1 #pragma once 2 3 #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x010b 4 #define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x020b 5 6 #define IMAGE_DOS_MAGIC 0x5a4d 7 #define IMAGE_PE_MAGIC 0x00004550 8 #define IMAGE_SIZEOF_SHORT_NAME 8 9 10 #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 11 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 12 #define IMAGE_FILE_DEBUG_STRIPPED 0x0200 13 14 #define IMAGE_FILE_MACHINE_I386 0x14c 15 #define IMAGE_FILE_MACHINE_AMD64 0x8664 16 #define IMAGE_FILE_MACHINE_IA64 0x0200 17 18 #define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 19 20 #define IMAGE_SCN_TYPE_NOLOAD 0x00000002 21 #define IMAGE_SCN_TYPE_NO_PAD 0x00000008 22 #define IMAGE_SCN_CNT_CODE 0x00000020 23 #define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040 24 #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 25 #define IMAGE_SCN_LNK_OTHER 0x00000100 26 #define IMAGE_SCN_LNK_INFO 0x00000200 27 #define IMAGE_SCN_LNK_REMOVE 0x00000800 28 #define IMAGE_SCN_NO_DEFER_SPEC_EXC 0x00004000 29 #define IMAGE_SCN_GPREL 0x00008000 30 #define IMAGE_SCN_MEM_PURGEABLE 0x00020000 31 #define IMAGE_SCN_MEM_LOCKED 0x00040000 32 #define IMAGE_SCN_MEM_PRELOAD 0x00080000 33 #define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000 34 #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000 35 #define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 36 #define IMAGE_SCN_MEM_NOT_PAGED 0x08000000 37 #define IMAGE_SCN_MEM_SHARED 0x10000000 38 #define IMAGE_SCN_MEM_EXECUTE 0x20000000 39 #define IMAGE_SCN_MEM_READ 0x40000000 40 #define IMAGE_SCN_MEM_WRITE 0x80000000 41 42 #define IMAGE_SCN_ALIGN_1BYTES 0x00100000 43 #define IMAGE_SCN_ALIGN_2BYTES 0x00200000 44 #define IMAGE_SCN_ALIGN_4BYTES 0x00300000 45 #define IMAGE_SCN_ALIGN_8BYTES 0x00400000 46 #define IMAGE_SCN_ALIGN_16BYTES 0x00500000 47 #define IMAGE_SCN_ALIGN_32BYTES 0x00600000 48 #define IMAGE_SCN_ALIGN_64BYTES 0x00700000 49 #define IMAGE_SCN_ALIGN_128BYTES 0x00800000 50 #define IMAGE_SCN_ALIGN_256BYTES 0x00900000 51 #define IMAGE_SCN_ALIGN_512BYTES 0x00A00000 52 #define IMAGE_SCN_ALIGN_1024BYTES 0x00B00000 53 #define IMAGE_SCN_ALIGN_2048BYTES 0x00C00000 54 #define IMAGE_SCN_ALIGN_4096BYTES 0x00D00000 55 #define IMAGE_SCN_ALIGN_8192BYTES 0x00E00000 56 #define IMAGE_SCN_ALIGN_MASK 0x00F00000 57 58 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 59 60 #define IMAGE_REL_I386_ABSOLUTE 0x0001 61 #define IMAGE_REL_I386_REL16 0x0002 62 #define IMAGE_REL_I386_DIR32 0x0006 63 64 #pragma pack(push,2) 65 typedef struct _IMAGE_DOS_HEADER { 66 WORD e_magic; 67 WORD e_cblp; 68 WORD e_cp; 69 WORD e_crlc; 70 WORD e_cparhdr; 71 WORD e_minalloc; 72 WORD e_maxalloc; 73 WORD e_ss; 74 WORD e_sp; 75 WORD e_csum; 76 WORD e_ip; 77 WORD e_cs; 78 WORD e_lfarlc; 79 WORD e_ovno; 80 WORD e_res[4]; 81 WORD e_oemid; 82 WORD e_oeminfo; 83 WORD e_res2[10]; 84 LONG e_lfanew; 85 } IMAGE_DOS_HEADER,*PIMAGE_DOS_HEADER; 86 #pragma pack(pop) 87 88 #pragma pack(push,4) 89 typedef struct _IMAGE_FILE_HEADER { 90 WORD Machine; 91 WORD NumberOfSections; 92 DWORD TimeDateStamp; 93 DWORD PointerToSymbolTable; 94 DWORD NumberOfSymbols; 95 WORD SizeOfOptionalHeader; 96 WORD Characteristics; 97 } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; 98 #pragma pack(pop) 99 100 typedef struct _IMAGE_DATA_DIRECTORY { 101 DWORD VirtualAddress; 102 DWORD Size; 103 } IMAGE_DATA_DIRECTORY,*PIMAGE_DATA_DIRECTORY; 104 105 typedef struct _IMAGE_OPTIONAL_HEADER32 { 106 WORD Magic; 107 BYTE MajorLinkerVersion; 108 BYTE MinorLinkerVersion; 109 DWORD SizeOfCode; 110 DWORD SizeOfInitializedData; 111 DWORD SizeOfUninitializedData; 112 DWORD AddressOfEntryPoint; 113 DWORD BaseOfCode; 114 DWORD BaseOfData; 115 DWORD ImageBase; 116 DWORD SectionAlignment; 117 DWORD FileAlignment; 118 WORD MajorOperatingSystemVersion; 119 WORD MinorOperatingSystemVersion; 120 WORD MajorImageVersion; 121 WORD MinorImageVersion; 122 WORD MajorSubsystemVersion; 123 WORD MinorSubsystemVersion; 124 DWORD Win32VersionValue; 125 DWORD SizeOfImage; 126 DWORD SizeOfHeaders; 127 DWORD CheckSum; 128 WORD Subsystem; 129 WORD DllCharacteristics; 130 DWORD SizeOfStackReserve; 131 DWORD SizeOfStackCommit; 132 DWORD SizeOfHeapReserve; 133 DWORD SizeOfHeapCommit; 134 DWORD LoaderFlags; 135 DWORD NumberOfRvaAndSizes; 136 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; 137 } IMAGE_OPTIONAL_HEADER32,*PIMAGE_OPTIONAL_HEADER32; 138 139 typedef struct _IMAGE_OPTIONAL_HEADER64 { 140 WORD Magic; 141 BYTE MajorLinkerVersion; 142 BYTE MinorLinkerVersion; 143 DWORD SizeOfCode; 144 DWORD SizeOfInitializedData; 145 DWORD SizeOfUninitializedData; 146 DWORD AddressOfEntryPoint; 147 DWORD BaseOfCode; 148 ULONGLONG ImageBase; 149 DWORD SectionAlignment; 150 DWORD FileAlignment; 151 WORD MajorOperatingSystemVersion; 152 WORD MinorOperatingSystemVersion; 153 WORD MajorImageVersion; 154 WORD MinorImageVersion; 155 WORD MajorSubsystemVersion; 156 WORD MinorSubsystemVersion; 157 DWORD Win32VersionValue; 158 DWORD SizeOfImage; 159 DWORD SizeOfHeaders; 160 DWORD CheckSum; 161 WORD Subsystem; 162 WORD DllCharacteristics; 163 ULONGLONG SizeOfStackReserve; 164 ULONGLONG SizeOfStackCommit; 165 ULONGLONG SizeOfHeapReserve; 166 ULONGLONG SizeOfHeapCommit; 167 DWORD LoaderFlags; 168 DWORD NumberOfRvaAndSizes; 169 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; 170 } IMAGE_OPTIONAL_HEADER64,*PIMAGE_OPTIONAL_HEADER64; 171 172 #ifdef _TARGET_PE64 173 typedef IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER; 174 typedef PIMAGE_OPTIONAL_HEADER64 PIMAGE_OPTIONAL_HEADER; 175 #else 176 typedef IMAGE_OPTIONAL_HEADER32 IMAGE_OPTIONAL_HEADER; 177 typedef PIMAGE_OPTIONAL_HEADER32 PIMAGE_OPTIONAL_HEADER; 178 #endif 179 180 typedef struct _IMAGE_NT_HEADERS32 181 { 182 DWORD Signature; 183 IMAGE_FILE_HEADER FileHeader; 184 IMAGE_OPTIONAL_HEADER32 OptionalHeader; 185 } IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32; 186 187 typedef struct _IMAGE_NT_HEADERS64 188 { 189 DWORD Signature; 190 IMAGE_FILE_HEADER FileHeader; 191 IMAGE_OPTIONAL_HEADER64 OptionalHeader; 192 } IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64; 193 194 #ifdef _TARGET_PE64 195 typedef IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS; 196 typedef PIMAGE_NT_HEADERS64 PIMAGE_NT_HEADERS; 197 #else 198 typedef IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS; 199 typedef PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS; 200 #endif 201 202 typedef struct _IMAGE_SECTION_HEADER { 203 BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; 204 union { 205 DWORD PhysicalAddress; 206 DWORD VirtualSize; 207 } Misc; 208 DWORD VirtualAddress; 209 DWORD SizeOfRawData; 210 DWORD PointerToRawData; 211 DWORD PointerToRelocations; 212 DWORD PointerToLinenumbers; 213 WORD NumberOfRelocations; 214 WORD NumberOfLinenumbers; 215 DWORD Characteristics; 216 } IMAGE_SECTION_HEADER,*PIMAGE_SECTION_HEADER; 217 218 #pragma pack(push,4) 219 typedef struct _IMAGE_BASE_RELOCATION { 220 DWORD VirtualAddress; 221 DWORD SizeOfBlock; 222 // Followed by: WORD TypeOffset[ANYSIZE_ARRAY]; 223 } IMAGE_BASE_RELOCATION,*PIMAGE_BASE_RELOCATION; 224 #pragma pack(pop) 225 226 #ifndef UNALIGNED 227 #define UNALIGNED 228 #endif 229 230 #pragma pack(push,2) 231 typedef struct _IMAGE_RELOCATION { 232 union { 233 DWORD VirtualAddress; 234 DWORD RelocCount; 235 }; 236 DWORD SymbolTableIndex; 237 WORD Type; 238 } IMAGE_RELOCATION; 239 typedef struct _IMAGE_RELOCATION UNALIGNED *PIMAGE_RELOCATION; 240 #pragma pack(pop) 241 242 #pragma pack(push,2) 243 typedef struct _IMAGE_SYMBOL { 244 union { 245 BYTE ShortName[8]; 246 struct { 247 DWORD Short; 248 DWORD Long; 249 } Name; 250 DWORD LongName[2]; 251 } N; 252 DWORD Value; 253 SHORT SectionNumber; 254 WORD Type; 255 BYTE StorageClass; 256 BYTE NumberOfAuxSymbols; 257 } IMAGE_SYMBOL; 258 typedef struct _IMAGE_SYMBOL UNALIGNED *PIMAGE_SYMBOL; 259 #pragma pack(pop) 260 261 #define IMAGE_DOS_SIGNATURE 0x5A4D 262 #define IMAGE_OS2_SIGNATURE 0x454E 263 #define IMAGE_OS2_SIGNATURE_LE 0x454C 264 #define IMAGE_VXD_SIGNATURE 0x454C 265 #define IMAGE_NT_SIGNATURE 0x00004550 266 267 #define IMAGE_FIRST_SECTION(h) ((PIMAGE_SECTION_HEADER) ((ULONG_PTR)h+FIELD_OFFSET(IMAGE_NT_HEADERS,OptionalHeader)+((PIMAGE_NT_HEADERS)(h))->FileHeader.SizeOfOptionalHeader)) 268