pecoff.h@ 65240

Last change on this file since 65240 was 65240, checked in by vboxsync, 8 years ago
pecoff.h,ldrPE.cpp: New IMAGE_LOAD_CONFIG_DIRECTORY structure in 15002, guard fields are used now.
Property svn:eol-style set to `native` Property svn:keywords set to `Id`
File size: 76.6 KB

Line
1	/* $Id: pecoff.h 65240 2017-01-11 10:39:51Z vboxsync $ */
2	/** @file
3	* IPRT - Windows NT PE & COFF Structures and Constants.
4	*/
5
6	/*
7	* Copyright (C) 2006-2016 Oracle Corporation
8	*
9	* This file is part of VirtualBox Open Source Edition (OSE), as
10	* available from http://www.virtualbox.org. This file is free software;
11	* you can redistribute it and/or modify it under the terms of the GNU
12	* General Public License (GPL) as published by the Free Software
13	* Foundation, in version 2 as it comes in the "COPYING" file of the
14	* VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15	* hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16	*
17	* The contents of this file may alternatively be used under the terms
18	* of the Common Development and Distribution License Version 1.0
19	* (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20	* VirtualBox OSE distribution, in which case the provisions of the
21	* CDDL are applicable instead of those of the GPL.
22	*
23	* You may elect to license modified versions of this file under the
24	* terms and conditions of either the GPL or the CDDL or both.
25	*/
26
27	#ifndef ___iprt_formats_pecoff_h
28	#define ___iprt_formats_pecoff_h
29
30	#include <iprt/types.h>
31	#include <iprt/assert.h>
32
33
34	/** @defgroup grp_rt_formats_pecoff PE & Microsoft COFF structures and definitions
35	* @ingroup grp_rt_formats
36	* @{
37	*/
38
39
40	/**
41	* PE & COFF file header.
42	*
43	* This starts COFF files, while in PE files it's preceeded by the PE signature
44	* (see IMAGE_NT_HEADERS32, IMAGE_NT_HEADERS64).
45	*/
46	typedef struct _IMAGE_FILE_HEADER
47	{
48	uint16_t Machine; /*< 0x00 /
49	uint16_t NumberOfSections; /*< 0x02 /
50	uint32_t TimeDateStamp; /*< 0x04 /
51	uint32_t PointerToSymbolTable; /*< 0x08 /
52	uint32_t NumberOfSymbols; /*< 0x0c /
53	uint16_t SizeOfOptionalHeader; /*< 0x10 /
54	uint16_t Characteristics; /*< 0x12 /
55	} IMAGE_FILE_HEADER; /* size: 0x14 */
56	AssertCompileSize(IMAGE_FILE_HEADER, 0x14);
57	typedef IMAGE_FILE_HEADER *PIMAGE_FILE_HEADER;
58	typedef IMAGE_FILE_HEADER const *PCIMAGE_FILE_HEADER;
59
60
61	/** @name PE & COFF machine types.
62	* Used by IMAGE_FILE_HEADER::Machine and IMAGE_SEPARATE_DEBUG_HEADER::Machine.
63	* @{ */
64	/** X86 compatible CPU, 32-bit instructions. */
65	#define IMAGE_FILE_MACHINE_I386 UINT16_C(0x014c)
66	/** AMD64 compatible CPU, 64-bit instructions. */
67	#define IMAGE_FILE_MACHINE_AMD64 UINT16_C(0x8664)
68
69	/** Unknown target CPU. */
70	#define IMAGE_FILE_MACHINE_UNKNOWN UINT16_C(0x0000)
71	/** Matshushita AM33 CPU. */
72	#define IMAGE_FILE_MACHINE_AM33 UINT16_C(0x01d3)
73	/** Little endian ARM CPU. */
74	#define IMAGE_FILE_MACHINE_ARM UINT16_C(0x01c0)
75	/** ARM or Thumb stuff. */
76	#define IMAGE_FILE_MACHINE_THUMB UINT16_C(0x01c2)
77	/** ARMv7 or higher CPU, Thumb mode. */
78	#define IMAGE_FILE_MACHINE_ARMNT UINT16_C(0x01c4)
79	/** ARMv8 CPU, 64-bit mode. */
80	#define IMAGE_FILE_MACHINE_ARM64 UINT16_C(0xaa64)
81	/** EFI byte code. */
82	#define IMAGE_FILE_MACHINE_EBC UINT16_C(0x0ebc)
83	/** "Itanic" CPU. */
84	#define IMAGE_FILE_MACHINE_IA64 UINT16_C(0x0200)
85	/** Mitsubishi M32R CPU, little endian. */
86	#define IMAGE_FILE_MACHINE_M32R UINT16_C(0x9041)
87	/** MIPS CPU, compact 16-bit instructions only? */
88	#define IMAGE_FILE_MACHINE_MIPS16 UINT16_C(0x0266)
89	/** MIPS CPU with FPU, full 32-bit instructions only? */
90	#define IMAGE_FILE_MACHINE_MIPSFPU UINT16_C(0x0366)
91	/** MIPS CPU with FPU, compact 16-bit instructions? */
92	#define IMAGE_FILE_MACHINE_MIPSFPU16 UINT16_C(0x0466)
93	/** MIPS CPU, little endian, Windows CE (?) v2 designation. */
94	#define IMAGE_FILE_MACHINE_WCEMIPSV2 UINT16_C(0x0169)
95	/** Power PC CPU, little endian. */
96	#define IMAGE_FILE_MACHINE_POWERPC UINT16_C(0x01f0)
97	/** Power PC CPU with FPU, also little endian? */
98	#define IMAGE_FILE_MACHINE_POWERPCFP UINT16_C(0x01f1)
99	/** MIPS R4000 CPU, little endian. */
100	#define IMAGE_FILE_MACHINE_R4000 UINT16_C(0x0166)
101	/** Hitachi SH3 CPU. */
102	#define IMAGE_FILE_MACHINE_SH3 UINT16_C(0x01a2)
103	/** Hitachi SH3 DSP. */
104	#define IMAGE_FILE_MACHINE_SH3DSP UINT16_C(0x01a3)
105	/** Hitachi SH4 CPU. */
106	#define IMAGE_FILE_MACHINE_SH4 UINT16_C(0x01a6)
107	/** Hitachi SH5 CPU. */
108	#define IMAGE_FILE_MACHINE_SH5 UINT16_C(0x01a8)
109	/** @} */
110
111	/** @name File header characteristics (IMAGE_FILE_HEADER::Characteristics)
112	* @{ */
113	#define IMAGE_FILE_RELOCS_STRIPPED UINT16_C(0x0001)
114	#define IMAGE_FILE_EXECUTABLE_IMAGE UINT16_C(0x0002)
115	#define IMAGE_FILE_LINE_NUMS_STRIPPED UINT16_C(0x0004)
116	#define IMAGE_FILE_LOCAL_SYMS_STRIPPED UINT16_C(0x0008)
117	#define IMAGE_FILE_AGGRESIVE_WS_TRIM UINT16_C(0x0010)
118	#define IMAGE_FILE_LARGE_ADDRESS_AWARE UINT16_C(0x0020)
119	#define IMAGE_FILE_16BIT_MACHINE UINT16_C(0x0040)
120	#define IMAGE_FILE_BYTES_REVERSED_LO UINT16_C(0x0080)
121	#define IMAGE_FILE_32BIT_MACHINE UINT16_C(0x0100)
122	#define IMAGE_FILE_DEBUG_STRIPPED UINT16_C(0x0200)
123	#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP UINT16_C(0x0400)
124	#define IMAGE_FILE_NET_RUN_FROM_SWAP UINT16_C(0x0800)
125	#define IMAGE_FILE_SYSTEM UINT16_C(0x1000)
126	#define IMAGE_FILE_DLL UINT16_C(0x2000)
127	#define IMAGE_FILE_UP_SYSTEM_ONLY UINT16_C(0x4000)
128	#define IMAGE_FILE_BYTES_REVERSED_HI UINT16_C(0x8000)
129	/** @} */
130
131
132	/**
133	* PE data directory.
134	*
135	* This is used to locate data in the loaded image so the dynamic linker or
136	* others can make use of it. However, in the case of
137	* IMAGE_DIRECTORY_ENTRY_SECURITY it is referring to raw file offsets.
138	*/
139	typedef struct _IMAGE_DATA_DIRECTORY
140	{
141	uint32_t VirtualAddress;
142	uint32_t Size;
143	} IMAGE_DATA_DIRECTORY;
144	AssertCompileSize(IMAGE_DATA_DIRECTORY, 0x8);
145	typedef IMAGE_DATA_DIRECTORY *PIMAGE_DATA_DIRECTORY;
146	typedef IMAGE_DATA_DIRECTORY const *PCIMAGE_DATA_DIRECTORY;
147
148	/** The standard number of data directories in the optional header.
149	* I.e. the dimensions of IMAGE_OPTIONAL_HEADER32::DataDirectory and
150	* IMAGE_OPTIONAL_HEADER64::DataDirectory.
151	*/
152	#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 0x10
153
154
155	/**
156	* PE optional header, 32-bit version.
157	*/
158	typedef struct _IMAGE_OPTIONAL_HEADER32
159	{
160	uint16_t Magic; /*< 0x00 /
161	uint8_t MajorLinkerVersion; /*< 0x02 /
162	uint8_t MinorLinkerVersion; /*< 0x03 /
163	uint32_t SizeOfCode; /*< 0x04 /
164	uint32_t SizeOfInitializedData; /*< 0x08 /
165	uint32_t SizeOfUninitializedData; /*< 0x0c /
166	uint32_t AddressOfEntryPoint; /*< 0x10 /
167	uint32_t BaseOfCode; /*< 0x14 /
168	uint32_t BaseOfData; /*< 0x18 /
169	uint32_t ImageBase; /*< 0x1c /
170	uint32_t SectionAlignment; /*< 0x20 /
171	uint32_t FileAlignment; /*< 0x24 /
172	uint16_t MajorOperatingSystemVersion; /*< 0x28 /
173	uint16_t MinorOperatingSystemVersion; /*< 0x2a /
174	uint16_t MajorImageVersion; /*< 0x2c /
175	uint16_t MinorImageVersion; /*< 0x2e /
176	uint16_t MajorSubsystemVersion; /*< 0x30 /
177	uint16_t MinorSubsystemVersion; /*< 0x32 /
178	uint32_t Win32VersionValue; /*< 0x34 /
179	uint32_t SizeOfImage; /*< 0x38 /
180	uint32_t SizeOfHeaders; /*< 0x3c /
181	uint32_t CheckSum; /*< 0x40 /
182	uint16_t Subsystem; /*< 0x44 /
183	uint16_t DllCharacteristics; /*< 0x46 /
184	uint32_t SizeOfStackReserve; /*< 0x48 /
185	uint32_t SizeOfStackCommit; /*< 0x4c /
186	uint32_t SizeOfHeapReserve; /*< 0x50 /
187	uint32_t SizeOfHeapCommit; /*< 0x54 /
188	uint32_t LoaderFlags; /*< 0x58 /
189	uint32_t NumberOfRvaAndSizes; /*< 0x5c /
190	IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /*< 0x60; 0x108 = 0x80 */
191	} IMAGE_OPTIONAL_HEADER32; /* size: 0xe0 */
192	AssertCompileSize(IMAGE_OPTIONAL_HEADER32, 0xe0);
193	typedef IMAGE_OPTIONAL_HEADER32 *PIMAGE_OPTIONAL_HEADER32;
194	typedef IMAGE_OPTIONAL_HEADER32 const *PCIMAGE_OPTIONAL_HEADER32;
195
196	/**
197	* PE optional header, 64-bit version.
198	*/
199	typedef struct _IMAGE_OPTIONAL_HEADER64
200	{
201	uint16_t Magic; /*< 0x00 /
202	uint8_t MajorLinkerVersion; /*< 0x02 /
203	uint8_t MinorLinkerVersion; /*< 0x03 /
204	uint32_t SizeOfCode; /*< 0x04 /
205	uint32_t SizeOfInitializedData; /*< 0x08 /
206	uint32_t SizeOfUninitializedData; /*< 0x0c /
207	uint32_t AddressOfEntryPoint; /*< 0x10 /
208	uint32_t BaseOfCode; /*< 0x14 /
209	uint64_t ImageBase; /*< 0x18 /
210	uint32_t SectionAlignment; /*< 0x20 /
211	uint32_t FileAlignment; /*< 0x24 /
212	uint16_t MajorOperatingSystemVersion; /*< 0x28 /
213	uint16_t MinorOperatingSystemVersion; /*< 0x2a /
214	uint16_t MajorImageVersion; /*< 0x2c /
215	uint16_t MinorImageVersion; /*< 0x2e /
216	uint16_t MajorSubsystemVersion; /*< 0x30 /
217	uint16_t MinorSubsystemVersion; /*< 0x32 /
218	uint32_t Win32VersionValue; /*< 0x34 /
219	uint32_t SizeOfImage; /*< 0x38 /
220	uint32_t SizeOfHeaders; /*< 0x3c /
221	uint32_t CheckSum; /*< 0x40 /
222	uint16_t Subsystem; /*< 0x44 /
223	uint16_t DllCharacteristics; /*< 0x46 /
224	uint64_t SizeOfStackReserve; /*< 0x48 /
225	uint64_t SizeOfStackCommit; /*< 0x50 /
226	uint64_t SizeOfHeapReserve; /*< 0x58 /
227	uint64_t SizeOfHeapCommit; /*< 0x60 /
228	uint32_t LoaderFlags; /*< 0x68 /
229	uint32_t NumberOfRvaAndSizes; /*< 0x6c /
230	IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /*< 0x70; 0x108 = 0x80 */
231	} IMAGE_OPTIONAL_HEADER64; /* size: 0xf0 */
232	AssertCompileSize(IMAGE_OPTIONAL_HEADER64, 0xf0);
233	typedef IMAGE_OPTIONAL_HEADER64 *PIMAGE_OPTIONAL_HEADER64;
234	typedef IMAGE_OPTIONAL_HEADER64 const *PCIMAGE_OPTIONAL_HEADER64;
235
236	/** @name Optional header magic values.
237	* @{ */
238	#define IMAGE_NT_OPTIONAL_HDR32_MAGIC UINT16_C(0x010b)
239	#define IMAGE_NT_OPTIONAL_HDR64_MAGIC UINT16_C(0x020b)
240	/** @} */
241
242	/** @name IMAGE_SUBSYSTEM_XXX - Optional header subsystems.
243	* IMAGE_OPTIONAL_HEADER32::Subsystem, IMAGE_OPTIONAL_HEADER64::Subsystem
244	* @{ */
245	#define IMAGE_SUBSYSTEM_UNKNOWN UINT16_C(0x0000)
246	#define IMAGE_SUBSYSTEM_NATIVE UINT16_C(0x0001)
247	#define IMAGE_SUBSYSTEM_WINDOWS_GUI UINT16_C(0x0002)
248	#define IMAGE_SUBSYSTEM_WINDOWS_CUI UINT16_C(0x0003)
249	#define IMAGE_SUBSYSTEM_OS2_GUI UINT16_C(0x0004)
250	#define IMAGE_SUBSYSTEM_OS2_CUI UINT16_C(0x0005)
251	#define IMAGE_SUBSYSTEM_POSIX_CUI UINT16_C(0x0007)
252	/** @} */
253
254	/** @name Optional header characteristics.
255	* @{ */
256	#define IMAGE_LIBRARY_PROCESS_INIT UINT16_C(0x0001)
257	#define IMAGE_LIBRARY_PROCESS_TERM UINT16_C(0x0002)
258	#define IMAGE_LIBRARY_THREAD_INIT UINT16_C(0x0004)
259	#define IMAGE_LIBRARY_THREAD_TERM UINT16_C(0x0008)
260	#define IMAGE_DLLCHARACTERISTICS_RESERVED UINT16_C(0x0010)
261	#define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA UINT16_C(0x0020)
262	#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE UINT16_C(0x0040)
263	#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY UINT16_C(0x0080)
264	#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT UINT16_C(0x0100)
265	#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION UINT16_C(0x0200)
266	#define IMAGE_DLLCHARACTERISTICS_NO_SEH UINT16_C(0x0400)
267	#define IMAGE_DLLCHARACTERISTICS_NO_BIND UINT16_C(0x0800)
268	#define IMAGE_DLLCHARACTERISTICS_APPCONTAINER UINT16_C(0x1000)
269	#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER UINT16_C(0x2000)
270	#define IMAGE_DLLCHARACTERISTICS_GUARD_CF UINT16_C(0x4000)
271	#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE UINT16_C(0x8000)
272	/** @} */
273
274
275	/** @name IMAGE_DIRECTORY_ENTRY_XXX - Data directory indexes.
276	* Used to index IMAGE_OPTIONAL_HEADER32::DataDirectory and
277	* IMAGE_OPTIONAL_HEADER64::DataDirectory
278	* @{ */
279	#define IMAGE_DIRECTORY_ENTRY_EXPORT 0x0
280	#define IMAGE_DIRECTORY_ENTRY_IMPORT 0x1
281	#define IMAGE_DIRECTORY_ENTRY_RESOURCE 0x2
282	#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x3
283	#define IMAGE_DIRECTORY_ENTRY_SECURITY 0x4
284	#define IMAGE_DIRECTORY_ENTRY_BASERELOC 0x5
285	#define IMAGE_DIRECTORY_ENTRY_DEBUG 0x6
286	#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 0x7
287	#define IMAGE_DIRECTORY_ENTRY_COPYRIGHT IMAGE_DIRECTORY_ENTRY_ARCHITECTURE
288	#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x8
289	#define IMAGE_DIRECTORY_ENTRY_TLS 0x9
290	#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0xa
291	#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0xb
292	#define IMAGE_DIRECTORY_ENTRY_IAT 0xc
293	#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0xd
294	#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0xe
295	/** @} */
296
297
298	/**
299	* PE (NT) headers, 32-bit version.
300	*/
301	typedef struct _IMAGE_NT_HEADERS32
302	{
303	uint32_t Signature; /*< 0x00 /
304	IMAGE_FILE_HEADER FileHeader; /*< 0x04 /
305	IMAGE_OPTIONAL_HEADER32 OptionalHeader; /*< 0x18 /
306	} IMAGE_NT_HEADERS32; /* size: 0xf8 */
307	AssertCompileSize(IMAGE_NT_HEADERS32, 0xf8);
308	AssertCompileMemberOffset(IMAGE_NT_HEADERS32, FileHeader, 4);
309	AssertCompileMemberOffset(IMAGE_NT_HEADERS32, OptionalHeader, 24);
310	typedef IMAGE_NT_HEADERS32 *PIMAGE_NT_HEADERS32;
311	typedef IMAGE_NT_HEADERS32 const *PCIMAGE_NT_HEADERS32;
312
313	/**
314	* PE (NT) headers, 64-bit version.
315	*/
316	typedef struct _IMAGE_NT_HEADERS64
317	{
318	uint32_t Signature; /*< 0x00 /
319	IMAGE_FILE_HEADER FileHeader; /*< 0x04 /
320	IMAGE_OPTIONAL_HEADER64 OptionalHeader; /*< 0x18 /
321	} IMAGE_NT_HEADERS64; /*< 0x108 /
322	AssertCompileSize(IMAGE_NT_HEADERS64, 0x108);
323	AssertCompileMemberOffset(IMAGE_NT_HEADERS64, FileHeader, 4);
324	AssertCompileMemberOffset(IMAGE_NT_HEADERS64, OptionalHeader, 24);
325	typedef IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
326	typedef IMAGE_NT_HEADERS64 const *PCIMAGE_NT_HEADERS64;
327
328	/** The PE signature.
329	* Used by IMAGE_NT_HEADERS32::Signature, IMAGE_NT_HEADERS64::Signature. */
330	#define IMAGE_NT_SIGNATURE UINT32_C(0x00004550)
331
332
333	/** Section header short name length (IMAGE_SECTION_HEADER::Name). */
334	#define IMAGE_SIZEOF_SHORT_NAME 0x8
335
336	/**
337	* PE & COFF section header.
338	*/
339	typedef struct _IMAGE_SECTION_HEADER
340	{
341	uint8_t Name[IMAGE_SIZEOF_SHORT_NAME];
342	union
343	{
344	uint32_t PhysicalAddress;
345	uint32_t VirtualSize;
346	} Misc;
347	uint32_t VirtualAddress;
348	uint32_t SizeOfRawData;
349	uint32_t PointerToRawData;
350	uint32_t PointerToRelocations;
351	uint32_t PointerToLinenumbers;
352	uint16_t NumberOfRelocations;
353	uint16_t NumberOfLinenumbers;
354	uint32_t Characteristics;
355	} IMAGE_SECTION_HEADER;
356	AssertCompileSize(IMAGE_SECTION_HEADER, 40);
357	typedef IMAGE_SECTION_HEADER *PIMAGE_SECTION_HEADER;
358	typedef IMAGE_SECTION_HEADER const *PCIMAGE_SECTION_HEADER;
359
360	/** @name IMAGE_SCN_XXX - Section header characteristics.
361	* Used by IMAGE_SECTION_HEADER::Characteristics.
362	* @{ */
363	#define IMAGE_SCN_TYPE_REG UINT32_C(0x00000000)
364	#define IMAGE_SCN_TYPE_DSECT UINT32_C(0x00000001)
365	#define IMAGE_SCN_TYPE_NOLOAD UINT32_C(0x00000002)
366	#define IMAGE_SCN_TYPE_GROUP UINT32_C(0x00000004)
367	#define IMAGE_SCN_TYPE_NO_PAD UINT32_C(0x00000008)
368	#define IMAGE_SCN_TYPE_COPY UINT32_C(0x00000010)
369
370	#define IMAGE_SCN_CNT_CODE UINT32_C(0x00000020)
371	#define IMAGE_SCN_CNT_INITIALIZED_DATA UINT32_C(0x00000040)
372	#define IMAGE_SCN_CNT_UNINITIALIZED_DATA UINT32_C(0x00000080)
373
374	#define IMAGE_SCN_LNK_OTHER UINT32_C(0x00000100)
375	#define IMAGE_SCN_LNK_INFO UINT32_C(0x00000200)
376	#define IMAGE_SCN_TYPE_OVER UINT32_C(0x00000400)
377	#define IMAGE_SCN_LNK_REMOVE UINT32_C(0x00000800)
378	#define IMAGE_SCN_LNK_COMDAT UINT32_C(0x00001000)
379	#define IMAGE_SCN_MEM_PROTECTED UINT32_C(0x00004000)
380	#define IMAGE_SCN_NO_DEFER_SPEC_EXC UINT32_C(0x00004000)
381	#define IMAGE_SCN_GPREL UINT32_C(0x00008000)
382	#define IMAGE_SCN_MEM_FARDATA UINT32_C(0x00008000)
383	#define IMAGE_SCN_MEM_SYSHEAP UINT32_C(0x00010000)
384	#define IMAGE_SCN_MEM_PURGEABLE UINT32_C(0x00020000)
385	#define IMAGE_SCN_MEM_16BIT UINT32_C(0x00020000)
386	#define IMAGE_SCN_MEM_LOCKED UINT32_C(0x00040000)
387	#define IMAGE_SCN_MEM_PRELOAD UINT32_C(0x00080000)
388
389	#define IMAGE_SCN_ALIGN_1BYTES UINT32_C(0x00100000)
390	#define IMAGE_SCN_ALIGN_2BYTES UINT32_C(0x00200000)
391	#define IMAGE_SCN_ALIGN_4BYTES UINT32_C(0x00300000)
392	#define IMAGE_SCN_ALIGN_8BYTES UINT32_C(0x00400000)
393	#define IMAGE_SCN_ALIGN_16BYTES UINT32_C(0x00500000)
394	#define IMAGE_SCN_ALIGN_32BYTES UINT32_C(0x00600000)
395	#define IMAGE_SCN_ALIGN_64BYTES UINT32_C(0x00700000)
396	#define IMAGE_SCN_ALIGN_128BYTES UINT32_C(0x00800000)
397	#define IMAGE_SCN_ALIGN_256BYTES UINT32_C(0x00900000)
398	#define IMAGE_SCN_ALIGN_512BYTES UINT32_C(0x00A00000)
399	#define IMAGE_SCN_ALIGN_1024BYTES UINT32_C(0x00B00000)
400	#define IMAGE_SCN_ALIGN_2048BYTES UINT32_C(0x00C00000)
401	#define IMAGE_SCN_ALIGN_4096BYTES UINT32_C(0x00D00000)
402	#define IMAGE_SCN_ALIGN_8192BYTES UINT32_C(0x00E00000)
403	#define IMAGE_SCN_ALIGN_MASK UINT32_C(0x00F00000)
404	#define IMAGE_SCN_ALIGN_SHIFT 20
405
406	#define IMAGE_SCN_LNK_NRELOC_OVFL UINT32_C(0x01000000)
407	#define IMAGE_SCN_MEM_DISCARDABLE UINT32_C(0x02000000)
408	#define IMAGE_SCN_MEM_NOT_CACHED UINT32_C(0x04000000)
409	#define IMAGE_SCN_MEM_NOT_PAGED UINT32_C(0x08000000)
410	#define IMAGE_SCN_MEM_SHARED UINT32_C(0x10000000)
411	#define IMAGE_SCN_MEM_EXECUTE UINT32_C(0x20000000)
412	#define IMAGE_SCN_MEM_READ UINT32_C(0x40000000)
413	#define IMAGE_SCN_MEM_WRITE UINT32_C(0x80000000)
414	/** @} */
415
416
417	/**
418	* PE image base relocations block header.
419	*
420	* This found in IMAGE_DIRECTORY_ENTRY_BASERELOC. Each entry is follow
421	* immediately by an array of 16-bit words, where the lower 12-bits are used
422	* for the page offset and the upper 4-bits for the base relocation type
423	* (IMAGE_REL_BASE_XXX). The block should be padded with
424	* IMAGE_REL_BASED_ABSOLUTE entries to ensure 32-bit alignment of this header.
425	*/
426	typedef struct _IMAGE_BASE_RELOCATION
427	{
428	/** The RVA of the page/block the following ase relocations applies to. */
429	uint32_t VirtualAddress;
430	/** The size of this relocation block, including this header. */
431	uint32_t SizeOfBlock;
432	} IMAGE_BASE_RELOCATION;
433	AssertCompileSize(IMAGE_BASE_RELOCATION, 8);
434	typedef IMAGE_BASE_RELOCATION *PIMAGE_BASE_RELOCATION;
435	typedef IMAGE_BASE_RELOCATION const *PCIMAGE_BASE_RELOCATION;
436
437	/** @name IMAGE_REL_BASED_XXX - PE base relocations.
438	* Found in the IMAGE_DIRECTORY_ENTRY_BASERELOC data directory.
439	* @{ */
440	#define IMAGE_REL_BASED_ABSOLUTE UINT16_C(0x0)
441	#define IMAGE_REL_BASED_HIGH UINT16_C(0x1)
442	#define IMAGE_REL_BASED_LOW UINT16_C(0x2)
443	#define IMAGE_REL_BASED_HIGHLOW UINT16_C(0x3)
444	#define IMAGE_REL_BASED_HIGHADJ UINT16_C(0x4)
445	#define IMAGE_REL_BASED_MIPS_JMPADDR UINT16_C(0x5)
446	#define IMAGE_REL_BASED_MIPS_JMPADDR16 UINT16_C(0x9)
447	#define IMAGE_REL_BASED_IA64_IMM64 UINT16_C(0x9)
448	#define IMAGE_REL_BASED_DIR64 UINT16_C(0xa)
449	#define IMAGE_REL_BASED_HIGH3ADJ UINT16_C(0xb)
450	/** @} */
451
452	/**
453	* PE export directory entry.
454	*/
455	typedef struct _IMAGE_EXPORT_DIRECTORY
456	{
457	uint32_t Characteristics;
458	uint32_t TimeDateStamp;
459	uint16_t MajorVersion;
460	uint16_t MinorVersion;
461	uint32_t Name;
462	uint32_t Base;
463	uint32_t NumberOfFunctions;
464	uint32_t NumberOfNames;
465	uint32_t AddressOfFunctions;
466	uint32_t AddressOfNames;
467	uint32_t AddressOfNameOrdinals;
468	} IMAGE_EXPORT_DIRECTORY;
469	AssertCompileSize(IMAGE_EXPORT_DIRECTORY, 40);
470	typedef IMAGE_EXPORT_DIRECTORY *PIMAGE_EXPORT_DIRECTORY;
471	typedef IMAGE_EXPORT_DIRECTORY const *PCIMAGE_EXPORT_DIRECTORY;
472
473
474	/**
475	* PE import directory entry.
476	*/
477	typedef struct _IMAGE_IMPORT_DESCRIPTOR
478	{
479	union
480	{
481	uint32_t Characteristics;
482	uint32_t OriginalFirstThunk;
483	} u;
484	uint32_t TimeDateStamp;
485	uint32_t ForwarderChain;
486	uint32_t Name;
487	uint32_t FirstThunk;
488	} IMAGE_IMPORT_DESCRIPTOR;
489	AssertCompileSize(IMAGE_IMPORT_DESCRIPTOR, 20);
490	typedef IMAGE_IMPORT_DESCRIPTOR *PIMAGE_IMPORT_DESCRIPTOR;
491	typedef IMAGE_IMPORT_DESCRIPTOR const *PCIMAGE_IMPORT_DESCRIPTOR;
492
493	/**
494	* Something we currently don't make use of...
495	*/
496	typedef struct _IMAGE_IMPORT_BY_NAME
497	{
498	uint16_t Hint;
499	uint8_t Name[1];
500	} IMAGE_IMPORT_BY_NAME;
501	AssertCompileSize(IMAGE_IMPORT_BY_NAME, 4);
502	typedef IMAGE_IMPORT_BY_NAME *PIMAGE_IMPORT_BY_NAME;
503	typedef IMAGE_IMPORT_BY_NAME const *PCIMAGE_IMPORT_BY_NAME;
504
505
506	#if 0
507	/* The image_thunk_data32/64 structures are not very helpful except for getting RSI.
508	keep them around till all the code has been converted. */
509	typedef struct _IMAGE_THUNK_DATA64
510	{
511	union
512	{
513	uint64_t ForwarderString;
514	uint64_t Function;
515	uint64_t Ordinal;
516	uint64_t AddressOfData;
517	} u1;
518	} IMAGE_THUNK_DATA64;
519	typedef IMAGE_THUNK_DATA64 *PIMAGE_THUNK_DATA64;
520	typedef IMAGE_THUNK_DATA64 const *PCIMAGE_THUNK_DATA64;
521
522	typedef struct _IMAGE_THUNK_DATA32
523	{
524	union
525	{
526	uint32_t ForwarderString;
527	uint32_t Function;
528	uint32_t Ordinal;
529	uint32_t AddressOfData;
530	} u1;
531	} IMAGE_THUNK_DATA32;
532	typedef IMAGE_THUNK_DATA32 *PIMAGE_THUNK_DATA32;
533	typedef IMAGE_THUNK_DATA32 const *PCIMAGE_THUNK_DATA32;
534	#endif
535
536	/** @name PE import directory macros.
537	* @{ */
538	#define IMAGE_ORDINAL_FLAG32 UINT32_C(0x80000000)
539	#define IMAGE_ORDINAL32(ord) ((ord) & UINT32_C(0xffff))
540	#define IMAGE_SNAP_BY_ORDINAL32(ord) (!!((ord) & IMAGE_ORDINAL_FLAG32))
541
542	#define IMAGE_ORDINAL_FLAG64 UINT64_C(0x8000000000000000)
543	#define IMAGE_ORDINAL64(ord) ((ord) & UINT32_C(0xffff))
544	#define IMAGE_SNAP_BY_ORDINAL64(ord) (!!((ord) & IMAGE_ORDINAL_FLAG64))
545	/** @} */
546
547	/** @name Image load config directories
548	* @{ */
549
550	/** @since Windows 10 (preview 9879) */
551	typedef struct _IMAGE_LOAD_CONFIG_CODE_INTEGRITY
552	{
553	uint16_t Flags;
554	uint16_t Catalog;
555	uint32_t CatalogOffset;
556	uint32_t Reserved;
557	} IMAGE_LOAD_CONFIG_CODE_INTEGRITY;
558	AssertCompileSize(IMAGE_LOAD_CONFIG_CODE_INTEGRITY, 12);
559	typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY *PIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
560	typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY const *PCIMAGE_LOAD_CONFIG_CODE_INTEGRITY;
561
562	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V1
563	{
564	uint32_t Size;
565	uint32_t TimeDateStamp;
566	uint16_t MajorVersion;
567	uint16_t MinorVersion;
568	uint32_t GlobalFlagsClear;
569	uint32_t GlobalFlagsSet;
570	uint32_t CriticalSectionDefaultTimeout;
571	uint32_t DeCommitFreeBlockThreshold;
572	uint32_t DeCommitTotalFreeThreshold;
573	uint32_t LockPrefixTable;
574	uint32_t MaximumAllocationSize;
575	uint32_t VirtualMemoryThreshold;
576	uint32_t ProcessHeapFlags;
577	uint32_t ProcessAffinityMask;
578	uint16_t CSDVersion;
579	uint16_t DependentLoadFlags;
580	uint32_t EditList;
581	uint32_t SecurityCookie;
582	} IMAGE_LOAD_CONFIG_DIRECTORY32_V1;
583	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V1, 0x40);
584	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
585	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V1;
586
587	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V2
588	{
589	uint32_t Size;
590	uint32_t TimeDateStamp;
591	uint16_t MajorVersion;
592	uint16_t MinorVersion;
593	uint32_t GlobalFlagsClear;
594	uint32_t GlobalFlagsSet;
595	uint32_t CriticalSectionDefaultTimeout;
596	uint32_t DeCommitFreeBlockThreshold;
597	uint32_t DeCommitTotalFreeThreshold;
598	uint32_t LockPrefixTable;
599	uint32_t MaximumAllocationSize;
600	uint32_t VirtualMemoryThreshold;
601	uint32_t ProcessHeapFlags;
602	uint32_t ProcessAffinityMask;
603	uint16_t CSDVersion;
604	uint16_t DependentLoadFlags;
605	uint32_t EditList;
606	uint32_t SecurityCookie;
607	uint32_t SEHandlerTable;
608	uint32_t SEHandlerCount;
609	} IMAGE_LOAD_CONFIG_DIRECTORY32_V2;
610	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V2, 0x48);
611	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
612	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V2;
613
614	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V3
615	{
616	uint32_t Size;
617	uint32_t TimeDateStamp;
618	uint16_t MajorVersion;
619	uint16_t MinorVersion;
620	uint32_t GlobalFlagsClear;
621	uint32_t GlobalFlagsSet;
622	uint32_t CriticalSectionDefaultTimeout;
623	uint32_t DeCommitFreeBlockThreshold;
624	uint32_t DeCommitTotalFreeThreshold;
625	uint32_t LockPrefixTable;
626	uint32_t MaximumAllocationSize;
627	uint32_t VirtualMemoryThreshold;
628	uint32_t ProcessHeapFlags;
629	uint32_t ProcessAffinityMask;
630	uint16_t CSDVersion;
631	uint16_t DependentLoadFlags;
632	uint32_t EditList;
633	uint32_t SecurityCookie;
634	uint32_t SEHandlerTable;
635	uint32_t SEHandlerCount;
636	uint32_t GuardCFCCheckFunctionPointer;
637	uint32_t GuardCFDispatchFunctionPointer;
638	uint32_t GuardCFFunctionTable;
639	uint32_t GuardCFFunctionCount;
640	uint32_t GuardFlags;
641	} IMAGE_LOAD_CONFIG_DIRECTORY32_V3;
642	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V3, 0x5c);
643	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
644	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V3;
645
646	/** @since Windows 10 (preview 9879) */
647	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V4
648	{
649	uint32_t Size;
650	uint32_t TimeDateStamp;
651	uint16_t MajorVersion;
652	uint16_t MinorVersion;
653	uint32_t GlobalFlagsClear;
654	uint32_t GlobalFlagsSet;
655	uint32_t CriticalSectionDefaultTimeout;
656	uint32_t DeCommitFreeBlockThreshold;
657	uint32_t DeCommitTotalFreeThreshold;
658	uint32_t LockPrefixTable;
659	uint32_t MaximumAllocationSize;
660	uint32_t VirtualMemoryThreshold;
661	uint32_t ProcessHeapFlags;
662	uint32_t ProcessAffinityMask;
663	uint16_t CSDVersion;
664	uint16_t DependentLoadFlags;
665	uint32_t EditList;
666	uint32_t SecurityCookie;
667	uint32_t SEHandlerTable;
668	uint32_t SEHandlerCount;
669	uint32_t GuardCFCCheckFunctionPointer;
670	uint32_t GuardCFDispatchFunctionPointer;
671	uint32_t GuardCFFunctionTable;
672	uint32_t GuardCFFunctionCount;
673	uint32_t GuardFlags;
674	IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
675	} IMAGE_LOAD_CONFIG_DIRECTORY32_V4;
676	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V4, 0x68);
677	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
678	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V4;
679
680	/** @since Windows 10 build 14286 (or maybe earlier). */
681	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V5
682	{
683	uint32_t Size;
684	uint32_t TimeDateStamp;
685	uint16_t MajorVersion;
686	uint16_t MinorVersion;
687	uint32_t GlobalFlagsClear;
688	uint32_t GlobalFlagsSet;
689	uint32_t CriticalSectionDefaultTimeout;
690	uint32_t DeCommitFreeBlockThreshold;
691	uint32_t DeCommitTotalFreeThreshold;
692	uint32_t LockPrefixTable;
693	uint32_t MaximumAllocationSize;
694	uint32_t VirtualMemoryThreshold;
695	uint32_t ProcessHeapFlags;
696	uint32_t ProcessAffinityMask;
697	uint16_t CSDVersion;
698	uint16_t DependentLoadFlags;
699	uint32_t EditList;
700	uint32_t SecurityCookie;
701	uint32_t SEHandlerTable;
702	uint32_t SEHandlerCount;
703	uint32_t GuardCFCCheckFunctionPointer;
704	uint32_t GuardCFDispatchFunctionPointer;
705	uint32_t GuardCFFunctionTable;
706	uint32_t GuardCFFunctionCount;
707	uint32_t GuardFlags;
708	IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
709	uint32_t GuardAddressTakenIatEntryTable;
710	uint32_t GuardAddressTakenIatEntryCount;
711	uint32_t GuardLongJumpTargetTable;
712	uint32_t GuardLongJumpTargetCount;
713	} IMAGE_LOAD_CONFIG_DIRECTORY32_V5;
714	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V5, 0x78);
715	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V5 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V5;
716	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V5 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V5;
717
718	/** @since Windows 10 build 14383 (or maybe earlier). */
719	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V6
720	{
721	uint32_t Size; /*< 0x00 /
722	uint32_t TimeDateStamp; /*< 0x04 /
723	uint16_t MajorVersion; /*< 0x08 /
724	uint16_t MinorVersion; /*< 0x0a /
725	uint32_t GlobalFlagsClear; /*< 0x0c /
726	uint32_t GlobalFlagsSet; /*< 0x10 /
727	uint32_t CriticalSectionDefaultTimeout; /*< 0x14 /
728	uint32_t DeCommitFreeBlockThreshold; /*< 0x18 /
729	uint32_t DeCommitTotalFreeThreshold; /*< 0x1c /
730	uint32_t LockPrefixTable; /*< 0x20 /
731	uint32_t MaximumAllocationSize; /*< 0x24 /
732	uint32_t VirtualMemoryThreshold; /*< 0x28 /
733	uint32_t ProcessHeapFlags; /*< 0x2c /
734	uint32_t ProcessAffinityMask; /*< 0x30 /
735	uint16_t CSDVersion; /*< 0x34 /
736	uint16_t DependentLoadFlags; /*< 0x36 /
737	uint32_t EditList; /*< 0x38 /
738	uint32_t SecurityCookie; /*< 0x3c /
739	uint32_t SEHandlerTable; /*< 0x40 /
740	uint32_t SEHandlerCount; /*< 0x44 /
741	uint32_t GuardCFCCheckFunctionPointer; /*< 0x48 /
742	uint32_t GuardCFDispatchFunctionPointer; /*< 0x4c /
743	uint32_t GuardCFFunctionTable; /*< 0x50 /
744	uint32_t GuardCFFunctionCount; /*< 0x54 /
745	uint32_t GuardFlags; /*< 0x58 /
746	IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /*< 0x5c /
747	uint32_t GuardAddressTakenIatEntryTable; /*< 0x68 /
748	uint32_t GuardAddressTakenIatEntryCount; /*< 0x6c /
749	uint32_t GuardLongJumpTargetTable; /*< 0x70 /
750	uint32_t GuardLongJumpTargetCount; /*< 0x74 /
751	uint32_t DynamicValueRelocTable; /*< 0x78 /
752	uint32_t HybridMetadataPointer; /*< 0x7c /
753	} IMAGE_LOAD_CONFIG_DIRECTORY32_V6;
754	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V6, 0x80);
755	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V6 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V6;
756	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V6 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V6;
757
758	/** @since Windows 10 build 14901 (or maybe earlier). */
759	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V7
760	{
761	uint32_t Size; /*< 0x00 /
762	uint32_t TimeDateStamp; /*< 0x04 /
763	uint16_t MajorVersion; /*< 0x08 /
764	uint16_t MinorVersion; /*< 0x0a /
765	uint32_t GlobalFlagsClear; /*< 0x0c /
766	uint32_t GlobalFlagsSet; /*< 0x10 /
767	uint32_t CriticalSectionDefaultTimeout; /*< 0x14 /
768	uint32_t DeCommitFreeBlockThreshold; /*< 0x18 /
769	uint32_t DeCommitTotalFreeThreshold; /*< 0x1c /
770	uint32_t LockPrefixTable; /*< 0x20 /
771	uint32_t MaximumAllocationSize; /*< 0x24 /
772	uint32_t VirtualMemoryThreshold; /*< 0x28 /
773	uint32_t ProcessHeapFlags; /*< 0x2c /
774	uint32_t ProcessAffinityMask; /*< 0x30 /
775	uint16_t CSDVersion; /*< 0x34 /
776	uint16_t DependentLoadFlags; /*< 0x36 /
777	uint32_t EditList; /*< 0x38 /
778	uint32_t SecurityCookie; /*< 0x3c /
779	uint32_t SEHandlerTable; /*< 0x40 /
780	uint32_t SEHandlerCount; /*< 0x44 /
781	uint32_t GuardCFCCheckFunctionPointer; /*< 0x48 /
782	uint32_t GuardCFDispatchFunctionPointer; /*< 0x4c /
783	uint32_t GuardCFFunctionTable; /*< 0x50 /
784	uint32_t GuardCFFunctionCount; /*< 0x54 /
785	uint32_t GuardFlags; /*< 0x58 /
786	IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /*< 0x5c /
787	uint32_t GuardAddressTakenIatEntryTable; /*< 0x68 /
788	uint32_t GuardAddressTakenIatEntryCount; /*< 0x6c /
789	uint32_t GuardLongJumpTargetTable; /*< 0x70 /
790	uint32_t GuardLongJumpTargetCount; /*< 0x74 /
791	uint32_t DynamicValueRelocTable; /*< 0x78 /
792	uint32_t CHPEMetadataPointer; /*< 0x7c Not sure when this was renamed from HybridMetadataPointer. /
793	uint32_t GuardRFFailureRoutine; /*< 0x80 /
794	uint32_t GuardRFFailureRoutineFunctionPointer; /*< 0x84 /
795	uint32_t DynamicValueRelocTableOffset; /*< 0x88 /
796	uint16_t DynamicValueRelocTableSection; /*< 0x8c /
797	uint16_t Reserved2; /*< 0x8e /
798	} IMAGE_LOAD_CONFIG_DIRECTORY32_V7;
799	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V7, 0x90);
800	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V7 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V7;
801	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V7 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V7;
802
803	/** @since Windows 10 build 15002 (or maybe earlier). */
804	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V8
805	{
806	uint32_t Size; /*< 0x00 /
807	uint32_t TimeDateStamp; /*< 0x04 /
808	uint16_t MajorVersion; /*< 0x08 /
809	uint16_t MinorVersion; /*< 0x0a /
810	uint32_t GlobalFlagsClear; /*< 0x0c /
811	uint32_t GlobalFlagsSet; /*< 0x10 /
812	uint32_t CriticalSectionDefaultTimeout; /*< 0x14 /
813	uint32_t DeCommitFreeBlockThreshold; /*< 0x18 /
814	uint32_t DeCommitTotalFreeThreshold; /*< 0x1c /
815	uint32_t LockPrefixTable; /*< 0x20 /
816	uint32_t MaximumAllocationSize; /*< 0x24 /
817	uint32_t VirtualMemoryThreshold; /*< 0x28 /
818	uint32_t ProcessHeapFlags; /*< 0x2c /
819	uint32_t ProcessAffinityMask; /*< 0x30 /
820	uint16_t CSDVersion; /*< 0x34 /
821	uint16_t DependentLoadFlags; /*< 0x36 /
822	uint32_t EditList; /*< 0x38 /
823	uint32_t SecurityCookie; /*< 0x3c /
824	uint32_t SEHandlerTable; /*< 0x40 /
825	uint32_t SEHandlerCount; /*< 0x44 /
826	uint32_t GuardCFCCheckFunctionPointer; /*< 0x48 /
827	uint32_t GuardCFDispatchFunctionPointer; /*< 0x4c /
828	uint32_t GuardCFFunctionTable; /*< 0x50 /
829	uint32_t GuardCFFunctionCount; /*< 0x54 /
830	uint32_t GuardFlags; /*< 0x58 /
831	IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /*< 0x5c /
832	uint32_t GuardAddressTakenIatEntryTable; /*< 0x68 /
833	uint32_t GuardAddressTakenIatEntryCount; /*< 0x6c /
834	uint32_t GuardLongJumpTargetTable; /*< 0x70 /
835	uint32_t GuardLongJumpTargetCount; /*< 0x74 /
836	uint32_t DynamicValueRelocTable; /*< 0x78 /
837	uint32_t CHPEMetadataPointer; /*< 0x7c Not sure when this was renamed from HybridMetadataPointer. /
838	uint32_t GuardRFFailureRoutine; /*< 0x80 /
839	uint32_t GuardRFFailureRoutineFunctionPointer; /*< 0x84 /
840	uint32_t DynamicValueRelocTableOffset; /*< 0x88 /
841	uint16_t DynamicValueRelocTableSection; /*< 0x8c /
842	uint16_t Reserved2; /*< 0x8e /
843	uint32_t GuardRFVerifyStackPointerFunctionPointer; /*< 0x90 /
844	uint32_t HotPatchTableOffset; /*< 0x94 /
845	} IMAGE_LOAD_CONFIG_DIRECTORY32_V8;
846	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V8, 0x98);
847	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V8 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V8;
848	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V8 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V8;
849
850	typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V8 IMAGE_LOAD_CONFIG_DIRECTORY32;
851	typedef PIMAGE_LOAD_CONFIG_DIRECTORY32_V8 PIMAGE_LOAD_CONFIG_DIRECTORY32;
852	typedef PCIMAGE_LOAD_CONFIG_DIRECTORY32_V8 PCIMAGE_LOAD_CONFIG_DIRECTORY32;
853
854
855	/* No _IMAGE_LOAD_CONFIG_DIRECTORY64_V1 exists. */
856
857	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V2
858	{
859	uint32_t Size;
860	uint32_t TimeDateStamp;
861	uint16_t MajorVersion;
862	uint16_t MinorVersion;
863	uint32_t GlobalFlagsClear;
864	uint32_t GlobalFlagsSet;
865	uint32_t CriticalSectionDefaultTimeout;
866	uint64_t DeCommitFreeBlockThreshold;
867	uint64_t DeCommitTotalFreeThreshold;
868	uint64_t LockPrefixTable;
869	uint64_t MaximumAllocationSize;
870	uint64_t VirtualMemoryThreshold;
871	uint64_t ProcessAffinityMask;
872	uint32_t ProcessHeapFlags;
873	uint16_t CSDVersion;
874	uint16_t DependentLoadFlags;
875	uint64_t EditList;
876	uint64_t SecurityCookie;
877	uint64_t SEHandlerTable;
878	uint64_t SEHandlerCount;
879	} IMAGE_LOAD_CONFIG_DIRECTORY64_V2;
880	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V2, 0x70);
881	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
882	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V2;
883
884	#pragma pack(4) /* Why not 8 byte alignment, baka microsofties?!? */
885	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V3
886	{
887	uint32_t Size;
888	uint32_t TimeDateStamp;
889	uint16_t MajorVersion;
890	uint16_t MinorVersion;
891	uint32_t GlobalFlagsClear;
892	uint32_t GlobalFlagsSet;
893	uint32_t CriticalSectionDefaultTimeout;
894	uint64_t DeCommitFreeBlockThreshold;
895	uint64_t DeCommitTotalFreeThreshold;
896	uint64_t LockPrefixTable;
897	uint64_t MaximumAllocationSize;
898	uint64_t VirtualMemoryThreshold;
899	uint64_t ProcessAffinityMask;
900	uint32_t ProcessHeapFlags;
901	uint16_t CSDVersion;
902	uint16_t DependentLoadFlags;
903	uint64_t EditList;
904	uint64_t SecurityCookie;
905	uint64_t SEHandlerTable;
906	uint64_t SEHandlerCount;
907	uint64_t GuardCFCCheckFunctionPointer;
908	uint64_t GuardCFDispatchFunctionPointer;
909	uint64_t GuardCFFunctionTable;
910	uint64_t GuardCFFunctionCount;
911	uint32_t GuardFlags;
912	} IMAGE_LOAD_CONFIG_DIRECTORY64_V3;
913	#pragma pack()
914	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V3, 0x94);
915	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
916	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V3;
917
918	/** @since Windows 10 (Preview (9879). */
919	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V4
920	{
921	uint32_t Size; /*< 0x00 /
922	uint32_t TimeDateStamp; /*< 0x04 /
923	uint16_t MajorVersion; /*< 0x08 /
924	uint16_t MinorVersion; /*< 0x0a /
925	uint32_t GlobalFlagsClear; /*< 0x0c /
926	uint32_t GlobalFlagsSet; /*< 0x10 /
927	uint32_t CriticalSectionDefaultTimeout; /*< 0x14 /
928	uint64_t DeCommitFreeBlockThreshold; /*< 0x18 /
929	uint64_t DeCommitTotalFreeThreshold; /*< 0x20 /
930	uint64_t LockPrefixTable; /*< 0x28 /
931	uint64_t MaximumAllocationSize; /*< 0x30 /
932	uint64_t VirtualMemoryThreshold; /*< 0x38 /
933	uint64_t ProcessAffinityMask; /*< 0x40 /
934	uint32_t ProcessHeapFlags; /*< 0x48 /
935	uint16_t CSDVersion; /*< 0x4c /
936	uint16_t DependentLoadFlags; /*< 0x4e /
937	uint64_t EditList; /*< 0x50 /
938	uint64_t SecurityCookie; /*< 0x58 /
939	uint64_t SEHandlerTable; /*< 0x60 /
940	uint64_t SEHandlerCount; /*< 0x68 /
941	uint64_t GuardCFCCheckFunctionPointer; /*< 0x70 /
942	uint64_t GuardCFDispatchFunctionPointer; /*< 0x78 /
943	uint64_t GuardCFFunctionTable; /*< 0x80 /
944	uint64_t GuardCFFunctionCount; /*< 0x88 /
945	uint32_t GuardFlags; /*< 0x90 /
946	IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /*< 0x94 /
947	} IMAGE_LOAD_CONFIG_DIRECTORY64_V4;
948	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V4, 0xa0);
949	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
950	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V4;
951
952	/** @since Windows 10 build 14286 (or maybe earlier). */
953	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V5
954	{
955	uint32_t Size; /*< 0x00 /
956	uint32_t TimeDateStamp; /*< 0x04 /
957	uint16_t MajorVersion; /*< 0x08 /
958	uint16_t MinorVersion; /*< 0x0a /
959	uint32_t GlobalFlagsClear; /*< 0x0c /
960	uint32_t GlobalFlagsSet; /*< 0x10 /
961	uint32_t CriticalSectionDefaultTimeout; /*< 0x14 /
962	uint64_t DeCommitFreeBlockThreshold; /*< 0x18 /
963	uint64_t DeCommitTotalFreeThreshold; /*< 0x20 /
964	uint64_t LockPrefixTable; /*< 0x28 /
965	uint64_t MaximumAllocationSize; /*< 0x30 /
966	uint64_t VirtualMemoryThreshold; /*< 0x38 /
967	uint64_t ProcessAffinityMask; /*< 0x40 /
968	uint32_t ProcessHeapFlags; /*< 0x48 /
969	uint16_t CSDVersion; /*< 0x4c /
970	uint16_t DependentLoadFlags; /*< 0x4e /
971	uint64_t EditList; /*< 0x50 /
972	uint64_t SecurityCookie; /*< 0x58 /
973	uint64_t SEHandlerTable; /*< 0x60 /
974	uint64_t SEHandlerCount; /*< 0x68 /
975	uint64_t GuardCFCCheckFunctionPointer; /*< 0x70 /
976	uint64_t GuardCFDispatchFunctionPointer; /*< 0x78 /
977	uint64_t GuardCFFunctionTable; /*< 0x80 /
978	uint64_t GuardCFFunctionCount; /*< 0x88 /
979	uint32_t GuardFlags; /*< 0x90 /
980	IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /*< 0x94 /
981	uint64_t GuardAddressTakenIatEntryTable; /*< 0xa0 /
982	uint64_t GuardAddressTakenIatEntryCount; /*< 0xa8 /
983	uint64_t GuardLongJumpTargetTable; /*< 0xb0 /
984	uint64_t GuardLongJumpTargetCount; /*< 0xb8 /
985	} IMAGE_LOAD_CONFIG_DIRECTORY64_V5;
986	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V5, 0xc0);
987	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V5 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V5;
988	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V5 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V5;
989
990	/** @since Windows 10 build 14393 (or maybe earlier). */
991	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V6
992	{
993	uint32_t Size; /*< 0x00 /
994	uint32_t TimeDateStamp; /*< 0x04 /
995	uint16_t MajorVersion; /*< 0x08 /
996	uint16_t MinorVersion; /*< 0x0a /
997	uint32_t GlobalFlagsClear; /*< 0x0c /
998	uint32_t GlobalFlagsSet; /*< 0x10 /
999	uint32_t CriticalSectionDefaultTimeout; /*< 0x14 /
1000	uint64_t DeCommitFreeBlockThreshold; /*< 0x18 /
1001	uint64_t DeCommitTotalFreeThreshold; /*< 0x20 /
1002	uint64_t LockPrefixTable; /*< 0x28 /
1003	uint64_t MaximumAllocationSize; /*< 0x30 /
1004	uint64_t VirtualMemoryThreshold; /*< 0x38 /
1005	uint64_t ProcessAffinityMask; /*< 0x40 /
1006	uint32_t ProcessHeapFlags; /*< 0x48 /
1007	uint16_t CSDVersion; /*< 0x4c /
1008	uint16_t DependentLoadFlags; /*< 0x4e /
1009	uint64_t EditList; /*< 0x50 /
1010	uint64_t SecurityCookie; /*< 0x58 /
1011	uint64_t SEHandlerTable; /*< 0x60 /
1012	uint64_t SEHandlerCount; /*< 0x68 /
1013	uint64_t GuardCFCCheckFunctionPointer; /*< 0x70 /
1014	uint64_t GuardCFDispatchFunctionPointer; /*< 0x78 /
1015	uint64_t GuardCFFunctionTable; /*< 0x80 /
1016	uint64_t GuardCFFunctionCount; /*< 0x88 /
1017	uint32_t GuardFlags; /*< 0x90 /
1018	IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /*< 0x94 /
1019	uint64_t GuardAddressTakenIatEntryTable; /*< 0xa0 /
1020	uint64_t GuardAddressTakenIatEntryCount; /*< 0xa8 /
1021	uint64_t GuardLongJumpTargetTable; /*< 0xb0 /
1022	uint64_t GuardLongJumpTargetCount; /*< 0xb8 /
1023	uint64_t DynamicValueRelocTable; /*< 0xc0 /
1024	uint64_t HybridMetadataPointer; /*< 0xc8 /
1025	} IMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1026	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V6, 0xd0);
1027	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V6 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1028	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V6 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V6;
1029
1030	/** @since Windows 10 build 14901 (or maybe earlier). */
1031	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V7
1032	{
1033	uint32_t Size; /*< 0x00 /
1034	uint32_t TimeDateStamp; /*< 0x04 /
1035	uint16_t MajorVersion; /*< 0x08 /
1036	uint16_t MinorVersion; /*< 0x0a /
1037	uint32_t GlobalFlagsClear; /*< 0x0c /
1038	uint32_t GlobalFlagsSet; /*< 0x10 /
1039	uint32_t CriticalSectionDefaultTimeout; /*< 0x14 /
1040	uint64_t DeCommitFreeBlockThreshold; /*< 0x18 /
1041	uint64_t DeCommitTotalFreeThreshold; /*< 0x20 /
1042	uint64_t LockPrefixTable; /*< 0x28 /
1043	uint64_t MaximumAllocationSize; /*< 0x30 /
1044	uint64_t VirtualMemoryThreshold; /*< 0x38 /
1045	uint64_t ProcessAffinityMask; /*< 0x40 /
1046	uint32_t ProcessHeapFlags; /*< 0x48 /
1047	uint16_t CSDVersion; /*< 0x4c /
1048	uint16_t DependentLoadFlags; /*< 0x4e /
1049	uint64_t EditList; /*< 0x50 /
1050	uint64_t SecurityCookie; /*< 0x58 /
1051	uint64_t SEHandlerTable; /*< 0x60 /
1052	uint64_t SEHandlerCount; /*< 0x68 /
1053	uint64_t GuardCFCCheckFunctionPointer; /*< 0x70 /
1054	uint64_t GuardCFDispatchFunctionPointer; /*< 0x78 /
1055	uint64_t GuardCFFunctionTable; /*< 0x80 /
1056	uint64_t GuardCFFunctionCount; /*< 0x88 /
1057	uint32_t GuardFlags; /*< 0x90 /
1058	IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /*< 0x94 /
1059	uint64_t GuardAddressTakenIatEntryTable; /*< 0xa0 /
1060	uint64_t GuardAddressTakenIatEntryCount; /*< 0xa8 /
1061	uint64_t GuardLongJumpTargetTable; /*< 0xb0 /
1062	uint64_t GuardLongJumpTargetCount; /*< 0xb8 /
1063	uint64_t DynamicValueRelocTable; /*< 0xc0 /
1064	uint64_t CHPEMetadataPointer; /*< 0xc8 Not sure when this was renamed from HybridMetadataPointer. /
1065	uint64_t GuardRFFailureRoutine; /*< 0xd0 /
1066	uint64_t GuardRFFailureRoutineFunctionPointer; /*< 0xd8 /
1067	uint32_t DynamicValueRelocTableOffset; /*< 0xe0 /
1068	uint16_t DynamicValueRelocTableSection; /*< 0xe4 /
1069	uint16_t Reserved2; /*< 0xe6 /
1070	} IMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1071	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V7, 0xe8);
1072	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V7 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1073	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V7 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V7;
1074
1075	/** @since Windows 10 build 15002 (or maybe earlier). */
1076	#pragma pack(4) /* Stupid, stupid microsofties! */
1077	typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V8
1078	{
1079	uint32_t Size; /*< 0x00 /
1080	uint32_t TimeDateStamp; /*< 0x04 /
1081	uint16_t MajorVersion; /*< 0x08 /
1082	uint16_t MinorVersion; /*< 0x0a /
1083	uint32_t GlobalFlagsClear; /*< 0x0c /
1084	uint32_t GlobalFlagsSet; /*< 0x10 /
1085	uint32_t CriticalSectionDefaultTimeout; /*< 0x14 /
1086	uint64_t DeCommitFreeBlockThreshold; /*< 0x18 /
1087	uint64_t DeCommitTotalFreeThreshold; /*< 0x20 /
1088	uint64_t LockPrefixTable; /*< 0x28 /
1089	uint64_t MaximumAllocationSize; /*< 0x30 /
1090	uint64_t VirtualMemoryThreshold; /*< 0x38 /
1091	uint64_t ProcessAffinityMask; /*< 0x40 /
1092	uint32_t ProcessHeapFlags; /*< 0x48 /
1093	uint16_t CSDVersion; /*< 0x4c /
1094	uint16_t DependentLoadFlags; /*< 0x4e /
1095	uint64_t EditList; /*< 0x50 /
1096	uint64_t SecurityCookie; /*< 0x58 /
1097	uint64_t SEHandlerTable; /*< 0x60 /
1098	uint64_t SEHandlerCount; /*< 0x68 /
1099	uint64_t GuardCFCCheckFunctionPointer; /*< 0x70 /
1100	uint64_t GuardCFDispatchFunctionPointer; /*< 0x78 /
1101	uint64_t GuardCFFunctionTable; /*< 0x80 /
1102	uint64_t GuardCFFunctionCount; /*< 0x88 /
1103	uint32_t GuardFlags; /*< 0x90 /
1104	IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity; /*< 0x94 /
1105	uint64_t GuardAddressTakenIatEntryTable; /*< 0xa0 /
1106	uint64_t GuardAddressTakenIatEntryCount; /*< 0xa8 /
1107	uint64_t GuardLongJumpTargetTable; /*< 0xb0 /
1108	uint64_t GuardLongJumpTargetCount; /*< 0xb8 /
1109	uint64_t DynamicValueRelocTable; /*< 0xc0 /
1110	uint64_t CHPEMetadataPointer; /*< 0xc8 /
1111	uint64_t GuardRFFailureRoutine; /*< 0xd0 /
1112	uint64_t GuardRFFailureRoutineFunctionPointer; /*< 0xd8 /
1113	uint32_t DynamicValueRelocTableOffset; /*< 0xe0 /
1114	uint16_t DynamicValueRelocTableSection; /*< 0xe4 /
1115	uint16_t Reserved2; /*< 0xe6 /
1116	uint64_t GuardRFVerifyStackPointerFunctionPointer; /*< 0xe8 /
1117	uint32_t HotPatchTableOffset; /*< 0xf0 /
1118	} IMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1119	#pragma pack()
1120	AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V8, 0xf4);
1121	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V8 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1122	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V8 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V8;
1123
1124	typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V8 IMAGE_LOAD_CONFIG_DIRECTORY64;
1125	typedef PIMAGE_LOAD_CONFIG_DIRECTORY64_V8 PIMAGE_LOAD_CONFIG_DIRECTORY64;
1126	typedef PCIMAGE_LOAD_CONFIG_DIRECTORY64_V8 PCIMAGE_LOAD_CONFIG_DIRECTORY64;
1127
1128	/** @} */
1129
1130
1131	/**
1132	* PE certificate directory.
1133	*
1134	* Found in IMAGE_DIRECTORY_ENTRY_SECURITY.
1135	*/
1136	typedef struct WIN_CERTIFICATE
1137	{
1138	uint32_t dwLength;
1139	uint16_t wRevision;
1140	uint16_t wCertificateType;
1141	uint8_t bCertificate[8];
1142	} WIN_CERTIFICATE;
1143	AssertCompileSize(WIN_CERTIFICATE, 16);
1144	typedef WIN_CERTIFICATE *PWIN_CERTIFICATE;
1145	typedef WIN_CERTIFICATE const *PCWIN_CERTIFICATE;
1146
1147	/** @name WIN_CERT_REVISION_XXX - Certificate data directory revision.
1148	* Used WIN_CERTIFICATE::wRevision found in the
1149	* IMAGE_DIRECTORY_ENTRY_SECURITY data directory. */
1150	#define WIN_CERT_REVISION_1_0 UINT16_C(0x0100)
1151	#define WIN_CERT_REVISION_2_0 UINT16_C(0x0200)
1152	/** @} */
1153
1154	/** @name WIN_CERT_TYPE_XXX - Signature type.
1155	* Used by WIN_CERTIFICATE::wCertificateType.
1156	* @{ */
1157	#define WIN_CERT_TYPE_X509 UINT16_C(1)
1158	#define WIN_CERT_TYPE_PKCS_SIGNED_DATA UINT16_C(2)
1159	#define WIN_CERT_TYPE_RESERVED_1 UINT16_C(3)
1160	#define WIN_CERT_TYPE_TS_STACK_SIGNED UINT16_C(4)
1161	#define WIN_CERT_TYPE_EFI_PKCS115 UINT16_C(0x0ef0)
1162	#define WIN_CERT_TYPE_EFI_GUID UINT16_C(0x0ef1)
1163	/** @} */
1164
1165	/** The alignment of the certificate table.
1166	* @remarks Found thru signtool experiments. */
1167	#define WIN_CERTIFICATE_ALIGNMENT UINT32_C(8)
1168
1169
1170	/**
1171	* Debug directory.
1172	*
1173	* Found in IMAGE_DIRECTORY_ENTRY_DEBUG.
1174	*/
1175	typedef struct _IMAGE_DEBUG_DIRECTORY
1176	{
1177	uint32_t Characteristics;
1178	uint32_t TimeDateStamp;
1179	uint16_t MajorVersion;
1180	uint16_t MinorVersion;
1181	uint32_t Type;
1182	uint32_t SizeOfData;
1183	uint32_t AddressOfRawData;
1184	uint32_t PointerToRawData;
1185	} IMAGE_DEBUG_DIRECTORY;
1186	AssertCompileSize(IMAGE_DEBUG_DIRECTORY, 28);
1187	typedef IMAGE_DEBUG_DIRECTORY *PIMAGE_DEBUG_DIRECTORY;
1188	typedef IMAGE_DEBUG_DIRECTORY const *PCIMAGE_DEBUG_DIRECTORY;
1189
1190	/** @name IMAGE_DEBUG_TYPE_XXX - Debug format types.
1191	* Used by IMAGE_DEBUG_DIRECTORY::Type.
1192	* @{ */
1193	#define IMAGE_DEBUG_TYPE_UNKNOWN UINT32_C(0x0)
1194	#define IMAGE_DEBUG_TYPE_COFF UINT32_C(0x1)
1195	#define IMAGE_DEBUG_TYPE_CODEVIEW UINT32_C(0x2)
1196	#define IMAGE_DEBUG_TYPE_FPO UINT32_C(0x3)
1197	#define IMAGE_DEBUG_TYPE_MISC UINT32_C(0x4)
1198	#define IMAGE_DEBUG_TYPE_EXCEPTION UINT32_C(0x5)
1199	#define IMAGE_DEBUG_TYPE_FIXUP UINT32_C(0x6)
1200	#define IMAGE_DEBUG_TYPE_OMAP_TO_SRC UINT32_C(0x7)
1201	#define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC UINT32_C(0x8)
1202	#define IMAGE_DEBUG_TYPE_BORLAND UINT32_C(0x9)
1203	#define IMAGE_DEBUG_TYPE_RESERVED10 UINT32_C(0x10)
1204	/** @} */
1205
1206	/** @name IMAGE_DEBUG_MISC_XXX - Misc debug data type.
1207	* Used by IMAGE_DEBUG_MISC::DataType.
1208	* @{ */
1209	#define IMAGE_DEBUG_MISC_EXENAME UINT32_C(1)
1210	/** @} */
1211
1212
1213	/**
1214	* The format of IMAGE_DEBUG_TYPE_MISC debug info.
1215	*/
1216	typedef struct _IMAGE_DEBUG_MISC
1217	{
1218	uint32_t DataType;
1219	uint32_t Length;
1220	uint8_t Unicode;
1221	uint8_t Reserved[3];
1222	uint8_t Data[1];
1223	} IMAGE_DEBUG_MISC;
1224	AssertCompileSize(IMAGE_DEBUG_MISC, 16);
1225	typedef IMAGE_DEBUG_MISC *PIMAGE_DEBUG_MISC;
1226	typedef IMAGE_DEBUG_MISC const *PCIMAGE_DEBUG_MISC;
1227
1228
1229
1230	/**
1231	* The header of a .DBG file (NT4).
1232	*/
1233	typedef struct _IMAGE_SEPARATE_DEBUG_HEADER
1234	{
1235	uint16_t Signature; /*< 0x00 /
1236	uint16_t Flags; /*< 0x02 /
1237	uint16_t Machine; /*< 0x04 /
1238	uint16_t Characteristics; /*< 0x06 /
1239	uint32_t TimeDateStamp; /*< 0x08 /
1240	uint32_t CheckSum; /*< 0x0c /
1241	uint32_t ImageBase; /*< 0x10 /
1242	uint32_t SizeOfImage; /*< 0x14 /
1243	uint32_t NumberOfSections; /*< 0x18 /
1244	uint32_t ExportedNamesSize; /*< 0x1c /
1245	uint32_t DebugDirectorySize; /*< 0x20 /
1246	uint32_t SectionAlignment; /*< 0x24 /
1247	uint32_t Reserved[2]; /*< 0x28 /
1248	} IMAGE_SEPARATE_DEBUG_HEADER; /* size: 0x30 */
1249	AssertCompileSize(IMAGE_SEPARATE_DEBUG_HEADER, 0x30);
1250	typedef IMAGE_SEPARATE_DEBUG_HEADER *PIMAGE_SEPARATE_DEBUG_HEADER;
1251	typedef IMAGE_SEPARATE_DEBUG_HEADER const *PCIMAGE_SEPARATE_DEBUG_HEADER;
1252
1253	/** The signature of a IMAGE_SEPARATE_DEBUG_HEADER. */
1254	#define IMAGE_SEPARATE_DEBUG_SIGNATURE UINT16_C(0x4944)
1255
1256
1257	/**
1258	* The format of IMAGE_DEBUG_TYPE_COFF debug info.
1259	*/
1260	typedef struct _IMAGE_COFF_SYMBOLS_HEADER
1261	{
1262	uint32_t NumberOfSymbols;
1263	uint32_t LvaToFirstSymbol;
1264	uint32_t NumberOfLinenumbers;
1265	uint32_t LvaToFirstLinenumber;
1266	uint32_t RvaToFirstByteOfCode;
1267	uint32_t RvaToLastByteOfCode;
1268	uint32_t RvaToFirstByteOfData;
1269	uint32_t RvaToLastByteOfData;
1270	} IMAGE_COFF_SYMBOLS_HEADER;
1271	AssertCompileSize(IMAGE_COFF_SYMBOLS_HEADER, 0x20);
1272	typedef IMAGE_COFF_SYMBOLS_HEADER *PIMAGE_COFF_SYMBOLS_HEADER;
1273	typedef IMAGE_COFF_SYMBOLS_HEADER const *PCIMAGE_COFF_SYMBOLS_HEADER;
1274
1275
1276	/**
1277	* Line number format of IMAGE_DEBUG_TYPE_COFF debug info.
1278	*
1279	* @remarks This has misaligned members.
1280	*/
1281	#pragma pack(2)
1282	typedef struct _IMAGE_LINENUMBER
1283	{
1284	union
1285	{
1286	uint32_t VirtualAddress;
1287	uint32_t SymbolTableIndex;
1288	} Type;
1289	uint16_t Linenumber;
1290	} IMAGE_LINENUMBER;
1291	#pragma pack()
1292	AssertCompileSize(IMAGE_LINENUMBER, 6);
1293	typedef IMAGE_LINENUMBER *PIMAGE_LINENUMBER;
1294	typedef IMAGE_LINENUMBER const *PCIMAGE_LINENUMBER;
1295
1296
1297	/** The size of a IMAGE_SYMBOL & IMAGE_AUX_SYMBOL structure. */
1298	#define IMAGE_SIZE_OF_SYMBOL 18
1299	/** The size of a IMAGE_SYMBOL_EX & IMAGE_AUX_SYMBOL_EX structure. */
1300	#define IMAGE_SIZE_OF_SYMBOL_EX 20
1301
1302	/**
1303	* COFF symbol.
1304	*/
1305	#pragma pack(2)
1306	typedef struct _IMAGE_SYMBOL
1307	{
1308	union
1309	{
1310	uint8_t ShortName[8];
1311	struct
1312	{
1313	uint32_t Short;
1314	uint32_t Long;
1315	} Name;
1316	uint32_t LongName[2];
1317	} N;
1318
1319	uint32_t Value;
1320	int16_t SectionNumber;
1321	uint16_t Type;
1322	uint8_t StorageClass;
1323	uint8_t NumberOfAuxSymbols;
1324	} IMAGE_SYMBOL;
1325	#pragma pack()
1326	AssertCompileSize(IMAGE_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
1327	typedef IMAGE_SYMBOL *PIMAGE_SYMBOL;
1328	typedef IMAGE_SYMBOL const *PCIMAGE_SYMBOL;
1329
1330	/**
1331	* COFF auxiliary symbol token defintion (whatever that is).
1332	*/
1333	#pragma pack(2)
1334	typedef struct IMAGE_AUX_SYMBOL_TOKEN_DEF
1335	{
1336	uint8_t bAuxType;
1337	uint8_t bReserved;
1338	uint32_t SymbolTableIndex;
1339	uint8_t rgbReserved[12];
1340	} IMAGE_AUX_SYMBOL_TOKEN_DEF;
1341	#pragma pack()
1342	AssertCompileSize(IMAGE_AUX_SYMBOL_TOKEN_DEF, IMAGE_SIZE_OF_SYMBOL);
1343	typedef IMAGE_AUX_SYMBOL_TOKEN_DEF *PIMAGE_AUX_SYMBOL_TOKEN_DEF;
1344	typedef IMAGE_AUX_SYMBOL_TOKEN_DEF const *PCIMAGE_AUX_SYMBOL_TOKEN_DEF;
1345
1346	/**
1347	* COFF auxiliary symbol.
1348	*/
1349	#pragma pack(1)
1350	typedef union _IMAGE_AUX_SYMBOL
1351	{
1352	struct
1353	{
1354	uint32_t TagIndex;
1355	union
1356	{
1357	struct
1358	{
1359	uint16_t Linenumber;
1360	uint16_t Size;
1361	} LnSz;
1362	} Misc;
1363	union
1364	{
1365	struct
1366	{
1367	uint32_t PointerToLinenumber;
1368	uint32_t PointerToNextFunction;
1369	} Function;
1370	struct
1371	{
1372	uint16_t Dimension[4];
1373	} Array;
1374	} FcnAry;
1375	uint16_t TvIndex;
1376	} Sym;
1377
1378	struct
1379	{
1380	uint8_t Name[IMAGE_SIZE_OF_SYMBOL];
1381	} File;
1382
1383	struct
1384	{
1385	uint32_t Length;
1386	uint16_t NumberOfRelocations;
1387	uint16_t NumberOfLinenumbers;
1388	uint32_t CheckSum;
1389	uint16_t Number;
1390	uint8_t Selection;
1391	uint8_t bReserved;
1392	uint16_t HighNumber;
1393	} Section;
1394
1395	IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
1396	struct
1397	{
1398	uint32_t crc;
1399	uint8_t rgbReserved[14];
1400	} CRC;
1401	} IMAGE_AUX_SYMBOL;
1402	#pragma pack()
1403	AssertCompileSize(IMAGE_AUX_SYMBOL, IMAGE_SIZE_OF_SYMBOL);
1404	typedef IMAGE_AUX_SYMBOL *PIMAGE_AUX_SYMBOL;
1405	typedef IMAGE_AUX_SYMBOL const *PCIMAGE_AUX_SYMBOL;
1406
1407
1408	/**
1409	* Extended COFF symbol.
1410	*/
1411	typedef struct _IMAGE_SYMBOL_EX
1412	{
1413	union
1414	{
1415	uint8_t ShortName[8];
1416	struct
1417	{
1418	uint32_t Short;
1419	uint32_t Long;
1420	} Name;
1421	uint32_t LongName[2];
1422	} N;
1423
1424	uint32_t Value;
1425	int32_t SectionNumber; /* The difference from IMAGE_SYMBOL */
1426	uint16_t Type;
1427	uint8_t StorageClass;
1428	uint8_t NumberOfAuxSymbols;
1429	} IMAGE_SYMBOL_EX;
1430	AssertCompileSize(IMAGE_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
1431	typedef IMAGE_SYMBOL_EX *PIMAGE_SYMBOL_EX;
1432	typedef IMAGE_SYMBOL_EX const *PCIMAGE_SYMBOL_EX;
1433
1434	/**
1435	* Extended COFF auxiliary symbol.
1436	*/
1437	typedef union _IMAGE_AUX_SYMBOL_EX
1438	{
1439	struct
1440	{
1441	uint32_t WeakDefaultSymIndex;
1442	uint32_t WeakSearchType;
1443	uint8_t rgbReserved[12];
1444	} Sym;
1445
1446	struct
1447	{
1448	uint8_t Name[IMAGE_SIZE_OF_SYMBOL_EX];
1449	} File;
1450
1451	struct
1452	{
1453	uint32_t Length;
1454	uint16_t NumberOfRelocations;
1455	uint16_t NumberOfLinenumbers;
1456	uint32_t CheckSum;
1457	uint16_t Number;
1458	uint8_t Selection;
1459	uint8_t bReserved;
1460	uint16_t HighNumber;
1461	uint8_t rgbReserved[2];
1462	} Section;
1463
1464	IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;
1465
1466	struct
1467	{
1468	uint32_t crc;
1469	uint8_t rgbReserved[16];
1470	} CRC;
1471	} IMAGE_AUX_SYMBOL_EX;
1472	AssertCompileSize(IMAGE_AUX_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);
1473	typedef IMAGE_AUX_SYMBOL_EX *PIMAGE_AUX_SYMBOL_EX;
1474	typedef IMAGE_AUX_SYMBOL_EX const *PCIMAGE_AUX_SYMBOL_EX;
1475
1476	/** @name Special COFF section numbers.
1477	* Used by IMAGE_SYMBOL::SectionNumber and IMAGE_SYMBOL_EX::SectionNumber
1478	* @{ */
1479	#define IMAGE_SYM_UNDEFINED INT16_C(0)
1480	#define IMAGE_SYM_ABSOLUTE INT16_C(-1)
1481	#define IMAGE_SYM_DEBUG INT16_C(-2)
1482	/** @} */
1483
1484	/** @name IMAGE_SYM_CLASS_XXX - COFF symbol storage classes.
1485	* @{ */
1486	#define IMAGE_SYM_CLASS_END_OF_FUNCTION UINT8_C(0xff) /* -1 */
1487	#define IMAGE_SYM_CLASS_NULL UINT8_C(0)
1488	#define IMAGE_SYM_CLASS_AUTOMATIC UINT8_C(1)
1489	#define IMAGE_SYM_CLASS_EXTERNAL UINT8_C(2)
1490	#define IMAGE_SYM_CLASS_STATIC UINT8_C(3)
1491	#define IMAGE_SYM_CLASS_REGISTER UINT8_C(4)
1492	#define IMAGE_SYM_CLASS_EXTERNAL_DEF UINT8_C(5)
1493	#define IMAGE_SYM_CLASS_LABEL UINT8_C(6)
1494	#define IMAGE_SYM_CLASS_UNDEFINED_LABEL UINT8_C(7)
1495	#define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT UINT8_C(8)
1496	#define IMAGE_SYM_CLASS_ARGUMENT UINT8_C(9)
1497	#define IMAGE_SYM_CLASS_STRUCT_TAG UINT8_C(10)
1498	#define IMAGE_SYM_CLASS_MEMBER_OF_UNION UINT8_C(11)
1499	#define IMAGE_SYM_CLASS_UNION_TAG UINT8_C(12)
1500	#define IMAGE_SYM_CLASS_TYPE_DEFINITION UINT8_C(13)
1501	#define IMAGE_SYM_CLASS_UNDEFINED_STATIC UINT8_C(14)
1502	#define IMAGE_SYM_CLASS_ENUM_TAG UINT8_C(15)
1503	#define IMAGE_SYM_CLASS_MEMBER_OF_ENUM UINT8_C(16)
1504	#define IMAGE_SYM_CLASS_REGISTER_PARAM UINT8_C(17)
1505	#define IMAGE_SYM_CLASS_BIT_FIELD UINT8_C(18)
1506	#define IMAGE_SYM_CLASS_FAR_EXTERNAL UINT8_C(68)
1507	#define IMAGE_SYM_CLASS_BLOCK UINT8_C(100)
1508	#define IMAGE_SYM_CLASS_FUNCTION UINT8_C(101)
1509	#define IMAGE_SYM_CLASS_END_OF_STRUCT UINT8_C(102)
1510	#define IMAGE_SYM_CLASS_FILE UINT8_C(103)
1511	#define IMAGE_SYM_CLASS_SECTION UINT8_C(104)
1512	#define IMAGE_SYM_CLASS_WEAK_EXTERNAL UINT8_C(105)
1513	#define IMAGE_SYM_CLASS_CLR_TOKEN UINT8_C(107)
1514	/** @} */
1515
1516	/** @name IMAGE_SYM_TYPE_XXX - COFF symbol base types
1517	* @{ */
1518	#define IMAGE_SYM_TYPE_NULL UINT16_C(0x0000)
1519	#define IMAGE_SYM_TYPE_VOID UINT16_C(0x0001)
1520	#define IMAGE_SYM_TYPE_CHAR UINT16_C(0x0002)
1521	#define IMAGE_SYM_TYPE_SHORT UINT16_C(0x0003)
1522	#define IMAGE_SYM_TYPE_INT UINT16_C(0x0004)
1523	#define IMAGE_SYM_TYPE_LONG UINT16_C(0x0005)
1524	#define IMAGE_SYM_TYPE_FLOAT UINT16_C(0x0006)
1525	#define IMAGE_SYM_TYPE_DOUBLE UINT16_C(0x0007)
1526	#define IMAGE_SYM_TYPE_STRUCT UINT16_C(0x0008)
1527	#define IMAGE_SYM_TYPE_UNION UINT16_C(0x0009)
1528	#define IMAGE_SYM_TYPE_ENUM UINT16_C(0x000a)
1529	#define IMAGE_SYM_TYPE_MOE UINT16_C(0x000b)
1530	#define IMAGE_SYM_TYPE_BYTE UINT16_C(0x000c)
1531	#define IMAGE_SYM_TYPE_WORD UINT16_C(0x000d)
1532	#define IMAGE_SYM_TYPE_UINT UINT16_C(0x000e)
1533	#define IMAGE_SYM_TYPE_DWORD UINT16_C(0x000f)
1534	#define IMAGE_SYM_TYPE_PCODE UINT16_C(0x8000)
1535	/** @} */
1536
1537	/** @name IMAGE_SYM_DTYPE_XXX - COFF symbol complex types
1538	* @{ */
1539	#define IMAGE_SYM_DTYPE_NULL UINT16_C(0x0)
1540	#define IMAGE_SYM_DTYPE_POINTER UINT16_C(0x1)
1541	#define IMAGE_SYM_DTYPE_FUNCTION UINT16_C(0x2)
1542	#define IMAGE_SYM_DTYPE_ARRAY UINT16_C(0x3)
1543	/** @} */
1544
1545	/** @name COFF Symbol type masks and shift counts.
1546	* @{ */
1547	#define N_BTMASK UINT16_C(0x000f)
1548	#define N_TMASK UINT16_C(0x0030)
1549	#define N_TMASK1 UINT16_C(0x00c0)
1550	#define N_TMASK2 UINT16_C(0x00f0)
1551	#define N_BTSHFT 4
1552	#define N_TSHIFT 2
1553	/** @} */
1554
1555	/** @name COFF Symbol type macros.
1556	* @{ */
1557	#define BTYPE(a_Type) ( (a_Type) & N_BTMASK )
1558	#define ISPTR(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_POINTER << N_BTSHFT) )
1559	#define ISFCN(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_FUNCTION << N_BTSHFT) )
1560	#define ISARY(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_ARRAY << N_BTSHFT) )
1561	#define ISTAG(a_StorageClass) ( (a_StorageClass) == IMAGE_SYM_CLASS_STRUCT_TAG \
1562	\|\| (a_StorageClass) == IMAGE_SYM_CLASS_UNION_TAG \
1563	\|\| (a_StorageClass) == IMAGE_SYM_CLASS_ENUM_TAG )
1564	/** @} */
1565
1566
1567	/**
1568	* COFF relocation table entry.
1569	*
1570	* @note The size of the structure is not a multiple of the largest member
1571	* (uint32_t), so odd relocation table entry members will have
1572	* misaligned uint32_t members.
1573	*/
1574	#pragma pack(1)
1575	typedef struct _IMAGE_RELOCATION
1576	{
1577	union
1578	{
1579	uint32_t VirtualAddress;
1580	uint32_t RelocCount;
1581	} u;
1582	uint32_t SymbolTableIndex;
1583	uint16_t Type;
1584	} IMAGE_RELOCATION;
1585	#pragma pack()
1586	/** The size of a COFF relocation entry. */
1587	#define IMAGE_SIZEOF_RELOCATION 10
1588	AssertCompileSize(IMAGE_RELOCATION, IMAGE_SIZEOF_RELOCATION);
1589	typedef IMAGE_RELOCATION *PIMAGE_RELOCATION;
1590	typedef IMAGE_RELOCATION const *PCIMAGE_RELOCATION;
1591
1592
1593	/** @name IMAGE_REL_AMD64_XXX - COFF relocations for AMD64 CPUs.
1594	* Used by IMAGE_RELOCATION::Type.
1595	* @{ */
1596	#define IMAGE_REL_AMD64_ABSOLUTE UINT16_C(0x0000)
1597	#define IMAGE_REL_AMD64_ADDR64 UINT16_C(0x0001)
1598	#define IMAGE_REL_AMD64_ADDR32 UINT16_C(0x0002)
1599	#define IMAGE_REL_AMD64_ADDR32NB UINT16_C(0x0003)
1600	#define IMAGE_REL_AMD64_REL32 UINT16_C(0x0004)
1601	#define IMAGE_REL_AMD64_REL32_1 UINT16_C(0x0005)
1602	#define IMAGE_REL_AMD64_REL32_2 UINT16_C(0x0006)
1603	#define IMAGE_REL_AMD64_REL32_3 UINT16_C(0x0007)
1604	#define IMAGE_REL_AMD64_REL32_4 UINT16_C(0x0008)
1605	#define IMAGE_REL_AMD64_REL32_5 UINT16_C(0x0009)
1606	#define IMAGE_REL_AMD64_SECTION UINT16_C(0x000a)
1607	#define IMAGE_REL_AMD64_SECREL UINT16_C(0x000b)
1608	#define IMAGE_REL_AMD64_SECREL7 UINT16_C(0x000c)
1609	#define IMAGE_REL_AMD64_TOKEN UINT16_C(0x000d)
1610	#define IMAGE_REL_AMD64_SREL32 UINT16_C(0x000e)
1611	#define IMAGE_REL_AMD64_PAIR UINT16_C(0x000f)
1612	#define IMAGE_REL_AMD64_SSPAN32 UINT16_C(0x0010)
1613	/** @} */
1614
1615	/** @name ARM IMAGE_REL_ARM_XXX - COFF relocations for ARM CPUs.
1616	* Used by IMAGE_RELOCATION::Type.
1617	* @{ */
1618	#define IMAGE_REL_ARM_ABSOLUTE UINT16_C(0x0000)
1619	#define IMAGE_REL_ARM_ADDR32 UINT16_C(0x0001)
1620	#define IMAGE_REL_ARM_ADDR32NB UINT16_C(0x0002)
1621	#define IMAGE_REL_ARM_BRANCH24 UINT16_C(0x0003)
1622	#define IMAGE_REL_ARM_BRANCH11 UINT16_C(0x0004)
1623	#define IMAGE_REL_ARM_TOKEN UINT16_C(0x0005)
1624	#define IMAGE_REL_ARM_BLX24 UINT16_C(0x0008)
1625	#define IMAGE_REL_ARM_BLX11 UINT16_C(0x0009)
1626	#define IMAGE_REL_ARM_SECTION UINT16_C(0x000e)
1627	#define IMAGE_REL_ARM_SECREL UINT16_C(0x000f)
1628	#define IMAGE_REL_ARM_MOV32A UINT16_C(0x0010)
1629	#define IMAGE_REL_ARM_MOV32T UINT16_C(0x0011)
1630	#define IMAGE_REL_ARM_BRANCH20T UINT16_C(0x0012)
1631	#define IMAGE_REL_ARM_BRANCH24T UINT16_C(0x0014)
1632	#define IMAGE_REL_ARM_BLX23T UINT16_C(0x0015)
1633	/** @} */
1634
1635	/** @name IMAGE_REL_ARM64_XXX - COFF relocations for ARMv8 CPUs (64-bit).
1636	* Used by IMAGE_RELOCATION::Type.
1637	* @{ */
1638	#define IMAGE_REL_ARM64_ABSOLUTE UINT16_C(0x0000)
1639	#define IMAGE_REL_ARM64_ADDR32 UINT16_C(0x0001)
1640	#define IMAGE_REL_ARM64_ADDR32NB UINT16_C(0x0002)
1641	#define IMAGE_REL_ARM64_BRANCH26 UINT16_C(0x0003)
1642	#define IMAGE_REL_ARM64_PAGEBASE_REL21 UINT16_C(0x0004)
1643	#define IMAGE_REL_ARM64_REL21 UINT16_C(0x0005)
1644	#define IMAGE_REL_ARM64_PAGEOFFSET_12A UINT16_C(0x0006)
1645	#define IMAGE_REL_ARM64_PAGEOFFSET_12L UINT16_C(0x0007)
1646	#define IMAGE_REL_ARM64_SECREL UINT16_C(0x0008)
1647	#define IMAGE_REL_ARM64_SECREL_LOW12A UINT16_C(0x0009)
1648	#define IMAGE_REL_ARM64_SECREL_HIGH12A UINT16_C(0x000a)
1649	#define IMAGE_REL_ARM64_SECREL_LOW12L UINT16_C(0x000b)
1650	#define IMAGE_REL_ARM64_TOKEN UINT16_C(0x000c)
1651	#define IMAGE_REL_ARM64_SECTION UINT16_C(0x000d)
1652	#define IMAGE_REL_ARM64_ADDR64 UINT16_C(0x000e)
1653	/** @} */
1654
1655	/** @name IMAGE_REL_SH3_XXX - COFF relocation for Hitachi SuperH CPUs.
1656	* Used by IMAGE_RELOCATION::Type.
1657	* @{ */
1658	#define IMAGE_REL_SH3_ABSOLUTE UINT16_C(0x0000)
1659	#define IMAGE_REL_SH3_DIRECT16 UINT16_C(0x0001)
1660	#define IMAGE_REL_SH3_DIRECT32 UINT16_C(0x0002)
1661	#define IMAGE_REL_SH3_DIRECT8 UINT16_C(0x0003)
1662	#define IMAGE_REL_SH3_DIRECT8_WORD UINT16_C(0x0004)
1663	#define IMAGE_REL_SH3_DIRECT8_LONG UINT16_C(0x0005)
1664	#define IMAGE_REL_SH3_DIRECT4 UINT16_C(0x0006)
1665	#define IMAGE_REL_SH3_DIRECT4_WORD UINT16_C(0x0007)
1666	#define IMAGE_REL_SH3_DIRECT4_LONG UINT16_C(0x0008)
1667	#define IMAGE_REL_SH3_PCREL8_WORD UINT16_C(0x0009)
1668	#define IMAGE_REL_SH3_PCREL8_LONG UINT16_C(0x000a)
1669	#define IMAGE_REL_SH3_PCREL12_WORD UINT16_C(0x000b)
1670	#define IMAGE_REL_SH3_STARTOF_SECTION UINT16_C(0x000c)
1671	#define IMAGE_REL_SH3_SIZEOF_SECTION UINT16_C(0x000d)
1672	#define IMAGE_REL_SH3_SECTION UINT16_C(0x000e)
1673	#define IMAGE_REL_SH3_SECREL UINT16_C(0x000f)
1674	#define IMAGE_REL_SH3_DIRECT32_NB UINT16_C(0x0010)
1675	#define IMAGE_REL_SH3_GPREL4_LONG UINT16_C(0x0011)
1676	#define IMAGE_REL_SH3_TOKEN UINT16_C(0x0012)
1677	#define IMAGE_REL_SHM_PCRELPT UINT16_C(0x0013)
1678	#define IMAGE_REL_SHM_REFLO UINT16_C(0x0014)
1679	#define IMAGE_REL_SHM_REFHALF UINT16_C(0x0015)
1680	#define IMAGE_REL_SHM_RELLO UINT16_C(0x0016)
1681	#define IMAGE_REL_SHM_RELHALF UINT16_C(0x0017)
1682	#define IMAGE_REL_SHM_PAIR UINT16_C(0x0018)
1683	#define IMAGE_REL_SHM_NOMODE UINT16_C(0x8000)
1684	/** @} */
1685
1686	/** @name IMAGE_REL_PPC_XXX - COFF relocations for IBM PowerPC CPUs.
1687	* Used by IMAGE_RELOCATION::Type.
1688	* @{ */
1689	#define IMAGE_REL_PPC_ABSOLUTE UINT16_C(0x0000)
1690	#define IMAGE_REL_PPC_ADDR64 UINT16_C(0x0001)
1691	#define IMAGE_REL_PPC_ADDR32 UINT16_C(0x0002)
1692	#define IMAGE_REL_PPC_ADDR24 UINT16_C(0x0003)
1693	#define IMAGE_REL_PPC_ADDR16 UINT16_C(0x0004)
1694	#define IMAGE_REL_PPC_ADDR14 UINT16_C(0x0005)
1695	#define IMAGE_REL_PPC_REL24 UINT16_C(0x0006)
1696	#define IMAGE_REL_PPC_REL14 UINT16_C(0x0007)
1697	#define IMAGE_REL_PPC_ADDR32NB UINT16_C(0x000a)
1698	#define IMAGE_REL_PPC_SECREL UINT16_C(0x000b)
1699	#define IMAGE_REL_PPC_SECTION UINT16_C(0x000c)
1700	#define IMAGE_REL_PPC_SECREL16 UINT16_C(0x000f)
1701	#define IMAGE_REL_PPC_REFHI UINT16_C(0x0010)
1702	#define IMAGE_REL_PPC_REFLO UINT16_C(0x0011)
1703	#define IMAGE_REL_PPC_PAIR UINT16_C(0x0012)
1704	#define IMAGE_REL_PPC_SECRELLO UINT16_C(0x0013)
1705	#define IMAGE_REL_PPC_GPREL UINT16_C(0x0015)
1706	#define IMAGE_REL_PPC_TOKEN UINT16_C(0x0016)
1707	/** @} */
1708
1709	/** @name IMAGE_REL_I386_XXX - COFF relocations for x86 CPUs.
1710	* Used by IMAGE_RELOCATION::Type.
1711	* @{ */
1712	#define IMAGE_REL_I386_ABSOLUTE UINT16_C(0x0000)
1713	#define IMAGE_REL_I386_DIR16 UINT16_C(0x0001)
1714	#define IMAGE_REL_I386_REL16 UINT16_C(0x0002)
1715	#define IMAGE_REL_I386_DIR32 UINT16_C(0x0006)
1716	#define IMAGE_REL_I386_DIR32NB UINT16_C(0x0007)
1717	#define IMAGE_REL_I386_SEG12 UINT16_C(0x0009)
1718	#define IMAGE_REL_I386_SECTION UINT16_C(0x000A)
1719	#define IMAGE_REL_I386_SECREL UINT16_C(0x000B)
1720	#define IMAGE_REL_I386_TOKEN UINT16_C(0x000C)
1721	#define IMAGE_REL_I386_SECREL7 UINT16_C(0x000D)
1722	#define IMAGE_REL_I386_REL32 UINT16_C(0x0014)
1723	/** @} */
1724
1725	/** @name IMAGE_REL_IA64_XXX - COFF relocations for "Itanic" CPUs.
1726	* @{ */
1727	#define IMAGE_REL_IA64_ABSOLUTE UINT16_C(0x0000)
1728	#define IMAGE_REL_IA64_IMM14 UINT16_C(0x0001)
1729	#define IMAGE_REL_IA64_IMM22 UINT16_C(0x0002)
1730	#define IMAGE_REL_IA64_IMM64 UINT16_C(0x0003)
1731	#define IMAGE_REL_IA64_DIR32 UINT16_C(0x0004)
1732	#define IMAGE_REL_IA64_DIR64 UINT16_C(0x0005)
1733	#define IMAGE_REL_IA64_PCREL21B UINT16_C(0x0006)
1734	#define IMAGE_REL_IA64_PCREL21M UINT16_C(0x0007)
1735	#define IMAGE_REL_IA64_PCREL21F UINT16_C(0x0008)
1736	#define IMAGE_REL_IA64_GPREL22 UINT16_C(0x0009)
1737	#define IMAGE_REL_IA64_LTOFF22 UINT16_C(0x000a)
1738	#define IMAGE_REL_IA64_SECTION UINT16_C(0x000b)
1739	#define IMAGE_REL_IA64_SECREL22 UINT16_C(0x000c)
1740	#define IMAGE_REL_IA64_SECREL64I UINT16_C(0x000d)
1741	#define IMAGE_REL_IA64_SECREL32 UINT16_C(0x000e)
1742	#define IMAGE_REL_IA64_DIR32NB UINT16_C(0x0010)
1743	#define IMAGE_REL_IA64_SREL14 UINT16_C(0x0011)
1744	#define IMAGE_REL_IA64_SREL22 UINT16_C(0x0012)
1745	#define IMAGE_REL_IA64_SREL32 UINT16_C(0x0013)
1746	#define IMAGE_REL_IA64_UREL32 UINT16_C(0x0014)
1747	#define IMAGE_REL_IA64_PCREL60X UINT16_C(0x0015)
1748	#define IMAGE_REL_IA64_PCREL60B UINT16_C(0x0016)
1749	#define IMAGE_REL_IA64_PCREL60F UINT16_C(0x0017)
1750	#define IMAGE_REL_IA64_PCREL60I UINT16_C(0x0018)
1751	#define IMAGE_REL_IA64_PCREL60M UINT16_C(0x0019)
1752	#define IMAGE_REL_IA64_IMMGPREL64 UINT16_C(0x001a)
1753	#define IMAGE_REL_IA64_TOKEN UINT16_C(0x001b)
1754	#define IMAGE_REL_IA64_GPREL32 UINT16_C(0x001c)
1755	#define IMAGE_REL_IA64_ADDEND UINT16_C(0x001f)
1756	/** @} */
1757
1758	/** @name IMAGE_REL_MIPS_XXX - COFF relocations for MIPS CPUs.
1759	* Used by IMAGE_RELOCATION::Type.
1760	* @{ */
1761	#define IMAGE_REL_MIPS_ABSOLUTE UINT16_C(0x0000)
1762	#define IMAGE_REL_MIPS_REFHALF UINT16_C(0x0001)
1763	#define IMAGE_REL_MIPS_REFWORD UINT16_C(0x0002)
1764	#define IMAGE_REL_MIPS_JMPADDR UINT16_C(0x0003)
1765	#define IMAGE_REL_MIPS_REFHI UINT16_C(0x0004)
1766	#define IMAGE_REL_MIPS_REFLO UINT16_C(0x0005)
1767	#define IMAGE_REL_MIPS_GPREL UINT16_C(0x0006)
1768	#define IMAGE_REL_MIPS_LITERAL UINT16_C(0x0007)
1769	#define IMAGE_REL_MIPS_SECTION UINT16_C(0x000a)
1770	#define IMAGE_REL_MIPS_SECREL UINT16_C(0x000b)
1771	#define IMAGE_REL_MIPS_SECRELLO UINT16_C(0x000c)
1772	#define IMAGE_REL_MIPS_SECRELHI UINT16_C(0x000d)
1773	#define IMAGE_REL_MIPS_JMPADDR16 UINT16_C(0x0010)
1774	#define IMAGE_REL_MIPS_REFWORDNB UINT16_C(0x0022)
1775	#define IMAGE_REL_MIPS_PAIR UINT16_C(0x0025)
1776	/** @} */
1777
1778	/** @name IMAGE_REL_M32R_XXX - COFF relocations for Mitsubishi M32R CPUs.
1779	* Used by IMAGE_RELOCATION::Type.
1780	* @{ */
1781	#define IMAGE_REL_M32R_ABSOLUTE UINT16_C(0x0000)
1782	#define IMAGE_REL_M32R_ADDR32 UINT16_C(0x0001)
1783	#define IMAGE_REL_M32R_ADDR32NB UINT16_C(0x0002)
1784	#define IMAGE_REL_M32R_ADDR24 UINT16_C(0x0003)
1785	#define IMAGE_REL_M32R_GPREL16 UINT16_C(0x0004)
1786	#define IMAGE_REL_M32R_PCREL24 UINT16_C(0x0005)
1787	#define IMAGE_REL_M32R_PCREL16 UINT16_C(0x0006)
1788	#define IMAGE_REL_M32R_PCREL8 UINT16_C(0x0007)
1789	#define IMAGE_REL_M32R_REFHALF UINT16_C(0x0008)
1790	#define IMAGE_REL_M32R_REFHI UINT16_C(0x0009)
1791	#define IMAGE_REL_M32R_REFLO UINT16_C(0x000a)
1792	#define IMAGE_REL_M32R_PAIR UINT16_C(0x000b)
1793	#define IMAGE_REL_M32R_SECTION UINT16_C(0x000c)
1794	#define IMAGE_REL_M32R_SECREL UINT16_C(0x000d)
1795	#define IMAGE_REL_M32R_TOKEN UINT16_C(0x000e)
1796	/** @} */
1797
1798
1799	/** @} */
1800
1801	#endif
1802

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/include/iprt/formats/pecoff.h@ 65240

Download in other formats: