sdk/include/ddk/ntimage.h

   1 #ifndef _NTIMAGE_
   2 #define _NTIMAGE_
   3
   4 //
   5 // Image Formats
   6 //
   7 #define IMAGE_DOS_SIGNATURE                 0x5A4D
   8 #define IMAGE_OS2_SIGNATURE                 0x454E
   9 #define IMAGE_OS2_SIGNATURE_LE              0x454C
  10 #define IMAGE_VXD_SIGNATURE                 0x454C
  11 #define IMAGE_NT_SIGNATURE                  0x00004550
  12
  13 //
  14 // Image architectures
  15 //
  16 #define IMAGE_FILE_MACHINE_AM33       0x1d3
  17 #define IMAGE_FILE_MACHINE_AMD64      0x8664
  18 #define IMAGE_FILE_MACHINE_ARM        0x1c0
  19 #define IMAGE_FILE_MACHINE_ARMV7      0x1c4
  20 #define IMAGE_FILE_MACHINE_EBC        0xebc
  21 #define IMAGE_FILE_MACHINE_I386       0x14c
  22 #define IMAGE_FILE_MACHINE_IA64       0x200
  23 #define IMAGE_FILE_MACHINE_M32R       0x9041
  24 #define IMAGE_FILE_MACHINE_MIPS16     0x266
  25 #define IMAGE_FILE_MACHINE_MIPSFPU    0x366
  26 #define IMAGE_FILE_MACHINE_MIPSFPU16  0x466
  27 #define IMAGE_FILE_MACHINE_POWERPC    0x1f0
  28 #define IMAGE_FILE_MACHINE_POWERPCFP  0x1f1
  29 #define IMAGE_FILE_MACHINE_R4000      0x166
  30 #define IMAGE_FILE_MACHINE_SH3        0x1a2
  31 #define IMAGE_FILE_MACHINE_SH3E       0x01a4
  32 #define IMAGE_FILE_MACHINE_SH3DSP     0x1a3
  33 #define IMAGE_FILE_MACHINE_SH4        0x1a6
  34 #define IMAGE_FILE_MACHINE_SH5        0x1a8
  35 #define IMAGE_FILE_MACHINE_THUMB      0x1c2
  36 #define IMAGE_FILE_MACHINE_WCEMIPSV2  0x169
  37 #define IMAGE_FILE_MACHINE_R3000      0x162
  38 #define IMAGE_FILE_MACHINE_R10000     0x168
  39 #define IMAGE_FILE_MACHINE_ALPHA      0x184
  40 #define IMAGE_FILE_MACHINE_ALPHA64    0x0284
  41 #define IMAGE_FILE_MACHINE_AXP64      IMAGE_FILE_MACHINE_ALPHA64
  42 #define IMAGE_FILE_MACHINE_CEE        0xC0EE
  43 #define IMAGE_FILE_MACHINE_TRICORE    0x0520
  44 #define IMAGE_FILE_MACHINE_CEF        0x0CEF
  45
  46
  47 //
  48 // DOS Image Header Format
  49 //
  50 #include <pshpack2.h>
  51 typedef struct _IMAGE_DOS_HEADER {
  52   USHORT e_magic;
  53   USHORT e_cblp;
  54   USHORT e_cp;
  55   USHORT e_crlc;
  56   USHORT e_cparhdr;
  57   USHORT e_minalloc;
  58   USHORT e_maxalloc;
  59   USHORT e_ss;
  60   USHORT e_sp;
  61   USHORT e_csum;
  62   USHORT e_ip;
  63   USHORT e_cs;
  64   USHORT e_lfarlc;
  65   USHORT e_ovno;
  66   USHORT e_res[4];
  67   USHORT e_oemid;
  68   USHORT e_oeminfo;
  69   USHORT e_res2[10];
  70   LONG e_lfanew;
  71 } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
  72 #include <poppack.h>
  73
  74 //
  75 // Export/Import Format
  76 //
  77 #include <pshpack4.h>
  78 typedef struct _IMAGE_EXPORT_DIRECTORY {
  79   ULONG Characteristics;
  80   ULONG TimeDateStamp;
  81   USHORT MajorVersion;
  82   USHORT MinorVersion;
  83   ULONG Name;
  84   ULONG Base;
  85   ULONG NumberOfFunctions;
  86   ULONG NumberOfNames;
  87   ULONG AddressOfFunctions;
  88   ULONG AddressOfNames;
  89   ULONG AddressOfNameOrdinals;
  90 } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
  91
  92 //
  93 // Resource Data Entry Format
  94 //
  95 typedef struct _IMAGE_RESOURCE_DATA_ENTRY {
  96   ULONG OffsetToData;
  97   ULONG Size;
  98   ULONG CodePage;
  99   ULONG Reserved;
 100 } IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;
 101
 102 //
 103 // Load Configuration Directory Entry Format
 104 //
 105 typedef struct {
 106   ULONG Size;
 107   ULONG TimeDateStamp;
 108   USHORT MajorVersion;
 109   USHORT MinorVersion;
 110   ULONG GlobalFlagsClear;
 111   ULONG GlobalFlagsSet;
 112   ULONG CriticalSectionDefaultTimeout;
 113   ULONG DeCommitFreeBlockThreshold;
 114   ULONG DeCommitTotalFreeThreshold;
 115   ULONG LockPrefixTable;
 116   ULONG MaximumAllocationSize;
 117   ULONG VirtualMemoryThreshold;
 118   ULONG ProcessHeapFlags;
 119   ULONG ProcessAffinityMask;
 120   USHORT CSDVersion;
 121   USHORT Reserved1;
 122   ULONG EditList;
 123   ULONG SecurityCookie;
 124   ULONG SEHandlerTable;
 125   ULONG SEHandlerCount;
 126 } IMAGE_LOAD_CONFIG_DIRECTORY32, *PIMAGE_LOAD_CONFIG_DIRECTORY32;
 127
 128 typedef struct {
 129   ULONG Size;
 130   ULONG TimeDateStamp;
 131   USHORT MajorVersion;
 132   USHORT MinorVersion;
 133   ULONG GlobalFlagsClear;
 134   ULONG GlobalFlagsSet;
 135   ULONG CriticalSectionDefaultTimeout;
 136   ULONGLONG DeCommitFreeBlockThreshold;
 137   ULONGLONG DeCommitTotalFreeThreshold;
 138   ULONGLONG LockPrefixTable;
 139   ULONGLONG MaximumAllocationSize;
 140   ULONGLONG VirtualMemoryThreshold;
 141   ULONGLONG ProcessAffinityMask;
 142   ULONG ProcessHeapFlags;
 143   USHORT CSDVersion;
 144   USHORT Reserved1;
 145   ULONGLONG EditList;
 146   ULONGLONG SecurityCookie;
 147   ULONGLONG SEHandlerTable;
 148   ULONGLONG SEHandlerCount;
 149 } IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64;
 150
 151 #ifdef _WIN64
 152 typedef IMAGE_LOAD_CONFIG_DIRECTORY64     IMAGE_LOAD_CONFIG_DIRECTORY;
 153 typedef PIMAGE_LOAD_CONFIG_DIRECTORY64    PIMAGE_LOAD_CONFIG_DIRECTORY;
 154 #else
 155 typedef IMAGE_LOAD_CONFIG_DIRECTORY32     IMAGE_LOAD_CONFIG_DIRECTORY;
 156 typedef PIMAGE_LOAD_CONFIG_DIRECTORY32    PIMAGE_LOAD_CONFIG_DIRECTORY;
 157 #endif
 158
 159 //
 160 // Base Relocation Format
 161 //
 162 typedef struct _IMAGE_BASE_RELOCATION {
 163   ULONG VirtualAddress;
 164   ULONG SizeOfBlock;
 165 } IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION;
 166
 167 //
 168 // Resource Format
 169 //
 170 typedef struct _IMAGE_RESOURCE_DIRECTORY {
 171   ULONG Characteristics;
 172   ULONG TimeDateStamp;
 173   USHORT MajorVersion;
 174   USHORT MinorVersion;
 175   USHORT NumberOfNamedEntries;
 176   USHORT NumberOfIdEntries;
 177 } IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;
 178
 179 #define IMAGE_RESOURCE_NAME_IS_STRING        0x80000000
 180 #define IMAGE_RESOURCE_DATA_IS_DIRECTORY     0x80000000
 181
 182 typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY {
 183   _ANONYMOUS_UNION union {
 184     _ANONYMOUS_STRUCT struct {
 185       ULONG NameOffset:31;
 186       ULONG NameIsString:1;
 187     } DUMMYSTRUCTNAME;
 188     ULONG Name;
 189     USHORT Id;
 190   } DUMMYUNIONNAME;
 191   _ANONYMOUS_UNION union {
 192       ULONG OffsetToData;
 193     _ANONYMOUS_STRUCT struct {
 194         ULONG OffsetToDirectory:31;
 195       ULONG DataIsDirectory:1;
 196     } DUMMYSTRUCTNAME2;
 197   } DUMMYUNIONNAME2;
 198 } IMAGE_RESOURCE_DIRECTORY_ENTRY, *PIMAGE_RESOURCE_DIRECTORY_ENTRY;
 199
 200 typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING {
 201   USHORT Length;
 202   CHAR NameString[ANYSIZE_ARRAY];
 203 } IMAGE_RESOURCE_DIRECTORY_STRING, *PIMAGE_RESOURCE_DIRECTORY_STRING;
 204
 205 //
 206 // Section Header Format
 207 //
 208 #define IMAGE_SIZEOF_SHORT_NAME              8
 209 #define IMAGE_SIZEOF_SECTION_HEADER          40
 210
 211 typedef struct _IMAGE_SECTION_HEADER {
 212   UCHAR Name[IMAGE_SIZEOF_SHORT_NAME];
 213   union {
 214     ULONG PhysicalAddress;
 215     ULONG VirtualSize;
 216   } Misc;
 217   ULONG VirtualAddress;
 218   ULONG SizeOfRawData;
 219   ULONG PointerToRawData;
 220   ULONG PointerToRelocations;
 221   ULONG PointerToLinenumbers;
 222   USHORT NumberOfRelocations;
 223   USHORT NumberOfLinenumbers;
 224   ULONG Characteristics;
 225 } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
 226
 227 //
 228 // Section Characteristics
 229 //
 230 #define IMAGE_SCN_CNT_CODE                   0x00000020
 231 #define IMAGE_SCN_CNT_INITIALIZED_DATA       0x00000040
 232 #define IMAGE_SCN_CNT_UNINITIALIZED_DATA     0x00000080
 233
 234 #define IMAGE_SCN_LNK_NRELOC_OVFL            0x01000000
 235 #define IMAGE_SCN_MEM_DISCARDABLE            0x02000000
 236 #define IMAGE_SCN_MEM_NOT_CACHED             0x04000000
 237 #define IMAGE_SCN_MEM_NOT_PAGED              0x08000000
 238 #define IMAGE_SCN_MEM_SHARED                 0x10000000
 239 #define IMAGE_SCN_MEM_EXECUTE                0x20000000
 240 #define IMAGE_SCN_MEM_READ                   0x40000000
 241 #define IMAGE_SCN_MEM_WRITE                  0x80000000
 242
 243 //
 244 // File Header Format
 245 //
 246 #define IMAGE_SIZEOF_FILE_HEADER             20
 247
 248 typedef struct _IMAGE_FILE_HEADER {
 249   USHORT Machine;
 250   USHORT NumberOfSections;
 251   ULONG TimeDateStamp;
 252   ULONG PointerToSymbolTable;
 253   ULONG NumberOfSymbols;
 254   USHORT SizeOfOptionalHeader;
 255   USHORT Characteristics;
 256 } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
 257
 258 //
 259 // File Characteristics
 260 //
 261 #define IMAGE_FILE_RELOCS_STRIPPED           0x0001
 262 #define IMAGE_FILE_EXECUTABLE_IMAGE          0x0002
 263 #define IMAGE_FILE_LINE_NUMS_STRIPPED        0x0004
 264 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008
 265 #define IMAGE_FILE_AGGRESIVE_WS_TRIM         0x0010
 266 #define IMAGE_FILE_LARGE_ADDRESS_AWARE       0x0020
 267 #define IMAGE_FILE_BYTES_REVERSED_LO         0x0080
 268 #define IMAGE_FILE_32BIT_MACHINE             0x0100
 269 #define IMAGE_FILE_DEBUG_STRIPPED            0x0200
 270 #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP   0x0400
 271 #define IMAGE_FILE_NET_RUN_FROM_SWAP         0x0800
 272 #define IMAGE_FILE_SYSTEM                    0x1000
 273 #define IMAGE_FILE_DLL                       0x2000
 274 #define IMAGE_FILE_UP_SYSTEM_ONLY            0x4000
 275 #define IMAGE_FILE_BYTES_REVERSED_HI         0x8000
 276
 277 //
 278 // Directory format.
 279 //
 280 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES    16
 281
 282 typedef struct _IMAGE_DATA_DIRECTORY {
 283   ULONG VirtualAddress;
 284   ULONG Size;
 285 } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
 286
 287 //
 288 // Optional Header Formats
 289 //
 290 typedef struct _IMAGE_OPTIONAL_HEADER {
 291   USHORT Magic;
 292   UCHAR MajorLinkerVersion;
 293   UCHAR MinorLinkerVersion;
 294   ULONG SizeOfCode;
 295   ULONG SizeOfInitializedData;
 296   ULONG SizeOfUninitializedData;
 297   ULONG AddressOfEntryPoint;
 298   ULONG BaseOfCode;
 299   ULONG BaseOfData;
 300   ULONG ImageBase;
 301   ULONG SectionAlignment;
 302   ULONG FileAlignment;
 303   USHORT MajorOperatingSystemVersion;
 304   USHORT MinorOperatingSystemVersion;
 305   USHORT MajorImageVersion;
 306   USHORT MinorImageVersion;
 307   USHORT MajorSubsystemVersion;
 308   USHORT MinorSubsystemVersion;
 309   ULONG Win32VersionValue;
 310   ULONG SizeOfImage;
 311   ULONG SizeOfHeaders;
 312   ULONG CheckSum;
 313   USHORT Subsystem;
 314   USHORT DllCharacteristics;
 315   ULONG SizeOfStackReserve;
 316   ULONG SizeOfStackCommit;
 317   ULONG SizeOfHeapReserve;
 318   ULONG SizeOfHeapCommit;
 319   ULONG LoaderFlags;
 320   ULONG NumberOfRvaAndSizes;
 321   IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
 322 } IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
 323
 324 typedef struct _IMAGE_ROM_OPTIONAL_HEADER {
 325   USHORT Magic;
 326   UCHAR MajorLinkerVersion;
 327   UCHAR MinorLinkerVersion;
 328   ULONG SizeOfCode;
 329   ULONG SizeOfInitializedData;
 330   ULONG SizeOfUninitializedData;
 331   ULONG AddressOfEntryPoint;
 332   ULONG BaseOfCode;
 333   ULONG BaseOfData;
 334   ULONG BaseOfBss;
 335   ULONG GprMask;
 336   ULONG CprMask[4];
 337   ULONG GpValue;
 338 } IMAGE_ROM_OPTIONAL_HEADER, *PIMAGE_ROM_OPTIONAL_HEADER;
 339
 340 typedef struct _IMAGE_OPTIONAL_HEADER64 {
 341   USHORT Magic;
 342   UCHAR MajorLinkerVersion;
 343   UCHAR MinorLinkerVersion;
 344   ULONG SizeOfCode;
 345   ULONG SizeOfInitializedData;
 346   ULONG SizeOfUninitializedData;
 347   ULONG AddressOfEntryPoint;
 348   ULONG BaseOfCode;
 349   ULONGLONG ImageBase;
 350   ULONG SectionAlignment;
 351   ULONG FileAlignment;
 352   USHORT MajorOperatingSystemVersion;
 353   USHORT MinorOperatingSystemVersion;
 354   USHORT MajorImageVersion;
 355   USHORT MinorImageVersion;
 356   USHORT MajorSubsystemVersion;
 357   USHORT MinorSubsystemVersion;
 358   ULONG Win32VersionValue;
 359   ULONG SizeOfImage;
 360   ULONG SizeOfHeaders;
 361   ULONG CheckSum;
 362   USHORT Subsystem;
 363   USHORT DllCharacteristics;
 364   ULONGLONG SizeOfStackReserve;
 365   ULONGLONG SizeOfStackCommit;
 366   ULONGLONG SizeOfHeapReserve;
 367   ULONGLONG SizeOfHeapCommit;
 368   ULONG LoaderFlags;
 369   ULONG NumberOfRvaAndSizes;
 370   IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
 371 } IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
 372
 373 //
 374 // Format Identifier Magics
 375 //
 376 #define IMAGE_NT_OPTIONAL_HDR32_MAGIC      0x10b
 377 #define IMAGE_NT_OPTIONAL_HDR64_MAGIC      0x20b
 378 #define IMAGE_ROM_OPTIONAL_HDR_MAGIC       0x107
 379
 380 #ifdef _WIN64
 381 typedef IMAGE_OPTIONAL_HEADER64             IMAGE_OPTIONAL_HEADER;
 382 typedef PIMAGE_OPTIONAL_HEADER64            PIMAGE_OPTIONAL_HEADER;
 383 #define IMAGE_NT_OPTIONAL_HDR_MAGIC         IMAGE_NT_OPTIONAL_HDR64_MAGIC
 384 #else
 385 typedef IMAGE_OPTIONAL_HEADER32             IMAGE_OPTIONAL_HEADER;
 386 typedef PIMAGE_OPTIONAL_HEADER32            PIMAGE_OPTIONAL_HEADER;
 387 #define IMAGE_NT_OPTIONAL_HDR_MAGIC         IMAGE_NT_OPTIONAL_HDR32_MAGIC
 388 #endif
 389
 390 //
 391 // Nt Header Formats
 392 //
 393 typedef struct _IMAGE_NT_HEADERS64 {
 394   ULONG Signature;
 395   IMAGE_FILE_HEADER FileHeader;
 396   IMAGE_OPTIONAL_HEADER64 OptionalHeader;
 397 } IMAGE_NT_HEADERS64;
 398
 399 typedef struct _IMAGE_NT_HEADERS {
 400   ULONG Signature;
 401   IMAGE_FILE_HEADER FileHeader;
 402   IMAGE_OPTIONAL_HEADER32 OptionalHeader;
 403 } IMAGE_NT_HEADERS32;
 404
 405 #ifdef _WIN64
 406 typedef IMAGE_NT_HEADERS64                  IMAGE_NT_HEADERS;
 407 #else
 408 typedef IMAGE_NT_HEADERS32                  IMAGE_NT_HEADERS;
 409 #endif
 410
 411 #ifndef _NTDDK_
 412
 413 typedef struct _IMAGE_NT_HEADERS *PIMAGE_NT_HEADERS32;
 414 typedef struct _IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
 415
 416 #ifdef _WIN64
 417 typedef PIMAGE_NT_HEADERS64                 PIMAGE_NT_HEADERS;
 418 #else
 419 typedef PIMAGE_NT_HEADERS32                 PIMAGE_NT_HEADERS;
 420 #endif
 421
 422 #endif /* _NTDDK_ */
 423
 424 //
 425 // Retreives the first image section header from the Nt Header
 426 //
 427 #define IMAGE_FIRST_SECTION( NtHeader )                \
 428   ((PIMAGE_SECTION_HEADER) ((ULONG_PTR)(NtHeader) +    \
 429    FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) +  \
 430    ((NtHeader))->FileHeader.SizeOfOptionalHeader))
 431
 432 //
 433 // Subsystems
 434 //
 435 #define IMAGE_SUBSYSTEM_UNKNOWN                         0
 436 #define IMAGE_SUBSYSTEM_NATIVE                          1
 437 #define IMAGE_SUBSYSTEM_WINDOWS_GUI                     2
 438 #define IMAGE_SUBSYSTEM_WINDOWS_CUI                     3
 439 #define IMAGE_SUBSYSTEM_OS2_CUI                         5
 440 #define IMAGE_SUBSYSTEM_POSIX_CUI                       7
 441 #define IMAGE_SUBSYSTEM_NATIVE_WINDOWS                  8
 442 #define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI                  9
 443 #define IMAGE_SUBSYSTEM_EFI_APPLICATION                 10
 444 #define IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER         11
 445 #define IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER              12
 446 #define IMAGE_SUBSYSTEM_EFI_ROM                         13
 447 #define IMAGE_SUBSYSTEM_XBOX                            14
 448 #define IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION        16
 449 #define IMAGE_SUBSYSTEM_XBOX_CODE_CATALOG               17
 450
 451 //
 452 // Dll Characteristics
 453 //
 454 #define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA        0x0020
 455 #define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE           0x0040
 456 #define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY        0x0080
 457 #define IMAGE_DLLCHARACTERISTICS_NX_COMPAT              0x0100
 458 #define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION           0x0200
 459 #define IMAGE_DLLCHARACTERISTICS_NO_SEH                 0x0400
 460 #define IMAGE_DLLCHARACTERISTICS_NO_BIND                0x0800
 461 #define IMAGE_DLLCHARACTERISTICS_APPCONTAINER           0x1000
 462 #define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER             0x2000
 463 #define IMAGE_DLLCHARACTERISTICS_GUARD_CF               0x4000
 464 #define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE  0x8000
 465
 466 //
 467 // Loader Flags
 468 //
 469 #define IMAGE_LOADER_FLAGS_COMPLUS       0x00000001
 470 #define IMAGE_LOADER_FLAGS_SYSTEM_GLOBAL 0x01000000
 471
 472 //
 473 // Directory Entry Specifiers
 474 //
 475 #define IMAGE_DIRECTORY_ENTRY_EXPORT          0
 476 #define IMAGE_DIRECTORY_ENTRY_IMPORT          1
 477 #define IMAGE_DIRECTORY_ENTRY_RESOURCE        2
 478 #define IMAGE_DIRECTORY_ENTRY_EXCEPTION       3
 479 #define IMAGE_DIRECTORY_ENTRY_SECURITY        4
 480 #define IMAGE_DIRECTORY_ENTRY_BASERELOC       5
 481 #define IMAGE_DIRECTORY_ENTRY_DEBUG           6
 482 #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE    7
 483 #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR       8
 484 #define IMAGE_DIRECTORY_ENTRY_TLS             9
 485 #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    10
 486 #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   11
 487 #define IMAGE_DIRECTORY_ENTRY_IAT            12
 488 #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   13
 489 #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14
 490
 491 //
 492 // Import Formats
 493 //
 494 typedef struct _IMAGE_IMPORT_BY_NAME {
 495   USHORT Hint;
 496   UCHAR Name[1];
 497 } IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
 498
 499 #include <pshpack8.h>
 500 typedef struct _IMAGE_THUNK_DATA64 {
 501   union {
 502     ULONGLONG ForwarderString;
 503     ULONGLONG Function;
 504     ULONGLONG Ordinal;
 505     ULONGLONG AddressOfData;
 506   } u1;
 507 } IMAGE_THUNK_DATA64, *PIMAGE_THUNK_DATA64;
 508 #include <poppack.h>
 509
 510 typedef struct _IMAGE_THUNK_DATA32 {
 511   union {
 512     ULONG ForwarderString;
 513     ULONG Function;
 514     ULONG Ordinal;
 515     ULONG AddressOfData;
 516   } u1;
 517 } IMAGE_THUNK_DATA32, *PIMAGE_THUNK_DATA32;
 518
 519 #define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL
 520 #define IMAGE_ORDINAL_FLAG32 0x80000000
 521 #define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)
 522 #define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)
 523 #define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
 524 #define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
 525
 526 //
 527 // Thread Local Storage (TLS)
 528 //
 529 typedef
 530 VOID
 531 (NTAPI *PIMAGE_TLS_CALLBACK) (
 532   PVOID DllHandle,
 533   ULONG Reason,
 534   PVOID Reserved);
 535
 536 typedef struct _IMAGE_TLS_DIRECTORY64 {
 537   ULONGLONG StartAddressOfRawData;
 538   ULONGLONG EndAddressOfRawData;
 539   ULONGLONG AddressOfIndex;
 540   ULONGLONG AddressOfCallBacks;
 541   ULONG SizeOfZeroFill;
 542   ULONG Characteristics;
 543 } IMAGE_TLS_DIRECTORY64, *PIMAGE_TLS_DIRECTORY64;
 544
 545 typedef struct _IMAGE_TLS_DIRECTORY32 {
 546   ULONG StartAddressOfRawData;
 547   ULONG EndAddressOfRawData;
 548   ULONG AddressOfIndex;
 549   ULONG AddressOfCallBacks;
 550   ULONG SizeOfZeroFill;
 551   ULONG Characteristics;
 552 } IMAGE_TLS_DIRECTORY32, *PIMAGE_TLS_DIRECTORY32;
 553
 554 #ifdef _WIN64
 555 #define IMAGE_ORDINAL_FLAG              IMAGE_ORDINAL_FLAG64
 556 #define IMAGE_ORDINAL(Ordinal)          IMAGE_ORDINAL64(Ordinal)
 557 typedef IMAGE_THUNK_DATA64              IMAGE_THUNK_DATA;
 558 typedef PIMAGE_THUNK_DATA64             PIMAGE_THUNK_DATA;
 559 #define IMAGE_SNAP_BY_ORDINAL(Ordinal)  IMAGE_SNAP_BY_ORDINAL64(Ordinal)
 560 typedef IMAGE_TLS_DIRECTORY64           IMAGE_TLS_DIRECTORY;
 561 typedef PIMAGE_TLS_DIRECTORY64          PIMAGE_TLS_DIRECTORY;
 562 #else
 563 #define IMAGE_ORDINAL_FLAG              IMAGE_ORDINAL_FLAG32
 564 #define IMAGE_ORDINAL(Ordinal)          IMAGE_ORDINAL32(Ordinal)
 565 typedef IMAGE_THUNK_DATA32              IMAGE_THUNK_DATA;
 566 typedef PIMAGE_THUNK_DATA32             PIMAGE_THUNK_DATA;
 567 #define IMAGE_SNAP_BY_ORDINAL(Ordinal)  IMAGE_SNAP_BY_ORDINAL32(Ordinal)
 568 typedef IMAGE_TLS_DIRECTORY32           IMAGE_TLS_DIRECTORY;
 569 typedef PIMAGE_TLS_DIRECTORY32          PIMAGE_TLS_DIRECTORY;
 570 #endif
 571
 572 typedef struct _IMAGE_IMPORT_DESCRIPTOR {
 573   _ANONYMOUS_UNION union {
 574     ULONG Characteristics;
 575     ULONG OriginalFirstThunk;
 576   } DUMMYUNIONNAME;
 577   ULONG TimeDateStamp;
 578   ULONG ForwarderChain;
 579   ULONG Name;
 580   ULONG FirstThunk;
 581 } IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR;
 582
 583 #include <poppack.h>
 584
 585 #endif /* _NTIMAGE_ */