- ULONG Characteristics;
- ULONG TimeDateStamp;
- USHORT MajorVersion;
- USHORT MinorVersion;
- ULONG Name;
- ULONG Base;
- ULONG NumberOfFunctions;
- ULONG NumberOfNames;
- ULONG AddressOfFunctions;
- ULONG AddressOfNames;
- ULONG AddressOfNameOrdinals;
+ ULONG Characteristics;
+ ULONG TimeDateStamp;
+ USHORT MajorVersion;
+ USHORT MinorVersion;
+ ULONG Name;
+ ULONG Base;
+ ULONG NumberOfFunctions;
+ ULONG NumberOfNames;
+ ULONG AddressOfFunctions;
+ ULONG AddressOfNames;
+ ULONG AddressOfNameOrdinals;
- ULONG Size;
- ULONG TimeDateStamp;
- USHORT MajorVersion;
- USHORT MinorVersion;
- ULONG GlobalFlagsClear;
- ULONG GlobalFlagsSet;
- ULONG CriticalSectionDefaultTimeout;
- ULONG DeCommitFreeBlockThreshold;
- ULONG DeCommitTotalFreeThreshold;
- ULONG LockPrefixTable;
- ULONG MaximumAllocationSize;
- ULONG VirtualMemoryThreshold;
- ULONG ProcessHeapFlags;
- ULONG ProcessAffinityMask;
- USHORT CSDVersion;
- USHORT Reserved1;
- ULONG EditList;
- ULONG SecurityCookie;
- ULONG SEHandlerTable;
- ULONG SEHandlerCount;
+ ULONG Size;
+ ULONG TimeDateStamp;
+ USHORT MajorVersion;
+ USHORT MinorVersion;
+ ULONG GlobalFlagsClear;
+ ULONG GlobalFlagsSet;
+ ULONG CriticalSectionDefaultTimeout;
+ ULONG DeCommitFreeBlockThreshold;
+ ULONG DeCommitTotalFreeThreshold;
+ ULONG LockPrefixTable;
+ ULONG MaximumAllocationSize;
+ ULONG VirtualMemoryThreshold;
+ ULONG ProcessHeapFlags;
+ ULONG ProcessAffinityMask;
+ USHORT CSDVersion;
+ USHORT Reserved1;
+ ULONG EditList;
+ ULONG SecurityCookie;
+ ULONG SEHandlerTable;
+ ULONG SEHandlerCount;
- ULONG Size;
- ULONG TimeDateStamp;
- USHORT MajorVersion;
- USHORT MinorVersion;
- ULONG GlobalFlagsClear;
- ULONG GlobalFlagsSet;
- ULONG CriticalSectionDefaultTimeout;
- ULONGLONG DeCommitFreeBlockThreshold;
- ULONGLONG DeCommitTotalFreeThreshold;
- ULONGLONG LockPrefixTable;
- ULONGLONG MaximumAllocationSize;
- ULONGLONG VirtualMemoryThreshold;
- ULONGLONG ProcessAffinityMask;
- ULONG ProcessHeapFlags;
- USHORT CSDVersion;
- USHORT Reserved1;
- ULONGLONG EditList;
- ULONGLONG SecurityCookie;
- ULONGLONG SEHandlerTable;
- ULONGLONG SEHandlerCount;
+ ULONG Size;
+ ULONG TimeDateStamp;
+ USHORT MajorVersion;
+ USHORT MinorVersion;
+ ULONG GlobalFlagsClear;
+ ULONG GlobalFlagsSet;
+ ULONG CriticalSectionDefaultTimeout;
+ ULONGLONG DeCommitFreeBlockThreshold;
+ ULONGLONG DeCommitTotalFreeThreshold;
+ ULONGLONG LockPrefixTable;
+ ULONGLONG MaximumAllocationSize;
+ ULONGLONG VirtualMemoryThreshold;
+ ULONGLONG ProcessAffinityMask;
+ ULONG ProcessHeapFlags;
+ USHORT CSDVersion;
+ USHORT Reserved1;
+ ULONGLONG EditList;
+ ULONGLONG SecurityCookie;
+ ULONGLONG SEHandlerTable;
+ ULONGLONG SEHandlerCount;
} IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;
typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING {
} IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;
typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING {
- UCHAR Name[IMAGE_SIZEOF_SHORT_NAME];
- union
- {
- ULONG PhysicalAddress;
- ULONG VirtualSize;
- } Misc;
- ULONG VirtualAddress;
- ULONG SizeOfRawData;
- ULONG PointerToRawData;
- ULONG PointerToRelocations;
- ULONG PointerToLinenumbers;
- USHORT NumberOfRelocations;
- USHORT NumberOfLinenumbers;
- ULONG Characteristics;
+ UCHAR Name[IMAGE_SIZEOF_SHORT_NAME];
+ union {
+ ULONG PhysicalAddress;
+ ULONG VirtualSize;
+ } Misc;
+ ULONG VirtualAddress;
+ ULONG SizeOfRawData;
+ ULONG PointerToRawData;
+ ULONG PointerToRelocations;
+ ULONG PointerToLinenumbers;
+ USHORT NumberOfRelocations;
+ USHORT NumberOfLinenumbers;
+ ULONG Characteristics;
- USHORT Machine;
- USHORT NumberOfSections;
- ULONG TimeDateStamp;
- ULONG PointerToSymbolTable;
- ULONG NumberOfSymbols;
- USHORT SizeOfOptionalHeader;
- USHORT Characteristics;
+ USHORT Machine;
+ USHORT NumberOfSections;
+ ULONG TimeDateStamp;
+ ULONG PointerToSymbolTable;
+ ULONG NumberOfSymbols;
+ USHORT SizeOfOptionalHeader;
+ USHORT Characteristics;
- USHORT Magic;
- UCHAR MajorLinkerVersion;
- UCHAR MinorLinkerVersion;
- ULONG SizeOfCode;
- ULONG SizeOfInitializedData;
- ULONG SizeOfUninitializedData;
- ULONG AddressOfEntryPoint;
- ULONG BaseOfCode;
- ULONG BaseOfData;
- ULONG ImageBase;
- ULONG SectionAlignment;
- ULONG FileAlignment;
- USHORT MajorOperatingSystemVersion;
- USHORT MinorOperatingSystemVersion;
- USHORT MajorImageVersion;
- USHORT MinorImageVersion;
- USHORT MajorSubsystemVersion;
- USHORT MinorSubsystemVersion;
- ULONG Win32VersionValue;
- ULONG SizeOfImage;
- ULONG SizeOfHeaders;
- ULONG CheckSum;
- USHORT Subsystem;
- USHORT DllCharacteristics;
- ULONG SizeOfStackReserve;
- ULONG SizeOfStackCommit;
- ULONG SizeOfHeapReserve;
- ULONG SizeOfHeapCommit;
- ULONG LoaderFlags;
- ULONG NumberOfRvaAndSizes;
- IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
+ USHORT Magic;
+ UCHAR MajorLinkerVersion;
+ UCHAR MinorLinkerVersion;
+ ULONG SizeOfCode;
+ ULONG SizeOfInitializedData;
+ ULONG SizeOfUninitializedData;
+ ULONG AddressOfEntryPoint;
+ ULONG BaseOfCode;
+ ULONG BaseOfData;
+ ULONG ImageBase;
+ ULONG SectionAlignment;
+ ULONG FileAlignment;
+ USHORT MajorOperatingSystemVersion;
+ USHORT MinorOperatingSystemVersion;
+ USHORT MajorImageVersion;
+ USHORT MinorImageVersion;
+ USHORT MajorSubsystemVersion;
+ USHORT MinorSubsystemVersion;
+ ULONG Win32VersionValue;
+ ULONG SizeOfImage;
+ ULONG SizeOfHeaders;
+ ULONG CheckSum;
+ USHORT Subsystem;
+ USHORT DllCharacteristics;
+ ULONG SizeOfStackReserve;
+ ULONG SizeOfStackCommit;
+ ULONG SizeOfHeapReserve;
+ ULONG SizeOfHeapCommit;
+ ULONG LoaderFlags;
+ ULONG NumberOfRvaAndSizes;
+ IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
typedef struct _IMAGE_ROM_OPTIONAL_HEADER {
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
typedef struct _IMAGE_ROM_OPTIONAL_HEADER {
- USHORT Magic;
- UCHAR MajorLinkerVersion;
- UCHAR MinorLinkerVersion;
- ULONG SizeOfCode;
- ULONG SizeOfInitializedData;
- ULONG SizeOfUninitializedData;
- ULONG AddressOfEntryPoint;
- ULONG BaseOfCode;
- ULONG BaseOfData;
- ULONG BaseOfBss;
- ULONG GprMask;
- ULONG CprMask[4];
- ULONG GpValue;
+ USHORT Magic;
+ UCHAR MajorLinkerVersion;
+ UCHAR MinorLinkerVersion;
+ ULONG SizeOfCode;
+ ULONG SizeOfInitializedData;
+ ULONG SizeOfUninitializedData;
+ ULONG AddressOfEntryPoint;
+ ULONG BaseOfCode;
+ ULONG BaseOfData;
+ ULONG BaseOfBss;
+ ULONG GprMask;
+ ULONG CprMask[4];
+ ULONG GpValue;
} IMAGE_ROM_OPTIONAL_HEADER, *PIMAGE_ROM_OPTIONAL_HEADER;
typedef struct _IMAGE_OPTIONAL_HEADER64 {
} IMAGE_ROM_OPTIONAL_HEADER, *PIMAGE_ROM_OPTIONAL_HEADER;
typedef struct _IMAGE_OPTIONAL_HEADER64 {
- USHORT Magic;
- UCHAR MajorLinkerVersion;
- UCHAR MinorLinkerVersion;
- ULONG SizeOfCode;
- ULONG SizeOfInitializedData;
- ULONG SizeOfUninitializedData;
- ULONG AddressOfEntryPoint;
- ULONG BaseOfCode;
- ULONGLONG ImageBase;
- ULONG SectionAlignment;
- ULONG FileAlignment;
- USHORT MajorOperatingSystemVersion;
- USHORT MinorOperatingSystemVersion;
- USHORT MajorImageVersion;
- USHORT MinorImageVersion;
- USHORT MajorSubsystemVersion;
- USHORT MinorSubsystemVersion;
- ULONG Win32VersionValue;
- ULONG SizeOfImage;
- ULONG SizeOfHeaders;
- ULONG CheckSum;
- USHORT Subsystem;
- USHORT DllCharacteristics;
- ULONGLONG SizeOfStackReserve;
- ULONGLONG SizeOfStackCommit;
- ULONGLONG SizeOfHeapReserve;
- ULONGLONG SizeOfHeapCommit;
- ULONG LoaderFlags;
- ULONG NumberOfRvaAndSizes;
- IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
+ USHORT Magic;
+ UCHAR MajorLinkerVersion;
+ UCHAR MinorLinkerVersion;
+ ULONG SizeOfCode;
+ ULONG SizeOfInitializedData;
+ ULONG SizeOfUninitializedData;
+ ULONG AddressOfEntryPoint;
+ ULONG BaseOfCode;
+ ULONGLONG ImageBase;
+ ULONG SectionAlignment;
+ ULONG FileAlignment;
+ USHORT MajorOperatingSystemVersion;
+ USHORT MinorOperatingSystemVersion;
+ USHORT MajorImageVersion;
+ USHORT MinorImageVersion;
+ USHORT MajorSubsystemVersion;
+ USHORT MinorSubsystemVersion;
+ ULONG Win32VersionValue;
+ ULONG SizeOfImage;
+ ULONG SizeOfHeaders;
+ ULONG CheckSum;
+ USHORT Subsystem;
+ USHORT DllCharacteristics;
+ ULONGLONG SizeOfStackReserve;
+ ULONGLONG SizeOfStackCommit;
+ ULONGLONG SizeOfHeapReserve;
+ ULONGLONG SizeOfHeapCommit;
+ ULONG LoaderFlags;
+ ULONG NumberOfRvaAndSizes;
+ IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
-#define IMAGE_FIRST_SECTION( NtHeader ) ((PIMAGE_SECTION_HEADER) \
- ((ULONG_PTR)(NtHeader) + \
- FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) + \
- ((NtHeader))->FileHeader.SizeOfOptionalHeader \
- ))
+#define IMAGE_FIRST_SECTION( NtHeader ) \
+ ((PIMAGE_SECTION_HEADER) ((ULONG_PTR)(NtHeader) + \
+ FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) + \
+ ((NtHeader))->FileHeader.SizeOfOptionalHeader))
} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
#include <pshpack8.h>
typedef struct _IMAGE_THUNK_DATA64 {
} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
#include <pshpack8.h>
typedef struct _IMAGE_THUNK_DATA64 {
} IMAGE_THUNK_DATA64, *PIMAGE_THUNK_DATA64;
#include <poppack.h>
typedef struct _IMAGE_THUNK_DATA32 {
} IMAGE_THUNK_DATA64, *PIMAGE_THUNK_DATA64;
#include <poppack.h>
typedef struct _IMAGE_THUNK_DATA32 {
} IMAGE_THUNK_DATA32, *PIMAGE_THUNK_DATA32;
#define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL
} IMAGE_THUNK_DATA32, *PIMAGE_THUNK_DATA32;
#define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL
#define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
#define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
#define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
#define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
- ULONGLONG StartAddressOfRawData;
- ULONGLONG EndAddressOfRawData;
- ULONGLONG AddressOfIndex;
- ULONGLONG AddressOfCallBacks;
- ULONG SizeOfZeroFill;
- ULONG Characteristics;
+ ULONGLONG StartAddressOfRawData;
+ ULONGLONG EndAddressOfRawData;
+ ULONGLONG AddressOfIndex;
+ ULONGLONG AddressOfCallBacks;
+ ULONG SizeOfZeroFill;
+ ULONG Characteristics;
} IMAGE_TLS_DIRECTORY64, *PIMAGE_TLS_DIRECTORY64;
typedef struct _IMAGE_TLS_DIRECTORY32 {
} IMAGE_TLS_DIRECTORY64, *PIMAGE_TLS_DIRECTORY64;
typedef struct _IMAGE_TLS_DIRECTORY32 {
- ULONG StartAddressOfRawData;
- ULONG EndAddressOfRawData;
- ULONG AddressOfIndex;
- ULONG AddressOfCallBacks;
- ULONG SizeOfZeroFill;
- ULONG Characteristics;
+ ULONG StartAddressOfRawData;
+ ULONG EndAddressOfRawData;
+ ULONG AddressOfIndex;
+ ULONG AddressOfCallBacks;
+ ULONG SizeOfZeroFill;
+ ULONG Characteristics;