1//! PE/COFF definitions.
2//!
3//! These definitions are independent of read/write support, although we do implement
4//! some traits useful for those.
5//!
6//! This module is based heavily on "winnt.h" (10.0.17763.0).
7
8#![allow(missing_docs)]
9
10use core::convert::TryInto;
11
12use crate::endian::{I32Bytes, LittleEndian as LE, U16Bytes, U32Bytes, I32, U16, U32, U64};
13use crate::pod::Pod;
14
15/// MZ
16pub const IMAGE_DOS_SIGNATURE: u16 = 0x5A4D;
17/// NE
18pub const IMAGE_OS2_SIGNATURE: u16 = 0x454E;
19/// LE
20pub const IMAGE_OS2_SIGNATURE_LE: u16 = 0x454C;
21/// LE
22pub const IMAGE_VXD_SIGNATURE: u16 = 0x454C;
23/// PE00
24pub const IMAGE_NT_SIGNATURE: u32 = 0x0000_4550;
25
26/// DOS .EXE header
27#[derive(Debug, Clone, Copy)]
28#[repr(C)]
29pub struct ImageDosHeader {
30 /// Magic number
31 pub e_magic: U16<LE>,
32 /// Bytes on last page of file
33 pub e_cblp: U16<LE>,
34 /// Pages in file
35 pub e_cp: U16<LE>,
36 /// Relocations
37 pub e_crlc: U16<LE>,
38 /// Size of header in paragraphs
39 pub e_cparhdr: U16<LE>,
40 /// Minimum extra paragraphs needed
41 pub e_minalloc: U16<LE>,
42 /// Maximum extra paragraphs needed
43 pub e_maxalloc: U16<LE>,
44 /// Initial (relative) SS value
45 pub e_ss: U16<LE>,
46 /// Initial SP value
47 pub e_sp: U16<LE>,
48 /// Checksum
49 pub e_csum: U16<LE>,
50 /// Initial IP value
51 pub e_ip: U16<LE>,
52 /// Initial (relative) CS value
53 pub e_cs: U16<LE>,
54 /// File address of relocation table
55 pub e_lfarlc: U16<LE>,
56 /// Overlay number
57 pub e_ovno: U16<LE>,
58 /// Reserved words
59 pub e_res: [U16<LE>; 4],
60 /// OEM identifier (for e_oeminfo)
61 pub e_oemid: U16<LE>,
62 /// OEM information; e_oemid specific
63 pub e_oeminfo: U16<LE>,
64 /// Reserved words
65 pub e_res2: [U16<LE>; 10],
66 /// File address of new exe header
67 pub e_lfanew: U32<LE>,
68}
69
70/// OS/2 .EXE header
71#[derive(Debug, Clone, Copy)]
72#[repr(C)]
73pub struct ImageOs2Header {
74 /// Magic number
75 pub ne_magic: U16<LE>,
76 /// Version number
77 pub ne_ver: i8,
78 /// Revision number
79 pub ne_rev: i8,
80 /// Offset of Entry Table
81 pub ne_enttab: U16<LE>,
82 /// Number of bytes in Entry Table
83 pub ne_cbenttab: U16<LE>,
84 /// Checksum of whole file
85 pub ne_crc: I32<LE>,
86 /// Flag word
87 pub ne_flags: U16<LE>,
88 /// Automatic data segment number
89 pub ne_autodata: U16<LE>,
90 /// Initial heap allocation
91 pub ne_heap: U16<LE>,
92 /// Initial stack allocation
93 pub ne_stack: U16<LE>,
94 /// Initial CS:IP setting
95 pub ne_csip: I32<LE>,
96 /// Initial SS:SP setting
97 pub ne_sssp: I32<LE>,
98 /// Count of file segments
99 pub ne_cseg: U16<LE>,
100 /// Entries in Module Reference Table
101 pub ne_cmod: U16<LE>,
102 /// Size of non-resident name table
103 pub ne_cbnrestab: U16<LE>,
104 /// Offset of Segment Table
105 pub ne_segtab: U16<LE>,
106 /// Offset of Resource Table
107 pub ne_rsrctab: U16<LE>,
108 /// Offset of resident name table
109 pub ne_restab: U16<LE>,
110 /// Offset of Module Reference Table
111 pub ne_modtab: U16<LE>,
112 /// Offset of Imported Names Table
113 pub ne_imptab: U16<LE>,
114 /// Offset of Non-resident Names Table
115 pub ne_nrestab: I32<LE>,
116 /// Count of movable entries
117 pub ne_cmovent: U16<LE>,
118 /// Segment alignment shift count
119 pub ne_align: U16<LE>,
120 /// Count of resource segments
121 pub ne_cres: U16<LE>,
122 /// Target Operating system
123 pub ne_exetyp: u8,
124 /// Other .EXE flags
125 pub ne_flagsothers: u8,
126 /// offset to return thunks
127 pub ne_pretthunks: U16<LE>,
128 /// offset to segment ref. bytes
129 pub ne_psegrefbytes: U16<LE>,
130 /// Minimum code swap area size
131 pub ne_swaparea: U16<LE>,
132 /// Expected Windows version number
133 pub ne_expver: U16<LE>,
134}
135
136/// Windows VXD header
137#[derive(Debug, Clone, Copy)]
138#[repr(C)]
139pub struct ImageVxdHeader {
140 /// Magic number
141 pub e32_magic: U16<LE>,
142 /// The byte ordering for the VXD
143 pub e32_border: u8,
144 /// The word ordering for the VXD
145 pub e32_worder: u8,
146 /// The EXE format level for now = 0
147 pub e32_level: U32<LE>,
148 /// The CPU type
149 pub e32_cpu: U16<LE>,
150 /// The OS type
151 pub e32_os: U16<LE>,
152 /// Module version
153 pub e32_ver: U32<LE>,
154 /// Module flags
155 pub e32_mflags: U32<LE>,
156 /// Module # pages
157 pub e32_mpages: U32<LE>,
158 /// Object # for instruction pointer
159 pub e32_startobj: U32<LE>,
160 /// Extended instruction pointer
161 pub e32_eip: U32<LE>,
162 /// Object # for stack pointer
163 pub e32_stackobj: U32<LE>,
164 /// Extended stack pointer
165 pub e32_esp: U32<LE>,
166 /// VXD page size
167 pub e32_pagesize: U32<LE>,
168 /// Last page size in VXD
169 pub e32_lastpagesize: U32<LE>,
170 /// Fixup section size
171 pub e32_fixupsize: U32<LE>,
172 /// Fixup section checksum
173 pub e32_fixupsum: U32<LE>,
174 /// Loader section size
175 pub e32_ldrsize: U32<LE>,
176 /// Loader section checksum
177 pub e32_ldrsum: U32<LE>,
178 /// Object table offset
179 pub e32_objtab: U32<LE>,
180 /// Number of objects in module
181 pub e32_objcnt: U32<LE>,
182 /// Object page map offset
183 pub e32_objmap: U32<LE>,
184 /// Object iterated data map offset
185 pub e32_itermap: U32<LE>,
186 /// Offset of Resource Table
187 pub e32_rsrctab: U32<LE>,
188 /// Number of resource entries
189 pub e32_rsrccnt: U32<LE>,
190 /// Offset of resident name table
191 pub e32_restab: U32<LE>,
192 /// Offset of Entry Table
193 pub e32_enttab: U32<LE>,
194 /// Offset of Module Directive Table
195 pub e32_dirtab: U32<LE>,
196 /// Number of module directives
197 pub e32_dircnt: U32<LE>,
198 /// Offset of Fixup Page Table
199 pub e32_fpagetab: U32<LE>,
200 /// Offset of Fixup Record Table
201 pub e32_frectab: U32<LE>,
202 /// Offset of Import Module Name Table
203 pub e32_impmod: U32<LE>,
204 /// Number of entries in Import Module Name Table
205 pub e32_impmodcnt: U32<LE>,
206 /// Offset of Import Procedure Name Table
207 pub e32_impproc: U32<LE>,
208 /// Offset of Per-Page Checksum Table
209 pub e32_pagesum: U32<LE>,
210 /// Offset of Enumerated Data Pages
211 pub e32_datapage: U32<LE>,
212 /// Number of preload pages
213 pub e32_preload: U32<LE>,
214 /// Offset of Non-resident Names Table
215 pub e32_nrestab: U32<LE>,
216 /// Size of Non-resident Name Table
217 pub e32_cbnrestab: U32<LE>,
218 /// Non-resident Name Table Checksum
219 pub e32_nressum: U32<LE>,
220 /// Object # for automatic data object
221 pub e32_autodata: U32<LE>,
222 /// Offset of the debugging information
223 pub e32_debuginfo: U32<LE>,
224 /// The length of the debugging info. in bytes
225 pub e32_debuglen: U32<LE>,
226 /// Number of instance pages in preload section of VXD file
227 pub e32_instpreload: U32<LE>,
228 /// Number of instance pages in demand load section of VXD file
229 pub e32_instdemand: U32<LE>,
230 /// Size of heap - for 16-bit apps
231 pub e32_heapsize: U32<LE>,
232 /// Reserved words
233 pub e32_res3: [u8; 12],
234 pub e32_winresoff: U32<LE>,
235 pub e32_winreslen: U32<LE>,
236 /// Device ID for VxD
237 pub e32_devid: U16<LE>,
238 /// DDK version for VxD
239 pub e32_ddkver: U16<LE>,
240}
241
242/// A PE rich header entry.
243///
244/// Rich headers have no official documentation, but have been heavily
245/// reversed-engineered and documented in the wild, e.g.:
246/// * `http://www.ntcore.com/files/richsign.htm`
247/// * `https://www.researchgate.net/figure/Structure-of-the-Rich-Header_fig1_318145388`
248///
249/// This data is "masked", i.e. XORed with a checksum derived from the file data.
250#[derive(Debug, Clone, Copy)]
251#[repr(C)]
252pub struct MaskedRichHeaderEntry {
253 pub masked_comp_id: U32<LE>,
254 pub masked_count: U32<LE>,
255}
256
257//
258// File header format.
259//
260
261#[derive(Debug, Clone, Copy)]
262#[repr(C)]
263pub struct ImageFileHeader {
264 pub machine: U16<LE>,
265 pub number_of_sections: U16<LE>,
266 pub time_date_stamp: U32<LE>,
267 pub pointer_to_symbol_table: U32<LE>,
268 pub number_of_symbols: U32<LE>,
269 pub size_of_optional_header: U16<LE>,
270 pub characteristics: U16<LE>,
271}
272
273pub const IMAGE_SIZEOF_FILE_HEADER: usize = 20;
274
275/// Relocation info stripped from file.
276pub const IMAGE_FILE_RELOCS_STRIPPED: u16 = 0x0001;
277/// File is executable (i.e. no unresolved external references).
278pub const IMAGE_FILE_EXECUTABLE_IMAGE: u16 = 0x0002;
279/// Line numbers stripped from file.
280pub const IMAGE_FILE_LINE_NUMS_STRIPPED: u16 = 0x0004;
281/// Local symbols stripped from file.
282pub const IMAGE_FILE_LOCAL_SYMS_STRIPPED: u16 = 0x0008;
283/// Aggressively trim working set
284pub const IMAGE_FILE_AGGRESIVE_WS_TRIM: u16 = 0x0010;
285/// App can handle >2gb addresses
286pub const IMAGE_FILE_LARGE_ADDRESS_AWARE: u16 = 0x0020;
287/// Bytes of machine word are reversed.
288pub const IMAGE_FILE_BYTES_REVERSED_LO: u16 = 0x0080;
289/// 32 bit word machine.
290pub const IMAGE_FILE_32BIT_MACHINE: u16 = 0x0100;
291/// Debugging info stripped from file in .DBG file
292pub const IMAGE_FILE_DEBUG_STRIPPED: u16 = 0x0200;
293/// If Image is on removable media, copy and run from the swap file.
294pub const IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP: u16 = 0x0400;
295/// If Image is on Net, copy and run from the swap file.
296pub const IMAGE_FILE_NET_RUN_FROM_SWAP: u16 = 0x0800;
297/// System File.
298pub const IMAGE_FILE_SYSTEM: u16 = 0x1000;
299/// File is a DLL.
300pub const IMAGE_FILE_DLL: u16 = 0x2000;
301/// File should only be run on a UP machine
302pub const IMAGE_FILE_UP_SYSTEM_ONLY: u16 = 0x4000;
303/// Bytes of machine word are reversed.
304pub const IMAGE_FILE_BYTES_REVERSED_HI: u16 = 0x8000;
305
306pub const IMAGE_FILE_MACHINE_UNKNOWN: u16 = 0;
307/// Useful for indicating we want to interact with the host and not a WoW guest.
308pub const IMAGE_FILE_MACHINE_TARGET_HOST: u16 = 0x0001;
309/// Intel 386.
310pub const IMAGE_FILE_MACHINE_I386: u16 = 0x014c;
311/// MIPS little-endian, 0x160 big-endian
312pub const IMAGE_FILE_MACHINE_R3000: u16 = 0x0162;
313/// MIPS little-endian
314pub const IMAGE_FILE_MACHINE_R4000: u16 = 0x0166;
315/// MIPS little-endian
316pub const IMAGE_FILE_MACHINE_R10000: u16 = 0x0168;
317/// MIPS little-endian WCE v2
318pub const IMAGE_FILE_MACHINE_WCEMIPSV2: u16 = 0x0169;
319/// Alpha_AXP
320pub const IMAGE_FILE_MACHINE_ALPHA: u16 = 0x0184;
321/// SH3 little-endian
322pub const IMAGE_FILE_MACHINE_SH3: u16 = 0x01a2;
323pub const IMAGE_FILE_MACHINE_SH3DSP: u16 = 0x01a3;
324/// SH3E little-endian
325pub const IMAGE_FILE_MACHINE_SH3E: u16 = 0x01a4;
326/// SH4 little-endian
327pub const IMAGE_FILE_MACHINE_SH4: u16 = 0x01a6;
328/// SH5
329pub const IMAGE_FILE_MACHINE_SH5: u16 = 0x01a8;
330/// ARM Little-Endian
331pub const IMAGE_FILE_MACHINE_ARM: u16 = 0x01c0;
332/// ARM Thumb/Thumb-2 Little-Endian
333pub const IMAGE_FILE_MACHINE_THUMB: u16 = 0x01c2;
334/// ARM Thumb-2 Little-Endian
335pub const IMAGE_FILE_MACHINE_ARMNT: u16 = 0x01c4;
336pub const IMAGE_FILE_MACHINE_AM33: u16 = 0x01d3;
337/// IBM PowerPC Little-Endian
338pub const IMAGE_FILE_MACHINE_POWERPC: u16 = 0x01F0;
339pub const IMAGE_FILE_MACHINE_POWERPCFP: u16 = 0x01f1;
340/// Intel 64
341pub const IMAGE_FILE_MACHINE_IA64: u16 = 0x0200;
342/// MIPS
343pub const IMAGE_FILE_MACHINE_MIPS16: u16 = 0x0266;
344/// ALPHA64
345pub const IMAGE_FILE_MACHINE_ALPHA64: u16 = 0x0284;
346/// MIPS
347pub const IMAGE_FILE_MACHINE_MIPSFPU: u16 = 0x0366;
348/// MIPS
349pub const IMAGE_FILE_MACHINE_MIPSFPU16: u16 = 0x0466;
350pub const IMAGE_FILE_MACHINE_AXP64: u16 = IMAGE_FILE_MACHINE_ALPHA64;
351/// Infineon
352pub const IMAGE_FILE_MACHINE_TRICORE: u16 = 0x0520;
353pub const IMAGE_FILE_MACHINE_CEF: u16 = 0x0CEF;
354/// EFI Byte Code
355pub const IMAGE_FILE_MACHINE_EBC: u16 = 0x0EBC;
356/// AMD64 (K8)
357pub const IMAGE_FILE_MACHINE_AMD64: u16 = 0x8664;
358/// M32R little-endian
359pub const IMAGE_FILE_MACHINE_M32R: u16 = 0x9041;
360/// ARM64 Little-Endian
361pub const IMAGE_FILE_MACHINE_ARM64: u16 = 0xAA64;
362/// ARM64EC ("Emulation Compatible")
363pub const IMAGE_FILE_MACHINE_ARM64EC: u16 = 0xA641;
364pub const IMAGE_FILE_MACHINE_CEE: u16 = 0xC0EE;
365/// RISCV32
366pub const IMAGE_FILE_MACHINE_RISCV32: u16 = 0x5032;
367/// RISCV64
368pub const IMAGE_FILE_MACHINE_RISCV64: u16 = 0x5064;
369/// RISCV128
370pub const IMAGE_FILE_MACHINE_RISCV128: u16 = 0x5128;
371
372//
373// Directory format.
374//
375
376#[derive(Debug, Clone, Copy)]
377#[repr(C)]
378pub struct ImageDataDirectory {
379 pub virtual_address: U32<LE>,
380 pub size: U32<LE>,
381}
382
383pub const IMAGE_NUMBEROF_DIRECTORY_ENTRIES: usize = 16;
384
385//
386// Optional header format.
387//
388
389#[derive(Debug, Clone, Copy)]
390#[repr(C)]
391pub struct ImageOptionalHeader32 {
392 // Standard fields.
393 pub magic: U16<LE>,
394 pub major_linker_version: u8,
395 pub minor_linker_version: u8,
396 pub size_of_code: U32<LE>,
397 pub size_of_initialized_data: U32<LE>,
398 pub size_of_uninitialized_data: U32<LE>,
399 pub address_of_entry_point: U32<LE>,
400 pub base_of_code: U32<LE>,
401 pub base_of_data: U32<LE>,
402
403 // NT additional fields.
404 pub image_base: U32<LE>,
405 pub section_alignment: U32<LE>,
406 pub file_alignment: U32<LE>,
407 pub major_operating_system_version: U16<LE>,
408 pub minor_operating_system_version: U16<LE>,
409 pub major_image_version: U16<LE>,
410 pub minor_image_version: U16<LE>,
411 pub major_subsystem_version: U16<LE>,
412 pub minor_subsystem_version: U16<LE>,
413 pub win32_version_value: U32<LE>,
414 pub size_of_image: U32<LE>,
415 pub size_of_headers: U32<LE>,
416 pub check_sum: U32<LE>,
417 pub subsystem: U16<LE>,
418 pub dll_characteristics: U16<LE>,
419 pub size_of_stack_reserve: U32<LE>,
420 pub size_of_stack_commit: U32<LE>,
421 pub size_of_heap_reserve: U32<LE>,
422 pub size_of_heap_commit: U32<LE>,
423 pub loader_flags: U32<LE>,
424 pub number_of_rva_and_sizes: U32<LE>,
425 //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
426}
427
428#[derive(Debug, Clone, Copy)]
429#[repr(C)]
430pub struct ImageRomOptionalHeader {
431 pub magic: U16<LE>,
432 pub major_linker_version: u8,
433 pub minor_linker_version: u8,
434 pub size_of_code: U32<LE>,
435 pub size_of_initialized_data: U32<LE>,
436 pub size_of_uninitialized_data: U32<LE>,
437 pub address_of_entry_point: U32<LE>,
438 pub base_of_code: U32<LE>,
439 pub base_of_data: U32<LE>,
440 pub base_of_bss: U32<LE>,
441 pub gpr_mask: U32<LE>,
442 pub cpr_mask: [U32<LE>; 4],
443 pub gp_value: U32<LE>,
444}
445
446#[derive(Debug, Clone, Copy)]
447#[repr(C)]
448pub struct ImageOptionalHeader64 {
449 pub magic: U16<LE>,
450 pub major_linker_version: u8,
451 pub minor_linker_version: u8,
452 pub size_of_code: U32<LE>,
453 pub size_of_initialized_data: U32<LE>,
454 pub size_of_uninitialized_data: U32<LE>,
455 pub address_of_entry_point: U32<LE>,
456 pub base_of_code: U32<LE>,
457 pub image_base: U64<LE>,
458 pub section_alignment: U32<LE>,
459 pub file_alignment: U32<LE>,
460 pub major_operating_system_version: U16<LE>,
461 pub minor_operating_system_version: U16<LE>,
462 pub major_image_version: U16<LE>,
463 pub minor_image_version: U16<LE>,
464 pub major_subsystem_version: U16<LE>,
465 pub minor_subsystem_version: U16<LE>,
466 pub win32_version_value: U32<LE>,
467 pub size_of_image: U32<LE>,
468 pub size_of_headers: U32<LE>,
469 pub check_sum: U32<LE>,
470 pub subsystem: U16<LE>,
471 pub dll_characteristics: U16<LE>,
472 pub size_of_stack_reserve: U64<LE>,
473 pub size_of_stack_commit: U64<LE>,
474 pub size_of_heap_reserve: U64<LE>,
475 pub size_of_heap_commit: U64<LE>,
476 pub loader_flags: U32<LE>,
477 pub number_of_rva_and_sizes: U32<LE>,
478 //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
479}
480
481pub const IMAGE_NT_OPTIONAL_HDR32_MAGIC: u16 = 0x10b;
482pub const IMAGE_NT_OPTIONAL_HDR64_MAGIC: u16 = 0x20b;
483pub const IMAGE_ROM_OPTIONAL_HDR_MAGIC: u16 = 0x107;
484
485#[derive(Debug, Clone, Copy)]
486#[repr(C)]
487pub struct ImageNtHeaders64 {
488 pub signature: U32<LE>,
489 pub file_header: ImageFileHeader,
490 pub optional_header: ImageOptionalHeader64,
491}
492
493#[derive(Debug, Clone, Copy)]
494#[repr(C)]
495pub struct ImageNtHeaders32 {
496 pub signature: U32<LE>,
497 pub file_header: ImageFileHeader,
498 pub optional_header: ImageOptionalHeader32,
499}
500
501#[derive(Debug, Clone, Copy)]
502#[repr(C)]
503pub struct ImageRomHeaders {
504 pub file_header: ImageFileHeader,
505 pub optional_header: ImageRomOptionalHeader,
506}
507
508// Values for `ImageOptionalHeader*::subsystem`.
509
510/// Unknown subsystem.
511pub const IMAGE_SUBSYSTEM_UNKNOWN: u16 = 0;
512/// Image doesn't require a subsystem.
513pub const IMAGE_SUBSYSTEM_NATIVE: u16 = 1;
514/// Image runs in the Windows GUI subsystem.
515pub const IMAGE_SUBSYSTEM_WINDOWS_GUI: u16 = 2;
516/// Image runs in the Windows character subsystem.
517pub const IMAGE_SUBSYSTEM_WINDOWS_CUI: u16 = 3;
518/// image runs in the OS/2 character subsystem.
519pub const IMAGE_SUBSYSTEM_OS2_CUI: u16 = 5;
520/// image runs in the Posix character subsystem.
521pub const IMAGE_SUBSYSTEM_POSIX_CUI: u16 = 7;
522/// image is a native Win9x driver.
523pub const IMAGE_SUBSYSTEM_NATIVE_WINDOWS: u16 = 8;
524/// Image runs in the Windows CE subsystem.
525pub const IMAGE_SUBSYSTEM_WINDOWS_CE_GUI: u16 = 9;
526pub const IMAGE_SUBSYSTEM_EFI_APPLICATION: u16 = 10;
527pub const IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER: u16 = 11;
528pub const IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER: u16 = 12;
529pub const IMAGE_SUBSYSTEM_EFI_ROM: u16 = 13;
530pub const IMAGE_SUBSYSTEM_XBOX: u16 = 14;
531pub const IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION: u16 = 16;
532pub const IMAGE_SUBSYSTEM_XBOX_CODE_CATALOG: u16 = 17;
533
534// Values for `ImageOptionalHeader*::dll_characteristics`.
535
536// IMAGE_LIBRARY_PROCESS_INIT 0x0001 // Reserved.
537// IMAGE_LIBRARY_PROCESS_TERM 0x0002 // Reserved.
538// IMAGE_LIBRARY_THREAD_INIT 0x0004 // Reserved.
539// IMAGE_LIBRARY_THREAD_TERM 0x0008 // Reserved.
540/// Image can handle a high entropy 64-bit virtual address space.
541pub const IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA: u16 = 0x0020;
542/// DLL can move.
543pub const IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE: u16 = 0x0040;
544/// Code Integrity Image
545pub const IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY: u16 = 0x0080;
546/// Image is NX compatible
547pub const IMAGE_DLLCHARACTERISTICS_NX_COMPAT: u16 = 0x0100;
548/// Image understands isolation and doesn't want it
549pub const IMAGE_DLLCHARACTERISTICS_NO_ISOLATION: u16 = 0x0200;
550/// Image does not use SEH. No SE handler may reside in this image
551pub const IMAGE_DLLCHARACTERISTICS_NO_SEH: u16 = 0x0400;
552/// Do not bind this image.
553pub const IMAGE_DLLCHARACTERISTICS_NO_BIND: u16 = 0x0800;
554/// Image should execute in an AppContainer
555pub const IMAGE_DLLCHARACTERISTICS_APPCONTAINER: u16 = 0x1000;
556/// Driver uses WDM model
557pub const IMAGE_DLLCHARACTERISTICS_WDM_DRIVER: u16 = 0x2000;
558/// Image supports Control Flow Guard.
559pub const IMAGE_DLLCHARACTERISTICS_GUARD_CF: u16 = 0x4000;
560pub const IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE: u16 = 0x8000;
561
562// Indices for `ImageOptionalHeader*::data_directory`.
563
564/// Export Directory
565pub const IMAGE_DIRECTORY_ENTRY_EXPORT: usize = 0;
566/// Import Directory
567pub const IMAGE_DIRECTORY_ENTRY_IMPORT: usize = 1;
568/// Resource Directory
569pub const IMAGE_DIRECTORY_ENTRY_RESOURCE: usize = 2;
570/// Exception Directory
571pub const IMAGE_DIRECTORY_ENTRY_EXCEPTION: usize = 3;
572/// Security Directory
573pub const IMAGE_DIRECTORY_ENTRY_SECURITY: usize = 4;
574/// Base Relocation Table
575pub const IMAGE_DIRECTORY_ENTRY_BASERELOC: usize = 5;
576/// Debug Directory
577pub const IMAGE_DIRECTORY_ENTRY_DEBUG: usize = 6;
578// IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // (X86 usage)
579/// Architecture Specific Data
580pub const IMAGE_DIRECTORY_ENTRY_ARCHITECTURE: usize = 7;
581/// RVA of GP
582pub const IMAGE_DIRECTORY_ENTRY_GLOBALPTR: usize = 8;
583/// TLS Directory
584pub const IMAGE_DIRECTORY_ENTRY_TLS: usize = 9;
585/// Load Configuration Directory
586pub const IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG: usize = 10;
587/// Bound Import Directory in headers
588pub const IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT: usize = 11;
589/// Import Address Table
590pub const IMAGE_DIRECTORY_ENTRY_IAT: usize = 12;
591/// Delay Load Import Descriptors
592pub const IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT: usize = 13;
593/// COM Runtime descriptor
594pub const IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR: usize = 14;
595
596#[derive(Debug, Clone, Copy, PartialEq, Eq)]
597#[repr(C)]
598pub struct Guid(pub [u8; 16]);
599
600impl Guid {
601 #[inline]
602 pub fn data1(self) -> U32<LE> {
603 U32::from_bytes(self.0[0..4].try_into().unwrap())
604 }
605
606 #[inline]
607 pub fn data2(self) -> U16<LE> {
608 U16::from_bytes(self.0[4..6].try_into().unwrap())
609 }
610
611 #[inline]
612 pub fn data3(self) -> U16<LE> {
613 U16::from_bytes(self.0[6..8].try_into().unwrap())
614 }
615
616 #[inline]
617 pub fn data4(self) -> [u8; 8] {
618 self.0[8..16].try_into().unwrap()
619 }
620}
621
622pub use Guid as ClsId;
623
624/// Non-COFF Object file header
625#[derive(Debug, Clone, Copy)]
626#[repr(C)]
627pub struct AnonObjectHeader {
628 /// Must be IMAGE_FILE_MACHINE_UNKNOWN
629 pub sig1: U16<LE>,
630 /// Must be 0xffff
631 pub sig2: U16<LE>,
632 /// >= 1 (implies the ClsId field is present)
633 pub version: U16<LE>,
634 pub machine: U16<LE>,
635 pub time_date_stamp: U32<LE>,
636 /// Used to invoke CoCreateInstance
637 pub class_id: ClsId,
638 /// Size of data that follows the header
639 pub size_of_data: U32<LE>,
640}
641
642#[derive(Debug, Clone, Copy)]
643#[repr(C)]
644pub struct AnonObjectHeaderV2 {
645 /// Must be IMAGE_FILE_MACHINE_UNKNOWN
646 pub sig1: U16<LE>,
647 /// Must be 0xffff
648 pub sig2: U16<LE>,
649 /// >= 2 (implies the Flags field is present - otherwise V1)
650 pub version: U16<LE>,
651 pub machine: U16<LE>,
652 pub time_date_stamp: U32<LE>,
653 /// Used to invoke CoCreateInstance
654 pub class_id: ClsId,
655 /// Size of data that follows the header
656 pub size_of_data: U32<LE>,
657 /// 0x1 -> contains metadata
658 pub flags: U32<LE>,
659 /// Size of CLR metadata
660 pub meta_data_size: U32<LE>,
661 /// Offset of CLR metadata
662 pub meta_data_offset: U32<LE>,
663}
664
665/// The required value of `AnonObjectHeaderBigobj::class_id`.
666pub const ANON_OBJECT_HEADER_BIGOBJ_CLASS_ID: ClsId = ClsId([
667 0xC7, 0xA1, 0xBA, 0xD1, 0xEE, 0xBA, 0xA9, 0x4B, 0xAF, 0x20, 0xFA, 0xF6, 0x6A, 0xA4, 0xDC, 0xB8,
668]);
669
670#[derive(Debug, Clone, Copy)]
671#[repr(C)]
672pub struct AnonObjectHeaderBigobj {
673 /* same as ANON_OBJECT_HEADER_V2 */
674 /// Must be IMAGE_FILE_MACHINE_UNKNOWN
675 pub sig1: U16<LE>,
676 /// Must be 0xffff
677 pub sig2: U16<LE>,
678 /// >= 2 (implies the Flags field is present)
679 pub version: U16<LE>,
680 /// Actual machine - IMAGE_FILE_MACHINE_xxx
681 pub machine: U16<LE>,
682 pub time_date_stamp: U32<LE>,
683 /// Must be `ANON_OBJECT_HEADER_BIGOBJ_CLASS_ID`.
684 pub class_id: ClsId,
685 /// Size of data that follows the header
686 pub size_of_data: U32<LE>,
687 /// 0x1 -> contains metadata
688 pub flags: U32<LE>,
689 /// Size of CLR metadata
690 pub meta_data_size: U32<LE>,
691 /// Offset of CLR metadata
692 pub meta_data_offset: U32<LE>,
693
694 /* bigobj specifics */
695 /// extended from WORD
696 pub number_of_sections: U32<LE>,
697 pub pointer_to_symbol_table: U32<LE>,
698 pub number_of_symbols: U32<LE>,
699}
700
701pub const IMAGE_SIZEOF_SHORT_NAME: usize = 8;
702
703//
704// Section header format.
705//
706
707#[derive(Debug, Default, Clone, Copy)]
708#[repr(C)]
709pub struct ImageSectionHeader {
710 pub name: [u8; IMAGE_SIZEOF_SHORT_NAME],
711 pub virtual_size: U32<LE>,
712 pub virtual_address: U32<LE>,
713 pub size_of_raw_data: U32<LE>,
714 pub pointer_to_raw_data: U32<LE>,
715 pub pointer_to_relocations: U32<LE>,
716 pub pointer_to_linenumbers: U32<LE>,
717 pub number_of_relocations: U16<LE>,
718 pub number_of_linenumbers: U16<LE>,
719 pub characteristics: U32<LE>,
720}
721
722pub const IMAGE_SIZEOF_SECTION_HEADER: usize = 40;
723
724// Values for `ImageSectionHeader::characteristics`.
725
726// IMAGE_SCN_TYPE_REG 0x00000000 // Reserved.
727// IMAGE_SCN_TYPE_DSECT 0x00000001 // Reserved.
728// IMAGE_SCN_TYPE_NOLOAD 0x00000002 // Reserved.
729// IMAGE_SCN_TYPE_GROUP 0x00000004 // Reserved.
730/// Reserved.
731pub const IMAGE_SCN_TYPE_NO_PAD: u32 = 0x0000_0008;
732// IMAGE_SCN_TYPE_COPY 0x00000010 // Reserved.
733
734/// Section contains code.
735pub const IMAGE_SCN_CNT_CODE: u32 = 0x0000_0020;
736/// Section contains initialized data.
737pub const IMAGE_SCN_CNT_INITIALIZED_DATA: u32 = 0x0000_0040;
738/// Section contains uninitialized data.
739pub const IMAGE_SCN_CNT_UNINITIALIZED_DATA: u32 = 0x0000_0080;
740
741/// Reserved.
742pub const IMAGE_SCN_LNK_OTHER: u32 = 0x0000_0100;
743/// Section contains comments or some other type of information.
744pub const IMAGE_SCN_LNK_INFO: u32 = 0x0000_0200;
745// IMAGE_SCN_TYPE_OVER 0x00000400 // Reserved.
746/// Section contents will not become part of image.
747pub const IMAGE_SCN_LNK_REMOVE: u32 = 0x0000_0800;
748/// Section contents comdat.
749pub const IMAGE_SCN_LNK_COMDAT: u32 = 0x0000_1000;
750// 0x00002000 // Reserved.
751// IMAGE_SCN_MEM_PROTECTED - Obsolete 0x00004000
752/// Reset speculative exceptions handling bits in the TLB entries for this section.
753pub const IMAGE_SCN_NO_DEFER_SPEC_EXC: u32 = 0x0000_4000;
754/// Section content can be accessed relative to GP
755pub const IMAGE_SCN_GPREL: u32 = 0x0000_8000;
756pub const IMAGE_SCN_MEM_FARDATA: u32 = 0x0000_8000;
757// IMAGE_SCN_MEM_SYSHEAP - Obsolete 0x00010000
758pub const IMAGE_SCN_MEM_PURGEABLE: u32 = 0x0002_0000;
759pub const IMAGE_SCN_MEM_16BIT: u32 = 0x0002_0000;
760pub const IMAGE_SCN_MEM_LOCKED: u32 = 0x0004_0000;
761pub const IMAGE_SCN_MEM_PRELOAD: u32 = 0x0008_0000;
762
763pub const IMAGE_SCN_ALIGN_1BYTES: u32 = 0x0010_0000;
764pub const IMAGE_SCN_ALIGN_2BYTES: u32 = 0x0020_0000;
765pub const IMAGE_SCN_ALIGN_4BYTES: u32 = 0x0030_0000;
766pub const IMAGE_SCN_ALIGN_8BYTES: u32 = 0x0040_0000;
767/// Default alignment if no others are specified.
768pub const IMAGE_SCN_ALIGN_16BYTES: u32 = 0x0050_0000;
769pub const IMAGE_SCN_ALIGN_32BYTES: u32 = 0x0060_0000;
770pub const IMAGE_SCN_ALIGN_64BYTES: u32 = 0x0070_0000;
771pub const IMAGE_SCN_ALIGN_128BYTES: u32 = 0x0080_0000;
772pub const IMAGE_SCN_ALIGN_256BYTES: u32 = 0x0090_0000;
773pub const IMAGE_SCN_ALIGN_512BYTES: u32 = 0x00A0_0000;
774pub const IMAGE_SCN_ALIGN_1024BYTES: u32 = 0x00B0_0000;
775pub const IMAGE_SCN_ALIGN_2048BYTES: u32 = 0x00C0_0000;
776pub const IMAGE_SCN_ALIGN_4096BYTES: u32 = 0x00D0_0000;
777pub const IMAGE_SCN_ALIGN_8192BYTES: u32 = 0x00E0_0000;
778// Unused 0x00F0_0000
779pub const IMAGE_SCN_ALIGN_MASK: u32 = 0x00F0_0000;
780
781/// Section contains extended relocations.
782pub const IMAGE_SCN_LNK_NRELOC_OVFL: u32 = 0x0100_0000;
783/// Section can be discarded.
784pub const IMAGE_SCN_MEM_DISCARDABLE: u32 = 0x0200_0000;
785/// Section is not cacheable.
786pub const IMAGE_SCN_MEM_NOT_CACHED: u32 = 0x0400_0000;
787/// Section is not pageable.
788pub const IMAGE_SCN_MEM_NOT_PAGED: u32 = 0x0800_0000;
789/// Section is shareable.
790pub const IMAGE_SCN_MEM_SHARED: u32 = 0x1000_0000;
791/// Section is executable.
792pub const IMAGE_SCN_MEM_EXECUTE: u32 = 0x2000_0000;
793/// Section is readable.
794pub const IMAGE_SCN_MEM_READ: u32 = 0x4000_0000;
795/// Section is writeable.
796pub const IMAGE_SCN_MEM_WRITE: u32 = 0x8000_0000;
797
798//
799// TLS Characteristic Flags
800//
801/// Tls index is scaled
802pub const IMAGE_SCN_SCALE_INDEX: u32 = 0x0000_0001;
803
804//
805// Symbol format.
806//
807
808// This struct has alignment 1.
809#[derive(Debug, Clone, Copy)]
810#[repr(C)]
811pub struct ImageSymbol {
812 /// If first 4 bytes are 0, then second 4 bytes are offset into string table.
813 pub name: [u8; 8],
814 pub value: U32Bytes<LE>,
815 pub section_number: U16Bytes<LE>,
816 pub typ: U16Bytes<LE>,
817 pub storage_class: u8,
818 pub number_of_aux_symbols: u8,
819}
820
821pub const IMAGE_SIZEOF_SYMBOL: usize = 18;
822
823#[derive(Debug, Clone, Copy)]
824#[repr(C)]
825pub struct ImageSymbolBytes(pub [u8; IMAGE_SIZEOF_SYMBOL]);
826
827// This struct has alignment 1.
828#[derive(Debug, Clone, Copy)]
829#[repr(C)]
830pub struct ImageSymbolEx {
831 /// If first 4 bytes are 0, then second 4 bytes are offset into string table.
832 pub name: [u8; 8],
833 pub value: U32Bytes<LE>,
834 pub section_number: I32Bytes<LE>,
835 pub typ: U16Bytes<LE>,
836 pub storage_class: u8,
837 pub number_of_aux_symbols: u8,
838}
839
840pub const IMAGE_SIZEOF_SYMBOL_EX: usize = 20;
841
842#[derive(Debug, Clone, Copy)]
843#[repr(C)]
844pub struct ImageSymbolExBytes(pub [u8; IMAGE_SIZEOF_SYMBOL_EX]);
845
846// Values for `ImageSymbol::section_number`.
847//
848// Symbols have a section number of the section in which they are
849// defined. Otherwise, section numbers have the following meanings:
850
851/// Symbol is undefined or is common.
852pub const IMAGE_SYM_UNDEFINED: i32 = 0;
853/// Symbol is an absolute value.
854pub const IMAGE_SYM_ABSOLUTE: i32 = -1;
855/// Symbol is a special debug item.
856pub const IMAGE_SYM_DEBUG: i32 = -2;
857/// Values 0xFF00-0xFFFF are special
858pub const IMAGE_SYM_SECTION_MAX: u16 = 0xFEFF;
859pub const IMAGE_SYM_SECTION_MAX_EX: u32 = 0x7fff_ffff;
860
861// Values for `ImageSymbol::typ` (basic component).
862
863/// no type.
864pub const IMAGE_SYM_TYPE_NULL: u16 = 0x0000;
865pub const IMAGE_SYM_TYPE_VOID: u16 = 0x0001;
866/// type character.
867pub const IMAGE_SYM_TYPE_CHAR: u16 = 0x0002;
868/// type short integer.
869pub const IMAGE_SYM_TYPE_SHORT: u16 = 0x0003;
870pub const IMAGE_SYM_TYPE_INT: u16 = 0x0004;
871pub const IMAGE_SYM_TYPE_LONG: u16 = 0x0005;
872pub const IMAGE_SYM_TYPE_FLOAT: u16 = 0x0006;
873pub const IMAGE_SYM_TYPE_DOUBLE: u16 = 0x0007;
874pub const IMAGE_SYM_TYPE_STRUCT: u16 = 0x0008;
875pub const IMAGE_SYM_TYPE_UNION: u16 = 0x0009;
876/// enumeration.
877pub const IMAGE_SYM_TYPE_ENUM: u16 = 0x000A;
878/// member of enumeration.
879pub const IMAGE_SYM_TYPE_MOE: u16 = 0x000B;
880pub const IMAGE_SYM_TYPE_BYTE: u16 = 0x000C;
881pub const IMAGE_SYM_TYPE_WORD: u16 = 0x000D;
882pub const IMAGE_SYM_TYPE_UINT: u16 = 0x000E;
883pub const IMAGE_SYM_TYPE_DWORD: u16 = 0x000F;
884pub const IMAGE_SYM_TYPE_PCODE: u16 = 0x8000;
885
886// Values for `ImageSymbol::typ` (derived component).
887
888/// no derived type.
889pub const IMAGE_SYM_DTYPE_NULL: u16 = 0;
890/// pointer.
891pub const IMAGE_SYM_DTYPE_POINTER: u16 = 1;
892/// function.
893pub const IMAGE_SYM_DTYPE_FUNCTION: u16 = 2;
894/// array.
895pub const IMAGE_SYM_DTYPE_ARRAY: u16 = 3;
896
897// Values for `ImageSymbol::storage_class`.
898pub const IMAGE_SYM_CLASS_END_OF_FUNCTION: u8 = 0xff;
899pub const IMAGE_SYM_CLASS_NULL: u8 = 0x00;
900pub const IMAGE_SYM_CLASS_AUTOMATIC: u8 = 0x01;
901pub const IMAGE_SYM_CLASS_EXTERNAL: u8 = 0x02;
902pub const IMAGE_SYM_CLASS_STATIC: u8 = 0x03;
903pub const IMAGE_SYM_CLASS_REGISTER: u8 = 0x04;
904pub const IMAGE_SYM_CLASS_EXTERNAL_DEF: u8 = 0x05;
905pub const IMAGE_SYM_CLASS_LABEL: u8 = 0x06;
906pub const IMAGE_SYM_CLASS_UNDEFINED_LABEL: u8 = 0x07;
907pub const IMAGE_SYM_CLASS_MEMBER_OF_STRUCT: u8 = 0x08;
908pub const IMAGE_SYM_CLASS_ARGUMENT: u8 = 0x09;
909pub const IMAGE_SYM_CLASS_STRUCT_TAG: u8 = 0x0A;
910pub const IMAGE_SYM_CLASS_MEMBER_OF_UNION: u8 = 0x0B;
911pub const IMAGE_SYM_CLASS_UNION_TAG: u8 = 0x0C;
912pub const IMAGE_SYM_CLASS_TYPE_DEFINITION: u8 = 0x0D;
913pub const IMAGE_SYM_CLASS_UNDEFINED_STATIC: u8 = 0x0E;
914pub const IMAGE_SYM_CLASS_ENUM_TAG: u8 = 0x0F;
915pub const IMAGE_SYM_CLASS_MEMBER_OF_ENUM: u8 = 0x10;
916pub const IMAGE_SYM_CLASS_REGISTER_PARAM: u8 = 0x11;
917pub const IMAGE_SYM_CLASS_BIT_FIELD: u8 = 0x12;
918
919pub const IMAGE_SYM_CLASS_FAR_EXTERNAL: u8 = 0x44;
920
921pub const IMAGE_SYM_CLASS_BLOCK: u8 = 0x64;
922pub const IMAGE_SYM_CLASS_FUNCTION: u8 = 0x65;
923pub const IMAGE_SYM_CLASS_END_OF_STRUCT: u8 = 0x66;
924pub const IMAGE_SYM_CLASS_FILE: u8 = 0x67;
925// new
926pub const IMAGE_SYM_CLASS_SECTION: u8 = 0x68;
927pub const IMAGE_SYM_CLASS_WEAK_EXTERNAL: u8 = 0x69;
928
929pub const IMAGE_SYM_CLASS_CLR_TOKEN: u8 = 0x6B;
930
931// type packing constants
932
933pub const N_BTMASK: u16 = 0x000F;
934pub const N_TMASK: u16 = 0x0030;
935pub const N_TMASK1: u16 = 0x00C0;
936pub const N_TMASK2: u16 = 0x00F0;
937pub const N_BTSHFT: usize = 4;
938pub const N_TSHIFT: usize = 2;
939
940pub const IMAGE_SYM_DTYPE_SHIFT: usize = N_BTSHFT;
941
942//
943// Auxiliary entry format.
944//
945
946// Used for both ImageSymbol and ImageSymbolEx (with padding).
947// This struct has alignment 1.
948#[derive(Debug, Clone, Copy)]
949#[repr(C)]
950pub struct ImageAuxSymbolTokenDef {
951 /// IMAGE_AUX_SYMBOL_TYPE
952 pub aux_type: u8,
953 /// Must be 0
954 pub reserved1: u8,
955 pub symbol_table_index: U32Bytes<LE>,
956 /// Must be 0
957 pub reserved2: [u8; 12],
958}
959
960pub const IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF: u16 = 1;
961
962/// Auxiliary symbol format 1: function definitions.
963// This struct has alignment 1.
964#[derive(Debug, Clone, Copy)]
965#[repr(C)]
966pub struct ImageAuxSymbolFunction {
967 pub tag_index: U32Bytes<LE>,
968 pub total_size: U32Bytes<LE>,
969 pub pointer_to_linenumber: U32Bytes<LE>,
970 pub pointer_to_next_function: U32Bytes<LE>,
971 pub unused: [u8; 2],
972}
973
974/// Auxiliary symbol format 2: .bf and .ef symbols.
975// This struct has alignment 1.
976#[derive(Debug, Clone, Copy)]
977#[repr(C)]
978pub struct ImageAuxSymbolFunctionBeginEnd {
979 pub unused1: [u8; 4],
980 /// declaration line number
981 pub linenumber: U16Bytes<LE>,
982 pub unused2: [u8; 6],
983 pub pointer_to_next_function: U32Bytes<LE>,
984 pub unused3: [u8; 2],
985}
986
987/// Auxiliary symbol format 3: weak externals.
988///
989/// Used for both `ImageSymbol` and `ImageSymbolEx` (both with padding).
990// This struct has alignment 1.
991#[derive(Debug, Clone, Copy)]
992#[repr(C)]
993pub struct ImageAuxSymbolWeak {
994 /// the weak extern default symbol index
995 pub weak_default_sym_index: U32Bytes<LE>,
996 pub weak_search_type: U32Bytes<LE>,
997}
998
999/// Auxiliary symbol format 5: sections.
1000///
1001/// Used for both `ImageSymbol` and `ImageSymbolEx` (with padding).
1002// This struct has alignment 1.
1003#[derive(Debug, Clone, Copy)]
1004#[repr(C)]
1005pub struct ImageAuxSymbolSection {
1006 /// section length
1007 pub length: U32Bytes<LE>,
1008 /// number of relocation entries
1009 pub number_of_relocations: U16Bytes<LE>,
1010 /// number of line numbers
1011 pub number_of_linenumbers: U16Bytes<LE>,
1012 /// checksum for communal
1013 pub check_sum: U32Bytes<LE>,
1014 /// section number to associate with
1015 pub number: U16Bytes<LE>,
1016 /// communal selection type
1017 pub selection: u8,
1018 pub reserved: u8,
1019 /// high bits of the section number
1020 pub high_number: U16Bytes<LE>,
1021}
1022
1023// Used for both ImageSymbol and ImageSymbolEx (both with padding).
1024// This struct has alignment 1.
1025#[derive(Debug, Clone, Copy)]
1026#[repr(C)]
1027pub struct ImageAuxSymbolCrc {
1028 pub crc: U32Bytes<LE>,
1029}
1030
1031//
1032// Communal selection types.
1033//
1034
1035pub const IMAGE_COMDAT_SELECT_NODUPLICATES: u8 = 1;
1036pub const IMAGE_COMDAT_SELECT_ANY: u8 = 2;
1037pub const IMAGE_COMDAT_SELECT_SAME_SIZE: u8 = 3;
1038pub const IMAGE_COMDAT_SELECT_EXACT_MATCH: u8 = 4;
1039pub const IMAGE_COMDAT_SELECT_ASSOCIATIVE: u8 = 5;
1040pub const IMAGE_COMDAT_SELECT_LARGEST: u8 = 6;
1041pub const IMAGE_COMDAT_SELECT_NEWEST: u8 = 7;
1042
1043pub const IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY: u16 = 1;
1044pub const IMAGE_WEAK_EXTERN_SEARCH_LIBRARY: u16 = 2;
1045pub const IMAGE_WEAK_EXTERN_SEARCH_ALIAS: u16 = 3;
1046pub const IMAGE_WEAK_EXTERN_ANTI_DEPENDENCY: u16 = 4;
1047
1048//
1049// Relocation format.
1050//
1051
1052// This struct has alignment 1.
1053#[derive(Debug, Clone, Copy)]
1054#[repr(C)]
1055pub struct ImageRelocation {
1056 /// Also `RelocCount` when IMAGE_SCN_LNK_NRELOC_OVFL is set
1057 pub virtual_address: U32Bytes<LE>,
1058 pub symbol_table_index: U32Bytes<LE>,
1059 pub typ: U16Bytes<LE>,
1060}
1061
1062//
1063// I386 relocation types.
1064//
1065/// Reference is absolute, no relocation is necessary
1066pub const IMAGE_REL_I386_ABSOLUTE: u16 = 0x0000;
1067/// Direct 16-bit reference to the symbols virtual address
1068pub const IMAGE_REL_I386_DIR16: u16 = 0x0001;
1069/// PC-relative 16-bit reference to the symbols virtual address
1070pub const IMAGE_REL_I386_REL16: u16 = 0x0002;
1071/// Direct 32-bit reference to the symbols virtual address
1072pub const IMAGE_REL_I386_DIR32: u16 = 0x0006;
1073/// Direct 32-bit reference to the symbols virtual address, base not included
1074pub const IMAGE_REL_I386_DIR32NB: u16 = 0x0007;
1075/// Direct 16-bit reference to the segment-selector bits of a 32-bit virtual address
1076pub const IMAGE_REL_I386_SEG12: u16 = 0x0009;
1077pub const IMAGE_REL_I386_SECTION: u16 = 0x000A;
1078pub const IMAGE_REL_I386_SECREL: u16 = 0x000B;
1079/// clr token
1080pub const IMAGE_REL_I386_TOKEN: u16 = 0x000C;
1081/// 7 bit offset from base of section containing target
1082pub const IMAGE_REL_I386_SECREL7: u16 = 0x000D;
1083/// PC-relative 32-bit reference to the symbols virtual address
1084pub const IMAGE_REL_I386_REL32: u16 = 0x0014;
1085
1086//
1087// MIPS relocation types.
1088//
1089/// Reference is absolute, no relocation is necessary
1090pub const IMAGE_REL_MIPS_ABSOLUTE: u16 = 0x0000;
1091pub const IMAGE_REL_MIPS_REFHALF: u16 = 0x0001;
1092pub const IMAGE_REL_MIPS_REFWORD: u16 = 0x0002;
1093pub const IMAGE_REL_MIPS_JMPADDR: u16 = 0x0003;
1094pub const IMAGE_REL_MIPS_REFHI: u16 = 0x0004;
1095pub const IMAGE_REL_MIPS_REFLO: u16 = 0x0005;
1096pub const IMAGE_REL_MIPS_GPREL: u16 = 0x0006;
1097pub const IMAGE_REL_MIPS_LITERAL: u16 = 0x0007;
1098pub const IMAGE_REL_MIPS_SECTION: u16 = 0x000A;
1099pub const IMAGE_REL_MIPS_SECREL: u16 = 0x000B;
1100/// Low 16-bit section relative reference (used for >32k TLS)
1101pub const IMAGE_REL_MIPS_SECRELLO: u16 = 0x000C;
1102/// High 16-bit section relative reference (used for >32k TLS)
1103pub const IMAGE_REL_MIPS_SECRELHI: u16 = 0x000D;
1104/// clr token
1105pub const IMAGE_REL_MIPS_TOKEN: u16 = 0x000E;
1106pub const IMAGE_REL_MIPS_JMPADDR16: u16 = 0x0010;
1107pub const IMAGE_REL_MIPS_REFWORDNB: u16 = 0x0022;
1108pub const IMAGE_REL_MIPS_PAIR: u16 = 0x0025;
1109
1110//
1111// Alpha Relocation types.
1112//
1113pub const IMAGE_REL_ALPHA_ABSOLUTE: u16 = 0x0000;
1114pub const IMAGE_REL_ALPHA_REFLONG: u16 = 0x0001;
1115pub const IMAGE_REL_ALPHA_REFQUAD: u16 = 0x0002;
1116pub const IMAGE_REL_ALPHA_GPREL32: u16 = 0x0003;
1117pub const IMAGE_REL_ALPHA_LITERAL: u16 = 0x0004;
1118pub const IMAGE_REL_ALPHA_LITUSE: u16 = 0x0005;
1119pub const IMAGE_REL_ALPHA_GPDISP: u16 = 0x0006;
1120pub const IMAGE_REL_ALPHA_BRADDR: u16 = 0x0007;
1121pub const IMAGE_REL_ALPHA_HINT: u16 = 0x0008;
1122pub const IMAGE_REL_ALPHA_INLINE_REFLONG: u16 = 0x0009;
1123pub const IMAGE_REL_ALPHA_REFHI: u16 = 0x000A;
1124pub const IMAGE_REL_ALPHA_REFLO: u16 = 0x000B;
1125pub const IMAGE_REL_ALPHA_PAIR: u16 = 0x000C;
1126pub const IMAGE_REL_ALPHA_MATCH: u16 = 0x000D;
1127pub const IMAGE_REL_ALPHA_SECTION: u16 = 0x000E;
1128pub const IMAGE_REL_ALPHA_SECREL: u16 = 0x000F;
1129pub const IMAGE_REL_ALPHA_REFLONGNB: u16 = 0x0010;
1130/// Low 16-bit section relative reference
1131pub const IMAGE_REL_ALPHA_SECRELLO: u16 = 0x0011;
1132/// High 16-bit section relative reference
1133pub const IMAGE_REL_ALPHA_SECRELHI: u16 = 0x0012;
1134/// High 16 bits of 48 bit reference
1135pub const IMAGE_REL_ALPHA_REFQ3: u16 = 0x0013;
1136/// Middle 16 bits of 48 bit reference
1137pub const IMAGE_REL_ALPHA_REFQ2: u16 = 0x0014;
1138/// Low 16 bits of 48 bit reference
1139pub const IMAGE_REL_ALPHA_REFQ1: u16 = 0x0015;
1140/// Low 16-bit GP relative reference
1141pub const IMAGE_REL_ALPHA_GPRELLO: u16 = 0x0016;
1142/// High 16-bit GP relative reference
1143pub const IMAGE_REL_ALPHA_GPRELHI: u16 = 0x0017;
1144
1145//
1146// IBM PowerPC relocation types.
1147//
1148/// NOP
1149pub const IMAGE_REL_PPC_ABSOLUTE: u16 = 0x0000;
1150/// 64-bit address
1151pub const IMAGE_REL_PPC_ADDR64: u16 = 0x0001;
1152/// 32-bit address
1153pub const IMAGE_REL_PPC_ADDR32: u16 = 0x0002;
1154/// 26-bit address, shifted left 2 (branch absolute)
1155pub const IMAGE_REL_PPC_ADDR24: u16 = 0x0003;
1156/// 16-bit address
1157pub const IMAGE_REL_PPC_ADDR16: u16 = 0x0004;
1158/// 16-bit address, shifted left 2 (load doubleword)
1159pub const IMAGE_REL_PPC_ADDR14: u16 = 0x0005;
1160/// 26-bit PC-relative offset, shifted left 2 (branch relative)
1161pub const IMAGE_REL_PPC_REL24: u16 = 0x0006;
1162/// 16-bit PC-relative offset, shifted left 2 (br cond relative)
1163pub const IMAGE_REL_PPC_REL14: u16 = 0x0007;
1164/// 16-bit offset from TOC base
1165pub const IMAGE_REL_PPC_TOCREL16: u16 = 0x0008;
1166/// 16-bit offset from TOC base, shifted left 2 (load doubleword)
1167pub const IMAGE_REL_PPC_TOCREL14: u16 = 0x0009;
1168
1169/// 32-bit addr w/o image base
1170pub const IMAGE_REL_PPC_ADDR32NB: u16 = 0x000A;
1171/// va of containing section (as in an image sectionhdr)
1172pub const IMAGE_REL_PPC_SECREL: u16 = 0x000B;
1173/// sectionheader number
1174pub const IMAGE_REL_PPC_SECTION: u16 = 0x000C;
1175/// substitute TOC restore instruction iff symbol is glue code
1176pub const IMAGE_REL_PPC_IFGLUE: u16 = 0x000D;
1177/// symbol is glue code; virtual address is TOC restore instruction
1178pub const IMAGE_REL_PPC_IMGLUE: u16 = 0x000E;
1179/// va of containing section (limited to 16 bits)
1180pub const IMAGE_REL_PPC_SECREL16: u16 = 0x000F;
1181pub const IMAGE_REL_PPC_REFHI: u16 = 0x0010;
1182pub const IMAGE_REL_PPC_REFLO: u16 = 0x0011;
1183pub const IMAGE_REL_PPC_PAIR: u16 = 0x0012;
1184/// Low 16-bit section relative reference (used for >32k TLS)
1185pub const IMAGE_REL_PPC_SECRELLO: u16 = 0x0013;
1186/// High 16-bit section relative reference (used for >32k TLS)
1187pub const IMAGE_REL_PPC_SECRELHI: u16 = 0x0014;
1188pub const IMAGE_REL_PPC_GPREL: u16 = 0x0015;
1189/// clr token
1190pub const IMAGE_REL_PPC_TOKEN: u16 = 0x0016;
1191
1192/// mask to isolate above values in IMAGE_RELOCATION.Type
1193pub const IMAGE_REL_PPC_TYPEMASK: u16 = 0x00FF;
1194
1195// Flag bits in `ImageRelocation::typ`.
1196
1197/// subtract reloc value rather than adding it
1198pub const IMAGE_REL_PPC_NEG: u16 = 0x0100;
1199/// fix branch prediction bit to predict branch taken
1200pub const IMAGE_REL_PPC_BRTAKEN: u16 = 0x0200;
1201/// fix branch prediction bit to predict branch not taken
1202pub const IMAGE_REL_PPC_BRNTAKEN: u16 = 0x0400;
1203/// toc slot defined in file (or, data in toc)
1204pub const IMAGE_REL_PPC_TOCDEFN: u16 = 0x0800;
1205
1206//
1207// Hitachi SH3 relocation types.
1208//
1209/// No relocation
1210pub const IMAGE_REL_SH3_ABSOLUTE: u16 = 0x0000;
1211/// 16 bit direct
1212pub const IMAGE_REL_SH3_DIRECT16: u16 = 0x0001;
1213/// 32 bit direct
1214pub const IMAGE_REL_SH3_DIRECT32: u16 = 0x0002;
1215/// 8 bit direct, -128..255
1216pub const IMAGE_REL_SH3_DIRECT8: u16 = 0x0003;
1217/// 8 bit direct .W (0 ext.)
1218pub const IMAGE_REL_SH3_DIRECT8_WORD: u16 = 0x0004;
1219/// 8 bit direct .L (0 ext.)
1220pub const IMAGE_REL_SH3_DIRECT8_LONG: u16 = 0x0005;
1221/// 4 bit direct (0 ext.)
1222pub const IMAGE_REL_SH3_DIRECT4: u16 = 0x0006;
1223/// 4 bit direct .W (0 ext.)
1224pub const IMAGE_REL_SH3_DIRECT4_WORD: u16 = 0x0007;
1225/// 4 bit direct .L (0 ext.)
1226pub const IMAGE_REL_SH3_DIRECT4_LONG: u16 = 0x0008;
1227/// 8 bit PC relative .W
1228pub const IMAGE_REL_SH3_PCREL8_WORD: u16 = 0x0009;
1229/// 8 bit PC relative .L
1230pub const IMAGE_REL_SH3_PCREL8_LONG: u16 = 0x000A;
1231/// 12 LSB PC relative .W
1232pub const IMAGE_REL_SH3_PCREL12_WORD: u16 = 0x000B;
1233/// Start of EXE section
1234pub const IMAGE_REL_SH3_STARTOF_SECTION: u16 = 0x000C;
1235/// Size of EXE section
1236pub const IMAGE_REL_SH3_SIZEOF_SECTION: u16 = 0x000D;
1237/// Section table index
1238pub const IMAGE_REL_SH3_SECTION: u16 = 0x000E;
1239/// Offset within section
1240pub const IMAGE_REL_SH3_SECREL: u16 = 0x000F;
1241/// 32 bit direct not based
1242pub const IMAGE_REL_SH3_DIRECT32_NB: u16 = 0x0010;
1243/// GP-relative addressing
1244pub const IMAGE_REL_SH3_GPREL4_LONG: u16 = 0x0011;
1245/// clr token
1246pub const IMAGE_REL_SH3_TOKEN: u16 = 0x0012;
1247/// Offset from current instruction in longwords
1248/// if not NOMODE, insert the inverse of the low bit at bit 32 to select PTA/PTB
1249pub const IMAGE_REL_SHM_PCRELPT: u16 = 0x0013;
1250/// Low bits of 32-bit address
1251pub const IMAGE_REL_SHM_REFLO: u16 = 0x0014;
1252/// High bits of 32-bit address
1253pub const IMAGE_REL_SHM_REFHALF: u16 = 0x0015;
1254/// Low bits of relative reference
1255pub const IMAGE_REL_SHM_RELLO: u16 = 0x0016;
1256/// High bits of relative reference
1257pub const IMAGE_REL_SHM_RELHALF: u16 = 0x0017;
1258/// offset operand for relocation
1259pub const IMAGE_REL_SHM_PAIR: u16 = 0x0018;
1260
1261/// relocation ignores section mode
1262pub const IMAGE_REL_SH_NOMODE: u16 = 0x8000;
1263
1264/// No relocation required
1265pub const IMAGE_REL_ARM_ABSOLUTE: u16 = 0x0000;
1266/// 32 bit address
1267pub const IMAGE_REL_ARM_ADDR32: u16 = 0x0001;
1268/// 32 bit address w/o image base
1269pub const IMAGE_REL_ARM_ADDR32NB: u16 = 0x0002;
1270/// 24 bit offset << 2 & sign ext.
1271pub const IMAGE_REL_ARM_BRANCH24: u16 = 0x0003;
1272/// Thumb: 2 11 bit offsets
1273pub const IMAGE_REL_ARM_BRANCH11: u16 = 0x0004;
1274/// clr token
1275pub const IMAGE_REL_ARM_TOKEN: u16 = 0x0005;
1276/// GP-relative addressing (ARM)
1277pub const IMAGE_REL_ARM_GPREL12: u16 = 0x0006;
1278/// GP-relative addressing (Thumb)
1279pub const IMAGE_REL_ARM_GPREL7: u16 = 0x0007;
1280pub const IMAGE_REL_ARM_BLX24: u16 = 0x0008;
1281pub const IMAGE_REL_ARM_BLX11: u16 = 0x0009;
1282/// 32-bit relative address from byte following reloc
1283pub const IMAGE_REL_ARM_REL32: u16 = 0x000A;
1284/// Section table index
1285pub const IMAGE_REL_ARM_SECTION: u16 = 0x000E;
1286/// Offset within section
1287pub const IMAGE_REL_ARM_SECREL: u16 = 0x000F;
1288/// ARM: MOVW/MOVT
1289pub const IMAGE_REL_ARM_MOV32A: u16 = 0x0010;
1290/// ARM: MOVW/MOVT (deprecated)
1291pub const IMAGE_REL_ARM_MOV32: u16 = 0x0010;
1292/// Thumb: MOVW/MOVT
1293pub const IMAGE_REL_ARM_MOV32T: u16 = 0x0011;
1294/// Thumb: MOVW/MOVT (deprecated)
1295pub const IMAGE_REL_THUMB_MOV32: u16 = 0x0011;
1296/// Thumb: 32-bit conditional B
1297pub const IMAGE_REL_ARM_BRANCH20T: u16 = 0x0012;
1298/// Thumb: 32-bit conditional B (deprecated)
1299pub const IMAGE_REL_THUMB_BRANCH20: u16 = 0x0012;
1300/// Thumb: 32-bit B or BL
1301pub const IMAGE_REL_ARM_BRANCH24T: u16 = 0x0014;
1302/// Thumb: 32-bit B or BL (deprecated)
1303pub const IMAGE_REL_THUMB_BRANCH24: u16 = 0x0014;
1304/// Thumb: BLX immediate
1305pub const IMAGE_REL_ARM_BLX23T: u16 = 0x0015;
1306/// Thumb: BLX immediate (deprecated)
1307pub const IMAGE_REL_THUMB_BLX23: u16 = 0x0015;
1308
1309pub const IMAGE_REL_AM_ABSOLUTE: u16 = 0x0000;
1310pub const IMAGE_REL_AM_ADDR32: u16 = 0x0001;
1311pub const IMAGE_REL_AM_ADDR32NB: u16 = 0x0002;
1312pub const IMAGE_REL_AM_CALL32: u16 = 0x0003;
1313pub const IMAGE_REL_AM_FUNCINFO: u16 = 0x0004;
1314pub const IMAGE_REL_AM_REL32_1: u16 = 0x0005;
1315pub const IMAGE_REL_AM_REL32_2: u16 = 0x0006;
1316pub const IMAGE_REL_AM_SECREL: u16 = 0x0007;
1317pub const IMAGE_REL_AM_SECTION: u16 = 0x0008;
1318pub const IMAGE_REL_AM_TOKEN: u16 = 0x0009;
1319
1320//
1321// ARM64 relocations types.
1322//
1323
1324/// No relocation required
1325pub const IMAGE_REL_ARM64_ABSOLUTE: u16 = 0x0000;
1326/// 32 bit address. Review! do we need it?
1327pub const IMAGE_REL_ARM64_ADDR32: u16 = 0x0001;
1328/// 32 bit address w/o image base (RVA: for Data/PData/XData)
1329pub const IMAGE_REL_ARM64_ADDR32NB: u16 = 0x0002;
1330/// 26 bit offset << 2 & sign ext. for B & BL
1331pub const IMAGE_REL_ARM64_BRANCH26: u16 = 0x0003;
1332/// ADRP
1333pub const IMAGE_REL_ARM64_PAGEBASE_REL21: u16 = 0x0004;
1334/// ADR
1335pub const IMAGE_REL_ARM64_REL21: u16 = 0x0005;
1336/// ADD/ADDS (immediate) with zero shift, for page offset
1337pub const IMAGE_REL_ARM64_PAGEOFFSET_12A: u16 = 0x0006;
1338/// LDR (indexed, unsigned immediate), for page offset
1339pub const IMAGE_REL_ARM64_PAGEOFFSET_12L: u16 = 0x0007;
1340/// Offset within section
1341pub const IMAGE_REL_ARM64_SECREL: u16 = 0x0008;
1342/// ADD/ADDS (immediate) with zero shift, for bit 0:11 of section offset
1343pub const IMAGE_REL_ARM64_SECREL_LOW12A: u16 = 0x0009;
1344/// ADD/ADDS (immediate) with zero shift, for bit 12:23 of section offset
1345pub const IMAGE_REL_ARM64_SECREL_HIGH12A: u16 = 0x000A;
1346/// LDR (indexed, unsigned immediate), for bit 0:11 of section offset
1347pub const IMAGE_REL_ARM64_SECREL_LOW12L: u16 = 0x000B;
1348pub const IMAGE_REL_ARM64_TOKEN: u16 = 0x000C;
1349/// Section table index
1350pub const IMAGE_REL_ARM64_SECTION: u16 = 0x000D;
1351/// 64 bit address
1352pub const IMAGE_REL_ARM64_ADDR64: u16 = 0x000E;
1353/// 19 bit offset << 2 & sign ext. for conditional B
1354pub const IMAGE_REL_ARM64_BRANCH19: u16 = 0x000F;
1355/// TBZ/TBNZ
1356pub const IMAGE_REL_ARM64_BRANCH14: u16 = 0x0010;
1357/// 32-bit relative address from byte following reloc
1358pub const IMAGE_REL_ARM64_REL32: u16 = 0x0011;
1359
1360//
1361// x64 relocations
1362//
1363/// Reference is absolute, no relocation is necessary
1364pub const IMAGE_REL_AMD64_ABSOLUTE: u16 = 0x0000;
1365/// 64-bit address (VA).
1366pub const IMAGE_REL_AMD64_ADDR64: u16 = 0x0001;
1367/// 32-bit address (VA).
1368pub const IMAGE_REL_AMD64_ADDR32: u16 = 0x0002;
1369/// 32-bit address w/o image base (RVA).
1370pub const IMAGE_REL_AMD64_ADDR32NB: u16 = 0x0003;
1371/// 32-bit relative address from byte following reloc
1372pub const IMAGE_REL_AMD64_REL32: u16 = 0x0004;
1373/// 32-bit relative address from byte distance 1 from reloc
1374pub const IMAGE_REL_AMD64_REL32_1: u16 = 0x0005;
1375/// 32-bit relative address from byte distance 2 from reloc
1376pub const IMAGE_REL_AMD64_REL32_2: u16 = 0x0006;
1377/// 32-bit relative address from byte distance 3 from reloc
1378pub const IMAGE_REL_AMD64_REL32_3: u16 = 0x0007;
1379/// 32-bit relative address from byte distance 4 from reloc
1380pub const IMAGE_REL_AMD64_REL32_4: u16 = 0x0008;
1381/// 32-bit relative address from byte distance 5 from reloc
1382pub const IMAGE_REL_AMD64_REL32_5: u16 = 0x0009;
1383/// Section index
1384pub const IMAGE_REL_AMD64_SECTION: u16 = 0x000A;
1385/// 32 bit offset from base of section containing target
1386pub const IMAGE_REL_AMD64_SECREL: u16 = 0x000B;
1387/// 7 bit unsigned offset from base of section containing target
1388pub const IMAGE_REL_AMD64_SECREL7: u16 = 0x000C;
1389/// 32 bit metadata token
1390pub const IMAGE_REL_AMD64_TOKEN: u16 = 0x000D;
1391/// 32 bit signed span-dependent value emitted into object
1392pub const IMAGE_REL_AMD64_SREL32: u16 = 0x000E;
1393pub const IMAGE_REL_AMD64_PAIR: u16 = 0x000F;
1394/// 32 bit signed span-dependent value applied at link time
1395pub const IMAGE_REL_AMD64_SSPAN32: u16 = 0x0010;
1396pub const IMAGE_REL_AMD64_EHANDLER: u16 = 0x0011;
1397/// Indirect branch to an import
1398pub const IMAGE_REL_AMD64_IMPORT_BR: u16 = 0x0012;
1399/// Indirect call to an import
1400pub const IMAGE_REL_AMD64_IMPORT_CALL: u16 = 0x0013;
1401/// Indirect branch to a CFG check
1402pub const IMAGE_REL_AMD64_CFG_BR: u16 = 0x0014;
1403/// Indirect branch to a CFG check, with REX.W prefix
1404pub const IMAGE_REL_AMD64_CFG_BR_REX: u16 = 0x0015;
1405/// Indirect call to a CFG check
1406pub const IMAGE_REL_AMD64_CFG_CALL: u16 = 0x0016;
1407/// Indirect branch to a target in RAX (no CFG)
1408pub const IMAGE_REL_AMD64_INDIR_BR: u16 = 0x0017;
1409/// Indirect branch to a target in RAX, with REX.W prefix (no CFG)
1410pub const IMAGE_REL_AMD64_INDIR_BR_REX: u16 = 0x0018;
1411/// Indirect call to a target in RAX (no CFG)
1412pub const IMAGE_REL_AMD64_INDIR_CALL: u16 = 0x0019;
1413/// Indirect branch for a switch table using Reg 0 (RAX)
1414pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_FIRST: u16 = 0x0020;
1415/// Indirect branch for a switch table using Reg 15 (R15)
1416pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_LAST: u16 = 0x002F;
1417
1418//
1419// IA64 relocation types.
1420//
1421pub const IMAGE_REL_IA64_ABSOLUTE: u16 = 0x0000;
1422pub const IMAGE_REL_IA64_IMM14: u16 = 0x0001;
1423pub const IMAGE_REL_IA64_IMM22: u16 = 0x0002;
1424pub const IMAGE_REL_IA64_IMM64: u16 = 0x0003;
1425pub const IMAGE_REL_IA64_DIR32: u16 = 0x0004;
1426pub const IMAGE_REL_IA64_DIR64: u16 = 0x0005;
1427pub const IMAGE_REL_IA64_PCREL21B: u16 = 0x0006;
1428pub const IMAGE_REL_IA64_PCREL21M: u16 = 0x0007;
1429pub const IMAGE_REL_IA64_PCREL21F: u16 = 0x0008;
1430pub const IMAGE_REL_IA64_GPREL22: u16 = 0x0009;
1431pub const IMAGE_REL_IA64_LTOFF22: u16 = 0x000A;
1432pub const IMAGE_REL_IA64_SECTION: u16 = 0x000B;
1433pub const IMAGE_REL_IA64_SECREL22: u16 = 0x000C;
1434pub const IMAGE_REL_IA64_SECREL64I: u16 = 0x000D;
1435pub const IMAGE_REL_IA64_SECREL32: u16 = 0x000E;
1436//
1437pub const IMAGE_REL_IA64_DIR32NB: u16 = 0x0010;
1438pub const IMAGE_REL_IA64_SREL14: u16 = 0x0011;
1439pub const IMAGE_REL_IA64_SREL22: u16 = 0x0012;
1440pub const IMAGE_REL_IA64_SREL32: u16 = 0x0013;
1441pub const IMAGE_REL_IA64_UREL32: u16 = 0x0014;
1442/// This is always a BRL and never converted
1443pub const IMAGE_REL_IA64_PCREL60X: u16 = 0x0015;
1444/// If possible, convert to MBB bundle with NOP.B in slot 1
1445pub const IMAGE_REL_IA64_PCREL60B: u16 = 0x0016;
1446/// If possible, convert to MFB bundle with NOP.F in slot 1
1447pub const IMAGE_REL_IA64_PCREL60F: u16 = 0x0017;
1448/// If possible, convert to MIB bundle with NOP.I in slot 1
1449pub const IMAGE_REL_IA64_PCREL60I: u16 = 0x0018;
1450/// If possible, convert to MMB bundle with NOP.M in slot 1
1451pub const IMAGE_REL_IA64_PCREL60M: u16 = 0x0019;
1452pub const IMAGE_REL_IA64_IMMGPREL64: u16 = 0x001A;
1453/// clr token
1454pub const IMAGE_REL_IA64_TOKEN: u16 = 0x001B;
1455pub const IMAGE_REL_IA64_GPREL32: u16 = 0x001C;
1456pub const IMAGE_REL_IA64_ADDEND: u16 = 0x001F;
1457
1458//
1459// CEF relocation types.
1460//
1461/// Reference is absolute, no relocation is necessary
1462pub const IMAGE_REL_CEF_ABSOLUTE: u16 = 0x0000;
1463/// 32-bit address (VA).
1464pub const IMAGE_REL_CEF_ADDR32: u16 = 0x0001;
1465/// 64-bit address (VA).
1466pub const IMAGE_REL_CEF_ADDR64: u16 = 0x0002;
1467/// 32-bit address w/o image base (RVA).
1468pub const IMAGE_REL_CEF_ADDR32NB: u16 = 0x0003;
1469/// Section index
1470pub const IMAGE_REL_CEF_SECTION: u16 = 0x0004;
1471/// 32 bit offset from base of section containing target
1472pub const IMAGE_REL_CEF_SECREL: u16 = 0x0005;
1473/// 32 bit metadata token
1474pub const IMAGE_REL_CEF_TOKEN: u16 = 0x0006;
1475
1476//
1477// clr relocation types.
1478//
1479/// Reference is absolute, no relocation is necessary
1480pub const IMAGE_REL_CEE_ABSOLUTE: u16 = 0x0000;
1481/// 32-bit address (VA).
1482pub const IMAGE_REL_CEE_ADDR32: u16 = 0x0001;
1483/// 64-bit address (VA).
1484pub const IMAGE_REL_CEE_ADDR64: u16 = 0x0002;
1485/// 32-bit address w/o image base (RVA).
1486pub const IMAGE_REL_CEE_ADDR32NB: u16 = 0x0003;
1487/// Section index
1488pub const IMAGE_REL_CEE_SECTION: u16 = 0x0004;
1489/// 32 bit offset from base of section containing target
1490pub const IMAGE_REL_CEE_SECREL: u16 = 0x0005;
1491/// 32 bit metadata token
1492pub const IMAGE_REL_CEE_TOKEN: u16 = 0x0006;
1493
1494/// No relocation required
1495pub const IMAGE_REL_M32R_ABSOLUTE: u16 = 0x0000;
1496/// 32 bit address
1497pub const IMAGE_REL_M32R_ADDR32: u16 = 0x0001;
1498/// 32 bit address w/o image base
1499pub const IMAGE_REL_M32R_ADDR32NB: u16 = 0x0002;
1500/// 24 bit address
1501pub const IMAGE_REL_M32R_ADDR24: u16 = 0x0003;
1502/// GP relative addressing
1503pub const IMAGE_REL_M32R_GPREL16: u16 = 0x0004;
1504/// 24 bit offset << 2 & sign ext.
1505pub const IMAGE_REL_M32R_PCREL24: u16 = 0x0005;
1506/// 16 bit offset << 2 & sign ext.
1507pub const IMAGE_REL_M32R_PCREL16: u16 = 0x0006;
1508/// 8 bit offset << 2 & sign ext.
1509pub const IMAGE_REL_M32R_PCREL8: u16 = 0x0007;
1510/// 16 MSBs
1511pub const IMAGE_REL_M32R_REFHALF: u16 = 0x0008;
1512/// 16 MSBs; adj for LSB sign ext.
1513pub const IMAGE_REL_M32R_REFHI: u16 = 0x0009;
1514/// 16 LSBs
1515pub const IMAGE_REL_M32R_REFLO: u16 = 0x000A;
1516/// Link HI and LO
1517pub const IMAGE_REL_M32R_PAIR: u16 = 0x000B;
1518/// Section table index
1519pub const IMAGE_REL_M32R_SECTION: u16 = 0x000C;
1520/// 32 bit section relative reference
1521pub const IMAGE_REL_M32R_SECREL32: u16 = 0x000D;
1522/// clr token
1523pub const IMAGE_REL_M32R_TOKEN: u16 = 0x000E;
1524
1525/// No relocation required
1526pub const IMAGE_REL_EBC_ABSOLUTE: u16 = 0x0000;
1527/// 32 bit address w/o image base
1528pub const IMAGE_REL_EBC_ADDR32NB: u16 = 0x0001;
1529/// 32-bit relative address from byte following reloc
1530pub const IMAGE_REL_EBC_REL32: u16 = 0x0002;
1531/// Section table index
1532pub const IMAGE_REL_EBC_SECTION: u16 = 0x0003;
1533/// Offset within section
1534pub const IMAGE_REL_EBC_SECREL: u16 = 0x0004;
1535
1536/*
1537// TODO?
1538#define EXT_IMM64(Value, Address, Size, InstPos, ValPos) /* Intel-IA64-Filler */ \
1539 Value |= (((ULONGLONG)((*(Address) >> InstPos) & (((ULONGLONG)1 << Size) - 1))) << ValPos) // Intel-IA64-Filler
1540
1541#define INS_IMM64(Value, Address, Size, InstPos, ValPos) /* Intel-IA64-Filler */\
1542 *(PDWORD)Address = (*(PDWORD)Address & ~(((1 << Size) - 1) << InstPos)) | /* Intel-IA64-Filler */\
1543 ((DWORD)((((ULONGLONG)Value >> ValPos) & (((ULONGLONG)1 << Size) - 1))) << InstPos) // Intel-IA64-Filler
1544*/
1545
1546/// Intel-IA64-Filler
1547pub const EMARCH_ENC_I17_IMM7B_INST_WORD_X: u16 = 3;
1548/// Intel-IA64-Filler
1549pub const EMARCH_ENC_I17_IMM7B_SIZE_X: u16 = 7;
1550/// Intel-IA64-Filler
1551pub const EMARCH_ENC_I17_IMM7B_INST_WORD_POS_X: u16 = 4;
1552/// Intel-IA64-Filler
1553pub const EMARCH_ENC_I17_IMM7B_VAL_POS_X: u16 = 0;
1554
1555/// Intel-IA64-Filler
1556pub const EMARCH_ENC_I17_IMM9D_INST_WORD_X: u16 = 3;
1557/// Intel-IA64-Filler
1558pub const EMARCH_ENC_I17_IMM9D_SIZE_X: u16 = 9;
1559/// Intel-IA64-Filler
1560pub const EMARCH_ENC_I17_IMM9D_INST_WORD_POS_X: u16 = 18;
1561/// Intel-IA64-Filler
1562pub const EMARCH_ENC_I17_IMM9D_VAL_POS_X: u16 = 7;
1563
1564/// Intel-IA64-Filler
1565pub const EMARCH_ENC_I17_IMM5C_INST_WORD_X: u16 = 3;
1566/// Intel-IA64-Filler
1567pub const EMARCH_ENC_I17_IMM5C_SIZE_X: u16 = 5;
1568/// Intel-IA64-Filler
1569pub const EMARCH_ENC_I17_IMM5C_INST_WORD_POS_X: u16 = 13;
1570/// Intel-IA64-Filler
1571pub const EMARCH_ENC_I17_IMM5C_VAL_POS_X: u16 = 16;
1572
1573/// Intel-IA64-Filler
1574pub const EMARCH_ENC_I17_IC_INST_WORD_X: u16 = 3;
1575/// Intel-IA64-Filler
1576pub const EMARCH_ENC_I17_IC_SIZE_X: u16 = 1;
1577/// Intel-IA64-Filler
1578pub const EMARCH_ENC_I17_IC_INST_WORD_POS_X: u16 = 12;
1579/// Intel-IA64-Filler
1580pub const EMARCH_ENC_I17_IC_VAL_POS_X: u16 = 21;
1581
1582/// Intel-IA64-Filler
1583pub const EMARCH_ENC_I17_IMM41A_INST_WORD_X: u16 = 1;
1584/// Intel-IA64-Filler
1585pub const EMARCH_ENC_I17_IMM41A_SIZE_X: u16 = 10;
1586/// Intel-IA64-Filler
1587pub const EMARCH_ENC_I17_IMM41A_INST_WORD_POS_X: u16 = 14;
1588/// Intel-IA64-Filler
1589pub const EMARCH_ENC_I17_IMM41A_VAL_POS_X: u16 = 22;
1590
1591/// Intel-IA64-Filler
1592pub const EMARCH_ENC_I17_IMM41B_INST_WORD_X: u16 = 1;
1593/// Intel-IA64-Filler
1594pub const EMARCH_ENC_I17_IMM41B_SIZE_X: u16 = 8;
1595/// Intel-IA64-Filler
1596pub const EMARCH_ENC_I17_IMM41B_INST_WORD_POS_X: u16 = 24;
1597/// Intel-IA64-Filler
1598pub const EMARCH_ENC_I17_IMM41B_VAL_POS_X: u16 = 32;
1599
1600/// Intel-IA64-Filler
1601pub const EMARCH_ENC_I17_IMM41C_INST_WORD_X: u16 = 2;
1602/// Intel-IA64-Filler
1603pub const EMARCH_ENC_I17_IMM41C_SIZE_X: u16 = 23;
1604/// Intel-IA64-Filler
1605pub const EMARCH_ENC_I17_IMM41C_INST_WORD_POS_X: u16 = 0;
1606/// Intel-IA64-Filler
1607pub const EMARCH_ENC_I17_IMM41C_VAL_POS_X: u16 = 40;
1608
1609/// Intel-IA64-Filler
1610pub const EMARCH_ENC_I17_SIGN_INST_WORD_X: u16 = 3;
1611/// Intel-IA64-Filler
1612pub const EMARCH_ENC_I17_SIGN_SIZE_X: u16 = 1;
1613/// Intel-IA64-Filler
1614pub const EMARCH_ENC_I17_SIGN_INST_WORD_POS_X: u16 = 27;
1615/// Intel-IA64-Filler
1616pub const EMARCH_ENC_I17_SIGN_VAL_POS_X: u16 = 63;
1617
1618/// Intel-IA64-Filler
1619pub const X3_OPCODE_INST_WORD_X: u16 = 3;
1620/// Intel-IA64-Filler
1621pub const X3_OPCODE_SIZE_X: u16 = 4;
1622/// Intel-IA64-Filler
1623pub const X3_OPCODE_INST_WORD_POS_X: u16 = 28;
1624/// Intel-IA64-Filler
1625pub const X3_OPCODE_SIGN_VAL_POS_X: u16 = 0;
1626
1627/// Intel-IA64-Filler
1628pub const X3_I_INST_WORD_X: u16 = 3;
1629/// Intel-IA64-Filler
1630pub const X3_I_SIZE_X: u16 = 1;
1631/// Intel-IA64-Filler
1632pub const X3_I_INST_WORD_POS_X: u16 = 27;
1633/// Intel-IA64-Filler
1634pub const X3_I_SIGN_VAL_POS_X: u16 = 59;
1635
1636/// Intel-IA64-Filler
1637pub const X3_D_WH_INST_WORD_X: u16 = 3;
1638/// Intel-IA64-Filler
1639pub const X3_D_WH_SIZE_X: u16 = 3;
1640/// Intel-IA64-Filler
1641pub const X3_D_WH_INST_WORD_POS_X: u16 = 24;
1642/// Intel-IA64-Filler
1643pub const X3_D_WH_SIGN_VAL_POS_X: u16 = 0;
1644
1645/// Intel-IA64-Filler
1646pub const X3_IMM20_INST_WORD_X: u16 = 3;
1647/// Intel-IA64-Filler
1648pub const X3_IMM20_SIZE_X: u16 = 20;
1649/// Intel-IA64-Filler
1650pub const X3_IMM20_INST_WORD_POS_X: u16 = 4;
1651/// Intel-IA64-Filler
1652pub const X3_IMM20_SIGN_VAL_POS_X: u16 = 0;
1653
1654/// Intel-IA64-Filler
1655pub const X3_IMM39_1_INST_WORD_X: u16 = 2;
1656/// Intel-IA64-Filler
1657pub const X3_IMM39_1_SIZE_X: u16 = 23;
1658/// Intel-IA64-Filler
1659pub const X3_IMM39_1_INST_WORD_POS_X: u16 = 0;
1660/// Intel-IA64-Filler
1661pub const X3_IMM39_1_SIGN_VAL_POS_X: u16 = 36;
1662
1663/// Intel-IA64-Filler
1664pub const X3_IMM39_2_INST_WORD_X: u16 = 1;
1665/// Intel-IA64-Filler
1666pub const X3_IMM39_2_SIZE_X: u16 = 16;
1667/// Intel-IA64-Filler
1668pub const X3_IMM39_2_INST_WORD_POS_X: u16 = 16;
1669/// Intel-IA64-Filler
1670pub const X3_IMM39_2_SIGN_VAL_POS_X: u16 = 20;
1671
1672/// Intel-IA64-Filler
1673pub const X3_P_INST_WORD_X: u16 = 3;
1674/// Intel-IA64-Filler
1675pub const X3_P_SIZE_X: u16 = 4;
1676/// Intel-IA64-Filler
1677pub const X3_P_INST_WORD_POS_X: u16 = 0;
1678/// Intel-IA64-Filler
1679pub const X3_P_SIGN_VAL_POS_X: u16 = 0;
1680
1681/// Intel-IA64-Filler
1682pub const X3_TMPLT_INST_WORD_X: u16 = 0;
1683/// Intel-IA64-Filler
1684pub const X3_TMPLT_SIZE_X: u16 = 4;
1685/// Intel-IA64-Filler
1686pub const X3_TMPLT_INST_WORD_POS_X: u16 = 0;
1687/// Intel-IA64-Filler
1688pub const X3_TMPLT_SIGN_VAL_POS_X: u16 = 0;
1689
1690/// Intel-IA64-Filler
1691pub const X3_BTYPE_QP_INST_WORD_X: u16 = 2;
1692/// Intel-IA64-Filler
1693pub const X3_BTYPE_QP_SIZE_X: u16 = 9;
1694/// Intel-IA64-Filler
1695pub const X3_BTYPE_QP_INST_WORD_POS_X: u16 = 23;
1696/// Intel-IA64-Filler
1697pub const X3_BTYPE_QP_INST_VAL_POS_X: u16 = 0;
1698
1699/// Intel-IA64-Filler
1700pub const X3_EMPTY_INST_WORD_X: u16 = 1;
1701/// Intel-IA64-Filler
1702pub const X3_EMPTY_SIZE_X: u16 = 2;
1703/// Intel-IA64-Filler
1704pub const X3_EMPTY_INST_WORD_POS_X: u16 = 14;
1705/// Intel-IA64-Filler
1706pub const X3_EMPTY_INST_VAL_POS_X: u16 = 0;
1707
1708//
1709// Line number format.
1710//
1711
1712// This struct has alignment 1.
1713#[derive(Debug, Clone, Copy)]
1714#[repr(C)]
1715pub struct ImageLinenumber {
1716 /// Symbol table index of function name if Linenumber is 0.
1717 /// Otherwise virtual address of line number.
1718 pub symbol_table_index_or_virtual_address: U32Bytes<LE>,
1719 /// Line number.
1720 pub linenumber: U16Bytes<LE>,
1721}
1722
1723//
1724// Based relocation format.
1725//
1726
1727#[derive(Debug, Clone, Copy)]
1728#[repr(C)]
1729pub struct ImageBaseRelocation {
1730 pub virtual_address: U32<LE>,
1731 pub size_of_block: U32<LE>,
1732 // pub type_offset[1]: U16<LE>,
1733}
1734
1735//
1736// Based relocation types.
1737//
1738
1739pub const IMAGE_REL_BASED_ABSOLUTE: u16 = 0;
1740pub const IMAGE_REL_BASED_HIGH: u16 = 1;
1741pub const IMAGE_REL_BASED_LOW: u16 = 2;
1742pub const IMAGE_REL_BASED_HIGHLOW: u16 = 3;
1743pub const IMAGE_REL_BASED_HIGHADJ: u16 = 4;
1744pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_5: u16 = 5;
1745pub const IMAGE_REL_BASED_RESERVED: u16 = 6;
1746pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_7: u16 = 7;
1747pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_8: u16 = 8;
1748pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_9: u16 = 9;
1749pub const IMAGE_REL_BASED_DIR64: u16 = 10;
1750
1751//
1752// Platform-specific based relocation types.
1753//
1754
1755pub const IMAGE_REL_BASED_IA64_IMM64: u16 = 9;
1756
1757pub const IMAGE_REL_BASED_MIPS_JMPADDR: u16 = 5;
1758pub const IMAGE_REL_BASED_MIPS_JMPADDR16: u16 = 9;
1759
1760pub const IMAGE_REL_BASED_ARM_MOV32: u16 = 5;
1761pub const IMAGE_REL_BASED_THUMB_MOV32: u16 = 7;
1762
1763pub const IMAGE_REL_BASED_RISCV_HIGH20: u16 = 5;
1764pub const IMAGE_REL_BASED_RISCV_LOW12I: u16 = 7;
1765pub const IMAGE_REL_BASED_RISCV_LOW12S: u16 = 8;
1766
1767//
1768// Archive format.
1769//
1770
1771pub const IMAGE_ARCHIVE_START_SIZE: usize = 8;
1772pub const IMAGE_ARCHIVE_START: &[u8; 8] = b"!<arch>\n";
1773pub const IMAGE_ARCHIVE_END: &[u8] = b"`\n";
1774pub const IMAGE_ARCHIVE_PAD: &[u8] = b"\n";
1775pub const IMAGE_ARCHIVE_LINKER_MEMBER: &[u8; 16] = b"/ ";
1776pub const IMAGE_ARCHIVE_LONGNAMES_MEMBER: &[u8; 16] = b"// ";
1777pub const IMAGE_ARCHIVE_HYBRIDMAP_MEMBER: &[u8; 16] = b"/<HYBRIDMAP>/ ";
1778
1779#[derive(Debug, Clone, Copy)]
1780#[repr(C)]
1781pub struct ImageArchiveMemberHeader {
1782 /// File member name - `/' terminated.
1783 pub name: [u8; 16],
1784 /// File member date - decimal.
1785 pub date: [u8; 12],
1786 /// File member user id - decimal.
1787 pub user_id: [u8; 6],
1788 /// File member group id - decimal.
1789 pub group_id: [u8; 6],
1790 /// File member mode - octal.
1791 pub mode: [u8; 8],
1792 /// File member size - decimal.
1793 pub size: [u8; 10],
1794 /// String to end header.
1795 pub end_header: [u8; 2],
1796}
1797
1798pub const IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR: u16 = 60;
1799
1800//
1801// DLL support.
1802//
1803
1804//
1805// Export Format
1806//
1807
1808#[derive(Debug, Clone, Copy)]
1809#[repr(C)]
1810pub struct ImageExportDirectory {
1811 pub characteristics: U32<LE>,
1812 pub time_date_stamp: U32<LE>,
1813 pub major_version: U16<LE>,
1814 pub minor_version: U16<LE>,
1815 pub name: U32<LE>,
1816 pub base: U32<LE>,
1817 pub number_of_functions: U32<LE>,
1818 pub number_of_names: U32<LE>,
1819 /// RVA from base of image
1820 pub address_of_functions: U32<LE>,
1821 /// RVA from base of image
1822 pub address_of_names: U32<LE>,
1823 /// RVA from base of image
1824 pub address_of_name_ordinals: U32<LE>,
1825}
1826
1827//
1828// Import Format
1829//
1830
1831#[derive(Debug, Clone, Copy)]
1832#[repr(C)]
1833pub struct ImageImportByName {
1834 pub hint: U16<LE>,
1835 //pub name: [i8; 1],
1836}
1837
1838#[derive(Debug, Clone, Copy)]
1839#[repr(C)]
1840pub struct ImageThunkData64(pub U64<LE>);
1841/*
1842 union {
1843/// PBYTE
1844 pub forwarder_string: U64<LE>,
1845/// PDWORD
1846 pub function: U64<LE>,
1847 pub ordinal: U64<LE>,
1848/// PIMAGE_IMPORT_BY_NAME
1849 pub address_of_data: U64<LE>,
1850 } u1;
1851*/
1852
1853#[derive(Debug, Clone, Copy)]
1854#[repr(C)]
1855pub struct ImageThunkData32(pub U32<LE>);
1856/*
1857 union {
1858/// PBYTE
1859 pub forwarder_string: U32<LE>,
1860/// PDWORD
1861 pub function: U32<LE>,
1862 pub ordinal: U32<LE>,
1863/// PIMAGE_IMPORT_BY_NAME
1864 pub address_of_data: U32<LE>,
1865 } u1;
1866}
1867*/
1868
1869pub const IMAGE_ORDINAL_FLAG64: u64 = 0x8000000000000000;
1870pub const IMAGE_ORDINAL_FLAG32: u32 = 0x80000000;
1871
1872/*
1873#define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)
1874#define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)
1875#define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
1876#define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
1877
1878*/
1879
1880//
1881// Thread Local Storage
1882//
1883
1884#[derive(Debug, Clone, Copy)]
1885#[repr(C)]
1886pub struct ImageTlsDirectory64 {
1887 pub start_address_of_raw_data: U64<LE>,
1888 pub end_address_of_raw_data: U64<LE>,
1889 /// PDWORD
1890 pub address_of_index: U64<LE>,
1891 /// PIMAGE_TLS_CALLBACK *;
1892 pub address_of_call_backs: U64<LE>,
1893 pub size_of_zero_fill: U32<LE>,
1894 pub characteristics: U32<LE>,
1895}
1896
1897#[derive(Debug, Clone, Copy)]
1898#[repr(C)]
1899pub struct ImageTlsDirectory32 {
1900 pub start_address_of_raw_data: U32<LE>,
1901 pub end_address_of_raw_data: U32<LE>,
1902 /// PDWORD
1903 pub address_of_index: U32<LE>,
1904 /// PIMAGE_TLS_CALLBACK *
1905 pub address_of_call_backs: U32<LE>,
1906 pub size_of_zero_fill: U32<LE>,
1907 pub characteristics: U32<LE>,
1908}
1909
1910#[derive(Debug, Clone, Copy)]
1911#[repr(C)]
1912pub struct ImageImportDescriptor {
1913 /// RVA to original unbound IAT (`ImageThunkData32`/`ImageThunkData64`)
1914 /// 0 for terminating null import descriptor
1915 pub original_first_thunk: U32Bytes<LE>,
1916 /// 0 if not bound,
1917 /// -1 if bound, and real date\time stamp
1918 /// in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
1919 /// O.W. date/time stamp of DLL bound to (Old BIND)
1920 pub time_date_stamp: U32Bytes<LE>,
1921 /// -1 if no forwarders
1922 pub forwarder_chain: U32Bytes<LE>,
1923 pub name: U32Bytes<LE>,
1924 /// RVA to IAT (if bound this IAT has actual addresses)
1925 pub first_thunk: U32Bytes<LE>,
1926}
1927
1928impl ImageImportDescriptor {
1929 /// Tell whether this import descriptor is the null descriptor
1930 /// (used to mark the end of the iterator array in a PE)
1931 pub fn is_null(&self) -> bool {
1932 self.original_first_thunk.get(LE) == 0
1933 && self.time_date_stamp.get(LE) == 0
1934 && self.forwarder_chain.get(LE) == 0
1935 && self.name.get(LE) == 0
1936 && self.first_thunk.get(LE) == 0
1937 }
1938}
1939
1940//
1941// New format import descriptors pointed to by DataDirectory[ IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT ]
1942//
1943
1944#[derive(Debug, Clone, Copy)]
1945#[repr(C)]
1946pub struct ImageBoundImportDescriptor {
1947 pub time_date_stamp: U32<LE>,
1948 pub offset_module_name: U16<LE>,
1949 pub number_of_module_forwarder_refs: U16<LE>,
1950 // Array of zero or more IMAGE_BOUND_FORWARDER_REF follows
1951}
1952
1953#[derive(Debug, Clone, Copy)]
1954#[repr(C)]
1955pub struct ImageBoundForwarderRef {
1956 pub time_date_stamp: U32<LE>,
1957 pub offset_module_name: U16<LE>,
1958 pub reserved: U16<LE>,
1959}
1960
1961#[derive(Debug, Clone, Copy)]
1962#[repr(C)]
1963pub struct ImageDelayloadDescriptor {
1964 pub attributes: U32<LE>,
1965
1966 /// RVA to the name of the target library (NULL-terminate ASCII string)
1967 pub dll_name_rva: U32<LE>,
1968 /// RVA to the HMODULE caching location (PHMODULE)
1969 pub module_handle_rva: U32<LE>,
1970 /// RVA to the start of the IAT (PIMAGE_THUNK_DATA)
1971 pub import_address_table_rva: U32<LE>,
1972 /// RVA to the start of the name table (PIMAGE_THUNK_DATA::AddressOfData)
1973 pub import_name_table_rva: U32<LE>,
1974 /// RVA to an optional bound IAT
1975 pub bound_import_address_table_rva: U32<LE>,
1976 /// RVA to an optional unload info table
1977 pub unload_information_table_rva: U32<LE>,
1978 /// 0 if not bound, otherwise, date/time of the target DLL
1979 pub time_date_stamp: U32<LE>,
1980}
1981
1982impl ImageDelayloadDescriptor {
1983 /// Tell whether this delay-load import descriptor is the null descriptor
1984 /// (used to mark the end of the iterator array in a PE)
1985 pub fn is_null(&self) -> bool {
1986 self.attributes.get(LE) == 0
1987 && self.dll_name_rva.get(LE) == 0
1988 && self.module_handle_rva.get(LE) == 0
1989 && self.import_address_table_rva.get(LE) == 0
1990 && self.import_name_table_rva.get(LE) == 0
1991 && self.bound_import_address_table_rva.get(LE) == 0
1992 && self.unload_information_table_rva.get(LE) == 0
1993 && self.time_date_stamp.get(LE) == 0
1994 }
1995}
1996
1997/// Delay load version 2 flag for `ImageDelayloadDescriptor::attributes`.
1998pub const IMAGE_DELAYLOAD_RVA_BASED: u32 = 0x8000_0000;
1999
2000//
2001// Resource Format.
2002//
2003
2004//
2005// Resource directory consists of two counts, following by a variable length
2006// array of directory entries. The first count is the number of entries at
2007// beginning of the array that have actual names associated with each entry.
2008// The entries are in ascending order, case insensitive strings. The second
2009// count is the number of entries that immediately follow the named entries.
2010// This second count identifies the number of entries that have 16-bit integer
2011// Ids as their name. These entries are also sorted in ascending order.
2012//
2013// This structure allows fast lookup by either name or number, but for any
2014// given resource entry only one form of lookup is supported, not both.
2015// This is consistent with the syntax of the .RC file and the .RES file.
2016//
2017
2018#[derive(Debug, Clone, Copy)]
2019#[repr(C)]
2020pub struct ImageResourceDirectory {
2021 pub characteristics: U32<LE>,
2022 pub time_date_stamp: U32<LE>,
2023 pub major_version: U16<LE>,
2024 pub minor_version: U16<LE>,
2025 pub number_of_named_entries: U16<LE>,
2026 pub number_of_id_entries: U16<LE>,
2027}
2028
2029pub const IMAGE_RESOURCE_NAME_IS_STRING: u32 = 0x8000_0000;
2030pub const IMAGE_RESOURCE_DATA_IS_DIRECTORY: u32 = 0x8000_0000;
2031//
2032// Each directory contains the 32-bit Name of the entry and an offset,
2033// relative to the beginning of the resource directory of the data associated
2034// with this directory entry. If the name of the entry is an actual text
2035// string instead of an integer Id, then the high order bit of the name field
2036// is set to one and the low order 31-bits are an offset, relative to the
2037// beginning of the resource directory of the string, which is of type
2038// IMAGE_RESOURCE_DIRECTORY_STRING. Otherwise the high bit is clear and the
2039// low-order 16-bits are the integer Id that identify this resource directory
2040// entry. If the directory entry is yet another resource directory (i.e. a
2041// subdirectory), then the high order bit of the offset field will be
2042// set to indicate this. Otherwise the high bit is clear and the offset
2043// field points to a resource data entry.
2044//
2045
2046#[derive(Debug, Clone, Copy)]
2047#[repr(C)]
2048pub struct ImageResourceDirectoryEntry {
2049 pub name_or_id: U32<LE>,
2050 pub offset_to_data_or_directory: U32<LE>,
2051}
2052
2053//
2054// For resource directory entries that have actual string names, the Name
2055// field of the directory entry points to an object of the following type.
2056// All of these string objects are stored together after the last resource
2057// directory entry and before the first resource data object. This minimizes
2058// the impact of these variable length objects on the alignment of the fixed
2059// size directory entry objects.
2060//
2061
2062#[derive(Debug, Clone, Copy)]
2063#[repr(C)]
2064pub struct ImageResourceDirectoryString {
2065 pub length: U16<LE>,
2066 //pub name_string: [i8; 1],
2067}
2068
2069#[derive(Debug, Clone, Copy)]
2070#[repr(C)]
2071pub struct ImageResourceDirStringU {
2072 pub length: U16<LE>,
2073 //pub name_string: [U16<LE>; 1],
2074}
2075
2076//
2077// Each resource data entry describes a leaf node in the resource directory
2078// tree. It contains an offset, relative to the beginning of the resource
2079// directory of the data for the resource, a size field that gives the number
2080// of bytes of data at that offset, a CodePage that should be used when
2081// decoding code point values within the resource data. Typically for new
2082// applications the code page would be the unicode code page.
2083//
2084
2085#[derive(Debug, Clone, Copy)]
2086#[repr(C)]
2087pub struct ImageResourceDataEntry {
2088 /// RVA of the data.
2089 pub offset_to_data: U32<LE>,
2090 pub size: U32<LE>,
2091 pub code_page: U32<LE>,
2092 pub reserved: U32<LE>,
2093}
2094
2095// Resource type: https://docs.microsoft.com/en-us/windows/win32/menurc/resource-types
2096
2097/// ID for: Hardware-dependent cursor resource.
2098pub const RT_CURSOR: u16 = 1;
2099/// ID for: Bitmap resource.
2100pub const RT_BITMAP: u16 = 2;
2101/// ID for: Hardware-dependent icon resource.
2102pub const RT_ICON: u16 = 3;
2103/// ID for: Menu resource.
2104pub const RT_MENU: u16 = 4;
2105/// ID for: Dialog box.
2106pub const RT_DIALOG: u16 = 5;
2107/// ID for: String-table entry.
2108pub const RT_STRING: u16 = 6;
2109/// ID for: Font directory resource.
2110pub const RT_FONTDIR: u16 = 7;
2111/// ID for: Font resource.
2112pub const RT_FONT: u16 = 8;
2113/// ID for: Accelerator table.
2114pub const RT_ACCELERATOR: u16 = 9;
2115/// ID for: Application-defined resource (raw data).
2116pub const RT_RCDATA: u16 = 10;
2117/// ID for: Message-table entry.
2118pub const RT_MESSAGETABLE: u16 = 11;
2119/// ID for: Hardware-independent cursor resource.
2120pub const RT_GROUP_CURSOR: u16 = 12;
2121/// ID for: Hardware-independent icon resource.
2122pub const RT_GROUP_ICON: u16 = 14;
2123/// ID for: Version resource.
2124pub const RT_VERSION: u16 = 16;
2125/// ID for: Allows a resource editing tool to associate a string with an .rc file.
2126pub const RT_DLGINCLUDE: u16 = 17;
2127/// ID for: Plug and Play resource.
2128pub const RT_PLUGPLAY: u16 = 19;
2129/// ID for: VXD.
2130pub const RT_VXD: u16 = 20;
2131/// ID for: Animated cursor.
2132pub const RT_ANICURSOR: u16 = 21;
2133/// ID for: Animated icon.
2134pub const RT_ANIICON: u16 = 22;
2135/// ID for: HTML resource.
2136pub const RT_HTML: u16 = 23;
2137/// ID for: Side-by-Side Assembly Manifest.
2138pub const RT_MANIFEST: u16 = 24;
2139
2140//
2141// Code Integrity in loadconfig (CI)
2142//
2143
2144#[derive(Debug, Clone, Copy)]
2145#[repr(C)]
2146pub struct ImageLoadConfigCodeIntegrity {
2147 /// Flags to indicate if CI information is available, etc.
2148 pub flags: U16<LE>,
2149 /// 0xFFFF means not available
2150 pub catalog: U16<LE>,
2151 pub catalog_offset: U32<LE>,
2152 /// Additional bitmask to be defined later
2153 pub reserved: U32<LE>,
2154}
2155
2156//
2157// Dynamic value relocation table in loadconfig
2158//
2159
2160#[derive(Debug, Clone, Copy)]
2161#[repr(C)]
2162pub struct ImageDynamicRelocationTable {
2163 pub version: U32<LE>,
2164 pub size: U32<LE>,
2165 // DynamicRelocations: [ImageDynamicRelocation; 0],
2166}
2167
2168//
2169// Dynamic value relocation entries following IMAGE_DYNAMIC_RELOCATION_TABLE
2170//
2171
2172#[derive(Debug, Clone, Copy)]
2173#[repr(C)]
2174pub struct ImageDynamicRelocation32 {
2175 pub symbol: U32<LE>,
2176 pub base_reloc_size: U32<LE>,
2177 // BaseRelocations: [ImageBaseRelocation; 0],
2178}
2179
2180#[derive(Debug, Clone, Copy)]
2181#[repr(C)]
2182pub struct ImageDynamicRelocation64 {
2183 pub symbol: U64<LE>,
2184 pub base_reloc_size: U32<LE>,
2185 // BaseRelocations: [ImageBaseRelocation; 0],
2186}
2187
2188#[derive(Debug, Clone, Copy)]
2189#[repr(C)]
2190pub struct ImageDynamicRelocation32V2 {
2191 pub header_size: U32<LE>,
2192 pub fixup_info_size: U32<LE>,
2193 pub symbol: U32<LE>,
2194 pub symbol_group: U32<LE>,
2195 pub flags: U32<LE>,
2196 // ... variable length header fields
2197 // pub fixup_info: [u8; fixup_info_size]
2198}
2199
2200#[derive(Debug, Clone, Copy)]
2201#[repr(C)]
2202pub struct ImageDynamicRelocation64V2 {
2203 pub header_size: U32<LE>,
2204 pub fixup_info_size: U32<LE>,
2205 pub symbol: U64<LE>,
2206 pub symbol_group: U32<LE>,
2207 pub flags: U32<LE>,
2208 // ... variable length header fields
2209 // pub fixup_info[u8; fixup_info_size]
2210}
2211
2212//
2213// Defined symbolic dynamic relocation entries.
2214//
2215
2216pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE: u32 = 0x0000_0001;
2217pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE: u32 = 0x0000_0002;
2218pub const IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER: u32 = 0x0000_0003;
2219pub const IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER: u32 = 0x0000_0004;
2220pub const IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH: u32 = 0x0000_0005;
2221
2222// This struct has alignment 1.
2223#[derive(Debug, Clone, Copy)]
2224#[repr(C)]
2225pub struct ImagePrologueDynamicRelocationHeader {
2226 pub prologue_byte_count: u8,
2227 // pub prologue_bytes: [u8; prologue_byte_count],
2228}
2229
2230// This struct has alignment 1.
2231#[derive(Debug, Clone, Copy)]
2232#[repr(C)]
2233pub struct ImageEpilogueDynamicRelocationHeader {
2234 pub epilogue_count: U32Bytes<LE>,
2235 pub epilogue_byte_count: u8,
2236 pub branch_descriptor_element_size: u8,
2237 pub branch_descriptor_count: U16Bytes<LE>,
2238 // pub branch_descriptors[...],
2239 // pub branch_descriptor_bit_map[...],
2240}
2241
2242/*
2243// TODO? bitfields
2244// TODO: unaligned?
2245#[derive(Debug, Clone, Copy)]
2246#[repr(C)]
2247pub struct ImageImportControlTransferDynamicRelocation {
2248 DWORD PageRelativeOffset : 12;
2249 DWORD IndirectCall : 1;
2250 DWORD IATIndex : 19;
2251}
2252
2253// TODO: unaligned?
2254#[derive(Debug, Clone, Copy)]
2255#[repr(C)]
2256pub struct ImageIndirControlTransferDynamicRelocation {
2257 WORD PageRelativeOffset : 12;
2258 WORD IndirectCall : 1;
2259 WORD RexWPrefix : 1;
2260 WORD CfgCheck : 1;
2261 WORD Reserved : 1;
2262}
2263
2264// TODO: unaligned?
2265#[derive(Debug, Clone, Copy)]
2266#[repr(C)]
2267pub struct ImageSwitchtableBranchDynamicRelocation {
2268 WORD PageRelativeOffset : 12;
2269 WORD RegisterNumber : 4;
2270}
2271*/
2272
2273//
2274// Load Configuration Directory Entry
2275//
2276
2277#[derive(Debug, Clone, Copy)]
2278#[repr(C)]
2279pub struct ImageLoadConfigDirectory32 {
2280 pub size: U32<LE>,
2281 pub time_date_stamp: U32<LE>,
2282 pub major_version: U16<LE>,
2283 pub minor_version: U16<LE>,
2284 pub global_flags_clear: U32<LE>,
2285 pub global_flags_set: U32<LE>,
2286 pub critical_section_default_timeout: U32<LE>,
2287 pub de_commit_free_block_threshold: U32<LE>,
2288 pub de_commit_total_free_threshold: U32<LE>,
2289 /// VA
2290 pub lock_prefix_table: U32<LE>,
2291 pub maximum_allocation_size: U32<LE>,
2292 pub virtual_memory_threshold: U32<LE>,
2293 pub process_heap_flags: U32<LE>,
2294 pub process_affinity_mask: U32<LE>,
2295 pub csd_version: U16<LE>,
2296 pub dependent_load_flags: U16<LE>,
2297 /// VA
2298 pub edit_list: U32<LE>,
2299 /// VA
2300 pub security_cookie: U32<LE>,
2301 /// VA
2302 pub sehandler_table: U32<LE>,
2303 pub sehandler_count: U32<LE>,
2304 /// VA
2305 pub guard_cf_check_function_pointer: U32<LE>,
2306 /// VA
2307 pub guard_cf_dispatch_function_pointer: U32<LE>,
2308 /// VA
2309 pub guard_cf_function_table: U32<LE>,
2310 pub guard_cf_function_count: U32<LE>,
2311 pub guard_flags: U32<LE>,
2312 pub code_integrity: ImageLoadConfigCodeIntegrity,
2313 /// VA
2314 pub guard_address_taken_iat_entry_table: U32<LE>,
2315 pub guard_address_taken_iat_entry_count: U32<LE>,
2316 /// VA
2317 pub guard_long_jump_target_table: U32<LE>,
2318 pub guard_long_jump_target_count: U32<LE>,
2319 /// VA
2320 pub dynamic_value_reloc_table: U32<LE>,
2321 pub chpe_metadata_pointer: U32<LE>,
2322 /// VA
2323 pub guard_rf_failure_routine: U32<LE>,
2324 /// VA
2325 pub guard_rf_failure_routine_function_pointer: U32<LE>,
2326 pub dynamic_value_reloc_table_offset: U32<LE>,
2327 pub dynamic_value_reloc_table_section: U16<LE>,
2328 pub reserved2: U16<LE>,
2329 /// VA
2330 pub guard_rf_verify_stack_pointer_function_pointer: U32<LE>,
2331 pub hot_patch_table_offset: U32<LE>,
2332 pub reserved3: U32<LE>,
2333 /// VA
2334 pub enclave_configuration_pointer: U32<LE>,
2335 /// VA
2336 pub volatile_metadata_pointer: U32<LE>,
2337}
2338
2339#[derive(Debug, Clone, Copy)]
2340#[repr(C)]
2341pub struct ImageLoadConfigDirectory64 {
2342 pub size: U32<LE>,
2343 pub time_date_stamp: U32<LE>,
2344 pub major_version: U16<LE>,
2345 pub minor_version: U16<LE>,
2346 pub global_flags_clear: U32<LE>,
2347 pub global_flags_set: U32<LE>,
2348 pub critical_section_default_timeout: U32<LE>,
2349 pub de_commit_free_block_threshold: U64<LE>,
2350 pub de_commit_total_free_threshold: U64<LE>,
2351 /// VA
2352 pub lock_prefix_table: U64<LE>,
2353 pub maximum_allocation_size: U64<LE>,
2354 pub virtual_memory_threshold: U64<LE>,
2355 pub process_affinity_mask: U64<LE>,
2356 pub process_heap_flags: U32<LE>,
2357 pub csd_version: U16<LE>,
2358 pub dependent_load_flags: U16<LE>,
2359 /// VA
2360 pub edit_list: U64<LE>,
2361 /// VA
2362 pub security_cookie: U64<LE>,
2363 /// VA
2364 pub sehandler_table: U64<LE>,
2365 pub sehandler_count: U64<LE>,
2366 /// VA
2367 pub guard_cf_check_function_pointer: U64<LE>,
2368 /// VA
2369 pub guard_cf_dispatch_function_pointer: U64<LE>,
2370 /// VA
2371 pub guard_cf_function_table: U64<LE>,
2372 pub guard_cf_function_count: U64<LE>,
2373 pub guard_flags: U32<LE>,
2374 pub code_integrity: ImageLoadConfigCodeIntegrity,
2375 /// VA
2376 pub guard_address_taken_iat_entry_table: U64<LE>,
2377 pub guard_address_taken_iat_entry_count: U64<LE>,
2378 /// VA
2379 pub guard_long_jump_target_table: U64<LE>,
2380 pub guard_long_jump_target_count: U64<LE>,
2381 /// VA
2382 pub dynamic_value_reloc_table: U64<LE>,
2383 /// VA
2384 pub chpe_metadata_pointer: U64<LE>,
2385 /// VA
2386 pub guard_rf_failure_routine: U64<LE>,
2387 /// VA
2388 pub guard_rf_failure_routine_function_pointer: U64<LE>,
2389 pub dynamic_value_reloc_table_offset: U32<LE>,
2390 pub dynamic_value_reloc_table_section: U16<LE>,
2391 pub reserved2: U16<LE>,
2392 /// VA
2393 pub guard_rf_verify_stack_pointer_function_pointer: U64<LE>,
2394 pub hot_patch_table_offset: U32<LE>,
2395 pub reserved3: U32<LE>,
2396 /// VA
2397 pub enclave_configuration_pointer: U64<LE>,
2398 /// VA
2399 pub volatile_metadata_pointer: U64<LE>,
2400}
2401
2402#[derive(Debug, Clone, Copy)]
2403#[repr(C)]
2404pub struct ImageHotPatchInfo {
2405 pub version: U32<LE>,
2406 pub size: U32<LE>,
2407 pub sequence_number: U32<LE>,
2408 pub base_image_list: U32<LE>,
2409 pub base_image_count: U32<LE>,
2410 /// Version 2 and later
2411 pub buffer_offset: U32<LE>,
2412 /// Version 3 and later
2413 pub extra_patch_size: U32<LE>,
2414}
2415
2416#[derive(Debug, Clone, Copy)]
2417#[repr(C)]
2418pub struct ImageHotPatchBase {
2419 pub sequence_number: U32<LE>,
2420 pub flags: U32<LE>,
2421 pub original_time_date_stamp: U32<LE>,
2422 pub original_check_sum: U32<LE>,
2423 pub code_integrity_info: U32<LE>,
2424 pub code_integrity_size: U32<LE>,
2425 pub patch_table: U32<LE>,
2426 /// Version 2 and later
2427 pub buffer_offset: U32<LE>,
2428}
2429
2430#[derive(Debug, Clone, Copy)]
2431#[repr(C)]
2432pub struct ImageHotPatchHashes {
2433 pub sha256: [u8; 32],
2434 pub sha1: [u8; 20],
2435}
2436
2437pub const IMAGE_HOT_PATCH_BASE_OBLIGATORY: u32 = 0x0000_0001;
2438pub const IMAGE_HOT_PATCH_BASE_CAN_ROLL_BACK: u32 = 0x0000_0002;
2439
2440pub const IMAGE_HOT_PATCH_CHUNK_INVERSE: u32 = 0x8000_0000;
2441pub const IMAGE_HOT_PATCH_CHUNK_OBLIGATORY: u32 = 0x4000_0000;
2442pub const IMAGE_HOT_PATCH_CHUNK_RESERVED: u32 = 0x3FF0_3000;
2443pub const IMAGE_HOT_PATCH_CHUNK_TYPE: u32 = 0x000F_C000;
2444pub const IMAGE_HOT_PATCH_CHUNK_SOURCE_RVA: u32 = 0x0000_8000;
2445pub const IMAGE_HOT_PATCH_CHUNK_TARGET_RVA: u32 = 0x0000_4000;
2446pub const IMAGE_HOT_PATCH_CHUNK_SIZE: u32 = 0x0000_0FFF;
2447
2448pub const IMAGE_HOT_PATCH_NONE: u32 = 0x0000_0000;
2449pub const IMAGE_HOT_PATCH_FUNCTION: u32 = 0x0001_C000;
2450pub const IMAGE_HOT_PATCH_ABSOLUTE: u32 = 0x0002_C000;
2451pub const IMAGE_HOT_PATCH_REL32: u32 = 0x0003_C000;
2452pub const IMAGE_HOT_PATCH_CALL_TARGET: u32 = 0x0004_4000;
2453pub const IMAGE_HOT_PATCH_INDIRECT: u32 = 0x0005_C000;
2454pub const IMAGE_HOT_PATCH_NO_CALL_TARGET: u32 = 0x0006_4000;
2455pub const IMAGE_HOT_PATCH_DYNAMIC_VALUE: u32 = 0x0007_8000;
2456
2457/// Module performs control flow integrity checks using system-supplied support
2458pub const IMAGE_GUARD_CF_INSTRUMENTED: u32 = 0x0000_0100;
2459/// Module performs control flow and write integrity checks
2460pub const IMAGE_GUARD_CFW_INSTRUMENTED: u32 = 0x0000_0200;
2461/// Module contains valid control flow target metadata
2462pub const IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT: u32 = 0x0000_0400;
2463/// Module does not make use of the /GS security cookie
2464pub const IMAGE_GUARD_SECURITY_COOKIE_UNUSED: u32 = 0x0000_0800;
2465/// Module supports read only delay load IAT
2466pub const IMAGE_GUARD_PROTECT_DELAYLOAD_IAT: u32 = 0x0000_1000;
2467/// Delayload import table in its own .didat section (with nothing else in it) that can be freely reprotected
2468pub const IMAGE_GUARD_DELAYLOAD_IAT_IN_ITS_OWN_SECTION: u32 = 0x0000_2000;
2469/// Module contains suppressed export information.
2470///
2471/// This also infers that the address taken taken IAT table is also present in the load config.
2472pub const IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT: u32 = 0x0000_4000;
2473/// Module enables suppression of exports
2474pub const IMAGE_GUARD_CF_ENABLE_EXPORT_SUPPRESSION: u32 = 0x0000_8000;
2475/// Module contains longjmp target information
2476pub const IMAGE_GUARD_CF_LONGJUMP_TABLE_PRESENT: u32 = 0x0001_0000;
2477/// Module contains return flow instrumentation and metadata
2478pub const IMAGE_GUARD_RF_INSTRUMENTED: u32 = 0x0002_0000;
2479/// Module requests that the OS enable return flow protection
2480pub const IMAGE_GUARD_RF_ENABLE: u32 = 0x0004_0000;
2481/// Module requests that the OS enable return flow protection in strict mode
2482pub const IMAGE_GUARD_RF_STRICT: u32 = 0x0008_0000;
2483/// Module was built with retpoline support
2484pub const IMAGE_GUARD_RETPOLINE_PRESENT: u32 = 0x0010_0000;
2485
2486/// Stride of Guard CF function table encoded in these bits (additional count of bytes per element)
2487pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_MASK: u32 = 0xF000_0000;
2488/// Shift to right-justify Guard CF function table stride
2489pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_SHIFT: u32 = 28;
2490
2491//
2492// GFIDS table entry flags.
2493//
2494
2495/// The containing GFID entry is suppressed
2496pub const IMAGE_GUARD_FLAG_FID_SUPPRESSED: u16 = 0x01;
2497/// The containing GFID entry is export suppressed
2498pub const IMAGE_GUARD_FLAG_EXPORT_SUPPRESSED: u16 = 0x02;
2499
2500//
2501// WIN CE Exception table format
2502//
2503
2504//
2505// Function table entry format. Function table is pointed to by the
2506// IMAGE_DIRECTORY_ENTRY_EXCEPTION directory entry.
2507//
2508
2509/*
2510// TODO? bitfields
2511#[derive(Debug, Clone, Copy)]
2512#[repr(C)]
2513pub struct ImageCeRuntimeFunctionEntry {
2514 pub func_start: U32<LE>,
2515 DWORD PrologLen : 8;
2516 DWORD FuncLen : 22;
2517 DWORD ThirtyTwoBit : 1;
2518 DWORD ExceptionFlag : 1;
2519}
2520*/
2521
2522#[derive(Debug, Clone, Copy)]
2523#[repr(C)]
2524pub struct ImageArmRuntimeFunctionEntry {
2525 pub begin_address: U32<LE>,
2526 pub unwind_data: U32<LE>,
2527}
2528
2529#[derive(Debug, Clone, Copy)]
2530#[repr(C)]
2531pub struct ImageArm64RuntimeFunctionEntry {
2532 pub begin_address: U32<LE>,
2533 pub unwind_data: U32<LE>,
2534}
2535
2536#[derive(Debug, Clone, Copy)]
2537#[repr(C)]
2538pub struct ImageAlpha64RuntimeFunctionEntry {
2539 pub begin_address: U64<LE>,
2540 pub end_address: U64<LE>,
2541 pub exception_handler: U64<LE>,
2542 pub handler_data: U64<LE>,
2543 pub prolog_end_address: U64<LE>,
2544}
2545
2546#[derive(Debug, Clone, Copy)]
2547#[repr(C)]
2548pub struct ImageAlphaRuntimeFunctionEntry {
2549 pub begin_address: U32<LE>,
2550 pub end_address: U32<LE>,
2551 pub exception_handler: U32<LE>,
2552 pub handler_data: U32<LE>,
2553 pub prolog_end_address: U32<LE>,
2554}
2555
2556#[derive(Debug, Clone, Copy)]
2557#[repr(C)]
2558pub struct ImageRuntimeFunctionEntry {
2559 pub begin_address: U32<LE>,
2560 pub end_address: U32<LE>,
2561 pub unwind_info_address_or_data: U32<LE>,
2562}
2563
2564//
2565// Software enclave information
2566//
2567
2568pub const IMAGE_ENCLAVE_LONG_ID_LENGTH: usize = 32;
2569pub const IMAGE_ENCLAVE_SHORT_ID_LENGTH: usize = 16;
2570
2571#[derive(Debug, Clone, Copy)]
2572#[repr(C)]
2573pub struct ImageEnclaveConfig32 {
2574 pub size: U32<LE>,
2575 pub minimum_required_config_size: U32<LE>,
2576 pub policy_flags: U32<LE>,
2577 pub number_of_imports: U32<LE>,
2578 pub import_list: U32<LE>,
2579 pub import_entry_size: U32<LE>,
2580 pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2581 pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2582 pub image_version: U32<LE>,
2583 pub security_version: U32<LE>,
2584 pub enclave_size: U32<LE>,
2585 pub number_of_threads: U32<LE>,
2586 pub enclave_flags: U32<LE>,
2587}
2588
2589#[derive(Debug, Clone, Copy)]
2590#[repr(C)]
2591pub struct ImageEnclaveConfig64 {
2592 pub size: U32<LE>,
2593 pub minimum_required_config_size: U32<LE>,
2594 pub policy_flags: U32<LE>,
2595 pub number_of_imports: U32<LE>,
2596 pub import_list: U32<LE>,
2597 pub import_entry_size: U32<LE>,
2598 pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2599 pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2600 pub image_version: U32<LE>,
2601 pub security_version: U32<LE>,
2602 pub enclave_size: U64<LE>,
2603 pub number_of_threads: U32<LE>,
2604 pub enclave_flags: U32<LE>,
2605}
2606
2607//pub const IMAGE_ENCLAVE_MINIMUM_CONFIG_SIZE: usize = FIELD_OFFSET(IMAGE_ENCLAVE_CONFIG, EnclaveFlags);
2608
2609pub const IMAGE_ENCLAVE_POLICY_DEBUGGABLE: u32 = 0x0000_0001;
2610
2611pub const IMAGE_ENCLAVE_FLAG_PRIMARY_IMAGE: u32 = 0x0000_0001;
2612
2613#[derive(Debug, Clone, Copy)]
2614#[repr(C)]
2615pub struct ImageEnclaveImport {
2616 pub match_type: U32<LE>,
2617 pub minimum_security_version: U32<LE>,
2618 pub unique_or_author_id: [u8; IMAGE_ENCLAVE_LONG_ID_LENGTH],
2619 pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2620 pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2621 pub import_name: U32<LE>,
2622 pub reserved: U32<LE>,
2623}
2624
2625pub const IMAGE_ENCLAVE_IMPORT_MATCH_NONE: u32 = 0x0000_0000;
2626pub const IMAGE_ENCLAVE_IMPORT_MATCH_UNIQUE_ID: u32 = 0x0000_0001;
2627pub const IMAGE_ENCLAVE_IMPORT_MATCH_AUTHOR_ID: u32 = 0x0000_0002;
2628pub const IMAGE_ENCLAVE_IMPORT_MATCH_FAMILY_ID: u32 = 0x0000_0003;
2629pub const IMAGE_ENCLAVE_IMPORT_MATCH_IMAGE_ID: u32 = 0x0000_0004;
2630
2631//
2632// Debug Format
2633//
2634
2635#[derive(Debug, Clone, Copy)]
2636#[repr(C)]
2637pub struct ImageDebugDirectory {
2638 pub characteristics: U32<LE>,
2639 pub time_date_stamp: U32<LE>,
2640 pub major_version: U16<LE>,
2641 pub minor_version: U16<LE>,
2642 pub typ: U32<LE>,
2643 pub size_of_data: U32<LE>,
2644 pub address_of_raw_data: U32<LE>,
2645 pub pointer_to_raw_data: U32<LE>,
2646}
2647
2648pub const IMAGE_DEBUG_TYPE_UNKNOWN: u32 = 0;
2649pub const IMAGE_DEBUG_TYPE_COFF: u32 = 1;
2650pub const IMAGE_DEBUG_TYPE_CODEVIEW: u32 = 2;
2651pub const IMAGE_DEBUG_TYPE_FPO: u32 = 3;
2652pub const IMAGE_DEBUG_TYPE_MISC: u32 = 4;
2653pub const IMAGE_DEBUG_TYPE_EXCEPTION: u32 = 5;
2654pub const IMAGE_DEBUG_TYPE_FIXUP: u32 = 6;
2655pub const IMAGE_DEBUG_TYPE_OMAP_TO_SRC: u32 = 7;
2656pub const IMAGE_DEBUG_TYPE_OMAP_FROM_SRC: u32 = 8;
2657pub const IMAGE_DEBUG_TYPE_BORLAND: u32 = 9;
2658pub const IMAGE_DEBUG_TYPE_RESERVED10: u32 = 10;
2659pub const IMAGE_DEBUG_TYPE_CLSID: u32 = 11;
2660pub const IMAGE_DEBUG_TYPE_VC_FEATURE: u32 = 12;
2661pub const IMAGE_DEBUG_TYPE_POGO: u32 = 13;
2662pub const IMAGE_DEBUG_TYPE_ILTCG: u32 = 14;
2663pub const IMAGE_DEBUG_TYPE_MPX: u32 = 15;
2664pub const IMAGE_DEBUG_TYPE_REPRO: u32 = 16;
2665
2666#[derive(Debug, Clone, Copy)]
2667#[repr(C)]
2668pub struct ImageCoffSymbolsHeader {
2669 pub number_of_symbols: U32<LE>,
2670 pub lva_to_first_symbol: U32<LE>,
2671 pub number_of_linenumbers: U32<LE>,
2672 pub lva_to_first_linenumber: U32<LE>,
2673 pub rva_to_first_byte_of_code: U32<LE>,
2674 pub rva_to_last_byte_of_code: U32<LE>,
2675 pub rva_to_first_byte_of_data: U32<LE>,
2676 pub rva_to_last_byte_of_data: U32<LE>,
2677}
2678
2679pub const FRAME_FPO: u16 = 0;
2680pub const FRAME_TRAP: u16 = 1;
2681pub const FRAME_TSS: u16 = 2;
2682pub const FRAME_NONFPO: u16 = 3;
2683
2684/*
2685// TODO? bitfields
2686#[derive(Debug, Clone, Copy)]
2687#[repr(C)]
2688pub struct FpoData {
2689/// offset 1st byte of function code
2690 pub ul_off_start: U32<LE>,
2691/// # bytes in function
2692 pub cb_proc_size: U32<LE>,
2693/// # bytes in locals/4
2694 pub cdw_locals: U32<LE>,
2695/// # bytes in params/4
2696 pub cdw_params: U16<LE>,
2697/// # bytes in prolog
2698 WORD cbProlog : 8;
2699/// # regs saved
2700 WORD cbRegs : 3;
2701/// TRUE if SEH in func
2702 WORD fHasSEH : 1;
2703/// TRUE if EBP has been allocated
2704 WORD fUseBP : 1;
2705/// reserved for future use
2706 WORD reserved : 1;
2707/// frame type
2708 WORD cbFrame : 2;
2709}
2710pub const SIZEOF_RFPO_DATA: usize = 16;
2711*/
2712
2713pub const IMAGE_DEBUG_MISC_EXENAME: u16 = 1;
2714
2715#[derive(Debug, Clone, Copy)]
2716#[repr(C)]
2717pub struct ImageDebugMisc {
2718 /// type of misc data, see defines
2719 pub data_type: U32<LE>,
2720 /// total length of record, rounded to four byte multiple.
2721 pub length: U32<LE>,
2722 /// TRUE if data is unicode string
2723 pub unicode: u8,
2724 pub reserved: [u8; 3],
2725 // Actual data
2726 //pub data: [u8; 1],
2727}
2728
2729//
2730// Function table extracted from MIPS/ALPHA/IA64 images. Does not contain
2731// information needed only for runtime support. Just those fields for
2732// each entry needed by a debugger.
2733//
2734
2735#[derive(Debug, Clone, Copy)]
2736#[repr(C)]
2737pub struct ImageFunctionEntry {
2738 pub starting_address: U32<LE>,
2739 pub ending_address: U32<LE>,
2740 pub end_of_prologue: U32<LE>,
2741}
2742
2743#[derive(Debug, Clone, Copy)]
2744#[repr(C)]
2745pub struct ImageFunctionEntry64 {
2746 pub starting_address: U64<LE>,
2747 pub ending_address: U64<LE>,
2748 pub end_of_prologue_or_unwind_info_address: U64<LE>,
2749}
2750
2751//
2752// Debugging information can be stripped from an image file and placed
2753// in a separate .DBG file, whose file name part is the same as the
2754// image file name part (e.g. symbols for CMD.EXE could be stripped
2755// and placed in CMD.DBG). This is indicated by the IMAGE_FILE_DEBUG_STRIPPED
2756// flag in the Characteristics field of the file header. The beginning of
2757// the .DBG file contains the following structure which captures certain
2758// information from the image file. This allows a debug to proceed even if
2759// the original image file is not accessible. This header is followed by
2760// zero of more IMAGE_SECTION_HEADER structures, followed by zero or more
2761// IMAGE_DEBUG_DIRECTORY structures. The latter structures and those in
2762// the image file contain file offsets relative to the beginning of the
2763// .DBG file.
2764//
2765// If symbols have been stripped from an image, the IMAGE_DEBUG_MISC structure
2766// is left in the image file, but not mapped. This allows a debugger to
2767// compute the name of the .DBG file, from the name of the image in the
2768// IMAGE_DEBUG_MISC structure.
2769//
2770
2771#[derive(Debug, Clone, Copy)]
2772#[repr(C)]
2773pub struct ImageSeparateDebugHeader {
2774 pub signature: U16<LE>,
2775 pub flags: U16<LE>,
2776 pub machine: U16<LE>,
2777 pub characteristics: U16<LE>,
2778 pub time_date_stamp: U32<LE>,
2779 pub check_sum: U32<LE>,
2780 pub image_base: U32<LE>,
2781 pub size_of_image: U32<LE>,
2782 pub number_of_sections: U32<LE>,
2783 pub exported_names_size: U32<LE>,
2784 pub debug_directory_size: U32<LE>,
2785 pub section_alignment: U32<LE>,
2786 pub reserved: [U32<LE>; 2],
2787}
2788
2789#[derive(Debug, Clone, Copy)]
2790#[repr(C)]
2791pub struct NonPagedDebugInfo {
2792 pub signature: U16<LE>,
2793 pub flags: U16<LE>,
2794 pub size: U32<LE>,
2795 pub machine: U16<LE>,
2796 pub characteristics: U16<LE>,
2797 pub time_date_stamp: U32<LE>,
2798 pub check_sum: U32<LE>,
2799 pub size_of_image: U32<LE>,
2800 pub image_base: U64<LE>,
2801 //debug_directory_size
2802 //ImageDebugDirectory
2803}
2804
2805pub const IMAGE_SEPARATE_DEBUG_SIGNATURE: u16 = 0x4944;
2806pub const NON_PAGED_DEBUG_SIGNATURE: u16 = 0x494E;
2807
2808pub const IMAGE_SEPARATE_DEBUG_FLAGS_MASK: u16 = 0x8000;
2809/// when DBG was updated, the old checksum didn't match.
2810pub const IMAGE_SEPARATE_DEBUG_MISMATCH: u16 = 0x8000;
2811
2812//
2813// The .arch section is made up of headers, each describing an amask position/value
2814// pointing to an array of IMAGE_ARCHITECTURE_ENTRY's. Each "array" (both the header
2815// and entry arrays) are terminiated by a quadword of 0xffffffffL.
2816//
2817// NOTE: There may be quadwords of 0 sprinkled around and must be skipped.
2818//
2819
2820/*
2821// TODO? bitfields
2822#[derive(Debug, Clone, Copy)]
2823#[repr(C)]
2824pub struct ImageArchitectureHeader {
2825 /// 1 -> code section depends on mask bit
2826 /// 0 -> new instruction depends on mask bit
2827 unsigned int AmaskValue: 1;
2828 /// MBZ
2829 int :7;
2830 /// Amask bit in question for this fixup
2831 unsigned int AmaskShift: 8;
2832 /// MBZ
2833 int :16;
2834 /// RVA into .arch section to array of ARCHITECTURE_ENTRY's
2835 pub first_entry_rva: U32<LE>,
2836}
2837*/
2838
2839#[derive(Debug, Clone, Copy)]
2840#[repr(C)]
2841pub struct ImageArchitectureEntry {
2842 /// RVA of instruction to fixup
2843 pub fixup_inst_rva: U32<LE>,
2844 /// fixup instruction (see alphaops.h)
2845 pub new_inst: U32<LE>,
2846}
2847
2848// The following structure defines the new import object. Note the values of the first two fields,
2849// which must be set as stated in order to differentiate old and new import members.
2850// Following this structure, the linker emits two null-terminated strings used to recreate the
2851// import at the time of use. The first string is the import's name, the second is the dll's name.
2852
2853pub const IMPORT_OBJECT_HDR_SIG2: u16 = 0xffff;
2854
2855#[derive(Debug, Clone, Copy)]
2856#[repr(C)]
2857pub struct ImportObjectHeader {
2858 /// Must be IMAGE_FILE_MACHINE_UNKNOWN
2859 pub sig1: U16<LE>,
2860 /// Must be IMPORT_OBJECT_HDR_SIG2.
2861 pub sig2: U16<LE>,
2862 pub version: U16<LE>,
2863 pub machine: U16<LE>,
2864 /// Time/date stamp
2865 pub time_date_stamp: U32<LE>,
2866 /// particularly useful for incremental links
2867 pub size_of_data: U32<LE>,
2868
2869 /// if grf & IMPORT_OBJECT_ORDINAL
2870 pub ordinal_or_hint: U16<LE>,
2871
2872 // WORD Type : 2;
2873 // WORD NameType : 3;
2874 // WORD Reserved : 11;
2875 pub name_type: U16<LE>,
2876}
2877
2878pub const IMPORT_OBJECT_TYPE_MASK: u16 = 0b11;
2879pub const IMPORT_OBJECT_TYPE_SHIFT: u16 = 0;
2880pub const IMPORT_OBJECT_CODE: u16 = 0;
2881pub const IMPORT_OBJECT_DATA: u16 = 1;
2882pub const IMPORT_OBJECT_CONST: u16 = 2;
2883
2884pub const IMPORT_OBJECT_NAME_MASK: u16 = 0b111;
2885pub const IMPORT_OBJECT_NAME_SHIFT: u16 = 2;
2886/// Import by ordinal
2887pub const IMPORT_OBJECT_ORDINAL: u16 = 0;
2888/// Import name == public symbol name.
2889pub const IMPORT_OBJECT_NAME: u16 = 1;
2890/// Import name == public symbol name skipping leading ?, @, or optionally _.
2891pub const IMPORT_OBJECT_NAME_NO_PREFIX: u16 = 2;
2892/// Import name == public symbol name skipping leading ?, @, or optionally _ and truncating at first @.
2893pub const IMPORT_OBJECT_NAME_UNDECORATE: u16 = 3;
2894/// Import name == a name is explicitly provided after the DLL name.
2895pub const IMPORT_OBJECT_NAME_EXPORTAS: u16 = 4;
2896
2897// COM+ Header entry point flags.
2898pub const COMIMAGE_FLAGS_ILONLY: u32 = 0x0000_0001;
2899pub const COMIMAGE_FLAGS_32BITREQUIRED: u32 = 0x0000_0002;
2900pub const COMIMAGE_FLAGS_IL_LIBRARY: u32 = 0x0000_0004;
2901pub const COMIMAGE_FLAGS_STRONGNAMESIGNED: u32 = 0x0000_0008;
2902pub const COMIMAGE_FLAGS_NATIVE_ENTRYPOINT: u32 = 0x0000_0010;
2903pub const COMIMAGE_FLAGS_TRACKDEBUGDATA: u32 = 0x0001_0000;
2904pub const COMIMAGE_FLAGS_32BITPREFERRED: u32 = 0x0002_0000;
2905
2906// Version flags for image.
2907pub const COR_VERSION_MAJOR_V2: u16 = 2;
2908pub const COR_VERSION_MAJOR: u16 = COR_VERSION_MAJOR_V2;
2909pub const COR_VERSION_MINOR: u16 = 5;
2910pub const COR_DELETED_NAME_LENGTH: usize = 8;
2911pub const COR_VTABLEGAP_NAME_LENGTH: usize = 8;
2912
2913// Maximum size of a NativeType descriptor.
2914pub const NATIVE_TYPE_MAX_CB: u16 = 1;
2915pub const COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE: u16 = 0xFF;
2916
2917// Consts for the MIH FLAGS
2918pub const IMAGE_COR_MIH_METHODRVA: u16 = 0x01;
2919pub const IMAGE_COR_MIH_EHRVA: u16 = 0x02;
2920pub const IMAGE_COR_MIH_BASICBLOCK: u16 = 0x08;
2921
2922// V-table constants
2923/// V-table slots are 32-bits in size.
2924pub const COR_VTABLE_32BIT: u16 = 0x01;
2925/// V-table slots are 64-bits in size.
2926pub const COR_VTABLE_64BIT: u16 = 0x02;
2927/// If set, transition from unmanaged.
2928pub const COR_VTABLE_FROM_UNMANAGED: u16 = 0x04;
2929/// If set, transition from unmanaged with keeping the current appdomain.
2930pub const COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN: u16 = 0x08;
2931/// Call most derived method described by
2932pub const COR_VTABLE_CALL_MOST_DERIVED: u16 = 0x10;
2933
2934// EATJ constants
2935/// Size of a jump thunk reserved range.
2936pub const IMAGE_COR_EATJ_THUNK_SIZE: usize = 32;
2937
2938// Max name lengths
2939pub const MAX_CLASS_NAME: usize = 1024;
2940pub const MAX_PACKAGE_NAME: usize = 1024;
2941
2942// CLR 2.0 header structure.
2943#[derive(Debug, Clone, Copy)]
2944#[repr(C)]
2945pub struct ImageCor20Header {
2946 // Header versioning
2947 pub cb: U32<LE>,
2948 pub major_runtime_version: U16<LE>,
2949 pub minor_runtime_version: U16<LE>,
2950
2951 // Symbol table and startup information
2952 pub meta_data: ImageDataDirectory,
2953 pub flags: U32<LE>,
2954
2955 // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is not set, EntryPointToken represents a managed entrypoint.
2956 // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is set, EntryPointRVA represents an RVA to a native entrypoint.
2957 pub entry_point_token_or_rva: U32<LE>,
2958
2959 // Binding information
2960 pub resources: ImageDataDirectory,
2961 pub strong_name_signature: ImageDataDirectory,
2962
2963 // Regular fixup and binding information
2964 pub code_manager_table: ImageDataDirectory,
2965 pub vtable_fixups: ImageDataDirectory,
2966 pub export_address_table_jumps: ImageDataDirectory,
2967
2968 // Precompiled image info (internal use only - set to zero)
2969 pub managed_native_header: ImageDataDirectory,
2970}
2971
2972unsafe_impl_pod!(
2973 ImageDosHeader,
2974 ImageOs2Header,
2975 ImageVxdHeader,
2976 ImageFileHeader,
2977 ImageDataDirectory,
2978 ImageOptionalHeader32,
2979 ImageRomOptionalHeader,
2980 ImageOptionalHeader64,
2981 ImageNtHeaders64,
2982 ImageNtHeaders32,
2983 ImageRomHeaders,
2984 Guid,
2985 AnonObjectHeader,
2986 AnonObjectHeaderV2,
2987 AnonObjectHeaderBigobj,
2988 ImageSectionHeader,
2989 ImageSymbol,
2990 ImageSymbolBytes,
2991 ImageSymbolEx,
2992 ImageSymbolExBytes,
2993 ImageAuxSymbolTokenDef,
2994 ImageAuxSymbolFunction,
2995 ImageAuxSymbolFunctionBeginEnd,
2996 ImageAuxSymbolWeak,
2997 ImageAuxSymbolSection,
2998 ImageAuxSymbolCrc,
2999 ImageRelocation,
3000 ImageLinenumber,
3001 ImageBaseRelocation,
3002 ImageArchiveMemberHeader,
3003 ImageExportDirectory,
3004 ImageImportByName,
3005 ImageThunkData64,
3006 ImageThunkData32,
3007 ImageTlsDirectory64,
3008 ImageTlsDirectory32,
3009 ImageImportDescriptor,
3010 ImageBoundImportDescriptor,
3011 ImageBoundForwarderRef,
3012 ImageDelayloadDescriptor,
3013 ImageResourceDirectory,
3014 ImageResourceDirectoryEntry,
3015 ImageResourceDirectoryString,
3016 ImageResourceDirStringU,
3017 ImageResourceDataEntry,
3018 ImageLoadConfigCodeIntegrity,
3019 ImageDynamicRelocationTable,
3020 ImageDynamicRelocation32,
3021 ImageDynamicRelocation64,
3022 ImageDynamicRelocation32V2,
3023 ImageDynamicRelocation64V2,
3024 ImagePrologueDynamicRelocationHeader,
3025 ImageEpilogueDynamicRelocationHeader,
3026 //ImageImportControlTransferDynamicRelocation,
3027 //ImageIndirControlTransferDynamicRelocation,
3028 //ImageSwitchtableBranchDynamicRelocation,
3029 ImageLoadConfigDirectory32,
3030 ImageLoadConfigDirectory64,
3031 ImageHotPatchInfo,
3032 ImageHotPatchBase,
3033 ImageHotPatchHashes,
3034 //ImageCeRuntimeFunctionEntry,
3035 ImageArmRuntimeFunctionEntry,
3036 ImageArm64RuntimeFunctionEntry,
3037 ImageAlpha64RuntimeFunctionEntry,
3038 ImageAlphaRuntimeFunctionEntry,
3039 ImageRuntimeFunctionEntry,
3040 ImageEnclaveConfig32,
3041 ImageEnclaveConfig64,
3042 ImageEnclaveImport,
3043 ImageDebugDirectory,
3044 ImageCoffSymbolsHeader,
3045 //FpoData,
3046 ImageDebugMisc,
3047 ImageFunctionEntry,
3048 ImageFunctionEntry64,
3049 ImageSeparateDebugHeader,
3050 NonPagedDebugInfo,
3051 //ImageArchitectureHeader,
3052 ImageArchitectureEntry,
3053 ImportObjectHeader,
3054 ImageCor20Header,
3055 MaskedRichHeaderEntry,
3056);
3057