;
2034typedef IMAGE_DEBUG_MISC const *PCIMAGE_DEBUG_MISC;
2035
2036
2037
2038/**
2039 * The header of a .DBG file (NT4).
2040 */
2041typedef struct _IMAGE_SEPARATE_DEBUG_HEADER
2042{
2043 uint16_t Signature; /**< 0x00 */
2044 uint16_t Flags; /**< 0x02 */
2045 uint16_t Machine; /**< 0x04 */
2046 uint16_t Characteristics; /**< 0x06 */
2047 uint32_t TimeDateStamp; /**< 0x08 */
2048 uint32_t CheckSum; /**< 0x0c */
2049 uint32_t ImageBase; /**< 0x10 */
2050 uint32_t SizeOfImage; /**< 0x14 */
2051 uint32_t NumberOfSections; /**< 0x18 */
2052 uint32_t ExportedNamesSize; /**< 0x1c */
2053 uint32_t DebugDirectorySize; /**< 0x20 */
2054 uint32_t SectionAlignment; /**< 0x24 */
2055 uint32_t Reserved[2]; /**< 0x28 */
2056} IMAGE_SEPARATE_DEBUG_HEADER; /* size: 0x30 */
2057AssertCompileSize(IMAGE_SEPARATE_DEBUG_HEADER, 0x30);
2058typedef IMAGE_SEPARATE_DEBUG_HEADER *PIMAGE_SEPARATE_DEBUG_HEADER;
2059typedef IMAGE_SEPARATE_DEBUG_HEADER const *PCIMAGE_SEPARATE_DEBUG_HEADER;
2060
2061/** The signature of a IMAGE_SEPARATE_DEBUG_HEADER. */
2062#define IMAGE_SEPARATE_DEBUG_SIGNATURE UINT16_C(0x4944)
2063
2064
2065/**
2066 * The format of IMAGE_DEBUG_TYPE_COFF debug info.
2067 */
2068typedef struct _IMAGE_COFF_SYMBOLS_HEADER
2069{
2070 uint32_t NumberOfSymbols;
2071 uint32_t LvaToFirstSymbol;
2072 uint32_t NumberOfLinenumbers;
2073 uint32_t LvaToFirstLinenumber;
2074 uint32_t RvaToFirstByteOfCode;
2075 uint32_t RvaToLastByteOfCode;
2076 uint32_t RvaToFirstByteOfData;
2077 uint32_t RvaToLastByteOfData;
2078} IMAGE_COFF_SYMBOLS_HEADER;
2079AssertCompileSize(IMAGE_COFF_SYMBOLS_HEADER, 0x20);
2080typedef IMAGE_COFF_SYMBOLS_HEADER *PIMAGE_COFF_SYMBOLS_HEADER;
2081typedef IMAGE_COFF_SYMBOLS_HEADER const *PCIMAGE_COFF_SYMBOLS_HEADER;
2082
2083
2084/**
2085 * Line number format of IMAGE_DEBUG_TYPE_COFF debug info.
2086 *
2087 * @remarks This has misaligned members.
2088 */
2089#pragma pack(2)
2090typedef struct _IMAGE_LINENUMBER
2091{
2092 union
2093 {
2094 uint32_t VirtualAddress;
2095 uint32_t SymbolTableIndex;
2096 } Type;
2097 uint16_t Linenumber;
2098} IMAGE_LINENUMBER;
2099#pragma pack()
2100AssertCompileSize(IMAGE_LINENUMBER, 6);
2101typedef IMAGE_LINENUMBER *PIMAGE_LINENUMBER;
2102typedef IMAGE_LINENUMBER const *PCIMAGE_LINENUMBER;
2103
2104
2105/** The size of a IMAGE_SYMBOL & IMAGE_AUX_SYMBOL structure. */
2106#define IMAGE_SIZE_OF_SYMBOL 18
2107/** The size of a IMAGE_SYMBOL_EX & IMAGE_AUX_SYMBOL_EX structure. */
2108#define IMAGE_SIZE_OF_SYMBOL_EX 20
2109
2110/**
2111 * COFF symbol.
2112 */
2113#pragma pack(2)
2114typedef struct _IMAGE_SYMBOL
2115{
2116 union
2117 {
2118 uint8_t ShortName[8];
2119 struct
2120 {
2121 uint32_t Short;
2122 uint32_t Long;
2123 } Name;
2124 uint32_t LongName[2];
2125 } N;
2126
2127 uint32_t Value;
2128 int16_t SectionNumber;
2129 uint16_t Type;
2130 uint8_t StorageClass;
2131 uint8_t NumberOfAuxSymbols;
2132} IMAGE_SYMBOL;
2133#pragma pack()
2134AssertCompileSize(IMAGE_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
2135typedef IMAGE_SYMBOL *PIMAGE_SYMBOL;
2136typedef IMAGE_SYMBOL const *PCIMAGE_SYMBOL;
2137
2138/**
2139 * COFF auxiliary symbol token defintion (whatever that is).
2140 */
2141#pragma pack(2)
2142typedef struct IMAGE_AUX_SYMBOL_TOKEN_DEF
2143{
2144 uint8_t bAuxType;
2145 uint8_t bReserved;
2146 uint32_t SymbolTableIndex;
2147 uint8_t rgbReserved[12];
2148} IMAGE_AUX_SYMBOL_TOKEN_DEF;
2149#pragma pack()
2150AssertCompileSize(IMAGE_AUX_SYMBOL_TOKEN_DEF, IMAGE_SIZE_OF_SYMBOL);
2151typedef IMAGE_AUX_SYMBOL_TOKEN_DEF *PIMAGE_AUX_SYMBOL_TOKEN_DEF;
2152typedef IMAGE_AUX_SYMBOL_TOKEN_DEF const *PCIMAGE_AUX_SYMBOL_TOKEN_DEF;
2153
2154/**
2155 * COFF auxiliary symbol.
2156 */
2157#pragma pack(1)
2158typedef union _IMAGE_AUX_SYMBOL
2159{
2160 struct
2161 {
2162 uint32_t TagIndex;
2163 union
2164 {
2165 struct
2166 {
2167 uint16_t Linenumber;
2168 uint16_t Size;
2169 } LnSz;
2170 } Misc;
2171 union
2172 {
2173 struct
2174 {
2175 uint32_t PointerToLinenumber;
2176 uint32_t PointerToNextFunction;
2177 } Function;
2178 struct
2179 {
2180 uint16_t Dimension[4];
2181 } Array;
2182 } FcnAry;
2183 uint16_t TvIndex;
2184 } Sym;
2185
2186 struct
2187 {
2188 uint8_t Name[IMAGE_SIZE_OF_SYMBOL];
2189 } File;
2190
2191 struct
2192 {
2193 uint32_t Length;
2194 uint16_t NumberOfRelocations;
2195 uint16_t NumberOfLinenumbers;
2196 uint32_t CheckSum;
2197 uint16_t Number;
2198 uint8_t Selection;
2199 uint8_t bReserved;
2200 uint16_t HighNumber;
2201 } Section;
2202
2203 IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
2204 struct
2205 {
2206 uint32_t crc;
2207 uint8_t rgbReserved[14];
2208 } CRC;
2209} IMAGE_AUX_SYMBOL;
2210#pragma pack()
2211AssertCompileSize(IMAGE_AUX_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
2212typedef IMAGE_AUX_SYMBOL *PIMAGE_AUX_SYMBOL;
2213typedef IMAGE_AUX_SYMBOL const *PCIMAGE_AUX_SYMBOL;
2214
2215
2216/**
2217 * Extended COFF symbol.
2218 */
2219typedef struct _IMAGE_SYMBOL_EX
2220{
2221 union
2222 {
2223 uint8_t ShortName[8];
2224 struct
2225 {
2226 uint32_t Short;
2227 uint32_t Long;
2228 } Name;
2229 uint32_t LongName[2];
2230 } N;
2231
2232 uint32_t Value;
2233 int32_t SectionNumber; /* The difference from IMAGE_SYMBOL */
2234 uint16_t Type;
2235 uint8_t StorageClass;
2236 uint8_t NumberOfAuxSymbols;
2237} IMAGE_SYMBOL_EX;
2238AssertCompileSize(IMAGE_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
2239typedef IMAGE_SYMBOL_EX *PIMAGE_SYMBOL_EX;
2240typedef IMAGE_SYMBOL_EX const *PCIMAGE_SYMBOL_EX;
2241
2242/**
2243 * Extended COFF auxiliary symbol.
2244 */
2245typedef union _IMAGE_AUX_SYMBOL_EX
2246{
2247 struct
2248 {
2249 uint32_t WeakDefaultSymIndex;
2250 uint32_t WeakSearchType;
2251 uint8_t rgbReserved[12];
2252 } Sym;
2253
2254 struct
2255 {
2256 uint8_t Name[IMAGE_SIZE_OF_SYMBOL_EX];
2257 } File;
2258
2259 struct
2260 {
2261 uint32_t Length;
2262 uint16_t NumberOfRelocations;
2263 uint16_t NumberOfLinenumbers;
2264 uint32_t CheckSum;
2265 uint16_t Number;
2266 uint8_t Selection;
2267 uint8_t bReserved;
2268 uint16_t HighNumber;
2269 uint8_t rgbReserved[2];
2270 } Section;
2271
2272 IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
2273
2274 struct
2275 {
2276 uint32_t crc;
2277 uint8_t rgbReserved[16];
2278 } CRC;
2279} IMAGE_AUX_SYMBOL_EX;
2280AssertCompileSize(IMAGE_AUX_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
2281typedef IMAGE_AUX_SYMBOL_EX *PIMAGE_AUX_SYMBOL_EX;
2282typedef IMAGE_AUX_SYMBOL_EX const *PCIMAGE_AUX_SYMBOL_EX;
2283
2284/** @name Special COFF section numbers.
2285 * Used by IMAGE_SYMBOL::SectionNumber and IMAGE_SYMBOL_EX::SectionNumber
2286 * @{ */
2287#define IMAGE_SYM_UNDEFINED INT16_C(0)
2288#define IMAGE_SYM_ABSOLUTE INT16_C(-1)
2289#define IMAGE_SYM_DEBUG INT16_C(-2)
2290/** @} */
2291
2292/** @name IMAGE_SYM_CLASS_XXX - COFF symbol storage classes.
2293 * @{ */
2294#define IMAGE_SYM_CLASS_END_OF_FUNCTION UINT8_C(0xff) /* -1 */
2295#define IMAGE_SYM_CLASS_NULL UINT8_C(0)
2296#define IMAGE_SYM_CLASS_AUTOMATIC UINT8_C(1)
2297#define IMAGE_SYM_CLASS_EXTERNAL UINT8_C(2)
2298#define IMAGE_SYM_CLASS_STATIC UINT8_C(3)
2299#define IMAGE_SYM_CLASS_REGISTER UINT8_C(4)
2300#define IMAGE_SYM_CLASS_EXTERNAL_DEF UINT8_C(5)
2301#define IMAGE_SYM_CLASS_LABEL UINT8_C(6)
2302#define IMAGE_SYM_CLASS_UNDEFINED_LABEL UINT8_C(7)
2303#define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT UINT8_C(8)
2304#define IMAGE_SYM_CLASS_ARGUMENT UINT8_C(9)
2305#define IMAGE_SYM_CLASS_STRUCT_TAG UINT8_C(10)
2306#define IMAGE_SYM_CLASS_MEMBER_OF_UNION UINT8_C(11)
2307#define IMAGE_SYM_CLASS_UNION_TAG UINT8_C(12)
2308#define IMAGE_SYM_CLASS_TYPE_DEFINITION UINT8_C(13)
2309#define IMAGE_SYM_CLASS_UNDEFINED_STATIC UINT8_C(14)
2310#define IMAGE_SYM_CLASS_ENUM_TAG UINT8_C(15)
2311#define IMAGE_SYM_CLASS_MEMBER_OF_ENUM UINT8_C(16)
2312#define IMAGE_SYM_CLASS_REGISTER_PARAM UINT8_C(17)
2313#define IMAGE_SYM_CLASS_BIT_FIELD UINT8_C(18)
2314#define IMAGE_SYM_CLASS_FAR_EXTERNAL UINT8_C(68)
2315#define IMAGE_SYM_CLASS_BLOCK UINT8_C(100)
2316#define IMAGE_SYM_CLASS_FUNCTION UINT8_C(101)
2317#define IMAGE_SYM_CLASS_END_OF_STRUCT UINT8_C(102)
2318#define IMAGE_SYM_CLASS_FILE UINT8_C(103)
2319#define IMAGE_SYM_CLASS_SECTION UINT8_C(104)
2320#define IMAGE_SYM_CLASS_WEAK_EXTERNAL UINT8_C(105)
2321#define IMAGE_SYM_CLASS_CLR_TOKEN UINT8_C(107)
2322/** @} */
2323
2324/** @name IMAGE_SYM_TYPE_XXX - COFF symbol base types
2325 * @{ */
2326#define IMAGE_SYM_TYPE_NULL UINT16_C(0x0000)
2327#define IMAGE_SYM_TYPE_VOID UINT16_C(0x0001)
2328#define IMAGE_SYM_TYPE_CHAR UINT16_C(0x0002)
2329#define IMAGE_SYM_TYPE_SHORT UINT16_C(0x0003)
2330#define IMAGE_SYM_TYPE_INT UINT16_C(0x0004)
2331#define IMAGE_SYM_TYPE_LONG UINT16_C(0x0005)
2332#define IMAGE_SYM_TYPE_FLOAT UINT16_C(0x0006)
2333#define IMAGE_SYM_TYPE_DOUBLE UINT16_C(0x0007)
2334#define IMAGE_SYM_TYPE_STRUCT UINT16_C(0x0008)
2335#define IMAGE_SYM_TYPE_UNION UINT16_C(0x0009)
2336#define IMAGE_SYM_TYPE_ENUM UINT16_C(0x000a)
2337#define IMAGE_SYM_TYPE_MOE UINT16_C(0x000b)
2338#define IMAGE_SYM_TYPE_BYTE UINT16_C(0x000c)
2339#define IMAGE_SYM_TYPE_WORD UINT16_C(0x000d)
2340#define IMAGE_SYM_TYPE_UINT UINT16_C(0x000e)
2341#define IMAGE_SYM_TYPE_DWORD UINT16_C(0x000f)
2342#define IMAGE_SYM_TYPE_PCODE UINT16_C(0x8000)
2343/** @} */
2344
2345/** @name IMAGE_SYM_DTYPE_XXX - COFF symbol complex types
2346 * @{ */
2347#define IMAGE_SYM_DTYPE_NULL UINT16_C(0x0)
2348#define IMAGE_SYM_DTYPE_POINTER UINT16_C(0x1)
2349#define IMAGE_SYM_DTYPE_FUNCTION UINT16_C(0x2)
2350#define IMAGE_SYM_DTYPE_ARRAY UINT16_C(0x3)
2351/** @} */
2352
2353/** @name COFF Symbol type masks and shift counts.
2354 * @{ */
2355#define N_BTMASK UINT16_C(0x000f)
2356#define N_TMASK UINT16_C(0x0030)
2357#define N_TMASK1 UINT16_C(0x00c0)
2358#define N_TMASK2 UINT16_C(0x00f0)
2359#define N_BTSHFT 4
2360#define N_TSHIFT 2
2361/** @} */
2362
2363/** @name COFF Symbol type macros.
2364 * @{ */
2365#define BTYPE(a_Type) ( (a_Type) & N_BTMASK )
2366#define ISPTR(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_POINTER << N_BTSHFT) )
2367#define ISFCN(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_FUNCTION << N_BTSHFT) )
2368#define ISARY(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_ARRAY << N_BTSHFT) )
2369#define ISTAG(a_StorageClass) ( (a_StorageClass) == IMAGE_SYM_CLASS_STRUCT_TAG \
2370 || (a_StorageClass) == IMAGE_SYM_CLASS_UNION_TAG \
2371 || (a_StorageClass) == IMAGE_SYM_CLASS_ENUM_TAG )
2372/** @} */
2373
2374
2375/**
2376 * COFF relocation table entry.
2377 *
2378 * @note The size of the structure is not a multiple of the largest member
2379 * (uint32_t), so odd relocation table entry members will have
2380 * misaligned uint32_t members.
2381 */
2382#pragma pack(1)
2383typedef struct _IMAGE_RELOCATION
2384{
2385 union
2386 {
2387 uint32_t VirtualAddress;
2388 uint32_t RelocCount;
2389 } u;
2390 uint32_t SymbolTableIndex;
2391 uint16_t Type;
2392} IMAGE_RELOCATION;
2393#pragma pack()
2394/** The size of a COFF relocation entry. */
2395#define IMAGE_SIZEOF_RELOCATION 10
2396AssertCompileSize(IMAGE_RELOCATION, IMAGE_SIZEOF_RELOCATION);
2397typedef IMAGE_RELOCATION *PIMAGE_RELOCATION;
2398typedef IMAGE_RELOCATION const *PCIMAGE_RELOCATION;
2399
2400
2401/** @name IMAGE_REL_AMD64_XXX - COFF relocations for AMD64 CPUs.
2402 * Used by IMAGE_RELOCATION::Type.
2403 * @{ */
2404#define IMAGE_REL_AMD64_ABSOLUTE UINT16_C(0x0000)
2405#define IMAGE_REL_AMD64_ADDR64 UINT16_C(0x0001)
2406#define IMAGE_REL_AMD64_ADDR32 UINT16_C(0x0002)
2407#define IMAGE_REL_AMD64_ADDR32NB UINT16_C(0x0003)
2408#define IMAGE_REL_AMD64_REL32 UINT16_C(0x0004)
2409#define IMAGE_REL_AMD64_REL32_1 UINT16_C(0x0005)
2410#define IMAGE_REL_AMD64_REL32_2 UINT16_C(0x0006)
2411#define IMAGE_REL_AMD64_REL32_3 UINT16_C(0x0007)
2412#define IMAGE_REL_AMD64_REL32_4 UINT16_C(0x0008)
2413#define IMAGE_REL_AMD64_REL32_5 UINT16_C(0x0009)
2414#define IMAGE_REL_AMD64_SECTION UINT16_C(0x000a)
2415#define IMAGE_REL_AMD64_SECREL UINT16_C(0x000b)
2416#define IMAGE_REL_AMD64_SECREL7 UINT16_C(0x000c)
2417#define IMAGE_REL_AMD64_TOKEN UINT16_C(0x000d)
2418#define IMAGE_REL_AMD64_SREL32 UINT16_C(0x000e)
2419#define IMAGE_REL_AMD64_PAIR UINT16_C(0x000f)
2420#define IMAGE_REL_AMD64_SSPAN32 UINT16_C(0x0010)
2421/** @} */
2422
2423/** @name ARM IMAGE_REL_ARM_XXX - COFF relocations for ARM CPUs.
2424 * Used by IMAGE_RELOCATION::Type.
2425 * @{ */
2426#define IMAGE_REL_ARM_ABSOLUTE UINT16_C(0x0000)
2427#define IMAGE_REL_ARM_ADDR32 UINT16_C(0x0001)
2428#define IMAGE_REL_ARM_ADDR32NB UINT16_C(0x0002)
2429#define IMAGE_REL_ARM_BRANCH24 UINT16_C(0x0003)
2430#define IMAGE_REL_ARM_BRANCH11 UINT16_C(0x0004)
2431#define IMAGE_REL_ARM_TOKEN UINT16_C(0x0005)
2432#define IMAGE_REL_ARM_BLX24 UINT16_C(0x0008)
2433#define IMAGE_REL_ARM_BLX11 UINT16_C(0x0009)
2434#define IMAGE_REL_ARM_SECTION UINT16_C(0x000e)
2435#define IMAGE_REL_ARM_SECREL UINT16_C(0x000f)
2436#define IMAGE_REL_ARM_MOV32A UINT16_C(0x0010)
2437#define IMAGE_REL_ARM_MOV32T UINT16_C(0x0011)
2438#define IMAGE_REL_ARM_BRANCH20T UINT16_C(0x0012)
2439#define IMAGE_REL_ARM_BRANCH24T UINT16_C(0x0014)
2440#define IMAGE_REL_ARM_BLX23T UINT16_C(0x0015)
2441/** @} */
2442
2443/** @name IMAGE_REL_ARM64_XXX - COFF relocations for ARMv8 CPUs (64-bit).
2444 * Used by IMAGE_RELOCATION::Type.
2445 * @{ */
2446#define IMAGE_REL_ARM64_ABSOLUTE UINT16_C(0x0000)
2447#define IMAGE_REL_ARM64_ADDR32 UINT16_C(0x0001)
2448#define IMAGE_REL_ARM64_ADDR32NB UINT16_C(0x0002)
2449#define IMAGE_REL_ARM64_BRANCH26 UINT16_C(0x0003)
2450#define IMAGE_REL_ARM64_PAGEBASE_REL21 UINT16_C(0x0004)
2451#define IMAGE_REL_ARM64_REL21 UINT16_C(0x0005)
2452#define IMAGE_REL_ARM64_PAGEOFFSET_12A UINT16_C(0x0006)
2453#define IMAGE_REL_ARM64_PAGEOFFSET_12L UINT16_C(0x0007)
2454#define IMAGE_REL_ARM64_SECREL UINT16_C(0x0008)
2455#define IMAGE_REL_ARM64_SECREL_LOW12A UINT16_C(0x0009)
2456#define IMAGE_REL_ARM64_SECREL_HIGH12A UINT16_C(0x000a)
2457#define IMAGE_REL_ARM64_SECREL_LOW12L UINT16_C(0x000b)
2458#define IMAGE_REL_ARM64_TOKEN UINT16_C(0x000c)
2459#define IMAGE_REL_ARM64_SECTION UINT16_C(0x000d)
2460#define IMAGE_REL_ARM64_ADDR64 UINT16_C(0x000e)
2461/** @} */
2462
2463/** @name IMAGE_REL_SH3_XXX - COFF relocation for Hitachi SuperH CPUs.
2464 * Used by IMAGE_RELOCATION::Type.
2465 * @{ */
2466#define IMAGE_REL_SH3_ABSOLUTE UINT16_C(0x0000)
2467#define IMAGE_REL_SH3_DIRECT16 UINT16_C(0x0001)
2468#define IMAGE_REL_SH3_DIRECT32 UINT16_C(0x0002)
2469#define IMAGE_REL_SH3_DIRECT8 UINT16_C(0x0003)
2470#define IMAGE_REL_SH3_DIRECT8_WORD UINT16_C(0x0004)
2471#define IMAGE_REL_SH3_DIRECT8_LONG UINT16_C(0x0005)
2472#define IMAGE_REL_SH3_DIRECT4 UINT16_C(0x0006)
2473#define IMAGE_REL_SH3_DIRECT4_WORD UINT16_C(0x0007)
2474#define IMAGE_REL_SH3_DIRECT4_LONG UINT16_C(0x0008)
2475#define IMAGE_REL_SH3_PCREL8_WORD UINT16_C(0x0009)
2476#define IMAGE_REL_SH3_PCREL8_LONG UINT16_C(0x000a)
2477#define IMAGE_REL_SH3_PCREL12_WORD UINT16_C(0x000b)
2478#define IMAGE_REL_SH3_STARTOF_SECTION UINT16_C(0x000c)
2479#define IMAGE_REL_SH3_SIZEOF_SECTION UINT16_C(0x000d)
2480#define IMAGE_REL_SH3_SECTION UINT16_C(0x000e)
2481#define IMAGE_REL_SH3_SECREL UINT16_C(0x000f)
2482#define IMAGE_REL_SH3_DIRECT32_NB UINT16_C(0x0010)
2483#define IMAGE_REL_SH3_GPREL4_LONG UINT16_C(0x0011)
2484#define IMAGE_REL_SH3_TOKEN UINT16_C(0x0012)
2485#define IMAGE_REL_SHM_PCRELPT UINT16_C(0x0013)
2486#define IMAGE_REL_SHM_REFLO UINT16_C(0x0014)
2487#define IMAGE_REL_SHM_REFHALF UINT16_C(0x0015)
2488#define IMAGE_REL_SHM_RELLO UINT16_C(0x0016)
2489#define IMAGE_REL_SHM_RELHALF UINT16_C(0x0017)
2490#define IMAGE_REL_SHM_PAIR UINT16_C(0x0018)
2491#define IMAGE_REL_SHM_NOMODE UINT16_C(0x8000)
2492/** @} */
2493
2494/** @name IMAGE_REL_PPC_XXX - COFF relocations for IBM PowerPC CPUs.
2495 * Used by IMAGE_RELOCATION::Type.
2496 * @{ */
2497#define IMAGE_REL_PPC_ABSOLUTE UINT16_C(0x0000)
2498#define IMAGE_REL_PPC_ADDR64 UINT16_C(0x0001)
2499#define IMAGE_REL_PPC_ADDR32 UINT16_C(0x0002)
2500#define IMAGE_REL_PPC_ADDR24 UINT16_C(0x0003)
2501#define IMAGE_REL_PPC_ADDR16 UINT16_C(0x0004)
2502#define IMAGE_REL_PPC_ADDR14 UINT16_C(0x0005)
2503#define IMAGE_REL_PPC_REL24 UINT16_C(0x0006)
2504#define IMAGE_REL_PPC_REL14 UINT16_C(0x0007)
2505#define IMAGE_REL_PPC_ADDR32NB UINT16_C(0x000a)
2506#define IMAGE_REL_PPC_SECREL UINT16_C(0x000b)
2507#define IMAGE_REL_PPC_SECTION UINT16_C(0x000c)
2508#define IMAGE_REL_PPC_SECREL16 UINT16_C(0x000f)
2509#define IMAGE_REL_PPC_REFHI UINT16_C(0x0010)
2510#define IMAGE_REL_PPC_REFLO UINT16_C(0x0011)
2511#define IMAGE_REL_PPC_PAIR UINT16_C(0x0012)
2512#define IMAGE_REL_PPC_SECRELLO UINT16_C(0x0013)
2513#define IMAGE_REL_PPC_GPREL UINT16_C(0x0015)
2514#define IMAGE_REL_PPC_TOKEN UINT16_C(0x0016)
2515/** @} */
2516
2517/** @name IMAGE_REL_I386_XXX - COFF relocations for x86 CPUs.
2518 * Used by IMAGE_RELOCATION::Type.
2519 * @{ */
2520#define IMAGE_REL_I386_ABSOLUTE UINT16_C(0x0000)
2521#define IMAGE_REL_I386_DIR16 UINT16_C(0x0001)
2522#define IMAGE_REL_I386_REL16 UINT16_C(0x0002)
2523#define IMAGE_REL_I386_DIR32 UINT16_C(0x0006)
2524#define IMAGE_REL_I386_DIR32NB UINT16_C(0x0007)
2525#define IMAGE_REL_I386_SEG12 UINT16_C(0x0009)
2526#define IMAGE_REL_I386_SECTION UINT16_C(0x000A)
2527#define IMAGE_REL_I386_SECREL UINT16_C(0x000B)
2528#define IMAGE_REL_I386_TOKEN UINT16_C(0x000C)
2529#define IMAGE_REL_I386_SECREL7 UINT16_C(0x000D)
2530#define IMAGE_REL_I386_REL32 UINT16_C(0x0014)
2531/** @} */
2532
2533/** @name IMAGE_REL_IA64_XXX - COFF relocations for "Itanic" CPUs.
2534 * @{ */
2535#define IMAGE_REL_IA64_ABSOLUTE UINT16_C(0x0000)
2536#define IMAGE_REL_IA64_IMM14 UINT16_C(0x0001)
2537#define IMAGE_REL_IA64_IMM22 UINT16_C(0x0002)
2538#define IMAGE_REL_IA64_IMM64 UINT16_C(0x0003)
2539#define IMAGE_REL_IA64_DIR32 UINT16_C(0x0004)
2540#define IMAGE_REL_IA64_DIR64 UINT16_C(0x0005)
2541#define IMAGE_REL_IA64_PCREL21B UINT16_C(0x0006)
2542#define IMAGE_REL_IA64_PCREL21M UINT16_C(0x0007)
2543#define IMAGE_REL_IA64_PCREL21F UINT16_C(0x0008)
2544#define IMAGE_REL_IA64_GPREL22 UINT16_C(0x0009)
2545#define IMAGE_REL_IA64_LTOFF22 UINT16_C(0x000a)
2546#define IMAGE_REL_IA64_SECTION UINT16_C(0x000b)
2547#define IMAGE_REL_IA64_SECREL22 UINT16_C(0x000c)
2548#define IMAGE_REL_IA64_SECREL64I UINT16_C(0x000d)
2549#define IMAGE_REL_IA64_SECREL32 UINT16_C(0x000e)
2550#define IMAGE_REL_IA64_DIR32NB UINT16_C(0x0010)
2551#define IMAGE_REL_IA64_SREL14 UINT16_C(0x0011)
2552#define IMAGE_REL_IA64_SREL22 UINT16_C(0x0012)
2553#define IMAGE_REL_IA64_SREL32 UINT16_C(0x0013)
2554#define IMAGE_REL_IA64_UREL32 UINT16_C(0x0014)
2555#define IMAGE_REL_IA64_PCREL60X UINT16_C(0x0015)
2556#define IMAGE_REL_IA64_PCREL60B UINT16_C(0x0016)
2557#define IMAGE_REL_IA64_PCREL60F UINT16_C(0x0017)
2558#define IMAGE_REL_IA64_PCREL60I UINT16_C(0x0018)
2559#define IMAGE_REL_IA64_PCREL60M UINT16_C(0x0019)
2560#define IMAGE_REL_IA64_IMMGPREL64 UINT16_C(0x001a)
2561#define IMAGE_REL_IA64_TOKEN UINT16_C(0x001b)
2562#define IMAGE_REL_IA64_GPREL32 UINT16_C(0x001c)
2563#define IMAGE_REL_IA64_ADDEND UINT16_C(0x001f)
2564/** @} */
2565
2566/** @name IMAGE_REL_MIPS_XXX - COFF relocations for MIPS CPUs.
2567 * Used by IMAGE_RELOCATION::Type.
2568 * @{ */
2569#define IMAGE_REL_MIPS_ABSOLUTE UINT16_C(0x0000)
2570#define IMAGE_REL_MIPS_REFHALF UINT16_C(0x0001)
2571#define IMAGE_REL_MIPS_REFWORD UINT16_C(0x0002)
2572#define IMAGE_REL_MIPS_JMPADDR UINT16_C(0x0003)
2573#define IMAGE_REL_MIPS_REFHI UINT16_C(0x0004)
2574#define IMAGE_REL_MIPS_REFLO UINT16_C(0x0005)
2575#define IMAGE_REL_MIPS_GPREL UINT16_C(0x0006)
2576#define IMAGE_REL_MIPS_LITERAL UINT16_C(0x0007)
2577#define IMAGE_REL_MIPS_SECTION UINT16_C(0x000a)
2578#define IMAGE_REL_MIPS_SECREL UINT16_C(0x000b)
2579#define IMAGE_REL_MIPS_SECRELLO UINT16_C(0x000c)
2580#define IMAGE_REL_MIPS_SECRELHI UINT16_C(0x000d)
2581#define IMAGE_REL_MIPS_JMPADDR16 UINT16_C(0x0010)
2582#define IMAGE_REL_MIPS_REFWORDNB UINT16_C(0x0022)
2583#define IMAGE_REL_MIPS_PAIR UINT16_C(0x0025)
2584/** @} */
2585
2586/** @name IMAGE_REL_M32R_XXX - COFF relocations for Mitsubishi M32R CPUs.
2587 * Used by IMAGE_RELOCATION::Type.
2588 * @{ */
2589#define IMAGE_REL_M32R_ABSOLUTE UINT16_C(0x0000)
2590#define IMAGE_REL_M32R_ADDR32 UINT16_C(0x0001)
2591#define IMAGE_REL_M32R_ADDR32NB UINT16_C(0x0002)
2592#define IMAGE_REL_M32R_ADDR24 UINT16_C(0x0003)
2593#define IMAGE_REL_M32R_GPREL16 UINT16_C(0x0004)
2594#define IMAGE_REL_M32R_PCREL24 UINT16_C(0x0005)
2595#define IMAGE_REL_M32R_PCREL16 UINT16_C(0x0006)
2596#define IMAGE_REL_M32R_PCREL8 UINT16_C(0x0007)
2597#define IMAGE_REL_M32R_REFHALF UINT16_C(0x0008)
2598#define IMAGE_REL_M32R_REFHI UINT16_C(0x0009)
2599#define IMAGE_REL_M32R_REFLO UINT16_C(0x000a)
2600#define IMAGE_REL_M32R_PAIR UINT16_C(0x000b)
2601#define IMAGE_REL_M32R_SECTION UINT16_C(0x000c)
2602#define IMAGE_REL_M32R_SECREL UINT16_C(0x000d)
2603#define IMAGE_REL_M32R_TOKEN UINT16_C(0x000e)
2604/** @} */
2605
2606
2607/** @} */
2608
2609#endif /* !IPRT_INCLUDED_formats_pecoff_h */
2610
Note: See TracBrowser for help on using the repository browser.

© 2023 Oracle
Contact – Privacy policy – Terms of Use