1 // copyright (c) 2017-2021 hors<horsicq@gmail.com> 2 // 3 // Permission is hereby granted, free of charge, to any person obtaining a copy 4 // of this software and associated documentation files (the "Software"), to deal 5 // in the Software without restriction, including without limitation the rights 6 // to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 7 // copies of the Software, and to permit persons to whom the Software is 8 // furnished to do so, subject to the following conditions: 9 10 // The above copyright notice and this permission notice shall be included in all 11 // copies or substantial portions of the Software. 12 13 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 14 // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 15 // FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 16 // AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 17 // LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 18 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 19 // SOFTWARE. 20 // 21 #include "pe_defs.h" 22 23 namespace N_IMAGE_DOS_HEADER 24 { 25 const FW_DEF::HEADER_RECORD records[]= 26 { 27 {e_magic, "e_magic", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_magic), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 28 {e_cblp, "e_cblp", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_cblp), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 29 {e_cp, "e_cp", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_cp), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 30 {e_crlc, "e_crlc", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_crlc), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 31 {e_cparhdr, "e_cparhdr", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_cparhdr), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 32 {e_minalloc, "e_minalloc", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_minalloc),2, "WORD", FW_DEF::VAL_TYPE_DATA}, 33 {e_maxalloc, "e_maxalloc", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_maxalloc),2, "WORD", FW_DEF::VAL_TYPE_DATA}, 34 {e_ss, "e_ss", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_ss), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 35 {e_sp, "e_sp", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_sp), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 36 {e_csum, "e_csum", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_csum), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 37 {e_ip, "e_ip", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_ip), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 38 {e_cs, "e_cs", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_cs), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 39 {e_lfarlc, "e_lfarlc", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_lfarlc), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 40 {e_ovno, "e_ovno", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_ovno), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 41 {e_res_0, "e_res_0", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res)+0, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 42 {e_res_1, "e_res_1", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res)+2, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 43 {e_res_2, "e_res_2", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res)+4, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 44 {e_res_3, "e_res_3", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res)+6, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 45 {e_oemid, "e_oemid", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_oemid), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 46 {e_oeminfo, "e_oeminfo", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_oeminfo), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 47 {e_res2_0, "e_res2_0", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res2)+0, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 48 {e_res2_1, "e_res2_1", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res2)+2, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 49 {e_res2_2, "e_res2_2", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res2)+4, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 50 {e_res2_3, "e_res2_3", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res2)+6, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 51 {e_res2_4, "e_res2_4", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res2)+8, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 52 {e_res2_5, "e_res2_5", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res2)+10, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 53 {e_res2_6, "e_res2_6", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res2)+12, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 54 {e_res2_7, "e_res2_7", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res2)+14, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 55 {e_res2_8, "e_res2_8", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res2)+16, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 56 {e_res2_9, "e_res2_9", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_res2)+18, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 57 {e_lfanew, "e_lfanew", offsetof(XMSDOS_DEF::IMAGE_DOS_HEADEREX,e_lfanew), 4, "LONG", FW_DEF::VAL_TYPE_OFFSET} 58 }; 59 } 60 61 namespace N_IMAGE_NT_HEADERS 62 { 63 const FW_DEF::HEADER_RECORD records[]= 64 { 65 {Signature, "Signature", offsetof(XPE_DEF::IMAGE_NT_HEADERS32,Signature), 4, "DWORD", FW_DEF::VAL_TYPE_DATA} 66 }; 67 } 68 69 namespace N_IMAGE_FILE_HEADER 70 { 71 const FW_DEF::HEADER_RECORD records[]= 72 { 73 {Machine, "Machine", offsetof(XPE_DEF::IMAGE_FILE_HEADER,Machine), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 74 {NumberOfSections, "NumberOfSections", offsetof(XPE_DEF::IMAGE_FILE_HEADER,NumberOfSections), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 75 {TimeDateStamp, "TimeDateStamp", offsetof(XPE_DEF::IMAGE_FILE_HEADER,TimeDateStamp), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 76 {PointerToSymbolTable, "PointerToSymbolTable", offsetof(XPE_DEF::IMAGE_FILE_HEADER,PointerToSymbolTable), 4, "DWORD", FW_DEF::VAL_TYPE_OFFSET}, 77 {NumberOfSymbols, "NumberOfSymbols", offsetof(XPE_DEF::IMAGE_FILE_HEADER,NumberOfSymbols), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 78 {SizeOfOptionalHeader, "SizeOfOptionalHeader", offsetof(XPE_DEF::IMAGE_FILE_HEADER,SizeOfOptionalHeader), 2, "WORD", FW_DEF::VAL_TYPE_SIZE}, 79 {Characteristics, "Characteristics", offsetof(XPE_DEF::IMAGE_FILE_HEADER,Characteristics), 2, "WORD", FW_DEF::VAL_TYPE_FLAGS} 80 }; 81 } 82 83 namespace N_IMAGE_OPTIONAL_HEADER 84 { 85 const FW_DEF::HEADER_RECORD records32[]= 86 { 87 {Magic, "Magic", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,Magic), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 88 {MajorLinkerVersion, "MajorLinkerVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,MajorLinkerVersion), 1, "BYTE", FW_DEF::VAL_TYPE_DATA}, 89 {MinorLinkerVersion, "MinorLinkerVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,MinorLinkerVersion), 1, "BYTE", FW_DEF::VAL_TYPE_DATA}, 90 {SizeOfCode, "SizeOfCode", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,SizeOfCode), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 91 {SizeOfInitializedData, "SizeOfInitializedData", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,SizeOfInitializedData), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 92 {SizeOfUninitializedData, "SizeOfUninitializedData", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,SizeOfUninitializedData), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 93 {AddressOfEntryPoint, "AddressOfEntryPoint", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,AddressOfEntryPoint), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 94 {BaseOfCode, "BaseOfCode", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,BaseOfCode), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 95 {BaseOfData, "BaseOfData", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,BaseOfData), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 96 {ImageBase, "ImageBase", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,ImageBase), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 97 {SectionAlignment, "SectionAlignment", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,SectionAlignment), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 98 {FileAlignment, "FileAlignment", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,FileAlignment), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 99 {MajorOperatingSystemVersion, "MajorOperatingSystemVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,MajorOperatingSystemVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 100 {MinorOperatingSystemVersion, "MinorOperatingSystemVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,MinorOperatingSystemVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 101 {MajorImageVersion, "MajorImageVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,MajorImageVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 102 {MinorImageVersion, "MinorImageVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,MinorImageVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 103 {MajorSubsystemVersion, "MajorSubsystemVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,MajorSubsystemVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 104 {MinorSubsystemVersion, "MinorSubsystemVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,MinorSubsystemVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 105 {Win32VersionValue, "Win32VersionValue", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,Win32VersionValue), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 106 {SizeOfImage, "SizeOfImage", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,SizeOfImage), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 107 {SizeOfHeaders, "SizeOfHeaders", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,SizeOfHeaders), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 108 {CheckSum, "CheckSum", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,CheckSum), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 109 {Subsystem, "Subsystem", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,Subsystem), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 110 {DllCharacteristics, "DllCharacteristics", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,DllCharacteristics), 2, "WORD", FW_DEF::VAL_TYPE_FLAGS}, 111 {SizeOfStackReserve, "SizeOfStackReserve", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,SizeOfStackReserve), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 112 {SizeOfStackCommit, "SizeOfStackCommit", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,SizeOfStackCommit), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 113 {SizeOfHeapReserve, "SizeOfHeapReserve", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,SizeOfHeapReserve), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 114 {SizeOfHeapCommit, "SizeOfHeapCommit", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,SizeOfHeapCommit), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 115 {LoaderFlags, "LoaderFlags", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,LoaderFlags), 4, "DWORD", FW_DEF::VAL_TYPE_FLAGS}, 116 {NumberOfRvaAndSizes, "NumberOfRvaAndSizes", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER32,NumberOfRvaAndSizes), 4, "DWORD", FW_DEF::VAL_TYPE_DATA} 117 }; 118 const FW_DEF::HEADER_RECORD records64[]= 119 { 120 {Magic, "Magic", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,Magic), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 121 {MajorLinkerVersion, "MajorLinkerVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,MajorLinkerVersion), 1, "BYTE", FW_DEF::VAL_TYPE_DATA}, 122 {MinorLinkerVersion, "MinorLinkerVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,MinorLinkerVersion), 1, "BYTE", FW_DEF::VAL_TYPE_DATA}, 123 {SizeOfCode, "SizeOfCode", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,SizeOfCode), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 124 {SizeOfInitializedData, "SizeOfInitializedData", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,SizeOfInitializedData), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 125 {SizeOfUninitializedData, "SizeOfUninitializedData", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,SizeOfUninitializedData), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 126 {AddressOfEntryPoint, "AddressOfEntryPoint", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,AddressOfEntryPoint), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 127 {BaseOfCode, "BaseOfCode", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,BaseOfCode), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 128 {BaseOfData, "", 0, 0, "", FW_DEF::VAL_TYPE_UNKNOWN}, 129 {ImageBase, "ImageBase", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,ImageBase), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 130 {SectionAlignment, "SectionAlignment", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,SectionAlignment), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 131 {FileAlignment, "FileAlignment", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,FileAlignment), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 132 {MajorOperatingSystemVersion, "MajorOperatingSystemVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,MajorOperatingSystemVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 133 {MinorOperatingSystemVersion, "MinorOperatingSystemVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,MinorOperatingSystemVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 134 {MajorImageVersion, "MajorImageVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,MajorImageVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 135 {MinorImageVersion, "MinorImageVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,MinorImageVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 136 {MajorSubsystemVersion, "MajorSubsystemVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,MajorSubsystemVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 137 {MinorSubsystemVersion, "MinorSubsystemVersion", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,MinorSubsystemVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 138 {Win32VersionValue, "Win32VersionValue", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,Win32VersionValue), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 139 {SizeOfImage, "SizeOfImage", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,SizeOfImage), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 140 {SizeOfHeaders, "SizeOfHeaders", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,SizeOfHeaders), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 141 {CheckSum, "CheckSum", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,CheckSum), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 142 {Subsystem, "Subsystem", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,Subsystem), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 143 {DllCharacteristics, "DllCharacteristics", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,DllCharacteristics), 2, "WORD", FW_DEF::VAL_TYPE_FLAGS}, 144 {SizeOfStackReserve, "SizeOfStackReserve", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,SizeOfStackReserve), 8, "ULONGLONG", FW_DEF::VAL_TYPE_SIZE}, 145 {SizeOfStackCommit, "SizeOfStackCommit", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,SizeOfStackCommit), 8, "ULONGLONG", FW_DEF::VAL_TYPE_SIZE}, 146 {SizeOfHeapReserve, "SizeOfHeapReserve", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,SizeOfHeapReserve), 8, "ULONGLONG", FW_DEF::VAL_TYPE_SIZE}, 147 {SizeOfHeapCommit, "SizeOfHeapCommit", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,SizeOfHeapCommit), 8, "ULONGLONG", FW_DEF::VAL_TYPE_SIZE}, 148 {LoaderFlags, "LoaderFlags", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,LoaderFlags), 4, "DWORD", FW_DEF::VAL_TYPE_FLAGS}, 149 {NumberOfRvaAndSizes, "NumberOfRvaAndSizes", offsetof(XPE_DEF::IMAGE_OPTIONAL_HEADER64,NumberOfRvaAndSizes), 4, "DWORD", FW_DEF::VAL_TYPE_DATA} 150 }; 151 } 152 153 namespace N_IMAGE_TLS 154 { 155 const FW_DEF::HEADER_RECORD records32[]= 156 { 157 {StartAddressOfRawData, "StartAddressOfRawData", offsetof(XPE_DEF::S_IMAGE_TLS_DIRECTORY32,StartAddressOfRawData), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 158 {EndAddressOfRawData, "EndAddressOfRawData", offsetof(XPE_DEF::S_IMAGE_TLS_DIRECTORY32,EndAddressOfRawData), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 159 {AddressOfIndex, "AddressOfIndex", offsetof(XPE_DEF::S_IMAGE_TLS_DIRECTORY32,AddressOfIndex), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 160 {AddressOfCallBacks, "AddressOfCallBacks", offsetof(XPE_DEF::S_IMAGE_TLS_DIRECTORY32,AddressOfCallBacks), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 161 {SizeOfZeroFill, "SizeOfZeroFill", offsetof(XPE_DEF::S_IMAGE_TLS_DIRECTORY32,SizeOfZeroFill), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 162 {Characteristics, "Characteristics", offsetof(XPE_DEF::S_IMAGE_TLS_DIRECTORY32,Characteristics), 4, "DWORD", FW_DEF::VAL_TYPE_FLAGS} 163 }; 164 const FW_DEF::HEADER_RECORD records64[]= 165 { 166 {StartAddressOfRawData, "StartAddressOfRawData", offsetof(XPE_DEF::S_IMAGE_TLS_DIRECTORY64,StartAddressOfRawData), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 167 {EndAddressOfRawData, "EndAddressOfRawData", offsetof(XPE_DEF::S_IMAGE_TLS_DIRECTORY64,EndAddressOfRawData), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 168 {AddressOfIndex, "AddressOfIndex", offsetof(XPE_DEF::S_IMAGE_TLS_DIRECTORY64,AddressOfIndex), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 169 {AddressOfCallBacks, "AddressOfCallBacks", offsetof(XPE_DEF::S_IMAGE_TLS_DIRECTORY64,AddressOfCallBacks), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 170 {SizeOfZeroFill, "SizeOfZeroFill", offsetof(XPE_DEF::S_IMAGE_TLS_DIRECTORY64,SizeOfZeroFill), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 171 {Characteristics, "Characteristics", offsetof(XPE_DEF::S_IMAGE_TLS_DIRECTORY64,Characteristics), 4, "DWORD", FW_DEF::VAL_TYPE_FLAGS} 172 }; 173 } 174 175 namespace N_IMAGE_LOADCONFIG 176 { 177 const FW_DEF::HEADER_RECORD records32[]= 178 { 179 {Size, "Size", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,Size), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 180 {TimeDateStamp, "TimeDateStamp", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,TimeDateStamp), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 181 {MajorVersion, "MajorVersion", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,MajorVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 182 {MinorVersion, "MinorVersion", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,MinorVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 183 {GlobalFlagsClear, "GlobalFlagsClear", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GlobalFlagsClear), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 184 {GlobalFlagsSet, "GlobalFlagsSet", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GlobalFlagsSet), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 185 {CriticalSectionDefaultTimeout, "CriticalSectionDefaultTimeout", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,CriticalSectionDefaultTimeout), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 186 {DeCommitFreeBlockThreshold, "DeCommitFreeBlockThreshold", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,DeCommitFreeBlockThreshold), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 187 {DeCommitTotalFreeThreshold, "DeCommitTotalFreeThreshold", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,DeCommitTotalFreeThreshold), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 188 {LockPrefixTable, "LockPrefixTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,LockPrefixTable), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 189 {MaximumAllocationSize, "MaximumAllocationSize", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,MaximumAllocationSize), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 190 {VirtualMemoryThreshold, "VirtualMemoryThreshold", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,VirtualMemoryThreshold), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 191 {ProcessAffinityMask, "ProcessAffinityMask", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,ProcessAffinityMask), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 192 {CSDVersion, "CSDVersion", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,CSDVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 193 {DependentLoadFlags, "DependentLoadFlags", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,DependentLoadFlags), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 194 {VirtualMemoryThreshold, "EditList", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,EditList), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 195 {VirtualMemoryThreshold, "SecurityCookie", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,SecurityCookie), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 196 {VirtualMemoryThreshold, "SEHandlerTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,SEHandlerTable), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 197 {VirtualMemoryThreshold, "SEHandlerCount", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,SEHandlerCount), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 198 {GuardCFCheckFunctionPointer, "GuardCFCheckFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardCFCheckFunctionPointer), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 199 {GuardCFDispatchFunctionPointer, "GuardCFDispatchFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardCFDispatchFunctionPointer), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 200 {GuardCFFunctionTable, "GuardCFFunctionTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardCFFunctionTable), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 201 {GuardCFFunctionCount, "GuardCFFunctionCount", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardCFFunctionCount), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 202 {GuardFlags, "GuardFlags", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardFlags), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 203 {CodeIntegrity_Flags, "CodeIntegrity_Flags", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,CodeIntegrity)+0, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 204 {CodeIntegrity_Catalog, "CodeIntegrity_Catalog", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,CodeIntegrity)+2, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 205 {CodeIntegrity_CatalogOffset, "CodeIntegrity_CatalogOffset", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,CodeIntegrity)+4, 4, "DWORD", FW_DEF::VAL_TYPE_OFFSET}, 206 {CodeIntegrity_Reserved, "CodeIntegrity_Reserved", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,CodeIntegrity)+8, 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 207 {GuardAddressTakenIatEntryTable, "GuardAddressTakenIatEntryTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardAddressTakenIatEntryTable), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 208 {GuardAddressTakenIatEntryCount, "GuardAddressTakenIatEntryCount", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardAddressTakenIatEntryCount), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 209 {GuardLongJumpTargetTable, "GuardLongJumpTargetTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardLongJumpTargetTable), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 210 {GuardLongJumpTargetCount, "GuardLongJumpTargetCount", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardLongJumpTargetCount), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 211 {DynamicValueRelocTable, "DynamicValueRelocTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,DynamicValueRelocTable), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 212 {CHPEMetadataPointer, "CHPEMetadataPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,CHPEMetadataPointer), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 213 {GuardRFFailureRoutine, "GuardRFFailureRoutine", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardRFFailureRoutine), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 214 {GuardRFFailureRoutineFunctionPointer, "GuardRFFailureRoutineFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardRFFailureRoutineFunctionPointer), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 215 {DynamicValueRelocTableOffset, "DynamicValueRelocTableOffset", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,DynamicValueRelocTableOffset), 4, "DWORD", FW_DEF::VAL_TYPE_OFFSET}, 216 {DynamicValueRelocTableSection, "DynamicValueRelocTableSection", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,DynamicValueRelocTableSection), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 217 {Reserved2, "Reserved2", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,Reserved2), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 218 {GuardRFVerifyStackPointerFunctionPointer, "GuardRFVerifyStackPointerFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardRFVerifyStackPointerFunctionPointer), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 219 {HotPatchTableOffset, "HotPatchTableOffset", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,HotPatchTableOffset), 4, "DWORD", FW_DEF::VAL_TYPE_OFFSET}, 220 {Reserved3, "Reserved3", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,Reserved3), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 221 {EnclaveConfigurationPointer, "EnclaveConfigurationPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,EnclaveConfigurationPointer), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 222 {VolatileMetadataPointer, "VolatileMetadataPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,VolatileMetadataPointer), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 223 {GuardEHContinuationTable, "GuardEHContinuationTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardEHContinuationTable), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 224 {GuardEHContinuationCount, "GuardEHContinuationCount", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardEHContinuationCount), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 225 {GuardXFGCheckFunctionPointer, "GuardXFGCheckFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardXFGCheckFunctionPointer), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 226 {GuardXFGDispatchFunctionPointer, "GuardXFGDispatchFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardXFGDispatchFunctionPointer), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 227 {GuardXFGTableDispatchFunctionPointer, "GuardXFGTableDispatchFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,GuardXFGTableDispatchFunctionPointer), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 228 {CastGuardOsDeterminedFailureMode, "CastGuardOsDeterminedFailureMode", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY32,CastGuardOsDeterminedFailureMode), 4, "DWORD", FW_DEF::VAL_TYPE_ADDRESS}, 229 }; 230 const FW_DEF::HEADER_RECORD records64[]= 231 { 232 {Size, "Size", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,Size), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 233 {TimeDateStamp, "TimeDateStamp", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,TimeDateStamp), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 234 {MajorVersion, "MajorVersion", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,MajorVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 235 {MinorVersion, "MinorVersion", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,MinorVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 236 {GlobalFlagsClear, "GlobalFlagsClear", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GlobalFlagsClear), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 237 {GlobalFlagsSet, "GlobalFlagsSet", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GlobalFlagsSet), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 238 {CriticalSectionDefaultTimeout, "CriticalSectionDefaultTimeout", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,CriticalSectionDefaultTimeout), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 239 {DeCommitFreeBlockThreshold, "DeCommitFreeBlockThreshold", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,DeCommitFreeBlockThreshold), 8, "ULONGLONG", FW_DEF::VAL_TYPE_DATA}, 240 {DeCommitTotalFreeThreshold, "DeCommitTotalFreeThreshold", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,DeCommitTotalFreeThreshold), 8, "ULONGLONG", FW_DEF::VAL_TYPE_DATA}, 241 {LockPrefixTable, "LockPrefixTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,LockPrefixTable), 8, "ULONGLONG", FW_DEF::VAL_TYPE_DATA}, 242 {MaximumAllocationSize, "MaximumAllocationSize", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,MaximumAllocationSize), 8, "ULONGLONG", FW_DEF::VAL_TYPE_DATA}, 243 {VirtualMemoryThreshold, "VirtualMemoryThreshold", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,VirtualMemoryThreshold), 8, "ULONGLONG", FW_DEF::VAL_TYPE_DATA}, 244 {ProcessAffinityMask, "ProcessAffinityMask", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,ProcessAffinityMask), 8, "ULONGLONG", FW_DEF::VAL_TYPE_DATA}, 245 {CSDVersion, "CSDVersion", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,CSDVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 246 {DependentLoadFlags, "DependentLoadFlags", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,DependentLoadFlags), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 247 {VirtualMemoryThreshold, "EditList", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,EditList), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 248 {VirtualMemoryThreshold, "SecurityCookie", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,SecurityCookie), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 249 {VirtualMemoryThreshold, "SEHandlerTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,SEHandlerTable), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 250 {VirtualMemoryThreshold, "SEHandlerCount", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,SEHandlerCount), 8, "ULONGLONG", FW_DEF::VAL_TYPE_DATA}, 251 {GuardCFCheckFunctionPointer, "GuardCFCheckFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardCFCheckFunctionPointer), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 252 {GuardCFDispatchFunctionPointer, "GuardCFDispatchFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardCFDispatchFunctionPointer), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 253 {GuardCFFunctionTable, "GuardCFFunctionTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardCFFunctionTable), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 254 {GuardCFFunctionCount, "GuardCFFunctionCount", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardCFFunctionCount), 8, "ULONGLONG", FW_DEF::VAL_TYPE_DATA}, 255 {GuardFlags, "GuardFlags", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardFlags), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 256 {CodeIntegrity_Flags, "CodeIntegrity_Flags", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,CodeIntegrity)+0, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 257 {CodeIntegrity_Catalog, "CodeIntegrity_Catalog", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,CodeIntegrity)+2, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 258 {CodeIntegrity_CatalogOffset, "CodeIntegrity_CatalogOffset", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,CodeIntegrity)+4, 4, "DWORD", FW_DEF::VAL_TYPE_OFFSET}, 259 {CodeIntegrity_Reserved, "CodeIntegrity_Reserved", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,CodeIntegrity)+8, 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 260 {GuardAddressTakenIatEntryTable, "GuardAddressTakenIatEntryTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardAddressTakenIatEntryTable), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 261 {GuardAddressTakenIatEntryCount, "GuardAddressTakenIatEntryCount", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardAddressTakenIatEntryCount), 8, "ULONGLONG", FW_DEF::VAL_TYPE_DATA}, 262 {GuardLongJumpTargetTable, "GuardLongJumpTargetTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardLongJumpTargetTable), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 263 {GuardLongJumpTargetCount, "GuardLongJumpTargetCount", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardLongJumpTargetCount), 8, "ULONGLONG", FW_DEF::VAL_TYPE_DATA}, 264 {DynamicValueRelocTable, "DynamicValueRelocTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,DynamicValueRelocTable), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 265 {CHPEMetadataPointer, "CHPEMetadataPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,CHPEMetadataPointer), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 266 {GuardRFFailureRoutine, "GuardRFFailureRoutine", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardRFFailureRoutine), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 267 {GuardRFFailureRoutineFunctionPointer, "GuardRFFailureRoutineFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardRFFailureRoutineFunctionPointer), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 268 {DynamicValueRelocTableOffset, "DynamicValueRelocTableOffset", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,DynamicValueRelocTableOffset), 4, "DWORD", FW_DEF::VAL_TYPE_OFFSET}, 269 {DynamicValueRelocTableSection, "DynamicValueRelocTableSection", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,DynamicValueRelocTableSection), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 270 {Reserved2, "Reserved2", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,Reserved2), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 271 {GuardRFVerifyStackPointerFunctionPointer, "GuardRFVerifyStackPointerFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardRFVerifyStackPointerFunctionPointer), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 272 {HotPatchTableOffset, "HotPatchTableOffset", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,HotPatchTableOffset), 4, "DWORD", FW_DEF::VAL_TYPE_OFFSET}, 273 {Reserved3, "Reserved3", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,Reserved3), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 274 {EnclaveConfigurationPointer, "EnclaveConfigurationPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,EnclaveConfigurationPointer), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 275 {VolatileMetadataPointer, "VolatileMetadataPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,VolatileMetadataPointer), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 276 {GuardEHContinuationTable, "GuardEHContinuationTable", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardEHContinuationTable), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 277 {GuardEHContinuationCount, "GuardEHContinuationCount", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardEHContinuationCount), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 278 {GuardXFGCheckFunctionPointer, "GuardXFGCheckFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardXFGCheckFunctionPointer), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 279 {GuardXFGDispatchFunctionPointer, "GuardXFGDispatchFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardXFGDispatchFunctionPointer), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 280 {GuardXFGTableDispatchFunctionPointer, "GuardXFGTableDispatchFunctionPointer", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,GuardXFGTableDispatchFunctionPointer), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 281 {CastGuardOsDeterminedFailureMode, "CastGuardOsDeterminedFailureMode", offsetof(XPE_DEF::S_IMAGE_LOAD_CONFIG_DIRECTORY64,CastGuardOsDeterminedFailureMode), 8, "ULONGLONG", FW_DEF::VAL_TYPE_ADDRESS}, 282 }; 283 } 284 285 namespace N_IMAGE_DIRECORIES 286 { 287 const FW_DEF::HEADER_RECORD records[]= 288 { 289 {Name, QObject::tr("Name"), 0, 0, "", FW_DEF::VAL_TYPE_LABEL}, 290 {Address, QObject::tr("Address"), 4, 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 291 {Size, QObject::tr("Size"), 8, 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 292 }; 293 } 294 295 namespace N_IMAGE_SECTION_HEADER 296 { 297 const FW_DEF::HEADER_RECORD records[]= 298 { 299 {Name, QObject::tr("Name"), offsetof(XPE_DEF::IMAGE_SECTION_HEADER,Name), 8, "BYTE[8]", FW_DEF::VAL_TYPE_TEXT}, 300 {VirtualSize, "VirtualSize", offsetof(XPE_DEF::IMAGE_SECTION_HEADER,Misc.VirtualSize), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 301 {VirtualAddress, "VirtualAddress", offsetof(XPE_DEF::IMAGE_SECTION_HEADER,VirtualAddress), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 302 {SizeOfRawData, "SizeOfRawData", offsetof(XPE_DEF::IMAGE_SECTION_HEADER,SizeOfRawData), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 303 {PointerToRawData, "PointerToRawData", offsetof(XPE_DEF::IMAGE_SECTION_HEADER,PointerToRawData), 4, "DWORD", FW_DEF::VAL_TYPE_OFFSET}, 304 {PointerToRelocations, "PointerToRelocations", offsetof(XPE_DEF::IMAGE_SECTION_HEADER,PointerToRelocations), 4, "DWORD", FW_DEF::VAL_TYPE_OFFSET}, 305 {PointerToLinenumbers, "PointerToLinenumbers", offsetof(XPE_DEF::IMAGE_SECTION_HEADER,PointerToLinenumbers), 4, "DWORD", FW_DEF::VAL_TYPE_OFFSET}, 306 {NumberOfRelocations, "NumberOfRelocations", offsetof(XPE_DEF::IMAGE_SECTION_HEADER,NumberOfRelocations), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 307 {NumberOfLinenumbers, "NumberOfLinenumbers", offsetof(XPE_DEF::IMAGE_SECTION_HEADER,NumberOfLinenumbers), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 308 {Characteristics, "Characteristics", offsetof(XPE_DEF::IMAGE_SECTION_HEADER,Characteristics), 4, "DWORD", FW_DEF::VAL_TYPE_FLAGS}, 309 {Characteristics, "", -1, 0, "", FW_DEF::VAL_TYPE_UNKNOWN} 310 }; 311 } 312 313 namespace N_IMAGE_RESOURCES 314 { 315 const FW_DEF::HEADER_RECORD records[]= 316 { 317 {ID1, "ID1", -1, 0, "", FW_DEF::VAL_TYPE_DATA}, 318 {ID2, "ID2", -1, 0, "", FW_DEF::VAL_TYPE_DATA}, 319 {ID3, "ID3", -1, 0, "", FW_DEF::VAL_TYPE_DATA}, 320 {ADDRESS, QObject::tr("Address"), -1, 0, "", FW_DEF::VAL_TYPE_ADDRESS}, 321 {OFFSET, QObject::tr("Offset"), -1, 0, "", FW_DEF::VAL_TYPE_OFFSET}, 322 {SIZE, QObject::tr("Size"), -1, 0, "", FW_DEF::VAL_TYPE_SIZE}, 323 }; 324 } 325 326 namespace N_IMAGE_EXPORT 327 { 328 const FW_DEF::HEADER_RECORD records[]= 329 { 330 {Characteristics, "Characteristics", offsetof(XPE_DEF::IMAGE_EXPORT_DIRECTORY,Characteristics), 4, "DWORD", FW_DEF::VAL_TYPE_FLAGS}, 331 {TimeDateStamp, "TimeDateStamp", offsetof(XPE_DEF::IMAGE_EXPORT_DIRECTORY,TimeDateStamp), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 332 {MajorVersion, "MajorVersion", offsetof(XPE_DEF::IMAGE_EXPORT_DIRECTORY,MajorVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 333 {MinorVersion, "MinorVersion", offsetof(XPE_DEF::IMAGE_EXPORT_DIRECTORY,MinorVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 334 {Name, "Name", offsetof(XPE_DEF::IMAGE_EXPORT_DIRECTORY,Name), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 335 {Base, "Base", offsetof(XPE_DEF::IMAGE_EXPORT_DIRECTORY,Base), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 336 {NumberOfFunctions, "NumberOfFunctions", offsetof(XPE_DEF::IMAGE_EXPORT_DIRECTORY,NumberOfFunctions), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 337 {NumberOfNames, "NumberOfNames", offsetof(XPE_DEF::IMAGE_EXPORT_DIRECTORY,NumberOfNames), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 338 {AddressOfFunctions, "AddressOfFunctions", offsetof(XPE_DEF::IMAGE_EXPORT_DIRECTORY,AddressOfFunctions), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 339 {AddressOfNames, "AddressOfNames", offsetof(XPE_DEF::IMAGE_EXPORT_DIRECTORY,AddressOfNames), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 340 {AddressOfNameOrdinals, "AddressOfNameOrdinals", offsetof(XPE_DEF::IMAGE_EXPORT_DIRECTORY,AddressOfNameOrdinals), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS} 341 }; 342 } 343 344 namespace N_IMAGE_EXPORT_FUNCTION 345 { 346 const FW_DEF::HEADER_RECORD records[]= 347 { 348 {Ordinal, "Ordinal", 0, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 349 {RVA, "RVA", 0, 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 350 {Name, QObject::tr("Name"), 0, 4, "SZCHAR", FW_DEF::VAL_TYPE_RELADDRESS} 351 }; 352 } 353 354 namespace N_IMAGE_IMPORT 355 { 356 const FW_DEF::HEADER_RECORD records[]= 357 { 358 {OriginalFirstThunk, "OriginalFirstThunk", offsetof(XPE_DEF::IMAGE_IMPORT_DESCRIPTOR,OriginalFirstThunk), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 359 {TimeDateStamp, "TimeDateStamp", offsetof(XPE_DEF::IMAGE_IMPORT_DESCRIPTOR,TimeDateStamp), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 360 {ForwarderChain, "ForwarderChain", offsetof(XPE_DEF::IMAGE_IMPORT_DESCRIPTOR,ForwarderChain), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 361 {Name, QObject::tr("Name"), offsetof(XPE_DEF::IMAGE_IMPORT_DESCRIPTOR,Name), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 362 {FirstThunk, "FirstThunk", offsetof(XPE_DEF::IMAGE_IMPORT_DESCRIPTOR,FirstThunk), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS} 363 }; 364 } 365 366 namespace N_IMAGE_IMPORT_FUNCTION 367 { 368 const FW_DEF::HEADER_RECORD records32[]= 369 { 370 {Thunk, "Thunk", 0, 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 371 {Ordinal, "Ordinal", 0, 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 372 {Hint, "Hint", 0, 2, "WORD", FW_DEF::VAL_TYPE_DATA} 373 }; 374 const FW_DEF::HEADER_RECORD records64[]= 375 { 376 {Thunk, "Thunk", 0, 8, "QWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 377 {Ordinal, "Ordinal", 0, 8, "QWORD", FW_DEF::VAL_TYPE_DATA}, 378 {Hint, "Hint", 0, 2, "WORD", FW_DEF::VAL_TYPE_DATA} 379 }; 380 } 381 382 namespace N_IMAGE_DELAYIMPORT_FUNCTION 383 { 384 const FW_DEF::HEADER_RECORD records32[]= 385 { 386 {AddressThunk, "AddressThunk", 0, 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 387 {BoundThunk, "BoundThunk", 0, 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 388 {NameThunk, "NameThunk", 0, 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 389 {Ordinal, "Ordinal", 0, 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 390 {Hint, "Hint", 0, 2, "WORD", FW_DEF::VAL_TYPE_DATA} 391 }; 392 const FW_DEF::HEADER_RECORD records64[]= 393 { 394 {AddressThunk, "AddressThunk", 0, 8, "QWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 395 {BoundThunk, "BoundThunk", 0, 8, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 396 {NameThunk, "NameThunk", 0, 8, "QWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 397 {Ordinal, "Ordinal", 0, 8, "QWORD", FW_DEF::VAL_TYPE_DATA}, 398 {Hint, "Hint", 0, 2, "WORD", FW_DEF::VAL_TYPE_DATA} 399 }; 400 } 401 402 namespace N_IMAGE_BOUNDIMPORT 403 { 404 const FW_DEF::HEADER_RECORD records[]= 405 { 406 {TimeDateStamp, "TimeDateStamp", 0, 4, "DWORD", FW_DEF::VAL_TYPE_UNIXTIME}, 407 {OffsetModuleName, "OffsetModuleName", 4, 2, "WORD", FW_DEF::VAL_TYPE_OFFSET}, 408 {NumberOfModuleForwarderRefs, "NumberOfModuleForwarderRefs", 6, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 409 }; 410 } 411 412 namespace N_IMAGE_RELOCS 413 { 414 const FW_DEF::HEADER_RECORD records[]= 415 { 416 {VirtualAddress, "VirtualAddress", 0, 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 417 {SizeOfBlock, "SizeOfBlock", 4, 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 418 }; 419 } 420 421 namespace N_IMAGE_DEBUG 422 { 423 const FW_DEF::HEADER_RECORD records[]= 424 { 425 {Characteristics, "Characteristics", offsetof(XPE_DEF::S_IMAGE_DEBUG_DIRECTORY,Characteristics), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 426 {TimeDateStamp, "TimeDateStamp", offsetof(XPE_DEF::S_IMAGE_DEBUG_DIRECTORY,TimeDateStamp), 4, "DWORD", FW_DEF::VAL_TYPE_UNIXTIME}, 427 {MajorVersion, "MajorVersion", offsetof(XPE_DEF::S_IMAGE_DEBUG_DIRECTORY,MajorVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 428 {MinorVersion, "MinorVersion", offsetof(XPE_DEF::S_IMAGE_DEBUG_DIRECTORY,MinorVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 429 {Type, "Type", offsetof(XPE_DEF::S_IMAGE_DEBUG_DIRECTORY,Type), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 430 {SizeOfData, "SizeOfData", offsetof(XPE_DEF::S_IMAGE_DEBUG_DIRECTORY,SizeOfData), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 431 {AddressOfRawData, "AddressOfRawData", offsetof(XPE_DEF::S_IMAGE_DEBUG_DIRECTORY,AddressOfRawData), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 432 {PointerToRawData, "PointerToRawData", offsetof(XPE_DEF::S_IMAGE_DEBUG_DIRECTORY,PointerToRawData), 4, "DWORD", FW_DEF::VAL_TYPE_OFFSET}, 433 }; 434 } 435 436 namespace N_IMAGE_DELAYIMPORT 437 { 438 const FW_DEF::HEADER_RECORD records[]= 439 { 440 {AllAttributes, "AllAttributes", offsetof(XPE_DEF::S_IMAGE_DELAYLOAD_DESCRIPTOR,AllAttributes), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 441 {DllNameRVA, "DllNameRVA", offsetof(XPE_DEF::S_IMAGE_DELAYLOAD_DESCRIPTOR,DllNameRVA), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 442 {ModuleHandleRVA, "ModuleHandleRVA", offsetof(XPE_DEF::S_IMAGE_DELAYLOAD_DESCRIPTOR,ModuleHandleRVA), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 443 {ImportAddressTableRVA, "ImportAddressTableRVA", offsetof(XPE_DEF::S_IMAGE_DELAYLOAD_DESCRIPTOR,ImportAddressTableRVA), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 444 {ImportNameTableRVA, "ImportNameTableRVA", offsetof(XPE_DEF::S_IMAGE_DELAYLOAD_DESCRIPTOR,ImportNameTableRVA), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 445 {BoundImportAddressTableRVA,"BoundImportAddressTableRVA", offsetof(XPE_DEF::S_IMAGE_DELAYLOAD_DESCRIPTOR,BoundImportAddressTableRVA), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 446 {UnloadInformationTableRVA, "UnloadInformationTableRVA", offsetof(XPE_DEF::S_IMAGE_DELAYLOAD_DESCRIPTOR,UnloadInformationTableRVA), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 447 {TimeDateStamp, "TimeDateStamp", offsetof(XPE_DEF::S_IMAGE_DELAYLOAD_DESCRIPTOR,TimeDateStamp), 4, "DWORD", FW_DEF::VAL_TYPE_UNIXTIME}, 448 }; 449 } 450 451 namespace N_IMAGE_EXCEPTIONS 452 { 453 const FW_DEF::HEADER_RECORD records[]= 454 { 455 {BeginAddress, "BeginAddress", offsetof(XPE_DEF::S_IMAGE_RUNTIME_FUNCTION_ENTRY,BeginAddress), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 456 {EndAddress, "EndAddress", offsetof(XPE_DEF::S_IMAGE_RUNTIME_FUNCTION_ENTRY,EndAddress), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 457 {UnwindInfoAddress, "UnwindInfoAddress", offsetof(XPE_DEF::S_IMAGE_RUNTIME_FUNCTION_ENTRY,UnwindInfoAddress), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 458 }; 459 } 460 461 namespace N_IMAGE_NETHEADER 462 { 463 const FW_DEF::HEADER_RECORD records[]= 464 { 465 {cb, "cb", offsetof(XPE_DEF::IMAGE_COR20_HEADER,cb), 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 466 {MajorRuntimeVersion, "MajorRuntimeVersion", offsetof(XPE_DEF::IMAGE_COR20_HEADER,MajorRuntimeVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 467 {MinorRuntimeVersion, "MinorRuntimeVersion", offsetof(XPE_DEF::IMAGE_COR20_HEADER,MinorRuntimeVersion), 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 468 {MetaData_Address, "MetaData_Address", offsetof(XPE_DEF::IMAGE_COR20_HEADER,MetaData.VirtualAddress), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 469 {MetaData_Size, "MetaData_Size", offsetof(XPE_DEF::IMAGE_COR20_HEADER,MetaData.Size), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 470 {Flags, "Flags", offsetof(XPE_DEF::IMAGE_COR20_HEADER,Flags), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 471 {EntryPoint, "EntryPoint", offsetof(XPE_DEF::IMAGE_COR20_HEADER,EntryPointRVA), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 472 {Resources_Address, "Resources_Address", offsetof(XPE_DEF::IMAGE_COR20_HEADER,Resources.VirtualAddress), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 473 {Resources_Size, "Resources_Size", offsetof(XPE_DEF::IMAGE_COR20_HEADER,Resources.Size), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 474 {StrongNameSignature_Address, "StrongNameSignature_Address", offsetof(XPE_DEF::IMAGE_COR20_HEADER,StrongNameSignature.VirtualAddress), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 475 {StrongNameSignature_Size, "StrongNameSignature_Size", offsetof(XPE_DEF::IMAGE_COR20_HEADER,StrongNameSignature.Size), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 476 {CodeManagerTable_Address, "CodeManagerTable_Address", offsetof(XPE_DEF::IMAGE_COR20_HEADER,CodeManagerTable.VirtualAddress), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 477 {CodeManagerTable_Size, "CodeManagerTable_Size", offsetof(XPE_DEF::IMAGE_COR20_HEADER,CodeManagerTable.Size), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 478 {VTableFixups_Address, "VTableFixups_Address", offsetof(XPE_DEF::IMAGE_COR20_HEADER,VTableFixups.VirtualAddress), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 479 {VTableFixups_Size, "VTableFixups_Size", offsetof(XPE_DEF::IMAGE_COR20_HEADER,VTableFixups.Size), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 480 {ExportAddressTableJumps_Address, "ExportAddressTableJumps_Address", offsetof(XPE_DEF::IMAGE_COR20_HEADER,ExportAddressTableJumps.VirtualAddress), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 481 {ExportAddressTableJumps_Size, "ExportAddressTableJumps_Size", offsetof(XPE_DEF::IMAGE_COR20_HEADER,ExportAddressTableJumps.Size), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 482 {ManagedNativeHeader_Address, "ManagedNativeHeader_Address", offsetof(XPE_DEF::IMAGE_COR20_HEADER,ManagedNativeHeader.VirtualAddress), 4, "DWORD", FW_DEF::VAL_TYPE_RELADDRESS}, 483 {ManagedNativeHeader_Size, "ManagedNativeHeader_Size", offsetof(XPE_DEF::IMAGE_COR20_HEADER,ManagedNativeHeader.Size), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 484 }; 485 } 486 487 namespace N_IMAGE_NET_METADATA 488 { 489 const FW_DEF::HEADER_RECORD records[]= 490 { 491 {Signature, "Signature", 0, 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 492 {MajorVersion, "MajorVersion", 4, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 493 {MinorVersion, "MinorVersion", 6, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 494 {Reserved, "Reserved", 8, 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 495 {VersionStringLength, "VersionStringLength", 12, 4, "DWORD", FW_DEF::VAL_TYPE_SIZE}, 496 {Version, "Version", 16, 1, "TEXT", FW_DEF::VAL_TYPE_TEXT}, 497 {Flags, "Flags", -1, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 498 {Streams, "Streams", -1, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 499 }; 500 } 501 502 namespace N_IMAGE_RESOURCE_FIXEDFILEINFO 503 { 504 const FW_DEF::HEADER_RECORD records[]= 505 { 506 {dwSignature, "dwSignature", offsetof(XPE_DEF::tagVS_FIXEDFILEINFO,dwSignature), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 507 {dwStrucVersion, "dwStrucVersion", offsetof(XPE_DEF::tagVS_FIXEDFILEINFO,dwStrucVersion), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 508 {dwFileVersionMS, "dwFileVersionMS", offsetof(XPE_DEF::tagVS_FIXEDFILEINFO,dwFileVersionMS), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 509 {dwFileVersionLS, "dwFileVersionLS", offsetof(XPE_DEF::tagVS_FIXEDFILEINFO,dwFileVersionLS), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 510 {dwProductVersionMS, "dwProductVersionMS", offsetof(XPE_DEF::tagVS_FIXEDFILEINFO,dwProductVersionMS), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 511 {dwProductVersionLS, "dwProductVersionLS", offsetof(XPE_DEF::tagVS_FIXEDFILEINFO,dwProductVersionLS), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 512 {dwFileFlagsMask, "dwFileFlagsMask", offsetof(XPE_DEF::tagVS_FIXEDFILEINFO,dwFileFlagsMask), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 513 {dwFileFlags, "dwFileFlags", offsetof(XPE_DEF::tagVS_FIXEDFILEINFO,dwFileFlags), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 514 {dwFileOS, "dwFileOS", offsetof(XPE_DEF::tagVS_FIXEDFILEINFO,dwFileOS), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 515 {dwFileType, "dwFileType", offsetof(XPE_DEF::tagVS_FIXEDFILEINFO,dwFileType), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 516 {dwFileSubtype, "dwFileSubtype", offsetof(XPE_DEF::tagVS_FIXEDFILEINFO,dwFileSubtype), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 517 {dwFileDateMS, "dwFileDateMS", offsetof(XPE_DEF::tagVS_FIXEDFILEINFO,dwFileDateMS), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 518 {dwFileDateLS, "dwFileDateLS", offsetof(XPE_DEF::tagVS_FIXEDFILEINFO,dwFileDateLS), 4, "DWORD", FW_DEF::VAL_TYPE_DATA}, 519 }; 520 } 521 522 namespace N_IMAGE_RELOCS_POSITION 523 { 524 const FW_DEF::HEADER_RECORD records[]= 525 { 526 {TypeOffset, "TypeOffset", 0, 2, "WORD", FW_DEF::VAL_TYPE_DATA}, 527 }; 528 } 529