7 #define IMAGE_DOS_SIGNATURE 0x5A4D
8 #define IMAGE_OS2_SIGNATURE 0x454E
9 #define IMAGE_OS2_SIGNATURE_LE 0x454C
10 #define IMAGE_VXD_SIGNATURE 0x454C
11 #define IMAGE_NT_SIGNATURE 0x00004550
14 // Image architectures
16 #define IMAGE_FILE_MACHINE_AM33 0x1d3
17 #define IMAGE_FILE_MACHINE_AMD64 0x8664
18 #define IMAGE_FILE_MACHINE_ARM 0x1c0
19 #define IMAGE_FILE_MACHINE_ARMV7 0x1c4
20 #define IMAGE_FILE_MACHINE_EBC 0xebc
21 #define IMAGE_FILE_MACHINE_I386 0x14c
22 #define IMAGE_FILE_MACHINE_IA64 0x200
23 #define IMAGE_FILE_MACHINE_M32R 0x9041
24 #define IMAGE_FILE_MACHINE_MIPS16 0x266
25 #define IMAGE_FILE_MACHINE_MIPSFPU 0x366
26 #define IMAGE_FILE_MACHINE_MIPSFPU16 0x466
27 #define IMAGE_FILE_MACHINE_POWERPC 0x1f0
28 #define IMAGE_FILE_MACHINE_POWERPCFP 0x1f1
29 #define IMAGE_FILE_MACHINE_R4000 0x166
30 #define IMAGE_FILE_MACHINE_SH3 0x1a2
31 #define IMAGE_FILE_MACHINE_SH3E 0x01a4
32 #define IMAGE_FILE_MACHINE_SH3DSP 0x1a3
33 #define IMAGE_FILE_MACHINE_SH4 0x1a6
34 #define IMAGE_FILE_MACHINE_SH5 0x1a8
35 #define IMAGE_FILE_MACHINE_THUMB 0x1c2
36 #define IMAGE_FILE_MACHINE_WCEMIPSV2 0x169
37 #define IMAGE_FILE_MACHINE_R3000 0x162
38 #define IMAGE_FILE_MACHINE_R10000 0x168
39 #define IMAGE_FILE_MACHINE_ALPHA 0x184
40 #define IMAGE_FILE_MACHINE_ALPHA64 0x0284
41 #define IMAGE_FILE_MACHINE_AXP64 IMAGE_FILE_MACHINE_ALPHA64
42 #define IMAGE_FILE_MACHINE_CEE 0xC0EE
43 #define IMAGE_FILE_MACHINE_TRICORE 0x0520
44 #define IMAGE_FILE_MACHINE_CEF 0x0CEF
48 // DOS Image Header Format
51 typedef struct _IMAGE_DOS_HEADER
{
71 } IMAGE_DOS_HEADER
, *PIMAGE_DOS_HEADER
;
75 // Export/Import Format
78 typedef struct _IMAGE_EXPORT_DIRECTORY
{
79 ULONG Characteristics
;
85 ULONG NumberOfFunctions
;
87 ULONG AddressOfFunctions
;
89 ULONG AddressOfNameOrdinals
;
90 } IMAGE_EXPORT_DIRECTORY
, *PIMAGE_EXPORT_DIRECTORY
;
93 // Resource Data Entry Format
95 typedef struct _IMAGE_RESOURCE_DATA_ENTRY
{
100 } IMAGE_RESOURCE_DATA_ENTRY
, *PIMAGE_RESOURCE_DATA_ENTRY
;
103 // Load Configuration Directory Entry Format
110 ULONG GlobalFlagsClear
;
111 ULONG GlobalFlagsSet
;
112 ULONG CriticalSectionDefaultTimeout
;
113 ULONG DeCommitFreeBlockThreshold
;
114 ULONG DeCommitTotalFreeThreshold
;
115 ULONG LockPrefixTable
;
116 ULONG MaximumAllocationSize
;
117 ULONG VirtualMemoryThreshold
;
118 ULONG ProcessHeapFlags
;
119 ULONG ProcessAffinityMask
;
123 ULONG SecurityCookie
;
124 ULONG SEHandlerTable
;
125 ULONG SEHandlerCount
;
126 } IMAGE_LOAD_CONFIG_DIRECTORY32
, *PIMAGE_LOAD_CONFIG_DIRECTORY32
;
133 ULONG GlobalFlagsClear
;
134 ULONG GlobalFlagsSet
;
135 ULONG CriticalSectionDefaultTimeout
;
136 ULONGLONG DeCommitFreeBlockThreshold
;
137 ULONGLONG DeCommitTotalFreeThreshold
;
138 ULONGLONG LockPrefixTable
;
139 ULONGLONG MaximumAllocationSize
;
140 ULONGLONG VirtualMemoryThreshold
;
141 ULONGLONG ProcessAffinityMask
;
142 ULONG ProcessHeapFlags
;
146 ULONGLONG SecurityCookie
;
147 ULONGLONG SEHandlerTable
;
148 ULONGLONG SEHandlerCount
;
149 } IMAGE_LOAD_CONFIG_DIRECTORY64
, *PIMAGE_LOAD_CONFIG_DIRECTORY64
;
152 typedef IMAGE_LOAD_CONFIG_DIRECTORY64 IMAGE_LOAD_CONFIG_DIRECTORY
;
153 typedef PIMAGE_LOAD_CONFIG_DIRECTORY64 PIMAGE_LOAD_CONFIG_DIRECTORY
;
155 typedef IMAGE_LOAD_CONFIG_DIRECTORY32 IMAGE_LOAD_CONFIG_DIRECTORY
;
156 typedef PIMAGE_LOAD_CONFIG_DIRECTORY32 PIMAGE_LOAD_CONFIG_DIRECTORY
;
160 // Base Relocation Format
162 typedef struct _IMAGE_BASE_RELOCATION
{
163 ULONG VirtualAddress
;
165 } IMAGE_BASE_RELOCATION
, *PIMAGE_BASE_RELOCATION
;
170 typedef struct _IMAGE_RESOURCE_DIRECTORY
{
171 ULONG Characteristics
;
175 USHORT NumberOfNamedEntries
;
176 USHORT NumberOfIdEntries
;
177 } IMAGE_RESOURCE_DIRECTORY
, *PIMAGE_RESOURCE_DIRECTORY
;
179 typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING
{
181 CHAR NameString
[ANYSIZE_ARRAY
];
182 } IMAGE_RESOURCE_DIRECTORY_STRING
, *PIMAGE_RESOURCE_DIRECTORY_STRING
;
185 // Section Header Format
187 #define IMAGE_SIZEOF_SHORT_NAME 8
188 #define IMAGE_SIZEOF_SECTION_HEADER 40
190 typedef struct _IMAGE_SECTION_HEADER
{
191 UCHAR Name
[IMAGE_SIZEOF_SHORT_NAME
];
193 ULONG PhysicalAddress
;
196 ULONG VirtualAddress
;
198 ULONG PointerToRawData
;
199 ULONG PointerToRelocations
;
200 ULONG PointerToLinenumbers
;
201 USHORT NumberOfRelocations
;
202 USHORT NumberOfLinenumbers
;
203 ULONG Characteristics
;
204 } IMAGE_SECTION_HEADER
, *PIMAGE_SECTION_HEADER
;
207 // Section Characteristics
209 #define IMAGE_SCN_CNT_CODE 0x00000020
210 #define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040
211 #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080
213 #define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000
214 #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
215 #define IMAGE_SCN_MEM_NOT_CACHED 0x04000000
216 #define IMAGE_SCN_MEM_NOT_PAGED 0x08000000
217 #define IMAGE_SCN_MEM_SHARED 0x10000000
218 #define IMAGE_SCN_MEM_EXECUTE 0x20000000
219 #define IMAGE_SCN_MEM_READ 0x40000000
220 #define IMAGE_SCN_MEM_WRITE 0x80000000
223 // File Header Format
225 #define IMAGE_SIZEOF_FILE_HEADER 20
227 typedef struct _IMAGE_FILE_HEADER
{
229 USHORT NumberOfSections
;
231 ULONG PointerToSymbolTable
;
232 ULONG NumberOfSymbols
;
233 USHORT SizeOfOptionalHeader
;
234 USHORT Characteristics
;
235 } IMAGE_FILE_HEADER
, *PIMAGE_FILE_HEADER
;
238 // File Characteristics
240 #define IMAGE_FILE_RELOCS_STRIPPED 0x0001
241 #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002
242 #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004
243 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008
244 #define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010
245 #define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020
246 #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080
247 #define IMAGE_FILE_32BIT_MACHINE 0x0100
248 #define IMAGE_FILE_DEBUG_STRIPPED 0x0200
249 #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400
250 #define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800
251 #define IMAGE_FILE_SYSTEM 0x1000
252 #define IMAGE_FILE_DLL 0x2000
253 #define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000
254 #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000
259 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
261 typedef struct _IMAGE_DATA_DIRECTORY
{
262 ULONG VirtualAddress
;
264 } IMAGE_DATA_DIRECTORY
, *PIMAGE_DATA_DIRECTORY
;
267 // Optional Header Formats
269 typedef struct _IMAGE_OPTIONAL_HEADER
{
271 UCHAR MajorLinkerVersion
;
272 UCHAR MinorLinkerVersion
;
274 ULONG SizeOfInitializedData
;
275 ULONG SizeOfUninitializedData
;
276 ULONG AddressOfEntryPoint
;
280 ULONG SectionAlignment
;
282 USHORT MajorOperatingSystemVersion
;
283 USHORT MinorOperatingSystemVersion
;
284 USHORT MajorImageVersion
;
285 USHORT MinorImageVersion
;
286 USHORT MajorSubsystemVersion
;
287 USHORT MinorSubsystemVersion
;
288 ULONG Win32VersionValue
;
293 USHORT DllCharacteristics
;
294 ULONG SizeOfStackReserve
;
295 ULONG SizeOfStackCommit
;
296 ULONG SizeOfHeapReserve
;
297 ULONG SizeOfHeapCommit
;
299 ULONG NumberOfRvaAndSizes
;
300 IMAGE_DATA_DIRECTORY DataDirectory
[IMAGE_NUMBEROF_DIRECTORY_ENTRIES
];
301 } IMAGE_OPTIONAL_HEADER32
, *PIMAGE_OPTIONAL_HEADER32
;
303 typedef struct _IMAGE_ROM_OPTIONAL_HEADER
{
305 UCHAR MajorLinkerVersion
;
306 UCHAR MinorLinkerVersion
;
308 ULONG SizeOfInitializedData
;
309 ULONG SizeOfUninitializedData
;
310 ULONG AddressOfEntryPoint
;
317 } IMAGE_ROM_OPTIONAL_HEADER
, *PIMAGE_ROM_OPTIONAL_HEADER
;
319 typedef struct _IMAGE_OPTIONAL_HEADER64
{
321 UCHAR MajorLinkerVersion
;
322 UCHAR MinorLinkerVersion
;
324 ULONG SizeOfInitializedData
;
325 ULONG SizeOfUninitializedData
;
326 ULONG AddressOfEntryPoint
;
329 ULONG SectionAlignment
;
331 USHORT MajorOperatingSystemVersion
;
332 USHORT MinorOperatingSystemVersion
;
333 USHORT MajorImageVersion
;
334 USHORT MinorImageVersion
;
335 USHORT MajorSubsystemVersion
;
336 USHORT MinorSubsystemVersion
;
337 ULONG Win32VersionValue
;
342 USHORT DllCharacteristics
;
343 ULONGLONG SizeOfStackReserve
;
344 ULONGLONG SizeOfStackCommit
;
345 ULONGLONG SizeOfHeapReserve
;
346 ULONGLONG SizeOfHeapCommit
;
348 ULONG NumberOfRvaAndSizes
;
349 IMAGE_DATA_DIRECTORY DataDirectory
[IMAGE_NUMBEROF_DIRECTORY_ENTRIES
];
350 } IMAGE_OPTIONAL_HEADER64
, *PIMAGE_OPTIONAL_HEADER64
;
353 // Format Identifier Magics
355 #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b
356 #define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b
357 #define IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107
360 typedef IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER
;
361 typedef PIMAGE_OPTIONAL_HEADER64 PIMAGE_OPTIONAL_HEADER
;
362 #define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR64_MAGIC
364 typedef IMAGE_OPTIONAL_HEADER32 IMAGE_OPTIONAL_HEADER
;
365 typedef PIMAGE_OPTIONAL_HEADER32 PIMAGE_OPTIONAL_HEADER
;
366 #define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR32_MAGIC
372 typedef struct _IMAGE_NT_HEADERS64
{
374 IMAGE_FILE_HEADER FileHeader
;
375 IMAGE_OPTIONAL_HEADER64 OptionalHeader
;
376 } IMAGE_NT_HEADERS64
;
378 typedef struct _IMAGE_NT_HEADERS
{
380 IMAGE_FILE_HEADER FileHeader
;
381 IMAGE_OPTIONAL_HEADER32 OptionalHeader
;
382 } IMAGE_NT_HEADERS32
;
385 typedef IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS
;
387 typedef IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS
;
392 typedef struct _IMAGE_NT_HEADERS
*PIMAGE_NT_HEADERS32
;
393 typedef struct _IMAGE_NT_HEADERS64
*PIMAGE_NT_HEADERS64
;
396 typedef PIMAGE_NT_HEADERS64 PIMAGE_NT_HEADERS
;
398 typedef PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS
;
404 // Retreives the first image section header from the Nt Header
406 #define IMAGE_FIRST_SECTION( NtHeader ) \
407 ((PIMAGE_SECTION_HEADER) ((ULONG_PTR)(NtHeader) + \
408 FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) + \
409 ((NtHeader))->FileHeader.SizeOfOptionalHeader))
412 // Dll Characteristics
414 #define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040
415 #define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY 0x0080
416 #define IMAGE_DLLCHARACTERISTICS_NX_COMPAT 0x0100
417 #define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200
418 #define IMAGE_DLLCHARACTERISTICS_NO_SEH 0x0400
419 #define IMAGE_DLLCHARACTERISTICS_NO_BIND 0x0800
420 #define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER 0x2000
421 #define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000
426 #define IMAGE_LOADER_FLAGS_COMPLUS 0x00000001
427 #define IMAGE_LOADER_FLAGS_SYSTEM_GLOBAL 0x01000000
430 // Directory Entry Specifiers
432 #define IMAGE_DIRECTORY_ENTRY_EXPORT 0
433 #define IMAGE_DIRECTORY_ENTRY_IMPORT 1
434 #define IMAGE_DIRECTORY_ENTRY_RESOURCE 2
435 #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3
436 #define IMAGE_DIRECTORY_ENTRY_SECURITY 4
437 #define IMAGE_DIRECTORY_ENTRY_BASERELOC 5
438 #define IMAGE_DIRECTORY_ENTRY_DEBUG 6
439 #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7
440 #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8
441 #define IMAGE_DIRECTORY_ENTRY_TLS 9
442 #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10
443 #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11
444 #define IMAGE_DIRECTORY_ENTRY_IAT 12
445 #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13
446 #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14
451 typedef struct _IMAGE_IMPORT_BY_NAME
{
454 } IMAGE_IMPORT_BY_NAME
, *PIMAGE_IMPORT_BY_NAME
;
456 #include <pshpack8.h>
457 typedef struct _IMAGE_THUNK_DATA64
{
459 ULONGLONG ForwarderString
;
462 ULONGLONG AddressOfData
;
464 } IMAGE_THUNK_DATA64
, *PIMAGE_THUNK_DATA64
;
467 typedef struct _IMAGE_THUNK_DATA32
{
469 ULONG ForwarderString
;
474 } IMAGE_THUNK_DATA32
, *PIMAGE_THUNK_DATA32
;
476 #define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL
477 #define IMAGE_ORDINAL_FLAG32 0x80000000
478 #define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)
479 #define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)
480 #define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
481 #define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
484 // Thread Local Storage (TLS)
488 (NTAPI
*PIMAGE_TLS_CALLBACK
) (
493 typedef struct _IMAGE_TLS_DIRECTORY64
{
494 ULONGLONG StartAddressOfRawData
;
495 ULONGLONG EndAddressOfRawData
;
496 ULONGLONG AddressOfIndex
;
497 ULONGLONG AddressOfCallBacks
;
498 ULONG SizeOfZeroFill
;
499 ULONG Characteristics
;
500 } IMAGE_TLS_DIRECTORY64
, *PIMAGE_TLS_DIRECTORY64
;
502 typedef struct _IMAGE_TLS_DIRECTORY32
{
503 ULONG StartAddressOfRawData
;
504 ULONG EndAddressOfRawData
;
505 ULONG AddressOfIndex
;
506 ULONG AddressOfCallBacks
;
507 ULONG SizeOfZeroFill
;
508 ULONG Characteristics
;
509 } IMAGE_TLS_DIRECTORY32
, *PIMAGE_TLS_DIRECTORY32
;
512 #define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG64
513 #define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL64(Ordinal)
514 typedef IMAGE_THUNK_DATA64 IMAGE_THUNK_DATA
;
515 typedef PIMAGE_THUNK_DATA64 PIMAGE_THUNK_DATA
;
516 #define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL64(Ordinal)
517 typedef IMAGE_TLS_DIRECTORY64 IMAGE_TLS_DIRECTORY
;
518 typedef PIMAGE_TLS_DIRECTORY64 PIMAGE_TLS_DIRECTORY
;
520 #define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG32
521 #define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL32(Ordinal)
522 typedef IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA
;
523 typedef PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA
;
524 #define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL32(Ordinal)
525 typedef IMAGE_TLS_DIRECTORY32 IMAGE_TLS_DIRECTORY
;
526 typedef PIMAGE_TLS_DIRECTORY32 PIMAGE_TLS_DIRECTORY
;
529 typedef struct _IMAGE_IMPORT_DESCRIPTOR
{
530 _ANONYMOUS_UNION
union {
531 ULONG Characteristics
;
532 ULONG OriginalFirstThunk
;
535 ULONG ForwarderChain
;
538 } IMAGE_IMPORT_DESCRIPTOR
, *PIMAGE_IMPORT_DESCRIPTOR
;
542 #endif /* _NTIMAGE_ */