1 | /* $Id: ldrPE.h 56290 2015-06-09 14:01:31Z vboxsync $ */
|
---|
2 | /** @file
|
---|
3 | * IPRT - Windows NT PE Structures and Constants.
|
---|
4 | */
|
---|
5 |
|
---|
6 | /*
|
---|
7 | * Copyright (C) 2006-2015 Oracle Corporation
|
---|
8 | *
|
---|
9 | * This file is part of VirtualBox Open Source Edition (OSE), as
|
---|
10 | * available from http://www.virtualbox.org. This file is free software;
|
---|
11 | * you can redistribute it and/or modify it under the terms of the GNU
|
---|
12 | * General Public License (GPL) as published by the Free Software
|
---|
13 | * Foundation, in version 2 as it comes in the "COPYING" file of the
|
---|
14 | * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
|
---|
15 | * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
|
---|
16 | *
|
---|
17 | * The contents of this file may alternatively be used under the terms
|
---|
18 | * of the Common Development and Distribution License Version 1.0
|
---|
19 | * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
|
---|
20 | * VirtualBox OSE distribution, in which case the provisions of the
|
---|
21 | * CDDL are applicable instead of those of the GPL.
|
---|
22 | *
|
---|
23 | * You may elect to license modified versions of this file under the
|
---|
24 | * terms and conditions of either the GPL or the CDDL or both.
|
---|
25 | */
|
---|
26 |
|
---|
27 | #ifndef ___internal_ldrPE_h
|
---|
28 | #define ___internal_ldrPE_h
|
---|
29 |
|
---|
30 | #include <iprt/types.h>
|
---|
31 | #include <iprt/assert.h>
|
---|
32 |
|
---|
33 | #pragma pack(4) /** @todo Necessary? */
|
---|
34 |
|
---|
35 |
|
---|
36 | /*******************************************************************************
|
---|
37 | * Defined Constants And Macros *
|
---|
38 | *******************************************************************************/
|
---|
39 | #define IMAGE_NT_SIGNATURE 0x00004550
|
---|
40 |
|
---|
41 | /* file header */
|
---|
42 | #define IMAGE_FILE_MACHINE_I386 0x014c
|
---|
43 | #define IMAGE_FILE_MACHINE_AMD64 0x8664
|
---|
44 |
|
---|
45 | #define IMAGE_FILE_RELOCS_STRIPPED 0x0001
|
---|
46 | #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002
|
---|
47 | #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004
|
---|
48 | #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008
|
---|
49 | #define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010
|
---|
50 | #define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020
|
---|
51 | #define IMAGE_FILE_16BIT_MACHINE 0x0040
|
---|
52 | #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080
|
---|
53 | #define IMAGE_FILE_32BIT_MACHINE 0x0100
|
---|
54 | #define IMAGE_FILE_DEBUG_STRIPPED 0x0200
|
---|
55 | #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400
|
---|
56 | #define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800
|
---|
57 | #define IMAGE_FILE_SYSTEM 0x1000
|
---|
58 | #define IMAGE_FILE_DLL 0x2000
|
---|
59 | #define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000
|
---|
60 | #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000
|
---|
61 |
|
---|
62 |
|
---|
63 | /* optional header */
|
---|
64 | #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10B
|
---|
65 | #define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20B
|
---|
66 |
|
---|
67 | #define IMAGE_SUBSYSTEM_UNKNOWN 0x0
|
---|
68 | #define IMAGE_SUBSYSTEM_NATIVE 0x1
|
---|
69 | #define IMAGE_SUBSYSTEM_WINDOWS_GUI 0x2
|
---|
70 | #define IMAGE_SUBSYSTEM_WINDOWS_CUI 0x3
|
---|
71 | #define IMAGE_SUBSYSTEM_OS2_GUI 0x4
|
---|
72 | #define IMAGE_SUBSYSTEM_OS2_CUI 0x5
|
---|
73 | #define IMAGE_SUBSYSTEM_POSIX_CUI 0x7
|
---|
74 |
|
---|
75 | #define IMAGE_LIBRARY_PROCESS_INIT 0x0001
|
---|
76 | #define IMAGE_LIBRARY_PROCESS_TERM 0x0002
|
---|
77 | #define IMAGE_LIBRARY_THREAD_INIT 0x0004
|
---|
78 | #define IMAGE_LIBRARY_THREAD_TERM 0x0008
|
---|
79 | #define IMAGE_DLLCHARACTERISTICS_RESERVED 0x0010
|
---|
80 | #define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA 0x0020
|
---|
81 | #define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040
|
---|
82 | #define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY 0x0080
|
---|
83 | #define IMAGE_DLLCHARACTERISTICS_NX_COMPAT 0x0100
|
---|
84 | #define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200
|
---|
85 | #define IMAGE_DLLCHARACTERISTICS_NO_SEH 0x0400
|
---|
86 | #define IMAGE_DLLCHARACTERISTICS_NO_BIND 0x0800
|
---|
87 | #define IMAGE_DLLCHARACTERISTICS_APPCONTAINER 0x1000
|
---|
88 | #define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER 0x2000
|
---|
89 | #define IMAGE_DLLCHARACTERISTICS_GUARD_CF 0x4000
|
---|
90 | #define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000
|
---|
91 |
|
---|
92 | #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 0x10
|
---|
93 |
|
---|
94 | #define IMAGE_DIRECTORY_ENTRY_EXPORT 0x0
|
---|
95 | #define IMAGE_DIRECTORY_ENTRY_IMPORT 0x1
|
---|
96 | #define IMAGE_DIRECTORY_ENTRY_RESOURCE 0x2
|
---|
97 | #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x3
|
---|
98 | #define IMAGE_DIRECTORY_ENTRY_SECURITY 0x4
|
---|
99 | #define IMAGE_DIRECTORY_ENTRY_BASERELOC 0x5
|
---|
100 | #define IMAGE_DIRECTORY_ENTRY_DEBUG 0x6
|
---|
101 | #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 0x7
|
---|
102 | #define IMAGE_DIRECTORY_ENTRY_COPYRIGHT IMAGE_DIRECTORY_ENTRY_ARCHITECTURE
|
---|
103 | #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x8
|
---|
104 | #define IMAGE_DIRECTORY_ENTRY_TLS 0x9
|
---|
105 | #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0xa
|
---|
106 | #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0xb
|
---|
107 | #define IMAGE_DIRECTORY_ENTRY_IAT 0xc
|
---|
108 | #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0xd
|
---|
109 | #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0xe
|
---|
110 |
|
---|
111 |
|
---|
112 | /* section header */
|
---|
113 | #define IMAGE_SIZEOF_SHORT_NAME 0x8
|
---|
114 |
|
---|
115 | #define IMAGE_SCN_TYPE_REG 0x00000000
|
---|
116 | #define IMAGE_SCN_TYPE_DSECT 0x00000001
|
---|
117 | #define IMAGE_SCN_TYPE_NOLOAD 0x00000002
|
---|
118 | #define IMAGE_SCN_TYPE_GROUP 0x00000004
|
---|
119 | #define IMAGE_SCN_TYPE_NO_PAD 0x00000008
|
---|
120 | #define IMAGE_SCN_TYPE_COPY 0x00000010
|
---|
121 |
|
---|
122 | #define IMAGE_SCN_CNT_CODE 0x00000020
|
---|
123 | #define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040
|
---|
124 | #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080
|
---|
125 |
|
---|
126 | #define IMAGE_SCN_LNK_OTHER 0x00000100
|
---|
127 | #define IMAGE_SCN_LNK_INFO 0x00000200
|
---|
128 | #define IMAGE_SCN_TYPE_OVER 0x00000400
|
---|
129 | #define IMAGE_SCN_LNK_REMOVE 0x00000800
|
---|
130 | #define IMAGE_SCN_LNK_COMDAT 0x00001000
|
---|
131 | #define IMAGE_SCN_MEM_PROTECTED 0x00004000
|
---|
132 | #define IMAGE_SCN_NO_DEFER_SPEC_EXC 0x00004000
|
---|
133 | #define IMAGE_SCN_GPREL 0x00008000
|
---|
134 | #define IMAGE_SCN_MEM_FARDATA 0x00008000
|
---|
135 | #define IMAGE_SCN_MEM_SYSHEAP 0x00010000
|
---|
136 | #define IMAGE_SCN_MEM_PURGEABLE 0x00020000
|
---|
137 | #define IMAGE_SCN_MEM_16BIT 0x00020000
|
---|
138 | #define IMAGE_SCN_MEM_LOCKED 0x00040000
|
---|
139 | #define IMAGE_SCN_MEM_PRELOAD 0x00080000
|
---|
140 |
|
---|
141 | #define IMAGE_SCN_ALIGN_1BYTES 0x00100000
|
---|
142 | #define IMAGE_SCN_ALIGN_2BYTES 0x00200000
|
---|
143 | #define IMAGE_SCN_ALIGN_4BYTES 0x00300000
|
---|
144 | #define IMAGE_SCN_ALIGN_8BYTES 0x00400000
|
---|
145 | #define IMAGE_SCN_ALIGN_16BYTES 0x00500000
|
---|
146 | #define IMAGE_SCN_ALIGN_32BYTES 0x00600000
|
---|
147 | #define IMAGE_SCN_ALIGN_64BYTES 0x00700000
|
---|
148 | #define IMAGE_SCN_ALIGN_128BYTES 0x00800000
|
---|
149 | #define IMAGE_SCN_ALIGN_256BYTES 0x00900000
|
---|
150 | #define IMAGE_SCN_ALIGN_512BYTES 0x00A00000
|
---|
151 | #define IMAGE_SCN_ALIGN_1024BYTES 0x00B00000
|
---|
152 | #define IMAGE_SCN_ALIGN_2048BYTES 0x00C00000
|
---|
153 | #define IMAGE_SCN_ALIGN_4096BYTES 0x00D00000
|
---|
154 | #define IMAGE_SCN_ALIGN_8192BYTES 0x00E00000
|
---|
155 | #define IMAGE_SCN_ALIGN_MASK 0x00F00000
|
---|
156 | #define IMAGE_SCN_ALIGN_SHIFT 20
|
---|
157 |
|
---|
158 | #define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000
|
---|
159 | #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
|
---|
160 | #define IMAGE_SCN_MEM_NOT_CACHED 0x04000000
|
---|
161 | #define IMAGE_SCN_MEM_NOT_PAGED 0x08000000
|
---|
162 | #define IMAGE_SCN_MEM_SHARED 0x10000000
|
---|
163 | #define IMAGE_SCN_MEM_EXECUTE 0x20000000
|
---|
164 | #define IMAGE_SCN_MEM_READ 0x40000000
|
---|
165 | #define IMAGE_SCN_MEM_WRITE 0x80000000
|
---|
166 |
|
---|
167 |
|
---|
168 | /* relocations */
|
---|
169 | #define IMAGE_REL_BASED_ABSOLUTE 0x0
|
---|
170 | #define IMAGE_REL_BASED_HIGH 0x1
|
---|
171 | #define IMAGE_REL_BASED_LOW 0x2
|
---|
172 | #define IMAGE_REL_BASED_HIGHLOW 0x3
|
---|
173 | #define IMAGE_REL_BASED_HIGHADJ 0x4
|
---|
174 | #define IMAGE_REL_BASED_MIPS_JMPADDR 0x5
|
---|
175 | #define IMAGE_REL_BASED_MIPS_JMPADDR16 0x9
|
---|
176 | #define IMAGE_REL_BASED_IA64_IMM64 0x9
|
---|
177 | #define IMAGE_REL_BASED_DIR64 0xa
|
---|
178 | #define IMAGE_REL_BASED_HIGH3ADJ 0xb
|
---|
179 |
|
---|
180 |
|
---|
181 | /* imports */
|
---|
182 | #define IMAGE_ORDINAL_FLAG32 0x80000000
|
---|
183 | #define IMAGE_ORDINAL32(ord) ((ord) & 0xffff)
|
---|
184 | #define IMAGE_SNAP_BY_ORDINAL32(ord) (!!((ord) & IMAGE_ORDINAL_FLAG32))
|
---|
185 |
|
---|
186 | #define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL
|
---|
187 | #define IMAGE_ORDINAL64(ord) ((ord) & 0xffff)
|
---|
188 | #define IMAGE_SNAP_BY_ORDINAL64(ord) (!!((ord) & IMAGE_ORDINAL_FLAG64))
|
---|
189 |
|
---|
190 |
|
---|
191 | /* debug dir */
|
---|
192 | #define IMAGE_DEBUG_TYPE_UNKNOWN UINT32_C(0x0)
|
---|
193 | #define IMAGE_DEBUG_TYPE_COFF UINT32_C(0x1)
|
---|
194 | #define IMAGE_DEBUG_TYPE_CODEVIEW UINT32_C(0x2)
|
---|
195 | #define IMAGE_DEBUG_TYPE_FPO UINT32_C(0x3)
|
---|
196 | #define IMAGE_DEBUG_TYPE_MISC UINT32_C(0x4)
|
---|
197 | #define IMAGE_DEBUG_TYPE_EXCEPTION UINT32_C(0x5)
|
---|
198 | #define IMAGE_DEBUG_TYPE_FIXUP UINT32_C(0x6)
|
---|
199 | #define IMAGE_DEBUG_TYPE_OMAP_TO_SRC UINT32_C(0x7)
|
---|
200 | #define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC UINT32_C(0x8)
|
---|
201 | #define IMAGE_DEBUG_TYPE_BORLAND UINT32_C(0x9)
|
---|
202 | #define IMAGE_DEBUG_TYPE_RESERVED10 UINT32_C(0x10)
|
---|
203 |
|
---|
204 | #define IMAGE_DEBUG_MISC_EXENAME UINT32_C(1)
|
---|
205 |
|
---|
206 | /* security directory */
|
---|
207 | #define WIN_CERT_REVISION_1_0 UINT16_C(0x0100)
|
---|
208 | #define WIN_CERT_REVISION_2_0 UINT16_C(0x0200)
|
---|
209 |
|
---|
210 | #define WIN_CERT_TYPE_X509 UINT16_C(1)
|
---|
211 | #define WIN_CERT_TYPE_PKCS_SIGNED_DATA UINT16_C(2)
|
---|
212 | #define WIN_CERT_TYPE_RESERVED_1 UINT16_C(3)
|
---|
213 | #define WIN_CERT_TYPE_TS_STACK_SIGNED UINT16_C(4)
|
---|
214 | #define WIN_CERT_TYPE_EFI_PKCS115 UINT16_C(0x0ef0)
|
---|
215 | #define WIN_CERT_TYPE_EFI_GUID UINT16_C(0x0ef1)
|
---|
216 |
|
---|
217 | /** The alignment of the certificate table.
|
---|
218 | * @remarks Found thru signtool experiments. */
|
---|
219 | #define WIN_CERTIFICATE_ALIGNMENT 8
|
---|
220 |
|
---|
221 | /* For .DBG files. */
|
---|
222 | #define IMAGE_SEPARATE_DEBUG_SIGNATURE UINT16_C(0x4944)
|
---|
223 |
|
---|
224 | #define IMAGE_SIZE_OF_SYMBOL 18
|
---|
225 | #define IMAGE_SIZE_OF_SYMBOL_EX 20
|
---|
226 |
|
---|
227 | #define IMAGE_SYM_UNDEFINED INT16_C(0)
|
---|
228 | #define IMAGE_SYM_ABSOLUTE INT16_C(-1)
|
---|
229 | #define IMAGE_SYM_DEBUG INT16_C(-2)
|
---|
230 |
|
---|
231 | #define IMAGE_SYM_CLASS_END_OF_FUNCTION UINT8_C(0xff) /* -1 */
|
---|
232 | #define IMAGE_SYM_CLASS_NULL UINT8_C(0)
|
---|
233 | #define IMAGE_SYM_CLASS_AUTOMATIC UINT8_C(1)
|
---|
234 | #define IMAGE_SYM_CLASS_EXTERNAL UINT8_C(2)
|
---|
235 | #define IMAGE_SYM_CLASS_STATIC UINT8_C(3)
|
---|
236 | #define IMAGE_SYM_CLASS_REGISTER UINT8_C(4)
|
---|
237 | #define IMAGE_SYM_CLASS_EXTERNAL_DEF UINT8_C(5)
|
---|
238 | #define IMAGE_SYM_CLASS_LABEL UINT8_C(6)
|
---|
239 | #define IMAGE_SYM_CLASS_UNDEFINED_LABEL UINT8_C(7)
|
---|
240 | #define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT UINT8_C(8)
|
---|
241 | #define IMAGE_SYM_CLASS_ARGUMENT UINT8_C(9)
|
---|
242 | #define IMAGE_SYM_CLASS_STRUCT_TAG UINT8_C(10)
|
---|
243 | #define IMAGE_SYM_CLASS_MEMBER_OF_UNION UINT8_C(11)
|
---|
244 | #define IMAGE_SYM_CLASS_UNION_TAG UINT8_C(12)
|
---|
245 | #define IMAGE_SYM_CLASS_TYPE_DEFINITION UINT8_C(13)
|
---|
246 | #define IMAGE_SYM_CLASS_UNDEFINED_STATIC UINT8_C(14)
|
---|
247 | #define IMAGE_SYM_CLASS_ENUM_TAG UINT8_C(15)
|
---|
248 | #define IMAGE_SYM_CLASS_MEMBER_OF_ENUM UINT8_C(16)
|
---|
249 | #define IMAGE_SYM_CLASS_REGISTER_PARAM UINT8_C(17)
|
---|
250 | #define IMAGE_SYM_CLASS_BIT_FIELD UINT8_C(18)
|
---|
251 | #define IMAGE_SYM_CLASS_FAR_EXTERNAL UINT8_C(68)
|
---|
252 | #define IMAGE_SYM_CLASS_BLOCK UINT8_C(100)
|
---|
253 | #define IMAGE_SYM_CLASS_FUNCTION UINT8_C(101)
|
---|
254 | #define IMAGE_SYM_CLASS_END_OF_STRUCT UINT8_C(102)
|
---|
255 | #define IMAGE_SYM_CLASS_FILE UINT8_C(103)
|
---|
256 | #define IMAGE_SYM_CLASS_SECTION UINT8_C(104)
|
---|
257 | #define IMAGE_SYM_CLASS_WEAK_EXTERNAL UINT8_C(105)
|
---|
258 | #define IMAGE_SYM_CLASS_CLR_TOKEN UINT8_C(107)
|
---|
259 |
|
---|
260 |
|
---|
261 | #define IMAGE_SYM_TYPE_NULL UINT16_C(0x0000)
|
---|
262 | #define IMAGE_SYM_TYPE_VOID UINT16_C(0x0001)
|
---|
263 | #define IMAGE_SYM_TYPE_CHAR UINT16_C(0x0002)
|
---|
264 | #define IMAGE_SYM_TYPE_SHORT UINT16_C(0x0003)
|
---|
265 | #define IMAGE_SYM_TYPE_INT UINT16_C(0x0004)
|
---|
266 | #define IMAGE_SYM_TYPE_LONG UINT16_C(0x0005)
|
---|
267 | #define IMAGE_SYM_TYPE_FLOAT UINT16_C(0x0006)
|
---|
268 | #define IMAGE_SYM_TYPE_DOUBLE UINT16_C(0x0007)
|
---|
269 | #define IMAGE_SYM_TYPE_STRUCT UINT16_C(0x0008)
|
---|
270 | #define IMAGE_SYM_TYPE_UNION UINT16_C(0x0009)
|
---|
271 | #define IMAGE_SYM_TYPE_ENUM UINT16_C(0x000a)
|
---|
272 | #define IMAGE_SYM_TYPE_MOE UINT16_C(0x000b)
|
---|
273 | #define IMAGE_SYM_TYPE_BYTE UINT16_C(0x000c)
|
---|
274 | #define IMAGE_SYM_TYPE_WORD UINT16_C(0x000d)
|
---|
275 | #define IMAGE_SYM_TYPE_UINT UINT16_C(0x000e)
|
---|
276 | #define IMAGE_SYM_TYPE_DWORD UINT16_C(0x000f)
|
---|
277 | #define IMAGE_SYM_TYPE_PCODE UINT16_C(0x8000)
|
---|
278 |
|
---|
279 | #define IMAGE_SYM_DTYPE_NULL UINT16_C(0x0)
|
---|
280 | #define IMAGE_SYM_DTYPE_POINTER UINT16_C(0x1)
|
---|
281 | #define IMAGE_SYM_DTYPE_FUNCTION UINT16_C(0x2)
|
---|
282 | #define IMAGE_SYM_DTYPE_ARRAY UINT16_C(0x3)
|
---|
283 |
|
---|
284 |
|
---|
285 | #define N_BTMASK UINT16_C(0x000f)
|
---|
286 | #define N_TMASK UINT16_C(0x0030)
|
---|
287 | #define N_TMASK1 UINT16_C(0x00c0)
|
---|
288 | #define N_TMASK2 UINT16_C(0x00f0)
|
---|
289 | #define N_BTSHFT 4
|
---|
290 | #define N_TSHIFT 2
|
---|
291 |
|
---|
292 | #define BTYPE(a_Type) ( (a_Type) & N_BTMASK )
|
---|
293 | #define ISPTR(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_POINTER << N_BTSHFT) )
|
---|
294 | #define ISFCN(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_FUNCTION << N_BTSHFT) )
|
---|
295 | #define ISARY(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_ARRAY << N_BTSHFT) )
|
---|
296 | #define ISTAG(a_StorageClass) ( (a_StorageClass) == IMAGE_SYM_CLASS_STRUCT_TAG \
|
---|
297 | || (a_StorageClass) == IMAGE_SYM_CLASS_UNION_TAG \
|
---|
298 | || (a_StorageClass) == IMAGE_SYM_CLASS_ENUM_TAG )
|
---|
299 |
|
---|
300 |
|
---|
301 | /*******************************************************************************
|
---|
302 | * Structures and Typedefs *
|
---|
303 | *******************************************************************************/
|
---|
304 | typedef struct _IMAGE_FILE_HEADER
|
---|
305 | {
|
---|
306 | uint16_t Machine; /**< 0x00 */
|
---|
307 | uint16_t NumberOfSections; /**< 0x02 */
|
---|
308 | uint32_t TimeDateStamp; /**< 0x04 */
|
---|
309 | uint32_t PointerToSymbolTable; /**< 0x08 */
|
---|
310 | uint32_t NumberOfSymbols; /**< 0x0c */
|
---|
311 | uint16_t SizeOfOptionalHeader; /**< 0x10 */
|
---|
312 | uint16_t Characteristics; /**< 0x12 */
|
---|
313 | } IMAGE_FILE_HEADER; /* size: 0x14 */
|
---|
314 | AssertCompileSize(IMAGE_FILE_HEADER, 0x14);
|
---|
315 | typedef IMAGE_FILE_HEADER *PIMAGE_FILE_HEADER;
|
---|
316 | typedef IMAGE_FILE_HEADER const *PCIMAGE_FILE_HEADER;
|
---|
317 |
|
---|
318 |
|
---|
319 | typedef struct _IMAGE_DATA_DIRECTORY
|
---|
320 | {
|
---|
321 | uint32_t VirtualAddress;
|
---|
322 | uint32_t Size;
|
---|
323 | } IMAGE_DATA_DIRECTORY;
|
---|
324 | typedef IMAGE_DATA_DIRECTORY *PIMAGE_DATA_DIRECTORY;
|
---|
325 | typedef IMAGE_DATA_DIRECTORY const *PCIMAGE_DATA_DIRECTORY;
|
---|
326 |
|
---|
327 |
|
---|
328 | typedef struct _IMAGE_OPTIONAL_HEADER32
|
---|
329 | {
|
---|
330 | uint16_t Magic; /**< 0x00 */
|
---|
331 | uint8_t MajorLinkerVersion; /**< 0x02 */
|
---|
332 | uint8_t MinorLinkerVersion; /**< 0x03 */
|
---|
333 | uint32_t SizeOfCode; /**< 0x04 */
|
---|
334 | uint32_t SizeOfInitializedData; /**< 0x08 */
|
---|
335 | uint32_t SizeOfUninitializedData; /**< 0x0c */
|
---|
336 | uint32_t AddressOfEntryPoint; /**< 0x10 */
|
---|
337 | uint32_t BaseOfCode; /**< 0x14 */
|
---|
338 | uint32_t BaseOfData; /**< 0x18 */
|
---|
339 | uint32_t ImageBase; /**< 0x1c */
|
---|
340 | uint32_t SectionAlignment; /**< 0x20 */
|
---|
341 | uint32_t FileAlignment; /**< 0x24 */
|
---|
342 | uint16_t MajorOperatingSystemVersion; /**< 0x28 */
|
---|
343 | uint16_t MinorOperatingSystemVersion; /**< 0x2a */
|
---|
344 | uint16_t MajorImageVersion; /**< 0x2c */
|
---|
345 | uint16_t MinorImageVersion; /**< 0x2e */
|
---|
346 | uint16_t MajorSubsystemVersion; /**< 0x30 */
|
---|
347 | uint16_t MinorSubsystemVersion; /**< 0x32 */
|
---|
348 | uint32_t Win32VersionValue; /**< 0x34 */
|
---|
349 | uint32_t SizeOfImage; /**< 0x38 */
|
---|
350 | uint32_t SizeOfHeaders; /**< 0x3c */
|
---|
351 | uint32_t CheckSum; /**< 0x40 */
|
---|
352 | uint16_t Subsystem; /**< 0x44 */
|
---|
353 | uint16_t DllCharacteristics; /**< 0x46 */
|
---|
354 | uint32_t SizeOfStackReserve; /**< 0x48 */
|
---|
355 | uint32_t SizeOfStackCommit; /**< 0x4c */
|
---|
356 | uint32_t SizeOfHeapReserve; /**< 0x50 */
|
---|
357 | uint32_t SizeOfHeapCommit; /**< 0x54 */
|
---|
358 | uint32_t LoaderFlags; /**< 0x58 */
|
---|
359 | uint32_t NumberOfRvaAndSizes; /**< 0x5c */
|
---|
360 | IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x60; 0x10*8 = 0x80 */
|
---|
361 | } IMAGE_OPTIONAL_HEADER32; /* size: 0xe0 */
|
---|
362 | AssertCompileSize(IMAGE_OPTIONAL_HEADER32, 0xe0);
|
---|
363 | typedef IMAGE_OPTIONAL_HEADER32 *PIMAGE_OPTIONAL_HEADER32;
|
---|
364 | typedef IMAGE_OPTIONAL_HEADER32 const *PCIMAGE_OPTIONAL_HEADER32;
|
---|
365 |
|
---|
366 | typedef struct _IMAGE_OPTIONAL_HEADER64
|
---|
367 | {
|
---|
368 | uint16_t Magic; /**< 0x00 */
|
---|
369 | uint8_t MajorLinkerVersion; /**< 0x02 */
|
---|
370 | uint8_t MinorLinkerVersion; /**< 0x03 */
|
---|
371 | uint32_t SizeOfCode; /**< 0x04 */
|
---|
372 | uint32_t SizeOfInitializedData; /**< 0x08 */
|
---|
373 | uint32_t SizeOfUninitializedData; /**< 0x0c */
|
---|
374 | uint32_t AddressOfEntryPoint; /**< 0x10 */
|
---|
375 | uint32_t BaseOfCode; /**< 0x14 */
|
---|
376 | uint64_t ImageBase; /**< 0x18 */
|
---|
377 | uint32_t SectionAlignment; /**< 0x20 */
|
---|
378 | uint32_t FileAlignment; /**< 0x24 */
|
---|
379 | uint16_t MajorOperatingSystemVersion; /**< 0x28 */
|
---|
380 | uint16_t MinorOperatingSystemVersion; /**< 0x2a */
|
---|
381 | uint16_t MajorImageVersion; /**< 0x2c */
|
---|
382 | uint16_t MinorImageVersion; /**< 0x2e */
|
---|
383 | uint16_t MajorSubsystemVersion; /**< 0x30 */
|
---|
384 | uint16_t MinorSubsystemVersion; /**< 0x32 */
|
---|
385 | uint32_t Win32VersionValue; /**< 0x34 */
|
---|
386 | uint32_t SizeOfImage; /**< 0x38 */
|
---|
387 | uint32_t SizeOfHeaders; /**< 0x3c */
|
---|
388 | uint32_t CheckSum; /**< 0x40 */
|
---|
389 | uint16_t Subsystem; /**< 0x44 */
|
---|
390 | uint16_t DllCharacteristics; /**< 0x46 */
|
---|
391 | uint64_t SizeOfStackReserve; /**< 0x48 */
|
---|
392 | uint64_t SizeOfStackCommit; /**< 0x50 */
|
---|
393 | uint64_t SizeOfHeapReserve; /**< 0x58 */
|
---|
394 | uint64_t SizeOfHeapCommit; /**< 0x60 */
|
---|
395 | uint32_t LoaderFlags; /**< 0x68 */
|
---|
396 | uint32_t NumberOfRvaAndSizes; /**< 0x6c */
|
---|
397 | IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x70; 0x10*8 = 0x80 */
|
---|
398 | } IMAGE_OPTIONAL_HEADER64; /* size: 0xf0 */
|
---|
399 | typedef IMAGE_OPTIONAL_HEADER64 *PIMAGE_OPTIONAL_HEADER64;
|
---|
400 | typedef IMAGE_OPTIONAL_HEADER64 const *PCIMAGE_OPTIONAL_HEADER64;
|
---|
401 |
|
---|
402 |
|
---|
403 | typedef struct _IMAGE_NT_HEADERS
|
---|
404 | {
|
---|
405 | uint32_t Signature; /**< 0x00 */
|
---|
406 | IMAGE_FILE_HEADER FileHeader; /**< 0x04 */
|
---|
407 | IMAGE_OPTIONAL_HEADER32 OptionalHeader; /**< 0x18 */
|
---|
408 | } IMAGE_NT_HEADERS32; /* size: 0xf8 */
|
---|
409 | AssertCompileSize(IMAGE_NT_HEADERS32, 0xf8);
|
---|
410 | AssertCompileMemberOffset(IMAGE_NT_HEADERS32, FileHeader, 4);
|
---|
411 | AssertCompileMemberOffset(IMAGE_NT_HEADERS32, OptionalHeader, 24);
|
---|
412 | typedef IMAGE_NT_HEADERS32 *PIMAGE_NT_HEADERS32;
|
---|
413 | typedef IMAGE_NT_HEADERS32 const *PCIMAGE_NT_HEADERS32;
|
---|
414 |
|
---|
415 | typedef struct _IMAGE_NT_HEADERS64
|
---|
416 | {
|
---|
417 | uint32_t Signature; /**< 0x00 */
|
---|
418 | IMAGE_FILE_HEADER FileHeader; /**< 0x04 */
|
---|
419 | IMAGE_OPTIONAL_HEADER64 OptionalHeader; /**< 0x18 */
|
---|
420 | } IMAGE_NT_HEADERS64; /**< 0x108 */
|
---|
421 | AssertCompileSize(IMAGE_NT_HEADERS64, 0x108);
|
---|
422 | AssertCompileMemberOffset(IMAGE_NT_HEADERS64, FileHeader, 4);
|
---|
423 | AssertCompileMemberOffset(IMAGE_NT_HEADERS64, OptionalHeader, 24);
|
---|
424 | typedef IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
|
---|
425 | typedef IMAGE_NT_HEADERS64 const *PCIMAGE_NT_HEADERS64;
|
---|
426 |
|
---|
427 |
|
---|
428 | typedef struct _IMAGE_SECTION_HEADER
|
---|
429 | {
|
---|
430 | uint8_t Name[IMAGE_SIZEOF_SHORT_NAME];
|
---|
431 | union
|
---|
432 | {
|
---|
433 | uint32_t PhysicalAddress;
|
---|
434 | uint32_t VirtualSize;
|
---|
435 | } Misc;
|
---|
436 | uint32_t VirtualAddress;
|
---|
437 | uint32_t SizeOfRawData;
|
---|
438 | uint32_t PointerToRawData;
|
---|
439 | uint32_t PointerToRelocations;
|
---|
440 | uint32_t PointerToLinenumbers;
|
---|
441 | uint16_t NumberOfRelocations;
|
---|
442 | uint16_t NumberOfLinenumbers;
|
---|
443 | uint32_t Characteristics;
|
---|
444 | } IMAGE_SECTION_HEADER;
|
---|
445 | typedef IMAGE_SECTION_HEADER *PIMAGE_SECTION_HEADER;
|
---|
446 | typedef IMAGE_SECTION_HEADER const *PCIMAGE_SECTION_HEADER;
|
---|
447 |
|
---|
448 |
|
---|
449 | typedef struct _IMAGE_BASE_RELOCATION
|
---|
450 | {
|
---|
451 | uint32_t VirtualAddress;
|
---|
452 | uint32_t SizeOfBlock;
|
---|
453 | } IMAGE_BASE_RELOCATION;
|
---|
454 | typedef IMAGE_BASE_RELOCATION *PIMAGE_BASE_RELOCATION;
|
---|
455 | typedef IMAGE_BASE_RELOCATION const *PCIMAGE_BASE_RELOCATION;
|
---|
456 |
|
---|
457 |
|
---|
458 | typedef struct _IMAGE_EXPORT_DIRECTORY
|
---|
459 | {
|
---|
460 | uint32_t Characteristics;
|
---|
461 | uint32_t TimeDateStamp;
|
---|
462 | uint16_t MajorVersion;
|
---|
463 | uint16_t MinorVersion;
|
---|
464 | uint32_t Name;
|
---|
465 | uint32_t Base;
|
---|
466 | uint32_t NumberOfFunctions;
|
---|
467 | uint32_t NumberOfNames;
|
---|
468 | uint32_t AddressOfFunctions;
|
---|
469 | uint32_t AddressOfNames;
|
---|
470 | uint32_t AddressOfNameOrdinals;
|
---|
471 | } IMAGE_EXPORT_DIRECTORY;
|
---|
472 | typedef IMAGE_EXPORT_DIRECTORY *PIMAGE_EXPORT_DIRECTORY;
|
---|
473 | typedef IMAGE_EXPORT_DIRECTORY const *PCIMAGE_EXPORT_DIRECTORY;
|
---|
474 |
|
---|
475 |
|
---|
476 | typedef struct _IMAGE_IMPORT_DESCRIPTOR
|
---|
477 | {
|
---|
478 | union
|
---|
479 | {
|
---|
480 | uint32_t Characteristics;
|
---|
481 | uint32_t OriginalFirstThunk;
|
---|
482 | } u;
|
---|
483 | uint32_t TimeDateStamp;
|
---|
484 | uint32_t ForwarderChain;
|
---|
485 | uint32_t Name;
|
---|
486 | uint32_t FirstThunk;
|
---|
487 | } IMAGE_IMPORT_DESCRIPTOR;
|
---|
488 | typedef IMAGE_IMPORT_DESCRIPTOR *PIMAGE_IMPORT_DESCRIPTOR;
|
---|
489 | typedef IMAGE_IMPORT_DESCRIPTOR const *PCIMAGE_IMPORT_DESCRIPTOR;
|
---|
490 |
|
---|
491 |
|
---|
492 | typedef struct _IMAGE_IMPORT_BY_NAME
|
---|
493 | {
|
---|
494 | uint16_t Hint;
|
---|
495 | uint8_t Name[1];
|
---|
496 | } IMAGE_IMPORT_BY_NAME;
|
---|
497 | typedef IMAGE_IMPORT_BY_NAME *PIMAGE_IMPORT_BY_NAME;
|
---|
498 | typedef IMAGE_IMPORT_BY_NAME const *PCIMAGE_IMPORT_BY_NAME;
|
---|
499 |
|
---|
500 |
|
---|
501 | /* The image_thunk_data32/64 structures are not very helpful except for getting RSI. keep them around till all the code has been converted. */
|
---|
502 | typedef struct _IMAGE_THUNK_DATA64
|
---|
503 | {
|
---|
504 | union
|
---|
505 | {
|
---|
506 | uint64_t ForwarderString;
|
---|
507 | uint64_t Function;
|
---|
508 | uint64_t Ordinal;
|
---|
509 | uint64_t AddressOfData;
|
---|
510 | } u1;
|
---|
511 | } IMAGE_THUNK_DATA64;
|
---|
512 | typedef IMAGE_THUNK_DATA64 *PIMAGE_THUNK_DATA64;
|
---|
513 | typedef IMAGE_THUNK_DATA64 const *PCIMAGE_THUNK_DATA64;
|
---|
514 |
|
---|
515 | typedef struct _IMAGE_THUNK_DATA32
|
---|
516 | {
|
---|
517 | union
|
---|
518 | {
|
---|
519 | uint32_t ForwarderString;
|
---|
520 | uint32_t Function;
|
---|
521 | uint32_t Ordinal;
|
---|
522 | uint32_t AddressOfData;
|
---|
523 | } u1;
|
---|
524 | } IMAGE_THUNK_DATA32;
|
---|
525 | typedef IMAGE_THUNK_DATA32 *PIMAGE_THUNK_DATA32;
|
---|
526 | typedef IMAGE_THUNK_DATA32 const *PCIMAGE_THUNK_DATA32;
|
---|
527 |
|
---|
528 |
|
---|
529 |
|
---|
530 | /* WARNING! NO MORE PRAGMA PACK 4 from here on. Assert size of all new types. */
|
---|
531 | /* WARNING! NO MORE PRAGMA PACK 4 from here on. Assert size of all new types. */
|
---|
532 | /* WARNING! NO MORE PRAGMA PACK 4 from here on. Assert size of all new types. */
|
---|
533 | /* WARNING! NO MORE PRAGMA PACK 4 from here on. Assert size of all new types. */
|
---|
534 | /* WARNING! NO MORE PRAGMA PACK 4 from here on. Assert size of all new types. */
|
---|
535 | /* WARNING! NO MORE PRAGMA PACK 4 from here on. Assert size of all new types. */
|
---|
536 | /* WARNING! NO MORE PRAGMA PACK 4 from here on. Assert size of all new types. */
|
---|
537 | /* WARNING! NO MORE PRAGMA PACK 4 from here on. Assert size of all new types. */
|
---|
538 | /* WARNING! NO MORE PRAGMA PACK 4 from here on. Assert size of all new types. */
|
---|
539 | #pragma pack()
|
---|
540 |
|
---|
541 |
|
---|
542 | /** @since Windows 10 (preview 9879) */
|
---|
543 | typedef struct _IMAGE_LOAD_CONFIG_CODE_INTEGRITY
|
---|
544 | {
|
---|
545 | uint16_t Flags;
|
---|
546 | uint16_t Catalog;
|
---|
547 | uint32_t CatalogOffset;
|
---|
548 | uint32_t Reserved;
|
---|
549 | } IMAGE_LOAD_CONFIG_CODE_INTEGRITY;
|
---|
550 | AssertCompileSize(IMAGE_LOAD_CONFIG_CODE_INTEGRITY, 12);
|
---|
551 | typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY *PIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
|
---|
552 | typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY const *PCIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
|
---|
553 |
|
---|
554 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V1
|
---|
555 | {
|
---|
556 | uint32_t Size;
|
---|
557 | uint32_t TimeDateStamp;
|
---|
558 | uint16_t MajorVersion;
|
---|
559 | uint16_t MinorVersion;
|
---|
560 | uint32_t GlobalFlagsClear;
|
---|
561 | uint32_t GlobalFlagsSet;
|
---|
562 | uint32_t CriticalSectionDefaultTimeout;
|
---|
563 | uint32_t DeCommitFreeBlockThreshold;
|
---|
564 | uint32_t DeCommitTotalFreeThreshold;
|
---|
565 | uint32_t LockPrefixTable;
|
---|
566 | uint32_t MaximumAllocationSize;
|
---|
567 | uint32_t VirtualMemoryThreshold;
|
---|
568 | uint32_t ProcessHeapFlags;
|
---|
569 | uint32_t ProcessAffinityMask;
|
---|
570 | uint16_t CSDVersion;
|
---|
571 | uint16_t Reserved1;
|
---|
572 | uint32_t EditList;
|
---|
573 | uint32_t SecurityCookie;
|
---|
574 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V1;
|
---|
575 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V1, 0x40);
|
---|
576 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
|
---|
577 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
|
---|
578 |
|
---|
579 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V2
|
---|
580 | {
|
---|
581 | uint32_t Size;
|
---|
582 | uint32_t TimeDateStamp;
|
---|
583 | uint16_t MajorVersion;
|
---|
584 | uint16_t MinorVersion;
|
---|
585 | uint32_t GlobalFlagsClear;
|
---|
586 | uint32_t GlobalFlagsSet;
|
---|
587 | uint32_t CriticalSectionDefaultTimeout;
|
---|
588 | uint32_t DeCommitFreeBlockThreshold;
|
---|
589 | uint32_t DeCommitTotalFreeThreshold;
|
---|
590 | uint32_t LockPrefixTable;
|
---|
591 | uint32_t MaximumAllocationSize;
|
---|
592 | uint32_t VirtualMemoryThreshold;
|
---|
593 | uint32_t ProcessHeapFlags;
|
---|
594 | uint32_t ProcessAffinityMask;
|
---|
595 | uint16_t CSDVersion;
|
---|
596 | uint16_t Reserved1;
|
---|
597 | uint32_t EditList;
|
---|
598 | uint32_t SecurityCookie;
|
---|
599 | uint32_t SEHandlerTable;
|
---|
600 | uint32_t SEHandlerCount;
|
---|
601 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V2;
|
---|
602 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V2, 0x48);
|
---|
603 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
|
---|
604 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
|
---|
605 |
|
---|
606 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V3
|
---|
607 | {
|
---|
608 | uint32_t Size;
|
---|
609 | uint32_t TimeDateStamp;
|
---|
610 | uint16_t MajorVersion;
|
---|
611 | uint16_t MinorVersion;
|
---|
612 | uint32_t GlobalFlagsClear;
|
---|
613 | uint32_t GlobalFlagsSet;
|
---|
614 | uint32_t CriticalSectionDefaultTimeout;
|
---|
615 | uint32_t DeCommitFreeBlockThreshold;
|
---|
616 | uint32_t DeCommitTotalFreeThreshold;
|
---|
617 | uint32_t LockPrefixTable;
|
---|
618 | uint32_t MaximumAllocationSize;
|
---|
619 | uint32_t VirtualMemoryThreshold;
|
---|
620 | uint32_t ProcessHeapFlags;
|
---|
621 | uint32_t ProcessAffinityMask;
|
---|
622 | uint16_t CSDVersion;
|
---|
623 | uint16_t Reserved1;
|
---|
624 | uint32_t EditList;
|
---|
625 | uint32_t SecurityCookie;
|
---|
626 | uint32_t SEHandlerTable;
|
---|
627 | uint32_t SEHandlerCount;
|
---|
628 | uint32_t GuardCFCCheckFunctionPointer;
|
---|
629 | uint32_t Reserved2;
|
---|
630 | uint32_t GuardCFFunctionTable;
|
---|
631 | uint32_t GuardCFFunctionCount;
|
---|
632 | uint32_t GuardFlags;
|
---|
633 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V3;
|
---|
634 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V3, 0x5c);
|
---|
635 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
|
---|
636 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
|
---|
637 |
|
---|
638 | /** @since Windows 10 (preview 9879) */
|
---|
639 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V4
|
---|
640 | {
|
---|
641 | uint32_t Size;
|
---|
642 | uint32_t TimeDateStamp;
|
---|
643 | uint16_t MajorVersion;
|
---|
644 | uint16_t MinorVersion;
|
---|
645 | uint32_t GlobalFlagsClear;
|
---|
646 | uint32_t GlobalFlagsSet;
|
---|
647 | uint32_t CriticalSectionDefaultTimeout;
|
---|
648 | uint32_t DeCommitFreeBlockThreshold;
|
---|
649 | uint32_t DeCommitTotalFreeThreshold;
|
---|
650 | uint32_t LockPrefixTable;
|
---|
651 | uint32_t MaximumAllocationSize;
|
---|
652 | uint32_t VirtualMemoryThreshold;
|
---|
653 | uint32_t ProcessHeapFlags;
|
---|
654 | uint32_t ProcessAffinityMask;
|
---|
655 | uint16_t CSDVersion;
|
---|
656 | uint16_t Reserved1;
|
---|
657 | uint32_t EditList;
|
---|
658 | uint32_t SecurityCookie;
|
---|
659 | uint32_t SEHandlerTable;
|
---|
660 | uint32_t SEHandlerCount;
|
---|
661 | uint32_t GuardCFCCheckFunctionPointer;
|
---|
662 | uint32_t Reserved2;
|
---|
663 | uint32_t GuardCFFunctionTable;
|
---|
664 | uint32_t GuardCFFunctionCount;
|
---|
665 | uint32_t GuardFlags;
|
---|
666 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
|
---|
667 | } IMAGE_LOAD_CONFIG_DIRECTORY32_V4;
|
---|
668 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V4, 0x68);
|
---|
669 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
|
---|
670 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
|
---|
671 |
|
---|
672 | typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 IMAGE_LOAD_CONFIG_DIRECTORY32;
|
---|
673 | typedef PIMAGE_LOAD_CONFIG_DIRECTORY32_V4 PIMAGE_LOAD_CONFIG_DIRECTORY32;
|
---|
674 | typedef PCIMAGE_LOAD_CONFIG_DIRECTORY32_V4 PCIMAGE_LOAD_CONFIG_DIRECTORY32;
|
---|
675 |
|
---|
676 | /* No _IMAGE_LOAD_CONFIG_DIRECTORY64_V1 exists. */
|
---|
677 |
|
---|
678 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V2
|
---|
679 | {
|
---|
680 | uint32_t Size;
|
---|
681 | uint32_t TimeDateStamp;
|
---|
682 | uint16_t MajorVersion;
|
---|
683 | uint16_t MinorVersion;
|
---|
684 | uint32_t GlobalFlagsClear;
|
---|
685 | uint32_t GlobalFlagsSet;
|
---|
686 | uint32_t CriticalSectionDefaultTimeout;
|
---|
687 | uint64_t DeCommitFreeBlockThreshold;
|
---|
688 | uint64_t DeCommitTotalFreeThreshold;
|
---|
689 | uint64_t LockPrefixTable;
|
---|
690 | uint64_t MaximumAllocationSize;
|
---|
691 | uint64_t VirtualMemoryThreshold;
|
---|
692 | uint64_t ProcessAffinityMask;
|
---|
693 | uint32_t ProcessHeapFlags;
|
---|
694 | uint16_t CSDVersion;
|
---|
695 | uint16_t Reserved1;
|
---|
696 | uint64_t EditList;
|
---|
697 | uint64_t SecurityCookie;
|
---|
698 | uint64_t SEHandlerTable;
|
---|
699 | uint64_t SEHandlerCount;
|
---|
700 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V2;
|
---|
701 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V2, 0x70);
|
---|
702 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
|
---|
703 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
|
---|
704 |
|
---|
705 | #pragma pack(4) /* Why not 8 byte alignment, baka microsofties?!? */
|
---|
706 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V3
|
---|
707 | {
|
---|
708 | uint32_t Size;
|
---|
709 | uint32_t TimeDateStamp;
|
---|
710 | uint16_t MajorVersion;
|
---|
711 | uint16_t MinorVersion;
|
---|
712 | uint32_t GlobalFlagsClear;
|
---|
713 | uint32_t GlobalFlagsSet;
|
---|
714 | uint32_t CriticalSectionDefaultTimeout;
|
---|
715 | uint64_t DeCommitFreeBlockThreshold;
|
---|
716 | uint64_t DeCommitTotalFreeThreshold;
|
---|
717 | uint64_t LockPrefixTable;
|
---|
718 | uint64_t MaximumAllocationSize;
|
---|
719 | uint64_t VirtualMemoryThreshold;
|
---|
720 | uint64_t ProcessAffinityMask;
|
---|
721 | uint32_t ProcessHeapFlags;
|
---|
722 | uint16_t CSDVersion;
|
---|
723 | uint16_t Reserved1;
|
---|
724 | uint64_t EditList;
|
---|
725 | uint64_t SecurityCookie;
|
---|
726 | uint64_t SEHandlerTable;
|
---|
727 | uint64_t SEHandlerCount;
|
---|
728 | uint64_t GuardCFCCheckFunctionPointer;
|
---|
729 | uint64_t Reserved2;
|
---|
730 | uint64_t GuardCFFunctionTable;
|
---|
731 | uint64_t GuardCFFunctionCount;
|
---|
732 | uint32_t GuardFlags;
|
---|
733 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V3;
|
---|
734 | #pragma pack()
|
---|
735 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V3, 0x94);
|
---|
736 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
|
---|
737 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
|
---|
738 |
|
---|
739 | /** @since Windows 10 (Preview (9879). */
|
---|
740 | typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V4
|
---|
741 | {
|
---|
742 | uint32_t Size;
|
---|
743 | uint32_t TimeDateStamp;
|
---|
744 | uint16_t MajorVersion;
|
---|
745 | uint16_t MinorVersion;
|
---|
746 | uint32_t GlobalFlagsClear;
|
---|
747 | uint32_t GlobalFlagsSet;
|
---|
748 | uint32_t CriticalSectionDefaultTimeout;
|
---|
749 | uint64_t DeCommitFreeBlockThreshold;
|
---|
750 | uint64_t DeCommitTotalFreeThreshold;
|
---|
751 | uint64_t LockPrefixTable;
|
---|
752 | uint64_t MaximumAllocationSize;
|
---|
753 | uint64_t VirtualMemoryThreshold;
|
---|
754 | uint64_t ProcessAffinityMask;
|
---|
755 | uint32_t ProcessHeapFlags;
|
---|
756 | uint16_t CSDVersion;
|
---|
757 | uint16_t Reserved1;
|
---|
758 | uint64_t EditList;
|
---|
759 | uint64_t SecurityCookie;
|
---|
760 | uint64_t SEHandlerTable;
|
---|
761 | uint64_t SEHandlerCount;
|
---|
762 | uint64_t GuardCFCCheckFunctionPointer;
|
---|
763 | uint64_t Reserved2;
|
---|
764 | uint64_t GuardCFFunctionTable;
|
---|
765 | uint64_t GuardCFFunctionCount;
|
---|
766 | uint32_t GuardFlags;
|
---|
767 | IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
|
---|
768 | } IMAGE_LOAD_CONFIG_DIRECTORY64_V4;
|
---|
769 | AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V4, 0xa0);
|
---|
770 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
|
---|
771 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
|
---|
772 |
|
---|
773 | typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 IMAGE_LOAD_CONFIG_DIRECTORY64;
|
---|
774 | typedef PIMAGE_LOAD_CONFIG_DIRECTORY64_V4 PIMAGE_LOAD_CONFIG_DIRECTORY64;
|
---|
775 | typedef PCIMAGE_LOAD_CONFIG_DIRECTORY64_V4 PCIMAGE_LOAD_CONFIG_DIRECTORY64;
|
---|
776 |
|
---|
777 |
|
---|
778 | typedef struct _IMAGE_DEBUG_DIRECTORY
|
---|
779 | {
|
---|
780 | uint32_t Characteristics;
|
---|
781 | uint32_t TimeDateStamp;
|
---|
782 | uint16_t MajorVersion;
|
---|
783 | uint16_t MinorVersion;
|
---|
784 | uint32_t Type;
|
---|
785 | uint32_t SizeOfData;
|
---|
786 | uint32_t AddressOfRawData;
|
---|
787 | uint32_t PointerToRawData;
|
---|
788 | } IMAGE_DEBUG_DIRECTORY;
|
---|
789 | AssertCompileSize(IMAGE_DEBUG_DIRECTORY, 28);
|
---|
790 | typedef IMAGE_DEBUG_DIRECTORY *PIMAGE_DEBUG_DIRECTORY;
|
---|
791 | typedef IMAGE_DEBUG_DIRECTORY const *PCIMAGE_DEBUG_DIRECTORY;
|
---|
792 |
|
---|
793 | typedef struct _IMAGE_DEBUG_MISC
|
---|
794 | {
|
---|
795 | uint32_t DataType;
|
---|
796 | uint32_t Length;
|
---|
797 | uint8_t Unicode;
|
---|
798 | uint8_t Reserved[3];
|
---|
799 | uint8_t Data[1];
|
---|
800 | } IMAGE_DEBUG_MISC;
|
---|
801 | AssertCompileSize(IMAGE_DEBUG_MISC, 16);
|
---|
802 | typedef IMAGE_DEBUG_MISC *PIMAGE_DEBUG_MISC;
|
---|
803 | typedef IMAGE_DEBUG_MISC const *PCIMAGE_DEBUG_MISC;
|
---|
804 |
|
---|
805 |
|
---|
806 | typedef struct WIN_CERTIFICATE
|
---|
807 | {
|
---|
808 | uint32_t dwLength;
|
---|
809 | uint16_t wRevision;
|
---|
810 | uint16_t wCertificateType;
|
---|
811 | uint8_t bCertificate[8];
|
---|
812 | } WIN_CERTIFICATE;
|
---|
813 | AssertCompileSize(WIN_CERTIFICATE, 16);
|
---|
814 | typedef WIN_CERTIFICATE *PWIN_CERTIFICATE;
|
---|
815 | typedef WIN_CERTIFICATE const *PCWIN_CERTIFICATE;
|
---|
816 |
|
---|
817 |
|
---|
818 | /** The header of a .DBG file (NT4). */
|
---|
819 | typedef struct _IMAGE_SEPARATE_DEBUG_HEADER
|
---|
820 | {
|
---|
821 | uint16_t Signature; /**< 0x00 */
|
---|
822 | uint16_t Flags; /**< 0x02 */
|
---|
823 | uint16_t Machine; /**< 0x04 */
|
---|
824 | uint16_t Characteristics; /**< 0x06 */
|
---|
825 | uint32_t TimeDateStamp; /**< 0x08 */
|
---|
826 | uint32_t CheckSum; /**< 0x0c */
|
---|
827 | uint32_t ImageBase; /**< 0x10 */
|
---|
828 | uint32_t SizeOfImage; /**< 0x14 */
|
---|
829 | uint32_t NumberOfSections; /**< 0x18 */
|
---|
830 | uint32_t ExportedNamesSize; /**< 0x1c */
|
---|
831 | uint32_t DebugDirectorySize; /**< 0x20 */
|
---|
832 | uint32_t SectionAlignment; /**< 0x24 */
|
---|
833 | uint32_t Reserved[2]; /**< 0x28 */
|
---|
834 | } IMAGE_SEPARATE_DEBUG_HEADER; /* size: 0x30 */
|
---|
835 | AssertCompileSize(IMAGE_SEPARATE_DEBUG_HEADER, 0x30);
|
---|
836 | typedef IMAGE_SEPARATE_DEBUG_HEADER *PIMAGE_SEPARATE_DEBUG_HEADER;
|
---|
837 | typedef IMAGE_SEPARATE_DEBUG_HEADER const *PCIMAGE_SEPARATE_DEBUG_HEADER;
|
---|
838 |
|
---|
839 |
|
---|
840 | typedef struct _IMAGE_COFF_SYMBOLS_HEADER
|
---|
841 | {
|
---|
842 | uint32_t NumberOfSymbols;
|
---|
843 | uint32_t LvaToFirstSymbol;
|
---|
844 | uint32_t NumberOfLinenumbers;
|
---|
845 | uint32_t LvaToFirstLinenumber;
|
---|
846 | uint32_t RvaToFirstByteOfCode;
|
---|
847 | uint32_t RvaToLastByteOfCode;
|
---|
848 | uint32_t RvaToFirstByteOfData;
|
---|
849 | uint32_t RvaToLastByteOfData;
|
---|
850 | } IMAGE_COFF_SYMBOLS_HEADER;
|
---|
851 | AssertCompileSize(IMAGE_COFF_SYMBOLS_HEADER, 0x20);
|
---|
852 | typedef IMAGE_COFF_SYMBOLS_HEADER *PIMAGE_COFF_SYMBOLS_HEADER;
|
---|
853 | typedef IMAGE_COFF_SYMBOLS_HEADER const *PCIMAGE_COFF_SYMBOLS_HEADER;
|
---|
854 |
|
---|
855 |
|
---|
856 | #pragma pack(2)
|
---|
857 | typedef struct _IMAGE_LINENUMBER
|
---|
858 | {
|
---|
859 | union
|
---|
860 | {
|
---|
861 | uint32_t VirtualAddress;
|
---|
862 | uint32_t SymbolTableIndex;
|
---|
863 | } Type;
|
---|
864 | uint16_t Linenumber;
|
---|
865 | } IMAGE_LINENUMBER;
|
---|
866 | #pragma pack()
|
---|
867 | AssertCompileSize(IMAGE_LINENUMBER, 6);
|
---|
868 | typedef IMAGE_LINENUMBER *PIMAGE_LINENUMBER;
|
---|
869 | typedef IMAGE_LINENUMBER const *PCIMAGE_LINENUMBER;
|
---|
870 |
|
---|
871 |
|
---|
872 | #pragma pack(2)
|
---|
873 | typedef struct _IMAGE_SYMBOL
|
---|
874 | {
|
---|
875 | union
|
---|
876 | {
|
---|
877 | uint8_t ShortName[8];
|
---|
878 | struct
|
---|
879 | {
|
---|
880 | uint32_t Short;
|
---|
881 | uint32_t Long;
|
---|
882 | } Name;
|
---|
883 | uint32_t LongName[2];
|
---|
884 | } N;
|
---|
885 |
|
---|
886 | uint32_t Value;
|
---|
887 | int16_t SectionNumber;
|
---|
888 | uint16_t Type;
|
---|
889 | uint8_t StorageClass;
|
---|
890 | uint8_t NumberOfAuxSymbols;
|
---|
891 | } IMAGE_SYMBOL;
|
---|
892 | #pragma pack()
|
---|
893 | AssertCompileSize(IMAGE_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
|
---|
894 | typedef IMAGE_SYMBOL *PIMAGE_SYMBOL;
|
---|
895 | typedef IMAGE_SYMBOL const *PCIMAGE_SYMBOL;
|
---|
896 |
|
---|
897 |
|
---|
898 | #pragma pack(2)
|
---|
899 | typedef struct IMAGE_AUX_SYMBOL_TOKEN_DEF
|
---|
900 | {
|
---|
901 | uint8_t bAuxType;
|
---|
902 | uint8_t bReserved;
|
---|
903 | uint32_t SymbolTableIndex;
|
---|
904 | uint8_t rgbReserved[12];
|
---|
905 | } IMAGE_AUX_SYMBOL_TOKEN_DEF;
|
---|
906 | #pragma pack()
|
---|
907 | AssertCompileSize(IMAGE_AUX_SYMBOL_TOKEN_DEF, IMAGE_SIZE_OF_SYMBOL);
|
---|
908 | typedef IMAGE_AUX_SYMBOL_TOKEN_DEF *PIMAGE_AUX_SYMBOL_TOKEN_DEF;
|
---|
909 | typedef IMAGE_AUX_SYMBOL_TOKEN_DEF const *PCIMAGE_AUX_SYMBOL_TOKEN_DEF;
|
---|
910 |
|
---|
911 |
|
---|
912 | #pragma pack(1)
|
---|
913 | typedef union _IMAGE_AUX_SYMBOL
|
---|
914 | {
|
---|
915 | struct
|
---|
916 | {
|
---|
917 | uint32_t TagIndex;
|
---|
918 | union
|
---|
919 | {
|
---|
920 | struct
|
---|
921 | {
|
---|
922 | uint16_t Linenumber;
|
---|
923 | uint16_t Size;
|
---|
924 | } LnSz;
|
---|
925 | } Misc;
|
---|
926 | union
|
---|
927 | {
|
---|
928 | struct
|
---|
929 | {
|
---|
930 | uint32_t PointerToLinenumber;
|
---|
931 | uint32_t PointerToNextFunction;
|
---|
932 | } Function;
|
---|
933 | struct
|
---|
934 | {
|
---|
935 | uint16_t Dimension[4];
|
---|
936 | } Array;
|
---|
937 | } FcnAry;
|
---|
938 | uint16_t TvIndex;
|
---|
939 | } Sym;
|
---|
940 |
|
---|
941 | struct
|
---|
942 | {
|
---|
943 | uint8_t Name[IMAGE_SIZE_OF_SYMBOL];
|
---|
944 | } File;
|
---|
945 |
|
---|
946 | struct
|
---|
947 | {
|
---|
948 | uint32_t Length;
|
---|
949 | uint16_t NumberOfRelocations;
|
---|
950 | uint16_t NumberOfLinenumbers;
|
---|
951 | uint32_t CheckSum;
|
---|
952 | uint16_t Number;
|
---|
953 | uint8_t Selection;
|
---|
954 | uint8_t bReserved;
|
---|
955 | uint16_t HighNumber;
|
---|
956 | } Section;
|
---|
957 |
|
---|
958 | IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
|
---|
959 | struct
|
---|
960 | {
|
---|
961 | uint32_t crc;
|
---|
962 | uint8_t rgbReserved[14];
|
---|
963 | } CRC;
|
---|
964 | } IMAGE_AUX_SYMBOL;
|
---|
965 | #pragma pack()
|
---|
966 | AssertCompileSize(IMAGE_AUX_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
|
---|
967 | typedef IMAGE_AUX_SYMBOL *PIMAGE_AUX_SYMBOL;
|
---|
968 | typedef IMAGE_AUX_SYMBOL const *PCIMAGE_AUX_SYMBOL;
|
---|
969 |
|
---|
970 |
|
---|
971 |
|
---|
972 | typedef struct _IMAGE_SYMBOL_EX
|
---|
973 | {
|
---|
974 | union
|
---|
975 | {
|
---|
976 | uint8_t ShortName[8];
|
---|
977 | struct
|
---|
978 | {
|
---|
979 | uint32_t Short;
|
---|
980 | uint32_t Long;
|
---|
981 | } Name;
|
---|
982 | uint32_t LongName[2];
|
---|
983 | } N;
|
---|
984 |
|
---|
985 | uint32_t Value;
|
---|
986 | int32_t SectionNumber; /* The difference from IMAGE_SYMBOL */
|
---|
987 | uint16_t Type;
|
---|
988 | uint8_t StorageClass;
|
---|
989 | uint8_t NumberOfAuxSymbols;
|
---|
990 | } IMAGE_SYMBOL_EX;
|
---|
991 | AssertCompileSize(IMAGE_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
|
---|
992 | typedef IMAGE_SYMBOL_EX *PIMAGE_SYMBOL_EX;
|
---|
993 | typedef IMAGE_SYMBOL_EX const *PCIMAGE_SYMBOL_EX;
|
---|
994 |
|
---|
995 |
|
---|
996 | typedef union _IMAGE_AUX_SYMBOL_EX
|
---|
997 | {
|
---|
998 | struct
|
---|
999 | {
|
---|
1000 | uint32_t WeakDefaultSymIndex;
|
---|
1001 | uint32_t WeakSearchType;
|
---|
1002 | uint8_t rgbReserved[12];
|
---|
1003 | } Sym;
|
---|
1004 |
|
---|
1005 | struct
|
---|
1006 | {
|
---|
1007 | uint8_t Name[IMAGE_SIZE_OF_SYMBOL_EX];
|
---|
1008 | } File;
|
---|
1009 |
|
---|
1010 | struct
|
---|
1011 | {
|
---|
1012 | uint32_t Length;
|
---|
1013 | uint16_t NumberOfRelocations;
|
---|
1014 | uint16_t NumberOfLinenumbers;
|
---|
1015 | uint32_t CheckSum;
|
---|
1016 | uint16_t Number;
|
---|
1017 | uint8_t Selection;
|
---|
1018 | uint8_t bReserved;
|
---|
1019 | uint16_t HighNumber;
|
---|
1020 | uint8_t rgbReserved[2];
|
---|
1021 | } Section;
|
---|
1022 |
|
---|
1023 | IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
|
---|
1024 |
|
---|
1025 | struct
|
---|
1026 | {
|
---|
1027 | uint32_t crc;
|
---|
1028 | uint8_t rgbReserved[16];
|
---|
1029 | } CRC;
|
---|
1030 | } IMAGE_AUX_SYMBOL_EX;
|
---|
1031 | AssertCompileSize(IMAGE_AUX_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
|
---|
1032 | typedef IMAGE_AUX_SYMBOL_EX *PIMAGE_AUX_SYMBOL_EX;
|
---|
1033 | typedef IMAGE_AUX_SYMBOL_EX const *PCIMAGE_AUX_SYMBOL_EX;
|
---|
1034 |
|
---|
1035 |
|
---|
1036 | #endif
|
---|
1037 |
|
---|