PEStructs.h File Reference

#include "NativeEnums.h"
#include <ntifs.h>

Go to the source code of this file.

Data Structures
struct	_IMAGE_DOS_HEADER
struct	_IMAGE_SECTION_HEADER
struct	_IMAGE_FILE_HEADER
struct	_IMAGE_DATA_DIRECTORY
struct	_IMAGE_OPTIONAL_HEADER64
struct	_IMAGE_OPTIONAL_HEADER32
struct	_IMAGE_NT_HEADERS64
struct	_IMAGE_NT_HEADERS
struct	_IMAGE_EXPORT_DIRECTORY
struct	_IMAGE_BASE_RELOCATION
struct	_IMAGE_IMPORT_BY_NAME
struct	_IMAGE_IMPORT_DESCRIPTOR
struct	_IMAGE_THUNK_DATA64
struct	_IMAGE_THUNK_DATA32

Macros
#define	IMAGE_DOS_SIGNATURE   0x5A4D
#define	IMAGE_NT_SIGNATURE   0x00004550
#define	IMAGE_NT_OPTIONAL_HDR32_MAGIC   0x10b
#define	IMAGE_NT_OPTIONAL_HDR64_MAGIC   0x20b
#define	IMAGE_NUMBEROF_DIRECTORY_ENTRIES   16
#define	IMAGE_DIRECTORY_ENTRY_EXPORT   0
#define	IMAGE_DIRECTORY_ENTRY_IMPORT   1
#define	IMAGE_DIRECTORY_ENTRY_RESOURCE   2
#define	IMAGE_DIRECTORY_ENTRY_EXCEPTION   3
#define	IMAGE_DIRECTORY_ENTRY_SECURITY   4
#define	IMAGE_DIRECTORY_ENTRY_BASERELOC   5
#define	IMAGE_DIRECTORY_ENTRY_DEBUG   6
#define	IMAGE_DIRECTORY_ENTRY_ARCHITECTURE   7
#define	IMAGE_DIRECTORY_ENTRY_GLOBALPTR   8
#define	IMAGE_DIRECTORY_ENTRY_TLS   9
#define	IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG   10
#define	IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   11
#define	IMAGE_DIRECTORY_ENTRY_IAT   12
#define	IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   13
#define	IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR   14
#define	IMAGE_REL_BASED_ABSOLUTE   0
#define	IMAGE_REL_BASED_HIGH   1
#define	IMAGE_REL_BASED_LOW   2
#define	IMAGE_REL_BASED_HIGHLOW   3
#define	IMAGE_REL_BASED_HIGHADJ   4
#define	IMAGE_REL_BASED_MIPS_JMPADDR   5
#define	IMAGE_REL_BASED_SECTION   6
#define	IMAGE_REL_BASED_REL32   7
#define	IMAGE_REL_BASED_MIPS_JMPADDR16   9
#define	IMAGE_REL_BASED_IA64_IMM64   9
#define	IMAGE_REL_BASED_DIR64   10
#define	IMAGE_SIZEOF_BASE_RELOCATION   8
#define	IMAGE_FILE_RELOCS_STRIPPED   0x0001
#define	IMAGE_FILE_EXECUTABLE_IMAGE   0x0002
#define	IMAGE_FILE_LINE_NUMS_STRIPPED   0x0004
#define	IMAGE_FILE_LOCAL_SYMS_STRIPPED   0x0008
#define	IMAGE_FILE_AGGRESIVE_WS_TRIM   0x0010
#define	IMAGE_FILE_LARGE_ADDRESS_AWARE   0x0020
#define	IMAGE_FILE_BYTES_REVERSED_LO   0x0080
#define	IMAGE_FILE_32BIT_MACHINE   0x0100
#define	IMAGE_FILE_DEBUG_STRIPPED   0x0200
#define	IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP   0x0400
#define	IMAGE_FILE_NET_RUN_FROM_SWAP   0x0800
#define	IMAGE_FILE_SYSTEM   0x1000
#define	IMAGE_FILE_DLL   0x2000
#define	IMAGE_FILE_UP_SYSTEM_ONLY   0x4000
#define	IMAGE_FILE_BYTES_REVERSED_HI   0x8000
#define	IMAGE_FILE_MACHINE_UNKNOWN   0
#define	IMAGE_FILE_MACHINE_I386   0x014c
#define	IMAGE_FILE_MACHINE_R3000   0x0162
#define	IMAGE_FILE_MACHINE_R4000   0x0166
#define	IMAGE_FILE_MACHINE_R10000   0x0168
#define	IMAGE_FILE_MACHINE_WCEMIPSV2   0x0169
#define	IMAGE_FILE_MACHINE_ALPHA   0x0184
#define	IMAGE_FILE_MACHINE_SH3   0x01a2
#define	IMAGE_FILE_MACHINE_SH3DSP   0x01a3
#define	IMAGE_FILE_MACHINE_SH3E   0x01a4
#define	IMAGE_FILE_MACHINE_SH4   0x01a6
#define	IMAGE_FILE_MACHINE_SH5   0x01a8
#define	IMAGE_FILE_MACHINE_ARM   0x01c0
#define	IMAGE_FILE_MACHINE_THUMB   0x01c2
#define	IMAGE_FILE_MACHINE_ARMNT   0x01c4
#define	IMAGE_FILE_MACHINE_AM33   0x01d3
#define	IMAGE_FILE_MACHINE_POWERPC   0x01F0
#define	IMAGE_FILE_MACHINE_POWERPCFP   0x01f1
#define	IMAGE_FILE_MACHINE_IA64   0x0200
#define	IMAGE_FILE_MACHINE_MIPS16   0x0266
#define	IMAGE_FILE_MACHINE_ALPHA64   0x0284
#define	IMAGE_FILE_MACHINE_MIPSFPU   0x0366
#define	IMAGE_FILE_MACHINE_MIPSFPU16   0x0466
#define	IMAGE_FILE_MACHINE_AXP64   IMAGE_FILE_MACHINE_ALPHA64
#define	IMAGE_FILE_MACHINE_TRICORE   0x0520
#define	IMAGE_FILE_MACHINE_CEF   0x0CEF
#define	IMAGE_FILE_MACHINE_EBC   0x0EBC
#define	IMAGE_FILE_MACHINE_AMD64   0x8664
#define	IMAGE_FILE_MACHINE_M32R   0x9041
#define	IMAGE_FILE_MACHINE_CEE   0xC0EE
#define	IMAGE_ORDINAL_FLAG64   0x8000000000000000
#define	IMAGE_ORDINAL_FLAG32   0x80000000
#define	IMAGE_ORDINAL64(Ordinal)   (Ordinal & 0xffff)
#define	IMAGE_ORDINAL32(Ordinal)   (Ordinal & 0xffff)
#define	IMAGE_SNAP_BY_ORDINAL64(Ordinal)   ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
#define	IMAGE_SNAP_BY_ORDINAL32(Ordinal)   ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
#define	IMAGE_SCN_TYPE_NO_PAD   0x00000008
#define	IMAGE_SCN_CNT_CODE   0x00000020
#define	IMAGE_SCN_CNT_INITIALIZED_DATA   0x00000040
#define	IMAGE_SCN_CNT_UNINITIALIZED_DATA   0x00000080
#define	IMAGE_SCN_LNK_OTHER   0x00000100
#define	IMAGE_SCN_LNK_INFO   0x00000200
#define	IMAGE_SCN_LNK_REMOVE   0x00000800
#define	IMAGE_SCN_LNK_COMDAT   0x00001000
#define	IMAGE_SCN_NO_DEFER_SPEC_EXC   0x00004000
#define	IMAGE_SCN_GPREL   0x00008000
#define	IMAGE_SCN_MEM_FARDATA   0x00008000
#define	IMAGE_SCN_MEM_PURGEABLE   0x00020000
#define	IMAGE_SCN_MEM_16BIT   0x00020000
#define	IMAGE_SCN_MEM_LOCKED   0x00040000
#define	IMAGE_SCN_MEM_PRELOAD   0x00080000
#define	IMAGE_SCN_ALIGN_1BYTES   0x00100000
#define	IMAGE_SCN_ALIGN_2BYTES   0x00200000
#define	IMAGE_SCN_ALIGN_4BYTES   0x00300000
#define	IMAGE_SCN_ALIGN_8BYTES   0x00400000
#define	IMAGE_SCN_ALIGN_16BYTES   0x00500000
#define	IMAGE_SCN_ALIGN_32BYTES   0x00600000
#define	IMAGE_SCN_ALIGN_64BYTES   0x00700000
#define	IMAGE_SCN_ALIGN_128BYTES   0x00800000
#define	IMAGE_SCN_ALIGN_256BYTES   0x00900000
#define	IMAGE_SCN_ALIGN_512BYTES   0x00A00000
#define	IMAGE_SCN_ALIGN_1024BYTES   0x00B00000
#define	IMAGE_SCN_ALIGN_2048BYTES   0x00C00000
#define	IMAGE_SCN_ALIGN_4096BYTES   0x00D00000
#define	IMAGE_SCN_ALIGN_8192BYTES   0x00E00000
#define	IMAGE_SCN_ALIGN_MASK   0x00F00000
#define	IMAGE_SCN_LNK_NRELOC_OVFL   0x01000000
#define	IMAGE_SCN_MEM_DISCARDABLE   0x02000000
#define	IMAGE_SCN_MEM_NOT_CACHED   0x04000000
#define	IMAGE_SCN_MEM_NOT_PAGED   0x08000000
#define	IMAGE_SCN_MEM_SHARED   0x10000000
#define	IMAGE_SCN_MEM_EXECUTE   0x20000000
#define	IMAGE_SCN_MEM_READ   0x40000000
#define	IMAGE_SCN_MEM_WRITE   0x80000000

Typedefs
typedef struct _IMAGE_DOS_HEADER	IMAGE_DOS_HEADER
typedef struct _IMAGE_DOS_HEADER *	PIMAGE_DOS_HEADER
typedef struct _IMAGE_SECTION_HEADER	IMAGE_SECTION_HEADER
typedef struct _IMAGE_SECTION_HEADER *	PIMAGE_SECTION_HEADER
typedef struct _IMAGE_FILE_HEADER	IMAGE_FILE_HEADER
typedef struct _IMAGE_FILE_HEADER *	PIMAGE_FILE_HEADER
typedef struct _IMAGE_DATA_DIRECTORY	IMAGE_DATA_DIRECTORY
typedef struct _IMAGE_DATA_DIRECTORY *	PIMAGE_DATA_DIRECTORY
typedef struct _IMAGE_OPTIONAL_HEADER64	IMAGE_OPTIONAL_HEADER64
typedef struct _IMAGE_OPTIONAL_HEADER64 *	PIMAGE_OPTIONAL_HEADER64
typedef struct _IMAGE_OPTIONAL_HEADER32	IMAGE_OPTIONAL_HEADER32
typedef struct _IMAGE_OPTIONAL_HEADER32 *	PIMAGE_OPTIONAL_HEADER32
typedef struct _IMAGE_NT_HEADERS64	IMAGE_NT_HEADERS64
typedef struct _IMAGE_NT_HEADERS64 *	PIMAGE_NT_HEADERS64
typedef struct _IMAGE_EXPORT_DIRECTORY	IMAGE_EXPORT_DIRECTORY
typedef struct _IMAGE_EXPORT_DIRECTORY *	PIMAGE_EXPORT_DIRECTORY
typedef struct _IMAGE_BASE_RELOCATION	IMAGE_BASE_RELOCATION
typedef IMAGE_BASE_RELOCATION UNALIGNED *	PIMAGE_BASE_RELOCATION
typedef struct _IMAGE_IMPORT_BY_NAME	IMAGE_IMPORT_BY_NAME
typedef struct _IMAGE_IMPORT_BY_NAME *	PIMAGE_IMPORT_BY_NAME
typedef struct _IMAGE_IMPORT_DESCRIPTOR	IMAGE_IMPORT_DESCRIPTOR
typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *	PIMAGE_IMPORT_DESCRIPTOR
typedef struct _IMAGE_THUNK_DATA64	IMAGE_THUNK_DATA64
typedef IMAGE_THUNK_DATA64 *	PIMAGE_THUNK_DATA64
typedef struct _IMAGE_THUNK_DATA32	IMAGE_THUNK_DATA32
typedef IMAGE_THUNK_DATA32 *	PIMAGE_THUNK_DATA32

Macro Definition Documentation

#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE   7

#define IMAGE_DIRECTORY_ENTRY_BASERELOC   5

#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   11

#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR   14

#define IMAGE_DIRECTORY_ENTRY_DEBUG   6

#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   13

#define IMAGE_DIRECTORY_ENTRY_EXCEPTION   3

#define IMAGE_DIRECTORY_ENTRY_EXPORT   0

#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR   8

#define IMAGE_DIRECTORY_ENTRY_IAT   12

#define IMAGE_DIRECTORY_ENTRY_IMPORT   1

#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG   10

#define IMAGE_DIRECTORY_ENTRY_RESOURCE   2

#define IMAGE_DIRECTORY_ENTRY_SECURITY   4

#define IMAGE_DIRECTORY_ENTRY_TLS   9

#define IMAGE_DOS_SIGNATURE   0x5A4D

#define IMAGE_FILE_32BIT_MACHINE   0x0100

#define IMAGE_FILE_AGGRESIVE_WS_TRIM   0x0010

#define IMAGE_FILE_BYTES_REVERSED_HI   0x8000

#define IMAGE_FILE_BYTES_REVERSED_LO   0x0080

#define IMAGE_FILE_DEBUG_STRIPPED   0x0200

#define IMAGE_FILE_DLL   0x2000

#define IMAGE_FILE_EXECUTABLE_IMAGE   0x0002

#define IMAGE_FILE_LARGE_ADDRESS_AWARE   0x0020

#define IMAGE_FILE_LINE_NUMS_STRIPPED   0x0004

#define IMAGE_FILE_LOCAL_SYMS_STRIPPED   0x0008

#define IMAGE_FILE_MACHINE_ALPHA   0x0184

#define IMAGE_FILE_MACHINE_ALPHA64   0x0284

#define IMAGE_FILE_MACHINE_AM33   0x01d3

#define IMAGE_FILE_MACHINE_AMD64   0x8664

#define IMAGE_FILE_MACHINE_ARM   0x01c0

#define IMAGE_FILE_MACHINE_ARMNT   0x01c4

#define IMAGE_FILE_MACHINE_AXP64   IMAGE_FILE_MACHINE_ALPHA64

#define IMAGE_FILE_MACHINE_CEE   0xC0EE

#define IMAGE_FILE_MACHINE_CEF   0x0CEF

#define IMAGE_FILE_MACHINE_EBC   0x0EBC

#define IMAGE_FILE_MACHINE_I386   0x014c

#define IMAGE_FILE_MACHINE_IA64   0x0200

#define IMAGE_FILE_MACHINE_M32R   0x9041

#define IMAGE_FILE_MACHINE_MIPS16   0x0266

#define IMAGE_FILE_MACHINE_MIPSFPU   0x0366

#define IMAGE_FILE_MACHINE_MIPSFPU16   0x0466

#define IMAGE_FILE_MACHINE_POWERPC   0x01F0

#define IMAGE_FILE_MACHINE_POWERPCFP   0x01f1

#define IMAGE_FILE_MACHINE_R10000   0x0168

#define IMAGE_FILE_MACHINE_R3000   0x0162

#define IMAGE_FILE_MACHINE_R4000   0x0166

#define IMAGE_FILE_MACHINE_SH3   0x01a2

#define IMAGE_FILE_MACHINE_SH3DSP   0x01a3

#define IMAGE_FILE_MACHINE_SH3E   0x01a4

#define IMAGE_FILE_MACHINE_SH4   0x01a6

#define IMAGE_FILE_MACHINE_SH5   0x01a8

#define IMAGE_FILE_MACHINE_THUMB   0x01c2

#define IMAGE_FILE_MACHINE_TRICORE   0x0520

#define IMAGE_FILE_MACHINE_UNKNOWN   0

#define IMAGE_FILE_MACHINE_WCEMIPSV2   0x0169

#define IMAGE_FILE_NET_RUN_FROM_SWAP   0x0800

#define IMAGE_FILE_RELOCS_STRIPPED   0x0001

#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP   0x0400

#define IMAGE_FILE_SYSTEM   0x1000

#define IMAGE_FILE_UP_SYSTEM_ONLY   0x4000

#define IMAGE_NT_OPTIONAL_HDR32_MAGIC   0x10b

#define IMAGE_NT_OPTIONAL_HDR64_MAGIC   0x20b

#define IMAGE_NT_SIGNATURE   0x00004550

#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES   16

#define IMAGE_ORDINAL32

(

Ordinal

)

(Ordinal & 0xffff)

#define IMAGE_ORDINAL64

(

Ordinal

)

(Ordinal & 0xffff)

#define IMAGE_ORDINAL_FLAG32   0x80000000

#define IMAGE_ORDINAL_FLAG64   0x8000000000000000

#define IMAGE_REL_BASED_ABSOLUTE   0

#define IMAGE_REL_BASED_DIR64   10

#define IMAGE_REL_BASED_HIGH   1

#define IMAGE_REL_BASED_HIGHADJ   4

#define IMAGE_REL_BASED_HIGHLOW   3

#define IMAGE_REL_BASED_IA64_IMM64   9

#define IMAGE_REL_BASED_LOW   2

#define IMAGE_REL_BASED_MIPS_JMPADDR   5

#define IMAGE_REL_BASED_MIPS_JMPADDR16   9

#define IMAGE_REL_BASED_REL32   7

#define IMAGE_REL_BASED_SECTION   6

#define IMAGE_SCN_ALIGN_1024BYTES   0x00B00000

#define IMAGE_SCN_ALIGN_128BYTES   0x00800000

#define IMAGE_SCN_ALIGN_16BYTES   0x00500000

#define IMAGE_SCN_ALIGN_1BYTES   0x00100000

#define IMAGE_SCN_ALIGN_2048BYTES   0x00C00000

#define IMAGE_SCN_ALIGN_256BYTES   0x00900000

#define IMAGE_SCN_ALIGN_2BYTES   0x00200000

#define IMAGE_SCN_ALIGN_32BYTES   0x00600000

#define IMAGE_SCN_ALIGN_4096BYTES   0x00D00000

#define IMAGE_SCN_ALIGN_4BYTES   0x00300000

#define IMAGE_SCN_ALIGN_512BYTES   0x00A00000

#define IMAGE_SCN_ALIGN_64BYTES   0x00700000

#define IMAGE_SCN_ALIGN_8192BYTES   0x00E00000

#define IMAGE_SCN_ALIGN_8BYTES   0x00400000

#define IMAGE_SCN_ALIGN_MASK   0x00F00000

#define IMAGE_SCN_CNT_CODE   0x00000020

#define IMAGE_SCN_CNT_INITIALIZED_DATA   0x00000040

#define IMAGE_SCN_CNT_UNINITIALIZED_DATA   0x00000080

#define IMAGE_SCN_GPREL   0x00008000

#define IMAGE_SCN_LNK_COMDAT   0x00001000

#define IMAGE_SCN_LNK_INFO   0x00000200

#define IMAGE_SCN_LNK_NRELOC_OVFL   0x01000000

#define IMAGE_SCN_LNK_OTHER   0x00000100

#define IMAGE_SCN_LNK_REMOVE   0x00000800

#define IMAGE_SCN_MEM_16BIT   0x00020000

#define IMAGE_SCN_MEM_DISCARDABLE   0x02000000

#define IMAGE_SCN_MEM_EXECUTE   0x20000000

#define IMAGE_SCN_MEM_FARDATA   0x00008000

#define IMAGE_SCN_MEM_LOCKED   0x00040000

#define IMAGE_SCN_MEM_NOT_CACHED   0x04000000

#define IMAGE_SCN_MEM_NOT_PAGED   0x08000000

#define IMAGE_SCN_MEM_PRELOAD   0x00080000

#define IMAGE_SCN_MEM_PURGEABLE   0x00020000

#define IMAGE_SCN_MEM_READ   0x40000000

#define IMAGE_SCN_MEM_SHARED   0x10000000

#define IMAGE_SCN_MEM_WRITE   0x80000000

#define IMAGE_SCN_NO_DEFER_SPEC_EXC   0x00004000

#define IMAGE_SCN_TYPE_NO_PAD   0x00000008

#define IMAGE_SIZEOF_BASE_RELOCATION   8

#define IMAGE_SNAP_BY_ORDINAL32

(

Ordinal

)

((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)

#define IMAGE_SNAP_BY_ORDINAL64

(

Ordinal

)

((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)

Typedef Documentation

typedef struct _IMAGE_BASE_RELOCATION IMAGE_BASE_RELOCATION

typedef struct _IMAGE_DATA_DIRECTORY IMAGE_DATA_DIRECTORY

typedef struct _IMAGE_DOS_HEADER IMAGE_DOS_HEADER

typedef struct _IMAGE_EXPORT_DIRECTORY IMAGE_EXPORT_DIRECTORY

typedef struct _IMAGE_FILE_HEADER IMAGE_FILE_HEADER

typedef struct _IMAGE_IMPORT_BY_NAME IMAGE_IMPORT_BY_NAME

typedef struct _IMAGE_IMPORT_DESCRIPTOR IMAGE_IMPORT_DESCRIPTOR

typedef struct _IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS64

typedef struct _IMAGE_OPTIONAL_HEADER32 IMAGE_OPTIONAL_HEADER32

typedef struct _IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER64

typedef struct _IMAGE_SECTION_HEADER IMAGE_SECTION_HEADER

typedef struct _IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA32

typedef struct _IMAGE_THUNK_DATA64 IMAGE_THUNK_DATA64

typedef IMAGE_BASE_RELOCATION UNALIGNED* PIMAGE_BASE_RELOCATION

typedef struct _IMAGE_DATA_DIRECTORY * PIMAGE_DATA_DIRECTORY

typedef struct _IMAGE_DOS_HEADER * PIMAGE_DOS_HEADER

typedef struct _IMAGE_EXPORT_DIRECTORY * PIMAGE_EXPORT_DIRECTORY

typedef struct _IMAGE_FILE_HEADER * PIMAGE_FILE_HEADER

typedef struct _IMAGE_IMPORT_BY_NAME * PIMAGE_IMPORT_BY_NAME

typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED* PIMAGE_IMPORT_DESCRIPTOR

typedef struct _IMAGE_NT_HEADERS64 * PIMAGE_NT_HEADERS64

typedef struct _IMAGE_OPTIONAL_HEADER32 * PIMAGE_OPTIONAL_HEADER32

typedef struct _IMAGE_OPTIONAL_HEADER64 * PIMAGE_OPTIONAL_HEADER64

typedef struct _IMAGE_SECTION_HEADER * PIMAGE_SECTION_HEADER

typedef IMAGE_THUNK_DATA32* PIMAGE_THUNK_DATA32

typedef IMAGE_THUNK_DATA64* PIMAGE_THUNK_DATA64