1 | /* $Id: pecoff.h 96448 2022-08-23 22:35:23Z vboxsync $ */
|
---|
2 | /** @file
|
---|
3 | * IPRT - Windows NT PE & COFF Structures and Constants.
|
---|
4 | */
|
---|
5 |
|
---|
6 | /*
|
---|
7 | * Copyright (C) 2006-2022 Oracle and/or its affiliates.
|
---|
8 | *
|
---|
9 | * This file is part of VirtualBox base platform packages, as
|
---|
10 | * available from https://www.virtualbox.org.
|
---|
11 | *
|
---|
12 | * This program is free software; you can redistribute it and/or
|
---|
13 | * modify it under the terms of the GNU General Public License
|
---|
14 | * as published by the Free Software Foundation, in version 3 of the
|
---|
15 | * License.
|
---|
16 | *
|
---|
17 | * This program is distributed in the hope that it will be useful, but
|
---|
18 | * WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
19 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
---|
20 | * General Public License for more details.
|
---|
21 | *
|
---|
22 | * You should have received a copy of the GNU General Public License
|
---|
23 | * along with this program; if not, see <https://www.gnu.org/licenses>.
|
---|
24 | *
|
---|
25 | * The contents of this file may alternatively be used under the terms
|
---|
26 | * of the Common Development and Distribution License Version 1.0
|
---|
27 | * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
|
---|
28 | * in the VirtualBox distribution, in which case the provisions of the
|
---|
29 | * CDDL are applicable instead of those of the GPL.
|
---|
30 | *
|
---|
31 | * You may elect to license modified versions of this file under the
|
---|
32 | * terms and conditions of either the GPL or the CDDL or both.
|
---|
33 | *
|
---|
34 | * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
|
---|
35 | */
|
---|
36 |
|
---|
37 | #ifndef IPRT_INCLUDED_formats_pecoff_h
|
---|
38 | #define IPRT_INCLUDED_formats_pecoff_h
|
---|
39 | #ifndef RT_WITHOUT_PRAGMA_ONCE
|
---|
40 | # pragma once
|
---|
41 | #endif
|
---|
42 |
|
---|
43 | #include <iprt/types.h>
|
---|
44 | #include <iprt/assertcompile.h>
|
---|
45 |
|
---|
46 |
|
---|
47 | /** @defgroup grp_rt_formats_pecoff PE & Microsoft COFF structures and definitions
|
---|
48 | * @ingroup grp_rt_formats
|
---|
49 | * @{
|
---|
50 | */
|
---|
51 |
|
---|
52 |
|
---|
53 | /**
|
---|
54 | * PE & COFF file header.
|
---|
55 | *
|
---|
56 | * This starts COFF files, while in PE files it's preceeded by the PE signature
|
---|
57 | * (see IMAGE_NT_HEADERS32, IMAGE_NT_HEADERS64).
|
---|
58 | */
|
---|
59 | typedef struct _IMAGE_FILE_HEADER
|
---|
60 | {
|
---|
61 | uint16_t Machine; /**< 0x00 */
|
---|
62 | uint16_t NumberOfSections; /**< 0x02 */
|
---|
63 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
64 | uint32_t PointerToSymbolTable; /**< 0x08 */
|
---|
65 | uint32_t NumberOfSymbols; /**< 0x0c */
|
---|
66 | uint16_t SizeOfOptionalHeader; /**< 0x10 */
|
---|
67 | uint16_t Characteristics; /**< 0x12 */
|
---|
68 | } IMAGE_FILE_HEADER; /* size: 0x14 */
|
---|
69 | AssertCompileSize(IMAGE_FILE_HEADER, 0x14);
|
---|
70 | typedef IMAGE_FILE_HEADER *PIMAGE_FILE_HEADER;
|
---|
71 | typedef IMAGE_FILE_HEADER const *PCIMAGE_FILE_HEADER;
|
---|
72 |
|
---|
73 |
|
---|
74 | /** @name PE & COFF machine types.
|
---|
75 | * Used by IMAGE_FILE_HEADER::Machine and IMAGE_SEPARATE_DEBUG_HEADER::Machine.
|
---|
76 | * @{ */
|
---|
77 | /** X86 compatible CPU, 32-bit instructions. */
|
---|
78 | #define IMAGE_FILE_MACHINE_I386 UINT16_C(0x014c)
|
---|
79 | /** AMD64 compatible CPU, 64-bit instructions. */
|
---|
80 | #define IMAGE_FILE_MACHINE_AMD64 UINT16_C(0x8664)
|
---|
81 |
|
---|
82 | /** Unknown target CPU. */
|
---|
83 | #define IMAGE_FILE_MACHINE_UNKNOWN UINT16_C(0x0000)
|
---|
84 | /** Basic-16 (whatever that is). */
|
---|
85 | #define IMAGE_FILE_MACHINE_BASIC_16 UINT16_C(0x0142)
|
---|
86 | /** Basic-16 (whatever that is) w/ transfer vector(s?) (TV). */
|
---|
87 | #define IMAGE_FILE_MACHINE_BASIC_16_TV UINT16_C(0x0143)
|
---|
88 | /** Intel iAPX 16 (8086?). */
|
---|
89 | #define IMAGE_FILE_MACHINE_IAPX16 UINT16_C(0x0144)
|
---|
90 | /** Intel iAPX 16 (8086?) w/ transfer vector(s?) (TV). */
|
---|
91 | #define IMAGE_FILE_MACHINE_IAPX16_TV UINT16_C(0x0145)
|
---|
92 | /** Intel iAPX 20 (80286?). */
|
---|
93 | #define IMAGE_FILE_MACHINE_IAPX20 UINT16_C(0x0144)
|
---|
94 | /** Intel iAPX 20 (80286?) w/ transfer vector(s?) (TV). */
|
---|
95 | #define IMAGE_FILE_MACHINE_IAPX20_TV UINT16_C(0x0145)
|
---|
96 | /** X86 compatible CPU, 8086. */
|
---|
97 | #define IMAGE_FILE_MACHINE_I8086 UINT16_C(0x0148)
|
---|
98 | /** X86 compatible CPU, 8086 w/ transfer vector(s?) (TV). */
|
---|
99 | #define IMAGE_FILE_MACHINE_I8086_TV UINT16_C(0x0149)
|
---|
100 | /** X86 compatible CPU, 80286 small model program. */
|
---|
101 | #define IMAGE_FILE_MACHINE_I286_SMALL UINT16_C(0x014a)
|
---|
102 | /** Motorola 68000. */
|
---|
103 | #define IMAGE_FILE_MACHINE_MC68 UINT16_C(0x0150)
|
---|
104 | /** Motorola 68000 w/ writable text sections. */
|
---|
105 | #define IMAGE_FILE_MACHINE_MC68_WR UINT16_C(0x0150)
|
---|
106 | /** Motorola 68000 w/ transfer vector(s?). */
|
---|
107 | #define IMAGE_FILE_MACHINE_MC68_TV UINT16_C(0x0151)
|
---|
108 | /** Motorola 68000 w/ demand paged text.
|
---|
109 | * @note shared with 80286 large model program. */
|
---|
110 | #define IMAGE_FILE_MACHINE_MC68_PG UINT16_C(0x0152)
|
---|
111 | /** X86 compatible CPU, 80286 large model program.
|
---|
112 | * @note shared with MC68000 w/ demand paged text */
|
---|
113 | #define IMAGE_FILE_MACHINE_I286_LARGE UINT16_C(0x0152)
|
---|
114 | /** IBM 370 (writable text). */
|
---|
115 | #define IMAGE_FILE_MACHINE_U370_WR UINT16_C(0x0158)
|
---|
116 | /** Amdahl 470/580 (writable text). */
|
---|
117 | #define IMAGE_FILE_MACHINE_AMDAHL_470_WR UINT16_C(0x0159)
|
---|
118 | /** Amdahl 470/580 (read only text). */
|
---|
119 | #define IMAGE_FILE_MACHINE_AMDAHL_470_RO UINT16_C(0x015c)
|
---|
120 | /** IBM 370 (read only text). */
|
---|
121 | #define IMAGE_FILE_MACHINE_U370_RO UINT16_C(0x015d)
|
---|
122 | /** MIPS R4000 CPU, little endian. */
|
---|
123 | #define IMAGE_FILE_MACHINE_R4000 UINT16_C(0x0166)
|
---|
124 | /** MIPS CPU, little endian, Windows CE (?) v2 designation. */
|
---|
125 | #define IMAGE_FILE_MACHINE_WCEMIPSV2 UINT16_C(0x0169)
|
---|
126 | /** VAX-11/750 and VAX-11/780 (writable text). */
|
---|
127 | #define IMAGE_FILE_MACHINE_VAX_WR UINT16_C(0x0178)
|
---|
128 | /** VAX-11/750 and VAX-11/780 (read-only text). */
|
---|
129 | #define IMAGE_FILE_MACHINE_VAX_RO UINT16_C(0x017d)
|
---|
130 | /** Hitachi SH3 CPU. */
|
---|
131 | #define IMAGE_FILE_MACHINE_SH3 UINT16_C(0x01a2)
|
---|
132 | /** Hitachi SH3 DSP. */
|
---|
133 | #define IMAGE_FILE_MACHINE_SH3DSP UINT16_C(0x01a3)
|
---|
134 | /** Hitachi SH4 CPU. */
|
---|
135 | #define IMAGE_FILE_MACHINE_SH4 UINT16_C(0x01a6)
|
---|
136 | /** Hitachi SH5 CPU. */
|
---|
137 | #define IMAGE_FILE_MACHINE_SH5 UINT16_C(0x01a8)
|
---|
138 | /** Little endian ARM CPU. */
|
---|
139 | #define IMAGE_FILE_MACHINE_ARM UINT16_C(0x01c0)
|
---|
140 | /** ARM or Thumb stuff. */
|
---|
141 | #define IMAGE_FILE_MACHINE_THUMB UINT16_C(0x01c2)
|
---|
142 | /** ARMv7 or higher CPU, Thumb mode. */
|
---|
143 | #define IMAGE_FILE_MACHINE_ARMNT UINT16_C(0x01c4)
|
---|
144 | /** Matshushita AM33 CPU. */
|
---|
145 | #define IMAGE_FILE_MACHINE_AM33 UINT16_C(0x01d3)
|
---|
146 | /** Power PC CPU, little endian. */
|
---|
147 | #define IMAGE_FILE_MACHINE_POWERPC UINT16_C(0x01f0)
|
---|
148 | /** Power PC CPU with FPU, also little endian? */
|
---|
149 | #define IMAGE_FILE_MACHINE_POWERPCFP UINT16_C(0x01f1)
|
---|
150 | /** "Itanic" CPU. */
|
---|
151 | #define IMAGE_FILE_MACHINE_IA64 UINT16_C(0x0200)
|
---|
152 | /** MIPS CPU, compact 16-bit instructions only? */
|
---|
153 | #define IMAGE_FILE_MACHINE_MIPS16 UINT16_C(0x0266)
|
---|
154 | /** MIPS CPU with FPU, full 32-bit instructions only? */
|
---|
155 | #define IMAGE_FILE_MACHINE_MIPSFPU UINT16_C(0x0366)
|
---|
156 | /** MIPS CPU with FPU, compact 16-bit instructions? */
|
---|
157 | #define IMAGE_FILE_MACHINE_MIPSFPU16 UINT16_C(0x0466)
|
---|
158 | /** EFI byte code. */
|
---|
159 | #define IMAGE_FILE_MACHINE_EBC UINT16_C(0x0ebc)
|
---|
160 | /** Mitsubishi M32R CPU, little endian. */
|
---|
161 | #define IMAGE_FILE_MACHINE_M32R UINT16_C(0x9041)
|
---|
162 | /** ARMv8 CPU, 64-bit mode. */
|
---|
163 | #define IMAGE_FILE_MACHINE_ARM64 UINT16_C(0xaa64)
|
---|
164 | /** @} */
|
---|
165 |
|
---|
166 | /** @name File header characteristics (IMAGE_FILE_HEADER::Characteristics)
|
---|
167 | * @{ */
|
---|
168 | #define IMAGE_FILE_RELOCS_STRIPPED UINT16_C(0x0001)
|
---|
169 | #define IMAGE_FILE_EXECUTABLE_IMAGE UINT16_C(0x0002)
|
---|
170 | #define IMAGE_FILE_LINE_NUMS_STRIPPED UINT16_C(0x0004)
|
---|
171 | #define IMAGE_FILE_LOCAL_SYMS_STRIPPED UINT16_C(0x0008)
|
---|
172 | #define IMAGE_FILE_AGGRESIVE_WS_TRIM UINT16_C(0x0010)
|
---|
173 | #define IMAGE_FILE_LARGE_ADDRESS_AWARE UINT16_C(0x0020)
|
---|
174 | #define IMAGE_FILE_16BIT_MACHINE UINT16_C(0x0040)
|
---|
175 | #define IMAGE_FILE_BYTES_REVERSED_LO UINT16_C(0x0080)
|
---|
176 | #define IMAGE_FILE_32BIT_MACHINE UINT16_C(0x0100)
|
---|
177 | #define IMAGE_FILE_DEBUG_STRIPPED UINT16_C(0x0200)
|
---|
178 | #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP UINT16_C(0x0400)
|
---|
179 | #define IMAGE_FILE_NET_RUN_FROM_SWAP UINT16_C(0x0800)
|
---|
180 | #define IMAGE_FILE_SYSTEM UINT16_C(0x1000) /**< (COFF/IAPX*: Used to indicate 80186 instructions) */
|
---|
181 | #define IMAGE_FILE_DLL UINT16_C(0x2000) /**< (COFF/IAPX*: Used to indicate 80286 instructions) */
|
---|
182 | #define IMAGE_FILE_UP_SYSTEM_ONLY UINT16_C(0x4000)
|
---|
183 | #define IMAGE_FILE_BYTES_REVERSED_HI UINT16_C(0x8000)
|
---|
184 | /** @} */
|
---|
185 |
|
---|
186 |
|
---|
187 | /**
|
---|
188 | * PE data directory.
|
---|
189 | *
|
---|
190 | * This is used to locate data in the loaded image so the dynamic linker or
|
---|
191 | * others can make use of it. However, in the case of
|
---|
192 | * IMAGE_DIRECTORY_ENTRY_SECURITY it is referring to raw file offsets.
|
---|
193 | */
|
---|
194 | typedef struct _IMAGE_DATA_DIRECTORY
|
---|
195 | {
|
---|
196 | uint32_t VirtualAddress;
|
---|
197 | uint32_t Size;
|
---|
198 | } IMAGE_DATA_DIRECTORY;
|
---|
199 | AssertCompileSize(IMAGE_DATA_DIRECTORY, 0x8);
|
---|
200 | typedef IMAGE_DATA_DIRECTORY *PIMAGE_DATA_DIRECTORY;
|
---|
201 | typedef IMAGE_DATA_DIRECTORY const *PCIMAGE_DATA_DIRECTORY;
|
---|
202 |
|
---|
203 | /** The standard number of data directories in the optional header.
|
---|
204 | * I.e. the dimensions of IMAGE_OPTIONAL_HEADER32::DataDirectory and
|
---|
205 | * IMAGE_OPTIONAL_HEADER64::DataDirectory.
|
---|
206 | */
|
---|
207 | #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 0x10
|
---|
208 |
|
---|
209 |
|
---|
210 | /**
|
---|
211 | * PE optional header, 32-bit version.
|
---|
212 | */
|
---|
213 | typedef struct _IMAGE_OPTIONAL_HEADER32
|
---|
214 | {
|
---|
215 | uint16_t Magic; /**< 0x00 */
|
---|
216 | uint8_t MajorLinkerVersion; /**< 0x02 */
|
---|
217 | uint8_t MinorLinkerVersion; /**< 0x03 */
|
---|
218 | uint32_t SizeOfCode; /**< 0x04 */
|
---|
219 | uint32_t SizeOfInitializedData; /**< 0x08 */
|
---|
220 | uint32_t SizeOfUninitializedData; /**< 0x0c */
|
---|
221 | uint32_t AddressOfEntryPoint; /**< 0x10 */
|
---|
222 | uint32_t BaseOfCode; /**< 0x14 */
|
---|
223 | uint32_t BaseOfData; /**< 0x18 */
|
---|
224 | uint32_t ImageBase; /**< 0x1c */
|
---|
225 | uint32_t SectionAlignment; /**< 0x20 */
|
---|
226 | uint32_t FileAlignment; /**< 0x24 */
|
---|
227 | uint16_t MajorOperatingSystemVersion; /**< 0x28 */
|
---|
228 | uint16_t MinorOperatingSystemVersion; /**< 0x2a */
|
---|
229 | uint16_t MajorImageVersion; /**< 0x2c */
|
---|
230 | uint16_t MinorImageVersion; /**< 0x2e */
|
---|
231 | uint16_t MajorSubsystemVersion; /**< 0x30 */
|
---|
232 | uint16_t MinorSubsystemVersion; /**< 0x32 */
|
---|
233 | uint32_t Win32VersionValue; /**< 0x34 */
|
---|
234 | uint32_t SizeOfImage; /**< 0x38 */
|
---|
235 | uint32_t SizeOfHeaders; /**< 0x3c */
|
---|
236 | uint32_t CheckSum; /**< 0x40 */
|
---|
237 | uint16_t Subsystem; /**< 0x44 */
|
---|
238 | uint16_t DllCharacteristics; /**< 0x46 */
|
---|
239 | uint32_t SizeOfStackReserve; /**< 0x48 */
|
---|
240 | uint32_t SizeOfStackCommit; /**< 0x4c */
|
---|
241 | uint32_t SizeOfHeapReserve; /**< 0x50 */
|
---|
242 | uint32_t SizeOfHeapCommit; /**< 0x54 */
|
---|
243 | uint32_t LoaderFlags; /**< 0x58 */
|
---|
244 | uint32_t NumberOfRvaAndSizes; /**< 0x5c */
|
---|
245 | IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x60; 0x10*8 = 0x80 */
|
---|
246 | } IMAGE_OPTIONAL_HEADER32; /* size: 0xe0 */
|
---|
247 | AssertCompileSize(IMAGE_OPTIONAL_HEADER32, 0xe0);
|
---|
248 | typedef IMAGE_OPTIONAL_HEADER32 *PIMAGE_OPTIONAL_HEADER32;
|
---|
249 | typedef IMAGE_OPTIONAL_HEADER32 const *PCIMAGE_OPTIONAL_HEADER32;
|
---|
250 |
|
---|
251 | /**
|
---|
252 | * PE optional header, 64-bit version.
|
---|
253 | */
|
---|
254 | typedef struct _IMAGE_OPTIONAL_HEADER64
|
---|
255 | {
|
---|
256 | uint16_t Magic; /**< 0x00 */
|
---|
257 | uint8_t MajorLinkerVersion; /**< 0x02 */
|
---|
258 | uint8_t MinorLinkerVersion; /**< 0x03 */
|
---|
259 | uint32_t SizeOfCode; /**< 0x04 */
|
---|
260 | uint32_t SizeOfInitializedData; /**< 0x08 */
|
---|
261 | uint32_t SizeOfUninitializedData; /**< 0x0c */
|
---|
262 | uint32_t AddressOfEntryPoint; /**< 0x10 */
|
---|
263 | uint32_t BaseOfCode; /**< 0x14 */
|
---|
264 | uint64_t ImageBase; /**< 0x18 */
|
---|
265 | uint32_t SectionAlignment; /**< 0x20 */
|
---|
266 | uint32_t FileAlignment; /**< 0x24 */
|
---|
267 | uint16_t MajorOperatingSystemVersion; /**< 0x28 */
|
---|
268 | uint16_t MinorOperatingSystemVersion; /**< 0x2a */
|
---|
269 | uint16_t MajorImageVersion; /**< 0x2c */
|
---|
270 | uint16_t MinorImageVersion; /**< 0x2e */
|
---|
271 | uint16_t MajorSubsystemVersion; /**< 0x30 */
|
---|
272 | uint16_t MinorSubsystemVersion; /**< 0x32 */
|
---|
273 | uint32_t Win32VersionValue; /**< 0x34 */
|
---|
274 | uint32_t SizeOfImage; /**< 0x38 */
|
---|
275 | uint32_t SizeOfHeaders; /**< 0x3c */
|
---|
276 | uint32_t CheckSum; /**< 0x40 */
|
---|
277 | uint16_t Subsystem; /**< 0x44 */
|
---|
278 | uint16_t DllCharacteristics; /**< 0x46 */
|
---|
279 | uint64_t SizeOfStackReserve; /**< 0x48 */
|
---|
280 | uint64_t SizeOfStackCommit; /**< 0x50 */
|
---|
281 | uint64_t SizeOfHeapReserve; /**< 0x58 */
|
---|
282 | uint64_t SizeOfHeapCommit; /**< 0x60 */
|
---|
283 | uint32_t LoaderFlags; /**< 0x68 */
|
---|
284 | uint32_t NumberOfRvaAndSizes; /**< 0x6c */
|
---|
285 | IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x70; 0x10*8 = 0x80 */
|
---|
286 | } IMAGE_OPTIONAL_HEADER64; /* size: 0xf0 */
|
---|
287 | AssertCompileSize(IMAGE_OPTIONAL_HEADER64, 0xf0);
|
---|
288 | typedef IMAGE_OPTIONAL_HEADER64 *PIMAGE_OPTIONAL_HEADER64;
|
---|
289 | typedef IMAGE_OPTIONAL_HEADER64 const *PCIMAGE_OPTIONAL_HEADER64;
|
---|
290 |
|
---|
291 | /** @name Optional header magic values.
|
---|
292 | * @{ */
|
---|
293 | #define IMAGE_NT_OPTIONAL_HDR32_MAGIC UINT16_C(0x010b)
|
---|
294 | #define IMAGE_NT_OPTIONAL_HDR64_MAGIC UINT16_C(0x020b)
|
---|
295 | /** @} */
|
---|
296 |
|
---|
297 | /** @name IMAGE_SUBSYSTEM_XXX - Optional header subsystems.
|
---|
298 | * IMAGE_OPTIONAL_HEADER32::Subsystem, IMAGE_OPTIONAL_HEADER64::Subsystem
|
---|
299 | * @{ */
|
---|
300 | #define IMAGE_SUBSYSTEM_UNKNOWN UINT16_C(0x0000)
|
---|
301 | #define IMAGE_SUBSYSTEM_NATIVE UINT16_C(0x0001)
|
---|
302 | #define IMAGE_SUBSYSTEM_WINDOWS_GUI UINT16_C(0x0002)
|
---|
303 | #define IMAGE_SUBSYSTEM_WINDOWS_CUI UINT16_C(0x0003)
|
---|
304 | #define IMAGE_SUBSYSTEM_OS2_GUI UINT16_C(0x0004)
|
---|
305 | #define IMAGE_SUBSYSTEM_OS2_CUI UINT16_C(0x0005)
|
---|
306 | #define IMAGE_SUBSYSTEM_POSIX_CUI UINT16_C(0x0007)
|
---|
307 | /** @} */
|
---|
308 |
|
---|
309 | /** @name Optional header characteristics.
|
---|
310 | * @{ */
|
---|
311 | #define IMAGE_LIBRARY_PROCESS_INIT UINT16_C(0x0001)
|
---|
312 | #define IMAGE_LIBRARY_PROCESS_TERM UINT16_C(0x0002)
|
---|
313 | #define IMAGE_LIBRARY_THREAD_INIT UINT16_C(0x0004)
|
---|
314 | #define IMAGE_LIBRARY_THREAD_TERM UINT16_C(0x0008)
|
---|
315 | #define IMAGE_DLLCHARACTERISTICS_RESERVED UINT16_C(0x0010)
|
---|
316 | #define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA UINT16_C(0x0020)
|
---|
317 | #define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE UINT16_C(0x0040)
|
---|
318 | #define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY UINT16_C(0x0080)
|
---|
319 | #define IMAGE_DLLCHARACTERISTICS_NX_COMPAT UINT16_C(0x0100)
|
---|
320 | #define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION UINT16_C(0x0200)
|
---|
321 | #define IMAGE_DLLCHARACTERISTICS_NO_SEH UINT16_C(0x0400)
|
---|
322 | #define IMAGE_DLLCHARACTERISTICS_NO_BIND UINT16_C(0x0800)
|
---|
323 | #define IMAGE_DLLCHARACTERISTICS_APPCONTAINER UINT16_C(0x1000)
|
---|
324 | #define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER UINT16_C(0x2000)
|
---|
325 | #define IMAGE_DLLCHARACTERISTICS_GUARD_CF UINT16_C(0x4000)
|
---|
326 | #define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE UINT16_C(0x8000)
|
---|
327 | /** @} */
|
---|
328 |
|
---|
329 |
|
---|
330 | /** @name IMAGE_DIRECTORY_ENTRY_XXX - Data directory indexes.
|
---|
331 | * Used to index IMAGE_OPTIONAL_HEADER32::DataDirectory and
|
---|
332 | * IMAGE_OPTIONAL_HEADER64::DataDirectory
|
---|
333 | * @{ */
|
---|
334 | #define IMAGE_DIRECTORY_ENTRY_EXPORT 0x0
|
---|
335 | #define IMAGE_DIRECTORY_ENTRY_IMPORT 0x1
|
---|
336 | #define IMAGE_DIRECTORY_ENTRY_RESOURCE 0x2
|
---|
337 | #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x3
|
---|
338 | #define IMAGE_DIRECTORY_ENTRY_SECURITY 0x4
|
---|
339 | #define IMAGE_DIRECTORY_ENTRY_BASERELOC 0x5
|
---|
340 | #define IMAGE_DIRECTORY_ENTRY_DEBUG 0x6
|
---|
341 | #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 0x7
|
---|
342 | #define IMAGE_DIRECTORY_ENTRY_COPYRIGHT IMAGE_DIRECTORY_ENTRY_ARCHITECTURE
|
---|
343 | #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x8
|
---|
344 | #define IMAGE_DIRECTORY_ENTRY_TLS 0x9
|
---|
345 | #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0xa
|
---|
346 | #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0xb
|
---|
347 | #define IMAGE_DIRECTORY_ENTRY_IAT 0xc
|
---|
348 | #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0xd
|
---|
349 | #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0xe
|
---|
350 | /** @} */
|
---|
351 |
|
---|
352 |
|
---|
353 | /**
|
---|
354 | * PE (NT) headers, 32-bit version.
|
---|
355 | */
|
---|
356 | typedef struct _IMAGE_NT_HEADERS32
|
---|
357 | {
|
---|
358 | uint32_t Signature; /**< 0x00 */
|
---|
359 | IMAGE_FILE_HEADER FileHeader; /**< 0x04 */
|
---|
360 | IMAGE_OPTIONAL_HEADER32 OptionalHeader; /**< 0x18 */
|
---|
361 | } IMAGE_NT_HEADERS32; /* size: 0xf8 */
|
---|
362 | AssertCompileSize(IMAGE_NT_HEADERS32, 0xf8);
|
---|
363 | AssertCompileMemberOffset(IMAGE_NT_HEADERS32, FileHeader, 4);
|
---|
364 | AssertCompileMemberOffset(IMAGE_NT_HEADERS32, OptionalHeader, 24);
|
---|
365 | typedef IMAGE_NT_HEADERS32 *PIMAGE_NT_HEADERS32;
|
---|
366 | typedef IMAGE_NT_HEADERS32 const *PCIMAGE_NT_HEADERS32;
|
---|
367 |
|
---|
368 | /**
|
---|
369 | * PE (NT) headers, 64-bit version.
|
---|
370 | */
|
---|
371 | typedef struct _IMAGE_NT_HEADERS64
|
---|
372 | {
|
---|
373 | uint32_t Signature; /**< 0x00 */
|
---|
374 | IMAGE_FILE_HEADER FileHeader; /**< 0x04 */
|
---|
375 | IMAGE_OPTIONAL_HEADER64 OptionalHeader; /**< 0x18 */
|
---|
376 | } IMAGE_NT_HEADERS64; /**< 0x108 */
|
---|
377 | AssertCompileSize(IMAGE_NT_HEADERS64, 0x108);
|
---|
378 | AssertCompileMemberOffset(IMAGE_NT_HEADERS64, FileHeader, 4);
|
---|
379 | AssertCompileMemberOffset(IMAGE_NT_HEADERS64, OptionalHeader, 24);
|
---|
380 | typedef IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
|
---|
381 | typedef IMAGE_NT_HEADERS64 const *PCIMAGE_NT_HEADERS64;
|
---|
382 |
|
---|
383 | /** The PE signature.
|
---|
384 | * Used by IMAGE_NT_HEADERS32::Signature, IMAGE_NT_HEADERS64::Signature. */
|
---|
385 | #define IMAGE_NT_SIGNATURE UINT32_C(0x00004550)
|
---|
386 |
|
---|
387 |
|
---|
388 | /** Section header short name length (IMAGE_SECTION_HEADER::Name). */
|
---|
389 | #define IMAGE_SIZEOF_SHORT_NAME 0x8
|
---|
390 |
|
---|
391 | /**
|
---|
392 | * PE & COFF section header.
|
---|
393 | */
|
---|
394 | typedef struct _IMAGE_SECTION_HEADER
|
---|
395 | {
|
---|
396 | uint8_t Name[IMAGE_SIZEOF_SHORT_NAME];
|
---|
397 | union
|
---|
398 | {
|
---|
399 | uint32_t PhysicalAddress;
|
---|
400 | uint32_t VirtualSize;
|
---|
401 | } Misc;
|
---|
402 | uint32_t VirtualAddress;
|
---|
403 | uint32_t SizeOfRawData;
|
---|
404 | uint32_t PointerToRawData;
|
---|
405 | uint32_t PointerToRelocations;
|
---|
406 | uint32_t PointerToLinenumbers;
|
---|
407 | uint16_t NumberOfRelocations;
|
---|
408 | uint16_t NumberOfLinenumbers;
|
---|
409 | uint32_t Characteristics;
|
---|
410 | } IMAGE_SECTION_HEADER;
|
---|
411 | AssertCompileSize(IMAGE_SECTION_HEADER, 40);
|
---|
412 | typedef IMAGE_SECTION_HEADER *PIMAGE_SECTION_HEADER;
|
---|
413 | typedef IMAGE_SECTION_HEADER const *PCIMAGE_SECTION_HEADER;
|
---|
414 |
|
---|
415 | /** @name IMAGE_SCN_XXX - Section header characteristics.
|
---|
416 | * Used by IMAGE_SECTION_HEADER::Characteristics.
|
---|
417 | * @{ */
|
---|
418 | #define IMAGE_SCN_TYPE_REG UINT32_C(0x00000000)
|
---|
419 | #define IMAGE_SCN_TYPE_DSECT UINT32_C(0x00000001)
|
---|
420 | #define IMAGE_SCN_TYPE_NOLOAD UINT32_C(0x00000002)
|
---|
421 | #define IMAGE_SCN_TYPE_GROUP UINT32_C(0x00000004)
|
---|
422 | #define IMAGE_SCN_TYPE_NO_PAD UINT32_C(0x00000008)
|
---|
423 | #define IMAGE_SCN_TYPE_COPY UINT32_C(0x00000010)
|
---|
424 |
|
---|
425 | #define IMAGE_SCN_CNT_CODE UINT32_C(0x00000020)
|
---|
426 | #define IMAGE_SCN_CNT_INITIALIZED_DATA UINT32_C(0x00000040)
|
---|
427 | #define IMAGE_SCN_CNT_UNINITIALIZED_DATA UINT32_C(0x00000080)
|
---|
428 |
|
---|
429 | #define IMAGE_SCN_LNK_OTHER UINT32_C(0x00000100)
|
---|
430 | #define IMAGE_SCN_LNK_INFO UINT32_C(0x00000200)
|
---|
431 | #define IMAGE_SCN_TYPE_OVER UINT32_C(0x00000400)
|
---|
432 | #define IMAGE_SCN_LNK_REMOVE UINT32_C(0x00000800)
|
---|
433 | #define IMAGE_SCN_LNK_COMDAT UINT32_C(0x00001000)
|
---|
434 | #define IMAGE_SCN_MEM_PROTECTED UINT32_C(0x00004000)
|
---|
435 | #define IMAGE_SCN_NO_DEFER_SPEC_EXC UINT32_C(0x00004000)
|
---|
436 | #define IMAGE_SCN_GPREL UINT32_C(0x00008000)
|
---|
437 | #define IMAGE_SCN_MEM_FARDATA UINT32_C(0x00008000)
|
---|
438 | #define IMAGE_SCN_MEM_SYSHEAP UINT32_C(0x00010000)
|
---|
439 | #define IMAGE_SCN_MEM_PURGEABLE UINT32_C(0x00020000)
|
---|
440 | #define IMAGE_SCN_MEM_16BIT UINT32_C(0x00020000)
|
---|
441 | #define IMAGE_SCN_MEM_LOCKED UINT32_C(0x00040000)
|
---|
442 | #define IMAGE_SCN_MEM_PRELOAD UINT32_C(0x00080000)
|
---|
443 |
|
---|
444 | #define IMAGE_SCN_ALIGN_1BYTES UINT32_C(0x00100000)
|
---|
445 | #define IMAGE_SCN_ALIGN_2BYTES UINT32_C(0x00200000)
|
---|
446 | #define IMAGE_SCN_ALIGN_4BYTES UINT32_C(0x00300000)
|
---|
447 | #define IMAGE_SCN_ALIGN_8BYTES UINT32_C(0x00400000)
|
---|
448 | #define IMAGE_SCN_ALIGN_16BYTES UINT32_C(0x00500000)
|
---|
449 | #define IMAGE_SCN_ALIGN_32BYTES UINT32_C(0x00600000)
|
---|
450 | #define IMAGE_SCN_ALIGN_64BYTES UINT32_C(0x00700000)
|
---|
451 | #define IMAGE_SCN_ALIGN_128BYTES UINT32_C(0x00800000)
|
---|
452 | #define IMAGE_SCN_ALIGN_256BYTES UINT32_C(0x00900000)
|
---|
453 | #define IMAGE_SCN_ALIGN_512BYTES UINT32_C(0x00A00000)
|
---|
454 | #define IMAGE_SCN_ALIGN_1024BYTES UINT32_C(0x00B00000)
|
---|
455 | #define IMAGE_SCN_ALIGN_2048BYTES UINT32_C(0x00C00000)
|
---|
456 | #define IMAGE_SCN_ALIGN_4096BYTES UINT32_C(0x00D00000)
|
---|
457 | #define IMAGE_SCN_ALIGN_8192BYTES UINT32_C(0x00E00000)
|
---|
458 | #define IMAGE_SCN_ALIGN_MASK UINT32_C(0x00F00000)
|
---|
459 | #define IMAGE_SCN_ALIGN_SHIFT 20
|
---|
460 |
|
---|
461 | #define IMAGE_SCN_LNK_NRELOC_OVFL UINT32_C(0x01000000)
|
---|
462 | #define IMAGE_SCN_MEM_DISCARDABLE UINT32_C(0x02000000)
|
---|
463 | #define IMAGE_SCN_MEM_NOT_CACHED UINT32_C(0x04000000)
|
---|
464 | #define IMAGE_SCN_MEM_NOT_PAGED UINT32_C(0x08000000)
|
---|
465 | #define IMAGE_SCN_MEM_SHARED UINT32_C(0x10000000)
|
---|
466 | #define IMAGE_SCN_MEM_EXECUTE UINT32_C(0x20000000)
|
---|
467 | #define IMAGE_SCN_MEM_READ UINT32_C(0x40000000)
|
---|
468 | #define IMAGE_SCN_MEM_WRITE UINT32_C(0x80000000)
|
---|
469 | /** @} */
|
---|
470 |
|
---|
471 |
|
---|
472 | /**
|
---|
473 | * PE image base relocations block header.
|
---|
474 | *
|
---|
475 | * This found in IMAGE_DIRECTORY_ENTRY_BASERELOC. Each entry is follow
|
---|
476 | * immediately by an array of 16-bit words, where the lower 12-bits are used
|
---|
477 | * for the page offset and the upper 4-bits for the base relocation type
|
---|
478 | * (IMAGE_REL_BASE_XXX). The block should be padded with
|
---|
479 | * IMAGE_REL_BASED_ABSOLUTE entries to ensure 32-bit alignment of this header.
|
---|
480 | */
|
---|
481 | typedef struct _IMAGE_BASE_RELOCATION
|
---|
482 | {
|
---|
483 | /** The RVA of the page/block the following ase relocations applies to. */
|
---|
484 | uint32_t VirtualAddress;
|
---|
485 | /** The size of this relocation block, including this header. */
|
---|
486 | uint32_t SizeOfBlock;
|
---|
487 | } IMAGE_BASE_RELOCATION;
|
---|
488 | AssertCompileSize(IMAGE_BASE_RELOCATION, 8);
|
---|
489 | typedef IMAGE_BASE_RELOCATION *PIMAGE_BASE_RELOCATION;
|
---|
490 | typedef IMAGE_BASE_RELOCATION const *PCIMAGE_BASE_RELOCATION;
|
---|
491 |
|
---|
492 | /** @name IMAGE_REL_BASED_XXX - PE base relocations.
|
---|
493 | * Found in the IMAGE_DIRECTORY_ENTRY_BASERELOC data directory.
|
---|
494 | * @{ */
|
---|
495 | #define IMAGE_REL_BASED_ABSOLUTE UINT16_C(0x0)
|
---|
496 | #define IMAGE_REL_BASED_HIGH UINT16_C(0x1)
|
---|
497 | #define IMAGE_REL_BASED_LOW UINT16_C(0x2)
|
---|
498 | #define IMAGE_REL_BASED_HIGHLOW UINT16_C(0x3)
|
---|
499 | #define IMAGE_REL_BASED_HIGHADJ UINT16_C(0x4)
|
---|
500 | #define IMAGE_REL_BASED_MIPS_JMPADDR UINT16_C(0x5)
|
---|
501 | #define IMAGE_REL_BASED_MIPS_JMPADDR16 UINT16_C(0x9)
|
---|
502 | #define IMAGE_REL_BASED_IA64_IMM64 UINT16_C(0x9)
|
---|
503 | #define IMAGE_REL_BASED_DIR64 UINT16_C(0xa)
|
---|
504 | #define IMAGE_REL_BASED_HIGH3ADJ UINT16_C(0xb)
|
---|
505 | /** @} */
|
---|
506 |
|
---|
507 | /**
|
---|
508 | * PE export directory entry.
|
---|
509 | */
|
---|
510 | typedef struct _IMAGE_EXPORT_DIRECTORY
|
---|
511 | {
|
---|
512 | uint32_t Characteristics;
|
---|
513 | uint32_t TimeDateStamp;
|
---|
514 | uint16_t MajorVersion;
|
---|
515 | uint16_t MinorVersion;
|
---|
516 | uint32_t Name;
|
---|
517 | uint32_t Base;
|
---|
518 | uint32_t NumberOfFunctions;
|
---|
519 | uint32_t NumberOfNames;
|
---|
520 | uint32_t AddressOfFunctions;
|
---|
521 | uint32_t AddressOfNames;
|
---|
522 | uint32_t AddressOfNameOrdinals;
|
---|
523 | } IMAGE_EXPORT_DIRECTORY;
|
---|
524 | AssertCompileSize(IMAGE_EXPORT_DIRECTORY, 40);
|
---|
525 | typedef IMAGE_EXPORT_DIRECTORY *PIMAGE_EXPORT_DIRECTORY;
|
---|
526 | typedef IMAGE_EXPORT_DIRECTORY const *PCIMAGE_EXPORT_DIRECTORY;
|
---|
527 |
|
---|
528 |
|
---|
529 | /**
|
---|
530 | * PE import directory entry.
|
---|
531 | */
|
---|
532 | typedef struct _IMAGE_IMPORT_DESCRIPTOR
|
---|
533 | {
|
---|
534 | union
|
---|
535 | {
|
---|
536 | uint32_t Characteristics;
|
---|
537 | uint32_t OriginalFirstThunk;
|
---|
538 | } u;
|
---|
539 | uint32_t TimeDateStamp;
|
---|
540 | uint32_t ForwarderChain;
|
---|
541 | uint32_t Name;
|
---|
542 | uint32_t FirstThunk;
|
---|
543 | } IMAGE_IMPORT_DESCRIPTOR;
|
---|
544 | AssertCompileSize(IMAGE_IMPORT_DESCRIPTOR, 20);
|
---|
545 | typedef IMAGE_IMPORT_DESCRIPTOR *PIMAGE_IMPORT_DESCRIPTOR;
|
---|
546 | typedef IMAGE_IMPORT_DESCRIPTOR const *PCIMAGE_IMPORT_DESCRIPTOR;
|
---|
547 |
|
---|
548 | /**
|
---|
549 | * Something we currently don't make use of...
|
---|
550 | */
|
---|
551 | typedef struct _IMAGE_IMPORT_BY_NAME
|
---|
552 | {
|
---|
553 | uint16_t Hint;
|
---|
554 | uint8_t Name[1];
|
---|
555 | } IMAGE_IMPORT_BY_NAME;
|
---|
556 | AssertCompileSize(IMAGE_IMPORT_BY_NAME, 4);
|
---|
557 | typedef IMAGE_IMPORT_BY_NAME *PIMAGE_IMPORT_BY_NAME;
|
---|
558 | typedef IMAGE_IMPORT_BY_NAME const *PCIMAGE_IMPORT_BY_NAME;
|
---|
559 |
|
---|
560 |
|
---|
561 | #if 0
|
---|
562 | /* The image_thunk_data32/64 structures are not very helpful except for getting RSI.
|
---|
563 | keep them around till all the code has been converted. */
|
---|
564 | typedef struct _IMAGE_THUNK_DATA64
|
---|
565 | {
|
---|
566 | union
|
---|
567 | {
|
---|
568 | uint64_t ForwarderString;
|
---|
569 | uint64_t Function;
|
---|
570 | uint64_t Ordinal;
|
---|
571 | uint64_t AddressOfData;
|
---|
572 | } u1;
|
---|
573 | } IMAGE_THUNK_DATA64;
|
---|
574 | typedef IMAGE_THUNK_DATA64 *PIMAGE_THUNK_DATA64;
|
---|
575 | typedef IMAGE_THUNK_DATA64 const *PCIMAGE_THUNK_DATA64;
|
---|
576 |
|
---|
577 | typedef struct _IMAGE_THUNK_DATA32
|
---|
578 | {
|
---|
579 | union
|
---|
580 | {
|
---|
581 | uint32_t ForwarderString;
|
---|
582 | uint32_t Function;
|
---|
583 | uint32_t Ordinal;
|
---|
584 | uint32_t AddressOfData;
|
---|
585 | } u1;
|
---|
586 | } IMAGE_THUNK_DATA32;
|
---|
587 | typedef IMAGE_THUNK_DATA32 *PIMAGE_THUNK_DATA32;
|
---|
588 | typedef IMAGE_THUNK_DATA32 const *PCIMAGE_THUNK_DATA32;
|
---|
589 | #endif
|
---|
590 |
|
---|
591 | /** @name PE import directory macros.
|
---|
592 | * @{ */
|
---|
593 | #define IMAGE_ORDINAL_FLAG32 UINT32_C(0x80000000)
|
---|
594 | #define IMAGE_ORDINAL32(ord) ((ord) & UINT32_C(0xffff))
|
---|
595 | #define IMAGE_SNAP_BY_ORDINAL32(ord) (!!((ord) & IMAGE_ORDINAL_FLAG32))
|
---|
596 |
|
---|
597 | #define IMAGE_ORDINAL_FLAG64 UINT64_C(0x8000000000000000)
|
---|
598 | #define IMAGE_ORDINAL64(ord) ((ord) & UINT32_C(0xffff))
|
---|
599 | #define IMAGE_SNAP_BY_ORDINAL64(ord) (!!((ord) & IMAGE_ORDINAL_FLAG64))
|
---|
600 | /** @} */
|
---|
601 |
|
---|
602 | /** @name PE Resource directory
|
---|
603 | * @{ */
|
---|
604 | typedef struct _IMAGE_RESOURCE_DIRECTORY
|
---|
605 | {
|
---|
606 | uint32_t Characteristics;
|
---|
607 | uint32_t TimeDateStamp;
|
---|
608 | uint16_t MajorVersion;
|
---|
609 | uint16_t MinorVersion;
|
---|
610 | uint16_t NumberOfNamedEntries;
|
---|
611 | uint16_t NumberOfIdEntries;
|
---|
612 | } IMAGE_RESOURCE_DIRECTORY;
|
---|
613 | typedef IMAGE_RESOURCE_DIRECTORY *PIMAGE_RESOURCE_DIRECTORY;
|
---|
614 | typedef IMAGE_RESOURCE_DIRECTORY const *PCIMAGE_RESOURCE_DIRECTORY;
|
---|
615 |
|
---|
616 | typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY
|
---|
617 | {
|
---|
618 | union
|
---|
619 | {
|
---|
620 | struct
|
---|
621 | {
|
---|
622 | uint32_t NameOffset : 31;
|
---|
623 | uint32_t NameIsString : 1; /**< IMAGE_RESOURCE_NAME_IS_STRING */
|
---|
624 | } s;
|
---|
625 | uint32_t Name;
|
---|
626 | uint16_t Id;
|
---|
627 | } u;
|
---|
628 | union
|
---|
629 | {
|
---|
630 | struct
|
---|
631 | {
|
---|
632 | uint32_t OffsetToDirectory : 31;
|
---|
633 | uint32_t DataIsDirectory : 1; /**< IMAGE_RESOURCE_DATA_IS_DIRECTORY*/
|
---|
634 | } s2;
|
---|
635 | uint32_t OffsetToData;
|
---|
636 | } u2;
|
---|
637 | } IMAGE_RESOURCE_DIRECTORY_ENTRY;
|
---|
638 | typedef IMAGE_RESOURCE_DIRECTORY_ENTRY *PIMAGE_RESOURCE_DIRECTORY_ENTRY;
|
---|
639 | typedef IMAGE_RESOURCE_DIRECTORY_ENTRY const *PCIMAGE_RESOURCE_DIRECTORY_ENTRY;
|
---|
640 |
|
---|
641 | #define IMAGE_RESOURCE_NAME_IS_STRING UINT32_C(0x80000000)
|
---|
642 | #define IMAGE_RESOURCE_DATA_IS_DIRECTORY UINT32_C(0x80000000)
|
---|
643 |
|
---|
644 | typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING
|
---|
645 | {
|
---|
646 | uint16_t Length;
|
---|
647 | char NameString[1];
|
---|
648 | } IMAGE_RESOURCE_DIRECTORY_STRING;
|
---|
649 | typedef IMAGE_RESOURCE_DIRECTORY_STRING *PIMAGE_RESOURCE_DIRECTORY_STRING;
|
---|
650 | typedef IMAGE_RESOURCE_DIRECTORY_STRING const *PCIMAGE_RESOURCE_DIRECTORY_STRING;
|
---|
651 |
|
---|
652 |
|
---|
653 | typedef struct _IMAGE_RESOURCE_DIR_STRING_U
|
---|
654 | {
|
---|
655 | uint16_t Length;
|
---|
656 | RTUTF16 NameString[1];
|
---|
657 | } IMAGE_RESOURCE_DIR_STRING_U;
|
---|
658 | typedef IMAGE_RESOURCE_DIR_STRING_U *PIMAGE_RESOURCE_DIR_STRING_U;
|
---|
659 | typedef IMAGE_RESOURCE_DIR_STRING_U const *PCIMAGE_RESOURCE_DIR_STRING_U;
|
---|
660 |
|
---|
661 |
|
---|
662 | typedef struct _IMAGE_RESOURCE_DATA_ENTRY
|
---|
663 | {
|
---|
664 | uint32_t OffsetToData;
|
---|
665 | uint32_t Size;
|
---|
666 | uint32_t CodePage;
|
---|
667 | uint32_t Reserved;
|
---|
668 | } IMAGE_RESOURCE_DATA_ENTRY;
|
---|
669 | typedef IMAGE_RESOURCE_DATA_ENTRY *PIMAGE_RESOURCE_DATA_ENTRY;
|
---|
670 | typedef IMAGE_RESOURCE_DATA_ENTRY const *PCIMAGE_RESOURCE_DATA_ENTRY;
|
---|
671 |
|
---|
672 | /** @} */
|
---|
673 |
|
---|
674 | /** @name Image exception information
|
---|
675 | * @{ */
|
---|
676 |
|
---|
677 | /** This structure is used by AMD64 and "Itanic".
|
---|
678 | * MIPS uses a different one. ARM, SH3, SH4 and PPC on WinCE also uses a different one. */
|
---|
679 | typedef struct _IMAGE_RUNTIME_FUNCTION_ENTRY
|
---|
680 | {
|
---|
681 | uint32_t BeginAddress;
|
---|
682 | uint32_t EndAddress;
|
---|
683 | uint32_t UnwindInfoAddress;
|
---|
684 | } IMAGE_RUNTIME_FUNCTION_ENTRY;
|
---|
685 | AssertCompileSize(IMAGE_RUNTIME_FUNCTION_ENTRY, 12);
|
---|
686 | typedef IMAGE_RUNTIME_FUNCTION_ENTRY *PIMAGE_RUNTIME_FUNCTION_ENTRY;
|
---|
687 | typedef IMAGE_RUNTIME_FUNCTION_ENTRY const *PCIMAGE_RUNTIME_FUNCTION_ENTRY;
|
---|
688 |
|
---|
689 | /**
|
---|
690 | * An unwind code for AMD64 and ARM64.
|
---|
691 | *
|
---|
692 | * @note Also known as UNWIND_CODE or _UNWIND_CODE.
|
---|
693 | */
|
---|
694 | typedef union IMAGE_UNWIND_CODE
|
---|
695 | {
|
---|
696 | struct
|
---|
697 | {
|
---|
698 | /** The prolog offset where the change takes effect.
|
---|
699 | * This means the instruction following the one being described. */
|
---|
700 | uint8_t CodeOffset;
|
---|
701 | /** Unwind opcode.
|
---|
702 | * For AMD64 see IMAGE_AMD64_UNWIND_OP_CODES. */
|
---|
703 | RT_GCC_EXTENSION uint8_t UnwindOp : 4;
|
---|
704 | /** Opcode specific. */
|
---|
705 | RT_GCC_EXTENSION uint8_t OpInfo : 4;
|
---|
706 | } u;
|
---|
707 | uint16_t FrameOffset;
|
---|
708 | } IMAGE_UNWIND_CODE;
|
---|
709 | AssertCompileSize(IMAGE_UNWIND_CODE, 2);
|
---|
710 |
|
---|
711 | /**
|
---|
712 | * Unwind information for AMD64 and ARM64.
|
---|
713 | *
|
---|
714 | * Pointed to by IMAGE_RUNTIME_FUNCTION_ENTRY::UnwindInfoAddress,
|
---|
715 | *
|
---|
716 | * @note Also known as UNWIND_INFO or _UNWIND_INFO.
|
---|
717 | */
|
---|
718 | typedef struct IMAGE_UNWIND_INFO
|
---|
719 | {
|
---|
720 | /** Version, currently 1 or 2. The latter if IMAGE_AMD64_UWOP_EPILOG is used. */
|
---|
721 | RT_GCC_EXTENSION uint8_t Version : 3;
|
---|
722 | /** IMAGE_UNW_FLAG_XXX */
|
---|
723 | RT_GCC_EXTENSION uint8_t Flags : 5;
|
---|
724 | /** Size of function prolog. */
|
---|
725 | uint8_t SizeOfProlog;
|
---|
726 | /** Number of opcodes in aOpcodes. */
|
---|
727 | uint8_t CountOfCodes;
|
---|
728 | /** Initial frame register. */
|
---|
729 | RT_GCC_EXTENSION uint8_t FrameRegister : 4;
|
---|
730 | /** Scaled frame register offset. */
|
---|
731 | RT_GCC_EXTENSION uint8_t FrameOffset : 4;
|
---|
732 | /** Unwind opcodes. */
|
---|
733 | RT_FLEXIBLE_ARRAY_EXTENSION
|
---|
734 | IMAGE_UNWIND_CODE aOpcodes[RT_FLEXIBLE_ARRAY];
|
---|
735 | } IMAGE_UNWIND_INFO;
|
---|
736 | AssertCompileMemberOffset(IMAGE_UNWIND_INFO, aOpcodes, 4);
|
---|
737 | typedef IMAGE_UNWIND_INFO *PIMAGE_UNWIND_INFO;
|
---|
738 | typedef IMAGE_UNWIND_INFO const *PCIMAGE_UNWIND_INFO;
|
---|
739 |
|
---|
740 | /** IMAGE_UNW_FLAGS_XXX - IMAGE_UNWIND_INFO::Flags.
|
---|
741 | * @{ */
|
---|
742 | /** No handler.
|
---|
743 | * @note Also know as UNW_FLAG_NHANDLER. */
|
---|
744 | #define IMAGE_UNW_FLAGS_NHANDLER 0
|
---|
745 | /** Have exception handler (RVA after codes, dword aligned.)
|
---|
746 | * @note Also know as UNW_FLAG_NHANDLER. */
|
---|
747 | #define IMAGE_UNW_FLAGS_EHANDLER 1
|
---|
748 | /** Have unwind handler (RVA after codes, dword aligned.)
|
---|
749 | * @note Also know as UNW_FLAG_NHANDLER. */
|
---|
750 | #define IMAGE_UNW_FLAGS_UHANDLER 2
|
---|
751 | /** Set if not primary unwind info for a function. An
|
---|
752 | * IMAGE_RUNTIME_FUNCTION_ENTRY giving the chained unwind info follows the
|
---|
753 | * aOpcodes array at a dword aligned offset. */
|
---|
754 | #define IMAGE_UNW_FLAGS_CHAININFO 4
|
---|
755 | /** @} */
|
---|
756 |
|
---|
757 | /**
|
---|
758 | * AMD64 unwind opcodes.
|
---|
759 | */
|
---|
760 | typedef enum IMAGE_AMD64_UNWIND_OP_CODES
|
---|
761 | {
|
---|
762 | /** Push non-volatile register (OpInfo).
|
---|
763 | * YASM: [pushreg reg]
|
---|
764 | * MASM: .PUSHREG reg */
|
---|
765 | IMAGE_AMD64_UWOP_PUSH_NONVOL = 0,
|
---|
766 | /** Stack allocation: Size stored in scaled in the next slot if OpInfo == 0,
|
---|
767 | * otherwise stored unscaled in the next two slots.
|
---|
768 | * YASM: [allocstack size]
|
---|
769 | * MASM: .ALLOCSTACK size */
|
---|
770 | IMAGE_AMD64_UWOP_ALLOC_LARGE,
|
---|
771 | /** Stack allocation: OpInfo = size / 8 - 1.
|
---|
772 | * YASM: [allocstack size]
|
---|
773 | * MASM: .ALLOCSTACK size */
|
---|
774 | IMAGE_AMD64_UWOP_ALLOC_SMALL,
|
---|
775 | /** Set frame pointer register: RSP + FrameOffset * 16.
|
---|
776 | * YASM: [setframe reg, offset]
|
---|
777 | * MASM: .SETFRAME reg, offset
|
---|
778 | * @code
|
---|
779 | * LEA RBP, [RSP + 20h]
|
---|
780 | * [setframe RBP, 20h]
|
---|
781 | * @endcode */
|
---|
782 | IMAGE_AMD64_UWOP_SET_FPREG,
|
---|
783 | /** Save non-volatile register (OpInfo) on stack (RSP/FP + next slot).
|
---|
784 | * YASM: [savereg reg, offset]
|
---|
785 | * MASM: .SAVEREG reg, offset */
|
---|
786 | IMAGE_AMD64_UWOP_SAVE_NONVOL,
|
---|
787 | /** Save non-volatile register (OpInfo) on stack (RSP/FP + next two slots).
|
---|
788 | * YASM: [savereg reg, offset]
|
---|
789 | * MASM: .SAVEREG reg, offset */
|
---|
790 | IMAGE_AMD64_UWOP_SAVE_NONVOL_FAR,
|
---|
791 | /** Epilog info, version 2+.
|
---|
792 | *
|
---|
793 | * The first time this opcode is used, the CodeOffset gives the size of the
|
---|
794 | * epilog and bit 0 of the OpInfo field indicates that there is only one
|
---|
795 | * epilog at the very end of the function.
|
---|
796 | *
|
---|
797 | * Subsequent uses of this opcode specifies epilog start offsets relative to
|
---|
798 | * the end of the function, using CodeOffset for the 8 lower bits and OpInfo
|
---|
799 | * for bits 8 thru 11.
|
---|
800 | *
|
---|
801 | * The compiler seems to stack allocations and register saving opcodes and
|
---|
802 | * indicates the location mirroring the first IMAGE_AMD64_UWOP_PUSH_NONVOL. */
|
---|
803 | IMAGE_AMD64_UWOP_EPILOG,
|
---|
804 | /** Undefined. */
|
---|
805 | IMAGE_AMD64_UWOP_RESERVED_7,
|
---|
806 | /** Save 128-bit XMM register (OpInfo) on stack (RSP/FP + next slot).
|
---|
807 | * YASM: [savexmm128 reg, offset]
|
---|
808 | * MASM: .SAVEXMM128 reg, offset */
|
---|
809 | IMAGE_AMD64_UWOP_SAVE_XMM128,
|
---|
810 | /** Save 128-bit XMM register (OpInfo) on stack (RSP/FP + next two slots).
|
---|
811 | * YASM: [savexmm128 reg, offset]
|
---|
812 | * MASM: .SAVEXMM128 reg, offset */
|
---|
813 | IMAGE_AMD64_UWOP_SAVE_XMM128_FAR,
|
---|
814 | /** IRET frame, OpInfo serves as error code indicator.
|
---|
815 | * YASM: [pushframe with-code]
|
---|
816 | * MASM: .pushframe with-code */
|
---|
817 | IMAGE_AMD64_UWOP_PUSH_MACHFRAME
|
---|
818 | } IMAGE_AMD64_UNWIND_OP_CODES;
|
---|
819 | /** @} */
|
---|
820 |
|
---|
821 |
|
---|
822 |
|
---|
823 | /** @name Image load config directories
|
---|
824 | * @{ */
|
---|
825 |
|
---|
826 | /** @since Windows 10 (preview 9879) */
|
---|
827 | typedef struct _IMAGE_LOAD_CONFIG_CODE_INTEGRITY
|
---|
828 | {
|
---|
829 | uint16_t Flags;
|
---|
830 | uint16_t Catalog;
|
---|
831 | uint32_t CatalogOffset;
|
---|
832 | uint32_t Reserved;
|
---|
833 | } IMAGE_LOAD_CONFIG_CODE_INTEGRITY;
|
---|
834 | AssertCompileSize(IMAGE_LOAD_CONFIG_CODE_INTEGRITY, 12);
|
---|
835 | typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY *PIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
|
---|
836 | typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY const *PCIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
|
---|
837 |
|
---|
838 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V1
|
---|
839 | {
|
---|
840 | uint32_t Size;
|
---|
841 | uint32_t TimeDateStamp;
|
---|
842 | uint16_t MajorVersion;
|
---|
843 | uint16_t MinorVersion;
|
---|
844 | uint32_t GlobalFlagsClear;
|
---|
845 | uint32_t GlobalFlagsSet;
|
---|
846 | uint32_t CriticalSectionDefaultTimeout;
|
---|
847 | uint32_t DeCommitFreeBlockThreshold;
|
---|
848 | uint32_t DeCommitTotalFreeThreshold;
|
---|
849 | uint32_t LockPrefixTable;
|
---|
850 | uint32_t MaximumAllocationSize;
|
---|
851 | uint32_t VirtualMemoryThreshold;
|
---|
852 | uint32_t ProcessHeapFlags;
|
---|
853 | uint32_t ProcessAffinityMask;
|
---|
854 | uint16_t CSDVersion;
|
---|
855 | uint16_t DependentLoadFlags;
|
---|
856 | uint32_t EditList;
|
---|
857 | uint32_t SecurityCookie;
|
---|
858 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V1;
|
---|
859 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V1, 0x40);
|
---|
860 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
|
---|
861 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
|
---|
862 |
|
---|
863 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V2
|
---|
864 | {
|
---|
865 | uint32_t Size;
|
---|
866 | uint32_t TimeDateStamp;
|
---|
867 | uint16_t MajorVersion;
|
---|
868 | uint16_t MinorVersion;
|
---|
869 | uint32_t GlobalFlagsClear;
|
---|
870 | uint32_t GlobalFlagsSet;
|
---|
871 | uint32_t CriticalSectionDefaultTimeout;
|
---|
872 | uint32_t DeCommitFreeBlockThreshold;
|
---|
873 | uint32_t DeCommitTotalFreeThreshold;
|
---|
874 | uint32_t LockPrefixTable;
|
---|
875 | uint32_t MaximumAllocationSize;
|
---|
876 | uint32_t VirtualMemoryThreshold;
|
---|
877 | uint32_t ProcessHeapFlags;
|
---|
878 | uint32_t ProcessAffinityMask;
|
---|
879 | uint16_t CSDVersion;
|
---|
880 | uint16_t DependentLoadFlags;
|
---|
881 | uint32_t EditList;
|
---|
882 | uint32_t SecurityCookie;
|
---|
883 | uint32_t SEHandlerTable;
|
---|
884 | uint32_t SEHandlerCount;
|
---|
885 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V2;
|
---|
886 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V2, 0x48);
|
---|
887 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
|
---|
888 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
|
---|
889 |
|
---|
890 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V3
|
---|
891 | {
|
---|
892 | uint32_t Size;
|
---|
893 | uint32_t TimeDateStamp;
|
---|
894 | uint16_t MajorVersion;
|
---|
895 | uint16_t MinorVersion;
|
---|
896 | uint32_t GlobalFlagsClear;
|
---|
897 | uint32_t GlobalFlagsSet;
|
---|
898 | uint32_t CriticalSectionDefaultTimeout;
|
---|
899 | uint32_t DeCommitFreeBlockThreshold;
|
---|
900 | uint32_t DeCommitTotalFreeThreshold;
|
---|
901 | uint32_t LockPrefixTable;
|
---|
902 | uint32_t MaximumAllocationSize;
|
---|
903 | uint32_t VirtualMemoryThreshold;
|
---|
904 | uint32_t ProcessHeapFlags;
|
---|
905 | uint32_t ProcessAffinityMask;
|
---|
906 | uint16_t CSDVersion;
|
---|
907 | uint16_t DependentLoadFlags;
|
---|
908 | uint32_t EditList;
|
---|
909 | uint32_t SecurityCookie;
|
---|
910 | uint32_t SEHandlerTable;
|
---|
911 | uint32_t SEHandlerCount;
|
---|
912 | uint32_t GuardCFCCheckFunctionPointer;
|
---|
913 | uint32_t GuardCFDispatchFunctionPointer;
|
---|
914 | uint32_t GuardCFFunctionTable;
|
---|
915 | uint32_t GuardCFFunctionCount;
|
---|
916 | uint32_t GuardFlags;
|
---|
917 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V3;
|
---|
918 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V3, 0x5c);
|
---|
919 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
|
---|
920 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
|
---|
921 |
|
---|
922 | /** @since Windows 10 (preview 9879) */
|
---|
923 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V4
|
---|
924 | {
|
---|
925 | uint32_t Size;
|
---|
926 | uint32_t TimeDateStamp;
|
---|
927 | uint16_t MajorVersion;
|
---|
928 | uint16_t MinorVersion;
|
---|
929 | uint32_t GlobalFlagsClear;
|
---|
930 | uint32_t GlobalFlagsSet;
|
---|
931 | uint32_t CriticalSectionDefaultTimeout;
|
---|
932 | uint32_t DeCommitFreeBlockThreshold;
|
---|
933 | uint32_t DeCommitTotalFreeThreshold;
|
---|
934 | uint32_t LockPrefixTable;
|
---|
935 | uint32_t MaximumAllocationSize;
|
---|
936 | uint32_t VirtualMemoryThreshold;
|
---|
937 | uint32_t ProcessHeapFlags;
|
---|
938 | uint32_t ProcessAffinityMask;
|
---|
939 | uint16_t CSDVersion;
|
---|
940 | uint16_t DependentLoadFlags;
|
---|
941 | uint32_t EditList;
|
---|
942 | uint32_t SecurityCookie;
|
---|
943 | uint32_t SEHandlerTable;
|
---|
944 | uint32_t SEHandlerCount;
|
---|
945 | uint32_t GuardCFCCheckFunctionPointer;
|
---|
946 | uint32_t GuardCFDispatchFunctionPointer;
|
---|
947 | uint32_t GuardCFFunctionTable;
|
---|
948 | uint32_t GuardCFFunctionCount;
|
---|
949 | uint32_t GuardFlags;
|
---|
950 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
|
---|
951 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V4;
|
---|
952 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V4, 0x68);
|
---|
953 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
|
---|
954 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
|
---|
955 |
|
---|
956 | /** @since Windows 10 build 14286 (or maybe earlier). */
|
---|
957 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V5
|
---|
958 | {
|
---|
959 | uint32_t Size;
|
---|
960 | uint32_t TimeDateStamp;
|
---|
961 | uint16_t MajorVersion;
|
---|
962 | uint16_t MinorVersion;
|
---|
963 | uint32_t GlobalFlagsClear;
|
---|
964 | uint32_t GlobalFlagsSet;
|
---|
965 | uint32_t CriticalSectionDefaultTimeout;
|
---|
966 | uint32_t DeCommitFreeBlockThreshold;
|
---|
967 | uint32_t DeCommitTotalFreeThreshold;
|
---|
968 | uint32_t LockPrefixTable;
|
---|
969 | uint32_t MaximumAllocationSize;
|
---|
970 | uint32_t VirtualMemoryThreshold;
|
---|
971 | uint32_t ProcessHeapFlags;
|
---|
972 | uint32_t ProcessAffinityMask;
|
---|
973 | uint16_t CSDVersion;
|
---|
974 | uint16_t DependentLoadFlags;
|
---|
975 | uint32_t EditList;
|
---|
976 | uint32_t SecurityCookie;
|
---|
977 | uint32_t SEHandlerTable;
|
---|
978 | uint32_t SEHandlerCount;
|
---|
979 | uint32_t GuardCFCCheckFunctionPointer;
|
---|
980 | uint32_t GuardCFDispatchFunctionPointer;
|
---|
981 | uint32_t GuardCFFunctionTable;
|
---|
982 | uint32_t GuardCFFunctionCount;
|
---|
983 | uint32_t GuardFlags;
|
---|
984 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
|
---|
985 | uint32_t GuardAddressTakenIatEntryTable;
|
---|
986 | uint32_t GuardAddressTakenIatEntryCount;
|
---|
987 | uint32_t GuardLongJumpTargetTable;
|
---|
988 | uint32_t GuardLongJumpTargetCount;
|
---|
989 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V5;
|
---|
990 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V5, 0x78);
|
---|
991 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V5 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V5;
|
---|
992 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V5 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V5;
|
---|
993 |
|
---|
994 | /** @since Windows 10 build 14383 (or maybe earlier). */
|
---|
995 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V6
|
---|
996 | {
|
---|
997 | uint32_t Size; /**< 0x00 */
|
---|
998 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
999 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1000 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1001 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1002 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1003 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1004 | uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1005 | uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
|
---|
1006 | uint32_t LockPrefixTable; /**< 0x20 */
|
---|
1007 | uint32_t MaximumAllocationSize; /**< 0x24 */
|
---|
1008 | uint32_t VirtualMemoryThreshold; /**< 0x28 */
|
---|
1009 | uint32_t ProcessHeapFlags; /**< 0x2c */
|
---|
1010 | uint32_t ProcessAffinityMask; /**< 0x30 */
|
---|
1011 | uint16_t CSDVersion; /**< 0x34 */
|
---|
1012 | uint16_t DependentLoadFlags; /**< 0x36 */
|
---|
1013 | uint32_t EditList; /**< 0x38 */
|
---|
1014 | uint32_t SecurityCookie; /**< 0x3c */
|
---|
1015 | uint32_t SEHandlerTable; /**< 0x40 */
|
---|
1016 | uint32_t SEHandlerCount; /**< 0x44 */
|
---|
1017 | uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
|
---|
1018 | uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
|
---|
1019 | uint32_t GuardCFFunctionTable; /**< 0x50 */
|
---|
1020 | uint32_t GuardCFFunctionCount; /**< 0x54 */
|
---|
1021 | uint32_t GuardFlags; /**< 0x58 */
|
---|
1022 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
|
---|
1023 | uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
|
---|
1024 | uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
|
---|
1025 | uint32_t GuardLongJumpTargetTable; /**< 0x70 */
|
---|
1026 | uint32_t GuardLongJumpTargetCount; /**< 0x74 */
|
---|
1027 | uint32_t DynamicValueRelocTable; /**< 0x78 */
|
---|
1028 | uint32_t HybridMetadataPointer; /**< 0x7c */
|
---|
1029 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V6;
|
---|
1030 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V6, 0x80);
|
---|
1031 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V6 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V6;
|
---|
1032 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V6 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V6;
|
---|
1033 |
|
---|
1034 | /** @since Windows 10 build 14901 (or maybe earlier). */
|
---|
1035 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V7
|
---|
1036 | {
|
---|
1037 | uint32_t Size; /**< 0x00 */
|
---|
1038 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1039 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1040 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1041 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1042 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1043 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1044 | uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1045 | uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
|
---|
1046 | uint32_t LockPrefixTable; /**< 0x20 */
|
---|
1047 | uint32_t MaximumAllocationSize; /**< 0x24 */
|
---|
1048 | uint32_t VirtualMemoryThreshold; /**< 0x28 */
|
---|
1049 | uint32_t ProcessHeapFlags; /**< 0x2c */
|
---|
1050 | uint32_t ProcessAffinityMask; /**< 0x30 */
|
---|
1051 | uint16_t CSDVersion; /**< 0x34 */
|
---|
1052 | uint16_t DependentLoadFlags; /**< 0x36 */
|
---|
1053 | uint32_t EditList; /**< 0x38 */
|
---|
1054 | uint32_t SecurityCookie; /**< 0x3c */
|
---|
1055 | uint32_t SEHandlerTable; /**< 0x40 */
|
---|
1056 | uint32_t SEHandlerCount; /**< 0x44 */
|
---|
1057 | uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
|
---|
1058 | uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
|
---|
1059 | uint32_t GuardCFFunctionTable; /**< 0x50 */
|
---|
1060 | uint32_t GuardCFFunctionCount; /**< 0x54 */
|
---|
1061 | uint32_t GuardFlags; /**< 0x58 */
|
---|
1062 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
|
---|
1063 | uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
|
---|
1064 | uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
|
---|
1065 | uint32_t GuardLongJumpTargetTable; /**< 0x70 */
|
---|
1066 | uint32_t GuardLongJumpTargetCount; /**< 0x74 */
|
---|
1067 | uint32_t DynamicValueRelocTable; /**< 0x78 */
|
---|
1068 | uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
|
---|
1069 | uint32_t GuardRFFailureRoutine; /**< 0x80 */
|
---|
1070 | uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
|
---|
1071 | uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
|
---|
1072 | uint16_t DynamicValueRelocTableSection; /**< 0x8c */
|
---|
1073 | uint16_t Reserved2; /**< 0x8e */
|
---|
1074 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V7;
|
---|
1075 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V7, 0x90);
|
---|
1076 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V7 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V7;
|
---|
1077 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V7 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V7;
|
---|
1078 |
|
---|
1079 | /** @since Windows 10 build 15002 (or maybe earlier). */
|
---|
1080 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V8
|
---|
1081 | {
|
---|
1082 | uint32_t Size; /**< 0x00 */
|
---|
1083 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1084 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1085 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1086 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1087 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1088 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1089 | uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1090 | uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
|
---|
1091 | uint32_t LockPrefixTable; /**< 0x20 */
|
---|
1092 | uint32_t MaximumAllocationSize; /**< 0x24 */
|
---|
1093 | uint32_t VirtualMemoryThreshold; /**< 0x28 */
|
---|
1094 | uint32_t ProcessHeapFlags; /**< 0x2c */
|
---|
1095 | uint32_t ProcessAffinityMask; /**< 0x30 */
|
---|
1096 | uint16_t CSDVersion; /**< 0x34 */
|
---|
1097 | uint16_t DependentLoadFlags; /**< 0x36 */
|
---|
1098 | uint32_t EditList; /**< 0x38 */
|
---|
1099 | uint32_t SecurityCookie; /**< 0x3c */
|
---|
1100 | uint32_t SEHandlerTable; /**< 0x40 */
|
---|
1101 | uint32_t SEHandlerCount; /**< 0x44 */
|
---|
1102 | uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
|
---|
1103 | uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
|
---|
1104 | uint32_t GuardCFFunctionTable; /**< 0x50 */
|
---|
1105 | uint32_t GuardCFFunctionCount; /**< 0x54 */
|
---|
1106 | uint32_t GuardFlags; /**< 0x58 */
|
---|
1107 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
|
---|
1108 | uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
|
---|
1109 | uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
|
---|
1110 | uint32_t GuardLongJumpTargetTable; /**< 0x70 */
|
---|
1111 | uint32_t GuardLongJumpTargetCount; /**< 0x74 */
|
---|
1112 | uint32_t DynamicValueRelocTable; /**< 0x78 */
|
---|
1113 | uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
|
---|
1114 | uint32_t GuardRFFailureRoutine; /**< 0x80 */
|
---|
1115 | uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
|
---|
1116 | uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
|
---|
1117 | uint16_t DynamicValueRelocTableSection; /**< 0x8c */
|
---|
1118 | uint16_t Reserved2; /**< 0x8e */
|
---|
1119 | uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
|
---|
1120 | uint32_t HotPatchTableOffset; /**< 0x94 */
|
---|
1121 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V8;
|
---|
1122 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V8, 0x98);
|
---|
1123 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V8 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V8;
|
---|
1124 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V8 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V8;
|
---|
1125 |
|
---|
1126 | /** @since Windows 10 build 16237 (or maybe earlier). */
|
---|
1127 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V9
|
---|
1128 | {
|
---|
1129 | uint32_t Size; /**< 0x00 */
|
---|
1130 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1131 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1132 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1133 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1134 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1135 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1136 | uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1137 | uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
|
---|
1138 | uint32_t LockPrefixTable; /**< 0x20 */
|
---|
1139 | uint32_t MaximumAllocationSize; /**< 0x24 */
|
---|
1140 | uint32_t VirtualMemoryThreshold; /**< 0x28 */
|
---|
1141 | uint32_t ProcessHeapFlags; /**< 0x2c */
|
---|
1142 | uint32_t ProcessAffinityMask; /**< 0x30 */
|
---|
1143 | uint16_t CSDVersion; /**< 0x34 */
|
---|
1144 | uint16_t DependentLoadFlags; /**< 0x36 */
|
---|
1145 | uint32_t EditList; /**< 0x38 */
|
---|
1146 | uint32_t SecurityCookie; /**< 0x3c */
|
---|
1147 | uint32_t SEHandlerTable; /**< 0x40 */
|
---|
1148 | uint32_t SEHandlerCount; /**< 0x44 */
|
---|
1149 | uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
|
---|
1150 | uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
|
---|
1151 | uint32_t GuardCFFunctionTable; /**< 0x50 */
|
---|
1152 | uint32_t GuardCFFunctionCount; /**< 0x54 */
|
---|
1153 | uint32_t GuardFlags; /**< 0x58 */
|
---|
1154 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
|
---|
1155 | uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
|
---|
1156 | uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
|
---|
1157 | uint32_t GuardLongJumpTargetTable; /**< 0x70 */
|
---|
1158 | uint32_t GuardLongJumpTargetCount; /**< 0x74 */
|
---|
1159 | uint32_t DynamicValueRelocTable; /**< 0x78 */
|
---|
1160 | uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
|
---|
1161 | uint32_t GuardRFFailureRoutine; /**< 0x80 */
|
---|
1162 | uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
|
---|
1163 | uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
|
---|
1164 | uint16_t DynamicValueRelocTableSection; /**< 0x8c */
|
---|
1165 | uint16_t Reserved2; /**< 0x8e */
|
---|
1166 | uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
|
---|
1167 | uint32_t HotPatchTableOffset; /**< 0x94 */
|
---|
1168 | uint32_t Reserved3; /**< 0x98 */
|
---|
1169 | uint32_t EnclaveConfigurationPointer; /**< 0x9c */
|
---|
1170 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V9;
|
---|
1171 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V9, 0xa0);
|
---|
1172 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V9 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V9;
|
---|
1173 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V9 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V9;
|
---|
1174 |
|
---|
1175 | /** @since Windows 10 build 18362 (or maybe earlier). */
|
---|
1176 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V10
|
---|
1177 | {
|
---|
1178 | uint32_t Size; /**< 0x00 */
|
---|
1179 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1180 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1181 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1182 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1183 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1184 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1185 | uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1186 | uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
|
---|
1187 | uint32_t LockPrefixTable; /**< 0x20 */
|
---|
1188 | uint32_t MaximumAllocationSize; /**< 0x24 */
|
---|
1189 | uint32_t VirtualMemoryThreshold; /**< 0x28 */
|
---|
1190 | uint32_t ProcessHeapFlags; /**< 0x2c */
|
---|
1191 | uint32_t ProcessAffinityMask; /**< 0x30 */
|
---|
1192 | uint16_t CSDVersion; /**< 0x34 */
|
---|
1193 | uint16_t DependentLoadFlags; /**< 0x36 */
|
---|
1194 | uint32_t EditList; /**< 0x38 */
|
---|
1195 | uint32_t SecurityCookie; /**< 0x3c */
|
---|
1196 | uint32_t SEHandlerTable; /**< 0x40 */
|
---|
1197 | uint32_t SEHandlerCount; /**< 0x44 */
|
---|
1198 | uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
|
---|
1199 | uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
|
---|
1200 | uint32_t GuardCFFunctionTable; /**< 0x50 */
|
---|
1201 | uint32_t GuardCFFunctionCount; /**< 0x54 */
|
---|
1202 | uint32_t GuardFlags; /**< 0x58 */
|
---|
1203 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
|
---|
1204 | uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
|
---|
1205 | uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
|
---|
1206 | uint32_t GuardLongJumpTargetTable; /**< 0x70 */
|
---|
1207 | uint32_t GuardLongJumpTargetCount; /**< 0x74 */
|
---|
1208 | uint32_t DynamicValueRelocTable; /**< 0x78 */
|
---|
1209 | uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
|
---|
1210 | uint32_t GuardRFFailureRoutine; /**< 0x80 */
|
---|
1211 | uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
|
---|
1212 | uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
|
---|
1213 | uint16_t DynamicValueRelocTableSection; /**< 0x8c */
|
---|
1214 | uint16_t Reserved2; /**< 0x8e */
|
---|
1215 | uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
|
---|
1216 | uint32_t HotPatchTableOffset; /**< 0x94 */
|
---|
1217 | uint32_t Reserved3; /**< 0x98 */
|
---|
1218 | uint32_t EnclaveConfigurationPointer; /**< 0x9c */
|
---|
1219 | uint32_t VolatileMetadataPointer; /**< 0xa0 */
|
---|
1220 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V10;
|
---|
1221 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V10, 0xa4);
|
---|
1222 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V10 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V10;
|
---|
1223 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V10 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V10;
|
---|
1224 |
|
---|
1225 | /** @since Windows 10 build 19564 (or maybe earlier). */
|
---|
1226 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V11
|
---|
1227 | {
|
---|
1228 | uint32_t Size; /**< 0x00 */
|
---|
1229 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1230 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1231 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1232 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1233 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1234 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1235 | uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1236 | uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
|
---|
1237 | uint32_t LockPrefixTable; /**< 0x20 */
|
---|
1238 | uint32_t MaximumAllocationSize; /**< 0x24 */
|
---|
1239 | uint32_t VirtualMemoryThreshold; /**< 0x28 */
|
---|
1240 | uint32_t ProcessHeapFlags; /**< 0x2c */
|
---|
1241 | uint32_t ProcessAffinityMask; /**< 0x30 */
|
---|
1242 | uint16_t CSDVersion; /**< 0x34 */
|
---|
1243 | uint16_t DependentLoadFlags; /**< 0x36 */
|
---|
1244 | uint32_t EditList; /**< 0x38 */
|
---|
1245 | uint32_t SecurityCookie; /**< 0x3c */
|
---|
1246 | uint32_t SEHandlerTable; /**< 0x40 */
|
---|
1247 | uint32_t SEHandlerCount; /**< 0x44 */
|
---|
1248 | uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
|
---|
1249 | uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
|
---|
1250 | uint32_t GuardCFFunctionTable; /**< 0x50 */
|
---|
1251 | uint32_t GuardCFFunctionCount; /**< 0x54 */
|
---|
1252 | uint32_t GuardFlags; /**< 0x58 */
|
---|
1253 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
|
---|
1254 | uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
|
---|
1255 | uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
|
---|
1256 | uint32_t GuardLongJumpTargetTable; /**< 0x70 */
|
---|
1257 | uint32_t GuardLongJumpTargetCount; /**< 0x74 */
|
---|
1258 | uint32_t DynamicValueRelocTable; /**< 0x78 */
|
---|
1259 | uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
|
---|
1260 | uint32_t GuardRFFailureRoutine; /**< 0x80 */
|
---|
1261 | uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
|
---|
1262 | uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
|
---|
1263 | uint16_t DynamicValueRelocTableSection; /**< 0x8c */
|
---|
1264 | uint16_t Reserved2; /**< 0x8e */
|
---|
1265 | uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
|
---|
1266 | uint32_t HotPatchTableOffset; /**< 0x94 */
|
---|
1267 | uint32_t Reserved3; /**< 0x98 */
|
---|
1268 | uint32_t EnclaveConfigurationPointer; /**< 0x9c - virtual address */
|
---|
1269 | uint32_t VolatileMetadataPointer; /**< 0xa0 */
|
---|
1270 | uint32_t GuardEHContinuationTable; /**< 0xa4 - virtual address */
|
---|
1271 | uint32_t GuardEHContinuationCount; /**< 0xa8 */
|
---|
1272 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V11;
|
---|
1273 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V11, 0xac);
|
---|
1274 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V11 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V11;
|
---|
1275 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V11 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V11;
|
---|
1276 |
|
---|
1277 | /** @since Visual C++ 2019 / RS5_IMAGE_LOAD_CONFIG_DIRECTORY32. */
|
---|
1278 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V12
|
---|
1279 | {
|
---|
1280 | uint32_t Size; /**< 0x00 */
|
---|
1281 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1282 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1283 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1284 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1285 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1286 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1287 | uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1288 | uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
|
---|
1289 | uint32_t LockPrefixTable; /**< 0x20 */
|
---|
1290 | uint32_t MaximumAllocationSize; /**< 0x24 */
|
---|
1291 | uint32_t VirtualMemoryThreshold; /**< 0x28 */
|
---|
1292 | uint32_t ProcessHeapFlags; /**< 0x2c */
|
---|
1293 | uint32_t ProcessAffinityMask; /**< 0x30 */
|
---|
1294 | uint16_t CSDVersion; /**< 0x34 */
|
---|
1295 | uint16_t DependentLoadFlags; /**< 0x36 */
|
---|
1296 | uint32_t EditList; /**< 0x38 */
|
---|
1297 | uint32_t SecurityCookie; /**< 0x3c */
|
---|
1298 | uint32_t SEHandlerTable; /**< 0x40 */
|
---|
1299 | uint32_t SEHandlerCount; /**< 0x44 */
|
---|
1300 | uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
|
---|
1301 | uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
|
---|
1302 | uint32_t GuardCFFunctionTable; /**< 0x50 */
|
---|
1303 | uint32_t GuardCFFunctionCount; /**< 0x54 */
|
---|
1304 | uint32_t GuardFlags; /**< 0x58 */
|
---|
1305 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
|
---|
1306 | uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
|
---|
1307 | uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
|
---|
1308 | uint32_t GuardLongJumpTargetTable; /**< 0x70 */
|
---|
1309 | uint32_t GuardLongJumpTargetCount; /**< 0x74 */
|
---|
1310 | uint32_t DynamicValueRelocTable; /**< 0x78 */
|
---|
1311 | uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
|
---|
1312 | uint32_t GuardRFFailureRoutine; /**< 0x80 */
|
---|
1313 | uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
|
---|
1314 | uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
|
---|
1315 | uint16_t DynamicValueRelocTableSection; /**< 0x8c */
|
---|
1316 | uint16_t Reserved2; /**< 0x8e */
|
---|
1317 | uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
|
---|
1318 | uint32_t HotPatchTableOffset; /**< 0x94 */
|
---|
1319 | uint32_t Reserved3; /**< 0x98 */
|
---|
1320 | uint32_t EnclaveConfigurationPointer; /**< 0x9c - virtual address */
|
---|
1321 | uint32_t VolatileMetadataPointer; /**< 0xa0 */
|
---|
1322 | uint32_t GuardEHContinuationTable; /**< 0xa4 - virtual address */
|
---|
1323 | uint32_t GuardEHContinuationCount; /**< 0xa8 */
|
---|
1324 | uint32_t GuardXFGCheckFunctionPointer; /**< 0xac */
|
---|
1325 | uint32_t GuardXFGDispatchFunctionPointer; /**< 0xb0 */
|
---|
1326 | uint32_t GuardXFGTableDispatchFunctionPointer; /**< 0xb4 */
|
---|
1327 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V12;
|
---|
1328 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V12, 0xb8);
|
---|
1329 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V12 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V12;
|
---|
1330 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V12 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V12;
|
---|
1331 |
|
---|
1332 | /** @since Visual C++ 2019 16.x (found in 16.11.9) / RS5_IMAGE_LOAD_CONFIG_DIRECTORY32. */
|
---|
1333 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V13
|
---|
1334 | {
|
---|
1335 | uint32_t Size; /**< 0x00 - virtual address */
|
---|
1336 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1337 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1338 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1339 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1340 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1341 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1342 | uint32_t DeCommitFreeBlockThreshold; /**< 0x18 - virtual address */
|
---|
1343 | uint32_t DeCommitTotalFreeThreshold; /**< 0x1c - virtual address */
|
---|
1344 | uint32_t LockPrefixTable; /**< 0x20 */
|
---|
1345 | uint32_t MaximumAllocationSize; /**< 0x24 */
|
---|
1346 | uint32_t VirtualMemoryThreshold; /**< 0x28 - virtual address of pointer variable */
|
---|
1347 | uint32_t ProcessHeapFlags; /**< 0x2c - virtual address of pointer variable */
|
---|
1348 | uint32_t ProcessAffinityMask; /**< 0x30 - virtual address */
|
---|
1349 | uint16_t CSDVersion; /**< 0x34 */
|
---|
1350 | uint16_t DependentLoadFlags; /**< 0x36 */
|
---|
1351 | uint32_t EditList; /**< 0x38 */
|
---|
1352 | uint32_t SecurityCookie; /**< 0x3c - virtual address */
|
---|
1353 | uint32_t SEHandlerTable; /**< 0x40 */
|
---|
1354 | uint32_t SEHandlerCount; /**< 0x44 - virtual address */
|
---|
1355 | uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
|
---|
1356 | uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c - virtual address */
|
---|
1357 | uint32_t GuardCFFunctionTable; /**< 0x50 */
|
---|
1358 | uint32_t GuardCFFunctionCount; /**< 0x54 - virtual address */
|
---|
1359 | uint32_t GuardFlags; /**< 0x58 - virtual address of pointer variable */
|
---|
1360 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
|
---|
1361 | uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 - virtual address */
|
---|
1362 | uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
|
---|
1363 | uint32_t GuardLongJumpTargetTable; /**< 0x70 - virtual address */
|
---|
1364 | uint32_t GuardLongJumpTargetCount; /**< 0x74 */
|
---|
1365 | uint32_t DynamicValueRelocTable; /**< 0x78 - virtual address */
|
---|
1366 | uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
|
---|
1367 | uint32_t GuardRFFailureRoutine; /**< 0x80 - virtual address */
|
---|
1368 | uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 - virtual address of pointer variable */
|
---|
1369 | uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
|
---|
1370 | uint16_t DynamicValueRelocTableSection; /**< 0x8c */
|
---|
1371 | uint16_t Reserved2; /**< 0x8e */
|
---|
1372 | uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 - virtual address of pointer variable */
|
---|
1373 | uint32_t HotPatchTableOffset; /**< 0x94 */
|
---|
1374 | uint32_t Reserved3; /**< 0x98 */
|
---|
1375 | uint32_t EnclaveConfigurationPointer; /**< 0x9c - virtual address of pointer variable */
|
---|
1376 | uint32_t VolatileMetadataPointer; /**< 0xa0 - virtual address of pointer variable */
|
---|
1377 | uint32_t GuardEHContinuationTable; /**< 0xa4 - virtual address */
|
---|
1378 | uint32_t GuardEHContinuationCount; /**< 0xa8 */
|
---|
1379 | uint32_t GuardXFGCheckFunctionPointer; /**< 0xac - virtual address of pointer variable */
|
---|
1380 | uint32_t GuardXFGDispatchFunctionPointer; /**< 0xb0 - virtual address of pointer variable */
|
---|
1381 | uint32_t GuardXFGTableDispatchFunctionPointer; /**< 0xb4 - virtual address of pointer variable */
|
---|
1382 | uint32_t CastGuardOsDeterminedFailureMode; /**< 0xb8 - virtual address */
|
---|
1383 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V13;
|
---|
1384 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V13, 0xbc);
|
---|
1385 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V13 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V13;
|
---|
1386 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V13 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V13;
|
---|
1387 |
|
---|
1388 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V13 IMAGE_LOAD_CONFIG_DIRECTORY32;
|
---|
1389 | typedef PIMAGE_LOAD_CONFIG_DIRECTORY32_V13 PIMAGE_LOAD_CONFIG_DIRECTORY32;
|
---|
1390 | typedef PCIMAGE_LOAD_CONFIG_DIRECTORY32_V13 PCIMAGE_LOAD_CONFIG_DIRECTORY32;
|
---|
1391 |
|
---|
1392 |
|
---|
1393 | /* No _IMAGE_LOAD_CONFIG_DIRECTORY64_V1 exists. */
|
---|
1394 |
|
---|
1395 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V2
|
---|
1396 | {
|
---|
1397 | uint32_t Size;
|
---|
1398 | uint32_t TimeDateStamp;
|
---|
1399 | uint16_t MajorVersion;
|
---|
1400 | uint16_t MinorVersion;
|
---|
1401 | uint32_t GlobalFlagsClear;
|
---|
1402 | uint32_t GlobalFlagsSet;
|
---|
1403 | uint32_t CriticalSectionDefaultTimeout;
|
---|
1404 | uint64_t DeCommitFreeBlockThreshold;
|
---|
1405 | uint64_t DeCommitTotalFreeThreshold;
|
---|
1406 | uint64_t LockPrefixTable;
|
---|
1407 | uint64_t MaximumAllocationSize;
|
---|
1408 | uint64_t VirtualMemoryThreshold;
|
---|
1409 | uint64_t ProcessAffinityMask;
|
---|
1410 | uint32_t ProcessHeapFlags;
|
---|
1411 | uint16_t CSDVersion;
|
---|
1412 | uint16_t DependentLoadFlags;
|
---|
1413 | uint64_t EditList;
|
---|
1414 | uint64_t SecurityCookie;
|
---|
1415 | uint64_t SEHandlerTable;
|
---|
1416 | uint64_t SEHandlerCount;
|
---|
1417 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V2;
|
---|
1418 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V2, 0x70);
|
---|
1419 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
|
---|
1420 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
|
---|
1421 |
|
---|
1422 | #pragma pack(4) /* Why not 8 byte alignment, baka microsofties?!? */
|
---|
1423 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V3
|
---|
1424 | {
|
---|
1425 | uint32_t Size;
|
---|
1426 | uint32_t TimeDateStamp;
|
---|
1427 | uint16_t MajorVersion;
|
---|
1428 | uint16_t MinorVersion;
|
---|
1429 | uint32_t GlobalFlagsClear;
|
---|
1430 | uint32_t GlobalFlagsSet;
|
---|
1431 | uint32_t CriticalSectionDefaultTimeout;
|
---|
1432 | uint64_t DeCommitFreeBlockThreshold;
|
---|
1433 | uint64_t DeCommitTotalFreeThreshold;
|
---|
1434 | uint64_t LockPrefixTable;
|
---|
1435 | uint64_t MaximumAllocationSize;
|
---|
1436 | uint64_t VirtualMemoryThreshold;
|
---|
1437 | uint64_t ProcessAffinityMask;
|
---|
1438 | uint32_t ProcessHeapFlags;
|
---|
1439 | uint16_t CSDVersion;
|
---|
1440 | uint16_t DependentLoadFlags;
|
---|
1441 | uint64_t EditList;
|
---|
1442 | uint64_t SecurityCookie;
|
---|
1443 | uint64_t SEHandlerTable;
|
---|
1444 | uint64_t SEHandlerCount;
|
---|
1445 | uint64_t GuardCFCCheckFunctionPointer;
|
---|
1446 | uint64_t GuardCFDispatchFunctionPointer;
|
---|
1447 | uint64_t GuardCFFunctionTable;
|
---|
1448 | uint64_t GuardCFFunctionCount;
|
---|
1449 | uint32_t GuardFlags;
|
---|
1450 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V3;
|
---|
1451 | #pragma pack()
|
---|
1452 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V3, 0x94);
|
---|
1453 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
|
---|
1454 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
|
---|
1455 |
|
---|
1456 | /** @since Windows 10 (Preview (9879). */
|
---|
1457 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V4
|
---|
1458 | {
|
---|
1459 | uint32_t Size; /**< 0x00 */
|
---|
1460 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1461 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1462 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1463 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1464 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1465 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1466 | uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1467 | uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
|
---|
1468 | uint64_t LockPrefixTable; /**< 0x28 */
|
---|
1469 | uint64_t MaximumAllocationSize; /**< 0x30 */
|
---|
1470 | uint64_t VirtualMemoryThreshold; /**< 0x38 */
|
---|
1471 | uint64_t ProcessAffinityMask; /**< 0x40 */
|
---|
1472 | uint32_t ProcessHeapFlags; /**< 0x48 */
|
---|
1473 | uint16_t CSDVersion; /**< 0x4c */
|
---|
1474 | uint16_t DependentLoadFlags; /**< 0x4e */
|
---|
1475 | uint64_t EditList; /**< 0x50 */
|
---|
1476 | uint64_t SecurityCookie; /**< 0x58 */
|
---|
1477 | uint64_t SEHandlerTable; /**< 0x60 */
|
---|
1478 | uint64_t SEHandlerCount; /**< 0x68 */
|
---|
1479 | uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
|
---|
1480 | uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
|
---|
1481 | uint64_t GuardCFFunctionTable; /**< 0x80 */
|
---|
1482 | uint64_t GuardCFFunctionCount; /**< 0x88 */
|
---|
1483 | uint32_t GuardFlags; /**< 0x90 */
|
---|
1484 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
|
---|
1485 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V4;
|
---|
1486 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V4, 0xa0);
|
---|
1487 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
|
---|
1488 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
|
---|
1489 |
|
---|
1490 | /** @since Windows 10 build 14286 (or maybe earlier). */
|
---|
1491 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V5
|
---|
1492 | {
|
---|
1493 | uint32_t Size; /**< 0x00 */
|
---|
1494 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1495 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1496 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1497 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1498 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1499 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1500 | uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1501 | uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
|
---|
1502 | uint64_t LockPrefixTable; /**< 0x28 */
|
---|
1503 | uint64_t MaximumAllocationSize; /**< 0x30 */
|
---|
1504 | uint64_t VirtualMemoryThreshold; /**< 0x38 */
|
---|
1505 | uint64_t ProcessAffinityMask; /**< 0x40 */
|
---|
1506 | uint32_t ProcessHeapFlags; /**< 0x48 */
|
---|
1507 | uint16_t CSDVersion; /**< 0x4c */
|
---|
1508 | uint16_t DependentLoadFlags; /**< 0x4e */
|
---|
1509 | uint64_t EditList; /**< 0x50 */
|
---|
1510 | uint64_t SecurityCookie; /**< 0x58 */
|
---|
1511 | uint64_t SEHandlerTable; /**< 0x60 */
|
---|
1512 | uint64_t SEHandlerCount; /**< 0x68 */
|
---|
1513 | uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
|
---|
1514 | uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
|
---|
1515 | uint64_t GuardCFFunctionTable; /**< 0x80 */
|
---|
1516 | uint64_t GuardCFFunctionCount; /**< 0x88 */
|
---|
1517 | uint32_t GuardFlags; /**< 0x90 */
|
---|
1518 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
|
---|
1519 | uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
|
---|
1520 | uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
|
---|
1521 | uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
|
---|
1522 | uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
|
---|
1523 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V5;
|
---|
1524 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V5, 0xc0);
|
---|
1525 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V5 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V5;
|
---|
1526 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V5 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V5;
|
---|
1527 |
|
---|
1528 | /** @since Windows 10 build 14393 (or maybe earlier). */
|
---|
1529 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V6
|
---|
1530 | {
|
---|
1531 | uint32_t Size; /**< 0x00 */
|
---|
1532 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1533 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1534 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1535 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1536 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1537 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1538 | uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1539 | uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
|
---|
1540 | uint64_t LockPrefixTable; /**< 0x28 */
|
---|
1541 | uint64_t MaximumAllocationSize; /**< 0x30 */
|
---|
1542 | uint64_t VirtualMemoryThreshold; /**< 0x38 */
|
---|
1543 | uint64_t ProcessAffinityMask; /**< 0x40 */
|
---|
1544 | uint32_t ProcessHeapFlags; /**< 0x48 */
|
---|
1545 | uint16_t CSDVersion; /**< 0x4c */
|
---|
1546 | uint16_t DependentLoadFlags; /**< 0x4e */
|
---|
1547 | uint64_t EditList; /**< 0x50 */
|
---|
1548 | uint64_t SecurityCookie; /**< 0x58 */
|
---|
1549 | uint64_t SEHandlerTable; /**< 0x60 */
|
---|
1550 | uint64_t SEHandlerCount; /**< 0x68 */
|
---|
1551 | uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
|
---|
1552 | uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
|
---|
1553 | uint64_t GuardCFFunctionTable; /**< 0x80 */
|
---|
1554 | uint64_t GuardCFFunctionCount; /**< 0x88 */
|
---|
1555 | uint32_t GuardFlags; /**< 0x90 */
|
---|
1556 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
|
---|
1557 | uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
|
---|
1558 | uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
|
---|
1559 | uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
|
---|
1560 | uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
|
---|
1561 | uint64_t DynamicValueRelocTable; /**< 0xc0 */
|
---|
1562 | uint64_t HybridMetadataPointer; /**< 0xc8 */
|
---|
1563 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V6;
|
---|
1564 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V6, 0xd0);
|
---|
1565 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V6 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V6;
|
---|
1566 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V6 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V6;
|
---|
1567 |
|
---|
1568 | /** @since Windows 10 build 14901 (or maybe earlier). */
|
---|
1569 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V7
|
---|
1570 | {
|
---|
1571 | uint32_t Size; /**< 0x00 */
|
---|
1572 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1573 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1574 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1575 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1576 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1577 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1578 | uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1579 | uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
|
---|
1580 | uint64_t LockPrefixTable; /**< 0x28 */
|
---|
1581 | uint64_t MaximumAllocationSize; /**< 0x30 */
|
---|
1582 | uint64_t VirtualMemoryThreshold; /**< 0x38 */
|
---|
1583 | uint64_t ProcessAffinityMask; /**< 0x40 */
|
---|
1584 | uint32_t ProcessHeapFlags; /**< 0x48 */
|
---|
1585 | uint16_t CSDVersion; /**< 0x4c */
|
---|
1586 | uint16_t DependentLoadFlags; /**< 0x4e */
|
---|
1587 | uint64_t EditList; /**< 0x50 */
|
---|
1588 | uint64_t SecurityCookie; /**< 0x58 */
|
---|
1589 | uint64_t SEHandlerTable; /**< 0x60 */
|
---|
1590 | uint64_t SEHandlerCount; /**< 0x68 */
|
---|
1591 | uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
|
---|
1592 | uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
|
---|
1593 | uint64_t GuardCFFunctionTable; /**< 0x80 */
|
---|
1594 | uint64_t GuardCFFunctionCount; /**< 0x88 */
|
---|
1595 | uint32_t GuardFlags; /**< 0x90 */
|
---|
1596 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
|
---|
1597 | uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
|
---|
1598 | uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
|
---|
1599 | uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
|
---|
1600 | uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
|
---|
1601 | uint64_t DynamicValueRelocTable; /**< 0xc0 */
|
---|
1602 | uint64_t CHPEMetadataPointer; /**< 0xc8 Not sure when this was renamed from HybridMetadataPointer. */
|
---|
1603 | uint64_t GuardRFFailureRoutine; /**< 0xd0 */
|
---|
1604 | uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
|
---|
1605 | uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
|
---|
1606 | uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
|
---|
1607 | uint16_t Reserved2; /**< 0xe6 */
|
---|
1608 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V7;
|
---|
1609 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V7, 0xe8);
|
---|
1610 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V7 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V7;
|
---|
1611 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V7 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V7;
|
---|
1612 |
|
---|
1613 | /** @since Windows 10 build 15002 (or maybe earlier). */
|
---|
1614 | #pragma pack(4) /* Stupid, stupid microsofties! */
|
---|
1615 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V8
|
---|
1616 | {
|
---|
1617 | uint32_t Size; /**< 0x00 */
|
---|
1618 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1619 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1620 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1621 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1622 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1623 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1624 | uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1625 | uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
|
---|
1626 | uint64_t LockPrefixTable; /**< 0x28 */
|
---|
1627 | uint64_t MaximumAllocationSize; /**< 0x30 */
|
---|
1628 | uint64_t VirtualMemoryThreshold; /**< 0x38 */
|
---|
1629 | uint64_t ProcessAffinityMask; /**< 0x40 */
|
---|
1630 | uint32_t ProcessHeapFlags; /**< 0x48 */
|
---|
1631 | uint16_t CSDVersion; /**< 0x4c */
|
---|
1632 | uint16_t DependentLoadFlags; /**< 0x4e */
|
---|
1633 | uint64_t EditList; /**< 0x50 */
|
---|
1634 | uint64_t SecurityCookie; /**< 0x58 */
|
---|
1635 | uint64_t SEHandlerTable; /**< 0x60 */
|
---|
1636 | uint64_t SEHandlerCount; /**< 0x68 */
|
---|
1637 | uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
|
---|
1638 | uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
|
---|
1639 | uint64_t GuardCFFunctionTable; /**< 0x80 */
|
---|
1640 | uint64_t GuardCFFunctionCount; /**< 0x88 */
|
---|
1641 | uint32_t GuardFlags; /**< 0x90 */
|
---|
1642 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
|
---|
1643 | uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
|
---|
1644 | uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
|
---|
1645 | uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
|
---|
1646 | uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
|
---|
1647 | uint64_t DynamicValueRelocTable; /**< 0xc0 */
|
---|
1648 | uint64_t CHPEMetadataPointer; /**< 0xc8 */
|
---|
1649 | uint64_t GuardRFFailureRoutine; /**< 0xd0 */
|
---|
1650 | uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
|
---|
1651 | uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
|
---|
1652 | uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
|
---|
1653 | uint16_t Reserved2; /**< 0xe6 */
|
---|
1654 | uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
|
---|
1655 | uint32_t HotPatchTableOffset; /**< 0xf0 */
|
---|
1656 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V8;
|
---|
1657 | #pragma pack()
|
---|
1658 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V8, 0xf4);
|
---|
1659 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V8 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V8;
|
---|
1660 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V8 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V8;
|
---|
1661 |
|
---|
1662 | /** @since Windows 10 build 15002 (or maybe earlier). */
|
---|
1663 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V9
|
---|
1664 | {
|
---|
1665 | uint32_t Size; /**< 0x00 */
|
---|
1666 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1667 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1668 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1669 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1670 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1671 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1672 | uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1673 | uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
|
---|
1674 | uint64_t LockPrefixTable; /**< 0x28 */
|
---|
1675 | uint64_t MaximumAllocationSize; /**< 0x30 */
|
---|
1676 | uint64_t VirtualMemoryThreshold; /**< 0x38 */
|
---|
1677 | uint64_t ProcessAffinityMask; /**< 0x40 */
|
---|
1678 | uint32_t ProcessHeapFlags; /**< 0x48 */
|
---|
1679 | uint16_t CSDVersion; /**< 0x4c */
|
---|
1680 | uint16_t DependentLoadFlags; /**< 0x4e */
|
---|
1681 | uint64_t EditList; /**< 0x50 */
|
---|
1682 | uint64_t SecurityCookie; /**< 0x58 */
|
---|
1683 | uint64_t SEHandlerTable; /**< 0x60 */
|
---|
1684 | uint64_t SEHandlerCount; /**< 0x68 */
|
---|
1685 | uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
|
---|
1686 | uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
|
---|
1687 | uint64_t GuardCFFunctionTable; /**< 0x80 */
|
---|
1688 | uint64_t GuardCFFunctionCount; /**< 0x88 */
|
---|
1689 | uint32_t GuardFlags; /**< 0x90 */
|
---|
1690 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
|
---|
1691 | uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
|
---|
1692 | uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
|
---|
1693 | uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
|
---|
1694 | uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
|
---|
1695 | uint64_t DynamicValueRelocTable; /**< 0xc0 */
|
---|
1696 | uint64_t CHPEMetadataPointer; /**< 0xc8 */
|
---|
1697 | uint64_t GuardRFFailureRoutine; /**< 0xd0 */
|
---|
1698 | uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
|
---|
1699 | uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
|
---|
1700 | uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
|
---|
1701 | uint16_t Reserved2; /**< 0xe6 */
|
---|
1702 | uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
|
---|
1703 | uint32_t HotPatchTableOffset; /**< 0xf0 */
|
---|
1704 | uint32_t Reserved3; /**< 0xf4 */
|
---|
1705 | uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
|
---|
1706 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V9;
|
---|
1707 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V9, 0x100);
|
---|
1708 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V9 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V9;
|
---|
1709 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V9 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V9;
|
---|
1710 |
|
---|
1711 | /** @since Windows 10 build 18362 (or maybe earlier). */
|
---|
1712 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V10
|
---|
1713 | {
|
---|
1714 | uint32_t Size; /**< 0x00 */
|
---|
1715 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1716 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1717 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1718 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1719 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1720 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1721 | uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1722 | uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
|
---|
1723 | uint64_t LockPrefixTable; /**< 0x28 */
|
---|
1724 | uint64_t MaximumAllocationSize; /**< 0x30 */
|
---|
1725 | uint64_t VirtualMemoryThreshold; /**< 0x38 */
|
---|
1726 | uint64_t ProcessAffinityMask; /**< 0x40 */
|
---|
1727 | uint32_t ProcessHeapFlags; /**< 0x48 */
|
---|
1728 | uint16_t CSDVersion; /**< 0x4c */
|
---|
1729 | uint16_t DependentLoadFlags; /**< 0x4e */
|
---|
1730 | uint64_t EditList; /**< 0x50 */
|
---|
1731 | uint64_t SecurityCookie; /**< 0x58 */
|
---|
1732 | uint64_t SEHandlerTable; /**< 0x60 */
|
---|
1733 | uint64_t SEHandlerCount; /**< 0x68 */
|
---|
1734 | uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
|
---|
1735 | uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
|
---|
1736 | uint64_t GuardCFFunctionTable; /**< 0x80 */
|
---|
1737 | uint64_t GuardCFFunctionCount; /**< 0x88 */
|
---|
1738 | uint32_t GuardFlags; /**< 0x90 */
|
---|
1739 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
|
---|
1740 | uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
|
---|
1741 | uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
|
---|
1742 | uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
|
---|
1743 | uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
|
---|
1744 | uint64_t DynamicValueRelocTable; /**< 0xc0 */
|
---|
1745 | uint64_t CHPEMetadataPointer; /**< 0xc8 */
|
---|
1746 | uint64_t GuardRFFailureRoutine; /**< 0xd0 */
|
---|
1747 | uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
|
---|
1748 | uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
|
---|
1749 | uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
|
---|
1750 | uint16_t Reserved2; /**< 0xe6 */
|
---|
1751 | uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
|
---|
1752 | uint32_t HotPatchTableOffset; /**< 0xf0 */
|
---|
1753 | uint32_t Reserved3; /**< 0xf4 */
|
---|
1754 | uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
|
---|
1755 | uint64_t VolatileMetadataPointer; /**< 0x100 */
|
---|
1756 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V10;
|
---|
1757 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V10, 0x108);
|
---|
1758 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V10 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V10;
|
---|
1759 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V10 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V10;
|
---|
1760 |
|
---|
1761 | /** @since Windows 10 build 19534 (or maybe earlier). */
|
---|
1762 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V11
|
---|
1763 | {
|
---|
1764 | uint32_t Size; /**< 0x00 */
|
---|
1765 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1766 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1767 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1768 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1769 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1770 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1771 | uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1772 | uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
|
---|
1773 | uint64_t LockPrefixTable; /**< 0x28 */
|
---|
1774 | uint64_t MaximumAllocationSize; /**< 0x30 */
|
---|
1775 | uint64_t VirtualMemoryThreshold; /**< 0x38 */
|
---|
1776 | uint64_t ProcessAffinityMask; /**< 0x40 */
|
---|
1777 | uint32_t ProcessHeapFlags; /**< 0x48 */
|
---|
1778 | uint16_t CSDVersion; /**< 0x4c */
|
---|
1779 | uint16_t DependentLoadFlags; /**< 0x4e */
|
---|
1780 | uint64_t EditList; /**< 0x50 */
|
---|
1781 | uint64_t SecurityCookie; /**< 0x58 */
|
---|
1782 | uint64_t SEHandlerTable; /**< 0x60 */
|
---|
1783 | uint64_t SEHandlerCount; /**< 0x68 */
|
---|
1784 | uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
|
---|
1785 | uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
|
---|
1786 | uint64_t GuardCFFunctionTable; /**< 0x80 */
|
---|
1787 | uint64_t GuardCFFunctionCount; /**< 0x88 */
|
---|
1788 | uint32_t GuardFlags; /**< 0x90 */
|
---|
1789 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
|
---|
1790 | uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
|
---|
1791 | uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
|
---|
1792 | uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
|
---|
1793 | uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
|
---|
1794 | uint64_t DynamicValueRelocTable; /**< 0xc0 */
|
---|
1795 | uint64_t CHPEMetadataPointer; /**< 0xc8 */
|
---|
1796 | uint64_t GuardRFFailureRoutine; /**< 0xd0 */
|
---|
1797 | uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
|
---|
1798 | uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
|
---|
1799 | uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
|
---|
1800 | uint16_t Reserved2; /**< 0xe6 */
|
---|
1801 | uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
|
---|
1802 | uint32_t HotPatchTableOffset; /**< 0xf0 */
|
---|
1803 | uint32_t Reserved3; /**< 0xf4 */
|
---|
1804 | uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
|
---|
1805 | uint64_t VolatileMetadataPointer; /**< 0x100 */
|
---|
1806 | uint64_t GuardEHContinuationTable; /**< 0x108 - virtual address */
|
---|
1807 | uint64_t GuardEHContinuationCount; /**< 0x110 */
|
---|
1808 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V11;
|
---|
1809 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V11, 0x118);
|
---|
1810 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V11 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V11;
|
---|
1811 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V11 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V11;
|
---|
1812 |
|
---|
1813 | /** @since Visual C++ 2019 / RS5_IMAGE_LOAD_CONFIG_DIRECTORY64. */
|
---|
1814 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V12
|
---|
1815 | {
|
---|
1816 | uint32_t Size; /**< 0x00 */
|
---|
1817 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1818 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1819 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1820 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1821 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1822 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1823 | uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1824 | uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
|
---|
1825 | uint64_t LockPrefixTable; /**< 0x28 */
|
---|
1826 | uint64_t MaximumAllocationSize; /**< 0x30 */
|
---|
1827 | uint64_t VirtualMemoryThreshold; /**< 0x38 */
|
---|
1828 | uint64_t ProcessAffinityMask; /**< 0x40 */
|
---|
1829 | uint32_t ProcessHeapFlags; /**< 0x48 */
|
---|
1830 | uint16_t CSDVersion; /**< 0x4c */
|
---|
1831 | uint16_t DependentLoadFlags; /**< 0x4e */
|
---|
1832 | uint64_t EditList; /**< 0x50 */
|
---|
1833 | uint64_t SecurityCookie; /**< 0x58 */
|
---|
1834 | uint64_t SEHandlerTable; /**< 0x60 */
|
---|
1835 | uint64_t SEHandlerCount; /**< 0x68 */
|
---|
1836 | uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
|
---|
1837 | uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
|
---|
1838 | uint64_t GuardCFFunctionTable; /**< 0x80 */
|
---|
1839 | uint64_t GuardCFFunctionCount; /**< 0x88 */
|
---|
1840 | uint32_t GuardFlags; /**< 0x90 */
|
---|
1841 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
|
---|
1842 | uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
|
---|
1843 | uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
|
---|
1844 | uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
|
---|
1845 | uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
|
---|
1846 | uint64_t DynamicValueRelocTable; /**< 0xc0 */
|
---|
1847 | uint64_t CHPEMetadataPointer; /**< 0xc8 */
|
---|
1848 | uint64_t GuardRFFailureRoutine; /**< 0xd0 */
|
---|
1849 | uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
|
---|
1850 | uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
|
---|
1851 | uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
|
---|
1852 | uint16_t Reserved2; /**< 0xe6 */
|
---|
1853 | uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
|
---|
1854 | uint32_t HotPatchTableOffset; /**< 0xf0 */
|
---|
1855 | uint32_t Reserved3; /**< 0xf4 */
|
---|
1856 | uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
|
---|
1857 | uint64_t VolatileMetadataPointer; /**< 0x100 */
|
---|
1858 | uint64_t GuardEHContinuationTable; /**< 0x108 - virtual address */
|
---|
1859 | uint64_t GuardEHContinuationCount; /**< 0x110 */
|
---|
1860 | uint64_t GuardXFGCheckFunctionPointer; /**< 0x118 */
|
---|
1861 | uint64_t GuardXFGDispatchFunctionPointer; /**< 0x120 */
|
---|
1862 | uint64_t GuardXFGTableDispatchFunctionPointer; /**< 0x128 */
|
---|
1863 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V12;
|
---|
1864 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V12, 0x130);
|
---|
1865 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V12 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V12;
|
---|
1866 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V12 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V12;
|
---|
1867 |
|
---|
1868 | /** @since Visual C++ 2019 16.x (found in 16.11.9) / RS5_IMAGE_LOAD_CONFIG_DIRECTORY32. */
|
---|
1869 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V13
|
---|
1870 | {
|
---|
1871 | uint32_t Size; /**< 0x00 */
|
---|
1872 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
1873 | uint16_t MajorVersion; /**< 0x08 */
|
---|
1874 | uint16_t MinorVersion; /**< 0x0a */
|
---|
1875 | uint32_t GlobalFlagsClear; /**< 0x0c */
|
---|
1876 | uint32_t GlobalFlagsSet; /**< 0x10 */
|
---|
1877 | uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
|
---|
1878 | uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
|
---|
1879 | uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
|
---|
1880 | uint64_t LockPrefixTable; /**< 0x28 - virtual address */
|
---|
1881 | uint64_t MaximumAllocationSize; /**< 0x30 */
|
---|
1882 | uint64_t VirtualMemoryThreshold; /**< 0x38 */
|
---|
1883 | uint64_t ProcessAffinityMask; /**< 0x40 */
|
---|
1884 | uint32_t ProcessHeapFlags; /**< 0x48 */
|
---|
1885 | uint16_t CSDVersion; /**< 0x4c */
|
---|
1886 | uint16_t DependentLoadFlags; /**< 0x4e */
|
---|
1887 | uint64_t EditList; /**< 0x50 - virtual address */
|
---|
1888 | uint64_t SecurityCookie; /**< 0x58 - virtual address */
|
---|
1889 | uint64_t SEHandlerTable; /**< 0x60 */
|
---|
1890 | uint64_t SEHandlerCount; /**< 0x68 */
|
---|
1891 | uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 - virtual address of pointer variable */
|
---|
1892 | uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 - virtual address of pointer variable */
|
---|
1893 | uint64_t GuardCFFunctionTable; /**< 0x80 - virtual address */
|
---|
1894 | uint64_t GuardCFFunctionCount; /**< 0x88 */
|
---|
1895 | uint32_t GuardFlags; /**< 0x90 */
|
---|
1896 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
|
---|
1897 | uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 - virtual address */
|
---|
1898 | uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
|
---|
1899 | uint64_t GuardLongJumpTargetTable; /**< 0xb0 - virtual address */
|
---|
1900 | uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
|
---|
1901 | uint64_t DynamicValueRelocTable; /**< 0xc0 - virtual address */
|
---|
1902 | uint64_t CHPEMetadataPointer; /**< 0xc8 */
|
---|
1903 | uint64_t GuardRFFailureRoutine; /**< 0xd0 - virtual address */
|
---|
1904 | uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 - virtual address of pointer variable */
|
---|
1905 | uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
|
---|
1906 | uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
|
---|
1907 | uint16_t Reserved2; /**< 0xe6 */
|
---|
1908 | uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 - virtual address of pointer variable */
|
---|
1909 | uint32_t HotPatchTableOffset; /**< 0xf0 */
|
---|
1910 | uint32_t Reserved3; /**< 0xf4 */
|
---|
1911 | uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
|
---|
1912 | uint64_t VolatileMetadataPointer; /**< 0x100 - virtual address of pointer variable */
|
---|
1913 | uint64_t GuardEHContinuationTable; /**< 0x108 - virtual address */
|
---|
1914 | uint64_t GuardEHContinuationCount; /**< 0x110 */
|
---|
1915 | uint64_t GuardXFGCheckFunctionPointer; /**< 0x118 - virtual address of pointer variable */
|
---|
1916 | uint64_t GuardXFGDispatchFunctionPointer; /**< 0x120 - virtual address of pointer variable */
|
---|
1917 | uint64_t GuardXFGTableDispatchFunctionPointer; /**< 0x128 - virtual address of pointer variable */
|
---|
1918 | uint64_t CastGuardOsDeterminedFailureMode; /**< 0x130 - virtual address */
|
---|
1919 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V13;
|
---|
1920 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V13, 0x138);
|
---|
1921 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V13 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V13;
|
---|
1922 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V13 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V13;
|
---|
1923 |
|
---|
1924 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V13 IMAGE_LOAD_CONFIG_DIRECTORY64;
|
---|
1925 | typedef PIMAGE_LOAD_CONFIG_DIRECTORY64_V13 PIMAGE_LOAD_CONFIG_DIRECTORY64;
|
---|
1926 | typedef PCIMAGE_LOAD_CONFIG_DIRECTORY64_V13 PCIMAGE_LOAD_CONFIG_DIRECTORY64;
|
---|
1927 |
|
---|
1928 | /** @} */
|
---|
1929 |
|
---|
1930 |
|
---|
1931 | /**
|
---|
1932 | * PE certificate directory.
|
---|
1933 | *
|
---|
1934 | * Found in IMAGE_DIRECTORY_ENTRY_SECURITY.
|
---|
1935 | */
|
---|
1936 | typedef struct WIN_CERTIFICATE
|
---|
1937 | {
|
---|
1938 | uint32_t dwLength;
|
---|
1939 | uint16_t wRevision;
|
---|
1940 | uint16_t wCertificateType;
|
---|
1941 | uint8_t bCertificate[8];
|
---|
1942 | } WIN_CERTIFICATE;
|
---|
1943 | AssertCompileSize(WIN_CERTIFICATE, 16);
|
---|
1944 | typedef WIN_CERTIFICATE *PWIN_CERTIFICATE;
|
---|
1945 | typedef WIN_CERTIFICATE const *PCWIN_CERTIFICATE;
|
---|
1946 |
|
---|
1947 | /** @name WIN_CERT_REVISION_XXX - Certificate data directory revision.
|
---|
1948 | * Used WIN_CERTIFICATE::wRevision found in the IMAGE_DIRECTORY_ENTRY_SECURITY
|
---|
1949 | * data directory.
|
---|
1950 | * @{ */
|
---|
1951 | #define WIN_CERT_REVISION_1_0 UINT16_C(0x0100)
|
---|
1952 | #define WIN_CERT_REVISION_2_0 UINT16_C(0x0200)
|
---|
1953 | /** @} */
|
---|
1954 |
|
---|
1955 | /** @name WIN_CERT_TYPE_XXX - Signature type.
|
---|
1956 | * Used by WIN_CERTIFICATE::wCertificateType.
|
---|
1957 | * @{ */
|
---|
1958 | #define WIN_CERT_TYPE_X509 UINT16_C(1)
|
---|
1959 | #define WIN_CERT_TYPE_PKCS_SIGNED_DATA UINT16_C(2)
|
---|
1960 | #define WIN_CERT_TYPE_RESERVED_1 UINT16_C(3)
|
---|
1961 | #define WIN_CERT_TYPE_TS_STACK_SIGNED UINT16_C(4)
|
---|
1962 | #define WIN_CERT_TYPE_EFI_PKCS115 UINT16_C(0x0ef0)
|
---|
1963 | #define WIN_CERT_TYPE_EFI_GUID UINT16_C(0x0ef1)
|
---|
1964 | /** @} */
|
---|
1965 |
|
---|
1966 | /** The alignment of the certificate table.
|
---|
1967 | * @remarks Found thru signtool experiments. */
|
---|
1968 | #define WIN_CERTIFICATE_ALIGNMENT UINT32_C(8)
|
---|
1969 |
|
---|
1970 |
|
---|
1971 | /**
|
---|
1972 | * Debug directory.
|
---|
1973 | *
|
---|
1974 | * Found in IMAGE_DIRECTORY_ENTRY_DEBUG.
|
---|
1975 | */
|
---|
1976 | typedef struct _IMAGE_DEBUG_DIRECTORY
|
---|
1977 | {
|
---|
1978 | uint32_t Characteristics;
|
---|
1979 | uint32_t TimeDateStamp;
|
---|
1980 | uint16_t MajorVersion;
|
---|
1981 | uint16_t MinorVersion;
|
---|
1982 | uint32_t Type;
|
---|
1983 | uint32_t SizeOfData;
|
---|
1984 | uint32_t AddressOfRawData;
|
---|
1985 | uint32_t PointerToRawData;
|
---|
1986 | } IMAGE_DEBUG_DIRECTORY;
|
---|
1987 | AssertCompileSize(IMAGE_DEBUG_DIRECTORY, 28);
|
---|
1988 | typedef IMAGE_DEBUG_DIRECTORY *PIMAGE_DEBUG_DIRECTORY;
|
---|
1989 | typedef IMAGE_DEBUG_DIRECTORY const *PCIMAGE_DEBUG_DIRECTORY;
|
---|
1990 |
|
---|
1991 | /** @name IMAGE_DEBUG_TYPE_XXX - Debug format types.
|
---|
1992 | * Used by IMAGE_DEBUG_DIRECTORY::Type.
|
---|
1993 | * @{ */
|
---|
1994 | #define IMAGE_DEBUG_TYPE_UNKNOWN UINT32_C(0x00)
|
---|
1995 | #define IMAGE_DEBUG_TYPE_COFF UINT32_C(0x01)
|
---|
1996 | #define IMAGE_DEBUG_TYPE_CODEVIEW UINT32_C(0x02)
|
---|
1997 | #define IMAGE_DEBUG_TYPE_FPO UINT32_C(0x03)
|
---|
1998 | #define IMAGE_DEBUG_TYPE_MISC UINT32_C(0x04)
|
---|
1999 | #define IMAGE_DEBUG_TYPE_EXCEPTION UINT32_C(0x05)
|
---|
2000 | #define IMAGE_DEBUG_TYPE_FIXUP UINT32_C(0x06)
|
---|
2001 | #define IMAGE_DEBUG_TYPE_OMAP_TO_SRC UINT32_C(0x07)
|
---|
2002 | #define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC UINT32_C(0x08)
|
---|
2003 | #define IMAGE_DEBUG_TYPE_BORLAND UINT32_C(0x09)
|
---|
2004 | #define IMAGE_DEBUG_TYPE_RESERVED10 UINT32_C(0x0a)
|
---|
2005 | #define IMAGE_DEBUG_TYPE_CLSID UINT32_C(0x0b)
|
---|
2006 | #define IMAGE_DEBUG_TYPE_VC_FEATURE UINT32_C(0x0c)
|
---|
2007 | #define IMAGE_DEBUG_TYPE_POGO UINT32_C(0x0d)
|
---|
2008 | #define IMAGE_DEBUG_TYPE_ILTCG UINT32_C(0x0e)
|
---|
2009 | #define IMAGE_DEBUG_TYPE_MPX UINT32_C(0x0f)
|
---|
2010 | #define IMAGE_DEBUG_TYPE_REPRO UINT32_C(0x10)
|
---|
2011 | /** @} */
|
---|
2012 |
|
---|
2013 | /** @name IMAGE_DEBUG_MISC_XXX - Misc debug data type.
|
---|
2014 | * Used by IMAGE_DEBUG_MISC::DataType.
|
---|
2015 | * @{ */
|
---|
2016 | #define IMAGE_DEBUG_MISC_EXENAME UINT32_C(1)
|
---|
2017 | /** @} */
|
---|
2018 |
|
---|
2019 |
|
---|
2020 | /**
|
---|
2021 | * The format of IMAGE_DEBUG_TYPE_MISC debug info.
|
---|
2022 | */
|
---|
2023 | typedef struct _IMAGE_DEBUG_MISC
|
---|
2024 | {
|
---|
2025 | uint32_t DataType;
|
---|
2026 | uint32_t Length;
|
---|
2027 | uint8_t Unicode;
|
---|
2028 | uint8_t Reserved[3];
|
---|
2029 | uint8_t Data[1];
|
---|
2030 | } IMAGE_DEBUG_MISC;
|
---|
2031 | AssertCompileSize(IMAGE_DEBUG_MISC, 16);
|
---|
2032 | typedef IMAGE_DEBUG_MISC *PIMAGE_DEBUG_MISC;
|
---|
2033 | typedef IMAGE_DEBUG_MISC const *PCIMAGE_DEBUG_MISC;
|
---|
2034 |
|
---|
2035 |
|
---|
2036 |
|
---|
2037 | /**
|
---|
2038 | * The header of a .DBG file (NT4).
|
---|
2039 | */
|
---|
2040 | typedef struct _IMAGE_SEPARATE_DEBUG_HEADER
|
---|
2041 | {
|
---|
2042 | uint16_t Signature; /**< 0x00 */
|
---|
2043 | uint16_t Flags; /**< 0x02 */
|
---|
2044 | uint16_t Machine; /**< 0x04 */
|
---|
2045 | uint16_t Characteristics; /**< 0x06 */
|
---|
2046 | uint32_t TimeDateStamp; /**< 0x08 */
|
---|
2047 | uint32_t CheckSum; /**< 0x0c */
|
---|
2048 | uint32_t ImageBase; /**< 0x10 */
|
---|
2049 | uint32_t SizeOfImage; /**< 0x14 */
|
---|
2050 | uint32_t NumberOfSections; /**< 0x18 */
|
---|
2051 | uint32_t ExportedNamesSize; /**< 0x1c */
|
---|
2052 | uint32_t DebugDirectorySize; /**< 0x20 */
|
---|
2053 | uint32_t SectionAlignment; /**< 0x24 */
|
---|
2054 | uint32_t Reserved[2]; /**< 0x28 */
|
---|
2055 | } IMAGE_SEPARATE_DEBUG_HEADER; /* size: 0x30 */
|
---|
2056 | AssertCompileSize(IMAGE_SEPARATE_DEBUG_HEADER, 0x30);
|
---|
2057 | typedef IMAGE_SEPARATE_DEBUG_HEADER *PIMAGE_SEPARATE_DEBUG_HEADER;
|
---|
2058 | typedef IMAGE_SEPARATE_DEBUG_HEADER const *PCIMAGE_SEPARATE_DEBUG_HEADER;
|
---|
2059 |
|
---|
2060 | /** The signature of a IMAGE_SEPARATE_DEBUG_HEADER. */
|
---|
2061 | #define IMAGE_SEPARATE_DEBUG_SIGNATURE UINT16_C(0x4944)
|
---|
2062 |
|
---|
2063 |
|
---|
2064 | /**
|
---|
2065 | * The format of IMAGE_DEBUG_TYPE_COFF debug info.
|
---|
2066 | */
|
---|
2067 | typedef struct _IMAGE_COFF_SYMBOLS_HEADER
|
---|
2068 | {
|
---|
2069 | uint32_t NumberOfSymbols;
|
---|
2070 | uint32_t LvaToFirstSymbol;
|
---|
2071 | uint32_t NumberOfLinenumbers;
|
---|
2072 | uint32_t LvaToFirstLinenumber;
|
---|
2073 | uint32_t RvaToFirstByteOfCode;
|
---|
2074 | uint32_t RvaToLastByteOfCode;
|
---|
2075 | uint32_t RvaToFirstByteOfData;
|
---|
2076 | uint32_t RvaToLastByteOfData;
|
---|
2077 | } IMAGE_COFF_SYMBOLS_HEADER;
|
---|
2078 | AssertCompileSize(IMAGE_COFF_SYMBOLS_HEADER, 0x20);
|
---|
2079 | typedef IMAGE_COFF_SYMBOLS_HEADER *PIMAGE_COFF_SYMBOLS_HEADER;
|
---|
2080 | typedef IMAGE_COFF_SYMBOLS_HEADER const *PCIMAGE_COFF_SYMBOLS_HEADER;
|
---|
2081 |
|
---|
2082 |
|
---|
2083 | /**
|
---|
2084 | * Line number format of IMAGE_DEBUG_TYPE_COFF debug info.
|
---|
2085 | *
|
---|
2086 | * @remarks This has misaligned members.
|
---|
2087 | */
|
---|
2088 | #pragma pack(2)
|
---|
2089 | typedef struct _IMAGE_LINENUMBER
|
---|
2090 | {
|
---|
2091 | union
|
---|
2092 | {
|
---|
2093 | uint32_t VirtualAddress;
|
---|
2094 | uint32_t SymbolTableIndex;
|
---|
2095 | } Type;
|
---|
2096 | uint16_t Linenumber;
|
---|
2097 | } IMAGE_LINENUMBER;
|
---|
2098 | #pragma pack()
|
---|
2099 | AssertCompileSize(IMAGE_LINENUMBER, 6);
|
---|
2100 | typedef IMAGE_LINENUMBER *PIMAGE_LINENUMBER;
|
---|
2101 | typedef IMAGE_LINENUMBER const *PCIMAGE_LINENUMBER;
|
---|
2102 |
|
---|
2103 |
|
---|
2104 | /** The size of a IMAGE_SYMBOL & IMAGE_AUX_SYMBOL structure. */
|
---|
2105 | #define IMAGE_SIZE_OF_SYMBOL 18
|
---|
2106 | /** The size of a IMAGE_SYMBOL_EX & IMAGE_AUX_SYMBOL_EX structure. */
|
---|
2107 | #define IMAGE_SIZE_OF_SYMBOL_EX 20
|
---|
2108 |
|
---|
2109 | /**
|
---|
2110 | * COFF symbol.
|
---|
2111 | */
|
---|
2112 | #pragma pack(2)
|
---|
2113 | typedef struct _IMAGE_SYMBOL
|
---|
2114 | {
|
---|
2115 | union
|
---|
2116 | {
|
---|
2117 | uint8_t ShortName[8];
|
---|
2118 | struct
|
---|
2119 | {
|
---|
2120 | uint32_t Short;
|
---|
2121 | uint32_t Long;
|
---|
2122 | } Name;
|
---|
2123 | uint32_t LongName[2];
|
---|
2124 | } N;
|
---|
2125 |
|
---|
2126 | uint32_t Value;
|
---|
2127 | int16_t SectionNumber;
|
---|
2128 | uint16_t Type;
|
---|
2129 | uint8_t StorageClass;
|
---|
2130 | uint8_t NumberOfAuxSymbols;
|
---|
2131 | } IMAGE_SYMBOL;
|
---|
2132 | #pragma pack()
|
---|
2133 | AssertCompileSize(IMAGE_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
|
---|
2134 | typedef IMAGE_SYMBOL *PIMAGE_SYMBOL;
|
---|
2135 | typedef IMAGE_SYMBOL const *PCIMAGE_SYMBOL;
|
---|
2136 |
|
---|
2137 | /**
|
---|
2138 | * COFF auxiliary symbol token defintion (whatever that is).
|
---|
2139 | */
|
---|
2140 | #pragma pack(2)
|
---|
2141 | typedef struct IMAGE_AUX_SYMBOL_TOKEN_DEF
|
---|
2142 | {
|
---|
2143 | uint8_t bAuxType;
|
---|
2144 | uint8_t bReserved;
|
---|
2145 | uint32_t SymbolTableIndex;
|
---|
2146 | uint8_t rgbReserved[12];
|
---|
2147 | } IMAGE_AUX_SYMBOL_TOKEN_DEF;
|
---|
2148 | #pragma pack()
|
---|
2149 | AssertCompileSize(IMAGE_AUX_SYMBOL_TOKEN_DEF, IMAGE_SIZE_OF_SYMBOL);
|
---|
2150 | typedef IMAGE_AUX_SYMBOL_TOKEN_DEF *PIMAGE_AUX_SYMBOL_TOKEN_DEF;
|
---|
2151 | typedef IMAGE_AUX_SYMBOL_TOKEN_DEF const *PCIMAGE_AUX_SYMBOL_TOKEN_DEF;
|
---|
2152 |
|
---|
2153 | /**
|
---|
2154 | * COFF auxiliary symbol.
|
---|
2155 | */
|
---|
2156 | #pragma pack(1)
|
---|
2157 | typedef union _IMAGE_AUX_SYMBOL
|
---|
2158 | {
|
---|
2159 | struct
|
---|
2160 | {
|
---|
2161 | uint32_t TagIndex;
|
---|
2162 | union
|
---|
2163 | {
|
---|
2164 | struct
|
---|
2165 | {
|
---|
2166 | uint16_t Linenumber;
|
---|
2167 | uint16_t Size;
|
---|
2168 | } LnSz;
|
---|
2169 | } Misc;
|
---|
2170 | union
|
---|
2171 | {
|
---|
2172 | struct
|
---|
2173 | {
|
---|
2174 | uint32_t PointerToLinenumber;
|
---|
2175 | uint32_t PointerToNextFunction;
|
---|
2176 | } Function;
|
---|
2177 | struct
|
---|
2178 | {
|
---|
2179 | uint16_t Dimension[4];
|
---|
2180 | } Array;
|
---|
2181 | } FcnAry;
|
---|
2182 | uint16_t TvIndex;
|
---|
2183 | } Sym;
|
---|
2184 |
|
---|
2185 | struct
|
---|
2186 | {
|
---|
2187 | uint8_t Name[IMAGE_SIZE_OF_SYMBOL];
|
---|
2188 | } File;
|
---|
2189 |
|
---|
2190 | struct
|
---|
2191 | {
|
---|
2192 | uint32_t Length;
|
---|
2193 | uint16_t NumberOfRelocations;
|
---|
2194 | uint16_t NumberOfLinenumbers;
|
---|
2195 | uint32_t CheckSum;
|
---|
2196 | uint16_t Number;
|
---|
2197 | uint8_t Selection;
|
---|
2198 | uint8_t bReserved;
|
---|
2199 | uint16_t HighNumber;
|
---|
2200 | } Section;
|
---|
2201 |
|
---|
2202 | IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
|
---|
2203 | struct
|
---|
2204 | {
|
---|
2205 | uint32_t crc;
|
---|
2206 | uint8_t rgbReserved[14];
|
---|
2207 | } CRC;
|
---|
2208 | } IMAGE_AUX_SYMBOL;
|
---|
2209 | #pragma pack()
|
---|
2210 | AssertCompileSize(IMAGE_AUX_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
|
---|
2211 | typedef IMAGE_AUX_SYMBOL *PIMAGE_AUX_SYMBOL;
|
---|
2212 | typedef IMAGE_AUX_SYMBOL const *PCIMAGE_AUX_SYMBOL;
|
---|
2213 |
|
---|
2214 |
|
---|
2215 | /**
|
---|
2216 | * Extended COFF symbol.
|
---|
2217 | */
|
---|
2218 | typedef struct _IMAGE_SYMBOL_EX
|
---|
2219 | {
|
---|
2220 | union
|
---|
2221 | {
|
---|
2222 | uint8_t ShortName[8];
|
---|
2223 | struct
|
---|
2224 | {
|
---|
2225 | uint32_t Short;
|
---|
2226 | uint32_t Long;
|
---|
2227 | } Name;
|
---|
2228 | uint32_t LongName[2];
|
---|
2229 | } N;
|
---|
2230 |
|
---|
2231 | uint32_t Value;
|
---|
2232 | int32_t SectionNumber; /* The difference from IMAGE_SYMBOL */
|
---|
2233 | uint16_t Type;
|
---|
2234 | uint8_t StorageClass;
|
---|
2235 | uint8_t NumberOfAuxSymbols;
|
---|
2236 | } IMAGE_SYMBOL_EX;
|
---|
2237 | AssertCompileSize(IMAGE_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
|
---|
2238 | typedef IMAGE_SYMBOL_EX *PIMAGE_SYMBOL_EX;
|
---|
2239 | typedef IMAGE_SYMBOL_EX const *PCIMAGE_SYMBOL_EX;
|
---|
2240 |
|
---|
2241 | /**
|
---|
2242 | * Extended COFF auxiliary symbol.
|
---|
2243 | */
|
---|
2244 | typedef union _IMAGE_AUX_SYMBOL_EX
|
---|
2245 | {
|
---|
2246 | struct
|
---|
2247 | {
|
---|
2248 | uint32_t WeakDefaultSymIndex;
|
---|
2249 | uint32_t WeakSearchType;
|
---|
2250 | uint8_t rgbReserved[12];
|
---|
2251 | } Sym;
|
---|
2252 |
|
---|
2253 | struct
|
---|
2254 | {
|
---|
2255 | uint8_t Name[IMAGE_SIZE_OF_SYMBOL_EX];
|
---|
2256 | } File;
|
---|
2257 |
|
---|
2258 | struct
|
---|
2259 | {
|
---|
2260 | uint32_t Length;
|
---|
2261 | uint16_t NumberOfRelocations;
|
---|
2262 | uint16_t NumberOfLinenumbers;
|
---|
2263 | uint32_t CheckSum;
|
---|
2264 | uint16_t Number;
|
---|
2265 | uint8_t Selection;
|
---|
2266 | uint8_t bReserved;
|
---|
2267 | uint16_t HighNumber;
|
---|
2268 | uint8_t rgbReserved[2];
|
---|
2269 | } Section;
|
---|
2270 |
|
---|
2271 | IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
|
---|
2272 |
|
---|
2273 | struct
|
---|
2274 | {
|
---|
2275 | uint32_t crc;
|
---|
2276 | uint8_t rgbReserved[16];
|
---|
2277 | } CRC;
|
---|
2278 | } IMAGE_AUX_SYMBOL_EX;
|
---|
2279 | AssertCompileSize(IMAGE_AUX_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
|
---|
2280 | typedef IMAGE_AUX_SYMBOL_EX *PIMAGE_AUX_SYMBOL_EX;
|
---|
2281 | typedef IMAGE_AUX_SYMBOL_EX const *PCIMAGE_AUX_SYMBOL_EX;
|
---|
2282 |
|
---|
2283 | /** @name Special COFF section numbers.
|
---|
2284 | * Used by IMAGE_SYMBOL::SectionNumber and IMAGE_SYMBOL_EX::SectionNumber
|
---|
2285 | * @{ */
|
---|
2286 | #define IMAGE_SYM_UNDEFINED INT16_C(0)
|
---|
2287 | #define IMAGE_SYM_ABSOLUTE INT16_C(-1)
|
---|
2288 | #define IMAGE_SYM_DEBUG INT16_C(-2)
|
---|
2289 | /** @} */
|
---|
2290 |
|
---|
2291 | /** @name IMAGE_SYM_CLASS_XXX - COFF symbol storage classes.
|
---|
2292 | * @{ */
|
---|
2293 | #define IMAGE_SYM_CLASS_END_OF_FUNCTION UINT8_C(0xff) /* -1 */
|
---|
2294 | #define IMAGE_SYM_CLASS_NULL UINT8_C(0)
|
---|
2295 | #define IMAGE_SYM_CLASS_AUTOMATIC UINT8_C(1)
|
---|
2296 | #define IMAGE_SYM_CLASS_EXTERNAL UINT8_C(2)
|
---|
2297 | #define IMAGE_SYM_CLASS_STATIC UINT8_C(3)
|
---|
2298 | #define IMAGE_SYM_CLASS_REGISTER UINT8_C(4)
|
---|
2299 | #define IMAGE_SYM_CLASS_EXTERNAL_DEF UINT8_C(5)
|
---|
2300 | #define IMAGE_SYM_CLASS_LABEL UINT8_C(6)
|
---|
2301 | #define IMAGE_SYM_CLASS_UNDEFINED_LABEL UINT8_C(7)
|
---|
2302 | #define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT UINT8_C(8)
|
---|
2303 | #define IMAGE_SYM_CLASS_ARGUMENT UINT8_C(9)
|
---|
2304 | #define IMAGE_SYM_CLASS_STRUCT_TAG UINT8_C(10)
|
---|
2305 | #define IMAGE_SYM_CLASS_MEMBER_OF_UNION UINT8_C(11)
|
---|
2306 | #define IMAGE_SYM_CLASS_UNION_TAG UINT8_C(12)
|
---|
2307 | #define IMAGE_SYM_CLASS_TYPE_DEFINITION UINT8_C(13)
|
---|
2308 | #define IMAGE_SYM_CLASS_UNDEFINED_STATIC UINT8_C(14)
|
---|
2309 | #define IMAGE_SYM_CLASS_ENUM_TAG UINT8_C(15)
|
---|
2310 | #define IMAGE_SYM_CLASS_MEMBER_OF_ENUM UINT8_C(16)
|
---|
2311 | #define IMAGE_SYM_CLASS_REGISTER_PARAM UINT8_C(17)
|
---|
2312 | #define IMAGE_SYM_CLASS_BIT_FIELD UINT8_C(18)
|
---|
2313 | #define IMAGE_SYM_CLASS_FAR_EXTERNAL UINT8_C(68)
|
---|
2314 | #define IMAGE_SYM_CLASS_BLOCK UINT8_C(100)
|
---|
2315 | #define IMAGE_SYM_CLASS_FUNCTION UINT8_C(101)
|
---|
2316 | #define IMAGE_SYM_CLASS_END_OF_STRUCT UINT8_C(102)
|
---|
2317 | #define IMAGE_SYM_CLASS_FILE UINT8_C(103)
|
---|
2318 | #define IMAGE_SYM_CLASS_SECTION UINT8_C(104)
|
---|
2319 | #define IMAGE_SYM_CLASS_WEAK_EXTERNAL UINT8_C(105)
|
---|
2320 | #define IMAGE_SYM_CLASS_CLR_TOKEN UINT8_C(107)
|
---|
2321 | /** @} */
|
---|
2322 |
|
---|
2323 | /** @name IMAGE_SYM_TYPE_XXX - COFF symbol base types
|
---|
2324 | * @{ */
|
---|
2325 | #define IMAGE_SYM_TYPE_NULL UINT16_C(0x0000)
|
---|
2326 | #define IMAGE_SYM_TYPE_VOID UINT16_C(0x0001)
|
---|
2327 | #define IMAGE_SYM_TYPE_CHAR UINT16_C(0x0002)
|
---|
2328 | #define IMAGE_SYM_TYPE_SHORT UINT16_C(0x0003)
|
---|
2329 | #define IMAGE_SYM_TYPE_INT UINT16_C(0x0004)
|
---|
2330 | #define IMAGE_SYM_TYPE_LONG UINT16_C(0x0005)
|
---|
2331 | #define IMAGE_SYM_TYPE_FLOAT UINT16_C(0x0006)
|
---|
2332 | #define IMAGE_SYM_TYPE_DOUBLE UINT16_C(0x0007)
|
---|
2333 | #define IMAGE_SYM_TYPE_STRUCT UINT16_C(0x0008)
|
---|
2334 | #define IMAGE_SYM_TYPE_UNION UINT16_C(0x0009)
|
---|
2335 | #define IMAGE_SYM_TYPE_ENUM UINT16_C(0x000a)
|
---|
2336 | #define IMAGE_SYM_TYPE_MOE UINT16_C(0x000b)
|
---|
2337 | #define IMAGE_SYM_TYPE_BYTE UINT16_C(0x000c)
|
---|
2338 | #define IMAGE_SYM_TYPE_WORD UINT16_C(0x000d)
|
---|
2339 | #define IMAGE_SYM_TYPE_UINT UINT16_C(0x000e)
|
---|
2340 | #define IMAGE_SYM_TYPE_DWORD UINT16_C(0x000f)
|
---|
2341 | #define IMAGE_SYM_TYPE_PCODE UINT16_C(0x8000)
|
---|
2342 | /** @} */
|
---|
2343 |
|
---|
2344 | /** @name IMAGE_SYM_DTYPE_XXX - COFF symbol complex types
|
---|
2345 | * @{ */
|
---|
2346 | #define IMAGE_SYM_DTYPE_NULL UINT16_C(0x0)
|
---|
2347 | #define IMAGE_SYM_DTYPE_POINTER UINT16_C(0x1)
|
---|
2348 | #define IMAGE_SYM_DTYPE_FUNCTION UINT16_C(0x2)
|
---|
2349 | #define IMAGE_SYM_DTYPE_ARRAY UINT16_C(0x3)
|
---|
2350 | /** @} */
|
---|
2351 |
|
---|
2352 | /** @name COFF Symbol type masks and shift counts.
|
---|
2353 | * @{ */
|
---|
2354 | #define N_BTMASK UINT16_C(0x000f)
|
---|
2355 | #define N_TMASK UINT16_C(0x0030)
|
---|
2356 | #define N_TMASK1 UINT16_C(0x00c0)
|
---|
2357 | #define N_TMASK2 UINT16_C(0x00f0)
|
---|
2358 | #define N_BTSHFT 4
|
---|
2359 | #define N_TSHIFT 2
|
---|
2360 | /** @} */
|
---|
2361 |
|
---|
2362 | /** @name COFF Symbol type macros.
|
---|
2363 | * @{ */
|
---|
2364 | #define BTYPE(a_Type) ( (a_Type) & N_BTMASK )
|
---|
2365 | #define ISPTR(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_POINTER << N_BTSHFT) )
|
---|
2366 | #define ISFCN(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_FUNCTION << N_BTSHFT) )
|
---|
2367 | #define ISARY(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_ARRAY << N_BTSHFT) )
|
---|
2368 | #define ISTAG(a_StorageClass) ( (a_StorageClass) == IMAGE_SYM_CLASS_STRUCT_TAG \
|
---|
2369 | || (a_StorageClass) == IMAGE_SYM_CLASS_UNION_TAG \
|
---|
2370 | || (a_StorageClass) == IMAGE_SYM_CLASS_ENUM_TAG )
|
---|
2371 | /** @} */
|
---|
2372 |
|
---|
2373 |
|
---|
2374 | /**
|
---|
2375 | * COFF relocation table entry.
|
---|
2376 | *
|
---|
2377 | * @note The size of the structure is not a multiple of the largest member
|
---|
2378 | * (uint32_t), so odd relocation table entry members will have
|
---|
2379 | * misaligned uint32_t members.
|
---|
2380 | */
|
---|
2381 | #pragma pack(1)
|
---|
2382 | typedef struct _IMAGE_RELOCATION
|
---|
2383 | {
|
---|
2384 | union
|
---|
2385 | {
|
---|
2386 | uint32_t VirtualAddress;
|
---|
2387 | uint32_t RelocCount;
|
---|
2388 | } u;
|
---|
2389 | uint32_t SymbolTableIndex;
|
---|
2390 | uint16_t Type;
|
---|
2391 | } IMAGE_RELOCATION;
|
---|
2392 | #pragma pack()
|
---|
2393 | /** The size of a COFF relocation entry. */
|
---|
2394 | #define IMAGE_SIZEOF_RELOCATION 10
|
---|
2395 | AssertCompileSize(IMAGE_RELOCATION, IMAGE_SIZEOF_RELOCATION);
|
---|
2396 | typedef IMAGE_RELOCATION *PIMAGE_RELOCATION;
|
---|
2397 | typedef IMAGE_RELOCATION const *PCIMAGE_RELOCATION;
|
---|
2398 |
|
---|
2399 |
|
---|
2400 | /** @name IMAGE_REL_AMD64_XXX - COFF relocations for AMD64 CPUs.
|
---|
2401 | * Used by IMAGE_RELOCATION::Type.
|
---|
2402 | * @{ */
|
---|
2403 | #define IMAGE_REL_AMD64_ABSOLUTE UINT16_C(0x0000)
|
---|
2404 | #define IMAGE_REL_AMD64_ADDR64 UINT16_C(0x0001)
|
---|
2405 | #define IMAGE_REL_AMD64_ADDR32 UINT16_C(0x0002)
|
---|
2406 | #define IMAGE_REL_AMD64_ADDR32NB UINT16_C(0x0003)
|
---|
2407 | #define IMAGE_REL_AMD64_REL32 UINT16_C(0x0004)
|
---|
2408 | #define IMAGE_REL_AMD64_REL32_1 UINT16_C(0x0005)
|
---|
2409 | #define IMAGE_REL_AMD64_REL32_2 UINT16_C(0x0006)
|
---|
2410 | #define IMAGE_REL_AMD64_REL32_3 UINT16_C(0x0007)
|
---|
2411 | #define IMAGE_REL_AMD64_REL32_4 UINT16_C(0x0008)
|
---|
2412 | #define IMAGE_REL_AMD64_REL32_5 UINT16_C(0x0009)
|
---|
2413 | #define IMAGE_REL_AMD64_SECTION UINT16_C(0x000a)
|
---|
2414 | #define IMAGE_REL_AMD64_SECREL UINT16_C(0x000b)
|
---|
2415 | #define IMAGE_REL_AMD64_SECREL7 UINT16_C(0x000c)
|
---|
2416 | #define IMAGE_REL_AMD64_TOKEN UINT16_C(0x000d)
|
---|
2417 | #define IMAGE_REL_AMD64_SREL32 UINT16_C(0x000e)
|
---|
2418 | #define IMAGE_REL_AMD64_PAIR UINT16_C(0x000f)
|
---|
2419 | #define IMAGE_REL_AMD64_SSPAN32 UINT16_C(0x0010)
|
---|
2420 | /** @} */
|
---|
2421 |
|
---|
2422 | /** @name ARM IMAGE_REL_ARM_XXX - COFF relocations for ARM CPUs.
|
---|
2423 | * Used by IMAGE_RELOCATION::Type.
|
---|
2424 | * @{ */
|
---|
2425 | #define IMAGE_REL_ARM_ABSOLUTE UINT16_C(0x0000)
|
---|
2426 | #define IMAGE_REL_ARM_ADDR32 UINT16_C(0x0001)
|
---|
2427 | #define IMAGE_REL_ARM_ADDR32NB UINT16_C(0x0002)
|
---|
2428 | #define IMAGE_REL_ARM_BRANCH24 UINT16_C(0x0003)
|
---|
2429 | #define IMAGE_REL_ARM_BRANCH11 UINT16_C(0x0004)
|
---|
2430 | #define IMAGE_REL_ARM_TOKEN UINT16_C(0x0005)
|
---|
2431 | #define IMAGE_REL_ARM_BLX24 UINT16_C(0x0008)
|
---|
2432 | #define IMAGE_REL_ARM_BLX11 UINT16_C(0x0009)
|
---|
2433 | #define IMAGE_REL_ARM_SECTION UINT16_C(0x000e)
|
---|
2434 | #define IMAGE_REL_ARM_SECREL UINT16_C(0x000f)
|
---|
2435 | #define IMAGE_REL_ARM_MOV32A UINT16_C(0x0010)
|
---|
2436 | #define IMAGE_REL_ARM_MOV32T UINT16_C(0x0011)
|
---|
2437 | #define IMAGE_REL_ARM_BRANCH20T UINT16_C(0x0012)
|
---|
2438 | #define IMAGE_REL_ARM_BRANCH24T UINT16_C(0x0014)
|
---|
2439 | #define IMAGE_REL_ARM_BLX23T UINT16_C(0x0015)
|
---|
2440 | /** @} */
|
---|
2441 |
|
---|
2442 | /** @name IMAGE_REL_ARM64_XXX - COFF relocations for ARMv8 CPUs (64-bit).
|
---|
2443 | * Used by IMAGE_RELOCATION::Type.
|
---|
2444 | * @{ */
|
---|
2445 | #define IMAGE_REL_ARM64_ABSOLUTE UINT16_C(0x0000)
|
---|
2446 | #define IMAGE_REL_ARM64_ADDR32 UINT16_C(0x0001)
|
---|
2447 | #define IMAGE_REL_ARM64_ADDR32NB UINT16_C(0x0002)
|
---|
2448 | #define IMAGE_REL_ARM64_BRANCH26 UINT16_C(0x0003)
|
---|
2449 | #define IMAGE_REL_ARM64_PAGEBASE_REL21 UINT16_C(0x0004)
|
---|
2450 | #define IMAGE_REL_ARM64_REL21 UINT16_C(0x0005)
|
---|
2451 | #define IMAGE_REL_ARM64_PAGEOFFSET_12A UINT16_C(0x0006)
|
---|
2452 | #define IMAGE_REL_ARM64_PAGEOFFSET_12L UINT16_C(0x0007)
|
---|
2453 | #define IMAGE_REL_ARM64_SECREL UINT16_C(0x0008)
|
---|
2454 | #define IMAGE_REL_ARM64_SECREL_LOW12A UINT16_C(0x0009)
|
---|
2455 | #define IMAGE_REL_ARM64_SECREL_HIGH12A UINT16_C(0x000a)
|
---|
2456 | #define IMAGE_REL_ARM64_SECREL_LOW12L UINT16_C(0x000b)
|
---|
2457 | #define IMAGE_REL_ARM64_TOKEN UINT16_C(0x000c)
|
---|
2458 | #define IMAGE_REL_ARM64_SECTION UINT16_C(0x000d)
|
---|
2459 | #define IMAGE_REL_ARM64_ADDR64 UINT16_C(0x000e)
|
---|
2460 | /** @} */
|
---|
2461 |
|
---|
2462 | /** @name IMAGE_REL_SH3_XXX - COFF relocation for Hitachi SuperH CPUs.
|
---|
2463 | * Used by IMAGE_RELOCATION::Type.
|
---|
2464 | * @{ */
|
---|
2465 | #define IMAGE_REL_SH3_ABSOLUTE UINT16_C(0x0000)
|
---|
2466 | #define IMAGE_REL_SH3_DIRECT16 UINT16_C(0x0001)
|
---|
2467 | #define IMAGE_REL_SH3_DIRECT32 UINT16_C(0x0002)
|
---|
2468 | #define IMAGE_REL_SH3_DIRECT8 UINT16_C(0x0003)
|
---|
2469 | #define IMAGE_REL_SH3_DIRECT8_WORD UINT16_C(0x0004)
|
---|
2470 | #define IMAGE_REL_SH3_DIRECT8_LONG UINT16_C(0x0005)
|
---|
2471 | #define IMAGE_REL_SH3_DIRECT4 UINT16_C(0x0006)
|
---|
2472 | #define IMAGE_REL_SH3_DIRECT4_WORD UINT16_C(0x0007)
|
---|
2473 | #define IMAGE_REL_SH3_DIRECT4_LONG UINT16_C(0x0008)
|
---|
2474 | #define IMAGE_REL_SH3_PCREL8_WORD UINT16_C(0x0009)
|
---|
2475 | #define IMAGE_REL_SH3_PCREL8_LONG UINT16_C(0x000a)
|
---|
2476 | #define IMAGE_REL_SH3_PCREL12_WORD UINT16_C(0x000b)
|
---|
2477 | #define IMAGE_REL_SH3_STARTOF_SECTION UINT16_C(0x000c)
|
---|
2478 | #define IMAGE_REL_SH3_SIZEOF_SECTION UINT16_C(0x000d)
|
---|
2479 | #define IMAGE_REL_SH3_SECTION UINT16_C(0x000e)
|
---|
2480 | #define IMAGE_REL_SH3_SECREL UINT16_C(0x000f)
|
---|
2481 | #define IMAGE_REL_SH3_DIRECT32_NB UINT16_C(0x0010)
|
---|
2482 | #define IMAGE_REL_SH3_GPREL4_LONG UINT16_C(0x0011)
|
---|
2483 | #define IMAGE_REL_SH3_TOKEN UINT16_C(0x0012)
|
---|
2484 | #define IMAGE_REL_SHM_PCRELPT UINT16_C(0x0013)
|
---|
2485 | #define IMAGE_REL_SHM_REFLO UINT16_C(0x0014)
|
---|
2486 | #define IMAGE_REL_SHM_REFHALF UINT16_C(0x0015)
|
---|
2487 | #define IMAGE_REL_SHM_RELLO UINT16_C(0x0016)
|
---|
2488 | #define IMAGE_REL_SHM_RELHALF UINT16_C(0x0017)
|
---|
2489 | #define IMAGE_REL_SHM_PAIR UINT16_C(0x0018)
|
---|
2490 | #define IMAGE_REL_SHM_NOMODE UINT16_C(0x8000)
|
---|
2491 | /** @} */
|
---|
2492 |
|
---|
2493 | /** @name IMAGE_REL_PPC_XXX - COFF relocations for IBM PowerPC CPUs.
|
---|
2494 | * Used by IMAGE_RELOCATION::Type.
|
---|
2495 | * @{ */
|
---|
2496 | #define IMAGE_REL_PPC_ABSOLUTE UINT16_C(0x0000)
|
---|
2497 | #define IMAGE_REL_PPC_ADDR64 UINT16_C(0x0001)
|
---|
2498 | #define IMAGE_REL_PPC_ADDR32 UINT16_C(0x0002)
|
---|
2499 | #define IMAGE_REL_PPC_ADDR24 UINT16_C(0x0003)
|
---|
2500 | #define IMAGE_REL_PPC_ADDR16 UINT16_C(0x0004)
|
---|
2501 | #define IMAGE_REL_PPC_ADDR14 UINT16_C(0x0005)
|
---|
2502 | #define IMAGE_REL_PPC_REL24 UINT16_C(0x0006)
|
---|
2503 | #define IMAGE_REL_PPC_REL14 UINT16_C(0x0007)
|
---|
2504 | #define IMAGE_REL_PPC_ADDR32NB UINT16_C(0x000a)
|
---|
2505 | #define IMAGE_REL_PPC_SECREL UINT16_C(0x000b)
|
---|
2506 | #define IMAGE_REL_PPC_SECTION UINT16_C(0x000c)
|
---|
2507 | #define IMAGE_REL_PPC_SECREL16 UINT16_C(0x000f)
|
---|
2508 | #define IMAGE_REL_PPC_REFHI UINT16_C(0x0010)
|
---|
2509 | #define IMAGE_REL_PPC_REFLO UINT16_C(0x0011)
|
---|
2510 | #define IMAGE_REL_PPC_PAIR UINT16_C(0x0012)
|
---|
2511 | #define IMAGE_REL_PPC_SECRELLO UINT16_C(0x0013)
|
---|
2512 | #define IMAGE_REL_PPC_GPREL UINT16_C(0x0015)
|
---|
2513 | #define IMAGE_REL_PPC_TOKEN UINT16_C(0x0016)
|
---|
2514 | /** @} */
|
---|
2515 |
|
---|
2516 | /** @name IMAGE_REL_I386_XXX - COFF relocations for x86 CPUs.
|
---|
2517 | * Used by IMAGE_RELOCATION::Type.
|
---|
2518 | * @{ */
|
---|
2519 | #define IMAGE_REL_I386_ABSOLUTE UINT16_C(0x0000)
|
---|
2520 | #define IMAGE_REL_I386_DIR16 UINT16_C(0x0001)
|
---|
2521 | #define IMAGE_REL_I386_REL16 UINT16_C(0x0002)
|
---|
2522 | #define IMAGE_REL_I386_DIR32 UINT16_C(0x0006)
|
---|
2523 | #define IMAGE_REL_I386_DIR32NB UINT16_C(0x0007)
|
---|
2524 | #define IMAGE_REL_I386_SEG12 UINT16_C(0x0009)
|
---|
2525 | #define IMAGE_REL_I386_SECTION UINT16_C(0x000A)
|
---|
2526 | #define IMAGE_REL_I386_SECREL UINT16_C(0x000B)
|
---|
2527 | #define IMAGE_REL_I386_TOKEN UINT16_C(0x000C)
|
---|
2528 | #define IMAGE_REL_I386_SECREL7 UINT16_C(0x000D)
|
---|
2529 | #define IMAGE_REL_I386_REL32 UINT16_C(0x0014)
|
---|
2530 | /** @} */
|
---|
2531 |
|
---|
2532 | /** @name IMAGE_REL_IA64_XXX - COFF relocations for "Itanic" CPUs.
|
---|
2533 | * @{ */
|
---|
2534 | #define IMAGE_REL_IA64_ABSOLUTE UINT16_C(0x0000)
|
---|
2535 | #define IMAGE_REL_IA64_IMM14 UINT16_C(0x0001)
|
---|
2536 | #define IMAGE_REL_IA64_IMM22 UINT16_C(0x0002)
|
---|
2537 | #define IMAGE_REL_IA64_IMM64 UINT16_C(0x0003)
|
---|
2538 | #define IMAGE_REL_IA64_DIR32 UINT16_C(0x0004)
|
---|
2539 | #define IMAGE_REL_IA64_DIR64 UINT16_C(0x0005)
|
---|
2540 | #define IMAGE_REL_IA64_PCREL21B UINT16_C(0x0006)
|
---|
2541 | #define IMAGE_REL_IA64_PCREL21M UINT16_C(0x0007)
|
---|
2542 | #define IMAGE_REL_IA64_PCREL21F UINT16_C(0x0008)
|
---|
2543 | #define IMAGE_REL_IA64_GPREL22 UINT16_C(0x0009)
|
---|
2544 | #define IMAGE_REL_IA64_LTOFF22 UINT16_C(0x000a)
|
---|
2545 | #define IMAGE_REL_IA64_SECTION UINT16_C(0x000b)
|
---|
2546 | #define IMAGE_REL_IA64_SECREL22 UINT16_C(0x000c)
|
---|
2547 | #define IMAGE_REL_IA64_SECREL64I UINT16_C(0x000d)
|
---|
2548 | #define IMAGE_REL_IA64_SECREL32 UINT16_C(0x000e)
|
---|
2549 | #define IMAGE_REL_IA64_DIR32NB UINT16_C(0x0010)
|
---|
2550 | #define IMAGE_REL_IA64_SREL14 UINT16_C(0x0011)
|
---|
2551 | #define IMAGE_REL_IA64_SREL22 UINT16_C(0x0012)
|
---|
2552 | #define IMAGE_REL_IA64_SREL32 UINT16_C(0x0013)
|
---|
2553 | #define IMAGE_REL_IA64_UREL32 UINT16_C(0x0014)
|
---|
2554 | #define IMAGE_REL_IA64_PCREL60X UINT16_C(0x0015)
|
---|
2555 | #define IMAGE_REL_IA64_PCREL60B UINT16_C(0x0016)
|
---|
2556 | #define IMAGE_REL_IA64_PCREL60F UINT16_C(0x0017)
|
---|
2557 | #define IMAGE_REL_IA64_PCREL60I UINT16_C(0x0018)
|
---|
2558 | #define IMAGE_REL_IA64_PCREL60M UINT16_C(0x0019)
|
---|
2559 | #define IMAGE_REL_IA64_IMMGPREL64 UINT16_C(0x001a)
|
---|
2560 | #define IMAGE_REL_IA64_TOKEN UINT16_C(0x001b)
|
---|
2561 | #define IMAGE_REL_IA64_GPREL32 UINT16_C(0x001c)
|
---|
2562 | #define IMAGE_REL_IA64_ADDEND UINT16_C(0x001f)
|
---|
2563 | /** @} */
|
---|
2564 |
|
---|
2565 | /** @name IMAGE_REL_MIPS_XXX - COFF relocations for MIPS CPUs.
|
---|
2566 | * Used by IMAGE_RELOCATION::Type.
|
---|
2567 | * @{ */
|
---|
2568 | #define IMAGE_REL_MIPS_ABSOLUTE UINT16_C(0x0000)
|
---|
2569 | #define IMAGE_REL_MIPS_REFHALF UINT16_C(0x0001)
|
---|
2570 | #define IMAGE_REL_MIPS_REFWORD UINT16_C(0x0002)
|
---|
2571 | #define IMAGE_REL_MIPS_JMPADDR UINT16_C(0x0003)
|
---|
2572 | #define IMAGE_REL_MIPS_REFHI UINT16_C(0x0004)
|
---|
2573 | #define IMAGE_REL_MIPS_REFLO UINT16_C(0x0005)
|
---|
2574 | #define IMAGE_REL_MIPS_GPREL UINT16_C(0x0006)
|
---|
2575 | #define IMAGE_REL_MIPS_LITERAL UINT16_C(0x0007)
|
---|
2576 | #define IMAGE_REL_MIPS_SECTION UINT16_C(0x000a)
|
---|
2577 | #define IMAGE_REL_MIPS_SECREL UINT16_C(0x000b)
|
---|
2578 | #define IMAGE_REL_MIPS_SECRELLO UINT16_C(0x000c)
|
---|
2579 | #define IMAGE_REL_MIPS_SECRELHI UINT16_C(0x000d)
|
---|
2580 | #define IMAGE_REL_MIPS_JMPADDR16 UINT16_C(0x0010)
|
---|
2581 | #define IMAGE_REL_MIPS_REFWORDNB UINT16_C(0x0022)
|
---|
2582 | #define IMAGE_REL_MIPS_PAIR UINT16_C(0x0025)
|
---|
2583 | /** @} */
|
---|
2584 |
|
---|
2585 | /** @name IMAGE_REL_M32R_XXX - COFF relocations for Mitsubishi M32R CPUs.
|
---|
2586 | * Used by IMAGE_RELOCATION::Type.
|
---|
2587 | * @{ */
|
---|
2588 | #define IMAGE_REL_M32R_ABSOLUTE UINT16_C(0x0000)
|
---|
2589 | #define IMAGE_REL_M32R_ADDR32 UINT16_C(0x0001)
|
---|
2590 | #define IMAGE_REL_M32R_ADDR32NB UINT16_C(0x0002)
|
---|
2591 | #define IMAGE_REL_M32R_ADDR24 UINT16_C(0x0003)
|
---|
2592 | #define IMAGE_REL_M32R_GPREL16 UINT16_C(0x0004)
|
---|
2593 | #define IMAGE_REL_M32R_PCREL24 UINT16_C(0x0005)
|
---|
2594 | #define IMAGE_REL_M32R_PCREL16 UINT16_C(0x0006)
|
---|
2595 | #define IMAGE_REL_M32R_PCREL8 UINT16_C(0x0007)
|
---|
2596 | #define IMAGE_REL_M32R_REFHALF UINT16_C(0x0008)
|
---|
2597 | #define IMAGE_REL_M32R_REFHI UINT16_C(0x0009)
|
---|
2598 | #define IMAGE_REL_M32R_REFLO UINT16_C(0x000a)
|
---|
2599 | #define IMAGE_REL_M32R_PAIR UINT16_C(0x000b)
|
---|
2600 | #define IMAGE_REL_M32R_SECTION UINT16_C(0x000c)
|
---|
2601 | #define IMAGE_REL_M32R_SECREL UINT16_C(0x000d)
|
---|
2602 | #define IMAGE_REL_M32R_TOKEN UINT16_C(0x000e)
|
---|
2603 | /** @} */
|
---|
2604 |
|
---|
2605 |
|
---|
2606 | /** @} */
|
---|
2607 |
|
---|
2608 | #endif /* !IPRT_INCLUDED_formats_pecoff_h */
|
---|
2609 |
|
---|