7#define IMAGE_DOS_SIGNATURE 0x5A4D
8#define IMAGE_OS2_SIGNATURE 0x454E
9#define IMAGE_OS2_SIGNATURE_LE 0x454C
10#define IMAGE_VXD_SIGNATURE 0x454C
11#define IMAGE_NT_SIGNATURE 0x00004550
16#define IMAGE_FILE_MACHINE_AM33 0x1d3
17#define IMAGE_FILE_MACHINE_AMD64 0x8664
18#define IMAGE_FILE_MACHINE_ARM 0x1c0
19#define IMAGE_FILE_MACHINE_ARMV7 0x1c4
20#define IMAGE_FILE_MACHINE_EBC 0xebc
21#define IMAGE_FILE_MACHINE_I386 0x14c
22#define IMAGE_FILE_MACHINE_IA64 0x200
23#define IMAGE_FILE_MACHINE_M32R 0x9041
24#define IMAGE_FILE_MACHINE_MIPS16 0x266
25#define IMAGE_FILE_MACHINE_MIPSFPU 0x366
26#define IMAGE_FILE_MACHINE_MIPSFPU16 0x466
27#define IMAGE_FILE_MACHINE_POWERPC 0x1f0
28#define IMAGE_FILE_MACHINE_POWERPCFP 0x1f1
29#define IMAGE_FILE_MACHINE_R4000 0x166
30#define IMAGE_FILE_MACHINE_SH3 0x1a2
31#define IMAGE_FILE_MACHINE_SH3E 0x01a4
32#define IMAGE_FILE_MACHINE_SH3DSP 0x1a3
33#define IMAGE_FILE_MACHINE_SH4 0x1a6
34#define IMAGE_FILE_MACHINE_SH5 0x1a8
35#define IMAGE_FILE_MACHINE_THUMB 0x1c2
36#define IMAGE_FILE_MACHINE_WCEMIPSV2 0x169
37#define IMAGE_FILE_MACHINE_R3000 0x162
38#define IMAGE_FILE_MACHINE_R10000 0x168
39#define IMAGE_FILE_MACHINE_ALPHA 0x184
40#define IMAGE_FILE_MACHINE_ALPHA64 0x0284
41#define IMAGE_FILE_MACHINE_AXP64 IMAGE_FILE_MACHINE_ALPHA64
42#define IMAGE_FILE_MACHINE_CEE 0xC0EE
43#define IMAGE_FILE_MACHINE_TRICORE 0x0520
44#define IMAGE_FILE_MACHINE_CEF 0x0CEF
179#define IMAGE_RESOURCE_NAME_IS_STRING 0x80000000
180#define IMAGE_RESOURCE_DATA_IS_DIRECTORY 0x80000000
208#define IMAGE_SIZEOF_SHORT_NAME 8
209#define IMAGE_SIZEOF_SECTION_HEADER 40
230#define IMAGE_SCN_CNT_CODE 0x00000020
231#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040
232#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080
234#define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000
235#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
236#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000
237#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000
238#define IMAGE_SCN_MEM_SHARED 0x10000000
239#define IMAGE_SCN_MEM_EXECUTE 0x20000000
240#define IMAGE_SCN_MEM_READ 0x40000000
241#define IMAGE_SCN_MEM_WRITE 0x80000000
246#define IMAGE_SIZEOF_FILE_HEADER 20
261#define IMAGE_FILE_RELOCS_STRIPPED 0x0001
262#define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002
263#define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004
264#define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008
265#define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010
266#define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020
267#define IMAGE_FILE_BYTES_REVERSED_LO 0x0080
268#define IMAGE_FILE_32BIT_MACHINE 0x0100
269#define IMAGE_FILE_DEBUG_STRIPPED 0x0200
270#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400
271#define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800
272#define IMAGE_FILE_SYSTEM 0x1000
273#define IMAGE_FILE_DLL 0x2000
274#define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000
275#define IMAGE_FILE_BYTES_REVERSED_HI 0x8000
280#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
376#define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b
377#define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b
378#define IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107
383#define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR64_MAGIC
387#define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR32_MAGIC
427#define IMAGE_FIRST_SECTION( NtHeader ) \
428 ((PIMAGE_SECTION_HEADER) ((ULONG_PTR)(NtHeader) + \
429 FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) + \
430 ((NtHeader))->FileHeader.SizeOfOptionalHeader))
435#define IMAGE_SUBSYSTEM_UNKNOWN 0
436#define IMAGE_SUBSYSTEM_NATIVE 1
437#define IMAGE_SUBSYSTEM_WINDOWS_GUI 2
438#define IMAGE_SUBSYSTEM_WINDOWS_CUI 3
439#define IMAGE_SUBSYSTEM_OS2_CUI 5
440#define IMAGE_SUBSYSTEM_POSIX_CUI 7
441#define IMAGE_SUBSYSTEM_NATIVE_WINDOWS 8
442#define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI 9
443#define IMAGE_SUBSYSTEM_EFI_APPLICATION 10
444#define IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER 11
445#define IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER 12
446#define IMAGE_SUBSYSTEM_EFI_ROM 13
447#define IMAGE_SUBSYSTEM_XBOX 14
448#define IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION 16
449#define IMAGE_SUBSYSTEM_XBOX_CODE_CATALOG 17
454#define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA 0x0020
455#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040
456#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY 0x0080
457#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT 0x0100
458#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200
459#define IMAGE_DLLCHARACTERISTICS_NO_SEH 0x0400
460#define IMAGE_DLLCHARACTERISTICS_NO_BIND 0x0800
461#define IMAGE_DLLCHARACTERISTICS_APPCONTAINER 0x1000
462#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER 0x2000
463#define IMAGE_DLLCHARACTERISTICS_GUARD_CF 0x4000
464#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000
469#define IMAGE_LOADER_FLAGS_COMPLUS 0x00000001
470#define IMAGE_LOADER_FLAGS_SYSTEM_GLOBAL 0x01000000
475#define IMAGE_DIRECTORY_ENTRY_EXPORT 0
476#define IMAGE_DIRECTORY_ENTRY_IMPORT 1
477#define IMAGE_DIRECTORY_ENTRY_RESOURCE 2
478#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3
479#define IMAGE_DIRECTORY_ENTRY_SECURITY 4
480#define IMAGE_DIRECTORY_ENTRY_BASERELOC 5
481#define IMAGE_DIRECTORY_ENTRY_DEBUG 6
482#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7
483#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8
484#define IMAGE_DIRECTORY_ENTRY_TLS 9
485#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10
486#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11
487#define IMAGE_DIRECTORY_ENTRY_IAT 12
488#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13
489#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14
519#define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL
520#define IMAGE_ORDINAL_FLAG32 0x80000000
521#define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)
522#define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)
523#define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
524#define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
555#define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG64
556#define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL64(Ordinal)
559#define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL64(Ordinal)
563#define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG32
564#define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL32(Ordinal)
567#define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL32(Ordinal)
PVOID PVOID PWCHAR PVOID USHORT PULONG Reason
#define _ANONYMOUS_STRUCT
struct _IMAGE_RESOURCE_DIRECTORY_STRING * PIMAGE_RESOURCE_DIRECTORY_STRING
IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA
struct _IMAGE_RESOURCE_DIRECTORY * PIMAGE_RESOURCE_DIRECTORY
IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS
struct _IMAGE_IMPORT_DESCRIPTOR * PIMAGE_IMPORT_DESCRIPTOR
struct _IMAGE_OPTIONAL_HEADER64 * PIMAGE_OPTIONAL_HEADER64
struct _IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER64
struct _IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA32
IMAGE_OPTIONAL_HEADER32 IMAGE_OPTIONAL_HEADER
struct _IMAGE_BASE_RELOCATION * PIMAGE_BASE_RELOCATION
struct IMAGE_LOAD_CONFIG_DIRECTORY64 * PIMAGE_LOAD_CONFIG_DIRECTORY64
struct _IMAGE_SECTION_HEADER * PIMAGE_SECTION_HEADER
struct _IMAGE_TLS_DIRECTORY64 IMAGE_TLS_DIRECTORY64
struct _IMAGE_RESOURCE_DATA_ENTRY * PIMAGE_RESOURCE_DATA_ENTRY
struct IMAGE_LOAD_CONFIG_DIRECTORY32 * PIMAGE_LOAD_CONFIG_DIRECTORY32
struct _IMAGE_DATA_DIRECTORY IMAGE_DATA_DIRECTORY
struct _IMAGE_BASE_RELOCATION IMAGE_BASE_RELOCATION
PIMAGE_LOAD_CONFIG_DIRECTORY32 PIMAGE_LOAD_CONFIG_DIRECTORY
IMAGE_LOAD_CONFIG_DIRECTORY32 IMAGE_LOAD_CONFIG_DIRECTORY
struct _IMAGE_THUNK_DATA64 IMAGE_THUNK_DATA64
struct _IMAGE_FILE_HEADER IMAGE_FILE_HEADER
struct _IMAGE_TLS_DIRECTORY32 * PIMAGE_TLS_DIRECTORY32
struct _IMAGE_IMPORT_BY_NAME IMAGE_IMPORT_BY_NAME
struct _IMAGE_OPTIONAL_HEADER * PIMAGE_OPTIONAL_HEADER32
IMAGE_TLS_DIRECTORY32 IMAGE_TLS_DIRECTORY
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES
PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS
struct _IMAGE_RESOURCE_DIRECTORY_ENTRY IMAGE_RESOURCE_DIRECTORY_ENTRY
struct _IMAGE_ROM_OPTIONAL_HEADER * PIMAGE_ROM_OPTIONAL_HEADER
struct _IMAGE_EXPORT_DIRECTORY * PIMAGE_EXPORT_DIRECTORY
struct _IMAGE_DOS_HEADER IMAGE_DOS_HEADER
struct _IMAGE_RESOURCE_DIRECTORY_STRING IMAGE_RESOURCE_DIRECTORY_STRING
struct _IMAGE_NT_HEADERS64 * PIMAGE_NT_HEADERS64
struct _IMAGE_RESOURCE_DIRECTORY IMAGE_RESOURCE_DIRECTORY
PIMAGE_TLS_DIRECTORY32 PIMAGE_TLS_DIRECTORY
struct _IMAGE_OPTIONAL_HEADER IMAGE_OPTIONAL_HEADER32
struct _IMAGE_DATA_DIRECTORY * PIMAGE_DATA_DIRECTORY
PIMAGE_OPTIONAL_HEADER32 PIMAGE_OPTIONAL_HEADER
struct _IMAGE_EXPORT_DIRECTORY IMAGE_EXPORT_DIRECTORY
struct _IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS64
PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA
struct _IMAGE_IMPORT_BY_NAME * PIMAGE_IMPORT_BY_NAME
struct _IMAGE_THUNK_DATA64 * PIMAGE_THUNK_DATA64
struct _IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32
struct _IMAGE_RESOURCE_DIRECTORY_ENTRY * PIMAGE_RESOURCE_DIRECTORY_ENTRY
struct _IMAGE_IMPORT_DESCRIPTOR IMAGE_IMPORT_DESCRIPTOR
struct _IMAGE_RESOURCE_DATA_ENTRY IMAGE_RESOURCE_DATA_ENTRY
struct _IMAGE_DOS_HEADER * PIMAGE_DOS_HEADER
struct _IMAGE_TLS_DIRECTORY32 IMAGE_TLS_DIRECTORY32
struct _IMAGE_NT_HEADERS IMAGE_NT_HEADERS32
struct _IMAGE_NT_HEADERS * PIMAGE_NT_HEADERS32
struct _IMAGE_TLS_DIRECTORY64 * PIMAGE_TLS_DIRECTORY64
VOID(NTAPI * PIMAGE_TLS_CALLBACK)(PVOID DllHandle, ULONG Reason, PVOID Reserved)
struct _IMAGE_FILE_HEADER * PIMAGE_FILE_HEADER
struct _IMAGE_SECTION_HEADER IMAGE_SECTION_HEADER
struct _IMAGE_ROM_OPTIONAL_HEADER IMAGE_ROM_OPTIONAL_HEADER
ULONG ProcessAffinityMask
ULONG DeCommitTotalFreeThreshold
ULONG MaximumAllocationSize
ULONG DeCommitFreeBlockThreshold
ULONG CriticalSectionDefaultTimeout
ULONG VirtualMemoryThreshold
ULONG CriticalSectionDefaultTimeout
ULONGLONG ProcessAffinityMask
ULONGLONG DeCommitFreeBlockThreshold
ULONGLONG MaximumAllocationSize
ULONGLONG DeCommitTotalFreeThreshold
ULONGLONG VirtualMemoryThreshold
ULONGLONG LockPrefixTable
ULONG AddressOfNameOrdinals
_ANONYMOUS_UNION union _IMAGE_IMPORT_DESCRIPTOR::@2219 DUMMYUNIONNAME
_ANONYMOUS_STRUCT struct _IMAGE_RESOURCE_DIRECTORY_ENTRY::@2212::@2214 DUMMYSTRUCTNAME
_ANONYMOUS_UNION union _IMAGE_RESOURCE_DIRECTORY_ENTRY::@2213 DUMMYUNIONNAME2
_ANONYMOUS_UNION union _IMAGE_RESOURCE_DIRECTORY_ENTRY::@2212 DUMMYUNIONNAME
_ANONYMOUS_STRUCT struct _IMAGE_RESOURCE_DIRECTORY_ENTRY::@2213::@2215 DUMMYSTRUCTNAME2
USHORT NumberOfNamedEntries
union _IMAGE_THUNK_DATA32::@2218 u1
ULONGLONG ForwarderString
union _IMAGE_THUNK_DATA64::@2217 u1
ULONG StartAddressOfRawData
ULONG EndAddressOfRawData
ULONGLONG AddressOfCallBacks
ULONGLONG StartAddressOfRawData
ULONGLONG EndAddressOfRawData
_Reserved_ PVOID Reserved
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES
#define IMAGE_SIZEOF_SHORT_NAME