4 #define _ANONYMOUS_UNION __extension__
5 #define _ANONYMOUS_STRUCT __extension__
11 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
12 #define IMAGE_SIZEOF_SHORT_NAME 8
13 #define IMAGE_SIZEOF_SYMBOL 18
17 #define IMAGE_DOS_SIGNATURE 0x5a4d
18 #define IMAGE_OS2_SIGNATURE 0x454e
19 #define IMAGE_OS2_SIGNATURE_LE 0x454c
20 #define IMAGE_VXD_SIGNATURE 0x454c
22 #define IMAGE_FILE_RELOCS_STRIPPED 0x0001 // Relocation info stripped from file.
23 #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 // File is executable (i.e. no unresolved externel references).
24 #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 // Line nunbers stripped from file.
25 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 // Local symbols stripped from file.
26 #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 // Bytes of machine word are reversed.
27 #define IMAGE_FILE_32BIT_MACHINE 0x0100 // 32 bit word machine.
28 #define IMAGE_FILE_DEBUG_STRIPPED 0x0200 // Debugging info stripped from file in .DBG file
29 #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 // If Image is on removable media, copy and run from the swap file.
30 #define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 // If Image is on Net, copy and run from the swap file.
31 #define IMAGE_FILE_SYSTEM 0x1000 // System File.
32 #define IMAGE_FILE_DLL 0x2000 // File is a DLL.
33 #define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 // File should only be run on a UP machine
34 #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 // Bytes of machine word are reversed.
36 #define IMAGE_FILE_MACHINE_UNKNOWN 0
37 #define IMAGE_FILE_MACHINE_I386 0x14c // Intel 386.
38 #define IMAGE_FILE_MACHINE_R3000 0x162 // MIPS little-endian, 0x160 big-endian
39 #define IMAGE_FILE_MACHINE_R4000 0x166 // MIPS little-endian
40 #define IMAGE_FILE_MACHINE_R10000 0x168 // MIPS little-endian
41 #define IMAGE_FILE_MACHINE_ALPHA 0x184 // Alpha_AXP
42 #define IMAGE_FILE_MACHINE_POWERPC 0x1F0 // IBM PowerPC Little-Endian
45 typedef struct _IMAGE_FILE_HEADER
{
47 WORD NumberOfSections
;
49 DWORD PointerToSymbolTable
;
50 DWORD NumberOfSymbols
;
51 WORD SizeOfOptionalHeader
;
53 } IMAGE_FILE_HEADER
, *PIMAGE_FILE_HEADER
;
54 typedef struct _IMAGE_DATA_DIRECTORY
{
57 } IMAGE_DATA_DIRECTORY
,*PIMAGE_DATA_DIRECTORY
;
58 typedef struct _IMAGE_OPTIONAL_HEADER
{
60 BYTE MajorLinkerVersion
;
61 BYTE MinorLinkerVersion
;
63 DWORD SizeOfInitializedData
;
64 DWORD SizeOfUninitializedData
;
65 DWORD AddressOfEntryPoint
;
69 DWORD SectionAlignment
;
71 WORD MajorOperatingSystemVersion
;
72 WORD MinorOperatingSystemVersion
;
73 WORD MajorImageVersion
;
74 WORD MinorImageVersion
;
75 WORD MajorSubsystemVersion
;
76 WORD MinorSubsystemVersion
;
82 WORD DllCharacteristics
;
83 DWORD SizeOfStackReserve
;
84 DWORD SizeOfStackCommit
;
85 DWORD SizeOfHeapReserve
;
86 DWORD SizeOfHeapCommit
;
88 DWORD NumberOfRvaAndSizes
;
89 IMAGE_DATA_DIRECTORY DataDirectory
[IMAGE_NUMBEROF_DIRECTORY_ENTRIES
];
90 } IMAGE_OPTIONAL_HEADER
,*PIMAGE_OPTIONAL_HEADER
;
91 typedef struct _IMAGE_ROM_OPTIONAL_HEADER
{
93 BYTE MajorLinkerVersion
;
94 BYTE MinorLinkerVersion
;
96 DWORD SizeOfInitializedData
;
97 DWORD SizeOfUninitializedData
;
98 DWORD AddressOfEntryPoint
;
105 } IMAGE_ROM_OPTIONAL_HEADER
,*PIMAGE_ROM_OPTIONAL_HEADER
;
108 typedef struct _IMAGE_DOS_HEADER
{
128 } IMAGE_DOS_HEADER
,*PIMAGE_DOS_HEADER
;
129 typedef struct _IMAGE_OS2_HEADER
{
157 WORD ne_psegrefbytes
;
160 } IMAGE_OS2_HEADER
,*PIMAGE_OS2_HEADER
;
163 typedef struct _IMAGE_NT_HEADERS
{
165 IMAGE_FILE_HEADER FileHeader
;
166 IMAGE_OPTIONAL_HEADER OptionalHeader
;
167 } IMAGE_NT_HEADERS
,*PIMAGE_NT_HEADERS
;
168 typedef struct _IMAGE_ROM_HEADERS
{
169 IMAGE_FILE_HEADER FileHeader
;
170 IMAGE_ROM_OPTIONAL_HEADER OptionalHeader
;
171 } IMAGE_ROM_HEADERS
,*PIMAGE_ROM_HEADERS
;
172 typedef struct _IMAGE_SECTION_HEADER
{
173 BYTE Name
[IMAGE_SIZEOF_SHORT_NAME
];
175 DWORD PhysicalAddress
;
178 DWORD VirtualAddress
;
180 DWORD PointerToRawData
;
181 DWORD PointerToRelocations
;
182 DWORD PointerToLinenumbers
;
183 WORD NumberOfRelocations
;
184 WORD NumberOfLinenumbers
;
185 DWORD Characteristics
;
186 } IMAGE_SECTION_HEADER
,*PIMAGE_SECTION_HEADER
;
189 typedef struct _IMAGE_SYMBOL
{
202 BYTE NumberOfAuxSymbols
;
203 } IMAGE_SYMBOL
,*PIMAGE_SYMBOL
;
204 typedef union _IMAGE_AUX_SYMBOL
{
216 DWORD PointerToLinenumber
;
217 DWORD PointerToNextFunction
;
226 BYTE Name
[IMAGE_SIZEOF_SYMBOL
];
230 WORD NumberOfRelocations
;
231 WORD NumberOfLinenumbers
;
236 } IMAGE_AUX_SYMBOL
,*PIMAGE_AUX_SYMBOL
;
237 typedef struct _IMAGE_COFF_SYMBOLS_HEADER
{
238 DWORD NumberOfSymbols
;
239 DWORD LvaToFirstSymbol
;
240 DWORD NumberOfLinenumbers
;
241 DWORD LvaToFirstLinenumber
;
242 DWORD RvaToFirstByteOfCode
;
243 DWORD RvaToLastByteOfCode
;
244 DWORD RvaToFirstByteOfData
;
245 DWORD RvaToLastByteOfData
;
246 } IMAGE_COFF_SYMBOLS_HEADER
,*PIMAGE_COFF_SYMBOLS_HEADER
;
247 typedef struct _IMAGE_RELOCATION
{
248 _ANONYMOUS_UNION
union {
249 DWORD VirtualAddress
;
252 DWORD SymbolTableIndex
;
254 } IMAGE_RELOCATION
,*PIMAGE_RELOCATION
;
257 typedef struct _IMAGE_BASE_RELOCATION
{
258 DWORD VirtualAddress
;
260 } IMAGE_BASE_RELOCATION
,*PIMAGE_BASE_RELOCATION
;
263 typedef struct _IMAGE_LINENUMBER
{
265 DWORD SymbolTableIndex
;
266 DWORD VirtualAddress
;
269 } IMAGE_LINENUMBER
,*PIMAGE_LINENUMBER
;
272 typedef struct _IMAGE_ARCHIVE_MEMBER_HEADER
{
280 } IMAGE_ARCHIVE_MEMBER_HEADER
,*PIMAGE_ARCHIVE_MEMBER_HEADER
;
281 typedef struct _IMAGE_EXPORT_DIRECTORY
{
282 DWORD Characteristics
;
288 DWORD NumberOfFunctions
;
290 PDWORD
*AddressOfFunctions
;
291 PDWORD
*AddressOfNames
;
292 PWORD
*AddressOfNameOrdinals
;
293 } IMAGE_EXPORT_DIRECTORY
,*PIMAGE_EXPORT_DIRECTORY
;
294 typedef struct _IMAGE_IMPORT_BY_NAME
{
297 } IMAGE_IMPORT_BY_NAME
,*PIMAGE_IMPORT_BY_NAME
;
298 typedef struct _IMAGE_THUNK_DATA
{
300 PBYTE ForwarderString
;
303 PIMAGE_IMPORT_BY_NAME AddressOfData
;
305 } IMAGE_THUNK_DATA
,*PIMAGE_THUNK_DATA
;
306 typedef struct _IMAGE_IMPORT_DESCRIPTOR
{
307 _ANONYMOUS_UNION
union {
308 DWORD Characteristics
;
309 PIMAGE_THUNK_DATA OriginalFirstThunk
;
312 DWORD ForwarderChain
;
314 PIMAGE_THUNK_DATA FirstThunk
;
315 } IMAGE_IMPORT_DESCRIPTOR
,*PIMAGE_IMPORT_DESCRIPTOR
;
316 typedef struct _IMAGE_BOUND_IMPORT_DESCRIPTOR
{
318 WORD OffsetModuleName
;
319 WORD NumberOfModuleForwarderRefs
;
320 } IMAGE_BOUND_IMPORT_DESCRIPTOR
,*PIMAGE_BOUND_IMPORT_DESCRIPTOR
;
321 typedef struct _IMAGE_BOUND_FORWARDER_REF
{
323 WORD OffsetModuleName
;
325 } IMAGE_BOUND_FORWARDER_REF
,*PIMAGE_BOUND_FORWARDER_REF
;
326 typedef void(NTAPI
*PIMAGE_TLS_CALLBACK
)(PVOID
,DWORD
,PVOID
);
327 typedef struct _IMAGE_TLS_DIRECTORY
{
328 DWORD StartAddressOfRawData
;
329 DWORD EndAddressOfRawData
;
330 PDWORD AddressOfIndex
;
331 PIMAGE_TLS_CALLBACK
*AddressOfCallBacks
;
332 DWORD SizeOfZeroFill
;
333 DWORD Characteristics
;
334 } IMAGE_TLS_DIRECTORY
,*PIMAGE_TLS_DIRECTORY
;
335 typedef struct _IMAGE_RESOURCE_DIRECTORY
{
336 DWORD Characteristics
;
340 WORD NumberOfNamedEntries
;
341 WORD NumberOfIdEntries
;
342 } IMAGE_RESOURCE_DIRECTORY
,*PIMAGE_RESOURCE_DIRECTORY
;
343 /*_ANONYMOUS_STRUCT typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY {
344 _ANONYMOUS_UNION union {
345 _ANONYMOUS_STRUCT struct {
347 DWORD NameIsString:1;
352 _ANONYMOUS_UNION union {
354 _ANONYMOUS_STRUCT struct {
355 DWORD OffsetToDirectory:31;
356 DWORD DataIsDirectory:1;
359 } IMAGE_RESOURCE_DIRECTORY_ENTRY,*PIMAGE_RESOURCE_DIRECTORY_ENTRY;
361 typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING
{
364 } IMAGE_RESOURCE_DIRECTORY_STRING
,*PIMAGE_RESOURCE_DIRECTORY_STRING
;
365 typedef struct _IMAGE_RESOURCE_DIR_STRING_U
{
368 } IMAGE_RESOURCE_DIR_STRING_U
,*PIMAGE_RESOURCE_DIR_STRING_U
;
369 typedef struct _IMAGE_RESOURCE_DATA_ENTRY
{
374 } IMAGE_RESOURCE_DATA_ENTRY
,*PIMAGE_RESOURCE_DATA_ENTRY
;
375 typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY
{
376 DWORD Characteristics
;
380 DWORD GlobalFlagsClear
;
381 DWORD GlobalFlagsSet
;
382 DWORD CriticalSectionDefaultTimeout
;
383 DWORD DeCommitFreeBlockThreshold
;
384 DWORD DeCommitTotalFreeThreshold
;
385 PVOID LockPrefixTable
;
386 DWORD MaximumAllocationSize
;
387 DWORD VirtualMemoryThreshold
;
388 DWORD ProcessHeapFlags
;
390 } IMAGE_LOAD_CONFIG_DIRECTORY
,*PIMAGE_LOAD_CONFIG_DIRECTORY
;
391 typedef struct _IMAGE_RUNTIME_FUNCTION_ENTRY
{
394 PVOID ExceptionHandler
;
396 DWORD PrologEndAddress
;
397 } IMAGE_RUNTIME_FUNCTION_ENTRY
,*PIMAGE_RUNTIME_FUNCTION_ENTRY
;
398 typedef struct _IMAGE_DEBUG_DIRECTORY
{
399 DWORD Characteristics
;
405 DWORD AddressOfRawData
;
406 DWORD PointerToRawData
;
407 } IMAGE_DEBUG_DIRECTORY
,*PIMAGE_DEBUG_DIRECTORY
;
408 typedef struct _FPO_DATA
{
419 } FPO_DATA
,*PFPO_DATA
;
420 typedef struct _IMAGE_DEBUG_MISC
{
426 } IMAGE_DEBUG_MISC
,*PIMAGE_DEBUG_MISC
;
427 typedef struct _IMAGE_FUNCTION_ENTRY
{
428 DWORD StartingAddress
;
431 } IMAGE_FUNCTION_ENTRY
,*PIMAGE_FUNCTION_ENTRY
;
432 typedef struct _IMAGE_SEPARATE_DEBUG_HEADER
{
436 WORD Characteristics
;
441 DWORD NumberOfSections
;
442 DWORD ExportedNamesSize
;
443 DWORD DebugDirectorySize
;
445 } IMAGE_SEPARATE_DEBUG_HEADER
,*PIMAGE_SEPARATE_DEBUG_HEADER
;
448 #define IMAGE_ORDINAL(Ordinal) (Ordinal & 0xffff)
451 // Each directory contains the 32-bit Name of the entry and an offset,
452 // relative to the beginning of the resource directory of the data associated
453 // with this directory entry. If the name of the entry is an actual text
454 // string instead of an integer Id, then the high order bit of the name field
455 // is set to one and the low order 31-bits are an offset, relative to the
456 // beginning of the resource directory of the string, which is of type
457 // IMAGE_RESOURCE_DIRECTORY_STRING. Otherwise the high bit is clear and the
458 // low-order 16-bits are the integer Id that identify this resource directory
459 // entry. If the directory entry is yet another resource directory (i.e. a
460 // subdirectory), then the high order bit of the offset field will be
461 // set to indicate this. Otherwise the high bit is clear and the offset
462 // field points to a resource data entry.
464 typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY
{
467 } IMAGE_RESOURCE_DIRECTORY_ENTRY
, *PIMAGE_RESOURCE_DIRECTORY_ENTRY
;
469 typedef struct _IMAGE_RESOURCE_DIRECTORY {
470 DWORD Characteristics;
474 WORD NumberOfNamedEntries;
475 WORD NumberOfIdEntries;
476 IMAGE_RESOURCE_DIRECTORY_ENTRY DirectoryEntries[0];
477 } IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;
480 #endif /* !__USE_W32API */
482 #define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S))
484 #define IMAGE_SECTION_CHAR_CODE 0x00000020
485 #define IMAGE_SECTION_CHAR_DATA 0x00000040
486 #define IMAGE_SECTION_CHAR_BSS 0x00000080
487 #define IMAGE_SECTION_CHAR_NON_CACHABLE 0x04000000
488 #define IMAGE_SECTION_CHAR_NON_PAGEABLE 0x08000000
489 #define IMAGE_SECTION_CHAR_SHARED 0x10000000
490 #define IMAGE_SECTION_CHAR_EXECUTABLE 0x20000000
491 #define IMAGE_SECTION_CHAR_READABLE 0x40000000
492 #define IMAGE_SECTION_CHAR_WRITABLE 0x80000000
493 #define IMAGE_SECTION_NOLOAD 0x00000002
495 #define IMAGE_DOS_MAGIC 0x5a4d
496 #define IMAGE_PE_MAGIC 0x00004550
498 #define IMAGE_NT_SIGNATURE 0x00004550
501 #define IMAGE_SIZEOF_FILE_HEADER 20
504 #define IMAGE_SUBSYSTEM_UNKNOWN 0
505 #define IMAGE_SUBSYSTEM_NATIVE 1
506 #define IMAGE_SUBSYSTEM_WINDOWS_GUI 2
507 #define IMAGE_SUBSYSTEM_WINDOWS_CUI 3
508 #define IMAGE_SUBSYSTEM_OS2_GUI 4
509 #define IMAGE_SUBSYSTEM_OS2_CUI 5
510 #define IMAGE_SUBSYSTEM_POSIX_GUI 6
511 #define IMAGE_SUBSYSTEM_POSIX_CUI 7
512 #define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI 9
518 #define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory
519 #define IMAGE_DIRECTORY_ENTRY_IMPORT 1 // Import Directory
520 #define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 // Resource Directory
521 #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 // Exception Directory
522 #define IMAGE_DIRECTORY_ENTRY_SECURITY 4 // Security Directory
523 #define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 // Base Relocation Table
524 #define IMAGE_DIRECTORY_ENTRY_DEBUG 6 // Debug Directory
525 #define IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // Description String
526 #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 // Machine Value (MIPS GP)
527 #define IMAGE_DIRECTORY_ENTRY_TLS 9 // TLS Directory
528 #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 // Load Configuration Directory
529 #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 // Bound Import Directory in headers
530 #define IMAGE_DIRECTORY_ENTRY_IAT 12 // Import Address
532 // Section header format.
534 #define IMAGE_SIZEOF_FILE_HEADER 20
535 #define IMAGE_FILE_MACHINE_UNKNOWN 0
536 #define IMAGE_NT_SIGNATURE 0x00004550
537 #define IMAGE_NT_OPTIONAL_HDR_MAGIC 0x10b
538 #define IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107
539 #define IMAGE_SEPARATE_DEBUG_SIGNATURE 0x4944
540 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
541 #define IMAGE_SIZEOF_ROM_OPTIONAL_HEADER 56
542 #define IMAGE_SIZEOF_STD_OPTIONAL_HEADER 28
543 #define IMAGE_SIZEOF_NT_OPTIONAL_HEADER 224
544 #define IMAGE_SIZEOF_SECTION_HEADER 40
545 #define IMAGE_SIZEOF_AUX_SYMBOL 18
546 #define IMAGE_SIZEOF_RELOCATION 10
547 #define IMAGE_SIZEOF_BASE_RELOCATION 8
548 #define IMAGE_SIZEOF_LINENUMBER 6
549 #define IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR 60
550 #define SIZEOF_RFPO_DATA 16
551 #define IMAGE_FIRST_SECTION(h) ((PIMAGE_SECTION_HEADER) ((DWORD)h+FIELD_OFFSET(IMAGE_NT_HEADERS,OptionalHeader)+((PIMAGE_NT_HEADERS)(h))->FileHeader.SizeOfOptionalHeader))
552 #define IMAGE_SCN_TYPE_NO_PAD 8
553 #define IMAGE_SCN_CNT_CODE 32
554 #define IMAGE_SCN_CNT_INITIALIZED_DATA 64
555 #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 128
556 #define IMAGE_SCN_LNK_OTHER 256
557 #define IMAGE_SCN_LNK_INFO 512
558 #define IMAGE_SCN_LNK_REMOVE 2048
559 #define IMAGE_SCN_LNK_COMDAT 4096
560 #define IMAGE_SCN_MEM_FARDATA 0x8000
561 #define IMAGE_SCN_MEM_PURGEABLE 0x20000
562 #define IMAGE_SCN_MEM_16BIT 0x20000
563 #define IMAGE_SCN_MEM_LOCKED 0x40000
564 #define IMAGE_SCN_MEM_PRELOAD 0x80000
565 #define IMAGE_SCN_ALIGN_1BYTES 0x100000
566 #define IMAGE_SCN_ALIGN_2BYTES 0x200000
567 #define IMAGE_SCN_ALIGN_4BYTES 0x300000
568 #define IMAGE_SCN_ALIGN_8BYTES 0x400000
569 #define IMAGE_SCN_ALIGN_16BYTES 0x500000
570 #define IMAGE_SCN_ALIGN_32BYTES 0x600000
571 #define IMAGE_SCN_ALIGN_64BYTES 0x700000
572 #define IMAGE_SCN_LNK_NRELOC_OVFL 0x1000000
573 #define IMAGE_SCN_MEM_DISCARDABLE 0x2000000
574 #define IMAGE_SCN_MEM_NOT_CACHED 0x4000000
575 #define IMAGE_SCN_MEM_NOT_PAGED 0x8000000
576 #define IMAGE_SCN_MEM_SHARED 0x10000000
577 #define IMAGE_SCN_MEM_EXECUTE 0x20000000
578 #define IMAGE_SCN_MEM_READ 0x40000000
579 #define IMAGE_SCN_MEM_WRITE 0x80000000
580 #define IMAGE_SYM_UNDEFINED 0
581 #define IMAGE_SYM_ABSOLUTE (-1)
582 #define IMAGE_SYM_DEBUG (-2)
583 #define IMAGE_SYM_TYPE_NULL 0
584 #define IMAGE_SYM_TYPE_VOID 1
585 #define IMAGE_SYM_TYPE_CHAR 2
586 #define IMAGE_SYM_TYPE_SHORT 3
587 #define IMAGE_SYM_TYPE_INT 4
588 #define IMAGE_SYM_TYPE_LONG 5
589 #define IMAGE_SYM_TYPE_FLOAT 6
590 #define IMAGE_SYM_TYPE_DOUBLE 7
591 #define IMAGE_SYM_TYPE_STRUCT 8
592 #define IMAGE_SYM_TYPE_UNION 9
593 #define IMAGE_SYM_TYPE_ENUM 10
594 #define IMAGE_SYM_TYPE_MOE 11
595 #define IMAGE_SYM_TYPE_BYTE 12
596 #define IMAGE_SYM_TYPE_WORD 13
597 #define IMAGE_SYM_TYPE_UINT 14
598 #define IMAGE_SYM_TYPE_DWORD 15
599 #define IMAGE_SYM_TYPE_PCODE 32768
600 #define IMAGE_SYM_DTYPE_NULL 0
601 #define IMAGE_SYM_DTYPE_POINTER 1
602 #define IMAGE_SYM_DTYPE_FUNCTION 2
603 #define IMAGE_SYM_DTYPE_ARRAY 3
604 #define IMAGE_SYM_CLASS_END_OF_FUNCTION (-1)
605 #define IMAGE_SYM_CLASS_NULL 0
606 #define IMAGE_SYM_CLASS_AUTOMATIC 1
607 #define IMAGE_SYM_CLASS_EXTERNAL 2
608 #define IMAGE_SYM_CLASS_STATIC 3
609 #define IMAGE_SYM_CLASS_REGISTER 4
610 #define IMAGE_SYM_CLASS_EXTERNAL_DEF 5
611 #define IMAGE_SYM_CLASS_LABEL 6
612 #define IMAGE_SYM_CLASS_UNDEFINED_LABEL 7
613 #define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT 8
614 #define IMAGE_SYM_CLASS_ARGUMENT 9
615 #define IMAGE_SYM_CLASS_STRUCT_TAG 10
616 #define IMAGE_SYM_CLASS_MEMBER_OF_UNION 11
617 #define IMAGE_SYM_CLASS_UNION_TAG 12
618 #define IMAGE_SYM_CLASS_TYPE_DEFINITION 13
619 #define IMAGE_SYM_CLASS_UNDEFINED_STATIC 14
620 #define IMAGE_SYM_CLASS_ENUM_TAG 15
621 #define IMAGE_SYM_CLASS_MEMBER_OF_ENUM 16
622 #define IMAGE_SYM_CLASS_REGISTER_PARAM 17
623 #define IMAGE_SYM_CLASS_BIT_FIELD 18
624 #define IMAGE_SYM_CLASS_FAR_EXTERNAL 68
625 #define IMAGE_SYM_CLASS_BLOCK 100
626 #define IMAGE_SYM_CLASS_FUNCTION 101
627 #define IMAGE_SYM_CLASS_END_OF_STRUCT 102
628 #define IMAGE_SYM_CLASS_FILE 103
629 #define IMAGE_SYM_CLASS_SECTION 104
630 #define IMAGE_SYM_CLASS_WEAK_EXTERNAL 105
631 #define IMAGE_COMDAT_SELECT_NODUPLICATES 1
632 #define IMAGE_COMDAT_SELECT_ANY 2
633 #define IMAGE_COMDAT_SELECT_SAME_SIZE 3
634 #define IMAGE_COMDAT_SELECT_EXACT_MATCH 4
635 #define IMAGE_COMDAT_SELECT_ASSOCIATIVE 5
636 #define IMAGE_COMDAT_SELECT_LARGEST 6
637 #define IMAGE_COMDAT_SELECT_NEWEST 7
638 #define IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY 1
639 #define IMAGE_WEAK_EXTERN_SEARCH_LIBRARY 2
640 #define IMAGE_WEAK_EXTERN_SEARCH_ALIAS 3
641 #define IMAGE_REL_I386_ABSOLUTE 0
642 #define IMAGE_REL_I386_DIR16 1
643 #define IMAGE_REL_I386_REL16 2
644 #define IMAGE_REL_I386_DIR32 6
645 #define IMAGE_REL_I386_DIR32NB 7
646 #define IMAGE_REL_I386_SEG12 9
647 #define IMAGE_REL_I386_SECTION 10
648 #define IMAGE_REL_I386_SECREL 11
649 #define IMAGE_REL_I386_REL32 20
650 #define IMAGE_REL_MIPS_ABSOLUTE 0
651 #define IMAGE_REL_MIPS_REFHALF 1
652 #define IMAGE_REL_MIPS_REFWORD 2
653 #define IMAGE_REL_MIPS_JMPADDR 3
654 #define IMAGE_REL_MIPS_REFHI 4
655 #define IMAGE_REL_MIPS_REFLO 5
656 #define IMAGE_REL_MIPS_GPREL 6
657 #define IMAGE_REL_MIPS_LITERAL 7
658 #define IMAGE_REL_MIPS_SECTION 10
659 #define IMAGE_REL_MIPS_SECREL 11
660 #define IMAGE_REL_MIPS_SECRELLO 12
661 #define IMAGE_REL_MIPS_SECRELHI 13
662 #define IMAGE_REL_MIPS_REFWORDNB 34
663 #define IMAGE_REL_MIPS_PAIR 35
664 #define IMAGE_REL_ALPHA_ABSOLUTE 0
665 #define IMAGE_REL_ALPHA_REFLONG 1
666 #define IMAGE_REL_ALPHA_REFQUAD 2
667 #define IMAGE_REL_ALPHA_GPREL32 3
668 #define IMAGE_REL_ALPHA_LITERAL 4
669 #define IMAGE_REL_ALPHA_LITUSE 5
670 #define IMAGE_REL_ALPHA_GPDISP 6
671 #define IMAGE_REL_ALPHA_BRADDR 7
672 #define IMAGE_REL_ALPHA_HINT 8
673 #define IMAGE_REL_ALPHA_INLINE_REFLONG 9
674 #define IMAGE_REL_ALPHA_REFHI 10
675 #define IMAGE_REL_ALPHA_REFLO 11
676 #define IMAGE_REL_ALPHA_PAIR 12
677 #define IMAGE_REL_ALPHA_MATCH 13
678 #define IMAGE_REL_ALPHA_SECTION 14
679 #define IMAGE_REL_ALPHA_SECREL 15
680 #define IMAGE_REL_ALPHA_REFLONGNB 16
681 #define IMAGE_REL_ALPHA_SECRELLO 17
682 #define IMAGE_REL_ALPHA_SECRELHI 18
683 #define IMAGE_REL_PPC_ABSOLUTE 0
684 #define IMAGE_REL_PPC_ADDR64 1
685 #define IMAGE_REL_PPC_ADDR32 2
686 #define IMAGE_REL_PPC_ADDR24 3
687 #define IMAGE_REL_PPC_ADDR16 4
688 #define IMAGE_REL_PPC_ADDR14 5
689 #define IMAGE_REL_PPC_REL24 6
690 #define IMAGE_REL_PPC_REL14 7
691 #define IMAGE_REL_PPC_TOCREL16 8
692 #define IMAGE_REL_PPC_TOCREL14 9
693 #define IMAGE_REL_PPC_ADDR32NB 10
694 #define IMAGE_REL_PPC_SECREL 11
695 #define IMAGE_REL_PPC_SECTION 12
696 #define IMAGE_REL_PPC_IFGLUE 13
697 #define IMAGE_REL_PPC_IMGLUE 14
698 #define IMAGE_REL_PPC_SECREL16 15
699 #define IMAGE_REL_PPC_REFHI 16
700 #define IMAGE_REL_PPC_REFLO 17
701 #define IMAGE_REL_PPC_PAIR 18
702 #define IMAGE_REL_PPC_TYPEMASK 255
703 #define IMAGE_REL_PPC_NEG 256
704 #define IMAGE_REL_PPC_BRTAKEN 512
705 #define IMAGE_REL_PPC_BRNTAKEN 1024
706 #define IMAGE_REL_PPC_TOCDEFN 2048
707 #define IMAGE_REL_BASED_ABSOLUTE 0
708 #define IMAGE_REL_BASED_HIGH 1
709 #define IMAGE_REL_BASED_LOW 2
710 #define IMAGE_REL_BASED_HIGHLOW 3
711 #define IMAGE_REL_BASED_HIGHADJ 4
712 #define IMAGE_REL_BASED_MIPS_JMPADDR 5
713 #define IMAGE_ARCHIVE_START_SIZE 8
714 #define IMAGE_ARCHIVE_START "!<arch>\n"
715 #define IMAGE_ARCHIVE_END "`\n"
716 #define IMAGE_ARCHIVE_PAD "\n"
717 #define IMAGE_ARCHIVE_LINKER_MEMBER "/ "
718 #define IMAGE_ARCHIVE_LONGNAMES_MEMBER "// "
719 #define IMAGE_ORDINAL_FLAG 0x80000000
720 #define IMAGE_SNAP_BY_ORDINAL(o) ((o&IMAGE_ORDINAL_FLAG)!=0)
721 #define IMAGE_RESOURCE_NAME_IS_STRING 0x80000000
722 #define IMAGE_RESOURCE_DATA_IS_DIRECTORY 0x80000000
723 #define IMAGE_DEBUG_TYPE_UNKNOWN 0
724 #define IMAGE_DEBUG_TYPE_COFF 1
725 #define IMAGE_DEBUG_TYPE_CODEVIEW 2
726 #define IMAGE_DEBUG_TYPE_FPO 3
727 #define IMAGE_DEBUG_TYPE_MISC 4
728 #define IMAGE_DEBUG_TYPE_EXCEPTION 5
729 #define IMAGE_DEBUG_TYPE_FIXUP 6
730 #define IMAGE_DEBUG_TYPE_OMAP_TO_SRC 7
731 #define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC 8
734 #define IMAGE_SIZEOF_SHORT_NAME 8
736 #define IMAGE_SIZEOF_SECTION_HEADER 40
738 #define IMAGE_SECTION_CODE (0x20)
739 #define IMAGE_SECTION_INITIALIZED_DATA (0x40)
740 #define IMAGE_SECTION_UNINITIALIZED_DATA (0x80)
746 #define IMAGE_ORDINAL_FLAG 0x80000000
749 // Predefined resource types ... there may be some more, but I don't have
750 // the information yet. .....sang cho.....
752 #define RT_NEWRESOURCE 0x2000
753 #define RT_ERROR 0x7fff
754 #define NEWBITMAP (RT_BITMAP|RT_NEWRESOURCE)
755 #define NEWMENU (RT_MENU|RT_NEWRESOURCE)
756 #define NEWDIALOG (RT_DIALOG|RT_NEWRESOURCE)
764 // Resource directory consists of two counts, following by a variable length
765 // array of directory entries. The first count is the number of entries at
766 // beginning of the array that have actual names associated with each entry.
767 // The entries are in ascending order, case insensitive strings. The second
768 // count is the number of entries that immediately follow the named entries.
769 // This second count identifies the number of entries that have 16-bit integer
770 // Ids as their name. These entries are also sorted in ascending order.
772 // This structure allows fast lookup by either name or number, but for any
773 // given resource entry only one form of lookup is supported, not both.
774 // This is consistant with the syntax of the .RC file and the .RES file.
778 #define IMAGE_RESOURCE_NAME_IS_STRING 0x80000000
779 #define IMAGE_RESOURCE_DATA_IS_DIRECTORY 0x80000000
784 // For resource directory entries that have actual string names, the Name
785 // field of the directory entry points to an object of the following type.
786 // All of these string objects are stored together after the last resource
787 // directory entry and before the first resource data object. This minimizes
788 // the impact of these variable length objects on the alignment of the fixed
789 // size directory entry objects.
791 /* defined above from mingw. ei
792 typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING {
794 CHAR NameString[ 1 ];
795 } IMAGE_RESOURCE_DIRECTORY_STRING, *PIMAGE_RESOURCE_DIRECTORY_STRING;
798 typedef struct _IMAGE_RESOURCE_DIR_STRING_U {
800 WCHAR NameString[ 1 ];
801 } IMAGE_RESOURCE_DIR_STRING_U, *PIMAGE_RESOURCE_DIR_STRING_U;
805 // Each resource data entry describes a leaf node in the resource directory
806 // tree. It contains an offset, relative to the beginning of the resource
807 // directory of the data for the resource, a size field that gives the number
808 // of bytes of data at that offset, a CodePage that should be used when
809 // decoding code point values within the resource data. Typically for new
810 // applications the code page would be the unicode code page.
813 typedef struct _IMAGE_RESOURCE_DATA_ENTRY {
818 } IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;
821 // Menu Resources ... added by .....sang cho....
823 // Menu resources are composed of a menu header followed by a sequential list
824 // of menu items. There are two types of menu items: pop-ups and normal menu
825 // itmes. The MENUITEM SEPARATOR is a special case of a normal menu item with
826 // an empty name, zero ID, and zero flags.
828 typedef struct _IMAGE_MENU_HEADER
{
829 WORD wVersion
; // Currently zero
830 WORD cbHeaderSize
; // Also zero
831 } IMAGE_MENU_HEADER
, *PIMAGE_MENU_HEADER
;
833 typedef struct _IMAGE_POPUP_MENU_ITEM
{
836 } IMAGE_POPUP_MENU_ITEM
, *PIMAGE_POPUP_MENU_ITEM
;
838 typedef struct _IMAGE_NORMAL_MENU_ITEM
{
842 } IMAGE_NORMAL_MENU_ITEM
, *PIMAGE_NORMAL_MENU_ITEM
;
844 #define MI_GRAYED 0x0001 // GRAYED keyword
845 #define MI_INACTIVE 0x0002 // INACTIVE keyword
846 #define MI_BITMAP 0x0004 // BITMAP keyword
847 #define MI_OWNERDRAW 0x0100 // OWNERDRAW keyword
848 #define MI_CHECKED 0x0008 // CHECKED keyword
849 #define MI_POPUP 0x0010 // used internally
850 #define MI_MENUBARBREAK 0x0020 // MENUBARBREAK keyword
851 #define MI_MENUBREAK 0x0040 // MENUBREAK keyword
852 #define MI_ENDMENU 0x0080 // used internally
854 // Dialog Box Resources .................. added by sang cho.
856 // A dialog box is contained in a single resource and has a header and
857 // a portion repeated for each control in the dialog box.
858 // The item DWORD IStyle is a standard window style composed of flags found
860 // The default style for a dialog box is:
861 // WS_POPUP | WS_BORDER | WS_SYSMENU
863 // The itme marked "Name or Ordinal" are :
864 // If the first word is an 0xffff, the next two bytes contain an ordinal ID.
865 // Otherwise, the first one or more WORDS contain a double-null-terminated string.
866 // An empty string is represented by a single WORD zero in the first location.
868 // The WORD wPointSize and WCHAR szFontName entries are present if the FONT
869 // statement was included for the dialog box. This can be detected by checking
870 // the entry IStyle. If IStyle & DS_SETFONT ( which is 0x40), then these
871 // entries will be present.
873 typedef struct _IMAGE_DIALOG_BOX_HEADER1
{
875 DWORD IExtendedStyle
; // New for Windows NT
876 WORD nControls
; // Number of Controls
881 // N_OR_O MenuName; // Name or Ordinal ID
882 // N_OR_O ClassName; // Name or Ordinal ID
883 // WCHAR szCaption[];
884 // WORD wPointSize; // Only here if FONT set for dialog
885 // WCHAR szFontName[]; // This too
886 } IMAGE_DIALOG_HEADER
, *PIMAGE_DIALOG_HEADER
;
888 typedef union _NAME_OR_ORDINAL
{ // Name or Ordinal ID
894 } NAME_OR_ORDINAL
, *PNAME_OR_ORDINAL
;
896 // The data for each control starts on a DWORD boundary (which may require
897 // some padding from the previous control), and its format is as follows:
899 typedef struct _IMAGE_CONTROL_DATA
{
901 DWORD IExtendedStyle
;
910 } IMAGE_CONTROL_DATA
, *PIMAGE_CONTROL_DATA
;
914 //#define STATIC 0x82
916 #define SCROLLBAR 0x84
917 #define COMBOBOX 0x85
919 // The various statements used in a dialog script are all mapped to these
920 // classes along with certain modifying styles. The values for these styles
921 // can be found in WINDOWS.H. All dialog controls have the default styles
922 // of WS_CHILD and WS_VISIBLE. A list of the default styles used follows:
924 // Statement Default Class Default Styles
925 // CONTROL None WS_CHILD|WS_VISIBLE
926 // LTEXT STATIC ES_LEFT
927 // RTEXT STATIC ES_RIGHT
928 // CTEXT STATIC ES_CENTER
929 // LISTBOX LISTBOX WS_BORDER|LBS_NOTIFY
930 // CHECKBOX BUTTON BS_CHECKBOX|WS_TABSTOP
931 // PUSHBUTTON BUTTON BS_PUSHBUTTON|WS_TABSTOP
932 // GROUPBOX BUTTON BS_GROUPBOX
933 // DEFPUSHBUTTON BUTTON BS_DFPUSHBUTTON|WS_TABSTOP
934 // RADIOBUTTON BUTTON BS_RADIOBUTTON
935 // AUTOCHECKBOX BUTTON BS_AUTOCHECKBOX
936 // AUTO3STATE BUTTON BS_AUTO3STATE
937 // AUTORADIOBUTTON BUTTON BS_AUTORADIOBUTTON
938 // PUSHBOX BUTTON BS_PUSHBOX
939 // STATE3 BUTTON BS_3STATE
940 // EDITTEXT EDIT ES_LEFT|WS_BORDER|WS_TABSTOP
941 // COMBOBOX COMBOBOX None
942 // ICON STATIC SS_ICON
943 // SCROLLBAR SCROLLBAR None
946 #define IMAGE_DEBUG_TYPE_UNKNOWN 0
947 #define IMAGE_DEBUG_TYPE_COFF 1
948 #define IMAGE_DEBUG_TYPE_CODEVIEW 2
949 #define IMAGE_DEBUG_TYPE_FPO 3
950 #define IMAGE_DEBUG_TYPE_MISC 4
951 #define IMAGE_DEBUG_TYPE_EXCEPTION 5
952 #define IMAGE_DEBUG_TYPE_FIXUP 6
953 #define IMAGE_DEBUG_TYPE_OMAP_TO_SRC 7
954 #define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC 8
959 // Debugging information can be stripped from an image file and placed
960 // in a separate .DBG file, whose file name part is the same as the
961 // image file name part (e.g. symbols for CMD.EXE could be stripped
962 // and placed in CMD.DBG). This is indicated by the IMAGE_FILE_DEBUG_STRIPPED
963 // flag in the Characteristics field of the file header. The beginning of
964 // the .DBG file contains the following structure which captures certain
965 // information from the image file. This allows a debug to proceed even if
966 // the original image file is not accessable. This header is followed by
967 // zero of more IMAGE_SECTION_HEADER structures, followed by zero or more
968 // IMAGE_DEBUG_DIRECTORY structures. The latter structures and those in
969 // the image file contain file offsets relative to the beginning of the
972 // If symbols have been stripped from an image, the IMAGE_DEBUG_MISC structure
973 // is left in the image file, but not mapped. This allows a debugger to
974 // compute the name of the .DBG file, from the name of the image in the
975 // IMAGE_DEBUG_MISC structure.
978 typedef struct _IMAGE_SEPARATE_DEBUG_HEADER {
982 WORD Characteristics;
987 DWORD NumberOfSections;
988 DWORD ExportedNamesSize;
989 DWORD DebugDirectorySize;
990 DWORD SectionAlignment;
992 } IMAGE_SEPARATE_DEBUG_HEADER, *PIMAGE_SEPARATE_DEBUG_HEADER;
994 #define IMAGE_SEPARATE_DEBUG_SIGNATURE 0x4944
996 #define IMAGE_SEPARATE_DEBUG_FLAGS_MASK 0x8000
997 #define IMAGE_SEPARATE_DEBUG_MISMATCH 0x8000 // when DBG was updated, the
998 // old checksum didn't match.
1004 #define SIZE_OF_NT_SIGNATURE sizeof (DWORD)
1005 #define MAXRESOURCENAME 13
1007 /* global macros to define header offsets into file */
1008 /* offset to PE file signature */
1009 #define NTSIGNATURE(a) ((LPVOID)((BYTE *)a + \
1010 ((PIMAGE_DOS_HEADER)a)->e_lfanew))
1012 /* DOS header identifies the NT PEFile signature dword
1013 the PEFILE header exists just after that dword */
1014 #define PEFHDROFFSET(a) ((LPVOID)((BYTE *)a + \
1015 ((PIMAGE_DOS_HEADER)a)->e_lfanew + \
1016 SIZE_OF_NT_SIGNATURE))
1018 /* PE optional header is immediately after PEFile header */
1019 #define OPTHDROFFSET(a) ((LPVOID)((BYTE *)a + \
1020 ((PIMAGE_DOS_HEADER)a)->e_lfanew + \
1021 SIZE_OF_NT_SIGNATURE + \
1022 sizeof (IMAGE_FILE_HEADER)))
1024 /* section headers are immediately after PE optional header */
1025 #define SECHDROFFSET(a) ((LPVOID)((BYTE *)a + \
1026 ((PIMAGE_DOS_HEADER)a)->e_lfanew + \
1027 SIZE_OF_NT_SIGNATURE + \
1028 sizeof (IMAGE_FILE_HEADER) + \
1029 sizeof (IMAGE_OPTIONAL_HEADER)))
1031 //#define FIELD_OFFSET(type, field) ((LONG)(LONG_PTR)&(((type *)0)->field))
1033 #define IMAGE_FIRST_SECTION( ntheader ) ((PIMAGE_SECTION_HEADER) \
1034 ((ULONG_PTR)ntheader + \
1035 FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) + \
1036 ((PIMAGE_NT_HEADERS)(ntheader))->FileHeader.SizeOfOptionalHeader \
1040 #define MakePtr( cast, ptr, addValue ) (cast)( (DWORD)(ptr) + (DWORD)(addValue))
1042 typedef struct _IMAGE_IMPORT_MODULE_DIRECTORY
1044 DWORD dwRVAFunctionNameList
;
1047 DWORD dwRVAModuleName
;
1048 DWORD dwRVAFunctionAddressList
;
1049 } IMAGE_IMPORT_MODULE_DIRECTORY
, *PIMAGE_IMPORT_MODULE_DIRECTORY
;
1051 typedef struct _RELOCATION_DIRECTORY
1053 DWORD VirtualAddress
; /* adresse virtuelle du bloc ou se font les relocations */
1054 DWORD SizeOfBlock
; // taille de cette structure + des structures
1055 // relocation_entry qui suivent (ces dernieres sont
1056 // donc au nombre de (SizeOfBlock-8)/2
1057 } RELOCATION_DIRECTORY
, *PRELOCATION_DIRECTORY
;
1059 typedef struct _RELOCATION_ENTRY
1062 // (TypeOffset >> 12) est le type
1063 // (TypeOffset&0xfff) est l'offset dans le bloc
1064 } RELOCATION_ENTRY
, *PRELOCATION_ENTRY
;
1066 #define TYPE_RELOC_ABSOLUTE 0
1067 #define TYPE_RELOC_HIGH 1
1068 #define TYPE_RELOC_LOW 2
1069 #define TYPE_RELOC_HIGHLOW 3
1070 #define TYPE_RELOC_HIGHADJ 4
1071 #define TYPE_RELOC_MIPS_JMPADDR 5
1073 #endif /* __INCLUDE_PE_H */