VirtualBox

source: vbox/trunk/include/iprt/formats/pecoff.h@ 107807

Last change on this file since 107807 was 106732, checked in by vboxsync, 4 months ago

IPRT/ldrPE.cpp,pecoff.h: Added IMAGE_LOAD_CONFIG_DIRECTORY64_V14 / IMAGE_LOAD_CONFIG_DIRECTORY32_V13 for the windows 11 22h2 structure update (added GuardMemcpyFunctionPointer). jiraref:VBP-1253
  • Property svn:eol-style set to native
  • Property svn:keywords set to Id Revision
File size: 134.6 KB
Line 
1/* $Id: pecoff.h 106732 2024-10-27 22:54:55Z vboxsync $ */
2/** @file
3 * IPRT - Windows NT PE & COFF Structures and Constants.
4 */
5
6/*
7 * Copyright (C) 2006-2024 Oracle and/or its affiliates.
8 *
9 * This file is part of VirtualBox base platform packages, as
10 * available from https://www.virtualbox.org.
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation, in version 3 of the
15 * License.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
20 * General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <https://www.gnu.org/licenses>.
24 *
25 * The contents of this file may alternatively be used under the terms
26 * of the Common Development and Distribution License Version 1.0
27 * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
28 * in the VirtualBox distribution, in which case the provisions of the
29 * CDDL are applicable instead of those of the GPL.
30 *
31 * You may elect to license modified versions of this file under the
32 * terms and conditions of either the GPL or the CDDL or both.
33 *
34 * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
35 */
36
37#ifndef IPRT_INCLUDED_formats_pecoff_h
38#define IPRT_INCLUDED_formats_pecoff_h
39#ifndef RT_WITHOUT_PRAGMA_ONCE
40# pragma once
41#endif
42
43#ifndef __ASSEMBLER__
44# include <iprt/types.h>
45#endif
46#include <iprt/assertcompile.h>
47
48
49/** @defgroup grp_rt_formats_pecoff PE & Microsoft COFF structures and definitions
50 * @ingroup grp_rt_formats
51 * @{
52 */
53
54
55#ifndef __ASSEMBLER__
56/**
57 * PE & COFF file header.
58 *
59 * This starts COFF files, while in PE files it's preceeded by the PE signature
60 * (see IMAGE_NT_HEADERS32, IMAGE_NT_HEADERS64).
61 */
62typedef struct _IMAGE_FILE_HEADER
63{
64 uint16_t Machine; /**< 0x00 */
65 uint16_t NumberOfSections; /**< 0x02 */
66 uint32_t TimeDateStamp; /**< 0x04 */
67 uint32_t PointerToSymbolTable; /**< 0x08 */
68 uint32_t NumberOfSymbols; /**< 0x0c */
69 uint16_t SizeOfOptionalHeader; /**< 0x10 */
70 uint16_t Characteristics; /**< 0x12 */
71} IMAGE_FILE_HEADER; /* size: 0x14 */
72AssertCompileSize(IMAGE_FILE_HEADER, 0x14);
73typedef IMAGE_FILE_HEADER *PIMAGE_FILE_HEADER;
74typedef IMAGE_FILE_HEADER const *PCIMAGE_FILE_HEADER;
75#endif /* !__ASSEMBLER__ */
76
77
78/** @name IMAGE_FILE_MACHINE_XXX - PE & COFF machine types.
79 * Used by IMAGE_FILE_HEADER::Machine and IMAGE_SEPARATE_DEBUG_HEADER::Machine.
80 * @{ */
81/** X86 compatible CPU, 32-bit instructions. */
82#define IMAGE_FILE_MACHINE_I386 UINT16_C(0x014c)
83/** AMD64 compatible CPU, 64-bit instructions. */
84#define IMAGE_FILE_MACHINE_AMD64 UINT16_C(0x8664)
85
86/** Unknown target CPU. */
87#define IMAGE_FILE_MACHINE_UNKNOWN UINT16_C(0x0000)
88/** Basic-16 (whatever that is). */
89#define IMAGE_FILE_MACHINE_BASIC_16 UINT16_C(0x0142)
90/** Basic-16 (whatever that is) w/ transfer vector(s?) (TV). */
91#define IMAGE_FILE_MACHINE_BASIC_16_TV UINT16_C(0x0143)
92/** Intel iAPX 16 (8086?). */
93#define IMAGE_FILE_MACHINE_IAPX16 UINT16_C(0x0144)
94/** Intel iAPX 16 (8086?) w/ transfer vector(s?) (TV). */
95#define IMAGE_FILE_MACHINE_IAPX16_TV UINT16_C(0x0145)
96/** Intel iAPX 20 (80286?). */
97#define IMAGE_FILE_MACHINE_IAPX20 UINT16_C(0x0144)
98/** Intel iAPX 20 (80286?) w/ transfer vector(s?) (TV). */
99#define IMAGE_FILE_MACHINE_IAPX20_TV UINT16_C(0x0145)
100/** X86 compatible CPU, 8086. */
101#define IMAGE_FILE_MACHINE_I8086 UINT16_C(0x0148)
102/** X86 compatible CPU, 8086 w/ transfer vector(s?) (TV). */
103#define IMAGE_FILE_MACHINE_I8086_TV UINT16_C(0x0149)
104/** X86 compatible CPU, 80286 small model program. */
105#define IMAGE_FILE_MACHINE_I286_SMALL UINT16_C(0x014a)
106/** Motorola 68000. */
107#define IMAGE_FILE_MACHINE_MC68 UINT16_C(0x0150)
108/** Motorola 68000 w/ writable text sections. */
109#define IMAGE_FILE_MACHINE_MC68_WR UINT16_C(0x0150)
110/** Motorola 68000 w/ transfer vector(s?). */
111#define IMAGE_FILE_MACHINE_MC68_TV UINT16_C(0x0151)
112/** Motorola 68000 w/ demand paged text.
113 * @note shared with 80286 large model program. */
114#define IMAGE_FILE_MACHINE_MC68_PG UINT16_C(0x0152)
115/** X86 compatible CPU, 80286 large model program.
116 * @note shared with MC68000 w/ demand paged text */
117#define IMAGE_FILE_MACHINE_I286_LARGE UINT16_C(0x0152)
118/** IBM 370 (writable text). */
119#define IMAGE_FILE_MACHINE_U370_WR UINT16_C(0x0158)
120/** Amdahl 470/580 (writable text). */
121#define IMAGE_FILE_MACHINE_AMDAHL_470_WR UINT16_C(0x0159)
122/** Amdahl 470/580 (read only text). */
123#define IMAGE_FILE_MACHINE_AMDAHL_470_RO UINT16_C(0x015c)
124/** IBM 370 (read only text). */
125#define IMAGE_FILE_MACHINE_U370_RO UINT16_C(0x015d)
126/** MIPS R4000 CPU, little endian. */
127#define IMAGE_FILE_MACHINE_R4000 UINT16_C(0x0166)
128/** MIPS CPU, little endian, Windows CE (?) v2 designation. */
129#define IMAGE_FILE_MACHINE_WCEMIPSV2 UINT16_C(0x0169)
130/** VAX-11/750 and VAX-11/780 (writable text). */
131#define IMAGE_FILE_MACHINE_VAX_WR UINT16_C(0x0178)
132/** VAX-11/750 and VAX-11/780 (read-only text). */
133#define IMAGE_FILE_MACHINE_VAX_RO UINT16_C(0x017d)
134/** Hitachi SH3 CPU. */
135#define IMAGE_FILE_MACHINE_SH3 UINT16_C(0x01a2)
136/** Hitachi SH3 DSP. */
137#define IMAGE_FILE_MACHINE_SH3DSP UINT16_C(0x01a3)
138/** Hitachi SH4 CPU. */
139#define IMAGE_FILE_MACHINE_SH4 UINT16_C(0x01a6)
140/** Hitachi SH5 CPU. */
141#define IMAGE_FILE_MACHINE_SH5 UINT16_C(0x01a8)
142/** Little endian ARM CPU. */
143#define IMAGE_FILE_MACHINE_ARM UINT16_C(0x01c0)
144/** ARM or Thumb stuff. */
145#define IMAGE_FILE_MACHINE_THUMB UINT16_C(0x01c2)
146/** ARMv7 or higher CPU, Thumb mode. */
147#define IMAGE_FILE_MACHINE_ARMNT UINT16_C(0x01c4)
148/** Matshushita AM33 CPU. */
149#define IMAGE_FILE_MACHINE_AM33 UINT16_C(0x01d3)
150/** Power PC CPU, little endian. */
151#define IMAGE_FILE_MACHINE_POWERPC UINT16_C(0x01f0)
152/** Power PC CPU with FPU, also little endian? */
153#define IMAGE_FILE_MACHINE_POWERPCFP UINT16_C(0x01f1)
154/** "Itanic" CPU. */
155#define IMAGE_FILE_MACHINE_IA64 UINT16_C(0x0200)
156/** MIPS CPU, compact 16-bit instructions only? */
157#define IMAGE_FILE_MACHINE_MIPS16 UINT16_C(0x0266)
158/** MIPS CPU with FPU, full 32-bit instructions only? */
159#define IMAGE_FILE_MACHINE_MIPSFPU UINT16_C(0x0366)
160/** MIPS CPU with FPU, compact 16-bit instructions? */
161#define IMAGE_FILE_MACHINE_MIPSFPU16 UINT16_C(0x0466)
162/** EFI byte code. */
163#define IMAGE_FILE_MACHINE_EBC UINT16_C(0x0ebc)
164/** Mitsubishi M32R CPU, little endian. */
165#define IMAGE_FILE_MACHINE_M32R UINT16_C(0x9041)
166/** ARMv8 CPU, 64-bit mode. */
167#define IMAGE_FILE_MACHINE_ARM64 UINT16_C(0xaa64)
168/** @} */
169
170/** @name File header characteristics (IMAGE_FILE_HEADER::Characteristics)
171 * @{ */
172#define IMAGE_FILE_RELOCS_STRIPPED UINT16_C(0x0001)
173#define IMAGE_FILE_EXECUTABLE_IMAGE UINT16_C(0x0002)
174#define IMAGE_FILE_LINE_NUMS_STRIPPED UINT16_C(0x0004)
175#define IMAGE_FILE_LOCAL_SYMS_STRIPPED UINT16_C(0x0008)
176#define IMAGE_FILE_AGGRESIVE_WS_TRIM UINT16_C(0x0010)
177#define IMAGE_FILE_LARGE_ADDRESS_AWARE UINT16_C(0x0020)
178#define IMAGE_FILE_16BIT_MACHINE UINT16_C(0x0040)
179#define IMAGE_FILE_BYTES_REVERSED_LO UINT16_C(0x0080)
180#define IMAGE_FILE_32BIT_MACHINE UINT16_C(0x0100)
181#define IMAGE_FILE_DEBUG_STRIPPED UINT16_C(0x0200)
182#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP UINT16_C(0x0400)
183#define IMAGE_FILE_NET_RUN_FROM_SWAP UINT16_C(0x0800)
184#define IMAGE_FILE_SYSTEM UINT16_C(0x1000) /**< (COFF/IAPX*: Used to indicate 80186 instructions) */
185#define IMAGE_FILE_DLL UINT16_C(0x2000) /**< (COFF/IAPX*: Used to indicate 80286 instructions) */
186#define IMAGE_FILE_UP_SYSTEM_ONLY UINT16_C(0x4000)
187#define IMAGE_FILE_BYTES_REVERSED_HI UINT16_C(0x8000)
188/** @} */
189
190
191#ifndef __ASSEMBLER__
192/**
193 * PE data directory.
194 *
195 * This is used to locate data in the loaded image so the dynamic linker or
196 * others can make use of it. However, in the case of
197 * IMAGE_DIRECTORY_ENTRY_SECURITY it is referring to raw file offsets.
198 */
199typedef struct _IMAGE_DATA_DIRECTORY
200{
201 uint32_t VirtualAddress;
202 uint32_t Size;
203} IMAGE_DATA_DIRECTORY;
204AssertCompileSize(IMAGE_DATA_DIRECTORY, 0x8);
205typedef IMAGE_DATA_DIRECTORY *PIMAGE_DATA_DIRECTORY;
206typedef IMAGE_DATA_DIRECTORY const *PCIMAGE_DATA_DIRECTORY;
207#endif /* !__ASSEMBLER__ */
208
209/** The standard number of data directories in the optional header.
210 * I.e. the dimensions of IMAGE_OPTIONAL_HEADER32::DataDirectory and
211 * IMAGE_OPTIONAL_HEADER64::DataDirectory.
212 */
213#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 0x10
214
215#ifndef __ASSEMBLER__
216
217/**
218 * PE optional header, 32-bit version.
219 */
220typedef struct _IMAGE_OPTIONAL_HEADER32
221{
222 uint16_t Magic; /**< 0x00 */
223 uint8_t MajorLinkerVersion; /**< 0x02 */
224 uint8_t MinorLinkerVersion; /**< 0x03 */
225 uint32_t SizeOfCode; /**< 0x04 */
226 uint32_t SizeOfInitializedData; /**< 0x08 */
227 uint32_t SizeOfUninitializedData; /**< 0x0c */
228 uint32_t AddressOfEntryPoint; /**< 0x10 */
229 uint32_t BaseOfCode; /**< 0x14 */
230 uint32_t BaseOfData; /**< 0x18 */
231 uint32_t ImageBase; /**< 0x1c */
232 uint32_t SectionAlignment; /**< 0x20 */
233 uint32_t FileAlignment; /**< 0x24 */
234 uint16_t MajorOperatingSystemVersion; /**< 0x28 */
235 uint16_t MinorOperatingSystemVersion; /**< 0x2a */
236 uint16_t MajorImageVersion; /**< 0x2c */
237 uint16_t MinorImageVersion; /**< 0x2e */
238 uint16_t MajorSubsystemVersion; /**< 0x30 */
239 uint16_t MinorSubsystemVersion; /**< 0x32 */
240 uint32_t Win32VersionValue; /**< 0x34 */
241 uint32_t SizeOfImage; /**< 0x38 */
242 uint32_t SizeOfHeaders; /**< 0x3c */
243 uint32_t CheckSum; /**< 0x40 */
244 uint16_t Subsystem; /**< 0x44 */
245 uint16_t DllCharacteristics; /**< 0x46 */
246 uint32_t SizeOfStackReserve; /**< 0x48 */
247 uint32_t SizeOfStackCommit; /**< 0x4c */
248 uint32_t SizeOfHeapReserve; /**< 0x50 */
249 uint32_t SizeOfHeapCommit; /**< 0x54 */
250 uint32_t LoaderFlags; /**< 0x58 */
251 uint32_t NumberOfRvaAndSizes; /**< 0x5c */
252 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x60; 0x10*8 = 0x80 */
253} IMAGE_OPTIONAL_HEADER32; /* size: 0xe0 */
254AssertCompileSize(IMAGE_OPTIONAL_HEADER32, 0xe0);
255typedef IMAGE_OPTIONAL_HEADER32 *PIMAGE_OPTIONAL_HEADER32;
256typedef IMAGE_OPTIONAL_HEADER32 const *PCIMAGE_OPTIONAL_HEADER32;
257
258/**
259 * PE optional header, 64-bit version.
260 */
261typedef struct _IMAGE_OPTIONAL_HEADER64
262{
263 uint16_t Magic; /**< 0x00 */
264 uint8_t MajorLinkerVersion; /**< 0x02 */
265 uint8_t MinorLinkerVersion; /**< 0x03 */
266 uint32_t SizeOfCode; /**< 0x04 */
267 uint32_t SizeOfInitializedData; /**< 0x08 */
268 uint32_t SizeOfUninitializedData; /**< 0x0c */
269 uint32_t AddressOfEntryPoint; /**< 0x10 */
270 uint32_t BaseOfCode; /**< 0x14 */
271 uint64_t ImageBase; /**< 0x18 */
272 uint32_t SectionAlignment; /**< 0x20 */
273 uint32_t FileAlignment; /**< 0x24 */
274 uint16_t MajorOperatingSystemVersion; /**< 0x28 */
275 uint16_t MinorOperatingSystemVersion; /**< 0x2a */
276 uint16_t MajorImageVersion; /**< 0x2c */
277 uint16_t MinorImageVersion; /**< 0x2e */
278 uint16_t MajorSubsystemVersion; /**< 0x30 */
279 uint16_t MinorSubsystemVersion; /**< 0x32 */
280 uint32_t Win32VersionValue; /**< 0x34 */
281 uint32_t SizeOfImage; /**< 0x38 */
282 uint32_t SizeOfHeaders; /**< 0x3c */
283 uint32_t CheckSum; /**< 0x40 */
284 uint16_t Subsystem; /**< 0x44 */
285 uint16_t DllCharacteristics; /**< 0x46 */
286 uint64_t SizeOfStackReserve; /**< 0x48 */
287 uint64_t SizeOfStackCommit; /**< 0x50 */
288 uint64_t SizeOfHeapReserve; /**< 0x58 */
289 uint64_t SizeOfHeapCommit; /**< 0x60 */
290 uint32_t LoaderFlags; /**< 0x68 */
291 uint32_t NumberOfRvaAndSizes; /**< 0x6c */
292 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x70; 0x10*8 = 0x80 */
293} IMAGE_OPTIONAL_HEADER64; /* size: 0xf0 */
294AssertCompileSize(IMAGE_OPTIONAL_HEADER64, 0xf0);
295typedef IMAGE_OPTIONAL_HEADER64 *PIMAGE_OPTIONAL_HEADER64;
296typedef IMAGE_OPTIONAL_HEADER64 const *PCIMAGE_OPTIONAL_HEADER64;
297
298#endif /* !__ASSEMBLER__ */
299
300/** @name Optional header magic values.
301 * @{ */
302#define IMAGE_NT_OPTIONAL_HDR32_MAGIC UINT16_C(0x010b)
303#define IMAGE_NT_OPTIONAL_HDR64_MAGIC UINT16_C(0x020b)
304/** @} */
305
306/** @name IMAGE_SUBSYSTEM_XXX - Optional header subsystems.
307 * IMAGE_OPTIONAL_HEADER32::Subsystem, IMAGE_OPTIONAL_HEADER64::Subsystem
308 * @{ */
309#define IMAGE_SUBSYSTEM_UNKNOWN UINT16_C(0x0000)
310#define IMAGE_SUBSYSTEM_NATIVE UINT16_C(0x0001)
311#define IMAGE_SUBSYSTEM_WINDOWS_GUI UINT16_C(0x0002)
312#define IMAGE_SUBSYSTEM_WINDOWS_CUI UINT16_C(0x0003)
313#define IMAGE_SUBSYSTEM_OS2_GUI UINT16_C(0x0004)
314#define IMAGE_SUBSYSTEM_OS2_CUI UINT16_C(0x0005)
315#define IMAGE_SUBSYSTEM_POSIX_CUI UINT16_C(0x0007)
316#define IMAGE_SUBSYSTEM_NATIVE_WINDOWS UINT16_C(0x0008) /**< Windows 9x native driver */
317#define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI UINT16_C(0x0009)
318#define IMAGE_SUBSYSTEM_EFI_APPLICATION UINT16_C(0x000a)
319#define IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER UINT16_C(0x000b)
320#define IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER UINT16_C(0x000c)
321#define IMAGE_SUBSYSTEM_EFI_ROM UINT16_C(0x000d)
322#define IMAGE_SUBSYSTEM_XBOX UINT16_C(0x000e)
323#define IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION UINT16_C(0x0010) /**< E.g. winload.exe */
324/** @} */
325
326/** @name Optional header characteristics.
327 * @{ */
328#define IMAGE_LIBRARY_PROCESS_INIT UINT16_C(0x0001)
329#define IMAGE_LIBRARY_PROCESS_TERM UINT16_C(0x0002)
330#define IMAGE_LIBRARY_THREAD_INIT UINT16_C(0x0004)
331#define IMAGE_LIBRARY_THREAD_TERM UINT16_C(0x0008)
332#define IMAGE_DLLCHARACTERISTICS_RESERVED UINT16_C(0x0010)
333#define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA UINT16_C(0x0020)
334#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE UINT16_C(0x0040)
335#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY UINT16_C(0x0080)
336#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT UINT16_C(0x0100)
337#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION UINT16_C(0x0200)
338#define IMAGE_DLLCHARACTERISTICS_NO_SEH UINT16_C(0x0400)
339#define IMAGE_DLLCHARACTERISTICS_NO_BIND UINT16_C(0x0800)
340#define IMAGE_DLLCHARACTERISTICS_APPCONTAINER UINT16_C(0x1000)
341#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER UINT16_C(0x2000)
342#define IMAGE_DLLCHARACTERISTICS_GUARD_CF UINT16_C(0x4000)
343#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE UINT16_C(0x8000)
344/** @} */
345
346
347/** @name IMAGE_DIRECTORY_ENTRY_XXX - Data directory indexes.
348 * Used to index IMAGE_OPTIONAL_HEADER32::DataDirectory and
349 * IMAGE_OPTIONAL_HEADER64::DataDirectory
350 * @{ */
351#define IMAGE_DIRECTORY_ENTRY_EXPORT 0x0
352#define IMAGE_DIRECTORY_ENTRY_IMPORT 0x1
353#define IMAGE_DIRECTORY_ENTRY_RESOURCE 0x2
354#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x3
355#define IMAGE_DIRECTORY_ENTRY_SECURITY 0x4
356#define IMAGE_DIRECTORY_ENTRY_BASERELOC 0x5
357#define IMAGE_DIRECTORY_ENTRY_DEBUG 0x6
358#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 0x7
359#define IMAGE_DIRECTORY_ENTRY_COPYRIGHT IMAGE_DIRECTORY_ENTRY_ARCHITECTURE
360#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x8
361#define IMAGE_DIRECTORY_ENTRY_TLS 0x9
362#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0xa
363#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0xb
364#define IMAGE_DIRECTORY_ENTRY_IAT 0xc
365#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0xd
366#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0xe
367/** @} */
368
369#ifndef __ASSEMBLER__
370
371/**
372 * PE (NT) headers, 32-bit version.
373 */
374typedef struct _IMAGE_NT_HEADERS32
375{
376 uint32_t Signature; /**< 0x00 */
377 IMAGE_FILE_HEADER FileHeader; /**< 0x04 */
378 IMAGE_OPTIONAL_HEADER32 OptionalHeader; /**< 0x18 */
379} IMAGE_NT_HEADERS32; /* size: 0xf8 */
380AssertCompileSize(IMAGE_NT_HEADERS32, 0xf8);
381AssertCompileMemberOffset(IMAGE_NT_HEADERS32, FileHeader, 4);
382AssertCompileMemberOffset(IMAGE_NT_HEADERS32, OptionalHeader, 24);
383typedef IMAGE_NT_HEADERS32 *PIMAGE_NT_HEADERS32;
384typedef IMAGE_NT_HEADERS32 const *PCIMAGE_NT_HEADERS32;
385
386/**
387 * PE (NT) headers, 64-bit version.
388 */
389typedef struct _IMAGE_NT_HEADERS64
390{
391 uint32_t Signature; /**< 0x00 */
392 IMAGE_FILE_HEADER FileHeader; /**< 0x04 */
393 IMAGE_OPTIONAL_HEADER64 OptionalHeader; /**< 0x18 */
394} IMAGE_NT_HEADERS64; /**< 0x108 */
395AssertCompileSize(IMAGE_NT_HEADERS64, 0x108);
396AssertCompileMemberOffset(IMAGE_NT_HEADERS64, FileHeader, 4);
397AssertCompileMemberOffset(IMAGE_NT_HEADERS64, OptionalHeader, 24);
398typedef IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
399typedef IMAGE_NT_HEADERS64 const *PCIMAGE_NT_HEADERS64;
400
401#endif /* !__ASSEMBLER__ */
402
403/** The PE signature.
404 * Used by IMAGE_NT_HEADERS32::Signature, IMAGE_NT_HEADERS64::Signature. */
405#define IMAGE_NT_SIGNATURE UINT32_C(0x00004550)
406
407
408/** Section header short name length (IMAGE_SECTION_HEADER::Name). */
409#define IMAGE_SIZEOF_SHORT_NAME 0x8
410
411#ifndef __ASSEMBLER__
412/**
413 * PE & COFF section header.
414 */
415typedef struct _IMAGE_SECTION_HEADER
416{
417 uint8_t Name[IMAGE_SIZEOF_SHORT_NAME];
418 union
419 {
420 uint32_t PhysicalAddress;
421 uint32_t VirtualSize;
422 } Misc;
423 uint32_t VirtualAddress;
424 uint32_t SizeOfRawData;
425 uint32_t PointerToRawData;
426 uint32_t PointerToRelocations;
427 uint32_t PointerToLinenumbers;
428 uint16_t NumberOfRelocations;
429 uint16_t NumberOfLinenumbers;
430 uint32_t Characteristics;
431} IMAGE_SECTION_HEADER;
432AssertCompileSize(IMAGE_SECTION_HEADER, 40);
433typedef IMAGE_SECTION_HEADER *PIMAGE_SECTION_HEADER;
434typedef IMAGE_SECTION_HEADER const *PCIMAGE_SECTION_HEADER;
435#endif /* !__ASSEMBLER__ */
436
437/** @name IMAGE_SCN_XXX - Section header characteristics.
438 * Used by IMAGE_SECTION_HEADER::Characteristics.
439 * @{ */
440#define IMAGE_SCN_TYPE_REG UINT32_C(0x00000000)
441#define IMAGE_SCN_TYPE_DSECT UINT32_C(0x00000001)
442#define IMAGE_SCN_TYPE_NOLOAD UINT32_C(0x00000002)
443#define IMAGE_SCN_TYPE_GROUP UINT32_C(0x00000004)
444#define IMAGE_SCN_TYPE_NO_PAD UINT32_C(0x00000008)
445#define IMAGE_SCN_TYPE_COPY UINT32_C(0x00000010)
446
447#define IMAGE_SCN_CNT_CODE UINT32_C(0x00000020)
448#define IMAGE_SCN_CNT_INITIALIZED_DATA UINT32_C(0x00000040)
449#define IMAGE_SCN_CNT_UNINITIALIZED_DATA UINT32_C(0x00000080)
450
451#define IMAGE_SCN_LNK_OTHER UINT32_C(0x00000100)
452#define IMAGE_SCN_LNK_INFO UINT32_C(0x00000200)
453#define IMAGE_SCN_TYPE_OVER UINT32_C(0x00000400)
454#define IMAGE_SCN_LNK_REMOVE UINT32_C(0x00000800)
455#define IMAGE_SCN_LNK_COMDAT UINT32_C(0x00001000)
456#define IMAGE_SCN_MEM_PROTECTED UINT32_C(0x00004000)
457#define IMAGE_SCN_NO_DEFER_SPEC_EXC UINT32_C(0x00004000)
458#define IMAGE_SCN_GPREL UINT32_C(0x00008000)
459#define IMAGE_SCN_MEM_FARDATA UINT32_C(0x00008000)
460#define IMAGE_SCN_MEM_SYSHEAP UINT32_C(0x00010000)
461#define IMAGE_SCN_MEM_PURGEABLE UINT32_C(0x00020000)
462#define IMAGE_SCN_MEM_16BIT UINT32_C(0x00020000)
463#define IMAGE_SCN_MEM_LOCKED UINT32_C(0x00040000)
464#define IMAGE_SCN_MEM_PRELOAD UINT32_C(0x00080000)
465
466#define IMAGE_SCN_ALIGN_1BYTES UINT32_C(0x00100000)
467#define IMAGE_SCN_ALIGN_2BYTES UINT32_C(0x00200000)
468#define IMAGE_SCN_ALIGN_4BYTES UINT32_C(0x00300000)
469#define IMAGE_SCN_ALIGN_8BYTES UINT32_C(0x00400000)
470#define IMAGE_SCN_ALIGN_16BYTES UINT32_C(0x00500000)
471#define IMAGE_SCN_ALIGN_32BYTES UINT32_C(0x00600000)
472#define IMAGE_SCN_ALIGN_64BYTES UINT32_C(0x00700000)
473#define IMAGE_SCN_ALIGN_128BYTES UINT32_C(0x00800000)
474#define IMAGE_SCN_ALIGN_256BYTES UINT32_C(0x00900000)
475#define IMAGE_SCN_ALIGN_512BYTES UINT32_C(0x00A00000)
476#define IMAGE_SCN_ALIGN_1024BYTES UINT32_C(0x00B00000)
477#define IMAGE_SCN_ALIGN_2048BYTES UINT32_C(0x00C00000)
478#define IMAGE_SCN_ALIGN_4096BYTES UINT32_C(0x00D00000)
479#define IMAGE_SCN_ALIGN_8192BYTES UINT32_C(0x00E00000)
480#define IMAGE_SCN_ALIGN_MASK UINT32_C(0x00F00000)
481#define IMAGE_SCN_ALIGN_SHIFT 20
482
483#define IMAGE_SCN_LNK_NRELOC_OVFL UINT32_C(0x01000000)
484#define IMAGE_SCN_MEM_DISCARDABLE UINT32_C(0x02000000)
485#define IMAGE_SCN_MEM_NOT_CACHED UINT32_C(0x04000000)
486#define IMAGE_SCN_MEM_NOT_PAGED UINT32_C(0x08000000)
487#define IMAGE_SCN_MEM_SHARED UINT32_C(0x10000000)
488#define IMAGE_SCN_MEM_EXECUTE UINT32_C(0x20000000)
489#define IMAGE_SCN_MEM_READ UINT32_C(0x40000000)
490#define IMAGE_SCN_MEM_WRITE UINT32_C(0x80000000)
491/** @} */
492
493
494#ifndef __ASSEMBLER__
495/**
496 * PE image base relocations block header.
497 *
498 * This found in IMAGE_DIRECTORY_ENTRY_BASERELOC. Each entry is follow
499 * immediately by an array of 16-bit words, where the lower 12-bits are used
500 * for the page offset and the upper 4-bits for the base relocation type
501 * (IMAGE_REL_BASE_XXX). The block should be padded with
502 * IMAGE_REL_BASED_ABSOLUTE entries to ensure 32-bit alignment of this header.
503 */
504typedef struct _IMAGE_BASE_RELOCATION
505{
506 /** The RVA of the page/block the following ase relocations applies to. */
507 uint32_t VirtualAddress;
508 /** The size of this relocation block, including this header. */
509 uint32_t SizeOfBlock;
510} IMAGE_BASE_RELOCATION;
511AssertCompileSize(IMAGE_BASE_RELOCATION, 8);
512typedef IMAGE_BASE_RELOCATION *PIMAGE_BASE_RELOCATION;
513typedef IMAGE_BASE_RELOCATION const *PCIMAGE_BASE_RELOCATION;
514#endif /* !__ASSEMBLER__ */
515
516/** @name IMAGE_REL_BASED_XXX - PE base relocations.
517 * Found in the IMAGE_DIRECTORY_ENTRY_BASERELOC data directory.
518 * @{ */
519#define IMAGE_REL_BASED_ABSOLUTE UINT16_C(0x0)
520#define IMAGE_REL_BASED_HIGH UINT16_C(0x1)
521#define IMAGE_REL_BASED_LOW UINT16_C(0x2)
522#define IMAGE_REL_BASED_HIGHLOW UINT16_C(0x3)
523#define IMAGE_REL_BASED_HIGHADJ UINT16_C(0x4)
524#define IMAGE_REL_BASED_MIPS_JMPADDR UINT16_C(0x5)
525#define IMAGE_REL_BASED_MIPS_JMPADDR16 UINT16_C(0x9)
526#define IMAGE_REL_BASED_IA64_IMM64 UINT16_C(0x9)
527#define IMAGE_REL_BASED_DIR64 UINT16_C(0xa)
528#define IMAGE_REL_BASED_HIGH3ADJ UINT16_C(0xb)
529/** @} */
530
531#ifndef __ASSEMBLER__
532
533/**
534 * PE export directory entry.
535 */
536typedef struct _IMAGE_EXPORT_DIRECTORY
537{
538 uint32_t Characteristics;
539 uint32_t TimeDateStamp;
540 uint16_t MajorVersion;
541 uint16_t MinorVersion;
542 uint32_t Name;
543 uint32_t Base;
544 uint32_t NumberOfFunctions;
545 uint32_t NumberOfNames;
546 uint32_t AddressOfFunctions;
547 uint32_t AddressOfNames;
548 uint32_t AddressOfNameOrdinals;
549} IMAGE_EXPORT_DIRECTORY;
550AssertCompileSize(IMAGE_EXPORT_DIRECTORY, 40);
551typedef IMAGE_EXPORT_DIRECTORY *PIMAGE_EXPORT_DIRECTORY;
552typedef IMAGE_EXPORT_DIRECTORY const *PCIMAGE_EXPORT_DIRECTORY;
553
554
555/**
556 * PE import directory entry.
557 */
558typedef struct _IMAGE_IMPORT_DESCRIPTOR
559{
560 union
561 {
562 uint32_t Characteristics;
563 uint32_t OriginalFirstThunk;
564 } u;
565 uint32_t TimeDateStamp;
566 uint32_t ForwarderChain;
567 uint32_t Name;
568 uint32_t FirstThunk;
569} IMAGE_IMPORT_DESCRIPTOR;
570AssertCompileSize(IMAGE_IMPORT_DESCRIPTOR, 20);
571typedef IMAGE_IMPORT_DESCRIPTOR *PIMAGE_IMPORT_DESCRIPTOR;
572typedef IMAGE_IMPORT_DESCRIPTOR const *PCIMAGE_IMPORT_DESCRIPTOR;
573
574/**
575 * Something we currently don't make use of...
576 */
577typedef struct _IMAGE_IMPORT_BY_NAME
578{
579 uint16_t Hint;
580 uint8_t Name[1];
581} IMAGE_IMPORT_BY_NAME;
582AssertCompileSize(IMAGE_IMPORT_BY_NAME, 4);
583typedef IMAGE_IMPORT_BY_NAME *PIMAGE_IMPORT_BY_NAME;
584typedef IMAGE_IMPORT_BY_NAME const *PCIMAGE_IMPORT_BY_NAME;
585
586
587# if 0
588/* The image_thunk_data32/64 structures are not very helpful except for getting RSI.
589 keep them around till all the code has been converted. */
590typedef struct _IMAGE_THUNK_DATA64
591{
592 union
593 {
594 uint64_t ForwarderString;
595 uint64_t Function;
596 uint64_t Ordinal;
597 uint64_t AddressOfData;
598 } u1;
599} IMAGE_THUNK_DATA64;
600typedef IMAGE_THUNK_DATA64 *PIMAGE_THUNK_DATA64;
601typedef IMAGE_THUNK_DATA64 const *PCIMAGE_THUNK_DATA64;
602
603typedef struct _IMAGE_THUNK_DATA32
604{
605 union
606 {
607 uint32_t ForwarderString;
608 uint32_t Function;
609 uint32_t Ordinal;
610 uint32_t AddressOfData;
611 } u1;
612} IMAGE_THUNK_DATA32;
613typedef IMAGE_THUNK_DATA32 *PIMAGE_THUNK_DATA32;
614typedef IMAGE_THUNK_DATA32 const *PCIMAGE_THUNK_DATA32;
615# endif
616
617#endif /* !__ASSEMBLER__ */
618
619/** @name PE import directory macros.
620 * @{ */
621#define IMAGE_ORDINAL_FLAG32 UINT32_C(0x80000000)
622#define IMAGE_ORDINAL32(ord) ((ord) & UINT32_C(0xffff))
623#define IMAGE_SNAP_BY_ORDINAL32(ord) (!!((ord) & IMAGE_ORDINAL_FLAG32))
624
625#define IMAGE_ORDINAL_FLAG64 UINT64_C(0x8000000000000000)
626#define IMAGE_ORDINAL64(ord) ((ord) & UINT32_C(0xffff))
627#define IMAGE_SNAP_BY_ORDINAL64(ord) (!!((ord) & IMAGE_ORDINAL_FLAG64))
628/** @} */
629
630#ifndef __ASSEMBLER__
631
632/** @name PE Resource directory
633 * @{ */
634typedef struct _IMAGE_RESOURCE_DIRECTORY
635{
636 uint32_t Characteristics;
637 uint32_t TimeDateStamp;
638 uint16_t MajorVersion;
639 uint16_t MinorVersion;
640 uint16_t NumberOfNamedEntries;
641 uint16_t NumberOfIdEntries;
642} IMAGE_RESOURCE_DIRECTORY;
643typedef IMAGE_RESOURCE_DIRECTORY *PIMAGE_RESOURCE_DIRECTORY;
644typedef IMAGE_RESOURCE_DIRECTORY const *PCIMAGE_RESOURCE_DIRECTORY;
645
646typedef struct _IMAGE_RESOURCE_DIRECTORY_ENTRY
647{
648 union
649 {
650 struct
651 {
652 uint32_t NameOffset : 31;
653 uint32_t NameIsString : 1; /**< IMAGE_RESOURCE_NAME_IS_STRING */
654 } s;
655 uint32_t Name;
656 uint16_t Id;
657 } u;
658 union
659 {
660 struct
661 {
662 uint32_t OffsetToDirectory : 31;
663 uint32_t DataIsDirectory : 1; /**< IMAGE_RESOURCE_DATA_IS_DIRECTORY*/
664 } s2;
665 uint32_t OffsetToData;
666 } u2;
667} IMAGE_RESOURCE_DIRECTORY_ENTRY;
668typedef IMAGE_RESOURCE_DIRECTORY_ENTRY *PIMAGE_RESOURCE_DIRECTORY_ENTRY;
669typedef IMAGE_RESOURCE_DIRECTORY_ENTRY const *PCIMAGE_RESOURCE_DIRECTORY_ENTRY;
670
671#endif /* !__ASSEMBLER__ */
672
673#define IMAGE_RESOURCE_NAME_IS_STRING UINT32_C(0x80000000)
674#define IMAGE_RESOURCE_DATA_IS_DIRECTORY UINT32_C(0x80000000)
675
676#ifndef __ASSEMBLER__
677
678typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING
679{
680 uint16_t Length;
681 char NameString[1];
682} IMAGE_RESOURCE_DIRECTORY_STRING;
683typedef IMAGE_RESOURCE_DIRECTORY_STRING *PIMAGE_RESOURCE_DIRECTORY_STRING;
684typedef IMAGE_RESOURCE_DIRECTORY_STRING const *PCIMAGE_RESOURCE_DIRECTORY_STRING;
685
686
687typedef struct _IMAGE_RESOURCE_DIR_STRING_U
688{
689 uint16_t Length;
690 RTUTF16 NameString[1];
691} IMAGE_RESOURCE_DIR_STRING_U;
692typedef IMAGE_RESOURCE_DIR_STRING_U *PIMAGE_RESOURCE_DIR_STRING_U;
693typedef IMAGE_RESOURCE_DIR_STRING_U const *PCIMAGE_RESOURCE_DIR_STRING_U;
694
695
696typedef struct _IMAGE_RESOURCE_DATA_ENTRY
697{
698 uint32_t OffsetToData;
699 uint32_t Size;
700 uint32_t CodePage;
701 uint32_t Reserved;
702} IMAGE_RESOURCE_DATA_ENTRY;
703typedef IMAGE_RESOURCE_DATA_ENTRY *PIMAGE_RESOURCE_DATA_ENTRY;
704typedef IMAGE_RESOURCE_DATA_ENTRY const *PCIMAGE_RESOURCE_DATA_ENTRY;
705
706#endif /* !__ASSEMBLER__ */
707
708/** @} */
709
710/** @name Image exception information
711 * @{ */
712
713#ifndef __ASSEMBLER__
714
715/** This structure is used by AMD64 and "Itanic".
716 * MIPS uses a different one. ARM, SH3, SH4 and PPC on WinCE also uses a different one. */
717typedef struct _IMAGE_AMD64_RUNTIME_FUNCTION_ENTRY
718{
719 uint32_t BeginAddress;
720 uint32_t EndAddress;
721 uint32_t UnwindInfoAddress;
722} IMAGE_AMD64_RUNTIME_FUNCTION_ENTRY;
723AssertCompileSize(IMAGE_AMD64_RUNTIME_FUNCTION_ENTRY, 12);
724typedef IMAGE_AMD64_RUNTIME_FUNCTION_ENTRY *PIMAGE_AMD64_RUNTIME_FUNCTION_ENTRY;
725typedef IMAGE_AMD64_RUNTIME_FUNCTION_ENTRY const *PCIMAGE_AMD64_RUNTIME_FUNCTION_ENTRY;
726
727/** The IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY::Flag values. */
728typedef enum ARM64_FNPDATA_FLAGS
729{
730 PdataRefToFullXdata = 0,
731 PdataPackedUnwindFunction,
732 PdataPackedUnwindFragment
733} ARM64_FNPDATA_FLAGS;
734
735/** The IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY::CR values. */
736typedef enum ARM64_FNPDATA_CR
737{
738 PdataCrUnchained = 0,
739 PdataCrUnchainedSavedLr,
740 PdataCrChainedWithPac,
741 PdataCrChained
742} ARM64_FNPDATA_CR;
743
744/** This structure is used by ARM64. */
745typedef struct _IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY
746{
747 uint32_t BeginAddress;
748 RT_GCC_EXTENSION
749 union
750 {
751 uint32_t UnwindData;
752 RT_GCC_EXTENSION
753 struct
754 {
755 uint32_t Flag : 2;
756 uint32_t FunctionLength : 11;
757 uint32_t RegF : 3;
758 uint32_t RegI : 4;
759 uint32_t H : 1;
760 uint32_t CR : 2;
761 uint32_t FrameSize : 9;
762 };
763 };
764} IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY;
765AssertCompileSize(IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY, 8);
766typedef IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY *PIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY;
767typedef IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY const *PCIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY;
768
769/** UnwindData word \#0. */
770typedef struct IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_BITFIELDS
771{
772 uint32_t FunctionLength : 18;
773 uint32_t Version : 2;
774 uint32_t ExceptionDataPresent : 1;
775 uint32_t EpilogInHeader : 1;
776 uint32_t EpilogCount : 5;
777 uint32_t CodeWords : 5;
778} IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_BITFIELDS;
779
780/** UnwindData word \#1, if present. */
781typedef struct IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_EXTENDED_BITFIELDS
782{
783 uint32_t ExtendedEpilogCount : 16;
784 uint32_t ExtendecodeWords : 8;
785 uint32_t Reserved : 8;
786} IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_EXTENDED_BITFIELDS;
787
788/** UnwindData word \#2 or if no extended fields \#1. */
789typedef struct IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_EPILOG_BITFIELDS
790{
791 uint32_t EpilogStartOffset : 18;
792 uint32_t Reserved : 4;
793 uint32_t EpilogStartIndex : 10;
794} IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_EPILOG_BITFIELDS;
795
796typedef union IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA
797{
798 uint32_t HeaderData;
799 RT_GCC_EXTENSION
800 struct /* copy of IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_BITFIELDS above */
801 {
802 uint32_t FunctionLength : 18;
803 uint32_t Version : 2;
804 uint32_t ExceptionDataPresent : 1;
805 uint32_t EpilogInHeader : 1;
806 uint32_t EpilogCount : 5;
807 uint32_t CodeWords : 5;
808 };
809 /* Non-standard, but convenient: */
810 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_EXTENDED_BITFIELDS ExtendedInfo;
811 IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA_EPILOG_BITFIELDS EpilogInfo;
812} IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA;
813AssertCompileSize(IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA, 4);
814typedef IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA *PIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA;
815typedef IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA const *PCIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY_XDATA;
816
817#ifdef RT_ARCH_ARM64
818typedef IMAGE_ARM64_RUNTIME_FUNCTION_ENTRY IMAGE_RUNTIME_FUNCTION_ENTRY;
819typedef PIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY PIMAGE_RUNTIME_FUNCTION_ENTRY;
820typedef PCIMAGE_ARM64_RUNTIME_FUNCTION_ENTRY PCIMAGE_RUNTIME_FUNCTION_ENTRY;
821#else
822typedef IMAGE_AMD64_RUNTIME_FUNCTION_ENTRY IMAGE_RUNTIME_FUNCTION_ENTRY;
823typedef PIMAGE_AMD64_RUNTIME_FUNCTION_ENTRY PIMAGE_RUNTIME_FUNCTION_ENTRY;
824typedef PCIMAGE_AMD64_RUNTIME_FUNCTION_ENTRY PCIMAGE_RUNTIME_FUNCTION_ENTRY;
825#endif
826
827/**
828 * An unwind code for AMD64 and ARM64.
829 *
830 * @note Also known as UNWIND_CODE or _UNWIND_CODE.
831 */
832typedef union IMAGE_UNWIND_CODE
833{
834 struct
835 {
836 /** The prolog offset where the change takes effect.
837 * This means the instruction following the one being described. */
838 uint8_t CodeOffset;
839 /** Unwind opcode.
840 * For AMD64 see IMAGE_AMD64_UNWIND_OP_CODES. */
841 RT_GCC_EXTENSION uint8_t UnwindOp : 4;
842 /** Opcode specific. */
843 RT_GCC_EXTENSION uint8_t OpInfo : 4;
844 } u;
845 uint16_t FrameOffset;
846} IMAGE_UNWIND_CODE;
847AssertCompileSize(IMAGE_UNWIND_CODE, 2);
848
849/**
850 * Unwind information for AMD64 and ARM64.
851 *
852 * Pointed to by IMAGE_RUNTIME_FUNCTION_ENTRY::UnwindInfoAddress,
853 *
854 * @note Also known as UNWIND_INFO or _UNWIND_INFO.
855 */
856typedef struct IMAGE_UNWIND_INFO
857{
858 /** Version, currently 1 or 2. The latter if IMAGE_AMD64_UWOP_EPILOG is used. */
859 RT_GCC_EXTENSION uint8_t Version : 3;
860 /** IMAGE_UNW_FLAG_XXX */
861 RT_GCC_EXTENSION uint8_t Flags : 5;
862 /** Size of function prolog. */
863 uint8_t SizeOfProlog;
864 /** Number of opcodes in aOpcodes. */
865 uint8_t CountOfCodes;
866 /** Initial frame register. */
867 RT_GCC_EXTENSION uint8_t FrameRegister : 4;
868 /** Scaled frame register offset. */
869 RT_GCC_EXTENSION uint8_t FrameOffset : 4;
870 /** Unwind opcodes. */
871 RT_FLEXIBLE_ARRAY_EXTENSION
872 IMAGE_UNWIND_CODE aOpcodes[RT_FLEXIBLE_ARRAY];
873} IMAGE_UNWIND_INFO;
874AssertCompileMemberOffset(IMAGE_UNWIND_INFO, aOpcodes, 4);
875typedef IMAGE_UNWIND_INFO *PIMAGE_UNWIND_INFO;
876typedef IMAGE_UNWIND_INFO const *PCIMAGE_UNWIND_INFO;
877
878#endif /* !__ASSEMBLER__ */
879
880/** IMAGE_UNW_FLAGS_XXX - IMAGE_UNWIND_INFO::Flags.
881 * @{ */
882/** No handler.
883 * @note Also know as UNW_FLAG_NHANDLER. */
884#define IMAGE_UNW_FLAGS_NHANDLER 0
885/** Have exception handler (RVA after codes, dword aligned.)
886 * @note Also know as UNW_FLAG_NHANDLER. */
887#define IMAGE_UNW_FLAGS_EHANDLER 1
888/** Have unwind handler (RVA after codes, dword aligned.)
889 * @note Also know as UNW_FLAG_NHANDLER. */
890#define IMAGE_UNW_FLAGS_UHANDLER 2
891/** Set if not primary unwind info for a function. An
892 * IMAGE_RUNTIME_FUNCTION_ENTRY giving the chained unwind info follows the
893 * aOpcodes array at a dword aligned offset. */
894#define IMAGE_UNW_FLAGS_CHAININFO 4
895/** @} */
896
897#ifndef __ASSEMBLER__
898/**
899 * AMD64 unwind opcodes.
900 */
901typedef enum IMAGE_AMD64_UNWIND_OP_CODES
902{
903 /** Push non-volatile register (OpInfo).
904 * YASM: [pushreg reg]
905 * MASM: .PUSHREG reg */
906 IMAGE_AMD64_UWOP_PUSH_NONVOL = 0,
907 /** Stack allocation: Size stored in scaled in the next slot if OpInfo == 0,
908 * otherwise stored unscaled in the next two slots.
909 * YASM: [allocstack size]
910 * MASM: .ALLOCSTACK size */
911 IMAGE_AMD64_UWOP_ALLOC_LARGE,
912 /** Stack allocation: OpInfo = size / 8 - 1.
913 * YASM: [allocstack size]
914 * MASM: .ALLOCSTACK size */
915 IMAGE_AMD64_UWOP_ALLOC_SMALL,
916 /** Set frame pointer register: RSP + FrameOffset * 16.
917 * YASM: [setframe reg, offset]
918 * MASM: .SETFRAME reg, offset
919 * @code
920 * LEA RBP, [RSP + 20h]
921 * [setframe RBP, 20h]
922 * @endcode */
923 IMAGE_AMD64_UWOP_SET_FPREG,
924 /** Save non-volatile register (OpInfo) on stack (RSP/FP + next slot).
925 * YASM: [savereg reg, offset]
926 * MASM: .SAVEREG reg, offset */
927 IMAGE_AMD64_UWOP_SAVE_NONVOL,
928 /** Save non-volatile register (OpInfo) on stack (RSP/FP + next two slots).
929 * YASM: [savereg reg, offset]
930 * MASM: .SAVEREG reg, offset */
931 IMAGE_AMD64_UWOP_SAVE_NONVOL_FAR,
932 /** Epilog info, version 2+.
933 *
934 * The first time this opcode is used, the CodeOffset gives the size of the
935 * epilog and bit 0 of the OpInfo field indicates that there is only one
936 * epilog at the very end of the function.
937 *
938 * Subsequent uses of this opcode specifies epilog start offsets relative to
939 * the end of the function, using CodeOffset for the 8 lower bits and OpInfo
940 * for bits 8 thru 11.
941 *
942 * The compiler seems to stack allocations and register saving opcodes and
943 * indicates the location mirroring the first IMAGE_AMD64_UWOP_PUSH_NONVOL. */
944 IMAGE_AMD64_UWOP_EPILOG,
945 /** Undefined. */
946 IMAGE_AMD64_UWOP_RESERVED_7,
947 /** Save 128-bit XMM register (OpInfo) on stack (RSP/FP + next slot).
948 * YASM: [savexmm128 reg, offset]
949 * MASM: .SAVEXMM128 reg, offset */
950 IMAGE_AMD64_UWOP_SAVE_XMM128,
951 /** Save 128-bit XMM register (OpInfo) on stack (RSP/FP + next two slots).
952 * YASM: [savexmm128 reg, offset]
953 * MASM: .SAVEXMM128 reg, offset */
954 IMAGE_AMD64_UWOP_SAVE_XMM128_FAR,
955 /** IRET frame, OpInfo serves as error code indicator.
956 * YASM: [pushframe with-code]
957 * MASM: .pushframe with-code */
958 IMAGE_AMD64_UWOP_PUSH_MACHFRAME
959} IMAGE_AMD64_UNWIND_OP_CODES;
960#endif /* !__ASSEMBLER__ */
961
962/** @} */
963
964
965
966/** @name Image load config directories
967 * @{ */
968#ifndef __ASSEMBLER__
969
970/** @since Windows 10 (preview 9879) */
971typedef struct _IMAGE_LOAD_CONFIG_CODE_INTEGRITY
972{
973 uint16_t Flags;
974 uint16_t Catalog;
975 uint32_t CatalogOffset;
976 uint32_t Reserved;
977} IMAGE_LOAD_CONFIG_CODE_INTEGRITY;
978AssertCompileSize(IMAGE_LOAD_CONFIG_CODE_INTEGRITY, 12);
979typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY *PIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
980typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY const *PCIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
981
982typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V1
983{
984 uint32_t Size;
985 uint32_t TimeDateStamp;
986 uint16_t MajorVersion;
987 uint16_t MinorVersion;
988 uint32_t GlobalFlagsClear;
989 uint32_t GlobalFlagsSet;
990 uint32_t CriticalSectionDefaultTimeout;
991 uint32_t DeCommitFreeBlockThreshold;
992 uint32_t DeCommitTotalFreeThreshold;
993 uint32_t LockPrefixTable;
994 uint32_t MaximumAllocationSize;
995 uint32_t VirtualMemoryThreshold;
996 uint32_t ProcessHeapFlags;
997 uint32_t ProcessAffinityMask;
998 uint16_t CSDVersion;
999 uint16_t DependentLoadFlags;
1000 uint32_t EditList;
1001 uint32_t SecurityCookie;
1002} IMAGE_LOAD_CONFIG_DIRECTORY32_V1;
1003AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V1, 0x40);
1004typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
1005typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
1006
1007typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V2
1008{
1009 uint32_t Size;
1010 uint32_t TimeDateStamp;
1011 uint16_t MajorVersion;
1012 uint16_t MinorVersion;
1013 uint32_t GlobalFlagsClear;
1014 uint32_t GlobalFlagsSet;
1015 uint32_t CriticalSectionDefaultTimeout;
1016 uint32_t DeCommitFreeBlockThreshold;
1017 uint32_t DeCommitTotalFreeThreshold;
1018 uint32_t LockPrefixTable;
1019 uint32_t MaximumAllocationSize;
1020 uint32_t VirtualMemoryThreshold;
1021 uint32_t ProcessHeapFlags;
1022 uint32_t ProcessAffinityMask;
1023 uint16_t CSDVersion;
1024 uint16_t DependentLoadFlags;
1025 uint32_t EditList;
1026 uint32_t SecurityCookie;
1027 uint32_t SEHandlerTable;
1028 uint32_t SEHandlerCount;
1029} IMAGE_LOAD_CONFIG_DIRECTORY32_V2;
1030AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V2, 0x48);
1031typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
1032typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
1033
1034typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V3
1035{
1036 uint32_t Size;
1037 uint32_t TimeDateStamp;
1038 uint16_t MajorVersion;
1039 uint16_t MinorVersion;
1040 uint32_t GlobalFlagsClear;
1041 uint32_t GlobalFlagsSet;
1042 uint32_t CriticalSectionDefaultTimeout;
1043 uint32_t DeCommitFreeBlockThreshold;
1044 uint32_t DeCommitTotalFreeThreshold;
1045 uint32_t LockPrefixTable;
1046 uint32_t MaximumAllocationSize;
1047 uint32_t VirtualMemoryThreshold;
1048 uint32_t ProcessHeapFlags;
1049 uint32_t ProcessAffinityMask;
1050 uint16_t CSDVersion;
1051 uint16_t DependentLoadFlags;
1052 uint32_t EditList;
1053 uint32_t SecurityCookie;
1054 uint32_t SEHandlerTable;
1055 uint32_t SEHandlerCount;
1056 uint32_t GuardCFCCheckFunctionPointer;
1057 uint32_t GuardCFDispatchFunctionPointer;
1058 uint32_t GuardCFFunctionTable;
1059 uint32_t GuardCFFunctionCount;
1060 uint32_t GuardFlags;
1061} IMAGE_LOAD_CONFIG_DIRECTORY32_V3;
1062AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V3, 0x5c);
1063typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
1064typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
1065
1066/** @since Windows 10 (preview 9879) */
1067typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V4
1068{
1069 uint32_t Size;
1070 uint32_t TimeDateStamp;
1071 uint16_t MajorVersion;
1072 uint16_t MinorVersion;
1073 uint32_t GlobalFlagsClear;
1074 uint32_t GlobalFlagsSet;
1075 uint32_t CriticalSectionDefaultTimeout;
1076 uint32_t DeCommitFreeBlockThreshold;
1077 uint32_t DeCommitTotalFreeThreshold;
1078 uint32_t LockPrefixTable;
1079 uint32_t MaximumAllocationSize;
1080 uint32_t VirtualMemoryThreshold;
1081 uint32_t ProcessHeapFlags;
1082 uint32_t ProcessAffinityMask;
1083 uint16_t CSDVersion;
1084 uint16_t DependentLoadFlags;
1085 uint32_t EditList;
1086 uint32_t SecurityCookie;
1087 uint32_t SEHandlerTable;
1088 uint32_t SEHandlerCount;
1089 uint32_t GuardCFCCheckFunctionPointer;
1090 uint32_t GuardCFDispatchFunctionPointer;
1091 uint32_t GuardCFFunctionTable;
1092 uint32_t GuardCFFunctionCount;
1093 uint32_t GuardFlags;
1094 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
1095} IMAGE_LOAD_CONFIG_DIRECTORY32_V4;
1096AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V4, 0x68);
1097typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
1098typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
1099
1100/** @since Windows 10 build 14286 (or maybe earlier). */
1101typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V5
1102{
1103 uint32_t Size;
1104 uint32_t TimeDateStamp;
1105 uint16_t MajorVersion;
1106 uint16_t MinorVersion;
1107 uint32_t GlobalFlagsClear;
1108 uint32_t GlobalFlagsSet;
1109 uint32_t CriticalSectionDefaultTimeout;
1110 uint32_t DeCommitFreeBlockThreshold;
1111 uint32_t DeCommitTotalFreeThreshold;
1112 uint32_t LockPrefixTable;
1113 uint32_t MaximumAllocationSize;
1114 uint32_t VirtualMemoryThreshold;
1115 uint32_t ProcessHeapFlags;
1116 uint32_t ProcessAffinityMask;
1117 uint16_t CSDVersion;
1118 uint16_t DependentLoadFlags;
1119 uint32_t EditList;
1120 uint32_t SecurityCookie;
1121 uint32_t SEHandlerTable;
1122 uint32_t SEHandlerCount;
1123 uint32_t GuardCFCCheckFunctionPointer;
1124 uint32_t GuardCFDispatchFunctionPointer;
1125 uint32_t GuardCFFunctionTable;
1126 uint32_t GuardCFFunctionCount;
1127 uint32_t GuardFlags;
1128 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
1129 uint32_t GuardAddressTakenIatEntryTable;
1130 uint32_t GuardAddressTakenIatEntryCount;
1131 uint32_t GuardLongJumpTargetTable;
1132 uint32_t GuardLongJumpTargetCount;
1133} IMAGE_LOAD_CONFIG_DIRECTORY32_V5;
1134AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V5, 0x78);
1135typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V5 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V5;
1136typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V5 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V5;
1137
1138/** @since Windows 10 build 14383 (or maybe earlier). */
1139typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V6
1140{
1141 uint32_t Size; /**< 0x00 */
1142 uint32_t TimeDateStamp; /**< 0x04 */
1143 uint16_t MajorVersion; /**< 0x08 */
1144 uint16_t MinorVersion; /**< 0x0a */
1145 uint32_t GlobalFlagsClear; /**< 0x0c */
1146 uint32_t GlobalFlagsSet; /**< 0x10 */
1147 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1148 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1149 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1150 uint32_t LockPrefixTable; /**< 0x20 */
1151 uint32_t MaximumAllocationSize; /**< 0x24 */
1152 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1153 uint32_t ProcessHeapFlags; /**< 0x2c */
1154 uint32_t ProcessAffinityMask; /**< 0x30 */
1155 uint16_t CSDVersion; /**< 0x34 */
1156 uint16_t DependentLoadFlags; /**< 0x36 */
1157 uint32_t EditList; /**< 0x38 */
1158 uint32_t SecurityCookie; /**< 0x3c */
1159 uint32_t SEHandlerTable; /**< 0x40 */
1160 uint32_t SEHandlerCount; /**< 0x44 */
1161 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1162 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1163 uint32_t GuardCFFunctionTable; /**< 0x50 */
1164 uint32_t GuardCFFunctionCount; /**< 0x54 */
1165 uint32_t GuardFlags; /**< 0x58 */
1166 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1167 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1168 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1169 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1170 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1171 uint32_t DynamicValueRelocTable; /**< 0x78 */
1172 uint32_t HybridMetadataPointer; /**< 0x7c */
1173} IMAGE_LOAD_CONFIG_DIRECTORY32_V6;
1174AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V6, 0x80);
1175typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V6 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V6;
1176typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V6 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V6;
1177
1178/** @since Windows 10 build 14901 (or maybe earlier). */
1179typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V7
1180{
1181 uint32_t Size; /**< 0x00 */
1182 uint32_t TimeDateStamp; /**< 0x04 */
1183 uint16_t MajorVersion; /**< 0x08 */
1184 uint16_t MinorVersion; /**< 0x0a */
1185 uint32_t GlobalFlagsClear; /**< 0x0c */
1186 uint32_t GlobalFlagsSet; /**< 0x10 */
1187 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1188 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1189 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1190 uint32_t LockPrefixTable; /**< 0x20 */
1191 uint32_t MaximumAllocationSize; /**< 0x24 */
1192 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1193 uint32_t ProcessHeapFlags; /**< 0x2c */
1194 uint32_t ProcessAffinityMask; /**< 0x30 */
1195 uint16_t CSDVersion; /**< 0x34 */
1196 uint16_t DependentLoadFlags; /**< 0x36 */
1197 uint32_t EditList; /**< 0x38 */
1198 uint32_t SecurityCookie; /**< 0x3c */
1199 uint32_t SEHandlerTable; /**< 0x40 */
1200 uint32_t SEHandlerCount; /**< 0x44 */
1201 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1202 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1203 uint32_t GuardCFFunctionTable; /**< 0x50 */
1204 uint32_t GuardCFFunctionCount; /**< 0x54 */
1205 uint32_t GuardFlags; /**< 0x58 */
1206 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1207 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1208 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1209 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1210 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1211 uint32_t DynamicValueRelocTable; /**< 0x78 */
1212 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1213 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1214 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1215 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1216 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1217 uint16_t Reserved2; /**< 0x8e */
1218} IMAGE_LOAD_CONFIG_DIRECTORY32_V7;
1219AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V7, 0x90);
1220typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V7 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V7;
1221typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V7 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V7;
1222
1223/** @since Windows 10 build 15002 (or maybe earlier). */
1224typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V8
1225{
1226 uint32_t Size; /**< 0x00 */
1227 uint32_t TimeDateStamp; /**< 0x04 */
1228 uint16_t MajorVersion; /**< 0x08 */
1229 uint16_t MinorVersion; /**< 0x0a */
1230 uint32_t GlobalFlagsClear; /**< 0x0c */
1231 uint32_t GlobalFlagsSet; /**< 0x10 */
1232 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1233 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1234 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1235 uint32_t LockPrefixTable; /**< 0x20 */
1236 uint32_t MaximumAllocationSize; /**< 0x24 */
1237 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1238 uint32_t ProcessHeapFlags; /**< 0x2c */
1239 uint32_t ProcessAffinityMask; /**< 0x30 */
1240 uint16_t CSDVersion; /**< 0x34 */
1241 uint16_t DependentLoadFlags; /**< 0x36 */
1242 uint32_t EditList; /**< 0x38 */
1243 uint32_t SecurityCookie; /**< 0x3c */
1244 uint32_t SEHandlerTable; /**< 0x40 */
1245 uint32_t SEHandlerCount; /**< 0x44 */
1246 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1247 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1248 uint32_t GuardCFFunctionTable; /**< 0x50 */
1249 uint32_t GuardCFFunctionCount; /**< 0x54 */
1250 uint32_t GuardFlags; /**< 0x58 */
1251 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1252 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1253 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1254 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1255 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1256 uint32_t DynamicValueRelocTable; /**< 0x78 */
1257 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1258 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1259 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1260 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1261 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1262 uint16_t Reserved2; /**< 0x8e */
1263 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1264 uint32_t HotPatchTableOffset; /**< 0x94 */
1265} IMAGE_LOAD_CONFIG_DIRECTORY32_V8;
1266AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V8, 0x98);
1267typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V8 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V8;
1268typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V8 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V8;
1269
1270/** @since Windows 10 build 16237 (or maybe earlier). */
1271typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V9
1272{
1273 uint32_t Size; /**< 0x00 */
1274 uint32_t TimeDateStamp; /**< 0x04 */
1275 uint16_t MajorVersion; /**< 0x08 */
1276 uint16_t MinorVersion; /**< 0x0a */
1277 uint32_t GlobalFlagsClear; /**< 0x0c */
1278 uint32_t GlobalFlagsSet; /**< 0x10 */
1279 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1280 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1281 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1282 uint32_t LockPrefixTable; /**< 0x20 */
1283 uint32_t MaximumAllocationSize; /**< 0x24 */
1284 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1285 uint32_t ProcessHeapFlags; /**< 0x2c */
1286 uint32_t ProcessAffinityMask; /**< 0x30 */
1287 uint16_t CSDVersion; /**< 0x34 */
1288 uint16_t DependentLoadFlags; /**< 0x36 */
1289 uint32_t EditList; /**< 0x38 */
1290 uint32_t SecurityCookie; /**< 0x3c */
1291 uint32_t SEHandlerTable; /**< 0x40 */
1292 uint32_t SEHandlerCount; /**< 0x44 */
1293 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1294 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1295 uint32_t GuardCFFunctionTable; /**< 0x50 */
1296 uint32_t GuardCFFunctionCount; /**< 0x54 */
1297 uint32_t GuardFlags; /**< 0x58 */
1298 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1299 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1300 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1301 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1302 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1303 uint32_t DynamicValueRelocTable; /**< 0x78 */
1304 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1305 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1306 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1307 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1308 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1309 uint16_t Reserved2; /**< 0x8e */
1310 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1311 uint32_t HotPatchTableOffset; /**< 0x94 */
1312 uint32_t Reserved3; /**< 0x98 */
1313 uint32_t EnclaveConfigurationPointer; /**< 0x9c */
1314} IMAGE_LOAD_CONFIG_DIRECTORY32_V9;
1315AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V9, 0xa0);
1316typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V9 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V9;
1317typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V9 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V9;
1318
1319/** @since Windows 10 build 18362 (or maybe earlier). */
1320typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V10
1321{
1322 uint32_t Size; /**< 0x00 */
1323 uint32_t TimeDateStamp; /**< 0x04 */
1324 uint16_t MajorVersion; /**< 0x08 */
1325 uint16_t MinorVersion; /**< 0x0a */
1326 uint32_t GlobalFlagsClear; /**< 0x0c */
1327 uint32_t GlobalFlagsSet; /**< 0x10 */
1328 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1329 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1330 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1331 uint32_t LockPrefixTable; /**< 0x20 */
1332 uint32_t MaximumAllocationSize; /**< 0x24 */
1333 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1334 uint32_t ProcessHeapFlags; /**< 0x2c */
1335 uint32_t ProcessAffinityMask; /**< 0x30 */
1336 uint16_t CSDVersion; /**< 0x34 */
1337 uint16_t DependentLoadFlags; /**< 0x36 */
1338 uint32_t EditList; /**< 0x38 */
1339 uint32_t SecurityCookie; /**< 0x3c */
1340 uint32_t SEHandlerTable; /**< 0x40 */
1341 uint32_t SEHandlerCount; /**< 0x44 */
1342 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1343 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1344 uint32_t GuardCFFunctionTable; /**< 0x50 */
1345 uint32_t GuardCFFunctionCount; /**< 0x54 */
1346 uint32_t GuardFlags; /**< 0x58 */
1347 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1348 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1349 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1350 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1351 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1352 uint32_t DynamicValueRelocTable; /**< 0x78 */
1353 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1354 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1355 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1356 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1357 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1358 uint16_t Reserved2; /**< 0x8e */
1359 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1360 uint32_t HotPatchTableOffset; /**< 0x94 */
1361 uint32_t Reserved3; /**< 0x98 */
1362 uint32_t EnclaveConfigurationPointer; /**< 0x9c */
1363 uint32_t VolatileMetadataPointer; /**< 0xa0 */
1364} IMAGE_LOAD_CONFIG_DIRECTORY32_V10;
1365AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V10, 0xa4);
1366typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V10 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V10;
1367typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V10 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V10;
1368
1369/** @since Windows 10 build 19564 (or maybe earlier). */
1370typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V11
1371{
1372 uint32_t Size; /**< 0x00 */
1373 uint32_t TimeDateStamp; /**< 0x04 */
1374 uint16_t MajorVersion; /**< 0x08 */
1375 uint16_t MinorVersion; /**< 0x0a */
1376 uint32_t GlobalFlagsClear; /**< 0x0c */
1377 uint32_t GlobalFlagsSet; /**< 0x10 */
1378 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1379 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1380 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1381 uint32_t LockPrefixTable; /**< 0x20 */
1382 uint32_t MaximumAllocationSize; /**< 0x24 */
1383 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1384 uint32_t ProcessHeapFlags; /**< 0x2c */
1385 uint32_t ProcessAffinityMask; /**< 0x30 */
1386 uint16_t CSDVersion; /**< 0x34 */
1387 uint16_t DependentLoadFlags; /**< 0x36 */
1388 uint32_t EditList; /**< 0x38 */
1389 uint32_t SecurityCookie; /**< 0x3c */
1390 uint32_t SEHandlerTable; /**< 0x40 */
1391 uint32_t SEHandlerCount; /**< 0x44 */
1392 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1393 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1394 uint32_t GuardCFFunctionTable; /**< 0x50 */
1395 uint32_t GuardCFFunctionCount; /**< 0x54 */
1396 uint32_t GuardFlags; /**< 0x58 */
1397 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1398 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1399 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1400 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1401 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1402 uint32_t DynamicValueRelocTable; /**< 0x78 */
1403 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1404 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1405 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1406 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1407 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1408 uint16_t Reserved2; /**< 0x8e */
1409 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1410 uint32_t HotPatchTableOffset; /**< 0x94 */
1411 uint32_t Reserved3; /**< 0x98 */
1412 uint32_t EnclaveConfigurationPointer; /**< 0x9c - virtual address */
1413 uint32_t VolatileMetadataPointer; /**< 0xa0 */
1414 uint32_t GuardEHContinuationTable; /**< 0xa4 - virtual address */
1415 uint32_t GuardEHContinuationCount; /**< 0xa8 */
1416} IMAGE_LOAD_CONFIG_DIRECTORY32_V11;
1417AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V11, 0xac);
1418typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V11 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V11;
1419typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V11 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V11;
1420
1421/** @since Visual C++ 2019 / RS5_IMAGE_LOAD_CONFIG_DIRECTORY32. */
1422typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V12
1423{
1424 uint32_t Size; /**< 0x00 */
1425 uint32_t TimeDateStamp; /**< 0x04 */
1426 uint16_t MajorVersion; /**< 0x08 */
1427 uint16_t MinorVersion; /**< 0x0a */
1428 uint32_t GlobalFlagsClear; /**< 0x0c */
1429 uint32_t GlobalFlagsSet; /**< 0x10 */
1430 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1431 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 */
1432 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c */
1433 uint32_t LockPrefixTable; /**< 0x20 */
1434 uint32_t MaximumAllocationSize; /**< 0x24 */
1435 uint32_t VirtualMemoryThreshold; /**< 0x28 */
1436 uint32_t ProcessHeapFlags; /**< 0x2c */
1437 uint32_t ProcessAffinityMask; /**< 0x30 */
1438 uint16_t CSDVersion; /**< 0x34 */
1439 uint16_t DependentLoadFlags; /**< 0x36 */
1440 uint32_t EditList; /**< 0x38 */
1441 uint32_t SecurityCookie; /**< 0x3c */
1442 uint32_t SEHandlerTable; /**< 0x40 */
1443 uint32_t SEHandlerCount; /**< 0x44 */
1444 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1445 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c */
1446 uint32_t GuardCFFunctionTable; /**< 0x50 */
1447 uint32_t GuardCFFunctionCount; /**< 0x54 */
1448 uint32_t GuardFlags; /**< 0x58 */
1449 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1450 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 */
1451 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1452 uint32_t GuardLongJumpTargetTable; /**< 0x70 */
1453 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1454 uint32_t DynamicValueRelocTable; /**< 0x78 */
1455 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1456 uint32_t GuardRFFailureRoutine; /**< 0x80 */
1457 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 */
1458 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1459 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1460 uint16_t Reserved2; /**< 0x8e */
1461 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 */
1462 uint32_t HotPatchTableOffset; /**< 0x94 */
1463 uint32_t Reserved3; /**< 0x98 */
1464 uint32_t EnclaveConfigurationPointer; /**< 0x9c - virtual address */
1465 uint32_t VolatileMetadataPointer; /**< 0xa0 */
1466 uint32_t GuardEHContinuationTable; /**< 0xa4 - virtual address */
1467 uint32_t GuardEHContinuationCount; /**< 0xa8 */
1468 uint32_t GuardXFGCheckFunctionPointer; /**< 0xac */
1469 uint32_t GuardXFGDispatchFunctionPointer; /**< 0xb0 */
1470 uint32_t GuardXFGTableDispatchFunctionPointer; /**< 0xb4 */
1471} IMAGE_LOAD_CONFIG_DIRECTORY32_V12;
1472AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V12, 0xb8);
1473typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V12 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V12;
1474typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V12 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V12;
1475
1476/** @since Visual C++ 2019 16.x (found in 16.11.9) / RS5_IMAGE_LOAD_CONFIG_DIRECTORY32. */
1477typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V13
1478{
1479 uint32_t Size; /**< 0x00 - virtual address */
1480 uint32_t TimeDateStamp; /**< 0x04 */
1481 uint16_t MajorVersion; /**< 0x08 */
1482 uint16_t MinorVersion; /**< 0x0a */
1483 uint32_t GlobalFlagsClear; /**< 0x0c */
1484 uint32_t GlobalFlagsSet; /**< 0x10 */
1485 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1486 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 - virtual address */
1487 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c - virtual address */
1488 uint32_t LockPrefixTable; /**< 0x20 */
1489 uint32_t MaximumAllocationSize; /**< 0x24 */
1490 uint32_t VirtualMemoryThreshold; /**< 0x28 - virtual address of pointer variable */
1491 uint32_t ProcessHeapFlags; /**< 0x2c - virtual address of pointer variable */
1492 uint32_t ProcessAffinityMask; /**< 0x30 - virtual address */
1493 uint16_t CSDVersion; /**< 0x34 */
1494 uint16_t DependentLoadFlags; /**< 0x36 */
1495 uint32_t EditList; /**< 0x38 */
1496 uint32_t SecurityCookie; /**< 0x3c - virtual address */
1497 uint32_t SEHandlerTable; /**< 0x40 */
1498 uint32_t SEHandlerCount; /**< 0x44 - virtual address */
1499 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1500 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c - virtual address */
1501 uint32_t GuardCFFunctionTable; /**< 0x50 */
1502 uint32_t GuardCFFunctionCount; /**< 0x54 - virtual address */
1503 uint32_t GuardFlags; /**< 0x58 - virtual address of pointer variable */
1504 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1505 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 - virtual address */
1506 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1507 uint32_t GuardLongJumpTargetTable; /**< 0x70 - virtual address */
1508 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1509 uint32_t DynamicValueRelocTable; /**< 0x78 - virtual address */
1510 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1511 uint32_t GuardRFFailureRoutine; /**< 0x80 - virtual address */
1512 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 - virtual address of pointer variable */
1513 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1514 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1515 uint16_t Reserved2; /**< 0x8e */
1516 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 - virtual address of pointer variable */
1517 uint32_t HotPatchTableOffset; /**< 0x94 */
1518 uint32_t Reserved3; /**< 0x98 */
1519 uint32_t EnclaveConfigurationPointer; /**< 0x9c - virtual address of pointer variable */
1520 uint32_t VolatileMetadataPointer; /**< 0xa0 - virtual address of pointer variable */
1521 uint32_t GuardEHContinuationTable; /**< 0xa4 - virtual address */
1522 uint32_t GuardEHContinuationCount; /**< 0xa8 */
1523 uint32_t GuardXFGCheckFunctionPointer; /**< 0xac - virtual address of pointer variable */
1524 uint32_t GuardXFGDispatchFunctionPointer; /**< 0xb0 - virtual address of pointer variable */
1525 uint32_t GuardXFGTableDispatchFunctionPointer; /**< 0xb4 - virtual address of pointer variable */
1526 uint32_t CastGuardOsDeterminedFailureMode; /**< 0xb8 - virtual address */
1527} IMAGE_LOAD_CONFIG_DIRECTORY32_V13;
1528AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V13, 0xbc);
1529typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V13 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V13;
1530typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V13 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V13;
1531
1532/** @since Visual C++ 2022 / SDK 10.0.22621.0 (22h2) */
1533typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V14
1534{
1535 uint32_t Size; /**< 0x00 - virtual address */
1536 uint32_t TimeDateStamp; /**< 0x04 */
1537 uint16_t MajorVersion; /**< 0x08 */
1538 uint16_t MinorVersion; /**< 0x0a */
1539 uint32_t GlobalFlagsClear; /**< 0x0c */
1540 uint32_t GlobalFlagsSet; /**< 0x10 */
1541 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1542 uint32_t DeCommitFreeBlockThreshold; /**< 0x18 - virtual address */
1543 uint32_t DeCommitTotalFreeThreshold; /**< 0x1c - virtual address */
1544 uint32_t LockPrefixTable; /**< 0x20 */
1545 uint32_t MaximumAllocationSize; /**< 0x24 */
1546 uint32_t VirtualMemoryThreshold; /**< 0x28 - virtual address of pointer variable */
1547 uint32_t ProcessHeapFlags; /**< 0x2c - virtual address of pointer variable */
1548 uint32_t ProcessAffinityMask; /**< 0x30 - virtual address */
1549 uint16_t CSDVersion; /**< 0x34 */
1550 uint16_t DependentLoadFlags; /**< 0x36 */
1551 uint32_t EditList; /**< 0x38 */
1552 uint32_t SecurityCookie; /**< 0x3c - virtual address */
1553 uint32_t SEHandlerTable; /**< 0x40 */
1554 uint32_t SEHandlerCount; /**< 0x44 - virtual address */
1555 uint32_t GuardCFCCheckFunctionPointer; /**< 0x48 */
1556 uint32_t GuardCFDispatchFunctionPointer; /**< 0x4c - virtual address */
1557 uint32_t GuardCFFunctionTable; /**< 0x50 */
1558 uint32_t GuardCFFunctionCount; /**< 0x54 - virtual address */
1559 uint32_t GuardFlags; /**< 0x58 - virtual address of pointer variable */
1560 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x5c */
1561 uint32_t GuardAddressTakenIatEntryTable; /**< 0x68 - virtual address */
1562 uint32_t GuardAddressTakenIatEntryCount; /**< 0x6c */
1563 uint32_t GuardLongJumpTargetTable; /**< 0x70 - virtual address */
1564 uint32_t GuardLongJumpTargetCount; /**< 0x74 */
1565 uint32_t DynamicValueRelocTable; /**< 0x78 - virtual address */
1566 uint32_t CHPEMetadataPointer; /**< 0x7c Not sure when this was renamed from HybridMetadataPointer. */
1567 uint32_t GuardRFFailureRoutine; /**< 0x80 - virtual address */
1568 uint32_t GuardRFFailureRoutineFunctionPointer; /**< 0x84 - virtual address of pointer variable */
1569 uint32_t DynamicValueRelocTableOffset; /**< 0x88 */
1570 uint16_t DynamicValueRelocTableSection; /**< 0x8c */
1571 uint16_t Reserved2; /**< 0x8e */
1572 uint32_t GuardRFVerifyStackPointerFunctionPointer; /**< 0x90 - virtual address of pointer variable */
1573 uint32_t HotPatchTableOffset; /**< 0x94 */
1574 uint32_t Reserved3; /**< 0x98 */
1575 uint32_t EnclaveConfigurationPointer; /**< 0x9c - virtual address of pointer variable */
1576 uint32_t VolatileMetadataPointer; /**< 0xa0 - virtual address of pointer variable */
1577 uint32_t GuardEHContinuationTable; /**< 0xa4 - virtual address */
1578 uint32_t GuardEHContinuationCount; /**< 0xa8 */
1579 uint32_t GuardXFGCheckFunctionPointer; /**< 0xac - virtual address of pointer variable */
1580 uint32_t GuardXFGDispatchFunctionPointer; /**< 0xb0 - virtual address of pointer variable */
1581 uint32_t GuardXFGTableDispatchFunctionPointer; /**< 0xb4 - virtual address of pointer variable */
1582 uint32_t CastGuardOsDeterminedFailureMode; /**< 0xb8 - virtual address */
1583 uint32_t GuardMemcpyFunctionPointer; /**< 0xbc - virtual address */
1584} IMAGE_LOAD_CONFIG_DIRECTORY32_V14;
1585AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V14, 0xc0);
1586typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V14 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V14;
1587typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V14 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V14;
1588
1589typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V14 IMAGE_LOAD_CONFIG_DIRECTORY32;
1590typedef PIMAGE_LOAD_CONFIG_DIRECTORY32_V14 PIMAGE_LOAD_CONFIG_DIRECTORY32;
1591typedef PCIMAGE_LOAD_CONFIG_DIRECTORY32_V14 PCIMAGE_LOAD_CONFIG_DIRECTORY32;
1592
1593
1594/* No _IMAGE_LOAD_CONFIG_DIRECTORY64_V1 exists. */
1595
1596typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V2
1597{
1598 uint32_t Size;
1599 uint32_t TimeDateStamp;
1600 uint16_t MajorVersion;
1601 uint16_t MinorVersion;
1602 uint32_t GlobalFlagsClear;
1603 uint32_t GlobalFlagsSet;
1604 uint32_t CriticalSectionDefaultTimeout;
1605 uint64_t DeCommitFreeBlockThreshold;
1606 uint64_t DeCommitTotalFreeThreshold;
1607 uint64_t LockPrefixTable;
1608 uint64_t MaximumAllocationSize;
1609 uint64_t VirtualMemoryThreshold;
1610 uint64_t ProcessAffinityMask;
1611 uint32_t ProcessHeapFlags;
1612 uint16_t CSDVersion;
1613 uint16_t DependentLoadFlags;
1614 uint64_t EditList;
1615 uint64_t SecurityCookie;
1616 uint64_t SEHandlerTable;
1617 uint64_t SEHandlerCount;
1618} IMAGE_LOAD_CONFIG_DIRECTORY64_V2;
1619AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V2, 0x70);
1620typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
1621typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
1622
1623#pragma pack(4) /* Why not 8 byte alignment, baka microsofties?!? */
1624typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V3
1625{
1626 uint32_t Size;
1627 uint32_t TimeDateStamp;
1628 uint16_t MajorVersion;
1629 uint16_t MinorVersion;
1630 uint32_t GlobalFlagsClear;
1631 uint32_t GlobalFlagsSet;
1632 uint32_t CriticalSectionDefaultTimeout;
1633 uint64_t DeCommitFreeBlockThreshold;
1634 uint64_t DeCommitTotalFreeThreshold;
1635 uint64_t LockPrefixTable;
1636 uint64_t MaximumAllocationSize;
1637 uint64_t VirtualMemoryThreshold;
1638 uint64_t ProcessAffinityMask;
1639 uint32_t ProcessHeapFlags;
1640 uint16_t CSDVersion;
1641 uint16_t DependentLoadFlags;
1642 uint64_t EditList;
1643 uint64_t SecurityCookie;
1644 uint64_t SEHandlerTable;
1645 uint64_t SEHandlerCount;
1646 uint64_t GuardCFCCheckFunctionPointer;
1647 uint64_t GuardCFDispatchFunctionPointer;
1648 uint64_t GuardCFFunctionTable;
1649 uint64_t GuardCFFunctionCount;
1650 uint32_t GuardFlags;
1651} IMAGE_LOAD_CONFIG_DIRECTORY64_V3;
1652#pragma pack()
1653AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V3, 0x94);
1654typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
1655typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
1656
1657/** @since Windows 10 (Preview (9879). */
1658typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V4
1659{
1660 uint32_t Size; /**< 0x00 */
1661 uint32_t TimeDateStamp; /**< 0x04 */
1662 uint16_t MajorVersion; /**< 0x08 */
1663 uint16_t MinorVersion; /**< 0x0a */
1664 uint32_t GlobalFlagsClear; /**< 0x0c */
1665 uint32_t GlobalFlagsSet; /**< 0x10 */
1666 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1667 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1668 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1669 uint64_t LockPrefixTable; /**< 0x28 */
1670 uint64_t MaximumAllocationSize; /**< 0x30 */
1671 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1672 uint64_t ProcessAffinityMask; /**< 0x40 */
1673 uint32_t ProcessHeapFlags; /**< 0x48 */
1674 uint16_t CSDVersion; /**< 0x4c */
1675 uint16_t DependentLoadFlags; /**< 0x4e */
1676 uint64_t EditList; /**< 0x50 */
1677 uint64_t SecurityCookie; /**< 0x58 */
1678 uint64_t SEHandlerTable; /**< 0x60 */
1679 uint64_t SEHandlerCount; /**< 0x68 */
1680 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1681 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1682 uint64_t GuardCFFunctionTable; /**< 0x80 */
1683 uint64_t GuardCFFunctionCount; /**< 0x88 */
1684 uint32_t GuardFlags; /**< 0x90 */
1685 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1686} IMAGE_LOAD_CONFIG_DIRECTORY64_V4;
1687AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V4, 0xa0);
1688typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
1689typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
1690
1691/** @since Windows 10 build 14286 (or maybe earlier). */
1692typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V5
1693{
1694 uint32_t Size; /**< 0x00 */
1695 uint32_t TimeDateStamp; /**< 0x04 */
1696 uint16_t MajorVersion; /**< 0x08 */
1697 uint16_t MinorVersion; /**< 0x0a */
1698 uint32_t GlobalFlagsClear; /**< 0x0c */
1699 uint32_t GlobalFlagsSet; /**< 0x10 */
1700 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1701 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1702 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1703 uint64_t LockPrefixTable; /**< 0x28 */
1704 uint64_t MaximumAllocationSize; /**< 0x30 */
1705 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1706 uint64_t ProcessAffinityMask; /**< 0x40 */
1707 uint32_t ProcessHeapFlags; /**< 0x48 */
1708 uint16_t CSDVersion; /**< 0x4c */
1709 uint16_t DependentLoadFlags; /**< 0x4e */
1710 uint64_t EditList; /**< 0x50 */
1711 uint64_t SecurityCookie; /**< 0x58 */
1712 uint64_t SEHandlerTable; /**< 0x60 */
1713 uint64_t SEHandlerCount; /**< 0x68 */
1714 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1715 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1716 uint64_t GuardCFFunctionTable; /**< 0x80 */
1717 uint64_t GuardCFFunctionCount; /**< 0x88 */
1718 uint32_t GuardFlags; /**< 0x90 */
1719 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1720 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1721 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1722 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1723 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1724} IMAGE_LOAD_CONFIG_DIRECTORY64_V5;
1725AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V5, 0xc0);
1726typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V5 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V5;
1727typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V5 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V5;
1728
1729/** @since Windows 10 build 14393 (or maybe earlier). */
1730typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V6
1731{
1732 uint32_t Size; /**< 0x00 */
1733 uint32_t TimeDateStamp; /**< 0x04 */
1734 uint16_t MajorVersion; /**< 0x08 */
1735 uint16_t MinorVersion; /**< 0x0a */
1736 uint32_t GlobalFlagsClear; /**< 0x0c */
1737 uint32_t GlobalFlagsSet; /**< 0x10 */
1738 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1739 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1740 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1741 uint64_t LockPrefixTable; /**< 0x28 */
1742 uint64_t MaximumAllocationSize; /**< 0x30 */
1743 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1744 uint64_t ProcessAffinityMask; /**< 0x40 */
1745 uint32_t ProcessHeapFlags; /**< 0x48 */
1746 uint16_t CSDVersion; /**< 0x4c */
1747 uint16_t DependentLoadFlags; /**< 0x4e */
1748 uint64_t EditList; /**< 0x50 */
1749 uint64_t SecurityCookie; /**< 0x58 */
1750 uint64_t SEHandlerTable; /**< 0x60 */
1751 uint64_t SEHandlerCount; /**< 0x68 */
1752 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1753 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1754 uint64_t GuardCFFunctionTable; /**< 0x80 */
1755 uint64_t GuardCFFunctionCount; /**< 0x88 */
1756 uint32_t GuardFlags; /**< 0x90 */
1757 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1758 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1759 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1760 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1761 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1762 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1763 uint64_t HybridMetadataPointer; /**< 0xc8 */
1764} IMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1765AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V6, 0xd0);
1766typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V6 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1767typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V6 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1768
1769/** @since Windows 10 build 14901 (or maybe earlier). */
1770typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V7
1771{
1772 uint32_t Size; /**< 0x00 */
1773 uint32_t TimeDateStamp; /**< 0x04 */
1774 uint16_t MajorVersion; /**< 0x08 */
1775 uint16_t MinorVersion; /**< 0x0a */
1776 uint32_t GlobalFlagsClear; /**< 0x0c */
1777 uint32_t GlobalFlagsSet; /**< 0x10 */
1778 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1779 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1780 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1781 uint64_t LockPrefixTable; /**< 0x28 */
1782 uint64_t MaximumAllocationSize; /**< 0x30 */
1783 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1784 uint64_t ProcessAffinityMask; /**< 0x40 */
1785 uint32_t ProcessHeapFlags; /**< 0x48 */
1786 uint16_t CSDVersion; /**< 0x4c */
1787 uint16_t DependentLoadFlags; /**< 0x4e */
1788 uint64_t EditList; /**< 0x50 */
1789 uint64_t SecurityCookie; /**< 0x58 */
1790 uint64_t SEHandlerTable; /**< 0x60 */
1791 uint64_t SEHandlerCount; /**< 0x68 */
1792 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1793 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1794 uint64_t GuardCFFunctionTable; /**< 0x80 */
1795 uint64_t GuardCFFunctionCount; /**< 0x88 */
1796 uint32_t GuardFlags; /**< 0x90 */
1797 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1798 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1799 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1800 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1801 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1802 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1803 uint64_t CHPEMetadataPointer; /**< 0xc8 Not sure when this was renamed from HybridMetadataPointer. */
1804 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1805 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1806 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1807 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1808 uint16_t Reserved2; /**< 0xe6 */
1809} IMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1810AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V7, 0xe8);
1811typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V7 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1812typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V7 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1813
1814/** @since Windows 10 build 15002 (or maybe earlier). */
1815#pragma pack(4) /* Stupid, stupid microsofties! */
1816typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V8
1817{
1818 uint32_t Size; /**< 0x00 */
1819 uint32_t TimeDateStamp; /**< 0x04 */
1820 uint16_t MajorVersion; /**< 0x08 */
1821 uint16_t MinorVersion; /**< 0x0a */
1822 uint32_t GlobalFlagsClear; /**< 0x0c */
1823 uint32_t GlobalFlagsSet; /**< 0x10 */
1824 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1825 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1826 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1827 uint64_t LockPrefixTable; /**< 0x28 */
1828 uint64_t MaximumAllocationSize; /**< 0x30 */
1829 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1830 uint64_t ProcessAffinityMask; /**< 0x40 */
1831 uint32_t ProcessHeapFlags; /**< 0x48 */
1832 uint16_t CSDVersion; /**< 0x4c */
1833 uint16_t DependentLoadFlags; /**< 0x4e */
1834 uint64_t EditList; /**< 0x50 */
1835 uint64_t SecurityCookie; /**< 0x58 */
1836 uint64_t SEHandlerTable; /**< 0x60 */
1837 uint64_t SEHandlerCount; /**< 0x68 */
1838 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1839 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1840 uint64_t GuardCFFunctionTable; /**< 0x80 */
1841 uint64_t GuardCFFunctionCount; /**< 0x88 */
1842 uint32_t GuardFlags; /**< 0x90 */
1843 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1844 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1845 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1846 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1847 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1848 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1849 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1850 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1851 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1852 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1853 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1854 uint16_t Reserved2; /**< 0xe6 */
1855 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1856 uint32_t HotPatchTableOffset; /**< 0xf0 */
1857} IMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1858#pragma pack()
1859AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V8, 0xf4);
1860typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V8 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1861typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V8 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1862
1863/** @since Windows 10 build 15002 (or maybe earlier). */
1864typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V9
1865{
1866 uint32_t Size; /**< 0x00 */
1867 uint32_t TimeDateStamp; /**< 0x04 */
1868 uint16_t MajorVersion; /**< 0x08 */
1869 uint16_t MinorVersion; /**< 0x0a */
1870 uint32_t GlobalFlagsClear; /**< 0x0c */
1871 uint32_t GlobalFlagsSet; /**< 0x10 */
1872 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1873 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1874 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1875 uint64_t LockPrefixTable; /**< 0x28 */
1876 uint64_t MaximumAllocationSize; /**< 0x30 */
1877 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1878 uint64_t ProcessAffinityMask; /**< 0x40 */
1879 uint32_t ProcessHeapFlags; /**< 0x48 */
1880 uint16_t CSDVersion; /**< 0x4c */
1881 uint16_t DependentLoadFlags; /**< 0x4e */
1882 uint64_t EditList; /**< 0x50 */
1883 uint64_t SecurityCookie; /**< 0x58 */
1884 uint64_t SEHandlerTable; /**< 0x60 */
1885 uint64_t SEHandlerCount; /**< 0x68 */
1886 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1887 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1888 uint64_t GuardCFFunctionTable; /**< 0x80 */
1889 uint64_t GuardCFFunctionCount; /**< 0x88 */
1890 uint32_t GuardFlags; /**< 0x90 */
1891 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1892 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1893 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1894 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1895 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1896 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1897 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1898 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1899 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1900 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1901 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1902 uint16_t Reserved2; /**< 0xe6 */
1903 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1904 uint32_t HotPatchTableOffset; /**< 0xf0 */
1905 uint32_t Reserved3; /**< 0xf4 */
1906 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
1907} IMAGE_LOAD_CONFIG_DIRECTORY64_V9;
1908AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V9, 0x100);
1909typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V9 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V9;
1910typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V9 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V9;
1911
1912/** @since Windows 10 build 18362 (or maybe earlier). */
1913typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V10
1914{
1915 uint32_t Size; /**< 0x00 */
1916 uint32_t TimeDateStamp; /**< 0x04 */
1917 uint16_t MajorVersion; /**< 0x08 */
1918 uint16_t MinorVersion; /**< 0x0a */
1919 uint32_t GlobalFlagsClear; /**< 0x0c */
1920 uint32_t GlobalFlagsSet; /**< 0x10 */
1921 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1922 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1923 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1924 uint64_t LockPrefixTable; /**< 0x28 */
1925 uint64_t MaximumAllocationSize; /**< 0x30 */
1926 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1927 uint64_t ProcessAffinityMask; /**< 0x40 */
1928 uint32_t ProcessHeapFlags; /**< 0x48 */
1929 uint16_t CSDVersion; /**< 0x4c */
1930 uint16_t DependentLoadFlags; /**< 0x4e */
1931 uint64_t EditList; /**< 0x50 */
1932 uint64_t SecurityCookie; /**< 0x58 */
1933 uint64_t SEHandlerTable; /**< 0x60 */
1934 uint64_t SEHandlerCount; /**< 0x68 */
1935 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1936 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1937 uint64_t GuardCFFunctionTable; /**< 0x80 */
1938 uint64_t GuardCFFunctionCount; /**< 0x88 */
1939 uint32_t GuardFlags; /**< 0x90 */
1940 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1941 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1942 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1943 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1944 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1945 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1946 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1947 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1948 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1949 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
1950 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
1951 uint16_t Reserved2; /**< 0xe6 */
1952 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
1953 uint32_t HotPatchTableOffset; /**< 0xf0 */
1954 uint32_t Reserved3; /**< 0xf4 */
1955 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
1956 uint64_t VolatileMetadataPointer; /**< 0x100 */
1957} IMAGE_LOAD_CONFIG_DIRECTORY64_V10;
1958AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V10, 0x108);
1959typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V10 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V10;
1960typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V10 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V10;
1961
1962/** @since Windows 10 build 19534 (or maybe earlier). */
1963typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V11
1964{
1965 uint32_t Size; /**< 0x00 */
1966 uint32_t TimeDateStamp; /**< 0x04 */
1967 uint16_t MajorVersion; /**< 0x08 */
1968 uint16_t MinorVersion; /**< 0x0a */
1969 uint32_t GlobalFlagsClear; /**< 0x0c */
1970 uint32_t GlobalFlagsSet; /**< 0x10 */
1971 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
1972 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
1973 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
1974 uint64_t LockPrefixTable; /**< 0x28 */
1975 uint64_t MaximumAllocationSize; /**< 0x30 */
1976 uint64_t VirtualMemoryThreshold; /**< 0x38 */
1977 uint64_t ProcessAffinityMask; /**< 0x40 */
1978 uint32_t ProcessHeapFlags; /**< 0x48 */
1979 uint16_t CSDVersion; /**< 0x4c */
1980 uint16_t DependentLoadFlags; /**< 0x4e */
1981 uint64_t EditList; /**< 0x50 */
1982 uint64_t SecurityCookie; /**< 0x58 */
1983 uint64_t SEHandlerTable; /**< 0x60 */
1984 uint64_t SEHandlerCount; /**< 0x68 */
1985 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
1986 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
1987 uint64_t GuardCFFunctionTable; /**< 0x80 */
1988 uint64_t GuardCFFunctionCount; /**< 0x88 */
1989 uint32_t GuardFlags; /**< 0x90 */
1990 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
1991 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
1992 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
1993 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
1994 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
1995 uint64_t DynamicValueRelocTable; /**< 0xc0 */
1996 uint64_t CHPEMetadataPointer; /**< 0xc8 */
1997 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
1998 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
1999 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
2000 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
2001 uint16_t Reserved2; /**< 0xe6 */
2002 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
2003 uint32_t HotPatchTableOffset; /**< 0xf0 */
2004 uint32_t Reserved3; /**< 0xf4 */
2005 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
2006 uint64_t VolatileMetadataPointer; /**< 0x100 */
2007 uint64_t GuardEHContinuationTable; /**< 0x108 - virtual address */
2008 uint64_t GuardEHContinuationCount; /**< 0x110 */
2009} IMAGE_LOAD_CONFIG_DIRECTORY64_V11;
2010AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V11, 0x118);
2011typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V11 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V11;
2012typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V11 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V11;
2013
2014/** @since Visual C++ 2019 / RS5_IMAGE_LOAD_CONFIG_DIRECTORY64. */
2015typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V12
2016{
2017 uint32_t Size; /**< 0x00 */
2018 uint32_t TimeDateStamp; /**< 0x04 */
2019 uint16_t MajorVersion; /**< 0x08 */
2020 uint16_t MinorVersion; /**< 0x0a */
2021 uint32_t GlobalFlagsClear; /**< 0x0c */
2022 uint32_t GlobalFlagsSet; /**< 0x10 */
2023 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
2024 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
2025 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
2026 uint64_t LockPrefixTable; /**< 0x28 */
2027 uint64_t MaximumAllocationSize; /**< 0x30 */
2028 uint64_t VirtualMemoryThreshold; /**< 0x38 */
2029 uint64_t ProcessAffinityMask; /**< 0x40 */
2030 uint32_t ProcessHeapFlags; /**< 0x48 */
2031 uint16_t CSDVersion; /**< 0x4c */
2032 uint16_t DependentLoadFlags; /**< 0x4e */
2033 uint64_t EditList; /**< 0x50 */
2034 uint64_t SecurityCookie; /**< 0x58 */
2035 uint64_t SEHandlerTable; /**< 0x60 */
2036 uint64_t SEHandlerCount; /**< 0x68 */
2037 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 */
2038 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 */
2039 uint64_t GuardCFFunctionTable; /**< 0x80 */
2040 uint64_t GuardCFFunctionCount; /**< 0x88 */
2041 uint32_t GuardFlags; /**< 0x90 */
2042 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
2043 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 */
2044 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
2045 uint64_t GuardLongJumpTargetTable; /**< 0xb0 */
2046 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
2047 uint64_t DynamicValueRelocTable; /**< 0xc0 */
2048 uint64_t CHPEMetadataPointer; /**< 0xc8 */
2049 uint64_t GuardRFFailureRoutine; /**< 0xd0 */
2050 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 */
2051 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
2052 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
2053 uint16_t Reserved2; /**< 0xe6 */
2054 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 */
2055 uint32_t HotPatchTableOffset; /**< 0xf0 */
2056 uint32_t Reserved3; /**< 0xf4 */
2057 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
2058 uint64_t VolatileMetadataPointer; /**< 0x100 */
2059 uint64_t GuardEHContinuationTable; /**< 0x108 - virtual address */
2060 uint64_t GuardEHContinuationCount; /**< 0x110 */
2061 uint64_t GuardXFGCheckFunctionPointer; /**< 0x118 */
2062 uint64_t GuardXFGDispatchFunctionPointer; /**< 0x120 */
2063 uint64_t GuardXFGTableDispatchFunctionPointer; /**< 0x128 */
2064} IMAGE_LOAD_CONFIG_DIRECTORY64_V12;
2065AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V12, 0x130);
2066typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V12 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V12;
2067typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V12 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V12;
2068
2069/** @since Visual C++ 2019 16.x (found in 16.11.9) / RS5_IMAGE_LOAD_CONFIG_DIRECTORY32. */
2070typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V13
2071{
2072 uint32_t Size; /**< 0x00 */
2073 uint32_t TimeDateStamp; /**< 0x04 */
2074 uint16_t MajorVersion; /**< 0x08 */
2075 uint16_t MinorVersion; /**< 0x0a */
2076 uint32_t GlobalFlagsClear; /**< 0x0c */
2077 uint32_t GlobalFlagsSet; /**< 0x10 */
2078 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
2079 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
2080 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
2081 uint64_t LockPrefixTable; /**< 0x28 - virtual address */
2082 uint64_t MaximumAllocationSize; /**< 0x30 */
2083 uint64_t VirtualMemoryThreshold; /**< 0x38 */
2084 uint64_t ProcessAffinityMask; /**< 0x40 */
2085 uint32_t ProcessHeapFlags; /**< 0x48 */
2086 uint16_t CSDVersion; /**< 0x4c */
2087 uint16_t DependentLoadFlags; /**< 0x4e */
2088 uint64_t EditList; /**< 0x50 - virtual address */
2089 uint64_t SecurityCookie; /**< 0x58 - virtual address */
2090 uint64_t SEHandlerTable; /**< 0x60 */
2091 uint64_t SEHandlerCount; /**< 0x68 */
2092 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 - virtual address of pointer variable */
2093 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 - virtual address of pointer variable */
2094 uint64_t GuardCFFunctionTable; /**< 0x80 - virtual address */
2095 uint64_t GuardCFFunctionCount; /**< 0x88 */
2096 uint32_t GuardFlags; /**< 0x90 */
2097 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
2098 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 - virtual address */
2099 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
2100 uint64_t GuardLongJumpTargetTable; /**< 0xb0 - virtual address */
2101 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
2102 uint64_t DynamicValueRelocTable; /**< 0xc0 - virtual address */
2103 uint64_t CHPEMetadataPointer; /**< 0xc8 */
2104 uint64_t GuardRFFailureRoutine; /**< 0xd0 - virtual address */
2105 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 - virtual address of pointer variable */
2106 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
2107 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
2108 uint16_t Reserved2; /**< 0xe6 */
2109 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 - virtual address of pointer variable */
2110 uint32_t HotPatchTableOffset; /**< 0xf0 */
2111 uint32_t Reserved3; /**< 0xf4 */
2112 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
2113 uint64_t VolatileMetadataPointer; /**< 0x100 - virtual address of pointer variable */
2114 uint64_t GuardEHContinuationTable; /**< 0x108 - virtual address */
2115 uint64_t GuardEHContinuationCount; /**< 0x110 */
2116 uint64_t GuardXFGCheckFunctionPointer; /**< 0x118 - virtual address of pointer variable */
2117 uint64_t GuardXFGDispatchFunctionPointer; /**< 0x120 - virtual address of pointer variable */
2118 uint64_t GuardXFGTableDispatchFunctionPointer; /**< 0x128 - virtual address of pointer variable */
2119 uint64_t CastGuardOsDeterminedFailureMode; /**< 0x130 - virtual address */
2120} IMAGE_LOAD_CONFIG_DIRECTORY64_V13;
2121AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V13, 0x138);
2122typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V13 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V13;
2123typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V13 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V13;
2124
2125/** @since Visual C++ 2022 / SDK 10.0.22621.0 (22h2) */
2126typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V14
2127{
2128 uint32_t Size; /**< 0x00 */
2129 uint32_t TimeDateStamp; /**< 0x04 */
2130 uint16_t MajorVersion; /**< 0x08 */
2131 uint16_t MinorVersion; /**< 0x0a */
2132 uint32_t GlobalFlagsClear; /**< 0x0c */
2133 uint32_t GlobalFlagsSet; /**< 0x10 */
2134 uint32_t CriticalSectionDefaultTimeout; /**< 0x14 */
2135 uint64_t DeCommitFreeBlockThreshold; /**< 0x18 */
2136 uint64_t DeCommitTotalFreeThreshold; /**< 0x20 */
2137 uint64_t LockPrefixTable; /**< 0x28 - virtual address */
2138 uint64_t MaximumAllocationSize; /**< 0x30 */
2139 uint64_t VirtualMemoryThreshold; /**< 0x38 */
2140 uint64_t ProcessAffinityMask; /**< 0x40 */
2141 uint32_t ProcessHeapFlags; /**< 0x48 */
2142 uint16_t CSDVersion; /**< 0x4c */
2143 uint16_t DependentLoadFlags; /**< 0x4e */
2144 uint64_t EditList; /**< 0x50 - virtual address */
2145 uint64_t SecurityCookie; /**< 0x58 - virtual address */
2146 uint64_t SEHandlerTable; /**< 0x60 */
2147 uint64_t SEHandlerCount; /**< 0x68 */
2148 uint64_t GuardCFCCheckFunctionPointer; /**< 0x70 - virtual address of pointer variable */
2149 uint64_t GuardCFDispatchFunctionPointer; /**< 0x78 - virtual address of pointer variable */
2150 uint64_t GuardCFFunctionTable; /**< 0x80 - virtual address */
2151 uint64_t GuardCFFunctionCount; /**< 0x88 */
2152 uint32_t GuardFlags; /**< 0x90 */
2153 IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /**< 0x94 */
2154 uint64_t GuardAddressTakenIatEntryTable; /**< 0xa0 - virtual address */
2155 uint64_t GuardAddressTakenIatEntryCount; /**< 0xa8 */
2156 uint64_t GuardLongJumpTargetTable; /**< 0xb0 - virtual address */
2157 uint64_t GuardLongJumpTargetCount; /**< 0xb8 */
2158 uint64_t DynamicValueRelocTable; /**< 0xc0 - virtual address */
2159 uint64_t CHPEMetadataPointer; /**< 0xc8 */
2160 uint64_t GuardRFFailureRoutine; /**< 0xd0 - virtual address */
2161 uint64_t GuardRFFailureRoutineFunctionPointer; /**< 0xd8 - virtual address of pointer variable */
2162 uint32_t DynamicValueRelocTableOffset; /**< 0xe0 */
2163 uint16_t DynamicValueRelocTableSection; /**< 0xe4 */
2164 uint16_t Reserved2; /**< 0xe6 */
2165 uint64_t GuardRFVerifyStackPointerFunctionPointer; /**< 0xe8 - virtual address of pointer variable */
2166 uint32_t HotPatchTableOffset; /**< 0xf0 */
2167 uint32_t Reserved3; /**< 0xf4 */
2168 uint64_t EnclaveConfigurationPointer; /**< 0xf8 - seen in bcrypt and bcryptprimitives pointing to the string "L". */
2169 uint64_t VolatileMetadataPointer; /**< 0x100 - virtual address of pointer variable */
2170 uint64_t GuardEHContinuationTable; /**< 0x108 - virtual address */
2171 uint64_t GuardEHContinuationCount; /**< 0x110 */
2172 uint64_t GuardXFGCheckFunctionPointer; /**< 0x118 - virtual address of pointer variable */
2173 uint64_t GuardXFGDispatchFunctionPointer; /**< 0x120 - virtual address of pointer variable */
2174 uint64_t GuardXFGTableDispatchFunctionPointer; /**< 0x128 - virtual address of pointer variable */
2175 uint64_t CastGuardOsDeterminedFailureMode; /**< 0x130 - virtual address */
2176 uint64_t GuardMemcpyFunctionPointer; /**< 0x138 - virtual address */
2177} IMAGE_LOAD_CONFIG_DIRECTORY64_V14;
2178AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V14, 0x140);
2179typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V14 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V14;
2180typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V14 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V14;
2181
2182typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V14 IMAGE_LOAD_CONFIG_DIRECTORY64;
2183typedef PIMAGE_LOAD_CONFIG_DIRECTORY64_V14 PIMAGE_LOAD_CONFIG_DIRECTORY64;
2184typedef PCIMAGE_LOAD_CONFIG_DIRECTORY64_V14 PCIMAGE_LOAD_CONFIG_DIRECTORY64;
2185
2186#endif /* !__ASSEMBLER__ */
2187/** @} */
2188
2189
2190#ifndef __ASSEMBLER__
2191/**
2192 * PE certificate directory.
2193 *
2194 * Found in IMAGE_DIRECTORY_ENTRY_SECURITY.
2195 */
2196typedef struct WIN_CERTIFICATE
2197{
2198 uint32_t dwLength;
2199 uint16_t wRevision;
2200 uint16_t wCertificateType;
2201 uint8_t bCertificate[8];
2202} WIN_CERTIFICATE;
2203AssertCompileSize(WIN_CERTIFICATE, 16);
2204typedef WIN_CERTIFICATE *PWIN_CERTIFICATE;
2205typedef WIN_CERTIFICATE const *PCWIN_CERTIFICATE;
2206#endif /* !__ASSEMBLER__ */
2207
2208/** @name WIN_CERT_REVISION_XXX - Certificate data directory revision.
2209 * Used WIN_CERTIFICATE::wRevision found in the IMAGE_DIRECTORY_ENTRY_SECURITY
2210 * data directory.
2211 * @{ */
2212#define WIN_CERT_REVISION_1_0 UINT16_C(0x0100)
2213#define WIN_CERT_REVISION_2_0 UINT16_C(0x0200)
2214/** @} */
2215
2216/** @name WIN_CERT_TYPE_XXX - Signature type.
2217 * Used by WIN_CERTIFICATE::wCertificateType.
2218 * @{ */
2219#define WIN_CERT_TYPE_X509 UINT16_C(1)
2220#define WIN_CERT_TYPE_PKCS_SIGNED_DATA UINT16_C(2)
2221#define WIN_CERT_TYPE_RESERVED_1 UINT16_C(3)
2222#define WIN_CERT_TYPE_TS_STACK_SIGNED UINT16_C(4)
2223#define WIN_CERT_TYPE_EFI_PKCS115 UINT16_C(0x0ef0)
2224#define WIN_CERT_TYPE_EFI_GUID UINT16_C(0x0ef1)
2225/** @} */
2226
2227/** The alignment of the certificate table.
2228 * @remarks Found thru signtool experiments.
2229 * @note There is a copy of this in RTSignTool.cpp. */
2230#define WIN_CERTIFICATE_ALIGNMENT UINT32_C(8)
2231
2232
2233#ifndef __ASSEMBLER__
2234/**
2235 * Debug directory.
2236 *
2237 * Found in IMAGE_DIRECTORY_ENTRY_DEBUG.
2238 */
2239typedef struct _IMAGE_DEBUG_DIRECTORY
2240{
2241 uint32_t Characteristics;
2242 uint32_t TimeDateStamp;
2243 uint16_t MajorVersion;
2244 uint16_t MinorVersion;
2245 uint32_t Type;
2246 uint32_t SizeOfData;
2247 uint32_t AddressOfRawData;
2248 uint32_t PointerToRawData;
2249} IMAGE_DEBUG_DIRECTORY;
2250AssertCompileSize(IMAGE_DEBUG_DIRECTORY, 28);
2251typedef IMAGE_DEBUG_DIRECTORY *PIMAGE_DEBUG_DIRECTORY;
2252typedef IMAGE_DEBUG_DIRECTORY const *PCIMAGE_DEBUG_DIRECTORY;
2253#endif /* !__ASSEMBLER__ */
2254
2255/** @name IMAGE_DEBUG_TYPE_XXX - Debug format types.
2256 * Used by IMAGE_DEBUG_DIRECTORY::Type.
2257 * @{ */
2258#define IMAGE_DEBUG_TYPE_UNKNOWN UINT32_C(0x00)
2259#define IMAGE_DEBUG_TYPE_COFF UINT32_C(0x01)
2260#define IMAGE_DEBUG_TYPE_CODEVIEW UINT32_C(0x02)
2261#define IMAGE_DEBUG_TYPE_FPO UINT32_C(0x03)
2262#define IMAGE_DEBUG_TYPE_MISC UINT32_C(0x04)
2263#define IMAGE_DEBUG_TYPE_EXCEPTION UINT32_C(0x05)
2264#define IMAGE_DEBUG_TYPE_FIXUP UINT32_C(0x06)
2265#define IMAGE_DEBUG_TYPE_OMAP_TO_SRC UINT32_C(0x07)
2266#define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC UINT32_C(0x08)
2267#define IMAGE_DEBUG_TYPE_BORLAND UINT32_C(0x09)
2268#define IMAGE_DEBUG_TYPE_RESERVED10 UINT32_C(0x0a)
2269#define IMAGE_DEBUG_TYPE_CLSID UINT32_C(0x0b)
2270#define IMAGE_DEBUG_TYPE_VC_FEATURE UINT32_C(0x0c)
2271#define IMAGE_DEBUG_TYPE_POGO UINT32_C(0x0d)
2272#define IMAGE_DEBUG_TYPE_ILTCG UINT32_C(0x0e)
2273#define IMAGE_DEBUG_TYPE_MPX UINT32_C(0x0f)
2274#define IMAGE_DEBUG_TYPE_REPRO UINT32_C(0x10)
2275/** @} */
2276
2277/** @name IMAGE_DEBUG_MISC_XXX - Misc debug data type.
2278 * Used by IMAGE_DEBUG_MISC::DataType.
2279 * @{ */
2280#define IMAGE_DEBUG_MISC_EXENAME UINT32_C(1)
2281/** @} */
2282
2283#ifndef __ASSEMBLER__
2284
2285/**
2286 * The format of IMAGE_DEBUG_TYPE_MISC debug info.
2287 */
2288typedef struct _IMAGE_DEBUG_MISC
2289{
2290 uint32_t DataType;
2291 uint32_t Length;
2292 uint8_t Unicode;
2293 uint8_t Reserved[3];
2294 uint8_t Data[1];
2295} IMAGE_DEBUG_MISC;
2296AssertCompileSize(IMAGE_DEBUG_MISC, 16);
2297typedef IMAGE_DEBUG_MISC *PIMAGE_DEBUG_MISC;
2298typedef IMAGE_DEBUG_MISC const *PCIMAGE_DEBUG_MISC;
2299
2300
2301/**
2302 * The header of a .DBG file (NT4).
2303 */
2304typedef struct _IMAGE_SEPARATE_DEBUG_HEADER
2305{
2306 uint16_t Signature; /**< 0x00 */
2307 uint16_t Flags; /**< 0x02 */
2308 uint16_t Machine; /**< 0x04 */
2309 uint16_t Characteristics; /**< 0x06 */
2310 uint32_t TimeDateStamp; /**< 0x08 */
2311 uint32_t CheckSum; /**< 0x0c */
2312 uint32_t ImageBase; /**< 0x10 */
2313 uint32_t SizeOfImage; /**< 0x14 */
2314 uint32_t NumberOfSections; /**< 0x18 */
2315 uint32_t ExportedNamesSize; /**< 0x1c */
2316 uint32_t DebugDirectorySize; /**< 0x20 */
2317 uint32_t SectionAlignment; /**< 0x24 */
2318 uint32_t Reserved[2]; /**< 0x28 */
2319} IMAGE_SEPARATE_DEBUG_HEADER; /* size: 0x30 */
2320AssertCompileSize(IMAGE_SEPARATE_DEBUG_HEADER, 0x30);
2321typedef IMAGE_SEPARATE_DEBUG_HEADER *PIMAGE_SEPARATE_DEBUG_HEADER;
2322typedef IMAGE_SEPARATE_DEBUG_HEADER const *PCIMAGE_SEPARATE_DEBUG_HEADER;
2323
2324#endif /* !__ASSEMBLER__ */
2325
2326/** The signature of a IMAGE_SEPARATE_DEBUG_HEADER. */
2327#define IMAGE_SEPARATE_DEBUG_SIGNATURE UINT16_C(0x4944)
2328
2329#ifndef __ASSEMBLER__
2330
2331/**
2332 * The format of IMAGE_DEBUG_TYPE_COFF debug info.
2333 */
2334typedef struct _IMAGE_COFF_SYMBOLS_HEADER
2335{
2336 uint32_t NumberOfSymbols;
2337 uint32_t LvaToFirstSymbol;
2338 uint32_t NumberOfLinenumbers;
2339 uint32_t LvaToFirstLinenumber;
2340 uint32_t RvaToFirstByteOfCode;
2341 uint32_t RvaToLastByteOfCode;
2342 uint32_t RvaToFirstByteOfData;
2343 uint32_t RvaToLastByteOfData;
2344} IMAGE_COFF_SYMBOLS_HEADER;
2345AssertCompileSize(IMAGE_COFF_SYMBOLS_HEADER, 0x20);
2346typedef IMAGE_COFF_SYMBOLS_HEADER *PIMAGE_COFF_SYMBOLS_HEADER;
2347typedef IMAGE_COFF_SYMBOLS_HEADER const *PCIMAGE_COFF_SYMBOLS_HEADER;
2348
2349
2350/**
2351 * Line number format of IMAGE_DEBUG_TYPE_COFF debug info.
2352 *
2353 * @remarks This has misaligned members.
2354 */
2355#pragma pack(2)
2356typedef struct _IMAGE_LINENUMBER
2357{
2358 union
2359 {
2360 uint32_t VirtualAddress;
2361 uint32_t SymbolTableIndex;
2362 } Type;
2363 uint16_t Linenumber;
2364} IMAGE_LINENUMBER;
2365#pragma pack()
2366AssertCompileSize(IMAGE_LINENUMBER, 6);
2367typedef IMAGE_LINENUMBER *PIMAGE_LINENUMBER;
2368typedef IMAGE_LINENUMBER const *PCIMAGE_LINENUMBER;
2369
2370#endif /* !__ASSEMBLER__ */
2371
2372/** The size of a IMAGE_SYMBOL & IMAGE_AUX_SYMBOL structure. */
2373#define IMAGE_SIZE_OF_SYMBOL 18
2374/** The size of a IMAGE_SYMBOL_EX & IMAGE_AUX_SYMBOL_EX structure. */
2375#define IMAGE_SIZE_OF_SYMBOL_EX 20
2376
2377#ifndef __ASSEMBLER__
2378
2379/**
2380 * COFF symbol.
2381 */
2382#pragma pack(2)
2383typedef struct _IMAGE_SYMBOL
2384{
2385 union
2386 {
2387 uint8_t ShortName[8];
2388 struct
2389 {
2390 uint32_t Short;
2391 uint32_t Long;
2392 } Name;
2393 uint32_t LongName[2];
2394 } N;
2395
2396 uint32_t Value;
2397 int16_t SectionNumber;
2398 uint16_t Type;
2399 uint8_t StorageClass;
2400 uint8_t NumberOfAuxSymbols;
2401} IMAGE_SYMBOL;
2402#pragma pack()
2403AssertCompileSize(IMAGE_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
2404typedef IMAGE_SYMBOL *PIMAGE_SYMBOL;
2405typedef IMAGE_SYMBOL const *PCIMAGE_SYMBOL;
2406
2407/**
2408 * COFF auxiliary symbol token defintion (whatever that is).
2409 */
2410#pragma pack(2)
2411typedef struct IMAGE_AUX_SYMBOL_TOKEN_DEF
2412{
2413 uint8_t bAuxType;
2414 uint8_t bReserved;
2415 uint32_t SymbolTableIndex;
2416 uint8_t rgbReserved[12];
2417} IMAGE_AUX_SYMBOL_TOKEN_DEF;
2418#pragma pack()
2419AssertCompileSize(IMAGE_AUX_SYMBOL_TOKEN_DEF, IMAGE_SIZE_OF_SYMBOL);
2420typedef IMAGE_AUX_SYMBOL_TOKEN_DEF *PIMAGE_AUX_SYMBOL_TOKEN_DEF;
2421typedef IMAGE_AUX_SYMBOL_TOKEN_DEF const *PCIMAGE_AUX_SYMBOL_TOKEN_DEF;
2422
2423/**
2424 * COFF auxiliary symbol.
2425 */
2426#pragma pack(1)
2427typedef union _IMAGE_AUX_SYMBOL
2428{
2429 struct
2430 {
2431 uint32_t TagIndex;
2432 union
2433 {
2434 struct
2435 {
2436 uint16_t Linenumber;
2437 uint16_t Size;
2438 } LnSz;
2439 } Misc;
2440 union
2441 {
2442 struct
2443 {
2444 uint32_t PointerToLinenumber;
2445 uint32_t PointerToNextFunction;
2446 } Function;
2447 struct
2448 {
2449 uint16_t Dimension[4];
2450 } Array;
2451 } FcnAry;
2452 uint16_t TvIndex;
2453 } Sym;
2454
2455 struct
2456 {
2457 uint8_t Name[IMAGE_SIZE_OF_SYMBOL];
2458 } File;
2459
2460 struct
2461 {
2462 uint32_t Length;
2463 uint16_t NumberOfRelocations;
2464 uint16_t NumberOfLinenumbers;
2465 uint32_t CheckSum;
2466 uint16_t Number;
2467 uint8_t Selection;
2468 uint8_t bReserved;
2469 uint16_t HighNumber;
2470 } Section;
2471
2472 IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
2473 struct
2474 {
2475 uint32_t crc;
2476 uint8_t rgbReserved[14];
2477 } CRC;
2478} IMAGE_AUX_SYMBOL;
2479#pragma pack()
2480AssertCompileSize(IMAGE_AUX_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
2481typedef IMAGE_AUX_SYMBOL *PIMAGE_AUX_SYMBOL;
2482typedef IMAGE_AUX_SYMBOL const *PCIMAGE_AUX_SYMBOL;
2483
2484
2485/**
2486 * Extended COFF symbol.
2487 */
2488typedef struct _IMAGE_SYMBOL_EX
2489{
2490 union
2491 {
2492 uint8_t ShortName[8];
2493 struct
2494 {
2495 uint32_t Short;
2496 uint32_t Long;
2497 } Name;
2498 uint32_t LongName[2];
2499 } N;
2500
2501 uint32_t Value;
2502 int32_t SectionNumber; /* The difference from IMAGE_SYMBOL */
2503 uint16_t Type;
2504 uint8_t StorageClass;
2505 uint8_t NumberOfAuxSymbols;
2506} IMAGE_SYMBOL_EX;
2507AssertCompileSize(IMAGE_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
2508typedef IMAGE_SYMBOL_EX *PIMAGE_SYMBOL_EX;
2509typedef IMAGE_SYMBOL_EX const *PCIMAGE_SYMBOL_EX;
2510
2511/**
2512 * Extended COFF auxiliary symbol.
2513 */
2514typedef union _IMAGE_AUX_SYMBOL_EX
2515{
2516 struct
2517 {
2518 uint32_t WeakDefaultSymIndex;
2519 uint32_t WeakSearchType;
2520 uint8_t rgbReserved[12];
2521 } Sym;
2522
2523 struct
2524 {
2525 uint8_t Name[IMAGE_SIZE_OF_SYMBOL_EX];
2526 } File;
2527
2528 struct
2529 {
2530 uint32_t Length;
2531 uint16_t NumberOfRelocations;
2532 uint16_t NumberOfLinenumbers;
2533 uint32_t CheckSum;
2534 uint16_t Number;
2535 uint8_t Selection;
2536 uint8_t bReserved;
2537 uint16_t HighNumber;
2538 uint8_t rgbReserved[2];
2539 } Section;
2540
2541 IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
2542
2543 struct
2544 {
2545 uint32_t crc;
2546 uint8_t rgbReserved[16];
2547 } CRC;
2548} IMAGE_AUX_SYMBOL_EX;
2549AssertCompileSize(IMAGE_AUX_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
2550typedef IMAGE_AUX_SYMBOL_EX *PIMAGE_AUX_SYMBOL_EX;
2551typedef IMAGE_AUX_SYMBOL_EX const *PCIMAGE_AUX_SYMBOL_EX;
2552
2553#endif /* !__ASSEMBLER__ */
2554
2555/** @name Special COFF section numbers.
2556 * Used by IMAGE_SYMBOL::SectionNumber and IMAGE_SYMBOL_EX::SectionNumber
2557 * @{ */
2558#define IMAGE_SYM_UNDEFINED INT16_C(0)
2559#define IMAGE_SYM_ABSOLUTE INT16_C(-1)
2560#define IMAGE_SYM_DEBUG INT16_C(-2)
2561/** @} */
2562
2563/** @name IMAGE_SYM_CLASS_XXX - COFF symbol storage classes.
2564 * @{ */
2565#define IMAGE_SYM_CLASS_END_OF_FUNCTION UINT8_C(0xff) /* -1 */
2566#define IMAGE_SYM_CLASS_NULL UINT8_C(0)
2567#define IMAGE_SYM_CLASS_AUTOMATIC UINT8_C(1)
2568#define IMAGE_SYM_CLASS_EXTERNAL UINT8_C(2)
2569#define IMAGE_SYM_CLASS_STATIC UINT8_C(3)
2570#define IMAGE_SYM_CLASS_REGISTER UINT8_C(4)
2571#define IMAGE_SYM_CLASS_EXTERNAL_DEF UINT8_C(5)
2572#define IMAGE_SYM_CLASS_LABEL UINT8_C(6)
2573#define IMAGE_SYM_CLASS_UNDEFINED_LABEL UINT8_C(7)
2574#define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT UINT8_C(8)
2575#define IMAGE_SYM_CLASS_ARGUMENT UINT8_C(9)
2576#define IMAGE_SYM_CLASS_STRUCT_TAG UINT8_C(10)
2577#define IMAGE_SYM_CLASS_MEMBER_OF_UNION UINT8_C(11)
2578#define IMAGE_SYM_CLASS_UNION_TAG UINT8_C(12)
2579#define IMAGE_SYM_CLASS_TYPE_DEFINITION UINT8_C(13)
2580#define IMAGE_SYM_CLASS_UNDEFINED_STATIC UINT8_C(14)
2581#define IMAGE_SYM_CLASS_ENUM_TAG UINT8_C(15)
2582#define IMAGE_SYM_CLASS_MEMBER_OF_ENUM UINT8_C(16)
2583#define IMAGE_SYM_CLASS_REGISTER_PARAM UINT8_C(17)
2584#define IMAGE_SYM_CLASS_BIT_FIELD UINT8_C(18)
2585#define IMAGE_SYM_CLASS_FAR_EXTERNAL UINT8_C(68)
2586#define IMAGE_SYM_CLASS_BLOCK UINT8_C(100)
2587#define IMAGE_SYM_CLASS_FUNCTION UINT8_C(101)
2588#define IMAGE_SYM_CLASS_END_OF_STRUCT UINT8_C(102)
2589#define IMAGE_SYM_CLASS_FILE UINT8_C(103)
2590#define IMAGE_SYM_CLASS_SECTION UINT8_C(104)
2591#define IMAGE_SYM_CLASS_WEAK_EXTERNAL UINT8_C(105)
2592#define IMAGE_SYM_CLASS_CLR_TOKEN UINT8_C(107)
2593/** @} */
2594
2595/** @name IMAGE_SYM_TYPE_XXX - COFF symbol base types
2596 * @{ */
2597#define IMAGE_SYM_TYPE_NULL UINT16_C(0x0000)
2598#define IMAGE_SYM_TYPE_VOID UINT16_C(0x0001)
2599#define IMAGE_SYM_TYPE_CHAR UINT16_C(0x0002)
2600#define IMAGE_SYM_TYPE_SHORT UINT16_C(0x0003)
2601#define IMAGE_SYM_TYPE_INT UINT16_C(0x0004)
2602#define IMAGE_SYM_TYPE_LONG UINT16_C(0x0005)
2603#define IMAGE_SYM_TYPE_FLOAT UINT16_C(0x0006)
2604#define IMAGE_SYM_TYPE_DOUBLE UINT16_C(0x0007)
2605#define IMAGE_SYM_TYPE_STRUCT UINT16_C(0x0008)
2606#define IMAGE_SYM_TYPE_UNION UINT16_C(0x0009)
2607#define IMAGE_SYM_TYPE_ENUM UINT16_C(0x000a)
2608#define IMAGE_SYM_TYPE_MOE UINT16_C(0x000b)
2609#define IMAGE_SYM_TYPE_BYTE UINT16_C(0x000c)
2610#define IMAGE_SYM_TYPE_WORD UINT16_C(0x000d)
2611#define IMAGE_SYM_TYPE_UINT UINT16_C(0x000e)
2612#define IMAGE_SYM_TYPE_DWORD UINT16_C(0x000f)
2613#define IMAGE_SYM_TYPE_PCODE UINT16_C(0x8000)
2614/** @} */
2615
2616/** @name IMAGE_SYM_DTYPE_XXX - COFF symbol complex types
2617 * @{ */
2618#define IMAGE_SYM_DTYPE_NULL UINT16_C(0x0)
2619#define IMAGE_SYM_DTYPE_POINTER UINT16_C(0x1)
2620#define IMAGE_SYM_DTYPE_FUNCTION UINT16_C(0x2)
2621#define IMAGE_SYM_DTYPE_ARRAY UINT16_C(0x3)
2622/** @} */
2623
2624/** @name COFF Symbol type masks and shift counts.
2625 * @{ */
2626#define N_BTMASK UINT16_C(0x000f)
2627#define N_TMASK UINT16_C(0x0030)
2628#define N_TMASK1 UINT16_C(0x00c0)
2629#define N_TMASK2 UINT16_C(0x00f0)
2630#define N_BTSHFT 4
2631#define N_TSHIFT 2
2632/** @} */
2633
2634/** @name COFF Symbol type macros.
2635 * @{ */
2636#define BTYPE(a_Type) ( (a_Type) & N_BTMASK )
2637#define ISPTR(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_POINTER << N_BTSHFT) )
2638#define ISFCN(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_FUNCTION << N_BTSHFT) )
2639#define ISARY(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_ARRAY << N_BTSHFT) )
2640#define ISTAG(a_StorageClass) ( (a_StorageClass) == IMAGE_SYM_CLASS_STRUCT_TAG \
2641 || (a_StorageClass) == IMAGE_SYM_CLASS_UNION_TAG \
2642 || (a_StorageClass) == IMAGE_SYM_CLASS_ENUM_TAG )
2643/** @} */
2644
2645
2646#ifndef __ASSEMBLER__
2647/**
2648 * COFF relocation table entry.
2649 *
2650 * @note The size of the structure is not a multiple of the largest member
2651 * (uint32_t), so odd relocation table entry members will have
2652 * misaligned uint32_t members.
2653 */
2654#pragma pack(1)
2655typedef struct _IMAGE_RELOCATION
2656{
2657 union
2658 {
2659 uint32_t VirtualAddress;
2660 uint32_t RelocCount;
2661 } u;
2662 uint32_t SymbolTableIndex;
2663 uint16_t Type;
2664} IMAGE_RELOCATION;
2665#pragma pack()
2666/** The size of a COFF relocation entry. */
2667#define IMAGE_SIZEOF_RELOCATION 10
2668AssertCompileSize(IMAGE_RELOCATION, IMAGE_SIZEOF_RELOCATION);
2669typedef IMAGE_RELOCATION *PIMAGE_RELOCATION;
2670typedef IMAGE_RELOCATION const *PCIMAGE_RELOCATION;
2671#endif /* !__ASSEMBLER__ */
2672
2673
2674/** @name IMAGE_REL_AMD64_XXX - COFF relocations for AMD64 CPUs.
2675 * Used by IMAGE_RELOCATION::Type.
2676 * @{ */
2677#define IMAGE_REL_AMD64_ABSOLUTE UINT16_C(0x0000)
2678#define IMAGE_REL_AMD64_ADDR64 UINT16_C(0x0001)
2679#define IMAGE_REL_AMD64_ADDR32 UINT16_C(0x0002)
2680#define IMAGE_REL_AMD64_ADDR32NB UINT16_C(0x0003)
2681#define IMAGE_REL_AMD64_REL32 UINT16_C(0x0004)
2682#define IMAGE_REL_AMD64_REL32_1 UINT16_C(0x0005)
2683#define IMAGE_REL_AMD64_REL32_2 UINT16_C(0x0006)
2684#define IMAGE_REL_AMD64_REL32_3 UINT16_C(0x0007)
2685#define IMAGE_REL_AMD64_REL32_4 UINT16_C(0x0008)
2686#define IMAGE_REL_AMD64_REL32_5 UINT16_C(0x0009)
2687#define IMAGE_REL_AMD64_SECTION UINT16_C(0x000a)
2688#define IMAGE_REL_AMD64_SECREL UINT16_C(0x000b)
2689#define IMAGE_REL_AMD64_SECREL7 UINT16_C(0x000c)
2690#define IMAGE_REL_AMD64_TOKEN UINT16_C(0x000d)
2691#define IMAGE_REL_AMD64_SREL32 UINT16_C(0x000e)
2692#define IMAGE_REL_AMD64_PAIR UINT16_C(0x000f)
2693#define IMAGE_REL_AMD64_SSPAN32 UINT16_C(0x0010)
2694/** @} */
2695
2696/** @name ARM IMAGE_REL_ARM_XXX - COFF relocations for ARM CPUs.
2697 * Used by IMAGE_RELOCATION::Type.
2698 * @{ */
2699#define IMAGE_REL_ARM_ABSOLUTE UINT16_C(0x0000)
2700#define IMAGE_REL_ARM_ADDR32 UINT16_C(0x0001)
2701#define IMAGE_REL_ARM_ADDR32NB UINT16_C(0x0002)
2702#define IMAGE_REL_ARM_BRANCH24 UINT16_C(0x0003)
2703#define IMAGE_REL_ARM_BRANCH11 UINT16_C(0x0004)
2704#define IMAGE_REL_ARM_TOKEN UINT16_C(0x0005)
2705#define IMAGE_REL_ARM_BLX24 UINT16_C(0x0008)
2706#define IMAGE_REL_ARM_BLX11 UINT16_C(0x0009)
2707#define IMAGE_REL_ARM_SECTION UINT16_C(0x000e)
2708#define IMAGE_REL_ARM_SECREL UINT16_C(0x000f)
2709#define IMAGE_REL_ARM_MOV32A UINT16_C(0x0010)
2710#define IMAGE_REL_ARM_MOV32T UINT16_C(0x0011)
2711#define IMAGE_REL_ARM_BRANCH20T UINT16_C(0x0012)
2712#define IMAGE_REL_ARM_BRANCH24T UINT16_C(0x0014)
2713#define IMAGE_REL_ARM_BLX23T UINT16_C(0x0015)
2714/** @} */
2715
2716/** @name IMAGE_REL_ARM64_XXX - COFF relocations for ARMv8 CPUs (64-bit).
2717 * Used by IMAGE_RELOCATION::Type.
2718 * @{ */
2719#define IMAGE_REL_ARM64_ABSOLUTE UINT16_C(0x0000)
2720#define IMAGE_REL_ARM64_ADDR32 UINT16_C(0x0001)
2721#define IMAGE_REL_ARM64_ADDR32NB UINT16_C(0x0002)
2722#define IMAGE_REL_ARM64_BRANCH26 UINT16_C(0x0003)
2723#define IMAGE_REL_ARM64_PAGEBASE_REL21 UINT16_C(0x0004)
2724#define IMAGE_REL_ARM64_REL21 UINT16_C(0x0005)
2725#define IMAGE_REL_ARM64_PAGEOFFSET_12A UINT16_C(0x0006)
2726#define IMAGE_REL_ARM64_PAGEOFFSET_12L UINT16_C(0x0007)
2727#define IMAGE_REL_ARM64_SECREL UINT16_C(0x0008)
2728#define IMAGE_REL_ARM64_SECREL_LOW12A UINT16_C(0x0009)
2729#define IMAGE_REL_ARM64_SECREL_HIGH12A UINT16_C(0x000a)
2730#define IMAGE_REL_ARM64_SECREL_LOW12L UINT16_C(0x000b)
2731#define IMAGE_REL_ARM64_TOKEN UINT16_C(0x000c)
2732#define IMAGE_REL_ARM64_SECTION UINT16_C(0x000d)
2733#define IMAGE_REL_ARM64_ADDR64 UINT16_C(0x000e)
2734/** @} */
2735
2736/** @name IMAGE_REL_SH3_XXX - COFF relocation for Hitachi SuperH CPUs.
2737 * Used by IMAGE_RELOCATION::Type.
2738 * @{ */
2739#define IMAGE_REL_SH3_ABSOLUTE UINT16_C(0x0000)
2740#define IMAGE_REL_SH3_DIRECT16 UINT16_C(0x0001)
2741#define IMAGE_REL_SH3_DIRECT32 UINT16_C(0x0002)
2742#define IMAGE_REL_SH3_DIRECT8 UINT16_C(0x0003)
2743#define IMAGE_REL_SH3_DIRECT8_WORD UINT16_C(0x0004)
2744#define IMAGE_REL_SH3_DIRECT8_LONG UINT16_C(0x0005)
2745#define IMAGE_REL_SH3_DIRECT4 UINT16_C(0x0006)
2746#define IMAGE_REL_SH3_DIRECT4_WORD UINT16_C(0x0007)
2747#define IMAGE_REL_SH3_DIRECT4_LONG UINT16_C(0x0008)
2748#define IMAGE_REL_SH3_PCREL8_WORD UINT16_C(0x0009)
2749#define IMAGE_REL_SH3_PCREL8_LONG UINT16_C(0x000a)
2750#define IMAGE_REL_SH3_PCREL12_WORD UINT16_C(0x000b)
2751#define IMAGE_REL_SH3_STARTOF_SECTION UINT16_C(0x000c)
2752#define IMAGE_REL_SH3_SIZEOF_SECTION UINT16_C(0x000d)
2753#define IMAGE_REL_SH3_SECTION UINT16_C(0x000e)
2754#define IMAGE_REL_SH3_SECREL UINT16_C(0x000f)
2755#define IMAGE_REL_SH3_DIRECT32_NB UINT16_C(0x0010)
2756#define IMAGE_REL_SH3_GPREL4_LONG UINT16_C(0x0011)
2757#define IMAGE_REL_SH3_TOKEN UINT16_C(0x0012)
2758#define IMAGE_REL_SHM_PCRELPT UINT16_C(0x0013)
2759#define IMAGE_REL_SHM_REFLO UINT16_C(0x0014)
2760#define IMAGE_REL_SHM_REFHALF UINT16_C(0x0015)
2761#define IMAGE_REL_SHM_RELLO UINT16_C(0x0016)
2762#define IMAGE_REL_SHM_RELHALF UINT16_C(0x0017)
2763#define IMAGE_REL_SHM_PAIR UINT16_C(0x0018)
2764#define IMAGE_REL_SHM_NOMODE UINT16_C(0x8000)
2765/** @} */
2766
2767/** @name IMAGE_REL_PPC_XXX - COFF relocations for IBM PowerPC CPUs.
2768 * Used by IMAGE_RELOCATION::Type.
2769 * @{ */
2770#define IMAGE_REL_PPC_ABSOLUTE UINT16_C(0x0000)
2771#define IMAGE_REL_PPC_ADDR64 UINT16_C(0x0001)
2772#define IMAGE_REL_PPC_ADDR32 UINT16_C(0x0002)
2773#define IMAGE_REL_PPC_ADDR24 UINT16_C(0x0003)
2774#define IMAGE_REL_PPC_ADDR16 UINT16_C(0x0004)
2775#define IMAGE_REL_PPC_ADDR14 UINT16_C(0x0005)
2776#define IMAGE_REL_PPC_REL24 UINT16_C(0x0006)
2777#define IMAGE_REL_PPC_REL14 UINT16_C(0x0007)
2778#define IMAGE_REL_PPC_ADDR32NB UINT16_C(0x000a)
2779#define IMAGE_REL_PPC_SECREL UINT16_C(0x000b)
2780#define IMAGE_REL_PPC_SECTION UINT16_C(0x000c)
2781#define IMAGE_REL_PPC_SECREL16 UINT16_C(0x000f)
2782#define IMAGE_REL_PPC_REFHI UINT16_C(0x0010)
2783#define IMAGE_REL_PPC_REFLO UINT16_C(0x0011)
2784#define IMAGE_REL_PPC_PAIR UINT16_C(0x0012)
2785#define IMAGE_REL_PPC_SECRELLO UINT16_C(0x0013)
2786#define IMAGE_REL_PPC_GPREL UINT16_C(0x0015)
2787#define IMAGE_REL_PPC_TOKEN UINT16_C(0x0016)
2788/** @} */
2789
2790/** @name IMAGE_REL_I386_XXX - COFF relocations for x86 CPUs.
2791 * Used by IMAGE_RELOCATION::Type.
2792 * @{ */
2793#define IMAGE_REL_I386_ABSOLUTE UINT16_C(0x0000)
2794#define IMAGE_REL_I386_DIR16 UINT16_C(0x0001)
2795#define IMAGE_REL_I386_REL16 UINT16_C(0x0002)
2796#define IMAGE_REL_I386_DIR32 UINT16_C(0x0006)
2797#define IMAGE_REL_I386_DIR32NB UINT16_C(0x0007)
2798#define IMAGE_REL_I386_SEG12 UINT16_C(0x0009)
2799#define IMAGE_REL_I386_SECTION UINT16_C(0x000A)
2800#define IMAGE_REL_I386_SECREL UINT16_C(0x000B)
2801#define IMAGE_REL_I386_TOKEN UINT16_C(0x000C)
2802#define IMAGE_REL_I386_SECREL7 UINT16_C(0x000D)
2803#define IMAGE_REL_I386_REL32 UINT16_C(0x0014)
2804/** @} */
2805
2806/** @name IMAGE_REL_IA64_XXX - COFF relocations for "Itanic" CPUs.
2807 * @{ */
2808#define IMAGE_REL_IA64_ABSOLUTE UINT16_C(0x0000)
2809#define IMAGE_REL_IA64_IMM14 UINT16_C(0x0001)
2810#define IMAGE_REL_IA64_IMM22 UINT16_C(0x0002)
2811#define IMAGE_REL_IA64_IMM64 UINT16_C(0x0003)
2812#define IMAGE_REL_IA64_DIR32 UINT16_C(0x0004)
2813#define IMAGE_REL_IA64_DIR64 UINT16_C(0x0005)
2814#define IMAGE_REL_IA64_PCREL21B UINT16_C(0x0006)
2815#define IMAGE_REL_IA64_PCREL21M UINT16_C(0x0007)
2816#define IMAGE_REL_IA64_PCREL21F UINT16_C(0x0008)
2817#define IMAGE_REL_IA64_GPREL22 UINT16_C(0x0009)
2818#define IMAGE_REL_IA64_LTOFF22 UINT16_C(0x000a)
2819#define IMAGE_REL_IA64_SECTION UINT16_C(0x000b)
2820#define IMAGE_REL_IA64_SECREL22 UINT16_C(0x000c)
2821#define IMAGE_REL_IA64_SECREL64I UINT16_C(0x000d)
2822#define IMAGE_REL_IA64_SECREL32 UINT16_C(0x000e)
2823#define IMAGE_REL_IA64_DIR32NB UINT16_C(0x0010)
2824#define IMAGE_REL_IA64_SREL14 UINT16_C(0x0011)
2825#define IMAGE_REL_IA64_SREL22 UINT16_C(0x0012)
2826#define IMAGE_REL_IA64_SREL32 UINT16_C(0x0013)
2827#define IMAGE_REL_IA64_UREL32 UINT16_C(0x0014)
2828#define IMAGE_REL_IA64_PCREL60X UINT16_C(0x0015)
2829#define IMAGE_REL_IA64_PCREL60B UINT16_C(0x0016)
2830#define IMAGE_REL_IA64_PCREL60F UINT16_C(0x0017)
2831#define IMAGE_REL_IA64_PCREL60I UINT16_C(0x0018)
2832#define IMAGE_REL_IA64_PCREL60M UINT16_C(0x0019)
2833#define IMAGE_REL_IA64_IMMGPREL64 UINT16_C(0x001a)
2834#define IMAGE_REL_IA64_TOKEN UINT16_C(0x001b)
2835#define IMAGE_REL_IA64_GPREL32 UINT16_C(0x001c)
2836#define IMAGE_REL_IA64_ADDEND UINT16_C(0x001f)
2837/** @} */
2838
2839/** @name IMAGE_REL_MIPS_XXX - COFF relocations for MIPS CPUs.
2840 * Used by IMAGE_RELOCATION::Type.
2841 * @{ */
2842#define IMAGE_REL_MIPS_ABSOLUTE UINT16_C(0x0000)
2843#define IMAGE_REL_MIPS_REFHALF UINT16_C(0x0001)
2844#define IMAGE_REL_MIPS_REFWORD UINT16_C(0x0002)
2845#define IMAGE_REL_MIPS_JMPADDR UINT16_C(0x0003)
2846#define IMAGE_REL_MIPS_REFHI UINT16_C(0x0004)
2847#define IMAGE_REL_MIPS_REFLO UINT16_C(0x0005)
2848#define IMAGE_REL_MIPS_GPREL UINT16_C(0x0006)
2849#define IMAGE_REL_MIPS_LITERAL UINT16_C(0x0007)
2850#define IMAGE_REL_MIPS_SECTION UINT16_C(0x000a)
2851#define IMAGE_REL_MIPS_SECREL UINT16_C(0x000b)
2852#define IMAGE_REL_MIPS_SECRELLO UINT16_C(0x000c)
2853#define IMAGE_REL_MIPS_SECRELHI UINT16_C(0x000d)
2854#define IMAGE_REL_MIPS_JMPADDR16 UINT16_C(0x0010)
2855#define IMAGE_REL_MIPS_REFWORDNB UINT16_C(0x0022)
2856#define IMAGE_REL_MIPS_PAIR UINT16_C(0x0025)
2857/** @} */
2858
2859/** @name IMAGE_REL_M32R_XXX - COFF relocations for Mitsubishi M32R CPUs.
2860 * Used by IMAGE_RELOCATION::Type.
2861 * @{ */
2862#define IMAGE_REL_M32R_ABSOLUTE UINT16_C(0x0000)
2863#define IMAGE_REL_M32R_ADDR32 UINT16_C(0x0001)
2864#define IMAGE_REL_M32R_ADDR32NB UINT16_C(0x0002)
2865#define IMAGE_REL_M32R_ADDR24 UINT16_C(0x0003)
2866#define IMAGE_REL_M32R_GPREL16 UINT16_C(0x0004)
2867#define IMAGE_REL_M32R_PCREL24 UINT16_C(0x0005)
2868#define IMAGE_REL_M32R_PCREL16 UINT16_C(0x0006)
2869#define IMAGE_REL_M32R_PCREL8 UINT16_C(0x0007)
2870#define IMAGE_REL_M32R_REFHALF UINT16_C(0x0008)
2871#define IMAGE_REL_M32R_REFHI UINT16_C(0x0009)
2872#define IMAGE_REL_M32R_REFLO UINT16_C(0x000a)
2873#define IMAGE_REL_M32R_PAIR UINT16_C(0x000b)
2874#define IMAGE_REL_M32R_SECTION UINT16_C(0x000c)
2875#define IMAGE_REL_M32R_SECREL UINT16_C(0x000d)
2876#define IMAGE_REL_M32R_TOKEN UINT16_C(0x000e)
2877/** @} */
2878
2879
2880/** @} */
2881
2882#endif /* !IPRT_INCLUDED_formats_pecoff_h */
2883
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette