6 #define IMAGE_DOS_SIGNATURE 0x5A4D // MZ
7 #define IMAGE_NT_SIGNATURE 0x00004550 // PE00
9 #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b
10 #define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b
12 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
14 #define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory
15 #define IMAGE_DIRECTORY_ENTRY_IMPORT 1 // Import Directory
16 #define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 // Resource Directory
17 #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 // Exception Directory
18 #define IMAGE_DIRECTORY_ENTRY_SECURITY 4 // Security Directory
19 #define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 // Base Relocation Table
20 #define IMAGE_DIRECTORY_ENTRY_DEBUG 6 // Debug Directory
22 #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7 // Architecture Specific Data
23 #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 // RVA of GP
24 #define IMAGE_DIRECTORY_ENTRY_TLS 9 // TLS Directory
25 #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 // Load Configuration Directory
26 #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 // Bound Import Directory in headers
27 #define IMAGE_DIRECTORY_ENTRY_IAT 12 // Import Address Table
28 #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13 // Delay Load Import Descriptors
29 #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor
31 #define IMAGE_REL_BASED_ABSOLUTE 0
32 #define IMAGE_REL_BASED_HIGH 1
33 #define IMAGE_REL_BASED_LOW 2
34 #define IMAGE_REL_BASED_HIGHLOW 3
35 #define IMAGE_REL_BASED_HIGHADJ 4
36 #define IMAGE_REL_BASED_MIPS_JMPADDR 5
37 #define IMAGE_REL_BASED_SECTION 6
38 #define IMAGE_REL_BASED_REL32 7
39 #define IMAGE_REL_BASED_MIPS_JMPADDR16 9
40 #define IMAGE_REL_BASED_IA64_IMM64 9
41 #define IMAGE_REL_BASED_DIR64 10
43 #define IMAGE_SIZEOF_BASE_RELOCATION 8
46 #define IMAGE_FILE_RELOCS_STRIPPED 0x0001 // Relocation info stripped from file.
47 #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 // File is executable (i.e. no unresolved external references).
48 #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 // Line nunbers stripped from file.
49 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 // Local symbols stripped from file.
50 #define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010 // Aggressively trim working set
51 #define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 // App can handle >2gb addresses
52 #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 // Bytes of machine word are reversed.
53 #define IMAGE_FILE_32BIT_MACHINE 0x0100 // 32 bit word machine.
54 #define IMAGE_FILE_DEBUG_STRIPPED 0x0200 // Debugging info stripped from file in .DBG file
55 #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 // If Image is on removable media, copy and run from the swap file.
56 #define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 // If Image is on Net, copy and run from the swap file.
57 #define IMAGE_FILE_SYSTEM 0x1000 // System File.
58 #define IMAGE_FILE_DLL 0x2000 // File is a DLL.
59 #define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 // File should only be run on a UP machine
60 #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 // Bytes of machine word are reversed.
62 #define IMAGE_FILE_MACHINE_UNKNOWN 0
63 #define IMAGE_FILE_MACHINE_I386 0x014c // Intel 386.
64 #define IMAGE_FILE_MACHINE_R3000 0x0162 // MIPS little-endian, 0x160 big-endian
65 #define IMAGE_FILE_MACHINE_R4000 0x0166 // MIPS little-endian
66 #define IMAGE_FILE_MACHINE_R10000 0x0168 // MIPS little-endian
67 #define IMAGE_FILE_MACHINE_WCEMIPSV2 0x0169 // MIPS little-endian WCE v2
68 #define IMAGE_FILE_MACHINE_ALPHA 0x0184 // Alpha_AXP
69 #define IMAGE_FILE_MACHINE_SH3 0x01a2 // SH3 little-endian
70 #define IMAGE_FILE_MACHINE_SH3DSP 0x01a3
71 #define IMAGE_FILE_MACHINE_SH3E 0x01a4 // SH3E little-endian
72 #define IMAGE_FILE_MACHINE_SH4 0x01a6 // SH4 little-endian
73 #define IMAGE_FILE_MACHINE_SH5 0x01a8 // SH5
74 #define IMAGE_FILE_MACHINE_ARM 0x01c0 // ARM Little-Endian
75 #define IMAGE_FILE_MACHINE_THUMB 0x01c2 // ARM Thumb/Thumb-2 Little-Endian
76 #define IMAGE_FILE_MACHINE_ARMNT 0x01c4 // ARM Thumb-2 Little-Endian
77 #define IMAGE_FILE_MACHINE_AM33 0x01d3
78 #define IMAGE_FILE_MACHINE_POWERPC 0x01F0 // IBM PowerPC Little-Endian
79 #define IMAGE_FILE_MACHINE_POWERPCFP 0x01f1
80 #define IMAGE_FILE_MACHINE_IA64 0x0200 // Intel 64
81 #define IMAGE_FILE_MACHINE_MIPS16 0x0266 // MIPS
82 #define IMAGE_FILE_MACHINE_ALPHA64 0x0284 // ALPHA64
83 #define IMAGE_FILE_MACHINE_MIPSFPU 0x0366 // MIPS
84 #define IMAGE_FILE_MACHINE_MIPSFPU16 0x0466 // MIPS
85 #define IMAGE_FILE_MACHINE_AXP64 IMAGE_FILE_MACHINE_ALPHA64
86 #define IMAGE_FILE_MACHINE_TRICORE 0x0520 // Infineon
87 #define IMAGE_FILE_MACHINE_CEF 0x0CEF
88 #define IMAGE_FILE_MACHINE_EBC 0x0EBC // EFI Byte Code
89 #define IMAGE_FILE_MACHINE_AMD64 0x8664 // AMD64 (K8)
90 #define IMAGE_FILE_MACHINE_M32R 0x9041 // M32R little-endian
91 #define IMAGE_FILE_MACHINE_CEE 0xC0EE
93 #define IMAGE_ORDINAL_FLAG64 0x8000000000000000
94 #define IMAGE_ORDINAL_FLAG32 0x80000000
95 #define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)
96 #define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)
97 #define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
98 #define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
107 #define IMAGE_SCN_TYPE_NO_PAD 0x00000008 // Reserved.
110 #define IMAGE_SCN_CNT_CODE 0x00000020 // Section contains code.
111 #define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040 // Section contains initialized data.
112 #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 // Section contains uninitialized data.
114 #define IMAGE_SCN_LNK_OTHER 0x00000100 // Reserved.
115 #define IMAGE_SCN_LNK_INFO 0x00000200 // Section contains comments or some other type of information.
117 #define IMAGE_SCN_LNK_REMOVE 0x00000800 // Section contents will not become part of image.
118 #define IMAGE_SCN_LNK_COMDAT 0x00001000 // Section contents comdat.
121 #define IMAGE_SCN_NO_DEFER_SPEC_EXC 0x00004000 // Reset speculative exceptions handling bits in the TLB entries for this section.
122 #define IMAGE_SCN_GPREL 0x00008000 // Section content can be accessed relative to GP
123 #define IMAGE_SCN_MEM_FARDATA 0x00008000
125 #define IMAGE_SCN_MEM_PURGEABLE 0x00020000
126 #define IMAGE_SCN_MEM_16BIT 0x00020000
127 #define IMAGE_SCN_MEM_LOCKED 0x00040000
128 #define IMAGE_SCN_MEM_PRELOAD 0x00080000
130 #define IMAGE_SCN_ALIGN_1BYTES 0x00100000 //
131 #define IMAGE_SCN_ALIGN_2BYTES 0x00200000 //
132 #define IMAGE_SCN_ALIGN_4BYTES 0x00300000 //
133 #define IMAGE_SCN_ALIGN_8BYTES 0x00400000 //
134 #define IMAGE_SCN_ALIGN_16BYTES 0x00500000 // Default alignment if no others are specified.
135 #define IMAGE_SCN_ALIGN_32BYTES 0x00600000 //
136 #define IMAGE_SCN_ALIGN_64BYTES 0x00700000 //
137 #define IMAGE_SCN_ALIGN_128BYTES 0x00800000 //
138 #define IMAGE_SCN_ALIGN_256BYTES 0x00900000 //
139 #define IMAGE_SCN_ALIGN_512BYTES 0x00A00000 //
140 #define IMAGE_SCN_ALIGN_1024BYTES 0x00B00000 //
141 #define IMAGE_SCN_ALIGN_2048BYTES 0x00C00000 //
142 #define IMAGE_SCN_ALIGN_4096BYTES 0x00D00000 //
143 #define IMAGE_SCN_ALIGN_8192BYTES 0x00E00000 //
145 #define IMAGE_SCN_ALIGN_MASK 0x00F00000
147 #define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000 // Section contains extended relocations.
148 #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000 // Section can be discarded.
149 #define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 // Section is not cachable.
150 #define IMAGE_SCN_MEM_NOT_PAGED 0x08000000 // Section is not pageable.
151 #define IMAGE_SCN_MEM_SHARED 0x10000000 // Section is shareable.
152 #define IMAGE_SCN_MEM_EXECUTE 0x20000000 // Section is executable.
153 #define IMAGE_SCN_MEM_READ 0x40000000 // Section is readable.
154 #define IMAGE_SCN_MEM_WRITE 0x80000000 // Section is writeable.
334 #pragma warning (disable : 4201)
353 #pragma warning (default : 4201)
ULONGLONG SizeOfStackReserve
Definition: PEStructs.h:239
ULONG SizeOfCode
Definition: PEStructs.h:257
struct _IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]
Definition: PEStructs.h:245
ULONG Name
Definition: PEStructs.h:348
ULONGLONG ImageBase
Definition: PEStructs.h:224
ULONG SizeOfInitializedData
Definition: PEStructs.h:258
ULONG ForwarderChain
Definition: PEStructs.h:347
struct _IMAGE_BASE_RELOCATION IMAGE_BASE_RELOCATION
ULONG ImageBase
Definition: PEStructs.h:268
ULONG Ordinal
Definition: PEStructs.h:373
USHORT e_oemid
Definition: PEStructs.h:173
USHORT MajorSubsystemVersion
Definition: PEStructs.h:231
Definition: PEStructs.h:367
Definition: PEStructs.h:248
struct _IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS64
USHORT NumberOfSections
Definition: PEStructs.h:200
struct _IMAGE_OPTIONAL_HEADER32 * PIMAGE_OPTIONAL_HEADER32
USHORT MajorImageVersion
Definition: PEStructs.h:229
ULONG Signature
Definition: PEStructs.h:294
IMAGE_FILE_HEADER FileHeader
Definition: PEStructs.h:302
ULONG PhysicalAddress
Definition: PEStructs.h:184
union _IMAGE_SECTION_HEADER::@76 Misc
IMAGE_THUNK_DATA64 * PIMAGE_THUNK_DATA64
Definition: PEStructs.h:365
USHORT MajorImageVersion
Definition: PEStructs.h:273
struct _IMAGE_OPTIONAL_HEADER64 OptionalHeader
Definition: PEStructs.h:296
USHORT Subsystem
Definition: PEStructs.h:281
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]
Definition: PEStructs.h:289
struct _IMAGE_SECTION_HEADER IMAGE_SECTION_HEADER
USHORT e_lfarlc
Definition: PEStructs.h:170
ULONGLONG SizeOfHeapReserve
Definition: PEStructs.h:241
Definition: PEStructs.h:214
ULONG Characteristics
Definition: PEStructs.h:339
ULONG SectionAlignment
Definition: PEStructs.h:225
ULONG FirstThunk
Definition: PEStructs.h:349
ULONG VirtualSize
Definition: PEStructs.h:185
ULONG NumberOfNames
Definition: PEStructs.h:314
USHORT e_ip
Definition: PEStructs.h:168
struct _IMAGE_IMPORT_BY_NAME * PIMAGE_IMPORT_BY_NAME
ULONG AddressOfEntryPoint
Definition: PEStructs.h:260
ULONG Name
Definition: PEStructs.h:311
ULONG SizeOfRawData
Definition: PEStructs.h:188
USHORT Hint
Definition: PEStructs.h:328
Definition: PEStructs.h:306
ULONG BaseOfCode
Definition: PEStructs.h:223
USHORT e_sp
Definition: PEStructs.h:166
ULONG Signature
Definition: PEStructs.h:301
USHORT e_magic
Definition: PEStructs.h:158
ULONG BaseOfData
Definition: PEStructs.h:262
ULONG Characteristics
Definition: PEStructs.h:307
ULONG CheckSum
Definition: PEStructs.h:280
ULONG Characteristics
Definition: PEStructs.h:194
ULONG FileAlignment
Definition: PEStructs.h:270
ULONG TimeDateStamp
Definition: PEStructs.h:308
UCHAR MinorLinkerVersion
Definition: PEStructs.h:256
ULONG SizeOfImage
Definition: PEStructs.h:234
USHORT MajorSubsystemVersion
Definition: PEStructs.h:275
USHORT e_maxalloc
Definition: PEStructs.h:164
IMAGE_IMPORT_DESCRIPTOR UNALIGNED * PIMAGE_IMPORT_DESCRIPTOR
Definition: PEStructs.h:351
ULONG SizeOfUninitializedData
Definition: PEStructs.h:259
ULONG SizeOfHeaders
Definition: PEStructs.h:235
USHORT MinorSubsystemVersion
Definition: PEStructs.h:276
USHORT e_oeminfo
Definition: PEStructs.h:174
struct _IMAGE_EXPORT_DIRECTORY * PIMAGE_EXPORT_DIRECTORY
ULONG ForwarderString
Definition: PEStructs.h:371
ULONG SizeOfHeapCommit
Definition: PEStructs.h:286
USHORT MinorOperatingSystemVersion
Definition: PEStructs.h:228
LONG e_lfanew
Definition: PEStructs.h:176
ULONGLONG ForwarderString
Definition: PEStructs.h:359
ULONGLONG Ordinal
Definition: PEStructs.h:361
struct _IMAGE_OPTIONAL_HEADER32 IMAGE_OPTIONAL_HEADER32
IMAGE_BASE_RELOCATION UNALIGNED * PIMAGE_BASE_RELOCATION
Definition: PEStructs.h:325
ULONG PointerToLinenumbers
Definition: PEStructs.h:191
USHORT DllCharacteristics
Definition: PEStructs.h:238
USHORT MajorOperatingSystemVersion
Definition: PEStructs.h:227
ULONG VirtualAddress
Definition: PEStructs.h:321
USHORT e_res[4]
Definition: PEStructs.h:172
IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32
Definition: PEStructs.h:377
ULONG SizeOfHeaders
Definition: PEStructs.h:279
ULONG Size
Definition: PEStructs.h:211
union _IMAGE_THUNK_DATA64::@79 u1
Definition: PEStructs.h:292
ULONG SizeOfBlock
Definition: PEStructs.h:322
USHORT Machine
Definition: PEStructs.h:199
ULONG BaseOfCode
Definition: PEStructs.h:261
ULONG LoaderFlags
Definition: PEStructs.h:243
USHORT SizeOfOptionalHeader
Definition: PEStructs.h:204
Definition: PEStructs.h:197
USHORT NumberOfLinenumbers
Definition: PEStructs.h:193
USHORT MinorSubsystemVersion
Definition: PEStructs.h:232
ULONG TimeDateStamp
Definition: PEStructs.h:342
USHORT MinorImageVersion
Definition: PEStructs.h:230
struct _IMAGE_FILE_HEADER IMAGE_FILE_HEADER
struct _IMAGE_EXPORT_DIRECTORY IMAGE_EXPORT_DIRECTORY
ULONGLONG Function
Definition: PEStructs.h:360
USHORT Magic
Definition: PEStructs.h:216
ULONG SizeOfImage
Definition: PEStructs.h:278
ULONG NumberOfRvaAndSizes
Definition: PEStructs.h:244
USHORT e_csum
Definition: PEStructs.h:167
ULONGLONG AddressOfData
Definition: PEStructs.h:362
USHORT MinorImageVersion
Definition: PEStructs.h:274
Definition: PEStructs.h:327
USHORT MinorOperatingSystemVersion
Definition: PEStructs.h:272
UCHAR MajorLinkerVersion
Definition: PEStructs.h:217
ULONG AddressOfFunctions
Definition: PEStructs.h:315
ULONG Win32VersionValue
Definition: PEStructs.h:233
ULONG TimeDateStamp
Definition: PEStructs.h:201
USHORT Characteristics
Definition: PEStructs.h:205
USHORT e_minalloc
Definition: PEStructs.h:163
Definition: PEStructs.h:179
ULONG NumberOfSymbols
Definition: PEStructs.h:203
struct _IMAGE_DOS_HEADER IMAGE_DOS_HEADER
USHORT e_ss
Definition: PEStructs.h:165
USHORT e_cp
Definition: PEStructs.h:160
USHORT e_ovno
Definition: PEStructs.h:171
struct _IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA32
struct _IMAGE_DATA_DIRECTORY * PIMAGE_DATA_DIRECTORY
IMAGE_OPTIONAL_HEADER32 OptionalHeader
Definition: PEStructs.h:303
CHAR Name[1]
Definition: PEStructs.h:329
UCHAR MajorLinkerVersion
Definition: PEStructs.h:255
struct _IMAGE_DOS_HEADER * PIMAGE_DOS_HEADER
struct _IMAGE_IMPORT_BY_NAME IMAGE_IMPORT_BY_NAME
USHORT NumberOfRelocations
Definition: PEStructs.h:192
USHORT DllCharacteristics
Definition: PEStructs.h:282
USHORT MajorOperatingSystemVersion
Definition: PEStructs.h:271
struct _IMAGE_SECTION_HEADER * PIMAGE_SECTION_HEADER
ULONG PointerToRelocations
Definition: PEStructs.h:190
ULONG Function
Definition: PEStructs.h:372
ULONG AddressOfEntryPoint
Definition: PEStructs.h:222
USHORT e_crlc
Definition: PEStructs.h:161
ULONG Win32VersionValue
Definition: PEStructs.h:277
struct _IMAGE_OPTIONAL_HEADER64 * PIMAGE_OPTIONAL_HEADER64
USHORT e_cblp
Definition: PEStructs.h:159
ULONG NumberOfRvaAndSizes
Definition: PEStructs.h:288
ULONG CheckSum
Definition: PEStructs.h:236
Definition: PEStructs.h:299
union _IMAGE_THUNK_DATA32::@80 u1
ULONG FileAlignment
Definition: PEStructs.h:226
USHORT e_res2[10]
Definition: PEStructs.h:175
UCHAR MinorLinkerVersion
Definition: PEStructs.h:218
ULONG SectionAlignment
Definition: PEStructs.h:269
ULONG NumberOfFunctions
Definition: PEStructs.h:313
ULONG AddressOfNames
Definition: PEStructs.h:316
Definition: PEStructs.h:156
ULONG SizeOfUninitializedData
Definition: PEStructs.h:221
ULONG AddressOfNameOrdinals
Definition: PEStructs.h:317
ULONG OriginalFirstThunk
Definition: PEStructs.h:340
UCHAR Name[8]
Definition: PEStructs.h:181
struct _IMAGE_IMPORT_DESCRIPTOR IMAGE_IMPORT_DESCRIPTOR
ULONG SizeOfInitializedData
Definition: PEStructs.h:220
struct _IMAGE_DATA_DIRECTORY IMAGE_DATA_DIRECTORY
USHORT e_cparhdr
Definition: PEStructs.h:162
ULONG LoaderFlags
Definition: PEStructs.h:287
struct _IMAGE_NT_HEADERS64 * PIMAGE_NT_HEADERS64
Definition: PEStructs.h:208
ULONG AddressOfData
Definition: PEStructs.h:374
ULONG SizeOfStackReserve
Definition: PEStructs.h:283
ULONGLONG SizeOfHeapCommit
Definition: PEStructs.h:242
ULONG PointerToSymbolTable
Definition: PEStructs.h:202
ULONG Base
Definition: PEStructs.h:312
ULONG SizeOfCode
Definition: PEStructs.h:219
USHORT Magic
Definition: PEStructs.h:254
ULONG VirtualAddress
Definition: PEStructs.h:210
ULONG SizeOfStackCommit
Definition: PEStructs.h:284
USHORT MajorVersion
Definition: PEStructs.h:309
Definition: PEStructs.h:320
ULONG VirtualAddress
Definition: PEStructs.h:187
ULONG PointerToRawData
Definition: PEStructs.h:189
USHORT MinorVersion
Definition: PEStructs.h:310
ULONGLONG SizeOfStackCommit
Definition: PEStructs.h:240
USHORT e_cs
Definition: PEStructs.h:169
USHORT Subsystem
Definition: PEStructs.h:237
struct _IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER64
ULONG SizeOfHeapReserve
Definition: PEStructs.h:285
struct _IMAGE_FILE_HEADER * PIMAGE_FILE_HEADER
struct _IMAGE_THUNK_DATA64 IMAGE_THUNK_DATA64
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES
Definition: PEStructs.h:12
struct _IMAGE_FILE_HEADER FileHeader
Definition: PEStructs.h:295
Definition: PEStructs.h:336
Definition: PEStructs.h:355