563 lines
32 KiB
C
563 lines
32 KiB
C
#ifndef PE_H
|
|
#define PE_H
|
|
#include <stdint.h>
|
|
|
|
#define IMAGE_DOS_SIGNATURE 0x5A4D // MZ
|
|
#define IMAGE_NT_SIGNATURE 0x00004550 // PE00
|
|
#define IMAGE_SIZEOF_FILE_HEADER 20
|
|
#define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 // File is executable (i.e. no unresolved externel references).
|
|
#define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 // Line nunbers stripped from file.
|
|
#define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 // Local symbols stripped from file.
|
|
#define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010 // Agressively trim working set
|
|
#define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 // App can handle >2gb addresses
|
|
#define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 // Bytes of machine word are reversed.
|
|
#define IMAGE_FILE_32BIT_MACHINE 0x0100 // 32 bit word machine.
|
|
#define IMAGE_FILE_DEBUG_STRIPPED 0x0200 // Debugging info stripped from file in .DBG file
|
|
#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 // If Image is on removable media, copy and run from the swap file.
|
|
#define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 // If Image is on Net, copy and run from the swap file.
|
|
#define IMAGE_FILE_SYSTEM 0x1000 // System File.
|
|
#define IMAGE_FILE_DLL 0x2000 // File is a DLL.
|
|
#define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 // File should only be run on a UP machine
|
|
#define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 // Bytes of machine word are reversed.
|
|
#define IMAGE_FILE_MACHINE_UNKNOWN 0
|
|
#define IMAGE_FILE_MACHINE_I386 0x014c // Intel 386.
|
|
#define IMAGE_FILE_MACHINE_R3000 0x0162 // MIPS little-endian, 0x160 big-endian
|
|
#define IMAGE_FILE_MACHINE_R4000 0x0166 // MIPS little-endian
|
|
#define IMAGE_FILE_MACHINE_WCEMIPSV2 0x0169 // MIPS little-endian WCE v2
|
|
#define IMAGE_FILE_MACHINE_ALPHA 0x0184 // Alpha_AXP
|
|
#define IMAGE_FILE_MACHINE_SH3 0x01a2 // SH3 little-endian
|
|
#define IMAGE_FILE_MACHINE_SH3DSP 0x01a3
|
|
#define IMAGE_FILE_MACHINE_SH3E 0x01a4 // SH3E little-endian
|
|
#define IMAGE_FILE_MACHINE_SH4 0x01a6 // SH4 little-endian
|
|
#define IMAGE_FILE_MACHINE_SH5 0x01a8 // SH5
|
|
#define IMAGE_FILE_MACHINE_ARM 0x01c0 // ARM Little-Endian
|
|
#define IMAGE_FILE_MACHINE_THUMB 0x01c2
|
|
#define IMAGE_FILE_MACHINE_AM33 0x01d3
|
|
#define IMAGE_FILE_MACHINE_POWERPC 0x01F0 // IBM PowerPC Little-Endian
|
|
#define IMAGE_FILE_MACHINE_POWERPCFP 0x01f1
|
|
#define IMAGE_FILE_MACHINE_IA64 0x0200 // Intel 64
|
|
#define IMAGE_FILE_MACHINE_MIPS16 0x0266 // MIPS
|
|
#define IMAGE_FILE_MACHINE_ALPHA64 0x0284 // ALPHA64
|
|
#define IMAGE_FILE_MACHINE_MIPSFPU 0x0366 // MIPS
|
|
#define IMAGE_FILE_MACHINE_MIPSFPU16 0x0466 // MIPS
|
|
#define IMAGE_FILE_MACHINE_AXP64 IMAGE_FILE_MACHINE_ALPHA64
|
|
#define IMAGE_FILE_MACHINE_TRICORE 0x0520 // Infineon
|
|
#define IMAGE_FILE_MACHINE_CEF 0x0CEF
|
|
#define IMAGE_FILE_MACHINE_EBC 0x0EBC // EFI Byte Code
|
|
#define IMAGE_FILE_MACHINE_AMD64 0x8664 // AMD64 (K8)
|
|
#define IMAGE_FILE_MACHINE_M32R 0x9041 // M32R little-endian
|
|
#define IMAGE_FILE_MACHINE_CEE 0xC0EE
|
|
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
|
|
#define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b
|
|
#define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b
|
|
#define IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107
|
|
#define IMAGE_SUBSYSTEM_UNKNOWN 0 // Unknown subsystem.
|
|
#define IMAGE_SUBSYSTEM_NATIVE 1 // Image doesn't require a subsystem.
|
|
#define IMAGE_SUBSYSTEM_WINDOWS_GUI 2 // Image runs in the Windows GUI subsystem.
|
|
#define IMAGE_SUBSYSTEM_WINDOWS_CUI 3 // Image runs in the Windows character subsystem.
|
|
#define IMAGE_SUBSYSTEM_OS2_CUI 5 // image runs in the OS/2 character subsystem.
|
|
#define IMAGE_SUBSYSTEM_POSIX_CUI 7 // image runs in the Posix character subsystem.
|
|
#define IMAGE_SUBSYSTEM_NATIVE_WINDOWS 8 // image is a native Win9x driver.
|
|
#define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI 9 // Image runs in the Windows CE subsystem.
|
|
#define IMAGE_SUBSYSTEM_EFI_APPLICATION 10 //
|
|
#define IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER 11 //
|
|
#define IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER 12 //
|
|
#define IMAGE_SUBSYSTEM_EFI_ROM 13
|
|
#define IMAGE_SUBSYSTEM_XBOX 14
|
|
#define IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION 16
|
|
#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040 // DLL can move.
|
|
#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY 0x0080 // Code Integrity Image
|
|
#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT 0x0100 // Image is NX compatible
|
|
#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200 // Image understands isolation and doesn't want it
|
|
#define IMAGE_DLLCHARACTERISTICS_NO_SEH 0x0400 // Image does not use SEH. No SE handler may reside in this image
|
|
#define IMAGE_DLLCHARACTERISTICS_NO_BIND 0x0800 // Do not bind this image.
|
|
#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000
|
|
#define IMAGE_DIRECTORY_ENTRY_EXPORT 0 // Export Directory
|
|
#define IMAGE_DIRECTORY_ENTRY_IMPORT 1 // Import Directory
|
|
#define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 // Resource Directory
|
|
#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 // Exception Directory
|
|
#define IMAGE_DIRECTORY_ENTRY_SECURITY 4 // Security Directory
|
|
#define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 // Base Relocation Table
|
|
#define IMAGE_DIRECTORY_ENTRY_DEBUG 6 // Debug Directory
|
|
#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7 // Architecture Specific Data
|
|
#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 // RVA of GP
|
|
#define IMAGE_DIRECTORY_ENTRY_TLS 9 // TLS Directory
|
|
#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 // Load Configuration Directory
|
|
#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 // Bound Import Directory in headers
|
|
#define IMAGE_DIRECTORY_ENTRY_IAT 12 // Import Address Table
|
|
#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13 // Delay Load Import Descriptors
|
|
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 // COM Runtime descriptor
|
|
#define IMAGE_SIZEOF_SHORT_NAME 8
|
|
#define IMAGE_SIZEOF_SECTION_HEADER 40
|
|
#define IMAGE_SCN_TYPE_NO_PAD 0x00000008 // Reserved.
|
|
#define IMAGE_SCN_CNT_CODE 0x00000020 // Section contains code.
|
|
#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040 // Section contains initialized data.
|
|
#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 // Section contains uninitialized data.
|
|
#define IMAGE_SCN_LNK_OTHER 0x00000100 // Reserved.
|
|
#define IMAGE_SCN_LNK_INFO 0x00000200 // Section contains comments or some other type of information.
|
|
#define IMAGE_SCN_LNK_REMOVE 0x00000800 // Section contents will not become part of image.
|
|
#define IMAGE_SCN_LNK_COMDAT 0x00001000 // Section contents comdat.
|
|
#define IMAGE_SCN_NO_DEFER_SPEC_EXC 0x00004000 // Reset speculative exceptions handling bits in the TLB entries for this section.
|
|
#define IMAGE_SCN_GPREL 0x00008000 // Section content can be accessed relative to GP
|
|
#define IMAGE_SCN_MEM_FARDATA 0x00008000
|
|
#define IMAGE_SCN_MEM_PURGEABLE 0x00020000
|
|
#define IMAGE_SCN_MEM_16BIT 0x00020000
|
|
#define IMAGE_SCN_MEM_LOCKED 0x00040000
|
|
#define IMAGE_SCN_MEM_PRELOAD 0x00080000
|
|
#define IMAGE_SCN_ALIGN_1BYTES 0x00100000 //
|
|
#define IMAGE_SCN_ALIGN_2BYTES 0x00200000 //
|
|
#define IMAGE_SCN_ALIGN_4BYTES 0x00300000 //
|
|
#define IMAGE_SCN_ALIGN_8BYTES 0x00400000 //
|
|
#define IMAGE_SCN_ALIGN_16BYTES 0x00500000 // Default alignment if no others are specified.
|
|
#define IMAGE_SCN_ALIGN_32BYTES 0x00600000 //
|
|
#define IMAGE_SCN_ALIGN_64BYTES 0x00700000 //
|
|
#define IMAGE_SCN_ALIGN_128BYTES 0x00800000 //
|
|
#define IMAGE_SCN_ALIGN_256BYTES 0x00900000 //
|
|
#define IMAGE_SCN_ALIGN_512BYTES 0x00A00000 //
|
|
#define IMAGE_SCN_ALIGN_1024BYTES 0x00B00000 //
|
|
#define IMAGE_SCN_ALIGN_2048BYTES 0x00C00000 //
|
|
#define IMAGE_SCN_ALIGN_4096BYTES 0x00D00000 //
|
|
#define IMAGE_SCN_ALIGN_8192BYTES 0x00E00000 //
|
|
#define IMAGE_SCN_ALIGN_MASK 0x00F00000
|
|
#define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000 // Section contains extended relocations.
|
|
#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000 // Section can be discarded.
|
|
#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 // Section is not cachable.
|
|
#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000 // Section is not pageable.
|
|
#define IMAGE_SCN_MEM_SHARED 0x10000000 // Section is shareable.
|
|
#define IMAGE_SCN_MEM_EXECUTE 0x20000000 // Section is executable.
|
|
#define IMAGE_SCN_MEM_READ 0x40000000 // Section is readable.
|
|
#define IMAGE_SCN_MEM_WRITE 0x80000000 // Section is writeable.
|
|
#define IMAGE_SCN_SCALE_INDEX 0x00000001 // Tls index is scaled
|
|
#define IMAGE_SIZEOF_SYMBOL 18
|
|
#define IMAGE_SYM_TYPE_NULL 0x0000 // no type.
|
|
#define IMAGE_SYM_TYPE_VOID 0x0001 //
|
|
#define IMAGE_SYM_TYPE_CHAR 0x0002 // type character.
|
|
#define IMAGE_SYM_TYPE_SHORT 0x0003 // type short integer.
|
|
#define IMAGE_SYM_TYPE_INT 0x0004 //
|
|
#define IMAGE_SYM_TYPE_LONG 0x0005 //
|
|
#define IMAGE_SYM_TYPE_FLOAT 0x0006 //
|
|
#define IMAGE_SYM_TYPE_DOUBLE 0x0007 //
|
|
#define IMAGE_SYM_TYPE_STRUCT 0x0008 //
|
|
#define IMAGE_SYM_TYPE_UNION 0x0009 //
|
|
#define IMAGE_SYM_TYPE_ENUM 0x000A // enumeration.
|
|
#define IMAGE_SYM_TYPE_MOE 0x000B // member of enumeration.
|
|
#define IMAGE_SYM_TYPE_BYTE 0x000C //
|
|
#define IMAGE_SYM_TYPE_WORD 0x000D //
|
|
#define IMAGE_SYM_TYPE_UINT 0x000E //
|
|
#define IMAGE_SYM_TYPE_DWORD 0x000F //
|
|
#define IMAGE_SYM_TYPE_PCODE 0x8000 //
|
|
#define IMAGE_SYM_DTYPE_NULL 0 // no derived type.
|
|
#define IMAGE_SYM_DTYPE_POINTER 1 // pointer.
|
|
#define IMAGE_SYM_DTYPE_FUNCTION 2 // function.
|
|
#define IMAGE_SYM_DTYPE_ARRAY 3 // array.
|
|
#define IMAGE_SYM_CLASS_NULL 0x0000
|
|
#define IMAGE_SYM_CLASS_AUTOMATIC 0x0001
|
|
#define IMAGE_SYM_CLASS_EXTERNAL 0x0002
|
|
#define IMAGE_SYM_CLASS_STATIC 0x0003
|
|
#define IMAGE_SYM_CLASS_REGISTER 0x0004
|
|
#define IMAGE_SYM_CLASS_EXTERNAL_DEF 0x0005
|
|
#define IMAGE_SYM_CLASS_LABEL 0x0006
|
|
#define IMAGE_SYM_CLASS_UNDEFINED_LABEL 0x0007
|
|
#define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT 0x0008
|
|
#define IMAGE_SYM_CLASS_ARGUMENT 0x0009
|
|
#define IMAGE_SYM_CLASS_STRUCT_TAG 0x000A
|
|
#define IMAGE_SYM_CLASS_MEMBER_OF_UNION 0x000B
|
|
#define IMAGE_SYM_CLASS_UNION_TAG 0x000C
|
|
#define IMAGE_SYM_CLASS_TYPE_DEFINITION 0x000D
|
|
#define IMAGE_SYM_CLASS_UNDEFINED_STATIC 0x000E
|
|
#define IMAGE_SYM_CLASS_ENUM_TAG 0x000F
|
|
#define IMAGE_SYM_CLASS_MEMBER_OF_ENUM 0x0010
|
|
#define IMAGE_SYM_CLASS_REGISTER_PARAM 0x0011
|
|
#define IMAGE_SYM_CLASS_BIT_FIELD 0x0012
|
|
#define IMAGE_SYM_CLASS_FAR_EXTERNAL 0x0044 //
|
|
#define IMAGE_SYM_CLASS_BLOCK 0x0064
|
|
#define IMAGE_SYM_CLASS_FUNCTION 0x0065
|
|
#define IMAGE_SYM_CLASS_END_OF_STRUCT 0x0066
|
|
#define IMAGE_SYM_CLASS_FILE 0x0067
|
|
#define IMAGE_SYM_CLASS_SECTION 0x0068
|
|
#define IMAGE_SYM_CLASS_WEAK_EXTERNAL 0x0069
|
|
#define IMAGE_SYM_CLASS_CLR_TOKEN 0x006B
|
|
#define IMAGE_REL_I386_ABSOLUTE 0x0000 // Reference is absolute, no relocation is necessary
|
|
#define IMAGE_REL_I386_DIR16 0x0001 // Direct 16-bit reference to the symbols virtual address
|
|
#define IMAGE_REL_I386_REL16 0x0002 // PC-relative 16-bit reference to the symbols virtual address
|
|
#define IMAGE_REL_I386_DIR32 0x0006 // Direct 32-bit reference to the symbols virtual address
|
|
#define IMAGE_REL_I386_DIR32NB 0x0007 // Direct 32-bit reference to the symbols virtual address, base not included
|
|
#define IMAGE_REL_I386_SEG12 0x0009 // Direct 16-bit reference to the segment-selector bits of a 32-bit virtual address
|
|
#define IMAGE_REL_I386_SECTION 0x000A
|
|
#define IMAGE_REL_I386_SECREL 0x000B
|
|
#define IMAGE_REL_I386_TOKEN 0x000C // clr token
|
|
#define IMAGE_REL_I386_SECREL7 0x000D // 7 bit offset from base of section containing target
|
|
#define IMAGE_REL_I386_REL32 0x0014 // PC-relative 32-bit reference to the symbols virtual address
|
|
#define IMAGE_REL_MIPS_ABSOLUTE 0x0000 // Reference is absolute, no relocation is necessary
|
|
#define IMAGE_REL_MIPS_REFHALF 0x0001
|
|
#define IMAGE_REL_MIPS_REFWORD 0x0002
|
|
#define IMAGE_REL_MIPS_JMPADDR 0x0003
|
|
#define IMAGE_REL_MIPS_REFHI 0x0004
|
|
#define IMAGE_REL_MIPS_REFLO 0x0005
|
|
#define IMAGE_REL_MIPS_GPREL 0x0006
|
|
#define IMAGE_REL_MIPS_LITERAL 0x0007
|
|
#define IMAGE_REL_MIPS_SECTION 0x000A
|
|
#define IMAGE_REL_MIPS_SECREL 0x000B
|
|
#define IMAGE_REL_MIPS_SECRELLO 0x000C // Low 16-bit section relative referemce (used for >32k TLS)
|
|
#define IMAGE_REL_MIPS_SECRELHI 0x000D // High 16-bit section relative reference (used for >32k TLS)
|
|
#define IMAGE_REL_MIPS_TOKEN 0x000E // clr token
|
|
#define IMAGE_REL_MIPS_JMPADDR16 0x0010
|
|
#define IMAGE_REL_MIPS_REFWORDNB 0x0022
|
|
#define IMAGE_REL_MIPS_PAIR 0x0025
|
|
#define IMAGE_REL_ALPHA_ABSOLUTE 0x0000
|
|
#define IMAGE_REL_ALPHA_REFLONG 0x0001
|
|
#define IMAGE_REL_ALPHA_REFQUAD 0x0002
|
|
#define IMAGE_REL_ALPHA_GPREL32 0x0003
|
|
#define IMAGE_REL_ALPHA_LITUSE 0x0005
|
|
#define IMAGE_REL_ALPHA_GPDISP 0x0006
|
|
#define IMAGE_REL_ALPHA_BRADDR 0x0007
|
|
#define IMAGE_REL_ALPHA_HINT 0x0008
|
|
#define IMAGE_REL_ALPHA_INLINE_REFLONG 0x0009
|
|
#define IMAGE_REL_ALPHA_REFHI 0x000A
|
|
#define IMAGE_REL_ALPHA_REFLO 0x000B
|
|
#define IMAGE_REL_ALPHA_PAIR 0x000C
|
|
#define IMAGE_REL_ALPHA_MATCH 0x000D
|
|
#define IMAGE_REL_ALPHA_SECTION 0x000E
|
|
#define IMAGE_REL_ALPHA_SECREL 0x000F
|
|
#define IMAGE_REL_ALPHA_REFLONGNB 0x0010
|
|
#define IMAGE_REL_ALPHA_SECRELLO 0x0011 // Low 16-bit section relative reference
|
|
#define IMAGE_REL_ALPHA_SECRELHI 0x0012 // High 16-bit section relative reference
|
|
#define IMAGE_REL_ALPHA_REFQ3 0x0013 // High 16 bits of 48 bit reference
|
|
#define IMAGE_REL_ALPHA_REFQ2 0x0014 // Middle 16 bits of 48 bit reference
|
|
#define IMAGE_REL_ALPHA_REFQ1 0x0015 // Low 16 bits of 48 bit reference
|
|
#define IMAGE_REL_ALPHA_GPRELLO 0x0016 // Low 16-bit GP relative reference
|
|
#define IMAGE_REL_ALPHA_GPRELHI 0x0017 // High 16-bit GP relative reference
|
|
#define IMAGE_REL_PPC_ABSOLUTE 0x0000 // NOP
|
|
#define IMAGE_REL_PPC_ADDR64 0x0001 // 64-bit address
|
|
#define IMAGE_REL_PPC_ADDR32 0x0002 // 32-bit address
|
|
#define IMAGE_REL_PPC_ADDR24 0x0003 // 26-bit address, shifted left 2 (branch absolute)
|
|
#define IMAGE_REL_PPC_ADDR16 0x0004 // 16-bit address
|
|
#define IMAGE_REL_PPC_REL24 0x0006 // 26-bit PC-relative offset, shifted left 2 (branch relative)
|
|
#define IMAGE_REL_PPC_REL14 0x0007 // 16-bit PC-relative offset, shifted left 2 (br cond relative)
|
|
#define IMAGE_REL_PPC_TOCREL16 0x0008 // 16-bit offset from TOC base
|
|
#define IMAGE_REL_PPC_ADDR32NB 0x000A // 32-bit addr w/o image base
|
|
#define IMAGE_REL_PPC_SECREL 0x000B // va of containing section (as in an image sectionhdr)
|
|
#define IMAGE_REL_PPC_SECTION 0x000C // sectionheader number
|
|
#define IMAGE_REL_PPC_IFGLUE 0x000D // substitute TOC restore instruction iff symbol is glue code
|
|
#define IMAGE_REL_PPC_SECREL16 0x000F // va of containing section (limited to 16 bits)
|
|
#define IMAGE_REL_PPC_REFLO 0x0011
|
|
#define IMAGE_REL_PPC_PAIR 0x0012
|
|
#define IMAGE_REL_PPC_SECRELHI 0x0014 // High 16-bit section relative reference (used for >32k TLS)
|
|
#define IMAGE_REL_PPC_GPREL 0x0015
|
|
#define IMAGE_REL_PPC_TOKEN 0x0016 // clr token
|
|
#define IMAGE_REL_PPC_NEG 0x0100 // subtract reloc value rather than adding it
|
|
#define IMAGE_REL_PPC_BRTAKEN 0x0200 // fix branch prediction bit to predict branch taken
|
|
#define IMAGE_REL_PPC_BRNTAKEN 0x0400 // fix branch prediction bit to predict branch not taken
|
|
#define IMAGE_REL_PPC_TOCDEFN 0x0800 // toc slot defined in file (or, data in toc)
|
|
#define IMAGE_REL_SH3_DIRECT16 0x0001 // 16 bit direct
|
|
#define IMAGE_REL_SH3_DIRECT32 0x0002 // 32 bit direct
|
|
#define IMAGE_REL_SH3_DIRECT8_WORD 0x0004 // 8 bit direct .W (0 ext.)
|
|
#define IMAGE_REL_SH3_DIRECT8_LONG 0x0005 // 8 bit direct .L (0 ext.)
|
|
#define IMAGE_REL_SH3_DIRECT4 0x0006 // 4 bit direct (0 ext.)
|
|
#define IMAGE_REL_SH3_DIRECT4_WORD 0x0007 // 4 bit direct .W (0 ext.)
|
|
#define IMAGE_REL_SH3_PCREL8_WORD 0x0009 // 8 bit PC relative .W
|
|
#define IMAGE_REL_SH3_PCREL8_LONG 0x000A // 8 bit PC relative .L
|
|
#define IMAGE_REL_SH3_PCREL12_WORD 0x000B // 12 LSB PC relative .W
|
|
#define IMAGE_REL_SH3_SIZEOF_SECTION 0x000D // Size of EXE section
|
|
#define IMAGE_REL_SH3_SECTION 0x000E // Section table index
|
|
#define IMAGE_REL_SH3_SECREL 0x000F // Offset within section
|
|
#define IMAGE_REL_SH3_DIRECT32_NB 0x0010 // 32 bit direct not based
|
|
#define IMAGE_REL_SH3_GPREL4_LONG 0x0011 // GP-relative addressing
|
|
#define IMAGE_REL_SH3_TOKEN 0x0012 // clr token
|
|
#define IMAGE_REL_SHM_PCRELPT 0x0013 // Offset from current
|
|
#define IMAGE_REL_SHM_REFLO 0x0014 // Low bits of 32-bit address
|
|
#define IMAGE_REL_SHM_REFHALF 0x0015 // High bits of 32-bit address
|
|
#define IMAGE_REL_SHM_RELLO 0x0016 // Low bits of relative reference
|
|
#define IMAGE_REL_SHM_RELHALF 0x0017 // High bits of relative reference
|
|
#define IMAGE_REL_SHM_PAIR 0x0018 // offset operand for relocation
|
|
#define IMAGE_REL_SH_NOMODE 0x8000 // relocation ignores section mode
|
|
#define IMAGE_REL_ARM_ABSOLUTE 0x0000 // No relocation required
|
|
#define IMAGE_REL_ARM_ADDR32 0x0001 // 32 bit address
|
|
#define IMAGE_REL_ARM_ADDR32NB 0x0002 // 32 bit address w/o image base
|
|
#define IMAGE_REL_ARM_BRANCH24 0x0003 // 24 bit offset << 2 & sign ext.
|
|
#define IMAGE_REL_ARM_BRANCH11 0x0004 // Thumb: 2 11 bit offsets
|
|
#define IMAGE_REL_ARM_TOKEN 0x0005 // clr token
|
|
#define IMAGE_REL_ARM_GPREL7 0x0007 // GP-relative addressing (Thumb)
|
|
#define IMAGE_REL_ARM_BLX24 0x0008
|
|
#define IMAGE_REL_ARM_BLX11 0x0009
|
|
#define IMAGE_REL_ARM_SECREL 0x000F // Offset within section
|
|
#define IMAGE_REL_AM_ABSOLUTE 0x0000
|
|
#define IMAGE_REL_AM_ADDR32NB 0x0002
|
|
#define IMAGE_REL_AM_FUNCINFO 0x0004
|
|
#define IMAGE_REL_AM_REL32_1 0x0005
|
|
#define IMAGE_REL_AM_REL32_2 0x0006
|
|
#define IMAGE_REL_AM_SECTION 0x0008
|
|
#define IMAGE_REL_AM_TOKEN 0x0009
|
|
#define IMAGE_REL_AMD64_ADDR64 0x0001 // 64-bit address (VA).
|
|
#define IMAGE_REL_AMD64_ADDR32 0x0002 // 32-bit address (VA).
|
|
#define IMAGE_REL_AMD64_REL32 0x0004 // 32-bit relative address from byte following reloc
|
|
#define IMAGE_REL_AMD64_REL32_1 0x0005 // 32-bit relative address from byte distance 1 from reloc
|
|
#define IMAGE_REL_AMD64_REL32_3 0x0007 // 32-bit relative address from byte distance 3 from reloc
|
|
#define IMAGE_REL_AMD64_REL32_5 0x0009 // 32-bit relative address from byte distance 5 from reloc
|
|
#define IMAGE_REL_AMD64_SECREL 0x000B // 32 bit offset from base of section containing target
|
|
#define IMAGE_REL_AMD64_SECREL7 0x000C // 7 bit unsigned offset from base of section containing target
|
|
#define IMAGE_REL_AMD64_SREL32 0x000E // 32 bit signed span-dependent value emitted into object
|
|
#define IMAGE_REL_AMD64_SSPAN32 0x0010 // 32 bit signed span-dependent value applied at link time
|
|
#define IMAGE_REL_IA64_IMM14 0x0001
|
|
#define IMAGE_REL_IA64_IMM64 0x0003
|
|
#define IMAGE_REL_IA64_DIR32 0x0004
|
|
#define IMAGE_REL_IA64_PCREL21B 0x0006
|
|
#define IMAGE_REL_IA64_PCREL21F 0x0008
|
|
#define IMAGE_REL_IA64_LTOFF22 0x000A
|
|
#define IMAGE_REL_IA64_SECTION 0x000B
|
|
#define IMAGE_REL_IA64_SECREL22 0x000C
|
|
#define IMAGE_REL_IA64_SECREL64I 0x000D
|
|
#define IMAGE_REL_IA64_SECREL32 0x000E
|
|
#define IMAGE_REL_IA64_DIR32NB 0x0010
|
|
#define IMAGE_REL_IA64_SREL22 0x0012
|
|
#define IMAGE_REL_IA64_SREL32 0x0013
|
|
#define IMAGE_REL_IA64_UREL32 0x0014
|
|
#define IMAGE_REL_IA64_PCREL60B 0x0016 // If possible, convert to MBB bundle with NOP.B in slot 1
|
|
#define IMAGE_REL_IA64_PCREL60F 0x0017 // If possible, convert to MFB bundle with NOP.F in slot 1
|
|
#define IMAGE_REL_IA64_PCREL60I 0x0018 // If possible, convert to MIB bundle with NOP.I in slot 1
|
|
#define IMAGE_REL_IA64_PCREL60M 0x0019 // If possible, convert to MMB bundle with NOP.M in slot 1
|
|
#define IMAGE_REL_IA64_IMMGPREL64 0x001A
|
|
#define IMAGE_REL_IA64_TOKEN 0x001B // clr token
|
|
#define IMAGE_REL_IA64_GPREL32 0x001C
|
|
#define IMAGE_REL_IA64_ADDEND 0x001F
|
|
#define IMAGE_REL_CEF_ABSOLUTE 0x0000 // Reference is absolute, no relocation is necessary
|
|
#define IMAGE_REL_CEF_ADDR64 0x0002 // 64-bit address (VA).
|
|
#define IMAGE_REL_CEF_ADDR32NB 0x0003 // 32-bit address w/o image base (RVA).
|
|
#define IMAGE_REL_CEF_SECTION 0x0004 // Section index
|
|
#define IMAGE_REL_CEF_TOKEN 0x0006 // 32 bit metadata token
|
|
#define IMAGE_REL_CEE_ABSOLUTE 0x0000 // Reference is absolute, no relocation is necessary
|
|
#define IMAGE_REL_CEE_ADDR32 0x0001 // 32-bit address (VA).
|
|
#define IMAGE_REL_CEE_ADDR64 0x0002 // 64-bit address (VA).
|
|
#define IMAGE_REL_CEE_ADDR32NB 0x0003 // 32-bit address w/o image base (RVA).
|
|
#define IMAGE_REL_CEE_SECREL 0x0005 // 32 bit offset from base of section containing target
|
|
#define IMAGE_REL_CEE_TOKEN 0x0006 // 32 bit metadata token
|
|
#define IMAGE_REL_M32R_ADDR32 0x0001 // 32 bit address
|
|
#define IMAGE_REL_M32R_ADDR32NB 0x0002 // 32 bit address w/o image base
|
|
#define IMAGE_REL_M32R_ADDR24 0x0003 // 24 bit address
|
|
#define IMAGE_REL_M32R_PCREL24 0x0005 // 24 bit offset << 2 & sign ext.
|
|
#define IMAGE_REL_M32R_PCREL8 0x0007 // 8 bit offset << 2 & sign ext.
|
|
#define IMAGE_REL_M32R_REFHALF 0x0008 // 16 MSBs
|
|
#define IMAGE_REL_M32R_REFHI 0x0009 // 16 MSBs; adj for LSB sign ext.
|
|
#define IMAGE_REL_M32R_REFLO 0x000A // 16 LSBs
|
|
#define IMAGE_REL_M32R_PAIR 0x000B // Link HI and LO
|
|
#define IMAGE_REL_M32R_SECTION 0x000C // Section table index
|
|
#define IMAGE_REL_M32R_SECREL32 0x000D // 32 bit section relative reference
|
|
#define IMAGE_REL_M32R_TOKEN 0x000E // clr token
|
|
#define IMAGE_REL_EBC_ABSOLUTE 0x0000 // No relocation required
|
|
#define IMAGE_REL_EBC_ADDR32NB 0x0001 // 32 bit address w/o image base
|
|
#define IMAGE_REL_EBC_REL32 0x0002 // 32-bit relative address from byte following reloc
|
|
#define IMAGE_REL_EBC_SECTION 0x0003 // Section table index
|
|
#define IMAGE_REL_EBC_SECREL 0x0004 // Offset within section
|
|
#define IMAGE_REL_BASED_ABSOLUTE 0
|
|
#define IMAGE_REL_BASED_LOW 2
|
|
#define IMAGE_REL_BASED_HIGHLOW 3
|
|
#define IMAGE_REL_BASED_HIGHADJ 4
|
|
#define IMAGE_REL_BASED_MIPS_JMPADDR 5
|
|
#define IMAGE_REL_BASED_MIPS_JMPADDR16 9
|
|
#define IMAGE_REL_BASED_DIR64 10
|
|
#define IMAGE_ARCHIVE_START "!<arch>\n"
|
|
#define IMAGE_ARCHIVE_PAD "\n"
|
|
#define IMAGE_ARCHIVE_LINKER_MEMBER "/ "
|
|
#define IMAGE_ARCHIVE_LONGNAMES_MEMBER "// "
|
|
#define IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR 60
|
|
#define IMAGE_ORDINAL_FLAG64 0x8000000000000000
|
|
#define IMAGE_ORDINAL_FLAG32 0x80000000
|
|
#define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG64
|
|
#define IMAGE_RESOURCE_NAME_IS_STRING 0x80000000
|
|
#define IMAGE_DEBUG_TYPE_UNKNOWN 0
|
|
|
|
typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header
|
|
uint16_t e_magic; // Magic number
|
|
uint16_t e_cblp; // Bytes on last page of file
|
|
uint16_t e_cp; // Pages in file
|
|
uint16_t e_crlc; // Relocations
|
|
uint16_t e_cparhdr; // Size of header in paragraphs
|
|
uint16_t e_minalloc; // Minimum extra paragraphs needed
|
|
uint16_t e_maxalloc; // Maximum extra paragraphs needed
|
|
uint16_t e_ss; // Initial (relative) SS value
|
|
uint16_t e_sp; // Initial SP value
|
|
uint16_t e_csum; // Checksum
|
|
uint16_t e_ip; // Initial IP value
|
|
uint16_t e_cs; // Initial (relative) CS value
|
|
uint16_t e_lfarlc; // File address of relocation table
|
|
uint16_t e_ovno; // Overlay number
|
|
uint16_t e_res[4]; // Reserved words
|
|
uint16_t e_oemid; // OEM identifier (for e_oeminfo)
|
|
uint16_t e_oeminfo; // OEM information; e_oemid specific
|
|
uint16_t e_res2[10]; // Reserved words
|
|
uint32_t e_lfanew; // File address of new exe header
|
|
} IMAGE_DOS_HEADER ;
|
|
|
|
typedef struct _IMAGE_FILE_HEADER {
|
|
uint16_t Machine;
|
|
uint16_t NumberOfSections;
|
|
uint32_t TimeDateStamp;
|
|
uint32_t PointerToSymbolTable;
|
|
uint32_t NumberOfSymbols;
|
|
uint16_t SizeOfOptionalHeader;
|
|
uint16_t Characteristics;
|
|
} IMAGE_FILE_HEADER;
|
|
|
|
typedef struct _IMAGE_DATA_DIRECTORY {
|
|
uint32_t VirtualAddress;
|
|
uint32_t Size;
|
|
} IMAGE_DATA_DIRECTORY;
|
|
|
|
typedef struct _IMAGE_OPTIONAL_HEADER {
|
|
//
|
|
// Standard fields.
|
|
//
|
|
|
|
uint16_t Magic;
|
|
uint8_t MajorLinkerVersion;
|
|
uint8_t MinorLinkerVersion;
|
|
uint32_t SizeOfCode;
|
|
uint32_t SizeOfInitializedData;
|
|
uint32_t SizeOfUninitializedData;
|
|
uint32_t AddressOfEntryPoint;
|
|
uint32_t BaseOfCode;
|
|
uint32_t BaseOfData;
|
|
|
|
//
|
|
// NT additional fields.
|
|
//
|
|
|
|
uint32_t ImageBase;
|
|
uint32_t SectionAlignment;
|
|
uint32_t FileAlignment;
|
|
uint16_t MajorOperatingSystemVersion;
|
|
uint16_t MinorOperatingSystemVersion;
|
|
uint16_t MajorImageVersion;
|
|
uint16_t MinorImageVersion;
|
|
uint16_t MajorSubsystemVersion;
|
|
uint16_t MinorSubsystemVersion;
|
|
uint32_t Win32VersionValue;
|
|
uint32_t SizeOfImage;
|
|
uint32_t SizeOfHeaders;
|
|
uint32_t CheckSum;
|
|
uint16_t Subsystem;
|
|
uint16_t DllCharacteristics;
|
|
uint32_t SizeOfStackReserve;
|
|
uint32_t SizeOfStackCommit;
|
|
uint32_t SizeOfHeapReserve;
|
|
uint32_t SizeOfHeapCommit;
|
|
uint32_t LoaderFlags;
|
|
uint32_t NumberOfRvaAndSizes;
|
|
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
|
|
} IMAGE_OPTIONAL_HEADER32;
|
|
|
|
typedef struct _IMAGE_OPTIONAL_HEADER64 {
|
|
uint16_t Magic;
|
|
uint8_t MajorLinkerVersion;
|
|
uint8_t MinorLinkerVersion;
|
|
uint32_t SizeOfCode;
|
|
uint32_t SizeOfInitializedData;
|
|
uint32_t SizeOfUninitializedData;
|
|
uint32_t AddressOfEntryPoint;
|
|
uint32_t BaseOfCode;
|
|
uint64_t ImageBase;
|
|
uint32_t SectionAlignment;
|
|
uint32_t FileAlignment;
|
|
uint16_t MajorOperatingSystemVersion;
|
|
uint16_t MinorOperatingSystemVersion;
|
|
uint16_t MajorImageVersion;
|
|
uint16_t MinorImageVersion;
|
|
uint16_t MajorSubsystemVersion;
|
|
uint16_t MinorSubsystemVersion;
|
|
uint32_t Win32VersionValue;
|
|
uint32_t SizeOfImage;
|
|
uint32_t SizeOfHeaders;
|
|
uint32_t CheckSum;
|
|
uint16_t Subsystem;
|
|
uint16_t DllCharacteristics;
|
|
uint64_t SizeOfStackReserve;
|
|
uint64_t SizeOfStackCommit;
|
|
uint64_t SizeOfHeapReserve;
|
|
uint64_t SizeOfHeapCommit;
|
|
uint32_t LoaderFlags;
|
|
uint32_t NumberOfRvaAndSizes;
|
|
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
|
|
} IMAGE_OPTIONAL_HEADER64;
|
|
|
|
typedef struct _IMAGE_NT_HEADERS64 {
|
|
uint32_t Signature;
|
|
IMAGE_FILE_HEADER FileHeader;
|
|
IMAGE_OPTIONAL_HEADER64 OptionalHeader;
|
|
} IMAGE_NT_HEADERS64;
|
|
|
|
typedef struct _IMAGE_NT_HEADERS {
|
|
uint32_t Signature;
|
|
IMAGE_FILE_HEADER FileHeader;
|
|
IMAGE_OPTIONAL_HEADER32 OptionalHeader;
|
|
} IMAGE_NT_HEADERS32;
|
|
|
|
typedef struct _IMAGE_SECTION_HEADER {
|
|
uint8_t Name[IMAGE_SIZEOF_SHORT_NAME];
|
|
union {
|
|
uint32_t PhysicalAddress;
|
|
uint32_t VirtualSize;
|
|
} Misc;
|
|
uint32_t VirtualAddress;
|
|
uint32_t SizeOfRawData;
|
|
uint32_t PointerToRawData;
|
|
uint32_t PointerToRelocations;
|
|
uint32_t PointerToLinenumbers;
|
|
uint16_t NumberOfRelocations;
|
|
uint16_t NumberOfLinenumbers;
|
|
uint32_t Characteristics;
|
|
} IMAGE_SECTION_HEADER;
|
|
|
|
typedef struct _IMAGE_EXPORT_DIRECTORY {
|
|
uint32_t Characteristics;
|
|
uint32_t TimeDateStamp;
|
|
uint16_t MajorVersion;
|
|
uint16_t MinorVersion;
|
|
uint32_t Name;
|
|
uint32_t Base;
|
|
uint32_t NumberOfFunctions;
|
|
uint32_t NumberOfNames;
|
|
uint32_t AddressOfFunctions; // RVA from base of image
|
|
uint32_t AddressOfNames; // RVA from base of image
|
|
uint32_t AddressOfNameOrdinals; // RVA from base of image
|
|
} IMAGE_EXPORT_DIRECTORY;
|
|
|
|
typedef struct _IMAGE_IMPORT_BY_NAME {
|
|
uint16_t Hint;
|
|
uint8_t Name[1];
|
|
} IMAGE_IMPORT_BY_NAME;
|
|
|
|
typedef struct _IMAGE_THUNK_DATA64 {
|
|
union {
|
|
uint64_t ForwarderString; // Puint8_t
|
|
uint64_t Function; // PDWORD
|
|
uint64_t Ordinal;
|
|
uint64_t AddressOfData; // PIMAGE_IMPORT_BY_NAME
|
|
} u1;
|
|
} IMAGE_THUNK_DATA64;
|
|
|
|
typedef struct _IMAGE_THUNK_DATA32 {
|
|
union {
|
|
uint32_t ForwarderString; // Puint8_t
|
|
uint32_t Function; // PDWORD
|
|
uint32_t Ordinal;
|
|
uint32_t AddressOfData; // PIMAGE_IMPORT_BY_NAME
|
|
} u1;
|
|
} IMAGE_THUNK_DATA32;
|
|
|
|
typedef struct _IMAGE_IMPORT_DESCRIPTOR {
|
|
union {
|
|
uint32_t Characteristics; // 0 for terminating null import descriptor
|
|
uint32_t OriginalFirstThunk; // RVA to original unbound IAT (PIMAGE_THUNK_DATA)
|
|
} u1;
|
|
uint32_t TimeDateStamp; // 0 if not bound,
|
|
// -1 if bound, and real date\time stamp
|
|
// in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
|
|
// O.W. date/time stamp of DLL bound to (Old BIND)
|
|
|
|
uint32_t ForwarderChain; // -1 if no forwarders
|
|
uint32_t Name;
|
|
uint32_t FirstThunk; // RVA to IAT (if bound this IAT has actual addresses)
|
|
} IMAGE_IMPORT_DESCRIPTOR;
|
|
|
|
#endif
|