4 //#define _ANONYMOUS_UNION __extension__
5 //#define _ANONYMOUS_STRUCT __extension__
8 #ifndef NONAMELESSUNION
9 #if __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 95)
10 #define _ANONYMOUS_UNION __extension__
11 #define _ANONYMOUS_STRUCT __extension__
13 #if defined(__cplusplus)
14 #define _ANONYMOUS_UNION __extension__
16 #endif /* __GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 95) */
17 #endif /* NONAMELESSUNION */
19 #define _ANONYMOUS_UNION
20 #define _ANONYMOUS_STRUCT
28 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
29 #define IMAGE_SIZEOF_SHORT_NAME 8
30 #define IMAGE_SIZEOF_SYMBOL 18
34 #define IMAGE_DOS_SIGNATURE 0x5a4d
35 #define IMAGE_OS2_SIGNATURE 0x454e
36 #define IMAGE_OS2_SIGNATURE_LE 0x454c
37 #define IMAGE_VXD_SIGNATURE 0x454c
39 #define IMAGE_FILE_RELOCS_STRIPPED 0x0001 // Relocation info stripped from file.
40 #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 // File is executable (i.e. no unresolved externel references).
41 #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 // Line nunbers stripped from file.
42 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 // Local symbols stripped from file.
43 #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 // Bytes of machine word are reversed.
44 #define IMAGE_FILE_32BIT_MACHINE 0x0100 // 32 bit word machine.
45 #define IMAGE_FILE_DEBUG_STRIPPED 0x0200 // Debugging info stripped from file in .DBG file
46 #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 // If Image is on removable media, copy and run from the swap file.
47 #define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 // If Image is on Net, copy and run from the swap file.
48 #define IMAGE_FILE_SYSTEM 0x1000 // System File.
49 #define IMAGE_FILE_DLL 0x2000 // File is a DLL.
50 #define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 // File should only be run on a UP machine
51 #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 // Bytes of machine word are reversed.
53 #define IMAGE_FILE_MACHINE_UNKNOWN 0
54 #define IMAGE_FILE_MACHINE_I386 0x14c // Intel 386.
55 #define IMAGE_FILE_MACHINE_R3000 0x162 // MIPS little-endian, 0x160 big-endian
56 #define IMAGE_FILE_MACHINE_R4000 0x166 // MIPS little-endian
57 #define IMAGE_FILE_MACHINE_R10000 0x168 // MIPS little-endian
58 #define IMAGE_FILE_MACHINE_ALPHA 0x184 // Alpha_AXP
59 #define IMAGE_FILE_MACHINE_POWERPC 0x1F0 // IBM PowerPC Little-Endian
62 typedef struct _IMAGE_FILE_HEADER {
64 WORD NumberOfSections;
66 DWORD PointerToSymbolTable;
67 DWORD NumberOfSymbols;
68 WORD SizeOfOptionalHeader;
70 } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
71 typedef struct _IMAGE_DATA_DIRECTORY {
74 } IMAGE_DATA_DIRECTORY,*PIMAGE_DATA_DIRECTORY;
75 typedef struct _IMAGE_OPTIONAL_HEADER {
77 BYTE MajorLinkerVersion;
78 BYTE MinorLinkerVersion;
80 DWORD SizeOfInitializedData;
81 DWORD SizeOfUninitializedData;
82 DWORD AddressOfEntryPoint;
86 DWORD SectionAlignment;
88 WORD MajorOperatingSystemVersion;
89 WORD MinorOperatingSystemVersion;
90 WORD MajorImageVersion;
91 WORD MinorImageVersion;
92 WORD MajorSubsystemVersion;
93 WORD MinorSubsystemVersion;
99 WORD DllCharacteristics;
100 DWORD SizeOfStackReserve;
101 DWORD SizeOfStackCommit;
102 DWORD SizeOfHeapReserve;
103 DWORD SizeOfHeapCommit;
105 DWORD NumberOfRvaAndSizes;
106 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
107 } IMAGE_OPTIONAL_HEADER,*PIMAGE_OPTIONAL_HEADER;
108 typedef struct _IMAGE_ROM_OPTIONAL_HEADER {
110 BYTE MajorLinkerVersion;
111 BYTE MinorLinkerVersion;
113 DWORD SizeOfInitializedData;
114 DWORD SizeOfUninitializedData;
115 DWORD AddressOfEntryPoint;
122 } IMAGE_ROM_OPTIONAL_HEADER,*PIMAGE_ROM_OPTIONAL_HEADER;
125 typedef struct _IMAGE_DOS_HEADER {
145 } IMAGE_DOS_HEADER,*PIMAGE_DOS_HEADER;
146 typedef struct _IMAGE_OS2_HEADER {
174 WORD ne_psegrefbytes;
177 } IMAGE_OS2_HEADER,*PIMAGE_OS2_HEADER;
180 typedef struct _IMAGE_NT_HEADERS {
182 IMAGE_FILE_HEADER FileHeader;
183 IMAGE_OPTIONAL_HEADER OptionalHeader;
184 } IMAGE_NT_HEADERS,*PIMAGE_NT_HEADERS;
185 typedef struct _IMAGE_ROM_HEADERS {
186 IMAGE_FILE_HEADER FileHeader;
187 IMAGE_ROM_OPTIONAL_HEADER OptionalHeader;
188 } IMAGE_ROM_HEADERS,*PIMAGE_ROM_HEADERS;
189 typedef struct _IMAGE_SECTION_HEADER {
190 BYTE Name[IMAGE_SIZEOF_SHORT_NAME];
192 DWORD PhysicalAddress;
195 DWORD VirtualAddress;
197 DWORD PointerToRawData;
198 DWORD PointerToRelocations;
199 DWORD PointerToLinenumbers;
200 WORD NumberOfRelocations;
201 WORD NumberOfLinenumbers;
202 DWORD Characteristics;
203 } IMAGE_SECTION_HEADER,*PIMAGE_SECTION_HEADER;
206 typedef struct _IMAGE_SYMBOL {
219 BYTE NumberOfAuxSymbols;
220 } IMAGE_SYMBOL,*PIMAGE_SYMBOL;
221 typedef union _IMAGE_AUX_SYMBOL {
233 DWORD PointerToLinenumber;
234 DWORD PointerToNextFunction;
243 BYTE Name[IMAGE_SIZEOF_SYMBOL];
247 WORD NumberOfRelocations;
248 WORD NumberOfLinenumbers;
253 } IMAGE_AUX_SYMBOL,*PIMAGE_AUX_SYMBOL;
254 typedef struct _IMAGE_COFF_SYMBOLS_HEADER {
255 DWORD NumberOfSymbols;
256 DWORD LvaToFirstSymbol;
257 DWORD NumberOfLinenumbers;
258 DWORD LvaToFirstLinenumber;
259 DWORD RvaToFirstByteOfCode;
260 DWORD RvaToLastByteOfCode;
261 DWORD RvaToFirstByteOfData;
262 DWORD RvaToLastByteOfData;
263 } IMAGE_COFF_SYMBOLS_HEADER,*PIMAGE_COFF_SYMBOLS_HEADER;
264 typedef struct _IMAGE_RELOCATION {
265 _ANONYMOUS_UNION union {
266 DWORD VirtualAddress;
269 DWORD SymbolTableIndex;
271 } IMAGE_RELOCATION,*PIMAGE_RELOCATION;
274 typedef struct _IMAGE_BASE_RELOCATION {
275 DWORD VirtualAddress;
277 } IMAGE_BASE_RELOCATION,*PIMAGE_BASE_RELOCATION;
280 typedef struct _IMAGE_LINENUMBER {
282 DWORD SymbolTableIndex;
283 DWORD VirtualAddress;
286 } IMAGE_LINENUMBER,*PIMAGE_LINENUMBER;
289 typedef struct _IMAGE_ARCHIVE_MEMBER_HEADER {
297 } IMAGE_ARCHIVE_MEMBER_HEADER,*PIMAGE_ARCHIVE_MEMBER_HEADER;
298 typedef struct _IMAGE_EXPORT_DIRECTORY {
299 DWORD Characteristics;
305 DWORD NumberOfFunctions;
307 PDWORD *AddressOfFunctions;
308 PDWORD *AddressOfNames;
309 PWORD *AddressOfNameOrdinals;
310 } IMAGE_EXPORT_DIRECTORY,*PIMAGE_EXPORT_DIRECTORY;
311 typedef struct _IMAGE_IMPORT_BY_NAME {
314 } IMAGE_IMPORT_BY_NAME,*PIMAGE_IMPORT_BY_NAME;
315 typedef struct _IMAGE_THUNK_DATA {
317 PBYTE ForwarderString;
320 PIMAGE_IMPORT_BY_NAME AddressOfData;
322 } IMAGE_THUNK_DATA,*PIMAGE_THUNK_DATA;
323 typedef struct _IMAGE_IMPORT_DESCRIPTOR {
324 _ANONYMOUS_UNION union {
325 DWORD Characteristics;
326 PIMAGE_THUNK_DATA OriginalFirstThunk;
329 DWORD ForwarderChain;
331 PIMAGE_THUNK_DATA FirstThunk;
332 } IMAGE_IMPORT_DESCRIPTOR,*PIMAGE_IMPORT_DESCRIPTOR;
333 typedef struct _IMAGE_BOUND_IMPORT_DESCRIPTOR {
335 WORD OffsetModuleName;
336 WORD NumberOfModuleForwarderRefs;
337 } IMAGE_BOUND_IMPORT_DESCRIPTOR,*PIMAGE_BOUND_IMPORT_DESCRIPTOR;
338 typedef struct _IMAGE_BOUND_FORWARDER_REF {
340 WORD OffsetModuleName;
342 } IMAGE_BOUND_FORWARDER_REF,*PIMAGE_BOUND_FORWARDER_REF;
343 typedef void(NTAPI *PIMAGE_TLS_CALLBACK)(PVOID,DWORD,PVOID);
344 typedef struct _IMAGE_TLS_DIRECTORY {
345 DWORD StartAddressOfRawData;
346 DWORD EndAddressOfRawData;
347 PDWORD AddressOfIndex;
348 PIMAGE_TLS_CALLBACK *AddressOfCallBacks;
349 DWORD SizeOfZeroFill;
350 DWORD Characteristics;
351 } IMAGE_TLS_DIRECTORY,*PIMAGE_TLS_DIRECTORY;
352 typedef struct _IMAGE_RESOURCE_DIRECTORY {
353 DWORD Characteristics;
357 WORD NumberOfNamedEntries;
358 WORD NumberOfIdEntries;
359 } IMAGE_RESOURCE_DIRECTORY,*PIMAGE_RESOURCE_DIRECTORY;
360 /*_ANONYMOUS_STRUCT typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY {
361 _ANONYMOUS_UNION union {
362 _ANONYMOUS_STRUCT struct {
364 DWORD NameIsString:1;
369 _ANONYMOUS_UNION union {
371 _ANONYMOUS_STRUCT struct {
372 DWORD OffsetToDirectory:31;
373 DWORD DataIsDirectory:1;
376 } IMAGE_RESOURCE_DIRECTORY_ENTRY,*PIMAGE_RESOURCE_DIRECTORY_ENTRY;
378 typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING {
381 } IMAGE_RESOURCE_DIRECTORY_STRING,*PIMAGE_RESOURCE_DIRECTORY_STRING;
382 typedef struct _IMAGE_RESOURCE_DIR_STRING_U {
385 } IMAGE_RESOURCE_DIR_STRING_U,*PIMAGE_RESOURCE_DIR_STRING_U;
386 typedef struct _IMAGE_RESOURCE_DATA_ENTRY {
391 } IMAGE_RESOURCE_DATA_ENTRY,*PIMAGE_RESOURCE_DATA_ENTRY;
392 typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY {
393 DWORD Characteristics;
397 DWORD GlobalFlagsClear;
398 DWORD GlobalFlagsSet;
399 DWORD CriticalSectionDefaultTimeout;
400 DWORD DeCommitFreeBlockThreshold;
401 DWORD DeCommitTotalFreeThreshold;
402 PVOID LockPrefixTable;
403 DWORD MaximumAllocationSize;
404 DWORD VirtualMemoryThreshold;
405 DWORD ProcessHeapFlags;
407 } IMAGE_LOAD_CONFIG_DIRECTORY,*PIMAGE_LOAD_CONFIG_DIRECTORY;
408 typedef struct _IMAGE_RUNTIME_FUNCTION_ENTRY {
411 PVOID ExceptionHandler;
413 DWORD PrologEndAddress;
414 } IMAGE_RUNTIME_FUNCTION_ENTRY,*PIMAGE_RUNTIME_FUNCTION_ENTRY;
415 typedef struct _IMAGE_DEBUG_DIRECTORY {
416 DWORD Characteristics;
422 DWORD AddressOfRawData;
423 DWORD PointerToRawData;
424 } IMAGE_DEBUG_DIRECTORY,*PIMAGE_DEBUG_DIRECTORY;
425 typedef struct _FPO_DATA {
436 } FPO_DATA,*PFPO_DATA;
437 typedef struct _IMAGE_DEBUG_MISC {
443 } IMAGE_DEBUG_MISC,*PIMAGE_DEBUG_MISC;
444 typedef struct _IMAGE_FUNCTION_ENTRY {
445 DWORD StartingAddress;
448 } IMAGE_FUNCTION_ENTRY,*PIMAGE_FUNCTION_ENTRY;
449 typedef struct _IMAGE_SEPARATE_DEBUG_HEADER {
453 WORD Characteristics;
458 DWORD NumberOfSections;
459 DWORD ExportedNamesSize;
460 DWORD DebugDirectorySize;
462 } IMAGE_SEPARATE_DEBUG_HEADER,*PIMAGE_SEPARATE_DEBUG_HEADER;
465 #define IMAGE_ORDINAL(Ordinal) (Ordinal & 0xffff)
468 // Each directory contains the 32-bit Name of the entry and an offset,
469 // relative to the beginning of the resource directory of the data associated
470 // with this directory entry. If the name of the entry is an actual text
471 // string instead of an integer Id, then the high order bit of the name field
472 // is set to one and the low order 31-bits are an offset, relative to the
473 // beginning of the resource directory of the string, which is of type
474 // IMAGE_RESOURCE_DIRECTORY_STRING. Otherwise the high bit is clear and the
475 // low-order 16-bits are the integer Id that identify this resource directory
476 // entry. If the directory entry is yet another resource directory (i.e. a
477 // subdirectory), then the high order bit of the offset field will be
478 // set to indicate this. Otherwise the high bit is clear and the offset
479 // field points to a resource data entry.
481 typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY {
484 } IMAGE_RESOURCE_DIRECTORY_ENTRY, *PIMAGE_RESOURCE_DIRECTORY_ENTRY;
486 typedef struct _IMAGE_RESOURCE_DIRECTORY {
487 DWORD Characteristics;
491 WORD NumberOfNamedEntries;
492 WORD NumberOfIdEntries;
493 IMAGE_RESOURCE_DIRECTORY_ENTRY DirectoryEntries[0];
494 } IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;
497 #endif /* !__USE_W32API */
499 #define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S))
501 #define IMAGE_SECTION_CHAR_CODE 0x00000020
502 #define IMAGE_SECTION_CHAR_DATA 0x00000040
503 #define IMAGE_SECTION_CHAR_BSS 0x00000080
504 #define IMAGE_SECTION_CHAR_NON_CACHABLE 0x04000000
505 #define IMAGE_SECTION_CHAR_NON_PAGEABLE 0x08000000
506 #define IMAGE_SECTION_CHAR_SHARED 0x10000000
507 #define IMAGE_SECTION_CHAR_EXECUTABLE 0x20000000
508 #define IMAGE_SECTION_CHAR_READABLE 0x40000000
509 #define IMAGE_SECTION_CHAR_WRITABLE 0x80000000
510 #define IMAGE_SECTION_NOLOAD 0x00000002
512 #define IMAGE_DOS_MAGIC 0x5a4d
513 #define IMAGE_PE_MAGIC 0x00004550
515 #define IMAGE_NT_SIGNATURE 0x00004550
518 #define IMAGE_SIZEOF_FILE_HEADER 20
521 #define IMAGE_SUBSYSTEM_UNKNOWN 0
522 #define IMAGE_SUBSYSTEM_NATIVE 1
523 #define IMAGE_SUBSYSTEM_WINDOWS_GUI 2
524 #define IMAGE_SUBSYSTEM_WINDOWS_CUI 3
525 #define IMAGE_SUBSYSTEM_OS2_GUI 4
526 #define IMAGE_SUBSYSTEM_OS2_CUI 5
527 #define IMAGE_SUBSYSTEM_POSIX_GUI 6
528 #define IMAGE_SUBSYSTEM_POSIX_CUI 7
529 #define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI 9
530 #define IMAGE_SUBSYSTEM_EFI_APPLICATION 10
531 #define IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER 11
532 #define IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER 12
533 #define IMAGE_SUBSYSTEM_EFI_ROM 13
534 #define IMAGE_SUBSYSTEM_XBOX 14
539 #define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory
540 #define IMAGE_DIRECTORY_ENTRY_IMPORT 1 // Import Directory
541 #define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 // Resource Directory
542 #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 // Exception Directory
543 #define IMAGE_DIRECTORY_ENTRY_SECURITY 4 // Security Directory
544 #define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 // Base Relocation Table
545 #define IMAGE_DIRECTORY_ENTRY_DEBUG 6 // Debug Directory
546 #define IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // Description String
547 #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 // Machine Value (MIPS GP)
548 #define IMAGE_DIRECTORY_ENTRY_TLS 9 // TLS Directory
549 #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 // Load Configuration Directory
550 #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 // Bound Import Directory in headers
551 #define IMAGE_DIRECTORY_ENTRY_IAT 12 // Import Address
553 // Section header format.
555 #define IMAGE_SIZEOF_FILE_HEADER 20
556 #define IMAGE_FILE_MACHINE_UNKNOWN 0
557 #define IMAGE_NT_SIGNATURE 0x00004550
558 #define IMAGE_NT_OPTIONAL_HDR_MAGIC 0x10b
559 #define IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107
560 #define IMAGE_SEPARATE_DEBUG_SIGNATURE 0x4944
561 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
562 #define IMAGE_SIZEOF_ROM_OPTIONAL_HEADER 56
563 #define IMAGE_SIZEOF_STD_OPTIONAL_HEADER 28
564 #define IMAGE_SIZEOF_NT_OPTIONAL_HEADER 224
565 #define IMAGE_SIZEOF_SECTION_HEADER 40
566 #define IMAGE_SIZEOF_AUX_SYMBOL 18
567 #define IMAGE_SIZEOF_RELOCATION 10
568 #define IMAGE_SIZEOF_BASE_RELOCATION 8
569 #define IMAGE_SIZEOF_LINENUMBER 6
570 #define IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR 60
571 #define SIZEOF_RFPO_DATA 16
572 #define IMAGE_FIRST_SECTION(h) ((PIMAGE_SECTION_HEADER) ((DWORD)h+FIELD_OFFSET(IMAGE_NT_HEADERS,OptionalHeader)+((PIMAGE_NT_HEADERS)(h))->FileHeader.SizeOfOptionalHeader))
573 #define IMAGE_SCN_TYPE_NO_PAD 8
574 #define IMAGE_SCN_CNT_CODE 32
575 #define IMAGE_SCN_CNT_INITIALIZED_DATA 64
576 #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 128
577 #define IMAGE_SCN_LNK_OTHER 256
578 #define IMAGE_SCN_LNK_INFO 512
579 #define IMAGE_SCN_LNK_REMOVE 2048
580 #define IMAGE_SCN_LNK_COMDAT 4096
581 #define IMAGE_SCN_MEM_FARDATA 0x8000
582 #define IMAGE_SCN_MEM_PURGEABLE 0x20000
583 #define IMAGE_SCN_MEM_16BIT 0x20000
584 #define IMAGE_SCN_MEM_LOCKED 0x40000
585 #define IMAGE_SCN_MEM_PRELOAD 0x80000
586 #define IMAGE_SCN_ALIGN_1BYTES 0x100000
587 #define IMAGE_SCN_ALIGN_2BYTES 0x200000
588 #define IMAGE_SCN_ALIGN_4BYTES 0x300000
589 #define IMAGE_SCN_ALIGN_8BYTES 0x400000
590 #define IMAGE_SCN_ALIGN_16BYTES 0x500000
591 #define IMAGE_SCN_ALIGN_32BYTES 0x600000
592 #define IMAGE_SCN_ALIGN_64BYTES 0x700000
593 #define IMAGE_SCN_LNK_NRELOC_OVFL 0x1000000
594 #define IMAGE_SCN_MEM_DISCARDABLE 0x2000000
595 #define IMAGE_SCN_MEM_NOT_CACHED 0x4000000
596 #define IMAGE_SCN_MEM_NOT_PAGED 0x8000000
597 #define IMAGE_SCN_MEM_SHARED 0x10000000
598 #define IMAGE_SCN_MEM_EXECUTE 0x20000000
599 #define IMAGE_SCN_MEM_READ 0x40000000
600 #define IMAGE_SCN_MEM_WRITE 0x80000000
601 #define IMAGE_SYM_UNDEFINED 0
602 #define IMAGE_SYM_ABSOLUTE (-1)
603 #define IMAGE_SYM_DEBUG (-2)
604 #define IMAGE_SYM_TYPE_NULL 0
605 #define IMAGE_SYM_TYPE_VOID 1
606 #define IMAGE_SYM_TYPE_CHAR 2
607 #define IMAGE_SYM_TYPE_SHORT 3
608 #define IMAGE_SYM_TYPE_INT 4
609 #define IMAGE_SYM_TYPE_LONG 5
610 #define IMAGE_SYM_TYPE_FLOAT 6
611 #define IMAGE_SYM_TYPE_DOUBLE 7
612 #define IMAGE_SYM_TYPE_STRUCT 8
613 #define IMAGE_SYM_TYPE_UNION 9
614 #define IMAGE_SYM_TYPE_ENUM 10
615 #define IMAGE_SYM_TYPE_MOE 11
616 #define IMAGE_SYM_TYPE_BYTE 12
617 #define IMAGE_SYM_TYPE_WORD 13
618 #define IMAGE_SYM_TYPE_UINT 14
619 #define IMAGE_SYM_TYPE_DWORD 15
620 #define IMAGE_SYM_TYPE_PCODE 32768
621 #define IMAGE_SYM_DTYPE_NULL 0
622 #define IMAGE_SYM_DTYPE_POINTER 1
623 #define IMAGE_SYM_DTYPE_FUNCTION 2
624 #define IMAGE_SYM_DTYPE_ARRAY 3
625 #define IMAGE_SYM_CLASS_END_OF_FUNCTION (-1)
626 #define IMAGE_SYM_CLASS_NULL 0
627 #define IMAGE_SYM_CLASS_AUTOMATIC 1
628 #define IMAGE_SYM_CLASS_EXTERNAL 2
629 #define IMAGE_SYM_CLASS_STATIC 3
630 #define IMAGE_SYM_CLASS_REGISTER 4
631 #define IMAGE_SYM_CLASS_EXTERNAL_DEF 5
632 #define IMAGE_SYM_CLASS_LABEL 6
633 #define IMAGE_SYM_CLASS_UNDEFINED_LABEL 7
634 #define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT 8
635 #define IMAGE_SYM_CLASS_ARGUMENT 9
636 #define IMAGE_SYM_CLASS_STRUCT_TAG 10
637 #define IMAGE_SYM_CLASS_MEMBER_OF_UNION 11
638 #define IMAGE_SYM_CLASS_UNION_TAG 12
639 #define IMAGE_SYM_CLASS_TYPE_DEFINITION 13
640 #define IMAGE_SYM_CLASS_UNDEFINED_STATIC 14
641 #define IMAGE_SYM_CLASS_ENUM_TAG 15
642 #define IMAGE_SYM_CLASS_MEMBER_OF_ENUM 16
643 #define IMAGE_SYM_CLASS_REGISTER_PARAM 17
644 #define IMAGE_SYM_CLASS_BIT_FIELD 18
645 #define IMAGE_SYM_CLASS_FAR_EXTERNAL 68
646 #define IMAGE_SYM_CLASS_BLOCK 100
647 #define IMAGE_SYM_CLASS_FUNCTION 101
648 #define IMAGE_SYM_CLASS_END_OF_STRUCT 102
649 #define IMAGE_SYM_CLASS_FILE 103
650 #define IMAGE_SYM_CLASS_SECTION 104
651 #define IMAGE_SYM_CLASS_WEAK_EXTERNAL 105
652 #define IMAGE_COMDAT_SELECT_NODUPLICATES 1
653 #define IMAGE_COMDAT_SELECT_ANY 2
654 #define IMAGE_COMDAT_SELECT_SAME_SIZE 3
655 #define IMAGE_COMDAT_SELECT_EXACT_MATCH 4
656 #define IMAGE_COMDAT_SELECT_ASSOCIATIVE 5
657 #define IMAGE_COMDAT_SELECT_LARGEST 6
658 #define IMAGE_COMDAT_SELECT_NEWEST 7
659 #define IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY 1
660 #define IMAGE_WEAK_EXTERN_SEARCH_LIBRARY 2
661 #define IMAGE_WEAK_EXTERN_SEARCH_ALIAS 3
662 #define IMAGE_REL_I386_ABSOLUTE 0
663 #define IMAGE_REL_I386_DIR16 1
664 #define IMAGE_REL_I386_REL16 2
665 #define IMAGE_REL_I386_DIR32 6
666 #define IMAGE_REL_I386_DIR32NB 7
667 #define IMAGE_REL_I386_SEG12 9
668 #define IMAGE_REL_I386_SECTION 10
669 #define IMAGE_REL_I386_SECREL 11
670 #define IMAGE_REL_I386_REL32 20
671 #define IMAGE_REL_MIPS_ABSOLUTE 0
672 #define IMAGE_REL_MIPS_REFHALF 1
673 #define IMAGE_REL_MIPS_REFWORD 2
674 #define IMAGE_REL_MIPS_JMPADDR 3
675 #define IMAGE_REL_MIPS_REFHI 4
676 #define IMAGE_REL_MIPS_REFLO 5
677 #define IMAGE_REL_MIPS_GPREL 6
678 #define IMAGE_REL_MIPS_LITERAL 7
679 #define IMAGE_REL_MIPS_SECTION 10
680 #define IMAGE_REL_MIPS_SECREL 11
681 #define IMAGE_REL_MIPS_SECRELLO 12
682 #define IMAGE_REL_MIPS_SECRELHI 13
683 #define IMAGE_REL_MIPS_REFWORDNB 34
684 #define IMAGE_REL_MIPS_PAIR 35
685 #define IMAGE_REL_ALPHA_ABSOLUTE 0
686 #define IMAGE_REL_ALPHA_REFLONG 1
687 #define IMAGE_REL_ALPHA_REFQUAD 2
688 #define IMAGE_REL_ALPHA_GPREL32 3
689 #define IMAGE_REL_ALPHA_LITERAL 4
690 #define IMAGE_REL_ALPHA_LITUSE 5
691 #define IMAGE_REL_ALPHA_GPDISP 6
692 #define IMAGE_REL_ALPHA_BRADDR 7
693 #define IMAGE_REL_ALPHA_HINT 8
694 #define IMAGE_REL_ALPHA_INLINE_REFLONG 9
695 #define IMAGE_REL_ALPHA_REFHI 10
696 #define IMAGE_REL_ALPHA_REFLO 11
697 #define IMAGE_REL_ALPHA_PAIR 12
698 #define IMAGE_REL_ALPHA_MATCH 13
699 #define IMAGE_REL_ALPHA_SECTION 14
700 #define IMAGE_REL_ALPHA_SECREL 15
701 #define IMAGE_REL_ALPHA_REFLONGNB 16
702 #define IMAGE_REL_ALPHA_SECRELLO 17
703 #define IMAGE_REL_ALPHA_SECRELHI 18
704 #define IMAGE_REL_PPC_ABSOLUTE 0
705 #define IMAGE_REL_PPC_ADDR64 1
706 #define IMAGE_REL_PPC_ADDR32 2
707 #define IMAGE_REL_PPC_ADDR24 3
708 #define IMAGE_REL_PPC_ADDR16 4
709 #define IMAGE_REL_PPC_ADDR14 5
710 #define IMAGE_REL_PPC_REL24 6
711 #define IMAGE_REL_PPC_REL14 7
712 #define IMAGE_REL_PPC_TOCREL16 8
713 #define IMAGE_REL_PPC_TOCREL14 9
714 #define IMAGE_REL_PPC_ADDR32NB 10
715 #define IMAGE_REL_PPC_SECREL 11
716 #define IMAGE_REL_PPC_SECTION 12
717 #define IMAGE_REL_PPC_IFGLUE 13
718 #define IMAGE_REL_PPC_IMGLUE 14
719 #define IMAGE_REL_PPC_SECREL16 15
720 #define IMAGE_REL_PPC_REFHI 16
721 #define IMAGE_REL_PPC_REFLO 17
722 #define IMAGE_REL_PPC_PAIR 18
723 #define IMAGE_REL_PPC_TYPEMASK 255
724 #define IMAGE_REL_PPC_NEG 256
725 #define IMAGE_REL_PPC_BRTAKEN 512
726 #define IMAGE_REL_PPC_BRNTAKEN 1024
727 #define IMAGE_REL_PPC_TOCDEFN 2048
728 #define IMAGE_REL_BASED_ABSOLUTE 0
729 #define IMAGE_REL_BASED_HIGH 1
730 #define IMAGE_REL_BASED_LOW 2
731 #define IMAGE_REL_BASED_HIGHLOW 3
732 #define IMAGE_REL_BASED_HIGHADJ 4
733 #define IMAGE_REL_BASED_MIPS_JMPADDR 5
734 #define IMAGE_ARCHIVE_START_SIZE 8
735 #define IMAGE_ARCHIVE_START "!<arch>\n"
736 #define IMAGE_ARCHIVE_END "`\n"
737 #define IMAGE_ARCHIVE_PAD "\n"
738 #define IMAGE_ARCHIVE_LINKER_MEMBER "/ "
739 #define IMAGE_ARCHIVE_LONGNAMES_MEMBER "// "
740 #define IMAGE_ORDINAL_FLAG 0x80000000
741 #define IMAGE_SNAP_BY_ORDINAL(o) ((o&IMAGE_ORDINAL_FLAG)!=0)
742 #define IMAGE_RESOURCE_NAME_IS_STRING 0x80000000
743 #define IMAGE_RESOURCE_DATA_IS_DIRECTORY 0x80000000
744 #define IMAGE_DEBUG_TYPE_UNKNOWN 0
745 #define IMAGE_DEBUG_TYPE_COFF 1
746 #define IMAGE_DEBUG_TYPE_CODEVIEW 2
747 #define IMAGE_DEBUG_TYPE_FPO 3
748 #define IMAGE_DEBUG_TYPE_MISC 4
749 #define IMAGE_DEBUG_TYPE_EXCEPTION 5
750 #define IMAGE_DEBUG_TYPE_FIXUP 6
751 #define IMAGE_DEBUG_TYPE_OMAP_TO_SRC 7
752 #define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC 8
755 #define IMAGE_SIZEOF_SHORT_NAME 8
757 #define IMAGE_SIZEOF_SECTION_HEADER 40
759 #define IMAGE_SECTION_CODE (0x20)
760 #define IMAGE_SECTION_INITIALIZED_DATA (0x40)
761 #define IMAGE_SECTION_UNINITIALIZED_DATA (0x80)
767 #define IMAGE_ORDINAL_FLAG 0x80000000
770 // Predefined resource types ... there may be some more, but I don't have
771 // the information yet. .....sang cho.....
773 #define RT_NEWRESOURCE 0x2000
774 #define RT_ERROR 0x7fff
775 #define NEWBITMAP (RT_BITMAP|RT_NEWRESOURCE)
776 #define NEWMENU (RT_MENU|RT_NEWRESOURCE)
777 #define NEWDIALOG (RT_DIALOG|RT_NEWRESOURCE)
785 // Resource directory consists of two counts, following by a variable length
786 // array of directory entries. The first count is the number of entries at
787 // beginning of the array that have actual names associated with each entry.
788 // The entries are in ascending order, case insensitive strings. The second
789 // count is the number of entries that immediately follow the named entries.
790 // This second count identifies the number of entries that have 16-bit integer
791 // Ids as their name. These entries are also sorted in ascending order.
793 // This structure allows fast lookup by either name or number, but for any
794 // given resource entry only one form of lookup is supported, not both.
795 // This is consistant with the syntax of the .RC file and the .RES file.
799 #define IMAGE_RESOURCE_NAME_IS_STRING 0x80000000
800 #define IMAGE_RESOURCE_DATA_IS_DIRECTORY 0x80000000
805 // For resource directory entries that have actual string names, the Name
806 // field of the directory entry points to an object of the following type.
807 // All of these string objects are stored together after the last resource
808 // directory entry and before the first resource data object. This minimizes
809 // the impact of these variable length objects on the alignment of the fixed
810 // size directory entry objects.
812 /* defined above from mingw. ei
813 typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING {
815 CHAR NameString[ 1 ];
816 } IMAGE_RESOURCE_DIRECTORY_STRING, *PIMAGE_RESOURCE_DIRECTORY_STRING;
819 typedef struct _IMAGE_RESOURCE_DIR_STRING_U {
821 WCHAR NameString[ 1 ];
822 } IMAGE_RESOURCE_DIR_STRING_U, *PIMAGE_RESOURCE_DIR_STRING_U;
826 // Each resource data entry describes a leaf node in the resource directory
827 // tree. It contains an offset, relative to the beginning of the resource
828 // directory of the data for the resource, a size field that gives the number
829 // of bytes of data at that offset, a CodePage that should be used when
830 // decoding code point values within the resource data. Typically for new
831 // applications the code page would be the unicode code page.
834 typedef struct _IMAGE_RESOURCE_DATA_ENTRY {
839 } IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;
842 // Menu Resources ... added by .....sang cho....
844 // Menu resources are composed of a menu header followed by a sequential list
845 // of menu items. There are two types of menu items: pop-ups and normal menu
846 // itmes. The MENUITEM SEPARATOR is a special case of a normal menu item with
847 // an empty name, zero ID, and zero flags.
849 typedef struct _IMAGE_MENU_HEADER{
850 WORD wVersion; // Currently zero
851 WORD cbHeaderSize; // Also zero
852 } IMAGE_MENU_HEADER, *PIMAGE_MENU_HEADER;
854 typedef struct _IMAGE_POPUP_MENU_ITEM{
857 } IMAGE_POPUP_MENU_ITEM, *PIMAGE_POPUP_MENU_ITEM;
859 typedef struct _IMAGE_NORMAL_MENU_ITEM{
863 } IMAGE_NORMAL_MENU_ITEM, *PIMAGE_NORMAL_MENU_ITEM;
865 #define MI_GRAYED 0x0001 // GRAYED keyword
866 #define MI_INACTIVE 0x0002 // INACTIVE keyword
867 #define MI_BITMAP 0x0004 // BITMAP keyword
868 #define MI_OWNERDRAW 0x0100 // OWNERDRAW keyword
869 #define MI_CHECKED 0x0008 // CHECKED keyword
870 #define MI_POPUP 0x0010 // used internally
871 #define MI_MENUBARBREAK 0x0020 // MENUBARBREAK keyword
872 #define MI_MENUBREAK 0x0040 // MENUBREAK keyword
873 #define MI_ENDMENU 0x0080 // used internally
875 // Dialog Box Resources .................. added by sang cho.
877 // A dialog box is contained in a single resource and has a header and
878 // a portion repeated for each control in the dialog box.
879 // The item DWORD IStyle is a standard window style composed of flags found
881 // The default style for a dialog box is:
882 // WS_POPUP | WS_BORDER | WS_SYSMENU
884 // The itme marked "Name or Ordinal" are :
885 // If the first word is an 0xffff, the next two bytes contain an ordinal ID.
886 // Otherwise, the first one or more WORDS contain a double-null-terminated string.
887 // An empty string is represented by a single WORD zero in the first location.
889 // The WORD wPointSize and WCHAR szFontName entries are present if the FONT
890 // statement was included for the dialog box. This can be detected by checking
891 // the entry IStyle. If IStyle & DS_SETFONT ( which is 0x40), then these
892 // entries will be present.
894 typedef struct _IMAGE_DIALOG_BOX_HEADER1{
896 DWORD IExtendedStyle; // New for Windows NT
897 WORD nControls; // Number of Controls
902 // N_OR_O MenuName; // Name or Ordinal ID
903 // N_OR_O ClassName; // Name or Ordinal ID
904 // WCHAR szCaption[];
905 // WORD wPointSize; // Only here if FONT set for dialog
906 // WCHAR szFontName[]; // This too
907 } IMAGE_DIALOG_HEADER, *PIMAGE_DIALOG_HEADER;
909 typedef union _NAME_OR_ORDINAL{ // Name or Ordinal ID
915 } NAME_OR_ORDINAL, *PNAME_OR_ORDINAL;
917 // The data for each control starts on a DWORD boundary (which may require
918 // some padding from the previous control), and its format is as follows:
920 typedef struct _IMAGE_CONTROL_DATA{
922 DWORD IExtendedStyle;
931 } IMAGE_CONTROL_DATA, *PIMAGE_CONTROL_DATA;
935 //#define STATIC 0x82
937 #define SCROLLBAR 0x84
938 #define COMBOBOX 0x85
940 // The various statements used in a dialog script are all mapped to these
941 // classes along with certain modifying styles. The values for these styles
942 // can be found in WINDOWS.H. All dialog controls have the default styles
943 // of WS_CHILD and WS_VISIBLE. A list of the default styles used follows:
945 // Statement Default Class Default Styles
946 // CONTROL None WS_CHILD|WS_VISIBLE
947 // LTEXT STATIC ES_LEFT
948 // RTEXT STATIC ES_RIGHT
949 // CTEXT STATIC ES_CENTER
950 // LISTBOX LISTBOX WS_BORDER|LBS_NOTIFY
951 // CHECKBOX BUTTON BS_CHECKBOX|WS_TABSTOP
952 // PUSHBUTTON BUTTON BS_PUSHBUTTON|WS_TABSTOP
953 // GROUPBOX BUTTON BS_GROUPBOX
954 // DEFPUSHBUTTON BUTTON BS_DFPUSHBUTTON|WS_TABSTOP
955 // RADIOBUTTON BUTTON BS_RADIOBUTTON
956 // AUTOCHECKBOX BUTTON BS_AUTOCHECKBOX
957 // AUTO3STATE BUTTON BS_AUTO3STATE
958 // AUTORADIOBUTTON BUTTON BS_AUTORADIOBUTTON
959 // PUSHBOX BUTTON BS_PUSHBOX
960 // STATE3 BUTTON BS_3STATE
961 // EDITTEXT EDIT ES_LEFT|WS_BORDER|WS_TABSTOP
962 // COMBOBOX COMBOBOX None
963 // ICON STATIC SS_ICON
964 // SCROLLBAR SCROLLBAR None
967 #define IMAGE_DEBUG_TYPE_UNKNOWN 0
968 #define IMAGE_DEBUG_TYPE_COFF 1
969 #define IMAGE_DEBUG_TYPE_CODEVIEW 2
970 #define IMAGE_DEBUG_TYPE_FPO 3
971 #define IMAGE_DEBUG_TYPE_MISC 4
972 #define IMAGE_DEBUG_TYPE_EXCEPTION 5
973 #define IMAGE_DEBUG_TYPE_FIXUP 6
974 #define IMAGE_DEBUG_TYPE_OMAP_TO_SRC 7
975 #define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC 8
980 // Debugging information can be stripped from an image file and placed
981 // in a separate .DBG file, whose file name part is the same as the
982 // image file name part (e.g. symbols for CMD.EXE could be stripped
983 // and placed in CMD.DBG). This is indicated by the IMAGE_FILE_DEBUG_STRIPPED
984 // flag in the Characteristics field of the file header. The beginning of
985 // the .DBG file contains the following structure which captures certain
986 // information from the image file. This allows a debug to proceed even if
987 // the original image file is not accessable. This header is followed by
988 // zero of more IMAGE_SECTION_HEADER structures, followed by zero or more
989 // IMAGE_DEBUG_DIRECTORY structures. The latter structures and those in
990 // the image file contain file offsets relative to the beginning of the
993 // If symbols have been stripped from an image, the IMAGE_DEBUG_MISC structure
994 // is left in the image file, but not mapped. This allows a debugger to
995 // compute the name of the .DBG file, from the name of the image in the
996 // IMAGE_DEBUG_MISC structure.
999 typedef struct _IMAGE_SEPARATE_DEBUG_HEADER {
1003 WORD Characteristics;
1004 DWORD TimeDateStamp;
1008 DWORD NumberOfSections;
1009 DWORD ExportedNamesSize;
1010 DWORD DebugDirectorySize;
1011 DWORD SectionAlignment;
1013 } IMAGE_SEPARATE_DEBUG_HEADER, *PIMAGE_SEPARATE_DEBUG_HEADER;
1015 #define IMAGE_SEPARATE_DEBUG_SIGNATURE 0x4944
1017 #define IMAGE_SEPARATE_DEBUG_FLAGS_MASK 0x8000
1018 #define IMAGE_SEPARATE_DEBUG_MISMATCH 0x8000 // when DBG was updated, the
1019 // old checksum didn't match.
1025 #define SIZE_OF_NT_SIGNATURE sizeof (DWORD)
1026 #define MAXRESOURCENAME 13
1028 /* global macros to define header offsets into file */
1029 /* offset to PE file signature */
1030 #define NTSIGNATURE(a) ((LPVOID)((BYTE *)a + \
1031 ((PIMAGE_DOS_HEADER)a)->e_lfanew))
1033 /* DOS header identifies the NT PEFile signature dword
1034 the PEFILE header exists just after that dword */
1035 #define PEFHDROFFSET(a) ((LPVOID)((BYTE *)a + \
1036 ((PIMAGE_DOS_HEADER)a)->e_lfanew + \
1037 SIZE_OF_NT_SIGNATURE))
1039 /* PE optional header is immediately after PEFile header */
1040 #define OPTHDROFFSET(a) ((LPVOID)((BYTE *)a + \
1041 ((PIMAGE_DOS_HEADER)a)->e_lfanew + \
1042 SIZE_OF_NT_SIGNATURE + \
1043 sizeof (IMAGE_FILE_HEADER)))
1045 /* section headers are immediately after PE optional header */
1046 #define SECHDROFFSET(a) ((LPVOID)((BYTE *)a + \
1047 ((PIMAGE_DOS_HEADER)a)->e_lfanew + \
1048 SIZE_OF_NT_SIGNATURE + \
1049 sizeof (IMAGE_FILE_HEADER) + \
1050 sizeof (IMAGE_OPTIONAL_HEADER)))
1052 //#define FIELD_OFFSET(type, field) ((LONG)(LONG_PTR)&(((type *)0)->field))
1054 #define IMAGE_FIRST_SECTION( ntheader ) ((PIMAGE_SECTION_HEADER) \
1055 ((ULONG_PTR)ntheader + \
1056 FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) + \
1057 ((PIMAGE_NT_HEADERS)(ntheader))->FileHeader.SizeOfOptionalHeader \
1061 #define MakePtr( cast, ptr, addValue ) (cast)( (DWORD)(ptr) + (DWORD)(addValue))
1063 typedef struct _IMAGE_IMPORT_MODULE_DIRECTORY
1065 DWORD dwRVAFunctionNameList;
1068 DWORD dwRVAModuleName;
1069 DWORD dwRVAFunctionAddressList;
1070 } IMAGE_IMPORT_MODULE_DIRECTORY, *PIMAGE_IMPORT_MODULE_DIRECTORY;
1072 typedef struct _RELOCATION_DIRECTORY
1074 DWORD VirtualAddress; /* adresse virtuelle du bloc ou se font les relocations */
1075 DWORD SizeOfBlock; // taille de cette structure + des structures
1076 // relocation_entry qui suivent (ces dernieres sont
1077 // donc au nombre de (SizeOfBlock-8)/2
1078 } RELOCATION_DIRECTORY, *PRELOCATION_DIRECTORY;
1080 typedef struct _RELOCATION_ENTRY
1083 // (TypeOffset >> 12) est le type
1084 // (TypeOffset&0xfff) est l'offset dans le bloc
1085 } RELOCATION_ENTRY, *PRELOCATION_ENTRY;
1087 #define TYPE_RELOC_ABSOLUTE 0
1088 #define TYPE_RELOC_HIGH 1
1089 #define TYPE_RELOC_LOW 2
1090 #define TYPE_RELOC_HIGHLOW 3
1091 #define TYPE_RELOC_HIGHADJ 4
1092 #define TYPE_RELOC_MIPS_JMPADDR 5
1094 #endif /* __INCLUDE_PE_H */