VirtualBox

source: vbox/trunk/include/iprt/formats/pecoff.h@ 73386

Last change on this file since 73386 was 73386, checked in by vboxsync, 6 years ago

iprt/formats/pecoff.h: More AMD64 unwind stuff.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 92.1 KB
Line 
1/* $Id: pecoff.h 73386 2018-07-27 15:18:50Z vboxsync $ */
2/** @file
3 * IPRT - Windows NT PE & COFF Structures and Constants.
4 */
5
6/*
7 * Copyright (C) 2006-2017 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * The contents of this file may alternatively be used under the terms
18 * of the Common Development and Distribution License Version 1.0
19 * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20 * VirtualBox OSE distribution, in which case the provisions of the
21 * CDDL are applicable instead of those of the GPL.
22 *
23 * You may elect to license modified versions of this file under the
24 * terms and conditions of either the GPL or the CDDL or both.
25 */
26
27#ifndef ___iprt_formats_pecoff_h
28#define ___iprt_formats_pecoff_h
29
30#include <iprt/types.h>
31#include <iprt/assertcompile.h>
32
33
34/** @defgroup grp_rt_formats_pecoff PE & Microsoft COFF structures and definitions
35 * @ingroup grp_rt_formats
36 * @{
37 */
38
39
40/**
41 * PE & COFF file header.
42 *
43 * This starts COFF files, while in PE files it's preceeded by the PE signature
44 * (see IMAGE_NT_HEADERS32, IMAGE_NT_HEADERS64).
45 */
46typedef struct _IMAGE_FILE_HEADER
47{
48 uint16_t Machine; /**< 0x00 */
49 uint16_t NumberOfSections; /**< 0x02 */
50 uint32_t TimeDateStamp; /**< 0x04 */
51 uint32_t PointerToSymbolTable; /**< 0x08 */
52 uint32_t NumberOfSymbols; /**< 0x0c */
53 uint16_t SizeOfOptionalHeader; /**< 0x10 */
54 uint16_t Characteristics; /**< 0x12 */
55} IMAGE_FILE_HEADER; /* size: 0x14 */
56AssertCompileSize(IMAGE_FILE_HEADER, 0x14);
57typedef IMAGE_FILE_HEADER *PIMAGE_FILE_HEADER;
58typedef IMAGE_FILE_HEADER const *PCIMAGE_FILE_HEADER;
59
60
61/** @name PE & COFF machine types.
62 * Used by IMAGE_FILE_HEADER::Machine and IMAGE_SEPARATE_DEBUG_HEADER::Machine.
63 * @{ */
64/** X86 compatible CPU, 32-bit instructions. */
65#define IMAGE_FILE_MACHINE_I386 UINT16_C(0x014c)
66/** AMD64 compatible CPU, 64-bit instructions. */
67#define IMAGE_FILE_MACHINE_AMD64 UINT16_C(0x8664)
68
69/** Unknown target CPU. */
70#define IMAGE_FILE_MACHINE_UNKNOWN UINT16_C(0x0000)
71/** Basic-16 (whatever that is). */
72#define IMAGE_FILE_MACHINE_BASIC_16 UINT16_C(0x0142)
73/** Basic-16 (whatever that is) w/ transfer vector(s?) (TV). */
74#define IMAGE_FILE_MACHINE_BASIC_16_TV UINT16_C(0x0143)
75/** Intel iAPX 16 (8086?). */
76#define IMAGE_FILE_MACHINE_IAPX16 UINT16_C(0x0144)
77/** Intel iAPX 16 (8086?) w/ transfer vector(s?) (TV). */
78#define IMAGE_FILE_MACHINE_IAPX16_TV UINT16_C(0x0145)
79/** Intel iAPX 20 (80286?). */
80#define IMAGE_FILE_MACHINE_IAPX20 UINT16_C(0x0144)
81/** Intel iAPX 20 (80286?) w/ transfer vector(s?) (TV). */
82#define IMAGE_FILE_MACHINE_IAPX20_TV UINT16_C(0x0145)
83/** X86 compatible CPU, 8086. */
84#define IMAGE_FILE_MACHINE_I8086 UINT16_C(0x0148)
85/** X86 compatible CPU, 8086 w/ transfer vector(s?) (TV). */
86#define IMAGE_FILE_MACHINE_I8086_TV UINT16_C(0x0149)
87/** X86 compatible CPU, 80286 small model program. */
88#define IMAGE_FILE_MACHINE_I286_SMALL UINT16_C(0x014a)
89/** Motorola 68000. */
90#define IMAGE_FILE_MACHINE_MC68 UINT16_C(0x0150)
91/** Motorola 68000 w/ writable text sections. */
92#define IMAGE_FILE_MACHINE_MC68_WR UINT16_C(0x0150)
93/** Motorola 68000 w/ transfer vector(s?). */
94#define IMAGE_FILE_MACHINE_MC68_TV UINT16_C(0x0151)
95/** Motorola 68000 w/ demand paged text.
96 * @note shared with 80286 large model program. */
97#define IMAGE_FILE_MACHINE_MC68_PG UINT16_C(0x0152)
98/** X86 compatible CPU, 80286 large model program.
99 * @note shared with MC68000 w/ demand paged text */
100#define IMAGE_FILE_MACHINE_I286_LARGE UINT16_C(0x0152)
101/** IBM 370 (writable text). */
102#define IMAGE_FILE_MACHINE_U370_WR UINT16_C(0x0158)
103/** Amdahl 470/580 (writable text). */
104#define IMAGE_FILE_MACHINE_AMDAHL_470_WR UINT16_C(0x0159)
105/** Amdahl 470/580 (read only text). */
106#define IMAGE_FILE_MACHINE_AMDAHL_470_RO UINT16_C(0x015c)
107/** IBM 370 (read only text). */
108#define IMAGE_FILE_MACHINE_U370_RO UINT16_C(0x015d)
109/** MIPS R4000 CPU, little endian. */
110#define IMAGE_FILE_MACHINE_R4000 UINT16_C(0x0166)
111/** MIPS CPU, little endian, Windows CE (?) v2 designation. */
112#define IMAGE_FILE_MACHINE_WCEMIPSV2 UINT16_C(0x0169)
113/** VAX-11/750 and VAX-11/780 (writable text). */
114#define IMAGE_FILE_MACHINE_VAX_WR UINT16_C(0x0178)
115/** VAX-11/750 and VAX-11/780 (read-only text). */
116#define IMAGE_FILE_MACHINE_VAX_RO UINT16_C(0x017d)
117/** Hitachi SH3 CPU. */
118#define IMAGE_FILE_MACHINE_SH3 UINT16_C(0x01a2)
119/** Hitachi SH3 DSP. */
120#define IMAGE_FILE_MACHINE_SH3DSP UINT16_C(0x01a3)
121/** Hitachi SH4 CPU. */
122#define IMAGE_FILE_MACHINE_SH4 UINT16_C(0x01a6)
123/** Hitachi SH5 CPU. */
124#define IMAGE_FILE_MACHINE_SH5 UINT16_C(0x01a8)
125/** Little endian ARM CPU. */
126#define IMAGE_FILE_MACHINE_ARM UINT16_C(0x01c0)
127/** ARM or Thumb stuff. */
128#define IMAGE_FILE_MACHINE_THUMB UINT16_C(0x01c2)
129/** ARMv7 or higher CPU, Thumb mode. */
130#define IMAGE_FILE_MACHINE_ARMNT UINT16_C(0x01c4)
131/** Matshushita AM33 CPU. */
132#define IMAGE_FILE_MACHINE_AM33 UINT16_C(0x01d3)
133/** Power PC CPU, little endian. */
134#define IMAGE_FILE_MACHINE_POWERPC UINT16_C(0x01f0)
135/** Power PC CPU with FPU, also little endian? */
136#define IMAGE_FILE_MACHINE_POWERPCFP UINT16_C(0x01f1)
137/** "Itanic" CPU. */
138#define IMAGE_FILE_MACHINE_IA64 UINT16_C(0x0200)
139/** MIPS CPU, compact 16-bit instructions only? */
140#define IMAGE_FILE_MACHINE_MIPS16 UINT16_C(0x0266)
141/** MIPS CPU with FPU, full 32-bit instructions only? */
142#define IMAGE_FILE_MACHINE_MIPSFPU UINT16_C(0x0366)
143/** MIPS CPU with FPU, compact 16-bit instructions? */
144#define IMAGE_FILE_MACHINE_MIPSFPU16 UINT16_C(0x0466)
145/** EFI byte code. */
146#define IMAGE_FILE_MACHINE_EBC UINT16_C(0x0ebc)
147/** Mitsubishi M32R CPU, little endian. */
148#define IMAGE_FILE_MACHINE_M32R UINT16_C(0x9041)
149/** ARMv8 CPU, 64-bit mode. */
150#define IMAGE_FILE_MACHINE_ARM64 UINT16_C(0xaa64)
151/** @} */
152
153/** @name File header characteristics (IMAGE_FILE_HEADER::Characteristics)
154 * @{ */
155#define IMAGE_FILE_RELOCS_STRIPPED UINT16_C(0x0001)
156#define IMAGE_FILE_EXECUTABLE_IMAGE UINT16_C(0x0002)
157#define IMAGE_FILE_LINE_NUMS_STRIPPED UINT16_C(0x0004)
158#define IMAGE_FILE_LOCAL_SYMS_STRIPPED UINT16_C(0x0008)
159#define IMAGE_FILE_AGGRESIVE_WS_TRIM UINT16_C(0x0010)
160#define IMAGE_FILE_LARGE_ADDRESS_AWARE UINT16_C(0x0020)
161#define IMAGE_FILE_16BIT_MACHINE UINT16_C(0x0040)
162#define IMAGE_FILE_BYTES_REVERSED_LO UINT16_C(0x0080)
163#define IMAGE_FILE_32BIT_MACHINE UINT16_C(0x0100)
164#define IMAGE_FILE_DEBUG_STRIPPED UINT16_C(0x0200)
165#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP UINT16_C(0x0400)
166#define IMAGE_FILE_NET_RUN_FROM_SWAP UINT16_C(0x0800)
167#define IMAGE_FILE_SYSTEM UINT16_C(0x1000) /**< (COFF/IAPX*: Used to indicate 80186 instructions) */
168#define IMAGE_FILE_DLL UINT16_C(0x2000) /**< (COFF/IAPX*: Used to indicate 80286 instructions) */
169#define IMAGE_FILE_UP_SYSTEM_ONLY UINT16_C(0x4000)
170#define IMAGE_FILE_BYTES_REVERSED_HI UINT16_C(0x8000)
171/** @} */
172
173
174/**
175 * PE data directory.
176 *
177 * This is used to locate data in the loaded image so the dynamic linker or
178 * others can make use of it. However, in the case of
179 * IMAGE_DIRECTORY_ENTRY_SECURITY it is referring to raw file offsets.
180 */
181typedef struct _IMAGE_DATA_DIRECTORY
182{
183 uint32_t VirtualAddress;
184 uint32_t Size;
185} IMAGE_DATA_DIRECTORY;
186AssertCompileSize(IMAGE_DATA_DIRECTORY, 0x8);
187typedef IMAGE_DATA_DIRECTORY *PIMAGE_DATA_DIRECTORY;
188typedef IMAGE_DATA_DIRECTORY const *PCIMAGE_DATA_DIRECTORY;
189
190/** The standard number of data directories in the optional header.
191 * I.e. the dimensions of IMAGE_OPTIONAL_HEADER32::DataDirectory and
192 * IMAGE_OPTIONAL_HEADER64::DataDirectory.
193 */
194#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 0x10
195
196
197/**
198 * PE optional header, 32-bit version.
199 */
200typedef struct _IMAGE_OPTIONAL_HEADER32
201{
202 uint16_t Magic; /**< 0x00 */
203 uint8_t MajorLinkerVersion; /**< 0x02 */
204 uint8_t MinorLinkerVersion; /**< 0x03 */
205 uint32_t SizeOfCode; /**< 0x04 */
206 uint32_t SizeOfInitializedData; /**< 0x08 */
207 uint32_t SizeOfUninitializedData; /**< 0x0c */
208 uint32_t AddressOfEntryPoint; /**< 0x10 */
209 uint32_t BaseOfCode; /**< 0x14 */
210 uint32_t BaseOfData; /**< 0x18 */
211 uint32_t ImageBase; /**< 0x1c */
212 uint32_t SectionAlignment; /**< 0x20 */
213 uint32_t FileAlignment; /**< 0x24 */
214 uint16_t MajorOperatingSystemVersion; /**< 0x28 */
215 uint16_t MinorOperatingSystemVersion; /**< 0x2a */
216 uint16_t MajorImageVersion; /**< 0x2c */
217 uint16_t MinorImageVersion; /**< 0x2e */
218 uint16_t MajorSubsystemVersion; /**< 0x30 */
219 uint16_t MinorSubsystemVersion; /**< 0x32 */
220 uint32_t Win32VersionValue; /**< 0x34 */
221 uint32_t SizeOfImage; /**< 0x38 */
222 uint32_t SizeOfHeaders; /**< 0x3c */
223 uint32_t CheckSum; /**< 0x40 */
224 uint16_t Subsystem; /**< 0x44 */
225 uint16_t DllCharacteristics; /**< 0x46 */
226 uint32_t SizeOfStackReserve; /**< 0x48 */
227 uint32_t SizeOfStackCommit; /**< 0x4c */
228 uint32_t SizeOfHeapReserve; /**< 0x50 */
229 uint32_t SizeOfHeapCommit; /**< 0x54 */
230 uint32_t LoaderFlags; /**< 0x58 */
231 uint32_t NumberOfRvaAndSizes; /**< 0x5c */
232 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x60; 0x10*8 = 0x80 */
233} IMAGE_OPTIONAL_HEADER32; /* size: 0xe0 */
234AssertCompileSize(IMAGE_OPTIONAL_HEADER32, 0xe0);
235typedef IMAGE_OPTIONAL_HEADER32 *PIMAGE_OPTIONAL_HEADER32;
236typedef IMAGE_OPTIONAL_HEADER32 const *PCIMAGE_OPTIONAL_HEADER32;
237
238/**
239 * PE optional header, 64-bit version.
240 */
241typedef struct _IMAGE_OPTIONAL_HEADER64
242{
243 uint16_t Magic; /**< 0x00 */
244 uint8_t MajorLinkerVersion; /**< 0x02 */
245 uint8_t MinorLinkerVersion; /**< 0x03 */
246 uint32_t SizeOfCode; /**< 0x04 */
247 uint32_t SizeOfInitializedData; /**< 0x08 */
248 uint32_t SizeOfUninitializedData; /**< 0x0c */
249 uint32_t AddressOfEntryPoint; /**< 0x10 */
250 uint32_t BaseOfCode; /**< 0x14 */
251 uint64_t ImageBase; /**< 0x18 */
252 uint32_t SectionAlignment; /**< 0x20 */
253 uint32_t FileAlignment; /**< 0x24 */
254 uint16_t MajorOperatingSystemVersion; /**< 0x28 */
255 uint16_t MinorOperatingSystemVersion; /**< 0x2a */
256 uint16_t MajorImageVersion; /**< 0x2c */
257 uint16_t MinorImageVersion; /**< 0x2e */
258 uint16_t MajorSubsystemVersion; /**< 0x30 */
259 uint16_t MinorSubsystemVersion; /**< 0x32 */
260 uint32_t Win32VersionValue; /**< 0x34 */
261 uint32_t SizeOfImage; /**< 0x38 */
262 uint32_t SizeOfHeaders; /**< 0x3c */
263 uint32_t CheckSum; /**< 0x40 */
264 uint16_t Subsystem; /**< 0x44 */
265 uint16_t DllCharacteristics; /**< 0x46 */
266 uint64_t SizeOfStackReserve; /**< 0x48 */
267 uint64_t SizeOfStackCommit; /**< 0x50 */
268 uint64_t SizeOfHeapReserve; /**< 0x58 */
269 uint64_t SizeOfHeapCommit; /**< 0x60 */
270 uint32_t LoaderFlags; /**< 0x68 */
271 uint32_t NumberOfRvaAndSizes; /**< 0x6c */
272 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x70; 0x10*8 = 0x80 */
273} IMAGE_OPTIONAL_HEADER64; /* size: 0xf0 */
274AssertCompileSize(IMAGE_OPTIONAL_HEADER64, 0xf0);
275typedef IMAGE_OPTIONAL_HEADER64 *PIMAGE_OPTIONAL_HEADER64;
276typedef IMAGE_OPTIONAL_HEADER64 const *PCIMAGE_OPTIONAL_HEADER64;
277
278/** @name Optional header magic values.
279 * @{ */
280#define IMAGE_NT_OPTIONAL_HDR32_MAGIC UINT16_C(0x010b)
281#define IMAGE_NT_OPTIONAL_HDR64_MAGIC UINT16_C(0x020b)
282/** @} */
283
284/** @name IMAGE_SUBSYSTEM_XXX - Optional header subsystems.
285 * IMAGE_OPTIONAL_HEADER32::Subsystem, IMAGE_OPTIONAL_HEADER64::Subsystem
286 * @{ */
287#define IMAGE_SUBSYSTEM_UNKNOWN UINT16_C(0x0000)
288#define IMAGE_SUBSYSTEM_NATIVE UINT16_C(0x0001)
289#define IMAGE_SUBSYSTEM_WINDOWS_GUI UINT16_C(0x0002)
290#define IMAGE_SUBSYSTEM_WINDOWS_CUI UINT16_C(0x0003)
291#define IMAGE_SUBSYSTEM_OS2_GUI UINT16_C(0x0004)
292#define IMAGE_SUBSYSTEM_OS2_CUI UINT16_C(0x0005)
293#define IMAGE_SUBSYSTEM_POSIX_CUI UINT16_C(0x0007)
294/** @} */
295
296/** @name Optional header characteristics.
297 * @{ */
298#define IMAGE_LIBRARY_PROCESS_INIT UINT16_C(0x0001)
299#define IMAGE_LIBRARY_PROCESS_TERM UINT16_C(0x0002)
300#define IMAGE_LIBRARY_THREAD_INIT UINT16_C(0x0004)
301#define IMAGE_LIBRARY_THREAD_TERM UINT16_C(0x0008)
302#define IMAGE_DLLCHARACTERISTICS_RESERVED UINT16_C(0x0010)
303#define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA UINT16_C(0x0020)
304#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE UINT16_C(0x0040)
305#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY UINT16_C(0x0080)
306#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT UINT16_C(0x0100)
307#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION UINT16_C(0x0200)
308#define IMAGE_DLLCHARACTERISTICS_NO_SEH UINT16_C(0x0400)
309#define IMAGE_DLLCHARACTERISTICS_NO_BIND UINT16_C(0x0800)
310#define IMAGE_DLLCHARACTERISTICS_APPCONTAINER UINT16_C(0x1000)
311#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER UINT16_C(0x2000)
312#define IMAGE_DLLCHARACTERISTICS_GUARD_CF UINT16_C(0x4000)
313#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE UINT16_C(0x8000)
314/** @} */
315
316
317/** @name IMAGE_DIRECTORY_ENTRY_XXX - Data directory indexes.
318 * Used to index IMAGE_OPTIONAL_HEADER32::DataDirectory and
319 * IMAGE_OPTIONAL_HEADER64::DataDirectory
320 * @{ */
321#define IMAGE_DIRECTORY_ENTRY_EXPORT 0x0
322#define IMAGE_DIRECTORY_ENTRY_IMPORT 0x1
323#define IMAGE_DIRECTORY_ENTRY_RESOURCE 0x2
324#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x3
325#define IMAGE_DIRECTORY_ENTRY_SECURITY 0x4
326#define IMAGE_DIRECTORY_ENTRY_BASERELOC 0x5
327#define IMAGE_DIRECTORY_ENTRY_DEBUG 0x6
328#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 0x7
329#define IMAGE_DIRECTORY_ENTRY_COPYRIGHT IMAGE_DIRECTORY_ENTRY_ARCHITECTURE
330#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x8
331#define IMAGE_DIRECTORY_ENTRY_TLS 0x9
332#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0xa
333#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0xb
334#define IMAGE_DIRECTORY_ENTRY_IAT 0xc
335#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0xd
336#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0xe
337/** @} */
338
339
340/**
341 * PE (NT) headers, 32-bit version.
342 */
343typedef struct _IMAGE_NT_HEADERS32
344{
345 uint32_t Signature; /**< 0x00 */
346 IMAGE_FILE_HEADER FileHeader; /**< 0x04 */
347 IMAGE_OPTIONAL_HEADER32 OptionalHeader; /**< 0x18 */
348} IMAGE_NT_HEADERS32; /* size: 0xf8 */
349AssertCompileSize(IMAGE_NT_HEADERS32, 0xf8);
350AssertCompileMemberOffset(IMAGE_NT_HEADERS32, FileHeader, 4);
351AssertCompileMemberOffset(IMAGE_NT_HEADERS32, OptionalHeader, 24);
352typedef IMAGE_NT_HEADERS32 *PIMAGE_NT_HEADERS32;
353typedef IMAGE_NT_HEADERS32 const *PCIMAGE_NT_HEADERS32;
354
355/**
356 * PE (NT) headers, 64-bit version.
357 */
358typedef struct _IMAGE_NT_HEADERS64
359{
360 uint32_t Signature; /**< 0x00 */
361 IMAGE_FILE_HEADER FileHeader; /**< 0x04 */
362 IMAGE_OPTIONAL_HEADER64 OptionalHeader; /**< 0x18 */
363} IMAGE_NT_HEADERS64; /**< 0x108 */
364AssertCompileSize(IMAGE_NT_HEADERS64, 0x108);
365AssertCompileMemberOffset(IMAGE_NT_HEADERS64, FileHeader, 4);
366AssertCompileMemberOffset(IMAGE_NT_HEADERS64, OptionalHeader, 24);
367typedef IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
368typedef IMAGE_NT_HEADERS64 const *PCIMAGE_NT_HEADERS64;
369
370/** The PE signature.
371 * Used by IMAGE_NT_HEADERS32::Signature, IMAGE_NT_HEADERS64::Signature. */
372#define IMAGE_NT_SIGNATURE UINT32_C(0x00004550)
373
374
375/** Section header short name length (IMAGE_SECTION_HEADER::Name). */
376#define IMAGE_SIZEOF_SHORT_NAME 0x8
377
378/**
379 * PE & COFF section header.
380 */
381typedef struct _IMAGE_SECTION_HEADER
382{
383 uint8_t Name[IMAGE_SIZEOF_SHORT_NAME];
384 union
385 {
386 uint32_t PhysicalAddress;
387 uint32_t VirtualSize;
388 } Misc;
389 uint32_t VirtualAddress;
390 uint32_t SizeOfRawData;
391 uint32_t PointerToRawData;
392 uint32_t PointerToRelocations;
393 uint32_t PointerToLinenumbers;
394 uint16_t NumberOfRelocations;
395 uint16_t NumberOfLinenumbers;
396 uint32_t Characteristics;
397} IMAGE_SECTION_HEADER;
398AssertCompileSize(IMAGE_SECTION_HEADER, 40);
399typedef IMAGE_SECTION_HEADER *PIMAGE_SECTION_HEADER;
400typedef IMAGE_SECTION_HEADER const *PCIMAGE_SECTION_HEADER;
401
402/** @name IMAGE_SCN_XXX - Section header characteristics.
403 * Used by IMAGE_SECTION_HEADER::Characteristics.
404 * @{ */
405#define IMAGE_SCN_TYPE_REG UINT32_C(0x00000000)
406#define IMAGE_SCN_TYPE_DSECT UINT32_C(0x00000001)
407#define IMAGE_SCN_TYPE_NOLOAD UINT32_C(0x00000002)
408#define IMAGE_SCN_TYPE_GROUP UINT32_C(0x00000004)
409#define IMAGE_SCN_TYPE_NO_PAD UINT32_C(0x00000008)
410#define IMAGE_SCN_TYPE_COPY UINT32_C(0x00000010)
411
412#define IMAGE_SCN_CNT_CODE UINT32_C(0x00000020)
413#define IMAGE_SCN_CNT_INITIALIZED_DATA UINT32_C(0x00000040)
414#define IMAGE_SCN_CNT_UNINITIALIZED_DATA UINT32_C(0x00000080)
415
416#define IMAGE_SCN_LNK_OTHER UINT32_C(0x00000100)
417#define IMAGE_SCN_LNK_INFO UINT32_C(0x00000200)
418#define IMAGE_SCN_TYPE_OVER UINT32_C(0x00000400)
419#define IMAGE_SCN_LNK_REMOVE UINT32_C(0x00000800)
420#define IMAGE_SCN_LNK_COMDAT UINT32_C(0x00001000)
421#define IMAGE_SCN_MEM_PROTECTED UINT32_C(0x00004000)
422#define IMAGE_SCN_NO_DEFER_SPEC_EXC UINT32_C(0x00004000)
423#define IMAGE_SCN_GPREL UINT32_C(0x00008000)
424#define IMAGE_SCN_MEM_FARDATA UINT32_C(0x00008000)
425#define IMAGE_SCN_MEM_SYSHEAP UINT32_C(0x00010000)
426#define IMAGE_SCN_MEM_PURGEABLE UINT32_C(0x00020000)
427#define IMAGE_SCN_MEM_16BIT UINT32_C(0x00020000)
428#define IMAGE_SCN_MEM_LOCKED UINT32_C(0x00040000)
429#define IMAGE_SCN_MEM_PRELOAD UINT32_C(0x00080000)
430
431#define IMAGE_SCN_ALIGN_1BYTES UINT32_C(0x00100000)
432#define IMAGE_SCN_ALIGN_2BYTES UINT32_C(0x00200000)
433#define IMAGE_SCN_ALIGN_4BYTES UINT32_C(0x00300000)
434#define IMAGE_SCN_ALIGN_8BYTES UINT32_C(0x00400000)
435#define IMAGE_SCN_ALIGN_16BYTES UINT32_C(0x00500000)
436#define IMAGE_SCN_ALIGN_32BYTES UINT32_C(0x00600000)
437#define IMAGE_SCN_ALIGN_64BYTES UINT32_C(0x00700000)
438#define IMAGE_SCN_ALIGN_128BYTES UINT32_C(0x00800000)
439#define IMAGE_SCN_ALIGN_256BYTES UINT32_C(0x00900000)
440#define IMAGE_SCN_ALIGN_512BYTES UINT32_C(0x00A00000)
441#define IMAGE_SCN_ALIGN_1024BYTES UINT32_C(0x00B00000)
442#define IMAGE_SCN_ALIGN_2048BYTES UINT32_C(0x00C00000)
443#define IMAGE_SCN_ALIGN_4096BYTES UINT32_C(0x00D00000)
444#define IMAGE_SCN_ALIGN_8192BYTES UINT32_C(0x00E00000)
445#define IMAGE_SCN_ALIGN_MASK UINT32_C(0x00F00000)
446#define IMAGE_SCN_ALIGN_SHIFT 20
447
448#define IMAGE_SCN_LNK_NRELOC_OVFL UINT32_C(0x01000000)
449#define IMAGE_SCN_MEM_DISCARDABLE UINT32_C(0x02000000)
450#define IMAGE_SCN_MEM_NOT_CACHED UINT32_C(0x04000000)
451#define IMAGE_SCN_MEM_NOT_PAGED UINT32_C(0x08000000)
452#define IMAGE_SCN_MEM_SHARED UINT32_C(0x10000000)
453#define IMAGE_SCN_MEM_EXECUTE UINT32_C(0x20000000)
454#define IMAGE_SCN_MEM_READ UINT32_C(0x40000000)
455#define IMAGE_SCN_MEM_WRITE UINT32_C(0x80000000)
456/** @} */
457
458
459/**
460 * PE image base relocations block header.
461 *
462 * This found in IMAGE_DIRECTORY_ENTRY_BASERELOC. Each entry is follow
463 * immediately by an array of 16-bit words, where the lower 12-bits are used
464 * for the page offset and the upper 4-bits for the base relocation type
465 * (IMAGE_REL_BASE_XXX). The block should be padded with
466 * IMAGE_REL_BASED_ABSOLUTE entries to ensure 32-bit alignment of this header.
467 */
468typedef struct _IMAGE_BASE_RELOCATION
469{
470 /** The RVA of the page/block the following ase relocations applies to. */
471 uint32_t VirtualAddress;
472 /** The size of this relocation block, including this header. */
473 uint32_t SizeOfBlock;
474} IMAGE_BASE_RELOCATION;
475AssertCompileSize(IMAGE_BASE_RELOCATION, 8);
476typedef IMAGE_BASE_RELOCATION *PIMAGE_BASE_RELOCATION;
477typedef IMAGE_BASE_RELOCATION const *PCIMAGE_BASE_RELOCATION;
478
479/** @name IMAGE_REL_BASED_XXX - PE base relocations.
480 * Found in the IMAGE_DIRECTORY_ENTRY_BASERELOC data directory.
481 * @{ */
482#define IMAGE_REL_BASED_ABSOLUTE UINT16_C(0x0)
483#define IMAGE_REL_BASED_HIGH UINT16_C(0x1)
484#define IMAGE_REL_BASED_LOW UINT16_C(0x2)
485#define IMAGE_REL_BASED_HIGHLOW UINT16_C(0x3)
486#define IMAGE_REL_BASED_HIGHADJ UINT16_C(0x4)
487#define IMAGE_REL_BASED_MIPS_JMPADDR UINT16_C(0x5)
488#define IMAGE_REL_BASED_MIPS_JMPADDR16 UINT16_C(0x9)
489#define IMAGE_REL_BASED_IA64_IMM64 UINT16_C(0x9)
490#define IMAGE_REL_BASED_DIR64 UINT16_C(0xa)
491#define IMAGE_REL_BASED_HIGH3ADJ UINT16_C(0xb)
492/** @} */
493
494/**
495 * PE export directory entry.
496 */
497typedef struct _IMAGE_EXPORT_DIRECTORY
498{
499 uint32_t Characteristics;
500 uint32_t TimeDateStamp;
501 uint16_t MajorVersion;
502 uint16_t MinorVersion;
503 uint32_t Name;
504 uint32_t Base;
505 uint32_t NumberOfFunctions;
506 uint32_t NumberOfNames;
507 uint32_t AddressOfFunctions;
508 uint32_t AddressOfNames;
509 uint32_t AddressOfNameOrdinals;
510} IMAGE_EXPORT_DIRECTORY;
511AssertCompileSize(IMAGE_EXPORT_DIRECTORY, 40);
512typedef IMAGE_EXPORT_DIRECTORY *PIMAGE_EXPORT_DIRECTORY;
513typedef IMAGE_EXPORT_DIRECTORY const *PCIMAGE_EXPORT_DIRECTORY;
514
515
516/**
517 * PE import directory entry.
518 */
519typedef struct _IMAGE_IMPORT_DESCRIPTOR
520{
521 union
522 {
523 uint32_t Characteristics;
524 uint32_t OriginalFirstThunk;
525 } u;
526 uint32_t TimeDateStamp;
527 uint32_t ForwarderChain;
528 uint32_t Name;
529 uint32_t FirstThunk;
530} IMAGE_IMPORT_DESCRIPTOR;
531AssertCompileSize(IMAGE_IMPORT_DESCRIPTOR, 20);
532typedef IMAGE_IMPORT_DESCRIPTOR *PIMAGE_IMPORT_DESCRIPTOR;
533typedef IMAGE_IMPORT_DESCRIPTOR const *PCIMAGE_IMPORT_DESCRIPTOR;
534
535/**
536 * Something we currently don't make use of...
537 */
538typedef struct _IMAGE_IMPORT_BY_NAME
539{
540 uint16_t Hint;
541 uint8_t Name[1];
542} IMAGE_IMPORT_BY_NAME;
543AssertCompileSize(IMAGE_IMPORT_BY_NAME, 4);
544typedef IMAGE_IMPORT_BY_NAME *PIMAGE_IMPORT_BY_NAME;
545typedef IMAGE_IMPORT_BY_NAME const *PCIMAGE_IMPORT_BY_NAME;
546
547
548#if 0
549/* The image_thunk_data32/64 structures are not very helpful except for getting RSI.
550 keep them around till all the code has been converted. */
551typedef struct _IMAGE_THUNK_DATA64
552{
553 union
554 {
555 uint64_t ForwarderString;
556 uint64_t Function;
557 uint64_t Ordinal;
558 uint64_t AddressOfData;
559 } u1;
560} IMAGE_THUNK_DATA64;
561typedef IMAGE_THUNK_DATA64 *PIMAGE_THUNK_DATA64;
562typedef IMAGE_THUNK_DATA64 const *PCIMAGE_THUNK_DATA64;
563
564typedef struct _IMAGE_THUNK_DATA32
565{
566 union
567 {
568 uint32_t ForwarderString;
569 uint32_t Function;
570 uint32_t Ordinal;
571 uint32_t AddressOfData;
572 } u1;
573} IMAGE_THUNK_DATA32;
574typedef IMAGE_THUNK_DATA32 *PIMAGE_THUNK_DATA32;
575typedef IMAGE_THUNK_DATA32 const *PCIMAGE_THUNK_DATA32;
576#endif
577
578/** @name PE import directory macros.
579 * @{ */
580#define IMAGE_ORDINAL_FLAG32 UINT32_C(0x80000000)
581#define IMAGE_ORDINAL32(ord) ((ord) & UINT32_C(0xffff))
582#define IMAGE_SNAP_BY_ORDINAL32(ord) (!!((ord) & IMAGE_ORDINAL_FLAG32))
583
584#define IMAGE_ORDINAL_FLAG64 UINT64_C(0x8000000000000000)
585#define IMAGE_ORDINAL64(ord) ((ord) & UINT32_C(0xffff))
586#define IMAGE_SNAP_BY_ORDINAL64(ord) (!!((ord) & IMAGE_ORDINAL_FLAG64))
587/** @} */
588
589/** @name PE Resource directory
590 * @{ */
591typedef struct _IMAGE_RESOURCE_DIRECTORY
592{
593 uint32_t Characteristics;
594 uint32_t TimeDateStamp;
595 uint16_t MajorVersion;
596 uint16_t MinorVersion;
597 uint16_t NumberOfNamedEntries;
598 uint16_t NumberOfIdEntries;
599} IMAGE_RESOURCE_DIRECTORY;
600typedef IMAGE_RESOURCE_DIRECTORY *PIMAGE_RESOURCE_DIRECTORY;
601typedef IMAGE_RESOURCE_DIRECTORY const *PCIMAGE_RESOURCE_DIRECTORY;
602
603typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY
604{
605 union
606 {
607 struct
608 {
609 uint32_t NameOffset : 31;
610 uint32_t NameIsString : 1; /**< IMAGE_RESOURCE_NAME_IS_STRING */
611 } s;
612 uint32_t Name;
613 uint16_t Id;
614 } u;
615 union
616 {
617 struct
618 {
619 uint32_t OffsetToDirectory : 31;
620 uint32_t DataIsDirectory : 1; /**< IMAGE_RESOURCE_DATA_IS_DIRECTORY*/
621 } s2;
622 uint32_t OffsetToData;
623 } u2;
624} IMAGE_RESOURCE_DIRECTORY_ENTRY;
625typedef IMAGE_RESOURCE_DIRECTORY_ENTRY *PIMAGE_RESOURCE_DIRECTORY_ENTRY;
626typedef IMAGE_RESOURCE_DIRECTORY_ENTRY const *PCIMAGE_RESOURCE_DIRECTORY_ENTRY;
627
628#define IMAGE_RESOURCE_NAME_IS_STRING UINT32_C(0x80000000)
629#define IMAGE_RESOURCE_DATA_IS_DIRECTORY UINT32_C(0x80000000)
630
631typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING
632{
633 uint16_t Length;
634 char NameString[1];
635} IMAGE_RESOURCE_DIRECTORY_STRING;
636typedef IMAGE_RESOURCE_DIRECTORY_STRING *PIMAGE_RESOURCE_DIRECTORY_STRING;
637typedef IMAGE_RESOURCE_DIRECTORY_STRING const *PCIMAGE_RESOURCE_DIRECTORY_STRING;
638
639
640typedef struct _IMAGE_RESOURCE_DIR_STRING_U
641{
642 uint16_t Length;
643 RTUTF16 NameString[1];
644} IMAGE_RESOURCE_DIR_STRING_U;
645typedef IMAGE_RESOURCE_DIR_STRING_U *PIMAGE_RESOURCE_DIR_STRING_U;
646typedef IMAGE_RESOURCE_DIR_STRING_U const *PCIMAGE_RESOURCE_DIR_STRING_U;
647
648
649typedef struct _IMAGE_RESOURCE_DATA_ENTRY
650{
651 uint32_t OffsetToData;
652 uint32_t Size;
653 uint32_t CodePage;
654 uint32_t Reserved;
655} IMAGE_RESOURCE_DATA_ENTRY;
656typedef IMAGE_RESOURCE_DATA_ENTRY *PIMAGE_RESOURCE_DATA_ENTRY;
657typedef IMAGE_RESOURCE_DATA_ENTRY const *PCIMAGE_RESOURCE_DATA_ENTRY;
658
659/** @} */
660
661/** @name Image exception information
662 * @{ */
663
664/** This structure is used by AMD64 and "Itanic".
665 * MIPS uses a different one. ARM, SH3, SH4 and PPC on WinCE also uses a different one. */
666typedef struct _IMAGE_RUNTIME_FUNCTION_ENTRY
667{
668 uint32_t BeginAddress;
669 uint32_t EndAddress;
670 uint32_t UnwindInfoAddress;
671} IMAGE_RUNTIME_FUNCTION_ENTRY;
672AssertCompileSize(IMAGE_RUNTIME_FUNCTION_ENTRY, 12);
673typedef IMAGE_RUNTIME_FUNCTION_ENTRY *PIMAGE_RUNTIME_FUNCTION_ENTRY;
674typedef IMAGE_RUNTIME_FUNCTION_ENTRY const *PCIMAGE_RUNTIME_FUNCTION_ENTRY;
675
676/**
677 * An unwind code for AMD64 and ARM64.
678 *
679 * @note Also known as UNWIND_CODE or _UNWIND_CODE.
680 */
681typedef union IMAGE_UNWIND_CODE
682{
683 struct
684 {
685 /** The prolog offset where the change takes effect.
686 * This means the instruction following the one being described. */
687 uint8_t CodeOffset;
688 /** Unwind opcode.
689 * For AMD64 see IMAGE_AMD64_UNWIND_OP_CODES. */
690 uint8_t UnwindOp : 4;
691 /** Opcode specific. */
692 uint8_t OpInfo : 4;
693 } u;
694 uint16_t FrameOffset;
695} IMAGE_UNWIND_CODE;
696AssertCompileSize(IMAGE_UNWIND_CODE, 2);
697
698/**
699 * Unwind information for AMD64 and ARM64.
700 *
701 * Pointed to by IMAGE_RUNTIME_FUNCTION_ENTRY::UnwindInfoAddress,
702 *
703 * @note Also known as UNWIND_INFO or _UNWIND_INFO.
704 */
705typedef struct IMAGE_UNWIND_INFO
706{
707 /** Version, currently 1. */
708 uint8_t Version : 3;
709 /** IMAGE_UNW_FLAG_XXX */
710 uint8_t Flags : 5;
711 /** Size of function prolog. */
712 uint8_t SizeOfProlog;
713 /** Number of opcodes in aOpcodes. */
714 uint8_t CountOfCodes;
715 /** Initial frame register. */
716 uint8_t FrameRegister : 4;
717 /** Scaled frame register offset. */
718 uint8_t FrameOffset : 4;
719 /** Unwind opcodes. */
720 IMAGE_UNWIND_CODE aOpcodes[RT_FLEXIBLE_ARRAY];
721} IMAGE_UNWIND_INFO;
722AssertCompileMemberOffset(IMAGE_UNWIND_INFO, aOpcodes, 4);
723typedef IMAGE_UNWIND_INFO *PIMAGE_UNWIND_INFO;
724typedef IMAGE_UNWIND_INFO const *PCIMAGE_UNWIND_INFO;
725
726/** IMAGE_UNW_FLAGS_XXX - IMAGE_UNWIND_INFO::Flags.
727 * @{ */
728/** No handler.
729 * @note Aslo know as UNW_FLAG_NHANDLER. */
730#define IMAGE_UNW_FLAGS_NHANDLER 0
731/** Have exception handler (RVA after codes, dword aligned.)
732 * @note Aslo know as UNW_FLAG_NHANDLER. */
733#define IMAGE_UNW_FLAGS_EHANDLER 1
734/** Have unwind handler (RVA after codes, dword aligned.)
735 * @note Aslo know as UNW_FLAG_NHANDLER. */
736#define IMAGE_UNW_FLAGS_UHANDLER 2
737/** Set if not primary unwind info for a function. An
738 * IMAGE_RUNTIME_FUNCTION_ENTRY giving the chained unwind info follows the
739 * aOpcodes array at a dword aligned offset. */
740#define IMAGE_UNW_FLAGS_CHAININFO 4
741/** @} */
742
743/**
744 * AMD64 unwind opcodes.
745 */
746typedef enum IMAGE_AMD64_UNWIND_OP_CODES
747{
748 /** Push non-volatile register (OpInfo).
749 * YASM: [pushreg reg]
750 * MASM: .PUSHREG reg */
751 IMAGE_AMD64_UWOP_PUSH_NONVOL = 0,
752 /** Stack allocation: Size stored in the next two slots (dword).
753 * YASM: [allocstack size]
754 * MASM: .ALLOCSTACK size */
755 IMAGE_AMD64_UWOP_ALLOC_LARGE,
756 /** Stack allocation: OpInfo = size / 8 - 1.
757 * YASM: [allocstack size]
758 * MASM: .ALLOCSTACK size */
759 IMAGE_AMD64_UWOP_ALLOC_SMALL,
760 /** Set frame pointer register: RSP + FrameOffset * 16.
761 * YASM: [setframe reg, offset]
762 * MASM: .SETFRAME reg, offset
763 * @code
764 * LEA RBP, [RSP + 20h]
765 * [setframe RBP, 20h]
766 * @endcode */
767 IMAGE_AMD64_UWOP_SET_FPREG,
768 /** Save non-volatile register (OpInfo) on stack (RSP/FP + next slot).
769 * YASM: [savereg reg, offset]
770 * MASM: .SAVEREG reg, offset */
771 IMAGE_AMD64_UWOP_SAVE_NONVOL,
772 /** Save non-volatile register (OpInfo) on stack (RSP/FP + next two slots).
773 * YASM: [savereg reg, offset]
774 * MASM: .SAVEREG reg, offset */
775 IMAGE_AMD64_UWOP_SAVE_NONVOL_FAR,
776 IMAGE_AMD64_UWOP_RESERVED_6,
777 IMAGE_AMD64_UWOP_RESERVED_7,
778 /** Save 128-bit XMM register (OpInfo) on stack (RSP/FP + next slot).
779 * YASM: [savexmm128 reg, offset]
780 * MASM: .SAVEXMM128 reg, offset */
781 IMAGE_AMD64_UWOP_SAVE_XMM128,
782 /** Save 128-bit XMM register (OpInfo) on stack (RSP/FP + next two slots).
783 * YASM: [savexmm128 reg, offset]
784 * MASM: .SAVEXMM128 reg, offset */
785 IMAGE_AMD64_UWOP_SAVE_XMM128_FAR,
786 /** IRET frame, OpInfo serves as error code indicator.
787 * YASM: [pushframe with-code]
788 * MASM: .pushframe with-code */
789 IMAGE_AMD64_UWOP_PUSH_MACHFRAME
790} IMAGE_AMD64_UNWIND_OP_CODES;
791/** @} */
792
793
794
795/** @name Image load config directories
796 * @{ */
797
798/** @since Windows 10 (preview 9879) */
799typedef struct _IMAGE_LOAD_CONFIG_CODE_INTEGRITY
800{
801 uint16_t Flags;
802 uint16_t Catalog;
803 uint32_t CatalogOffset;
804 uint32_t Reserved;
805} IMAGE_LOAD_CONFIG_CODE_INTEGRITY;
806AssertCompileSize(IMAGE_LOAD_CONFIG_CODE_INTEGRITY, 12);
807typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY *PIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
808typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY const *PCIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
809
810typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V1
811{
812 uint32_t Size;
813 uint32_t TimeDateStamp;
814 uint16_t MajorVersion;
815 uint16_t MinorVersion;
816 uint32_t GlobalFlagsClear;
817 uint32_t GlobalFlagsSet;
818 uint32_t CriticalSectionDefaultTimeout;
819 uint32_t DeCommitFreeBlockThreshold;
820 uint32_t DeCommitTotalFreeThreshold;
821 uint32_t LockPrefixTable;
822 uint32_t MaximumAllocationSize;
823 uint32_t VirtualMemoryThreshold;
824 uint32_t ProcessHeapFlags;
825 uint32_t ProcessAffinityMask;
826 uint16_t CSDVersion;
827 uint16_t DependentLoadFlags;
828 uint32_t EditList;
829 uint32_t SecurityCookie;
830} IMAGE_LOAD_CONFIG_DIRECTORY32_V1;
831AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V1, 0x40);
832typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
833typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
834
835typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V2
836{
837 uint32_t Size;
838 uint32_t TimeDateStamp;
839 uint16_t MajorVersion;
840 uint16_t MinorVersion;
841 uint32_t GlobalFlagsClear;
842 uint32_t GlobalFlagsSet;
843 uint32_t CriticalSectionDefaultTimeout;
844 uint32_t DeCommitFreeBlockThreshold;
845 uint32_t DeCommitTotalFreeThreshold;
846 uint32_t LockPrefixTable;
847 uint32_t MaximumAllocationSize;
848 uint32_t VirtualMemoryThreshold;
849 uint32_t ProcessHeapFlags;
850 uint32_t ProcessAffinityMask;
851 uint16_t CSDVersion;
852 uint16_t DependentLoadFlags;
853 uint32_t EditList;
854 uint32_t SecurityCookie;
855 uint32_t SEHandlerTable;
856 uint32_t SEHandlerCount;
857} IMAGE_LOAD_CONFIG_DIRECTORY32_V2;
858AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V2, 0x48);
859typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
860typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
861
862typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V3
863{
864 uint32_t Size;
865 uint32_t TimeDateStamp;
866 uint16_t MajorVersion;
867 uint16_t MinorVersion;
868 uint32_t GlobalFlagsClear;
869 uint32_t GlobalFlagsSet;
870 uint32_t CriticalSectionDefaultTimeout;
871 uint32_t DeCommitFreeBlockThreshold;
872 uint32_t DeCommitTotalFreeThreshold;
873 uint32_t LockPrefixTable;
874 uint32_t MaximumAllocationSize;
875 uint32_t VirtualMemoryThreshold;
876 uint32_t ProcessHeapFlags;
877 uint32_t ProcessAffinityMask;
878 uint16_t CSDVersion;
879 uint16_t DependentLoadFlags;
880 uint32_t EditList;
881 uint32_t SecurityCookie;
882 uint32_t SEHandlerTable;
883 uint32_t SEHandlerCount;
884 uint32_t GuardCFCCheckFunctionPointer;
885 uint32_t GuardCFDispatchFunctionPointer;
886 uint32_t GuardCFFunctionTable;
887 uint32_t GuardCFFunctionCount;
888 uint32_t GuardFlags;
889} IMAGE_LOAD_CONFIG_DIRECTORY32_V3;
890AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V3, 0x5c);
891typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
892typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
893
894/** @since Windows 10 (preview 9879) */
895typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V4
896{
897 uint32_t Size;
898 uint32_t TimeDateStamp;
899 uint16_t MajorVersion;
900 uint16_t MinorVersion;
901 uint32_t GlobalFlagsClear;
902 uint32_t GlobalFlagsSet;
903 uint32_t CriticalSectionDefaultTimeout;
904 uint32_t DeCommitFreeBlockThreshold;
905 uint32_t DeCommitTotalFreeThreshold;
906 uint32_t LockPrefixTable;
907 uint32_t MaximumAllocationSize;
908 uint32_t VirtualMemoryThreshold;
909 uint32_t ProcessHeapFlags;
910 uint32_t ProcessAffinityMask;
911 uint16_t CSDVersion;
912 uint16_t DependentLoadFlags;
913 uint32_t EditList;
914 uint32_t SecurityCookie;
915 uint32_t SEHandlerTable;
916 uint32_t SEHandlerCount;
917 uint32_t GuardCFCCheckFunctionPointer;
918 uint32_t GuardCFDispatchFunctionPointer;
919 uint32_t GuardCFFunctionTable;
920 uint32_t GuardCFFunctionCount;
921 uint32_t GuardFlags;
922 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
923} IMAGE_LOAD_CONFIG_DIRECTORY32_V4;
924AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V4, 0x68);
925typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
926typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
927
928/** @since Windows 10 build 14286 (or maybe earlier). */
929typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V5
930{
931 uint32_t Size;
932 uint32_t TimeDateStamp;
933 uint16_t MajorVersion;
934 uint16_t MinorVersion;
935 uint32_t GlobalFlagsClear;
936 uint32_t GlobalFlagsSet;
937 uint32_t CriticalSectionDefaultTimeout;
938 uint32_t DeCommitFreeBlockThreshold;
939 uint32_t DeCommitTotalFreeThreshold;
940 uint32_t LockPrefixTable;
941 uint32_t MaximumAllocationSize;
942 uint32_t VirtualMemoryThreshold;
943 uint32_t ProcessHeapFlags;
944 uint32_t ProcessAffinityMask;
945 uint16_t CSDVersion;
946 uint16_t DependentLoadFlags;
947 uint32_t EditList;
948 uint32_t SecurityCookie;
949 uint32_t SEHandlerTable;
950 uint32_t SEHandlerCount;
951 uint32_t GuardCFCCheckFunctionPointer;
952 uint32_t GuardCFDispatchFunctionPointer;
953 uint32_t GuardCFFunctionTable;
954 uint32_t GuardCFFunctionCount;
955 uint32_t GuardFlags;
956 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
957 uint32_t GuardAddressTakenIatEntryTable;
958 uint32_t GuardAddressTakenIatEntryCount;
959 uint32_t GuardLongJumpTargetTable;
960 uint32_t GuardLongJumpTargetCount;
961} IMAGE_LOAD_CONFIG_DIRECTORY32_V5;
962AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V5, 0x78);
963typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V5 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V5;
964typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V5 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V5;
965
966/** @since Windows 10 build 14383 (or maybe earlier). */
967typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V6
968{
969 uint32_t Size; /**< 0x00 */
970 uint32_t TimeDateStamp; /**< 0x04 */
971 uint16_t MajorVersion; /**< 0x08 */
972 uint16_t MinorVersion; /**< 0x0a */
973 uint32_t GlobalFlagsClear; /**< 0x0c */
974 uint32_t GlobalFlagsSet; /**< 0x10 */
975 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
976 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
977 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
978 uint32_t LockPrefixTable; /**< 0x20 */
979 uint32_t MaximumAllocationSize; /**< 0x24 */
980 uint32_t VirtualMemoryThreshold; /**< 0x28 */
981 uint32_t ProcessHeapFlags; /**< 0x2c */
982 uint32_t ProcessAffinityMask; /**< 0x30 */
983 uint16_t CSDVersion; /**< 0x34 */
984 uint16_t DependentLoadFlags; /**< 0x36 */
985 uint32_t EditList; /**< 0x38 */
986 uint32_t SecurityCookie; /**< 0x3c */
987 uint32_t SEHandlerTable; /**< 0x40 */
988 uint32_t SEHandlerCount; /**< 0x44 */
989 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
990 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
991 uint32_t GuardCFFunctionTable; /**< 0x50 */
992 uint32_t GuardCFFunctionCount; /**< 0x54 */
993 uint32_t GuardFlags; /**< 0x58 */
994 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
995 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
996 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
997 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
998 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
999 uint32_t DynamicValueRelocTable; /**< 0x78 */
1000 uint32_t HybridMetadataPointer; /**< 0x7c */
1001} IMAGE_LOAD_CONFIG_DIRECTORY32_V6;
1002AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V6, 0x80);
1003typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V6 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V6;
1004typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V6 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V6;
1005
1006/** @since Windows 10 build 14901 (or maybe earlier). */
1007typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V7
1008{
1009 uint32_t Size; /**< 0x00 */
1010 uint32_t TimeDateStamp; /**< 0x04 */
1011 uint16_t MajorVersion; /**< 0x08 */
1012 uint16_t MinorVersion; /**< 0x0a */
1013 uint32_t GlobalFlagsClear; /**< 0x0c */
1014 uint32_t GlobalFlagsSet; /**< 0x10 */
1015 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1016 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1017 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1018 uint32_t LockPrefixTable; /**< 0x20 */
1019 uint32_t MaximumAllocationSize; /**< 0x24 */
1020 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1021 uint32_t ProcessHeapFlags; /**< 0x2c */
1022 uint32_t ProcessAffinityMask; /**< 0x30 */
1023 uint16_t CSDVersion; /**< 0x34 */
1024 uint16_t DependentLoadFlags; /**< 0x36 */
1025 uint32_t EditList; /**< 0x38 */
1026 uint32_t SecurityCookie; /**< 0x3c */
1027 uint32_t SEHandlerTable; /**< 0x40 */
1028 uint32_t SEHandlerCount; /**< 0x44 */
1029 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1030 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1031 uint32_t GuardCFFunctionTable; /**< 0x50 */
1032 uint32_t GuardCFFunctionCount; /**< 0x54 */
1033 uint32_t GuardFlags; /**< 0x58 */
1034 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1035 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1036 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1037 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1038 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1039 uint32_t DynamicValueRelocTable; /**< 0x78 */
1040 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1041 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1042 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1043 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1044 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1045 uint16_t Reserved2; /**< 0x8e */
1046} IMAGE_LOAD_CONFIG_DIRECTORY32_V7;
1047AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V7, 0x90);
1048typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V7 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V7;
1049typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V7 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V7;
1050
1051/** @since Windows 10 build 15002 (or maybe earlier). */
1052typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V8
1053{
1054 uint32_t Size; /**< 0x00 */
1055 uint32_t TimeDateStamp; /**< 0x04 */
1056 uint16_t MajorVersion; /**< 0x08 */
1057 uint16_t MinorVersion; /**< 0x0a */
1058 uint32_t GlobalFlagsClear; /**< 0x0c */
1059 uint32_t GlobalFlagsSet; /**< 0x10 */
1060 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1061 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1062 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1063 uint32_t LockPrefixTable; /**< 0x20 */
1064 uint32_t MaximumAllocationSize; /**< 0x24 */
1065 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1066 uint32_t ProcessHeapFlags; /**< 0x2c */
1067 uint32_t ProcessAffinityMask; /**< 0x30 */
1068 uint16_t CSDVersion; /**< 0x34 */
1069 uint16_t DependentLoadFlags; /**< 0x36 */
1070 uint32_t EditList; /**< 0x38 */
1071 uint32_t SecurityCookie; /**< 0x3c */
1072 uint32_t SEHandlerTable; /**< 0x40 */
1073 uint32_t SEHandlerCount; /**< 0x44 */
1074 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1075 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1076 uint32_t GuardCFFunctionTable; /**< 0x50 */
1077 uint32_t GuardCFFunctionCount; /**< 0x54 */
1078 uint32_t GuardFlags; /**< 0x58 */
1079 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1080 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1081 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1082 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1083 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1084 uint32_t DynamicValueRelocTable; /**< 0x78 */
1085 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1086 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1087 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1088 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1089 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1090 uint16_t Reserved2; /**< 0x8e */
1091 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1092 uint32_t HotPatchTableOffset; /**< 0x94 */
1093} IMAGE_LOAD_CONFIG_DIRECTORY32_V8;
1094AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V8, 0x98);
1095typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V8 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V8;
1096typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V8 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V8;
1097
1098/** @since Windows 10 build 16237 (or maybe earlier). */
1099typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V9
1100{
1101 uint32_t Size; /**< 0x00 */
1102 uint32_t TimeDateStamp; /**< 0x04 */
1103 uint16_t MajorVersion; /**< 0x08 */
1104 uint16_t MinorVersion; /**< 0x0a */
1105 uint32_t GlobalFlagsClear; /**< 0x0c */
1106 uint32_t GlobalFlagsSet; /**< 0x10 */
1107 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1108 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1109 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1110 uint32_t LockPrefixTable; /**< 0x20 */
1111 uint32_t MaximumAllocationSize; /**< 0x24 */
1112 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1113 uint32_t ProcessHeapFlags; /**< 0x2c */
1114 uint32_t ProcessAffinityMask; /**< 0x30 */
1115 uint16_t CSDVersion; /**< 0x34 */
1116 uint16_t DependentLoadFlags; /**< 0x36 */
1117 uint32_t EditList; /**< 0x38 */
1118 uint32_t SecurityCookie; /**< 0x3c */
1119 uint32_t SEHandlerTable; /**< 0x40 */
1120 uint32_t SEHandlerCount; /**< 0x44 */
1121 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1122 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1123 uint32_t GuardCFFunctionTable; /**< 0x50 */
1124 uint32_t GuardCFFunctionCount; /**< 0x54 */
1125 uint32_t GuardFlags; /**< 0x58 */
1126 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1127 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1128 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1129 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1130 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1131 uint32_t DynamicValueRelocTable; /**< 0x78 */
1132 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1133 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1134 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1135 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1136 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1137 uint16_t Reserved2; /**< 0x8e */
1138 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1139 uint32_t HotPatchTableOffset; /**< 0x94 */
1140 uint32_t AddressOfSomeUnicodeString; /**< 0x98 - 64-bit version has this member about here. not sure about location yet. */
1141 uint32_t Reserved3QuestionMark; /**< 0x9a - Did they 8-byte pad the structure or is AddressOfSomeUnicodeString 64-bit? */
1142} IMAGE_LOAD_CONFIG_DIRECTORY32_V9;
1143AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V9, 0xa0);
1144typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V9 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V9;
1145typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V9 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V9;
1146
1147typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V9 IMAGE_LOAD_CONFIG_DIRECTORY32;
1148typedef PIMAGE_LOAD_CONFIG_DIRECTORY32_V9 PIMAGE_LOAD_CONFIG_DIRECTORY32;
1149typedef PCIMAGE_LOAD_CONFIG_DIRECTORY32_V9 PCIMAGE_LOAD_CONFIG_DIRECTORY32;
1150
1151
1152/* No _IMAGE_LOAD_CONFIG_DIRECTORY64_V1 exists. */
1153
1154typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V2
1155{
1156 uint32_t Size;
1157 uint32_t TimeDateStamp;
1158 uint16_t MajorVersion;
1159 uint16_t MinorVersion;
1160 uint32_t GlobalFlagsClear;
1161 uint32_t GlobalFlagsSet;
1162 uint32_t CriticalSectionDefaultTimeout;
1163 uint64_t DeCommitFreeBlockThreshold;
1164 uint64_t DeCommitTotalFreeThreshold;
1165 uint64_t LockPrefixTable;
1166 uint64_t MaximumAllocationSize;
1167 uint64_t VirtualMemoryThreshold;
1168 uint64_t ProcessAffinityMask;
1169 uint32_t ProcessHeapFlags;
1170 uint16_t CSDVersion;
1171 uint16_t DependentLoadFlags;
1172 uint64_t EditList;
1173 uint64_t SecurityCookie;
1174 uint64_t SEHandlerTable;
1175 uint64_t SEHandlerCount;
1176} IMAGE_LOAD_CONFIG_DIRECTORY64_V2;
1177AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V2, 0x70);
1178typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
1179typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
1180
1181#pragma pack(4) /* Why not 8 byte alignment, baka microsofties?!? */
1182typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V3
1183{
1184 uint32_t Size;
1185 uint32_t TimeDateStamp;
1186 uint16_t MajorVersion;
1187 uint16_t MinorVersion;
1188 uint32_t GlobalFlagsClear;
1189 uint32_t GlobalFlagsSet;
1190 uint32_t CriticalSectionDefaultTimeout;
1191 uint64_t DeCommitFreeBlockThreshold;
1192 uint64_t DeCommitTotalFreeThreshold;
1193 uint64_t LockPrefixTable;
1194 uint64_t MaximumAllocationSize;
1195 uint64_t VirtualMemoryThreshold;
1196 uint64_t ProcessAffinityMask;
1197 uint32_t ProcessHeapFlags;
1198 uint16_t CSDVersion;
1199 uint16_t DependentLoadFlags;
1200 uint64_t EditList;
1201 uint64_t SecurityCookie;
1202 uint64_t SEHandlerTable;
1203 uint64_t SEHandlerCount;
1204 uint64_t GuardCFCCheckFunctionPointer;
1205 uint64_t GuardCFDispatchFunctionPointer;
1206 uint64_t GuardCFFunctionTable;
1207 uint64_t GuardCFFunctionCount;
1208 uint32_t GuardFlags;
1209} IMAGE_LOAD_CONFIG_DIRECTORY64_V3;
1210#pragma pack()
1211AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V3, 0x94);
1212typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
1213typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
1214
1215/** @since Windows 10 (Preview (9879). */
1216typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V4
1217{
1218 uint32_t Size; /**< 0x00 */
1219 uint32_t TimeDateStamp; /**< 0x04 */
1220 uint16_t MajorVersion; /**< 0x08 */
1221 uint16_t MinorVersion; /**< 0x0a */
1222 uint32_t GlobalFlagsClear; /**< 0x0c */
1223 uint32_t GlobalFlagsSet; /**< 0x10 */
1224 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1225 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1226 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1227 uint64_t LockPrefixTable; /**< 0x28 */
1228 uint64_t MaximumAllocationSize; /**< 0x30 */
1229 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1230 uint64_t ProcessAffinityMask; /**< 0x40 */
1231 uint32_t ProcessHeapFlags; /**< 0x48 */
1232 uint16_t CSDVersion; /**< 0x4c */
1233 uint16_t DependentLoadFlags; /**< 0x4e */
1234 uint64_t EditList; /**< 0x50 */
1235 uint64_t SecurityCookie; /**< 0x58 */
1236 uint64_t SEHandlerTable; /**< 0x60 */
1237 uint64_t SEHandlerCount; /**< 0x68 */
1238 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1239 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1240 uint64_t GuardCFFunctionTable; /**< 0x80 */
1241 uint64_t GuardCFFunctionCount; /**< 0x88 */
1242 uint32_t GuardFlags; /**< 0x90 */
1243 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1244} IMAGE_LOAD_CONFIG_DIRECTORY64_V4;
1245AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V4, 0xa0);
1246typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
1247typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
1248
1249/** @since Windows 10 build 14286 (or maybe earlier). */
1250typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V5
1251{
1252 uint32_t Size; /**< 0x00 */
1253 uint32_t TimeDateStamp; /**< 0x04 */
1254 uint16_t MajorVersion; /**< 0x08 */
1255 uint16_t MinorVersion; /**< 0x0a */
1256 uint32_t GlobalFlagsClear; /**< 0x0c */
1257 uint32_t GlobalFlagsSet; /**< 0x10 */
1258 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1259 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1260 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1261 uint64_t LockPrefixTable; /**< 0x28 */
1262 uint64_t MaximumAllocationSize; /**< 0x30 */
1263 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1264 uint64_t ProcessAffinityMask; /**< 0x40 */
1265 uint32_t ProcessHeapFlags; /**< 0x48 */
1266 uint16_t CSDVersion; /**< 0x4c */
1267 uint16_t DependentLoadFlags; /**< 0x4e */
1268 uint64_t EditList; /**< 0x50 */
1269 uint64_t SecurityCookie; /**< 0x58 */
1270 uint64_t SEHandlerTable; /**< 0x60 */
1271 uint64_t SEHandlerCount; /**< 0x68 */
1272 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1273 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1274 uint64_t GuardCFFunctionTable; /**< 0x80 */
1275 uint64_t GuardCFFunctionCount; /**< 0x88 */
1276 uint32_t GuardFlags; /**< 0x90 */
1277 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1278 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1279 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1280 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1281 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1282} IMAGE_LOAD_CONFIG_DIRECTORY64_V5;
1283AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V5, 0xc0);
1284typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V5 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V5;
1285typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V5 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V5;
1286
1287/** @since Windows 10 build 14393 (or maybe earlier). */
1288typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V6
1289{
1290 uint32_t Size; /**< 0x00 */
1291 uint32_t TimeDateStamp; /**< 0x04 */
1292 uint16_t MajorVersion; /**< 0x08 */
1293 uint16_t MinorVersion; /**< 0x0a */
1294 uint32_t GlobalFlagsClear; /**< 0x0c */
1295 uint32_t GlobalFlagsSet; /**< 0x10 */
1296 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1297 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1298 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1299 uint64_t LockPrefixTable; /**< 0x28 */
1300 uint64_t MaximumAllocationSize; /**< 0x30 */
1301 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1302 uint64_t ProcessAffinityMask; /**< 0x40 */
1303 uint32_t ProcessHeapFlags; /**< 0x48 */
1304 uint16_t CSDVersion; /**< 0x4c */
1305 uint16_t DependentLoadFlags; /**< 0x4e */
1306 uint64_t EditList; /**< 0x50 */
1307 uint64_t SecurityCookie; /**< 0x58 */
1308 uint64_t SEHandlerTable; /**< 0x60 */
1309 uint64_t SEHandlerCount; /**< 0x68 */
1310 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1311 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1312 uint64_t GuardCFFunctionTable; /**< 0x80 */
1313 uint64_t GuardCFFunctionCount; /**< 0x88 */
1314 uint32_t GuardFlags; /**< 0x90 */
1315 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1316 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1317 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1318 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1319 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1320 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1321 uint64_t HybridMetadataPointer; /**< 0xc8 */
1322} IMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1323AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V6, 0xd0);
1324typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V6 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1325typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V6 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1326
1327/** @since Windows 10 build 14901 (or maybe earlier). */
1328typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V7
1329{
1330 uint32_t Size; /**< 0x00 */
1331 uint32_t TimeDateStamp; /**< 0x04 */
1332 uint16_t MajorVersion; /**< 0x08 */
1333 uint16_t MinorVersion; /**< 0x0a */
1334 uint32_t GlobalFlagsClear; /**< 0x0c */
1335 uint32_t GlobalFlagsSet; /**< 0x10 */
1336 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1337 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1338 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1339 uint64_t LockPrefixTable; /**< 0x28 */
1340 uint64_t MaximumAllocationSize; /**< 0x30 */
1341 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1342 uint64_t ProcessAffinityMask; /**< 0x40 */
1343 uint32_t ProcessHeapFlags; /**< 0x48 */
1344 uint16_t CSDVersion; /**< 0x4c */
1345 uint16_t DependentLoadFlags; /**< 0x4e */
1346 uint64_t EditList; /**< 0x50 */
1347 uint64_t SecurityCookie; /**< 0x58 */
1348 uint64_t SEHandlerTable; /**< 0x60 */
1349 uint64_t SEHandlerCount; /**< 0x68 */
1350 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1351 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1352 uint64_t GuardCFFunctionTable; /**< 0x80 */
1353 uint64_t GuardCFFunctionCount; /**< 0x88 */
1354 uint32_t GuardFlags; /**< 0x90 */
1355 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1356 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1357 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1358 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1359 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1360 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1361 uint64_t CHPEMetadataPointer; /**< 0xc8 Not sure when this was renamed from HybridMetadataPointer. */
1362 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1363 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1364 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1365 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1366 uint16_t Reserved2; /**< 0xe6 */
1367} IMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1368AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V7, 0xe8);
1369typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V7 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1370typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V7 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1371
1372/** @since Windows 10 build 15002 (or maybe earlier). */
1373#pragma pack(4) /* Stupid, stupid microsofties! */
1374typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V8
1375{
1376 uint32_t Size; /**< 0x00 */
1377 uint32_t TimeDateStamp; /**< 0x04 */
1378 uint16_t MajorVersion; /**< 0x08 */
1379 uint16_t MinorVersion; /**< 0x0a */
1380 uint32_t GlobalFlagsClear; /**< 0x0c */
1381 uint32_t GlobalFlagsSet; /**< 0x10 */
1382 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1383 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1384 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1385 uint64_t LockPrefixTable; /**< 0x28 */
1386 uint64_t MaximumAllocationSize; /**< 0x30 */
1387 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1388 uint64_t ProcessAffinityMask; /**< 0x40 */
1389 uint32_t ProcessHeapFlags; /**< 0x48 */
1390 uint16_t CSDVersion; /**< 0x4c */
1391 uint16_t DependentLoadFlags; /**< 0x4e */
1392 uint64_t EditList; /**< 0x50 */
1393 uint64_t SecurityCookie; /**< 0x58 */
1394 uint64_t SEHandlerTable; /**< 0x60 */
1395 uint64_t SEHandlerCount; /**< 0x68 */
1396 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1397 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1398 uint64_t GuardCFFunctionTable; /**< 0x80 */
1399 uint64_t GuardCFFunctionCount; /**< 0x88 */
1400 uint32_t GuardFlags; /**< 0x90 */
1401 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1402 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1403 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1404 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1405 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1406 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1407 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1408 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1409 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1410 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1411 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1412 uint16_t Reserved2; /**< 0xe6 */
1413 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1414 uint32_t HotPatchTableOffset; /**< 0xf0 */
1415} IMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1416#pragma pack()
1417AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V8, 0xf4);
1418typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V8 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1419typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V8 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1420
1421/** @since Windows 10 build 15002 (or maybe earlier). */
1422typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V9
1423{
1424 uint32_t Size; /**< 0x00 */
1425 uint32_t TimeDateStamp; /**< 0x04 */
1426 uint16_t MajorVersion; /**< 0x08 */
1427 uint16_t MinorVersion; /**< 0x0a */
1428 uint32_t GlobalFlagsClear; /**< 0x0c */
1429 uint32_t GlobalFlagsSet; /**< 0x10 */
1430 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1431 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1432 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1433 uint64_t LockPrefixTable; /**< 0x28 */
1434 uint64_t MaximumAllocationSize; /**< 0x30 */
1435 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1436 uint64_t ProcessAffinityMask; /**< 0x40 */
1437 uint32_t ProcessHeapFlags; /**< 0x48 */
1438 uint16_t CSDVersion; /**< 0x4c */
1439 uint16_t DependentLoadFlags; /**< 0x4e */
1440 uint64_t EditList; /**< 0x50 */
1441 uint64_t SecurityCookie; /**< 0x58 */
1442 uint64_t SEHandlerTable; /**< 0x60 */
1443 uint64_t SEHandlerCount; /**< 0x68 */
1444 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1445 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1446 uint64_t GuardCFFunctionTable; /**< 0x80 */
1447 uint64_t GuardCFFunctionCount; /**< 0x88 */
1448 uint32_t GuardFlags; /**< 0x90 */
1449 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1450 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1451 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1452 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1453 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1454 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1455 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1456 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1457 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1458 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1459 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1460 uint16_t Reserved2; /**< 0xe6 */
1461 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1462 uint32_t HotPatchTableOffset; /**< 0xf0 */
1463 uint32_t Reserved3; /**< 0xf4 */
1464 uint64_t AddressOfSomeUnicodeString; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
1465} IMAGE_LOAD_CONFIG_DIRECTORY64_V9;
1466AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V9, 0x100);
1467typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V9 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V9;
1468typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V9 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V9;
1469
1470typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V9 IMAGE_LOAD_CONFIG_DIRECTORY64;
1471typedef PIMAGE_LOAD_CONFIG_DIRECTORY64_V9 PIMAGE_LOAD_CONFIG_DIRECTORY64;
1472typedef PCIMAGE_LOAD_CONFIG_DIRECTORY64_V9 PCIMAGE_LOAD_CONFIG_DIRECTORY64;
1473
1474/** @} */
1475
1476
1477/**
1478 * PE certificate directory.
1479 *
1480 * Found in IMAGE_DIRECTORY_ENTRY_SECURITY.
1481 */
1482typedef struct WIN_CERTIFICATE
1483{
1484 uint32_t dwLength;
1485 uint16_t wRevision;
1486 uint16_t wCertificateType;
1487 uint8_t bCertificate[8];
1488} WIN_CERTIFICATE;
1489AssertCompileSize(WIN_CERTIFICATE, 16);
1490typedef WIN_CERTIFICATE *PWIN_CERTIFICATE;
1491typedef WIN_CERTIFICATE const *PCWIN_CERTIFICATE;
1492
1493/** @name WIN_CERT_REVISION_XXX - Certificate data directory revision.
1494 * Used WIN_CERTIFICATE::wRevision found in the
1495 * IMAGE_DIRECTORY_ENTRY_SECURITY data directory. */
1496#define WIN_CERT_REVISION_1_0 UINT16_C(0x0100)
1497#define WIN_CERT_REVISION_2_0 UINT16_C(0x0200)
1498/** @} */
1499
1500/** @name WIN_CERT_TYPE_XXX - Signature type.
1501 * Used by WIN_CERTIFICATE::wCertificateType.
1502 * @{ */
1503#define WIN_CERT_TYPE_X509 UINT16_C(1)
1504#define WIN_CERT_TYPE_PKCS_SIGNED_DATA UINT16_C(2)
1505#define WIN_CERT_TYPE_RESERVED_1 UINT16_C(3)
1506#define WIN_CERT_TYPE_TS_STACK_SIGNED UINT16_C(4)
1507#define WIN_CERT_TYPE_EFI_PKCS115 UINT16_C(0x0ef0)
1508#define WIN_CERT_TYPE_EFI_GUID UINT16_C(0x0ef1)
1509/** @} */
1510
1511/** The alignment of the certificate table.
1512 * @remarks Found thru signtool experiments. */
1513#define WIN_CERTIFICATE_ALIGNMENT UINT32_C(8)
1514
1515
1516/**
1517 * Debug directory.
1518 *
1519 * Found in IMAGE_DIRECTORY_ENTRY_DEBUG.
1520 */
1521typedef struct _IMAGE_DEBUG_DIRECTORY
1522{
1523 uint32_t Characteristics;
1524 uint32_t TimeDateStamp;
1525 uint16_t MajorVersion;
1526 uint16_t MinorVersion;
1527 uint32_t Type;
1528 uint32_t SizeOfData;
1529 uint32_t AddressOfRawData;
1530 uint32_t PointerToRawData;
1531} IMAGE_DEBUG_DIRECTORY;
1532AssertCompileSize(IMAGE_DEBUG_DIRECTORY, 28);
1533typedef IMAGE_DEBUG_DIRECTORY *PIMAGE_DEBUG_DIRECTORY;
1534typedef IMAGE_DEBUG_DIRECTORY const *PCIMAGE_DEBUG_DIRECTORY;
1535
1536/** @name IMAGE_DEBUG_TYPE_XXX - Debug format types.
1537 * Used by IMAGE_DEBUG_DIRECTORY::Type.
1538 * @{ */
1539#define IMAGE_DEBUG_TYPE_UNKNOWN UINT32_C(0x00)
1540#define IMAGE_DEBUG_TYPE_COFF UINT32_C(0x01)
1541#define IMAGE_DEBUG_TYPE_CODEVIEW UINT32_C(0x02)
1542#define IMAGE_DEBUG_TYPE_FPO UINT32_C(0x03)
1543#define IMAGE_DEBUG_TYPE_MISC UINT32_C(0x04)
1544#define IMAGE_DEBUG_TYPE_EXCEPTION UINT32_C(0x05)
1545#define IMAGE_DEBUG_TYPE_FIXUP UINT32_C(0x06)
1546#define IMAGE_DEBUG_TYPE_OMAP_TO_SRC UINT32_C(0x07)
1547#define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC UINT32_C(0x08)
1548#define IMAGE_DEBUG_TYPE_BORLAND UINT32_C(0x09)
1549#define IMAGE_DEBUG_TYPE_RESERVED10 UINT32_C(0x0a)
1550#define IMAGE_DEBUG_TYPE_CLSID UINT32_C(0x0b)
1551#define IMAGE_DEBUG_TYPE_VC_FEATURE UINT32_C(0x0c)
1552#define IMAGE_DEBUG_TYPE_POGO UINT32_C(0x0d)
1553#define IMAGE_DEBUG_TYPE_ILTCG UINT32_C(0x0e)
1554#define IMAGE_DEBUG_TYPE_MPX UINT32_C(0x0f)
1555#define IMAGE_DEBUG_TYPE_REPRO UINT32_C(0x10)
1556/** @} */
1557
1558/** @name IMAGE_DEBUG_MISC_XXX - Misc debug data type.
1559 * Used by IMAGE_DEBUG_MISC::DataType.
1560 * @{ */
1561#define IMAGE_DEBUG_MISC_EXENAME UINT32_C(1)
1562/** @} */
1563
1564
1565/**
1566 * The format of IMAGE_DEBUG_TYPE_MISC debug info.
1567 */
1568typedef struct _IMAGE_DEBUG_MISC
1569{
1570 uint32_t DataType;
1571 uint32_t Length;
1572 uint8_t Unicode;
1573 uint8_t Reserved[3];
1574 uint8_t Data[1];
1575} IMAGE_DEBUG_MISC;
1576AssertCompileSize(IMAGE_DEBUG_MISC, 16);
1577typedef IMAGE_DEBUG_MISC *PIMAGE_DEBUG_MISC;
1578typedef IMAGE_DEBUG_MISC const *PCIMAGE_DEBUG_MISC;
1579
1580
1581
1582/**
1583 * The header of a .DBG file (NT4).
1584 */
1585typedef struct _IMAGE_SEPARATE_DEBUG_HEADER
1586{
1587 uint16_t Signature; /**< 0x00 */
1588 uint16_t Flags; /**< 0x02 */
1589 uint16_t Machine; /**< 0x04 */
1590 uint16_t Characteristics; /**< 0x06 */
1591 uint32_t TimeDateStamp; /**< 0x08 */
1592 uint32_t CheckSum; /**< 0x0c */
1593 uint32_t ImageBase; /**< 0x10 */
1594 uint32_t SizeOfImage; /**< 0x14 */
1595 uint32_t NumberOfSections; /**< 0x18 */
1596 uint32_t ExportedNamesSize; /**< 0x1c */
1597 uint32_t DebugDirectorySize; /**< 0x20 */
1598 uint32_t SectionAlignment; /**< 0x24 */
1599 uint32_t Reserved[2]; /**< 0x28 */
1600} IMAGE_SEPARATE_DEBUG_HEADER; /* size: 0x30 */
1601AssertCompileSize(IMAGE_SEPARATE_DEBUG_HEADER, 0x30);
1602typedef IMAGE_SEPARATE_DEBUG_HEADER *PIMAGE_SEPARATE_DEBUG_HEADER;
1603typedef IMAGE_SEPARATE_DEBUG_HEADER const *PCIMAGE_SEPARATE_DEBUG_HEADER;
1604
1605/** The signature of a IMAGE_SEPARATE_DEBUG_HEADER. */
1606#define IMAGE_SEPARATE_DEBUG_SIGNATURE UINT16_C(0x4944)
1607
1608
1609/**
1610 * The format of IMAGE_DEBUG_TYPE_COFF debug info.
1611 */
1612typedef struct _IMAGE_COFF_SYMBOLS_HEADER
1613{
1614 uint32_t NumberOfSymbols;
1615 uint32_t LvaToFirstSymbol;
1616 uint32_t NumberOfLinenumbers;
1617 uint32_t LvaToFirstLinenumber;
1618 uint32_t RvaToFirstByteOfCode;
1619 uint32_t RvaToLastByteOfCode;
1620 uint32_t RvaToFirstByteOfData;
1621 uint32_t RvaToLastByteOfData;
1622} IMAGE_COFF_SYMBOLS_HEADER;
1623AssertCompileSize(IMAGE_COFF_SYMBOLS_HEADER, 0x20);
1624typedef IMAGE_COFF_SYMBOLS_HEADER *PIMAGE_COFF_SYMBOLS_HEADER;
1625typedef IMAGE_COFF_SYMBOLS_HEADER const *PCIMAGE_COFF_SYMBOLS_HEADER;
1626
1627
1628/**
1629 * Line number format of IMAGE_DEBUG_TYPE_COFF debug info.
1630 *
1631 * @remarks This has misaligned members.
1632 */
1633#pragma pack(2)
1634typedef struct _IMAGE_LINENUMBER
1635{
1636 union
1637 {
1638 uint32_t VirtualAddress;
1639 uint32_t SymbolTableIndex;
1640 } Type;
1641 uint16_t Linenumber;
1642} IMAGE_LINENUMBER;
1643#pragma pack()
1644AssertCompileSize(IMAGE_LINENUMBER, 6);
1645typedef IMAGE_LINENUMBER *PIMAGE_LINENUMBER;
1646typedef IMAGE_LINENUMBER const *PCIMAGE_LINENUMBER;
1647
1648
1649/** The size of a IMAGE_SYMBOL & IMAGE_AUX_SYMBOL structure. */
1650#define IMAGE_SIZE_OF_SYMBOL 18
1651/** The size of a IMAGE_SYMBOL_EX & IMAGE_AUX_SYMBOL_EX structure. */
1652#define IMAGE_SIZE_OF_SYMBOL_EX 20
1653
1654/**
1655 * COFF symbol.
1656 */
1657#pragma pack(2)
1658typedef struct _IMAGE_SYMBOL
1659{
1660 union
1661 {
1662 uint8_t ShortName[8];
1663 struct
1664 {
1665 uint32_t Short;
1666 uint32_t Long;
1667 } Name;
1668 uint32_t LongName[2];
1669 } N;
1670
1671 uint32_t Value;
1672 int16_t SectionNumber;
1673 uint16_t Type;
1674 uint8_t StorageClass;
1675 uint8_t NumberOfAuxSymbols;
1676} IMAGE_SYMBOL;
1677#pragma pack()
1678AssertCompileSize(IMAGE_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
1679typedef IMAGE_SYMBOL *PIMAGE_SYMBOL;
1680typedef IMAGE_SYMBOL const *PCIMAGE_SYMBOL;
1681
1682/**
1683 * COFF auxiliary symbol token defintion (whatever that is).
1684 */
1685#pragma pack(2)
1686typedef struct IMAGE_AUX_SYMBOL_TOKEN_DEF
1687{
1688 uint8_t bAuxType;
1689 uint8_t bReserved;
1690 uint32_t SymbolTableIndex;
1691 uint8_t rgbReserved[12];
1692} IMAGE_AUX_SYMBOL_TOKEN_DEF;
1693#pragma pack()
1694AssertCompileSize(IMAGE_AUX_SYMBOL_TOKEN_DEF, IMAGE_SIZE_OF_SYMBOL);
1695typedef IMAGE_AUX_SYMBOL_TOKEN_DEF *PIMAGE_AUX_SYMBOL_TOKEN_DEF;
1696typedef IMAGE_AUX_SYMBOL_TOKEN_DEF const *PCIMAGE_AUX_SYMBOL_TOKEN_DEF;
1697
1698/**
1699 * COFF auxiliary symbol.
1700 */
1701#pragma pack(1)
1702typedef union _IMAGE_AUX_SYMBOL
1703{
1704 struct
1705 {
1706 uint32_t TagIndex;
1707 union
1708 {
1709 struct
1710 {
1711 uint16_t Linenumber;
1712 uint16_t Size;
1713 } LnSz;
1714 } Misc;
1715 union
1716 {
1717 struct
1718 {
1719 uint32_t PointerToLinenumber;
1720 uint32_t PointerToNextFunction;
1721 } Function;
1722 struct
1723 {
1724 uint16_t Dimension[4];
1725 } Array;
1726 } FcnAry;
1727 uint16_t TvIndex;
1728 } Sym;
1729
1730 struct
1731 {
1732 uint8_t Name[IMAGE_SIZE_OF_SYMBOL];
1733 } File;
1734
1735 struct
1736 {
1737 uint32_t Length;
1738 uint16_t NumberOfRelocations;
1739 uint16_t NumberOfLinenumbers;
1740 uint32_t CheckSum;
1741 uint16_t Number;
1742 uint8_t Selection;
1743 uint8_t bReserved;
1744 uint16_t HighNumber;
1745 } Section;
1746
1747 IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
1748 struct
1749 {
1750 uint32_t crc;
1751 uint8_t rgbReserved[14];
1752 } CRC;
1753} IMAGE_AUX_SYMBOL;
1754#pragma pack()
1755AssertCompileSize(IMAGE_AUX_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
1756typedef IMAGE_AUX_SYMBOL *PIMAGE_AUX_SYMBOL;
1757typedef IMAGE_AUX_SYMBOL const *PCIMAGE_AUX_SYMBOL;
1758
1759
1760/**
1761 * Extended COFF symbol.
1762 */
1763typedef struct _IMAGE_SYMBOL_EX
1764{
1765 union
1766 {
1767 uint8_t ShortName[8];
1768 struct
1769 {
1770 uint32_t Short;
1771 uint32_t Long;
1772 } Name;
1773 uint32_t LongName[2];
1774 } N;
1775
1776 uint32_t Value;
1777 int32_t SectionNumber; /* The difference from IMAGE_SYMBOL */
1778 uint16_t Type;
1779 uint8_t StorageClass;
1780 uint8_t NumberOfAuxSymbols;
1781} IMAGE_SYMBOL_EX;
1782AssertCompileSize(IMAGE_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
1783typedef IMAGE_SYMBOL_EX *PIMAGE_SYMBOL_EX;
1784typedef IMAGE_SYMBOL_EX const *PCIMAGE_SYMBOL_EX;
1785
1786/**
1787 * Extended COFF auxiliary symbol.
1788 */
1789typedef union _IMAGE_AUX_SYMBOL_EX
1790{
1791 struct
1792 {
1793 uint32_t WeakDefaultSymIndex;
1794 uint32_t WeakSearchType;
1795 uint8_t rgbReserved[12];
1796 } Sym;
1797
1798 struct
1799 {
1800 uint8_t Name[IMAGE_SIZE_OF_SYMBOL_EX];
1801 } File;
1802
1803 struct
1804 {
1805 uint32_t Length;
1806 uint16_t NumberOfRelocations;
1807 uint16_t NumberOfLinenumbers;
1808 uint32_t CheckSum;
1809 uint16_t Number;
1810 uint8_t Selection;
1811 uint8_t bReserved;
1812 uint16_t HighNumber;
1813 uint8_t rgbReserved[2];
1814 } Section;
1815
1816 IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
1817
1818 struct
1819 {
1820 uint32_t crc;
1821 uint8_t rgbReserved[16];
1822 } CRC;
1823} IMAGE_AUX_SYMBOL_EX;
1824AssertCompileSize(IMAGE_AUX_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
1825typedef IMAGE_AUX_SYMBOL_EX *PIMAGE_AUX_SYMBOL_EX;
1826typedef IMAGE_AUX_SYMBOL_EX const *PCIMAGE_AUX_SYMBOL_EX;
1827
1828/** @name Special COFF section numbers.
1829 * Used by IMAGE_SYMBOL::SectionNumber and IMAGE_SYMBOL_EX::SectionNumber
1830 * @{ */
1831#define IMAGE_SYM_UNDEFINED INT16_C(0)
1832#define IMAGE_SYM_ABSOLUTE INT16_C(-1)
1833#define IMAGE_SYM_DEBUG INT16_C(-2)
1834/** @} */
1835
1836/** @name IMAGE_SYM_CLASS_XXX - COFF symbol storage classes.
1837 * @{ */
1838#define IMAGE_SYM_CLASS_END_OF_FUNCTION UINT8_C(0xff) /* -1 */
1839#define IMAGE_SYM_CLASS_NULL UINT8_C(0)
1840#define IMAGE_SYM_CLASS_AUTOMATIC UINT8_C(1)
1841#define IMAGE_SYM_CLASS_EXTERNAL UINT8_C(2)
1842#define IMAGE_SYM_CLASS_STATIC UINT8_C(3)
1843#define IMAGE_SYM_CLASS_REGISTER UINT8_C(4)
1844#define IMAGE_SYM_CLASS_EXTERNAL_DEF UINT8_C(5)
1845#define IMAGE_SYM_CLASS_LABEL UINT8_C(6)
1846#define IMAGE_SYM_CLASS_UNDEFINED_LABEL UINT8_C(7)
1847#define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT UINT8_C(8)
1848#define IMAGE_SYM_CLASS_ARGUMENT UINT8_C(9)
1849#define IMAGE_SYM_CLASS_STRUCT_TAG UINT8_C(10)
1850#define IMAGE_SYM_CLASS_MEMBER_OF_UNION UINT8_C(11)
1851#define IMAGE_SYM_CLASS_UNION_TAG UINT8_C(12)
1852#define IMAGE_SYM_CLASS_TYPE_DEFINITION UINT8_C(13)
1853#define IMAGE_SYM_CLASS_UNDEFINED_STATIC UINT8_C(14)
1854#define IMAGE_SYM_CLASS_ENUM_TAG UINT8_C(15)
1855#define IMAGE_SYM_CLASS_MEMBER_OF_ENUM UINT8_C(16)
1856#define IMAGE_SYM_CLASS_REGISTER_PARAM UINT8_C(17)
1857#define IMAGE_SYM_CLASS_BIT_FIELD UINT8_C(18)
1858#define IMAGE_SYM_CLASS_FAR_EXTERNAL UINT8_C(68)
1859#define IMAGE_SYM_CLASS_BLOCK UINT8_C(100)
1860#define IMAGE_SYM_CLASS_FUNCTION UINT8_C(101)
1861#define IMAGE_SYM_CLASS_END_OF_STRUCT UINT8_C(102)
1862#define IMAGE_SYM_CLASS_FILE UINT8_C(103)
1863#define IMAGE_SYM_CLASS_SECTION UINT8_C(104)
1864#define IMAGE_SYM_CLASS_WEAK_EXTERNAL UINT8_C(105)
1865#define IMAGE_SYM_CLASS_CLR_TOKEN UINT8_C(107)
1866/** @} */
1867
1868/** @name IMAGE_SYM_TYPE_XXX - COFF symbol base types
1869 * @{ */
1870#define IMAGE_SYM_TYPE_NULL UINT16_C(0x0000)
1871#define IMAGE_SYM_TYPE_VOID UINT16_C(0x0001)
1872#define IMAGE_SYM_TYPE_CHAR UINT16_C(0x0002)
1873#define IMAGE_SYM_TYPE_SHORT UINT16_C(0x0003)
1874#define IMAGE_SYM_TYPE_INT UINT16_C(0x0004)
1875#define IMAGE_SYM_TYPE_LONG UINT16_C(0x0005)
1876#define IMAGE_SYM_TYPE_FLOAT UINT16_C(0x0006)
1877#define IMAGE_SYM_TYPE_DOUBLE UINT16_C(0x0007)
1878#define IMAGE_SYM_TYPE_STRUCT UINT16_C(0x0008)
1879#define IMAGE_SYM_TYPE_UNION UINT16_C(0x0009)
1880#define IMAGE_SYM_TYPE_ENUM UINT16_C(0x000a)
1881#define IMAGE_SYM_TYPE_MOE UINT16_C(0x000b)
1882#define IMAGE_SYM_TYPE_BYTE UINT16_C(0x000c)
1883#define IMAGE_SYM_TYPE_WORD UINT16_C(0x000d)
1884#define IMAGE_SYM_TYPE_UINT UINT16_C(0x000e)
1885#define IMAGE_SYM_TYPE_DWORD UINT16_C(0x000f)
1886#define IMAGE_SYM_TYPE_PCODE UINT16_C(0x8000)
1887/** @} */
1888
1889/** @name IMAGE_SYM_DTYPE_XXX - COFF symbol complex types
1890 * @{ */
1891#define IMAGE_SYM_DTYPE_NULL UINT16_C(0x0)
1892#define IMAGE_SYM_DTYPE_POINTER UINT16_C(0x1)
1893#define IMAGE_SYM_DTYPE_FUNCTION UINT16_C(0x2)
1894#define IMAGE_SYM_DTYPE_ARRAY UINT16_C(0x3)
1895/** @} */
1896
1897/** @name COFF Symbol type masks and shift counts.
1898 * @{ */
1899#define N_BTMASK UINT16_C(0x000f)
1900#define N_TMASK UINT16_C(0x0030)
1901#define N_TMASK1 UINT16_C(0x00c0)
1902#define N_TMASK2 UINT16_C(0x00f0)
1903#define N_BTSHFT 4
1904#define N_TSHIFT 2
1905/** @} */
1906
1907/** @name COFF Symbol type macros.
1908 * @{ */
1909#define BTYPE(a_Type) ( (a_Type) & N_BTMASK )
1910#define ISPTR(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_POINTER << N_BTSHFT) )
1911#define ISFCN(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_FUNCTION << N_BTSHFT) )
1912#define ISARY(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_ARRAY << N_BTSHFT) )
1913#define ISTAG(a_StorageClass) ( (a_StorageClass) == IMAGE_SYM_CLASS_STRUCT_TAG \
1914 || (a_StorageClass) == IMAGE_SYM_CLASS_UNION_TAG \
1915 || (a_StorageClass) == IMAGE_SYM_CLASS_ENUM_TAG )
1916/** @} */
1917
1918
1919/**
1920 * COFF relocation table entry.
1921 *
1922 * @note The size of the structure is not a multiple of the largest member
1923 * (uint32_t), so odd relocation table entry members will have
1924 * misaligned uint32_t members.
1925 */
1926#pragma pack(1)
1927typedef struct _IMAGE_RELOCATION
1928{
1929 union
1930 {
1931 uint32_t VirtualAddress;
1932 uint32_t RelocCount;
1933 } u;
1934 uint32_t SymbolTableIndex;
1935 uint16_t Type;
1936} IMAGE_RELOCATION;
1937#pragma pack()
1938/** The size of a COFF relocation entry. */
1939#define IMAGE_SIZEOF_RELOCATION 10
1940AssertCompileSize(IMAGE_RELOCATION, IMAGE_SIZEOF_RELOCATION);
1941typedef IMAGE_RELOCATION *PIMAGE_RELOCATION;
1942typedef IMAGE_RELOCATION const *PCIMAGE_RELOCATION;
1943
1944
1945/** @name IMAGE_REL_AMD64_XXX - COFF relocations for AMD64 CPUs.
1946 * Used by IMAGE_RELOCATION::Type.
1947 * @{ */
1948#define IMAGE_REL_AMD64_ABSOLUTE UINT16_C(0x0000)
1949#define IMAGE_REL_AMD64_ADDR64 UINT16_C(0x0001)
1950#define IMAGE_REL_AMD64_ADDR32 UINT16_C(0x0002)
1951#define IMAGE_REL_AMD64_ADDR32NB UINT16_C(0x0003)
1952#define IMAGE_REL_AMD64_REL32 UINT16_C(0x0004)
1953#define IMAGE_REL_AMD64_REL32_1 UINT16_C(0x0005)
1954#define IMAGE_REL_AMD64_REL32_2 UINT16_C(0x0006)
1955#define IMAGE_REL_AMD64_REL32_3 UINT16_C(0x0007)
1956#define IMAGE_REL_AMD64_REL32_4 UINT16_C(0x0008)
1957#define IMAGE_REL_AMD64_REL32_5 UINT16_C(0x0009)
1958#define IMAGE_REL_AMD64_SECTION UINT16_C(0x000a)
1959#define IMAGE_REL_AMD64_SECREL UINT16_C(0x000b)
1960#define IMAGE_REL_AMD64_SECREL7 UINT16_C(0x000c)
1961#define IMAGE_REL_AMD64_TOKEN UINT16_C(0x000d)
1962#define IMAGE_REL_AMD64_SREL32 UINT16_C(0x000e)
1963#define IMAGE_REL_AMD64_PAIR UINT16_C(0x000f)
1964#define IMAGE_REL_AMD64_SSPAN32 UINT16_C(0x0010)
1965/** @} */
1966
1967/** @name ARM IMAGE_REL_ARM_XXX - COFF relocations for ARM CPUs.
1968 * Used by IMAGE_RELOCATION::Type.
1969 * @{ */
1970#define IMAGE_REL_ARM_ABSOLUTE UINT16_C(0x0000)
1971#define IMAGE_REL_ARM_ADDR32 UINT16_C(0x0001)
1972#define IMAGE_REL_ARM_ADDR32NB UINT16_C(0x0002)
1973#define IMAGE_REL_ARM_BRANCH24 UINT16_C(0x0003)
1974#define IMAGE_REL_ARM_BRANCH11 UINT16_C(0x0004)
1975#define IMAGE_REL_ARM_TOKEN UINT16_C(0x0005)
1976#define IMAGE_REL_ARM_BLX24 UINT16_C(0x0008)
1977#define IMAGE_REL_ARM_BLX11 UINT16_C(0x0009)
1978#define IMAGE_REL_ARM_SECTION UINT16_C(0x000e)
1979#define IMAGE_REL_ARM_SECREL UINT16_C(0x000f)
1980#define IMAGE_REL_ARM_MOV32A UINT16_C(0x0010)
1981#define IMAGE_REL_ARM_MOV32T UINT16_C(0x0011)
1982#define IMAGE_REL_ARM_BRANCH20T UINT16_C(0x0012)
1983#define IMAGE_REL_ARM_BRANCH24T UINT16_C(0x0014)
1984#define IMAGE_REL_ARM_BLX23T UINT16_C(0x0015)
1985/** @} */
1986
1987/** @name IMAGE_REL_ARM64_XXX - COFF relocations for ARMv8 CPUs (64-bit).
1988 * Used by IMAGE_RELOCATION::Type.
1989 * @{ */
1990#define IMAGE_REL_ARM64_ABSOLUTE UINT16_C(0x0000)
1991#define IMAGE_REL_ARM64_ADDR32 UINT16_C(0x0001)
1992#define IMAGE_REL_ARM64_ADDR32NB UINT16_C(0x0002)
1993#define IMAGE_REL_ARM64_BRANCH26 UINT16_C(0x0003)
1994#define IMAGE_REL_ARM64_PAGEBASE_REL21 UINT16_C(0x0004)
1995#define IMAGE_REL_ARM64_REL21 UINT16_C(0x0005)
1996#define IMAGE_REL_ARM64_PAGEOFFSET_12A UINT16_C(0x0006)
1997#define IMAGE_REL_ARM64_PAGEOFFSET_12L UINT16_C(0x0007)
1998#define IMAGE_REL_ARM64_SECREL UINT16_C(0x0008)
1999#define IMAGE_REL_ARM64_SECREL_LOW12A UINT16_C(0x0009)
2000#define IMAGE_REL_ARM64_SECREL_HIGH12A UINT16_C(0x000a)
2001#define IMAGE_REL_ARM64_SECREL_LOW12L UINT16_C(0x000b)
2002#define IMAGE_REL_ARM64_TOKEN UINT16_C(0x000c)
2003#define IMAGE_REL_ARM64_SECTION UINT16_C(0x000d)
2004#define IMAGE_REL_ARM64_ADDR64 UINT16_C(0x000e)
2005/** @} */
2006
2007/** @name IMAGE_REL_SH3_XXX - COFF relocation for Hitachi SuperH CPUs.
2008 * Used by IMAGE_RELOCATION::Type.
2009 * @{ */
2010#define IMAGE_REL_SH3_ABSOLUTE UINT16_C(0x0000)
2011#define IMAGE_REL_SH3_DIRECT16 UINT16_C(0x0001)
2012#define IMAGE_REL_SH3_DIRECT32 UINT16_C(0x0002)
2013#define IMAGE_REL_SH3_DIRECT8 UINT16_C(0x0003)
2014#define IMAGE_REL_SH3_DIRECT8_WORD UINT16_C(0x0004)
2015#define IMAGE_REL_SH3_DIRECT8_LONG UINT16_C(0x0005)
2016#define IMAGE_REL_SH3_DIRECT4 UINT16_C(0x0006)
2017#define IMAGE_REL_SH3_DIRECT4_WORD UINT16_C(0x0007)
2018#define IMAGE_REL_SH3_DIRECT4_LONG UINT16_C(0x0008)
2019#define IMAGE_REL_SH3_PCREL8_WORD UINT16_C(0x0009)
2020#define IMAGE_REL_SH3_PCREL8_LONG UINT16_C(0x000a)
2021#define IMAGE_REL_SH3_PCREL12_WORD UINT16_C(0x000b)
2022#define IMAGE_REL_SH3_STARTOF_SECTION UINT16_C(0x000c)
2023#define IMAGE_REL_SH3_SIZEOF_SECTION UINT16_C(0x000d)
2024#define IMAGE_REL_SH3_SECTION UINT16_C(0x000e)
2025#define IMAGE_REL_SH3_SECREL UINT16_C(0x000f)
2026#define IMAGE_REL_SH3_DIRECT32_NB UINT16_C(0x0010)
2027#define IMAGE_REL_SH3_GPREL4_LONG UINT16_C(0x0011)
2028#define IMAGE_REL_SH3_TOKEN UINT16_C(0x0012)
2029#define IMAGE_REL_SHM_PCRELPT UINT16_C(0x0013)
2030#define IMAGE_REL_SHM_REFLO UINT16_C(0x0014)
2031#define IMAGE_REL_SHM_REFHALF UINT16_C(0x0015)
2032#define IMAGE_REL_SHM_RELLO UINT16_C(0x0016)
2033#define IMAGE_REL_SHM_RELHALF UINT16_C(0x0017)
2034#define IMAGE_REL_SHM_PAIR UINT16_C(0x0018)
2035#define IMAGE_REL_SHM_NOMODE UINT16_C(0x8000)
2036/** @} */
2037
2038/** @name IMAGE_REL_PPC_XXX - COFF relocations for IBM PowerPC CPUs.
2039 * Used by IMAGE_RELOCATION::Type.
2040 * @{ */
2041#define IMAGE_REL_PPC_ABSOLUTE UINT16_C(0x0000)
2042#define IMAGE_REL_PPC_ADDR64 UINT16_C(0x0001)
2043#define IMAGE_REL_PPC_ADDR32 UINT16_C(0x0002)
2044#define IMAGE_REL_PPC_ADDR24 UINT16_C(0x0003)
2045#define IMAGE_REL_PPC_ADDR16 UINT16_C(0x0004)
2046#define IMAGE_REL_PPC_ADDR14 UINT16_C(0x0005)
2047#define IMAGE_REL_PPC_REL24 UINT16_C(0x0006)
2048#define IMAGE_REL_PPC_REL14 UINT16_C(0x0007)
2049#define IMAGE_REL_PPC_ADDR32NB UINT16_C(0x000a)
2050#define IMAGE_REL_PPC_SECREL UINT16_C(0x000b)
2051#define IMAGE_REL_PPC_SECTION UINT16_C(0x000c)
2052#define IMAGE_REL_PPC_SECREL16 UINT16_C(0x000f)
2053#define IMAGE_REL_PPC_REFHI UINT16_C(0x0010)
2054#define IMAGE_REL_PPC_REFLO UINT16_C(0x0011)
2055#define IMAGE_REL_PPC_PAIR UINT16_C(0x0012)
2056#define IMAGE_REL_PPC_SECRELLO UINT16_C(0x0013)
2057#define IMAGE_REL_PPC_GPREL UINT16_C(0x0015)
2058#define IMAGE_REL_PPC_TOKEN UINT16_C(0x0016)
2059/** @} */
2060
2061/** @name IMAGE_REL_I386_XXX - COFF relocations for x86 CPUs.
2062 * Used by IMAGE_RELOCATION::Type.
2063 * @{ */
2064#define IMAGE_REL_I386_ABSOLUTE UINT16_C(0x0000)
2065#define IMAGE_REL_I386_DIR16 UINT16_C(0x0001)
2066#define IMAGE_REL_I386_REL16 UINT16_C(0x0002)
2067#define IMAGE_REL_I386_DIR32 UINT16_C(0x0006)
2068#define IMAGE_REL_I386_DIR32NB UINT16_C(0x0007)
2069#define IMAGE_REL_I386_SEG12 UINT16_C(0x0009)
2070#define IMAGE_REL_I386_SECTION UINT16_C(0x000A)
2071#define IMAGE_REL_I386_SECREL UINT16_C(0x000B)
2072#define IMAGE_REL_I386_TOKEN UINT16_C(0x000C)
2073#define IMAGE_REL_I386_SECREL7 UINT16_C(0x000D)
2074#define IMAGE_REL_I386_REL32 UINT16_C(0x0014)
2075/** @} */
2076
2077/** @name IMAGE_REL_IA64_XXX - COFF relocations for "Itanic" CPUs.
2078 * @{ */
2079#define IMAGE_REL_IA64_ABSOLUTE UINT16_C(0x0000)
2080#define IMAGE_REL_IA64_IMM14 UINT16_C(0x0001)
2081#define IMAGE_REL_IA64_IMM22 UINT16_C(0x0002)
2082#define IMAGE_REL_IA64_IMM64 UINT16_C(0x0003)
2083#define IMAGE_REL_IA64_DIR32 UINT16_C(0x0004)
2084#define IMAGE_REL_IA64_DIR64 UINT16_C(0x0005)
2085#define IMAGE_REL_IA64_PCREL21B UINT16_C(0x0006)
2086#define IMAGE_REL_IA64_PCREL21M UINT16_C(0x0007)
2087#define IMAGE_REL_IA64_PCREL21F UINT16_C(0x0008)
2088#define IMAGE_REL_IA64_GPREL22 UINT16_C(0x0009)
2089#define IMAGE_REL_IA64_LTOFF22 UINT16_C(0x000a)
2090#define IMAGE_REL_IA64_SECTION UINT16_C(0x000b)
2091#define IMAGE_REL_IA64_SECREL22 UINT16_C(0x000c)
2092#define IMAGE_REL_IA64_SECREL64I UINT16_C(0x000d)
2093#define IMAGE_REL_IA64_SECREL32 UINT16_C(0x000e)
2094#define IMAGE_REL_IA64_DIR32NB UINT16_C(0x0010)
2095#define IMAGE_REL_IA64_SREL14 UINT16_C(0x0011)
2096#define IMAGE_REL_IA64_SREL22 UINT16_C(0x0012)
2097#define IMAGE_REL_IA64_SREL32 UINT16_C(0x0013)
2098#define IMAGE_REL_IA64_UREL32 UINT16_C(0x0014)
2099#define IMAGE_REL_IA64_PCREL60X UINT16_C(0x0015)
2100#define IMAGE_REL_IA64_PCREL60B UINT16_C(0x0016)
2101#define IMAGE_REL_IA64_PCREL60F UINT16_C(0x0017)
2102#define IMAGE_REL_IA64_PCREL60I UINT16_C(0x0018)
2103#define IMAGE_REL_IA64_PCREL60M UINT16_C(0x0019)
2104#define IMAGE_REL_IA64_IMMGPREL64 UINT16_C(0x001a)
2105#define IMAGE_REL_IA64_TOKEN UINT16_C(0x001b)
2106#define IMAGE_REL_IA64_GPREL32 UINT16_C(0x001c)
2107#define IMAGE_REL_IA64_ADDEND UINT16_C(0x001f)
2108/** @} */
2109
2110/** @name IMAGE_REL_MIPS_XXX - COFF relocations for MIPS CPUs.
2111 * Used by IMAGE_RELOCATION::Type.
2112 * @{ */
2113#define IMAGE_REL_MIPS_ABSOLUTE UINT16_C(0x0000)
2114#define IMAGE_REL_MIPS_REFHALF UINT16_C(0x0001)
2115#define IMAGE_REL_MIPS_REFWORD UINT16_C(0x0002)
2116#define IMAGE_REL_MIPS_JMPADDR UINT16_C(0x0003)
2117#define IMAGE_REL_MIPS_REFHI UINT16_C(0x0004)
2118#define IMAGE_REL_MIPS_REFLO UINT16_C(0x0005)
2119#define IMAGE_REL_MIPS_GPREL UINT16_C(0x0006)
2120#define IMAGE_REL_MIPS_LITERAL UINT16_C(0x0007)
2121#define IMAGE_REL_MIPS_SECTION UINT16_C(0x000a)
2122#define IMAGE_REL_MIPS_SECREL UINT16_C(0x000b)
2123#define IMAGE_REL_MIPS_SECRELLO UINT16_C(0x000c)
2124#define IMAGE_REL_MIPS_SECRELHI UINT16_C(0x000d)
2125#define IMAGE_REL_MIPS_JMPADDR16 UINT16_C(0x0010)
2126#define IMAGE_REL_MIPS_REFWORDNB UINT16_C(0x0022)
2127#define IMAGE_REL_MIPS_PAIR UINT16_C(0x0025)
2128/** @} */
2129
2130/** @name IMAGE_REL_M32R_XXX - COFF relocations for Mitsubishi M32R CPUs.
2131 * Used by IMAGE_RELOCATION::Type.
2132 * @{ */
2133#define IMAGE_REL_M32R_ABSOLUTE UINT16_C(0x0000)
2134#define IMAGE_REL_M32R_ADDR32 UINT16_C(0x0001)
2135#define IMAGE_REL_M32R_ADDR32NB UINT16_C(0x0002)
2136#define IMAGE_REL_M32R_ADDR24 UINT16_C(0x0003)
2137#define IMAGE_REL_M32R_GPREL16 UINT16_C(0x0004)
2138#define IMAGE_REL_M32R_PCREL24 UINT16_C(0x0005)
2139#define IMAGE_REL_M32R_PCREL16 UINT16_C(0x0006)
2140#define IMAGE_REL_M32R_PCREL8 UINT16_C(0x0007)
2141#define IMAGE_REL_M32R_REFHALF UINT16_C(0x0008)
2142#define IMAGE_REL_M32R_REFHI UINT16_C(0x0009)
2143#define IMAGE_REL_M32R_REFLO UINT16_C(0x000a)
2144#define IMAGE_REL_M32R_PAIR UINT16_C(0x000b)
2145#define IMAGE_REL_M32R_SECTION UINT16_C(0x000c)
2146#define IMAGE_REL_M32R_SECREL UINT16_C(0x000d)
2147#define IMAGE_REL_M32R_TOKEN UINT16_C(0x000e)
2148/** @} */
2149
2150
2151/** @} */
2152
2153#endif
2154
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette