Rev 1906 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log | RSS feed
| Rev | Author | Line No. | Line |
|---|---|---|---|
| 1906 | serge | 1 | |
| 2 | typedef unsigned int DWORD; |
||
| 3 | typedef unsigned int LONG; |
||
| 4 | typedef unsigned char BYTE; |
||
| 5 | |||
| 6 | |||
| 7 | #define IMAGE_NT_SIGNATURE 0x00004550 |
||
| 8 | #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b |
||
| 9 | |||
| 10 | |||
| 11 | typedef struct _IMAGE_DOS_HEADER |
||
| 12 | { |
||
| 13 | WORD e_magic; |
||
| 14 | WORD e_cblp; |
||
| 15 | WORD e_cp; |
||
| 16 | WORD e_crlc; |
||
| 17 | WORD e_cparhdr; |
||
| 18 | WORD e_minalloc; |
||
| 19 | WORD e_maxalloc; |
||
| 20 | WORD e_ss; |
||
| 21 | WORD e_sp; |
||
| 22 | WORD e_csum; |
||
| 23 | WORD e_ip; |
||
| 24 | WORD e_cs; |
||
| 25 | WORD e_lfarlc; |
||
| 26 | WORD e_ovno; |
||
| 27 | WORD e_res[4]; |
||
| 28 | WORD e_oemid; |
||
| 29 | WORD e_oeminfo; |
||
| 30 | WORD e_res2[10]; |
||
| 31 | LONG e_lfanew; |
||
| 32 | } IMAGE_DOS_HEADER,*PIMAGE_DOS_HEADER; |
||
| 33 | #pragma pack(pop) |
||
| 34 | |||
| 35 | |||
| 36 | |||
| 37 | typedef struct _IMAGE_FILE_HEADER |
||
| 38 | { |
||
| 39 | WORD Machine; |
||
| 40 | WORD NumberOfSections; |
||
| 41 | DWORD TimeDateStamp; |
||
| 42 | DWORD PointerToSymbolTable; |
||
| 43 | DWORD NumberOfSymbols; |
||
| 44 | WORD SizeOfOptionalHeader; |
||
| 45 | WORD Characteristics; |
||
| 46 | } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; |
||
| 47 | |||
| 48 | |||
| 49 | |||
| 50 | |||
| 51 | and compatible processors */ |
||
| 52 | typedef struct _IMAGE_DATA_DIRECTORY { |
||
| 53 | DWORD VirtualAddress; |
||
| 54 | DWORD Size; |
||
| 55 | } IMAGE_DATA_DIRECTORY,*PIMAGE_DATA_DIRECTORY; |
||
| 56 | |||
| 57 | |||
| 58 | |||
| 59 | |||
| 60 | WORD Magic; |
||
| 61 | BYTE MajorLinkerVersion; |
||
| 62 | BYTE MinorLinkerVersion; |
||
| 63 | DWORD SizeOfCode; |
||
| 64 | DWORD SizeOfInitializedData; |
||
| 65 | DWORD SizeOfUninitializedData; |
||
| 66 | DWORD AddressOfEntryPoint; |
||
| 67 | DWORD BaseOfCode; |
||
| 68 | DWORD BaseOfData; |
||
| 69 | DWORD ImageBase; |
||
| 70 | DWORD SectionAlignment; |
||
| 71 | DWORD FileAlignment; |
||
| 72 | WORD MajorOperatingSystemVersion; |
||
| 73 | WORD MinorOperatingSystemVersion; |
||
| 74 | WORD MajorImageVersion; |
||
| 75 | WORD MinorImageVersion; |
||
| 76 | WORD MajorSubsystemVersion; |
||
| 77 | WORD MinorSubsystemVersion; |
||
| 78 | DWORD Win32VersionValue; |
||
| 79 | DWORD SizeOfImage; |
||
| 80 | DWORD SizeOfHeaders; |
||
| 81 | DWORD CheckSum; |
||
| 82 | WORD Subsystem; |
||
| 83 | WORD DllCharacteristics; |
||
| 84 | DWORD SizeOfStackReserve; |
||
| 85 | DWORD SizeOfStackCommit; |
||
| 86 | DWORD SizeOfHeapReserve; |
||
| 87 | DWORD SizeOfHeapCommit; |
||
| 88 | DWORD LoaderFlags; |
||
| 89 | DWORD NumberOfRvaAndSizes; |
||
| 90 | IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; |
||
| 91 | } IMAGE_OPTIONAL_HEADER,*PIMAGE_OPTIONAL_HEADER; |
||
| 92 | |||
| 93 | |||
| 94 | |||
| 95 | |||
| 96 | |||
| 97 | typedef struct _IMAGE_NT_HEADERS |
||
| 98 | { |
||
| 99 | DWORD Signature; |
||
| 100 | IMAGE_FILE_HEADER FileHeader; |
||
| 101 | IMAGE_OPTIONAL_HEADER OptionalHeader; |
||
| 102 | } IMAGE_NT_HEADERS32,*PIMAGE_NT_HEADERS32; |
||
| 103 | |||
| 104 | |||
| 105 | |||
| 106 | |||
| 107 | { |
||
| 108 | BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; |
||
| 3915 | Serge | 109 | union |
| 1906 | serge | 110 | { |
| 111 | DWORD PhysicalAddress; |
||
| 112 | DWORD VirtualSize; |
||
| 3915 | Serge | 113 | } Misc; |
| 114 | DWORD VirtualAddress; |
||
| 1906 | serge | 115 | DWORD SizeOfRawData; |
| 116 | DWORD PointerToRawData; |
||
| 117 | DWORD PointerToRelocations; |
||
| 118 | DWORD PointerToLinenumbers; |
||
| 119 | WORD NumberOfRelocations; |
||
| 120 | WORD NumberOfLinenumbers; |
||
| 121 | DWORD Characteristics; |
||
| 122 | } IMAGE_SECTION_HEADER,*PIMAGE_SECTION_HEADER; |
||
| 123 | #pragma pack(pop) |
||
| 124 | |||
| 125 | |||
| 126 | #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 |
||
| 127 | #define IMAGE_SCN_MEM_SHARED 0x10000000 |
||
| 128 | #define IMAGE_SCN_MEM_EXECUTE 0x20000000 |
||
| 129 | #define IMAGE_SCN_MEM_WRITE 0x80000000 |
||
| 130 | |||
| 131 | |||
| 132 | typedef struct _IMAGE_BASE_RELOCATION { |
||
| 133 | DWORD VirtualAddress; |
||
| 134 | DWORD SizeOfBlock; |
||
| 135 | } IMAGE_BASE_RELOCATION,*PIMAGE_BASE_RELOCATION; |
||
| 136 | #pragma pack(pop) |
||
| 137 | |||
| 138 | |||
| 139 | { |
||
| 140 | union |
||
| 141 | { |
||
| 142 | DWORD Characteristics; |
||
| 143 | DWORD OriginalFirstThunk; |
||
| 144 | }; |
||
| 145 | DWORD TimeDateStamp; |
||
| 146 | DWORD ForwarderChain; |
||
| 147 | DWORD Name; |
||
| 148 | DWORD FirstThunk; |
||
| 149 | } IMAGE_IMPORT_DESCRIPTOR,*PIMAGE_IMPORT_DESCRIPTOR; |
||
| 150 | |||
| 151 | |||
| 152 | { |
||
| 153 | union |
||
| 154 | { |
||
| 155 | DWORD ForwarderString; |
||
| 156 | DWORD Function; |
||
| 157 | DWORD Ordinal; |
||
| 158 | DWORD AddressOfData; |
||
| 159 | } u1; |
||
| 160 | } IMAGE_THUNK_DATA32,*PIMAGE_THUNK_DATA32; |
||
| 161 | |||
| 162 | |||
| 163 | { |
||
| 164 | WORD Hint; |
||
| 165 | BYTE Name[1]; |
||
| 166 | } IMAGE_IMPORT_BY_NAME,*PIMAGE_IMPORT_BY_NAME; |
||
| 167 | |||
| 168 | |||
| 169 | |||
| 170 | |||
| 171 | DWORD Characteristics; |
||
| 172 | DWORD TimeDateStamp; |
||
| 173 | WORD MajorVersion; |
||
| 174 | WORD MinorVersion; |
||
| 175 | DWORD Name; |
||
| 176 | DWORD Base; |
||
| 177 | DWORD NumberOfFunctions; |
||
| 178 | DWORD NumberOfNames; |
||
| 179 | DWORD AddressOfFunctions; |
||
| 180 | DWORD AddressOfNames; |
||
| 181 | DWORD AddressOfNameOrdinals; |
||
| 182 | } IMAGE_EXPORT_DIRECTORY,*PIMAGE_EXPORT_DIRECTORY; |
||
| 183 | |||
| 184 | |||
| 185 | |||
| 186 |