7 #define IMAGE_DOS_SIGNATURE 0x5A4D 8 #define IMAGE_OS2_SIGNATURE 0x454E 9 #define IMAGE_OS2_SIGNATURE_LE 0x454C 10 #define IMAGE_VXD_SIGNATURE 0x454C 11 #define IMAGE_NT_SIGNATURE 0x00004550 16 #define IMAGE_FILE_MACHINE_AM33 0x1d3 17 #define IMAGE_FILE_MACHINE_AMD64 0x8664 18 #define IMAGE_FILE_MACHINE_ARM 0x1c0 19 #define IMAGE_FILE_MACHINE_ARMV7 0x1c4 20 #define IMAGE_FILE_MACHINE_EBC 0xebc 21 #define IMAGE_FILE_MACHINE_I386 0x14c 22 #define IMAGE_FILE_MACHINE_IA64 0x200 23 #define IMAGE_FILE_MACHINE_M32R 0x9041 24 #define IMAGE_FILE_MACHINE_MIPS16 0x266 25 #define IMAGE_FILE_MACHINE_MIPSFPU 0x366 26 #define IMAGE_FILE_MACHINE_MIPSFPU16 0x466 27 #define IMAGE_FILE_MACHINE_POWERPC 0x1f0 28 #define IMAGE_FILE_MACHINE_POWERPCFP 0x1f1 29 #define IMAGE_FILE_MACHINE_R4000 0x166 30 #define IMAGE_FILE_MACHINE_SH3 0x1a2 31 #define IMAGE_FILE_MACHINE_SH3E 0x01a4 32 #define IMAGE_FILE_MACHINE_SH3DSP 0x1a3 33 #define IMAGE_FILE_MACHINE_SH4 0x1a6 34 #define IMAGE_FILE_MACHINE_SH5 0x1a8 35 #define IMAGE_FILE_MACHINE_THUMB 0x1c2 36 #define IMAGE_FILE_MACHINE_WCEMIPSV2 0x169 37 #define IMAGE_FILE_MACHINE_R3000 0x162 38 #define IMAGE_FILE_MACHINE_R10000 0x168 39 #define IMAGE_FILE_MACHINE_ALPHA 0x184 40 #define IMAGE_FILE_MACHINE_ALPHA64 0x0284 41 #define IMAGE_FILE_MACHINE_AXP64 IMAGE_FILE_MACHINE_ALPHA64 42 #define IMAGE_FILE_MACHINE_CEE 0xC0EE 43 #define IMAGE_FILE_MACHINE_TRICORE 0x0520 44 #define IMAGE_FILE_MACHINE_CEF 0x0CEF 179 #define IMAGE_RESOURCE_NAME_IS_STRING 0x80000000 180 #define IMAGE_RESOURCE_DATA_IS_DIRECTORY 0x80000000 208 #define IMAGE_SIZEOF_SHORT_NAME 8 209 #define IMAGE_SIZEOF_SECTION_HEADER 40 230 #define IMAGE_SCN_CNT_CODE 0x00000020 231 #define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040 232 #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 234 #define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000 235 #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000 236 #define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 237 #define IMAGE_SCN_MEM_NOT_PAGED 0x08000000 238 #define IMAGE_SCN_MEM_SHARED 0x10000000 239 #define IMAGE_SCN_MEM_EXECUTE 0x20000000 240 #define IMAGE_SCN_MEM_READ 0x40000000 241 #define IMAGE_SCN_MEM_WRITE 0x80000000 246 #define IMAGE_SIZEOF_FILE_HEADER 20 261 #define IMAGE_FILE_RELOCS_STRIPPED 0x0001 262 #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 263 #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 264 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 265 #define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010 266 #define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 267 #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 268 #define IMAGE_FILE_32BIT_MACHINE 0x0100 269 #define IMAGE_FILE_DEBUG_STRIPPED 0x0200 270 #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 271 #define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 272 #define IMAGE_FILE_SYSTEM 0x1000 273 #define IMAGE_FILE_DLL 0x2000 274 #define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 275 #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 280 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 376 #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b 377 #define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b 378 #define IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107 383 #define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR64_MAGIC 387 #define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR32_MAGIC 427 #define IMAGE_FIRST_SECTION( NtHeader ) \ 428 ((PIMAGE_SECTION_HEADER) ((ULONG_PTR)(NtHeader) + \ 429 FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) + \ 430 ((NtHeader))->FileHeader.SizeOfOptionalHeader)) 435 #define IMAGE_SUBSYSTEM_UNKNOWN 0 436 #define IMAGE_SUBSYSTEM_NATIVE 1 437 #define IMAGE_SUBSYSTEM_WINDOWS_GUI 2 438 #define IMAGE_SUBSYSTEM_WINDOWS_CUI 3 439 #define IMAGE_SUBSYSTEM_OS2_CUI 5 440 #define IMAGE_SUBSYSTEM_POSIX_CUI 7 441 #define IMAGE_SUBSYSTEM_NATIVE_WINDOWS 8 442 #define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI 9 443 #define IMAGE_SUBSYSTEM_EFI_APPLICATION 10 444 #define IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER 11 445 #define IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER 12 446 #define IMAGE_SUBSYSTEM_EFI_ROM 13 447 #define IMAGE_SUBSYSTEM_XBOX 14 448 #define IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION 16 449 #define IMAGE_SUBSYSTEM_XBOX_CODE_CATALOG 17 454 #define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA 0x0020 455 #define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040 456 #define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY 0x0080 457 #define IMAGE_DLLCHARACTERISTICS_NX_COMPAT 0x0100 458 #define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200 459 #define IMAGE_DLLCHARACTERISTICS_NO_SEH 0x0400 460 #define IMAGE_DLLCHARACTERISTICS_NO_BIND 0x0800 461 #define IMAGE_DLLCHARACTERISTICS_APPCONTAINER 0x1000 462 #define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER 0x2000 463 #define IMAGE_DLLCHARACTERISTICS_GUARD_CF 0x4000 464 #define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000 469 #define IMAGE_LOADER_FLAGS_COMPLUS 0x00000001 470 #define IMAGE_LOADER_FLAGS_SYSTEM_GLOBAL 0x01000000 475 #define IMAGE_DIRECTORY_ENTRY_EXPORT 0 476 #define IMAGE_DIRECTORY_ENTRY_IMPORT 1 477 #define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 478 #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 479 #define IMAGE_DIRECTORY_ENTRY_SECURITY 4 480 #define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 481 #define IMAGE_DIRECTORY_ENTRY_DEBUG 6 482 #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7 483 #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 484 #define IMAGE_DIRECTORY_ENTRY_TLS 9 485 #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 486 #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 487 #define IMAGE_DIRECTORY_ENTRY_IAT 12 488 #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13 489 #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 499 #include <pshpack8.h> 519 #define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL 520 #define IMAGE_ORDINAL_FLAG32 0x80000000 521 #define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff) 522 #define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff) 523 #define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0) 524 #define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0) 555 #define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG64 556 #define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL64(Ordinal) 559 #define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL64(Ordinal) 563 #define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG32 564 #define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL32(Ordinal) 567 #define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL32(Ordinal)
struct _IMAGE_RESOURCE_DIRECTORY * PIMAGE_RESOURCE_DIRECTORY
struct _IMAGE_DATA_DIRECTORY * PIMAGE_DATA_DIRECTORY
struct _IMAGE_RESOURCE_DIRECTORY_STRING IMAGE_RESOURCE_DIRECTORY_STRING
struct _IMAGE_SECTION_HEADER IMAGE_SECTION_HEADER
struct _IMAGE_BASE_RELOCATION * PIMAGE_BASE_RELOCATION
IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS
ULONG AddressOfNameOrdinals
struct _IMAGE_RESOURCE_DIRECTORY IMAGE_RESOURCE_DIRECTORY
struct _IMAGE_IMPORT_BY_NAME * PIMAGE_IMPORT_BY_NAME
#define IMAGE_SIZEOF_SHORT_NAME
struct _IMAGE_THUNK_DATA64 * PIMAGE_THUNK_DATA64
struct _IMAGE_RESOURCE_DATA_ENTRY IMAGE_RESOURCE_DATA_ENTRY
IMAGE_TLS_DIRECTORY32 IMAGE_TLS_DIRECTORY
PIMAGE_TLS_DIRECTORY32 PIMAGE_TLS_DIRECTORY
struct _IMAGE_THUNK_DATA64 IMAGE_THUNK_DATA64
struct _IMAGE_TLS_DIRECTORY32 * PIMAGE_TLS_DIRECTORY32
ULONGLONG MaximumAllocationSize
struct _IMAGE_IMPORT_DESCRIPTOR * PIMAGE_IMPORT_DESCRIPTOR
_ANONYMOUS_STRUCT struct _IMAGE_RESOURCE_DIRECTORY_ENTRY::@2083::@2085 DUMMYSTRUCTNAME2
struct _IMAGE_BASE_RELOCATION IMAGE_BASE_RELOCATION
IMAGE_OPTIONAL_HEADER32 IMAGE_OPTIONAL_HEADER
ULONGLONG DeCommitTotalFreeThreshold
PIMAGE_OPTIONAL_HEADER32 PIMAGE_OPTIONAL_HEADER
struct _IMAGE_LOAD_CONFIG_DIRECTORY32 IMAGE_LOAD_CONFIG_DIRECTORY32
union _IMAGE_THUNK_DATA64::@2087 u1
ULONGLONG LockPrefixTable
struct _IMAGE_NT_HEADERS * PIMAGE_NT_HEADERS32
PIMAGE_LOAD_CONFIG_DIRECTORY32 PIMAGE_LOAD_CONFIG_DIRECTORY
ULONGLONG AddressOfCallBacks
ULONGLONG StartAddressOfRawData
USHORT NumberOfNamedEntries
_ANONYMOUS_UNION union _IMAGE_RESOURCE_DIRECTORY_ENTRY::@2082 DUMMYUNIONNAME
struct IMAGE_LOAD_CONFIG_DIRECTORY32 * PIMAGE_LOAD_CONFIG_DIRECTORY32
IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA
ULONG DeCommitTotalFreeThreshold
struct _IMAGE_LOAD_CONFIG_DIRECTORY64 IMAGE_LOAD_CONFIG_DIRECTORY64
VOID(NTAPI * PIMAGE_TLS_CALLBACK)(PVOID DllHandle, ULONG Reason, PVOID Reserved)
struct _IMAGE_FILE_HEADER * PIMAGE_FILE_HEADER
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
ULONGLONG VirtualMemoryThreshold
struct _IMAGE_DOS_HEADER IMAGE_DOS_HEADER
struct _IMAGE_FILE_HEADER IMAGE_FILE_HEADER
struct _IMAGE_TLS_DIRECTORY64 IMAGE_TLS_DIRECTORY64
struct _IMAGE_TLS_DIRECTORY32 IMAGE_TLS_DIRECTORY32
_Reserved_ PVOID Reserved
struct _IMAGE_SECTION_HEADER * PIMAGE_SECTION_HEADER
ULONG VirtualMemoryThreshold
ULONGLONG ProcessAffinityMask
struct _IMAGE_RESOURCE_DIRECTORY_ENTRY * PIMAGE_RESOURCE_DIRECTORY_ENTRY
struct _IMAGE_ROM_OPTIONAL_HEADER * PIMAGE_ROM_OPTIONAL_HEADER
struct _IMAGE_DATA_DIRECTORY IMAGE_DATA_DIRECTORY
ULONG CriticalSectionDefaultTimeout
_ANONYMOUS_UNION union _IMAGE_RESOURCE_DIRECTORY_ENTRY::@2083 DUMMYUNIONNAME2
struct _IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS64
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES
struct _IMAGE_OPTIONAL_HEADER * PIMAGE_OPTIONAL_HEADER32
struct _IMAGE_IMPORT_BY_NAME IMAGE_IMPORT_BY_NAME
struct _IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA32
IMAGE_LOAD_CONFIG_DIRECTORY32 IMAGE_LOAD_CONFIG_DIRECTORY
struct _IMAGE_TLS_DIRECTORY64 * PIMAGE_TLS_DIRECTORY64
ULONGLONG EndAddressOfRawData
struct _IMAGE_OPTIONAL_HEADER IMAGE_OPTIONAL_HEADER32
#define _ANONYMOUS_STRUCT
union _IMAGE_THUNK_DATA32::@2088 u1
struct _IMAGE_RESOURCE_DATA_ENTRY * PIMAGE_RESOURCE_DATA_ENTRY
struct _IMAGE_RESOURCE_DIRECTORY_STRING * PIMAGE_RESOURCE_DIRECTORY_STRING
struct _IMAGE_DOS_HEADER * PIMAGE_DOS_HEADER
struct _IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32
ULONG ProcessAffinityMask
struct _IMAGE_NT_HEADERS IMAGE_NT_HEADERS32
_ANONYMOUS_UNION union _IMAGE_IMPORT_DESCRIPTOR::@2089 DUMMYUNIONNAME
_ANONYMOUS_STRUCT struct _IMAGE_RESOURCE_DIRECTORY_ENTRY::@2082::@2084 DUMMYSTRUCTNAME
ULONGLONG DeCommitFreeBlockThreshold
struct IMAGE_LOAD_CONFIG_DIRECTORY64 * PIMAGE_LOAD_CONFIG_DIRECTORY64
ULONG EndAddressOfRawData
PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS
struct _IMAGE_OPTIONAL_HEADER64 * PIMAGE_OPTIONAL_HEADER64
ULONG MaximumAllocationSize
struct _IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER64
ULONG DeCommitFreeBlockThreshold
PVOID PVOID PWCHAR PVOID USHORT PULONG Reason
ULONGLONG ForwarderString
ULONG StartAddressOfRawData
struct _IMAGE_EXPORT_DIRECTORY IMAGE_EXPORT_DIRECTORY
struct _IMAGE_NT_HEADERS64 * PIMAGE_NT_HEADERS64
struct _IMAGE_IMPORT_DESCRIPTOR IMAGE_IMPORT_DESCRIPTOR
PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA
struct _IMAGE_ROM_OPTIONAL_HEADER IMAGE_ROM_OPTIONAL_HEADER
struct _IMAGE_EXPORT_DIRECTORY * PIMAGE_EXPORT_DIRECTORY
struct _IMAGE_RESOURCE_DIRECTORY_ENTRY IMAGE_RESOURCE_DIRECTORY_ENTRY
ULONG CriticalSectionDefaultTimeout