1//! PE/COFF definitions.
2//!
3//! These definitions are independent of read/write support, although we do implement
4//! some traits useful for those.
5//!
6//! This module is based heavily on "winnt.h" (10.0.17763.0).
7
8#![allow(missing_docs)]
9
10use core::convert::TryInto;
11
12use crate::endian::{I32Bytes, LittleEndian as LE, U16Bytes, U32Bytes, I32, U16, U32, U64};
13use crate::pod::Pod;
14
15/// MZ
16pub const IMAGE_DOS_SIGNATURE: u16 = 0x5A4D;
17/// NE
18pub const IMAGE_OS2_SIGNATURE: u16 = 0x454E;
19/// LE
20pub const IMAGE_OS2_SIGNATURE_LE: u16 = 0x454C;
21/// LE
22pub const IMAGE_VXD_SIGNATURE: u16 = 0x454C;
23/// PE00
24pub const IMAGE_NT_SIGNATURE: u32 = 0x0000_4550;
25
26/// DOS .EXE header
27#[derive(Debug, Clone, Copy)]
28#[repr(C)]
29pub struct ImageDosHeader {
30 /// Magic number
31 pub e_magic: U16<LE>,
32 /// Bytes on last page of file
33 pub e_cblp: U16<LE>,
34 /// Pages in file
35 pub e_cp: U16<LE>,
36 /// Relocations
37 pub e_crlc: U16<LE>,
38 /// Size of header in paragraphs
39 pub e_cparhdr: U16<LE>,
40 /// Minimum extra paragraphs needed
41 pub e_minalloc: U16<LE>,
42 /// Maximum extra paragraphs needed
43 pub e_maxalloc: U16<LE>,
44 /// Initial (relative) SS value
45 pub e_ss: U16<LE>,
46 /// Initial SP value
47 pub e_sp: U16<LE>,
48 /// Checksum
49 pub e_csum: U16<LE>,
50 /// Initial IP value
51 pub e_ip: U16<LE>,
52 /// Initial (relative) CS value
53 pub e_cs: U16<LE>,
54 /// File address of relocation table
55 pub e_lfarlc: U16<LE>,
56 /// Overlay number
57 pub e_ovno: U16<LE>,
58 /// Reserved words
59 pub e_res: [U16<LE>; 4],
60 /// OEM identifier (for e_oeminfo)
61 pub e_oemid: U16<LE>,
62 /// OEM information; e_oemid specific
63 pub e_oeminfo: U16<LE>,
64 /// Reserved words
65 pub e_res2: [U16<LE>; 10],
66 /// File address of new exe header
67 pub e_lfanew: U32<LE>,
68}
69
70/// OS/2 .EXE header
71#[derive(Debug, Clone, Copy)]
72#[repr(C)]
73pub struct ImageOs2Header {
74 /// Magic number
75 pub ne_magic: U16<LE>,
76 /// Version number
77 pub ne_ver: i8,
78 /// Revision number
79 pub ne_rev: i8,
80 /// Offset of Entry Table
81 pub ne_enttab: U16<LE>,
82 /// Number of bytes in Entry Table
83 pub ne_cbenttab: U16<LE>,
84 /// Checksum of whole file
85 pub ne_crc: I32<LE>,
86 /// Flag word
87 pub ne_flags: U16<LE>,
88 /// Automatic data segment number
89 pub ne_autodata: U16<LE>,
90 /// Initial heap allocation
91 pub ne_heap: U16<LE>,
92 /// Initial stack allocation
93 pub ne_stack: U16<LE>,
94 /// Initial CS:IP setting
95 pub ne_csip: I32<LE>,
96 /// Initial SS:SP setting
97 pub ne_sssp: I32<LE>,
98 /// Count of file segments
99 pub ne_cseg: U16<LE>,
100 /// Entries in Module Reference Table
101 pub ne_cmod: U16<LE>,
102 /// Size of non-resident name table
103 pub ne_cbnrestab: U16<LE>,
104 /// Offset of Segment Table
105 pub ne_segtab: U16<LE>,
106 /// Offset of Resource Table
107 pub ne_rsrctab: U16<LE>,
108 /// Offset of resident name table
109 pub ne_restab: U16<LE>,
110 /// Offset of Module Reference Table
111 pub ne_modtab: U16<LE>,
112 /// Offset of Imported Names Table
113 pub ne_imptab: U16<LE>,
114 /// Offset of Non-resident Names Table
115 pub ne_nrestab: I32<LE>,
116 /// Count of movable entries
117 pub ne_cmovent: U16<LE>,
118 /// Segment alignment shift count
119 pub ne_align: U16<LE>,
120 /// Count of resource segments
121 pub ne_cres: U16<LE>,
122 /// Target Operating system
123 pub ne_exetyp: u8,
124 /// Other .EXE flags
125 pub ne_flagsothers: u8,
126 /// offset to return thunks
127 pub ne_pretthunks: U16<LE>,
128 /// offset to segment ref. bytes
129 pub ne_psegrefbytes: U16<LE>,
130 /// Minimum code swap area size
131 pub ne_swaparea: U16<LE>,
132 /// Expected Windows version number
133 pub ne_expver: U16<LE>,
134}
135
136/// Windows VXD header
137#[derive(Debug, Clone, Copy)]
138#[repr(C)]
139pub struct ImageVxdHeader {
140 /// Magic number
141 pub e32_magic: U16<LE>,
142 /// The byte ordering for the VXD
143 pub e32_border: u8,
144 /// The word ordering for the VXD
145 pub e32_worder: u8,
146 /// The EXE format level for now = 0
147 pub e32_level: U32<LE>,
148 /// The CPU type
149 pub e32_cpu: U16<LE>,
150 /// The OS type
151 pub e32_os: U16<LE>,
152 /// Module version
153 pub e32_ver: U32<LE>,
154 /// Module flags
155 pub e32_mflags: U32<LE>,
156 /// Module # pages
157 pub e32_mpages: U32<LE>,
158 /// Object # for instruction pointer
159 pub e32_startobj: U32<LE>,
160 /// Extended instruction pointer
161 pub e32_eip: U32<LE>,
162 /// Object # for stack pointer
163 pub e32_stackobj: U32<LE>,
164 /// Extended stack pointer
165 pub e32_esp: U32<LE>,
166 /// VXD page size
167 pub e32_pagesize: U32<LE>,
168 /// Last page size in VXD
169 pub e32_lastpagesize: U32<LE>,
170 /// Fixup section size
171 pub e32_fixupsize: U32<LE>,
172 /// Fixup section checksum
173 pub e32_fixupsum: U32<LE>,
174 /// Loader section size
175 pub e32_ldrsize: U32<LE>,
176 /// Loader section checksum
177 pub e32_ldrsum: U32<LE>,
178 /// Object table offset
179 pub e32_objtab: U32<LE>,
180 /// Number of objects in module
181 pub e32_objcnt: U32<LE>,
182 /// Object page map offset
183 pub e32_objmap: U32<LE>,
184 /// Object iterated data map offset
185 pub e32_itermap: U32<LE>,
186 /// Offset of Resource Table
187 pub e32_rsrctab: U32<LE>,
188 /// Number of resource entries
189 pub e32_rsrccnt: U32<LE>,
190 /// Offset of resident name table
191 pub e32_restab: U32<LE>,
192 /// Offset of Entry Table
193 pub e32_enttab: U32<LE>,
194 /// Offset of Module Directive Table
195 pub e32_dirtab: U32<LE>,
196 /// Number of module directives
197 pub e32_dircnt: U32<LE>,
198 /// Offset of Fixup Page Table
199 pub e32_fpagetab: U32<LE>,
200 /// Offset of Fixup Record Table
201 pub e32_frectab: U32<LE>,
202 /// Offset of Import Module Name Table
203 pub e32_impmod: U32<LE>,
204 /// Number of entries in Import Module Name Table
205 pub e32_impmodcnt: U32<LE>,
206 /// Offset of Import Procedure Name Table
207 pub e32_impproc: U32<LE>,
208 /// Offset of Per-Page Checksum Table
209 pub e32_pagesum: U32<LE>,
210 /// Offset of Enumerated Data Pages
211 pub e32_datapage: U32<LE>,
212 /// Number of preload pages
213 pub e32_preload: U32<LE>,
214 /// Offset of Non-resident Names Table
215 pub e32_nrestab: U32<LE>,
216 /// Size of Non-resident Name Table
217 pub e32_cbnrestab: U32<LE>,
218 /// Non-resident Name Table Checksum
219 pub e32_nressum: U32<LE>,
220 /// Object # for automatic data object
221 pub e32_autodata: U32<LE>,
222 /// Offset of the debugging information
223 pub e32_debuginfo: U32<LE>,
224 /// The length of the debugging info. in bytes
225 pub e32_debuglen: U32<LE>,
226 /// Number of instance pages in preload section of VXD file
227 pub e32_instpreload: U32<LE>,
228 /// Number of instance pages in demand load section of VXD file
229 pub e32_instdemand: U32<LE>,
230 /// Size of heap - for 16-bit apps
231 pub e32_heapsize: U32<LE>,
232 /// Reserved words
233 pub e32_res3: [u8; 12],
234 pub e32_winresoff: U32<LE>,
235 pub e32_winreslen: U32<LE>,
236 /// Device ID for VxD
237 pub e32_devid: U16<LE>,
238 /// DDK version for VxD
239 pub e32_ddkver: U16<LE>,
240}
241
242/// A PE rich header entry.
243///
244/// Rich headers have no official documentation, but have been heavily
245/// reversed-engineered and documented in the wild, e.g.:
246/// * `http://www.ntcore.com/files/richsign.htm`
247/// * `https://www.researchgate.net/figure/Structure-of-the-Rich-Header_fig1_318145388`
248///
249/// This data is "masked", i.e. XORed with a checksum derived from the file data.
250#[derive(Debug, Clone, Copy)]
251#[repr(C)]
252pub struct MaskedRichHeaderEntry {
253 pub masked_comp_id: U32<LE>,
254 pub masked_count: U32<LE>,
255}
256
257//
258// File header format.
259//
260
261#[derive(Debug, Clone, Copy)]
262#[repr(C)]
263pub struct ImageFileHeader {
264 pub machine: U16<LE>,
265 pub number_of_sections: U16<LE>,
266 pub time_date_stamp: U32<LE>,
267 pub pointer_to_symbol_table: U32<LE>,
268 pub number_of_symbols: U32<LE>,
269 pub size_of_optional_header: U16<LE>,
270 pub characteristics: U16<LE>,
271}
272
273pub const IMAGE_SIZEOF_FILE_HEADER: usize = 20;
274
275/// Relocation info stripped from file.
276pub const IMAGE_FILE_RELOCS_STRIPPED: u16 = 0x0001;
277/// File is executable (i.e. no unresolved external references).
278pub const IMAGE_FILE_EXECUTABLE_IMAGE: u16 = 0x0002;
279/// Line numbers stripped from file.
280pub const IMAGE_FILE_LINE_NUMS_STRIPPED: u16 = 0x0004;
281/// Local symbols stripped from file.
282pub const IMAGE_FILE_LOCAL_SYMS_STRIPPED: u16 = 0x0008;
283/// Aggressively trim working set
284pub const IMAGE_FILE_AGGRESIVE_WS_TRIM: u16 = 0x0010;
285/// App can handle >2gb addresses
286pub const IMAGE_FILE_LARGE_ADDRESS_AWARE: u16 = 0x0020;
287/// Bytes of machine word are reversed.
288pub const IMAGE_FILE_BYTES_REVERSED_LO: u16 = 0x0080;
289/// 32 bit word machine.
290pub const IMAGE_FILE_32BIT_MACHINE: u16 = 0x0100;
291/// Debugging info stripped from file in .DBG file
292pub const IMAGE_FILE_DEBUG_STRIPPED: u16 = 0x0200;
293/// If Image is on removable media, copy and run from the swap file.
294pub const IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP: u16 = 0x0400;
295/// If Image is on Net, copy and run from the swap file.
296pub const IMAGE_FILE_NET_RUN_FROM_SWAP: u16 = 0x0800;
297/// System File.
298pub const IMAGE_FILE_SYSTEM: u16 = 0x1000;
299/// File is a DLL.
300pub const IMAGE_FILE_DLL: u16 = 0x2000;
301/// File should only be run on a UP machine
302pub const IMAGE_FILE_UP_SYSTEM_ONLY: u16 = 0x4000;
303/// Bytes of machine word are reversed.
304pub const IMAGE_FILE_BYTES_REVERSED_HI: u16 = 0x8000;
305
306pub const IMAGE_FILE_MACHINE_UNKNOWN: u16 = 0;
307/// Useful for indicating we want to interact with the host and not a WoW guest.
308pub const IMAGE_FILE_MACHINE_TARGET_HOST: u16 = 0x0001;
309/// Intel 386.
310pub const IMAGE_FILE_MACHINE_I386: u16 = 0x014c;
311/// MIPS little-endian, 0x160 big-endian
312pub const IMAGE_FILE_MACHINE_R3000: u16 = 0x0162;
313/// MIPS little-endian
314pub const IMAGE_FILE_MACHINE_R4000: u16 = 0x0166;
315/// MIPS little-endian
316pub const IMAGE_FILE_MACHINE_R10000: u16 = 0x0168;
317/// MIPS little-endian WCE v2
318pub const IMAGE_FILE_MACHINE_WCEMIPSV2: u16 = 0x0169;
319/// Alpha_AXP
320pub const IMAGE_FILE_MACHINE_ALPHA: u16 = 0x0184;
321/// SH3 little-endian
322pub const IMAGE_FILE_MACHINE_SH3: u16 = 0x01a2;
323pub const IMAGE_FILE_MACHINE_SH3DSP: u16 = 0x01a3;
324/// SH3E little-endian
325pub const IMAGE_FILE_MACHINE_SH3E: u16 = 0x01a4;
326/// SH4 little-endian
327pub const IMAGE_FILE_MACHINE_SH4: u16 = 0x01a6;
328/// SH5
329pub const IMAGE_FILE_MACHINE_SH5: u16 = 0x01a8;
330/// ARM Little-Endian
331pub const IMAGE_FILE_MACHINE_ARM: u16 = 0x01c0;
332/// ARM Thumb/Thumb-2 Little-Endian
333pub const IMAGE_FILE_MACHINE_THUMB: u16 = 0x01c2;
334/// ARM Thumb-2 Little-Endian
335pub const IMAGE_FILE_MACHINE_ARMNT: u16 = 0x01c4;
336pub const IMAGE_FILE_MACHINE_AM33: u16 = 0x01d3;
337/// IBM PowerPC Little-Endian
338pub const IMAGE_FILE_MACHINE_POWERPC: u16 = 0x01F0;
339pub const IMAGE_FILE_MACHINE_POWERPCFP: u16 = 0x01f1;
340/// Intel 64
341pub const IMAGE_FILE_MACHINE_IA64: u16 = 0x0200;
342/// MIPS
343pub const IMAGE_FILE_MACHINE_MIPS16: u16 = 0x0266;
344/// ALPHA64
345pub const IMAGE_FILE_MACHINE_ALPHA64: u16 = 0x0284;
346/// MIPS
347pub const IMAGE_FILE_MACHINE_MIPSFPU: u16 = 0x0366;
348/// MIPS
349pub const IMAGE_FILE_MACHINE_MIPSFPU16: u16 = 0x0466;
350pub const IMAGE_FILE_MACHINE_AXP64: u16 = IMAGE_FILE_MACHINE_ALPHA64;
351/// Infineon
352pub const IMAGE_FILE_MACHINE_TRICORE: u16 = 0x0520;
353pub const IMAGE_FILE_MACHINE_CEF: u16 = 0x0CEF;
354/// EFI Byte Code
355pub const IMAGE_FILE_MACHINE_EBC: u16 = 0x0EBC;
356/// AMD64 (K8)
357pub const IMAGE_FILE_MACHINE_AMD64: u16 = 0x8664;
358/// M32R little-endian
359pub const IMAGE_FILE_MACHINE_M32R: u16 = 0x9041;
360/// ARM64 Little-Endian
361pub const IMAGE_FILE_MACHINE_ARM64: u16 = 0xAA64;
362/// ARM64EC ("Emulation Compatible")
363pub const IMAGE_FILE_MACHINE_ARM64EC: u16 = 0xA641;
364pub const IMAGE_FILE_MACHINE_CEE: u16 = 0xC0EE;
365/// RISCV32
366pub const IMAGE_FILE_MACHINE_RISCV32: u16 = 0x5032;
367/// RISCV64
368pub const IMAGE_FILE_MACHINE_RISCV64: u16 = 0x5064;
369/// RISCV128
370pub const IMAGE_FILE_MACHINE_RISCV128: u16 = 0x5128;
371/// ARM64X (Mixed ARM64 and ARM64EC)
372pub const IMAGE_FILE_MACHINE_ARM64X: u16 = 0xA64E;
373/// CHPE x86 ("Compiled Hybrid Portable Executable")
374pub const IMAGE_FILE_MACHINE_CHPE_X86: u16 = 0x3A64;
375
376//
377// Directory format.
378//
379
380#[derive(Debug, Clone, Copy)]
381#[repr(C)]
382pub struct ImageDataDirectory {
383 pub virtual_address: U32<LE>,
384 pub size: U32<LE>,
385}
386
387pub const IMAGE_NUMBEROF_DIRECTORY_ENTRIES: usize = 16;
388
389//
390// Optional header format.
391//
392
393#[derive(Debug, Clone, Copy)]
394#[repr(C)]
395pub struct ImageOptionalHeader32 {
396 // Standard fields.
397 pub magic: U16<LE>,
398 pub major_linker_version: u8,
399 pub minor_linker_version: u8,
400 pub size_of_code: U32<LE>,
401 pub size_of_initialized_data: U32<LE>,
402 pub size_of_uninitialized_data: U32<LE>,
403 pub address_of_entry_point: U32<LE>,
404 pub base_of_code: U32<LE>,
405 pub base_of_data: U32<LE>,
406
407 // NT additional fields.
408 pub image_base: U32<LE>,
409 pub section_alignment: U32<LE>,
410 pub file_alignment: U32<LE>,
411 pub major_operating_system_version: U16<LE>,
412 pub minor_operating_system_version: U16<LE>,
413 pub major_image_version: U16<LE>,
414 pub minor_image_version: U16<LE>,
415 pub major_subsystem_version: U16<LE>,
416 pub minor_subsystem_version: U16<LE>,
417 pub win32_version_value: U32<LE>,
418 pub size_of_image: U32<LE>,
419 pub size_of_headers: U32<LE>,
420 pub check_sum: U32<LE>,
421 pub subsystem: U16<LE>,
422 pub dll_characteristics: U16<LE>,
423 pub size_of_stack_reserve: U32<LE>,
424 pub size_of_stack_commit: U32<LE>,
425 pub size_of_heap_reserve: U32<LE>,
426 pub size_of_heap_commit: U32<LE>,
427 pub loader_flags: U32<LE>,
428 pub number_of_rva_and_sizes: U32<LE>,
429 //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
430}
431
432#[derive(Debug, Clone, Copy)]
433#[repr(C)]
434pub struct ImageRomOptionalHeader {
435 pub magic: U16<LE>,
436 pub major_linker_version: u8,
437 pub minor_linker_version: u8,
438 pub size_of_code: U32<LE>,
439 pub size_of_initialized_data: U32<LE>,
440 pub size_of_uninitialized_data: U32<LE>,
441 pub address_of_entry_point: U32<LE>,
442 pub base_of_code: U32<LE>,
443 pub base_of_data: U32<LE>,
444 pub base_of_bss: U32<LE>,
445 pub gpr_mask: U32<LE>,
446 pub cpr_mask: [U32<LE>; 4],
447 pub gp_value: U32<LE>,
448}
449
450#[derive(Debug, Clone, Copy)]
451#[repr(C)]
452pub struct ImageOptionalHeader64 {
453 pub magic: U16<LE>,
454 pub major_linker_version: u8,
455 pub minor_linker_version: u8,
456 pub size_of_code: U32<LE>,
457 pub size_of_initialized_data: U32<LE>,
458 pub size_of_uninitialized_data: U32<LE>,
459 pub address_of_entry_point: U32<LE>,
460 pub base_of_code: U32<LE>,
461 pub image_base: U64<LE>,
462 pub section_alignment: U32<LE>,
463 pub file_alignment: U32<LE>,
464 pub major_operating_system_version: U16<LE>,
465 pub minor_operating_system_version: U16<LE>,
466 pub major_image_version: U16<LE>,
467 pub minor_image_version: U16<LE>,
468 pub major_subsystem_version: U16<LE>,
469 pub minor_subsystem_version: U16<LE>,
470 pub win32_version_value: U32<LE>,
471 pub size_of_image: U32<LE>,
472 pub size_of_headers: U32<LE>,
473 pub check_sum: U32<LE>,
474 pub subsystem: U16<LE>,
475 pub dll_characteristics: U16<LE>,
476 pub size_of_stack_reserve: U64<LE>,
477 pub size_of_stack_commit: U64<LE>,
478 pub size_of_heap_reserve: U64<LE>,
479 pub size_of_heap_commit: U64<LE>,
480 pub loader_flags: U32<LE>,
481 pub number_of_rva_and_sizes: U32<LE>,
482 //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
483}
484
485pub const IMAGE_NT_OPTIONAL_HDR32_MAGIC: u16 = 0x10b;
486pub const IMAGE_NT_OPTIONAL_HDR64_MAGIC: u16 = 0x20b;
487pub const IMAGE_ROM_OPTIONAL_HDR_MAGIC: u16 = 0x107;
488
489#[derive(Debug, Clone, Copy)]
490#[repr(C)]
491pub struct ImageNtHeaders64 {
492 pub signature: U32<LE>,
493 pub file_header: ImageFileHeader,
494 pub optional_header: ImageOptionalHeader64,
495}
496
497#[derive(Debug, Clone, Copy)]
498#[repr(C)]
499pub struct ImageNtHeaders32 {
500 pub signature: U32<LE>,
501 pub file_header: ImageFileHeader,
502 pub optional_header: ImageOptionalHeader32,
503}
504
505#[derive(Debug, Clone, Copy)]
506#[repr(C)]
507pub struct ImageRomHeaders {
508 pub file_header: ImageFileHeader,
509 pub optional_header: ImageRomOptionalHeader,
510}
511
512// Values for `ImageOptionalHeader*::subsystem`.
513
514/// Unknown subsystem.
515pub const IMAGE_SUBSYSTEM_UNKNOWN: u16 = 0;
516/// Image doesn't require a subsystem.
517pub const IMAGE_SUBSYSTEM_NATIVE: u16 = 1;
518/// Image runs in the Windows GUI subsystem.
519pub const IMAGE_SUBSYSTEM_WINDOWS_GUI: u16 = 2;
520/// Image runs in the Windows character subsystem.
521pub const IMAGE_SUBSYSTEM_WINDOWS_CUI: u16 = 3;
522/// image runs in the OS/2 character subsystem.
523pub const IMAGE_SUBSYSTEM_OS2_CUI: u16 = 5;
524/// image runs in the Posix character subsystem.
525pub const IMAGE_SUBSYSTEM_POSIX_CUI: u16 = 7;
526/// image is a native Win9x driver.
527pub const IMAGE_SUBSYSTEM_NATIVE_WINDOWS: u16 = 8;
528/// Image runs in the Windows CE subsystem.
529pub const IMAGE_SUBSYSTEM_WINDOWS_CE_GUI: u16 = 9;
530pub const IMAGE_SUBSYSTEM_EFI_APPLICATION: u16 = 10;
531pub const IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER: u16 = 11;
532pub const IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER: u16 = 12;
533pub const IMAGE_SUBSYSTEM_EFI_ROM: u16 = 13;
534pub const IMAGE_SUBSYSTEM_XBOX: u16 = 14;
535pub const IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION: u16 = 16;
536pub const IMAGE_SUBSYSTEM_XBOX_CODE_CATALOG: u16 = 17;
537
538// Values for `ImageOptionalHeader*::dll_characteristics`.
539
540// IMAGE_LIBRARY_PROCESS_INIT 0x0001 // Reserved.
541// IMAGE_LIBRARY_PROCESS_TERM 0x0002 // Reserved.
542// IMAGE_LIBRARY_THREAD_INIT 0x0004 // Reserved.
543// IMAGE_LIBRARY_THREAD_TERM 0x0008 // Reserved.
544/// Image can handle a high entropy 64-bit virtual address space.
545pub const IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA: u16 = 0x0020;
546/// DLL can move.
547pub const IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE: u16 = 0x0040;
548/// Code Integrity Image
549pub const IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY: u16 = 0x0080;
550/// Image is NX compatible
551pub const IMAGE_DLLCHARACTERISTICS_NX_COMPAT: u16 = 0x0100;
552/// Image understands isolation and doesn't want it
553pub const IMAGE_DLLCHARACTERISTICS_NO_ISOLATION: u16 = 0x0200;
554/// Image does not use SEH. No SE handler may reside in this image
555pub const IMAGE_DLLCHARACTERISTICS_NO_SEH: u16 = 0x0400;
556/// Do not bind this image.
557pub const IMAGE_DLLCHARACTERISTICS_NO_BIND: u16 = 0x0800;
558/// Image should execute in an AppContainer
559pub const IMAGE_DLLCHARACTERISTICS_APPCONTAINER: u16 = 0x1000;
560/// Driver uses WDM model
561pub const IMAGE_DLLCHARACTERISTICS_WDM_DRIVER: u16 = 0x2000;
562/// Image supports Control Flow Guard.
563pub const IMAGE_DLLCHARACTERISTICS_GUARD_CF: u16 = 0x4000;
564pub const IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE: u16 = 0x8000;
565
566// Indices for `ImageOptionalHeader*::data_directory`.
567
568/// Export Directory
569pub const IMAGE_DIRECTORY_ENTRY_EXPORT: usize = 0;
570/// Import Directory
571pub const IMAGE_DIRECTORY_ENTRY_IMPORT: usize = 1;
572/// Resource Directory
573pub const IMAGE_DIRECTORY_ENTRY_RESOURCE: usize = 2;
574/// Exception Directory
575pub const IMAGE_DIRECTORY_ENTRY_EXCEPTION: usize = 3;
576/// Security Directory
577pub const IMAGE_DIRECTORY_ENTRY_SECURITY: usize = 4;
578/// Base Relocation Table
579pub const IMAGE_DIRECTORY_ENTRY_BASERELOC: usize = 5;
580/// Debug Directory
581pub const IMAGE_DIRECTORY_ENTRY_DEBUG: usize = 6;
582// IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // (X86 usage)
583/// Architecture Specific Data
584pub const IMAGE_DIRECTORY_ENTRY_ARCHITECTURE: usize = 7;
585/// RVA of GP
586pub const IMAGE_DIRECTORY_ENTRY_GLOBALPTR: usize = 8;
587/// TLS Directory
588pub const IMAGE_DIRECTORY_ENTRY_TLS: usize = 9;
589/// Load Configuration Directory
590pub const IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG: usize = 10;
591/// Bound Import Directory in headers
592pub const IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT: usize = 11;
593/// Import Address Table
594pub const IMAGE_DIRECTORY_ENTRY_IAT: usize = 12;
595/// Delay Load Import Descriptors
596pub const IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT: usize = 13;
597/// COM Runtime descriptor
598pub const IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR: usize = 14;
599
600#[derive(Debug, Clone, Copy, PartialEq, Eq)]
601#[repr(C)]
602pub struct Guid(pub [u8; 16]);
603
604impl Guid {
605 #[inline]
606 pub fn data1(self) -> U32<LE> {
607 U32::from_bytes(self.0[0..4].try_into().unwrap())
608 }
609
610 #[inline]
611 pub fn data2(self) -> U16<LE> {
612 U16::from_bytes(self.0[4..6].try_into().unwrap())
613 }
614
615 #[inline]
616 pub fn data3(self) -> U16<LE> {
617 U16::from_bytes(self.0[6..8].try_into().unwrap())
618 }
619
620 #[inline]
621 pub fn data4(self) -> [u8; 8] {
622 self.0[8..16].try_into().unwrap()
623 }
624}
625
626pub use Guid as ClsId;
627
628/// Non-COFF Object file header
629#[derive(Debug, Clone, Copy)]
630#[repr(C)]
631pub struct AnonObjectHeader {
632 /// Must be IMAGE_FILE_MACHINE_UNKNOWN
633 pub sig1: U16<LE>,
634 /// Must be 0xffff
635 pub sig2: U16<LE>,
636 /// >= 1 (implies the ClsId field is present)
637 pub version: U16<LE>,
638 pub machine: U16<LE>,
639 pub time_date_stamp: U32<LE>,
640 /// Used to invoke CoCreateInstance
641 pub class_id: ClsId,
642 /// Size of data that follows the header
643 pub size_of_data: U32<LE>,
644}
645
646#[derive(Debug, Clone, Copy)]
647#[repr(C)]
648pub struct AnonObjectHeaderV2 {
649 /// Must be IMAGE_FILE_MACHINE_UNKNOWN
650 pub sig1: U16<LE>,
651 /// Must be 0xffff
652 pub sig2: U16<LE>,
653 /// >= 2 (implies the Flags field is present - otherwise V1)
654 pub version: U16<LE>,
655 pub machine: U16<LE>,
656 pub time_date_stamp: U32<LE>,
657 /// Used to invoke CoCreateInstance
658 pub class_id: ClsId,
659 /// Size of data that follows the header
660 pub size_of_data: U32<LE>,
661 /// 0x1 -> contains metadata
662 pub flags: U32<LE>,
663 /// Size of CLR metadata
664 pub meta_data_size: U32<LE>,
665 /// Offset of CLR metadata
666 pub meta_data_offset: U32<LE>,
667}
668
669/// The required value of `AnonObjectHeaderBigobj::class_id`.
670pub const ANON_OBJECT_HEADER_BIGOBJ_CLASS_ID: ClsId = ClsId([
671 0xC7, 0xA1, 0xBA, 0xD1, 0xEE, 0xBA, 0xA9, 0x4B, 0xAF, 0x20, 0xFA, 0xF6, 0x6A, 0xA4, 0xDC, 0xB8,
672]);
673
674#[derive(Debug, Clone, Copy)]
675#[repr(C)]
676pub struct AnonObjectHeaderBigobj {
677 /* same as ANON_OBJECT_HEADER_V2 */
678 /// Must be IMAGE_FILE_MACHINE_UNKNOWN
679 pub sig1: U16<LE>,
680 /// Must be 0xffff
681 pub sig2: U16<LE>,
682 /// >= 2 (implies the Flags field is present)
683 pub version: U16<LE>,
684 /// Actual machine - IMAGE_FILE_MACHINE_xxx
685 pub machine: U16<LE>,
686 pub time_date_stamp: U32<LE>,
687 /// Must be `ANON_OBJECT_HEADER_BIGOBJ_CLASS_ID`.
688 pub class_id: ClsId,
689 /// Size of data that follows the header
690 pub size_of_data: U32<LE>,
691 /// 0x1 -> contains metadata
692 pub flags: U32<LE>,
693 /// Size of CLR metadata
694 pub meta_data_size: U32<LE>,
695 /// Offset of CLR metadata
696 pub meta_data_offset: U32<LE>,
697
698 /* bigobj specifics */
699 /// extended from WORD
700 pub number_of_sections: U32<LE>,
701 pub pointer_to_symbol_table: U32<LE>,
702 pub number_of_symbols: U32<LE>,
703}
704
705pub const IMAGE_SIZEOF_SHORT_NAME: usize = 8;
706
707//
708// Section header format.
709//
710
711#[derive(Debug, Default, Clone, Copy)]
712#[repr(C)]
713pub struct ImageSectionHeader {
714 pub name: [u8; IMAGE_SIZEOF_SHORT_NAME],
715 pub virtual_size: U32<LE>,
716 pub virtual_address: U32<LE>,
717 pub size_of_raw_data: U32<LE>,
718 pub pointer_to_raw_data: U32<LE>,
719 pub pointer_to_relocations: U32<LE>,
720 pub pointer_to_linenumbers: U32<LE>,
721 pub number_of_relocations: U16<LE>,
722 pub number_of_linenumbers: U16<LE>,
723 pub characteristics: U32<LE>,
724}
725
726pub const IMAGE_SIZEOF_SECTION_HEADER: usize = 40;
727
728// Values for `ImageSectionHeader::characteristics`.
729
730// IMAGE_SCN_TYPE_REG 0x00000000 // Reserved.
731// IMAGE_SCN_TYPE_DSECT 0x00000001 // Reserved.
732// IMAGE_SCN_TYPE_NOLOAD 0x00000002 // Reserved.
733// IMAGE_SCN_TYPE_GROUP 0x00000004 // Reserved.
734/// Reserved.
735pub const IMAGE_SCN_TYPE_NO_PAD: u32 = 0x0000_0008;
736// IMAGE_SCN_TYPE_COPY 0x00000010 // Reserved.
737
738/// Section contains code.
739pub const IMAGE_SCN_CNT_CODE: u32 = 0x0000_0020;
740/// Section contains initialized data.
741pub const IMAGE_SCN_CNT_INITIALIZED_DATA: u32 = 0x0000_0040;
742/// Section contains uninitialized data.
743pub const IMAGE_SCN_CNT_UNINITIALIZED_DATA: u32 = 0x0000_0080;
744
745/// Reserved.
746pub const IMAGE_SCN_LNK_OTHER: u32 = 0x0000_0100;
747/// Section contains comments or some other type of information.
748pub const IMAGE_SCN_LNK_INFO: u32 = 0x0000_0200;
749// IMAGE_SCN_TYPE_OVER 0x00000400 // Reserved.
750/// Section contents will not become part of image.
751pub const IMAGE_SCN_LNK_REMOVE: u32 = 0x0000_0800;
752/// Section contents comdat.
753pub const IMAGE_SCN_LNK_COMDAT: u32 = 0x0000_1000;
754// 0x00002000 // Reserved.
755// IMAGE_SCN_MEM_PROTECTED - Obsolete 0x00004000
756/// Reset speculative exceptions handling bits in the TLB entries for this section.
757pub const IMAGE_SCN_NO_DEFER_SPEC_EXC: u32 = 0x0000_4000;
758/// Section content can be accessed relative to GP
759pub const IMAGE_SCN_GPREL: u32 = 0x0000_8000;
760pub const IMAGE_SCN_MEM_FARDATA: u32 = 0x0000_8000;
761// IMAGE_SCN_MEM_SYSHEAP - Obsolete 0x00010000
762pub const IMAGE_SCN_MEM_PURGEABLE: u32 = 0x0002_0000;
763pub const IMAGE_SCN_MEM_16BIT: u32 = 0x0002_0000;
764pub const IMAGE_SCN_MEM_LOCKED: u32 = 0x0004_0000;
765pub const IMAGE_SCN_MEM_PRELOAD: u32 = 0x0008_0000;
766
767pub const IMAGE_SCN_ALIGN_1BYTES: u32 = 0x0010_0000;
768pub const IMAGE_SCN_ALIGN_2BYTES: u32 = 0x0020_0000;
769pub const IMAGE_SCN_ALIGN_4BYTES: u32 = 0x0030_0000;
770pub const IMAGE_SCN_ALIGN_8BYTES: u32 = 0x0040_0000;
771/// Default alignment if no others are specified.
772pub const IMAGE_SCN_ALIGN_16BYTES: u32 = 0x0050_0000;
773pub const IMAGE_SCN_ALIGN_32BYTES: u32 = 0x0060_0000;
774pub const IMAGE_SCN_ALIGN_64BYTES: u32 = 0x0070_0000;
775pub const IMAGE_SCN_ALIGN_128BYTES: u32 = 0x0080_0000;
776pub const IMAGE_SCN_ALIGN_256BYTES: u32 = 0x0090_0000;
777pub const IMAGE_SCN_ALIGN_512BYTES: u32 = 0x00A0_0000;
778pub const IMAGE_SCN_ALIGN_1024BYTES: u32 = 0x00B0_0000;
779pub const IMAGE_SCN_ALIGN_2048BYTES: u32 = 0x00C0_0000;
780pub const IMAGE_SCN_ALIGN_4096BYTES: u32 = 0x00D0_0000;
781pub const IMAGE_SCN_ALIGN_8192BYTES: u32 = 0x00E0_0000;
782// Unused 0x00F0_0000
783pub const IMAGE_SCN_ALIGN_MASK: u32 = 0x00F0_0000;
784
785/// Section contains extended relocations.
786pub const IMAGE_SCN_LNK_NRELOC_OVFL: u32 = 0x0100_0000;
787/// Section can be discarded.
788pub const IMAGE_SCN_MEM_DISCARDABLE: u32 = 0x0200_0000;
789/// Section is not cacheable.
790pub const IMAGE_SCN_MEM_NOT_CACHED: u32 = 0x0400_0000;
791/// Section is not pageable.
792pub const IMAGE_SCN_MEM_NOT_PAGED: u32 = 0x0800_0000;
793/// Section is shareable.
794pub const IMAGE_SCN_MEM_SHARED: u32 = 0x1000_0000;
795/// Section is executable.
796pub const IMAGE_SCN_MEM_EXECUTE: u32 = 0x2000_0000;
797/// Section is readable.
798pub const IMAGE_SCN_MEM_READ: u32 = 0x4000_0000;
799/// Section is writeable.
800pub const IMAGE_SCN_MEM_WRITE: u32 = 0x8000_0000;
801
802//
803// TLS Characteristic Flags
804//
805/// Tls index is scaled
806pub const IMAGE_SCN_SCALE_INDEX: u32 = 0x0000_0001;
807
808//
809// Symbol format.
810//
811
812// This struct has alignment 1.
813#[derive(Debug, Clone, Copy)]
814#[repr(C)]
815pub struct ImageSymbol {
816 /// If first 4 bytes are 0, then second 4 bytes are offset into string table.
817 pub name: [u8; 8],
818 pub value: U32Bytes<LE>,
819 pub section_number: U16Bytes<LE>,
820 pub typ: U16Bytes<LE>,
821 pub storage_class: u8,
822 pub number_of_aux_symbols: u8,
823}
824
825pub const IMAGE_SIZEOF_SYMBOL: usize = 18;
826
827#[derive(Debug, Clone, Copy)]
828#[repr(C)]
829pub struct ImageSymbolBytes(pub [u8; IMAGE_SIZEOF_SYMBOL]);
830
831// This struct has alignment 1.
832#[derive(Debug, Clone, Copy)]
833#[repr(C)]
834pub struct ImageSymbolEx {
835 /// If first 4 bytes are 0, then second 4 bytes are offset into string table.
836 pub name: [u8; 8],
837 pub value: U32Bytes<LE>,
838 pub section_number: I32Bytes<LE>,
839 pub typ: U16Bytes<LE>,
840 pub storage_class: u8,
841 pub number_of_aux_symbols: u8,
842}
843
844pub const IMAGE_SIZEOF_SYMBOL_EX: usize = 20;
845
846#[derive(Debug, Clone, Copy)]
847#[repr(C)]
848pub struct ImageSymbolExBytes(pub [u8; IMAGE_SIZEOF_SYMBOL_EX]);
849
850// Values for `ImageSymbol::section_number`.
851//
852// Symbols have a section number of the section in which they are
853// defined. Otherwise, section numbers have the following meanings:
854
855/// Symbol is undefined or is common.
856pub const IMAGE_SYM_UNDEFINED: i32 = 0;
857/// Symbol is an absolute value.
858pub const IMAGE_SYM_ABSOLUTE: i32 = -1;
859/// Symbol is a special debug item.
860pub const IMAGE_SYM_DEBUG: i32 = -2;
861/// Values 0xFF00-0xFFFF are special
862pub const IMAGE_SYM_SECTION_MAX: u16 = 0xFEFF;
863pub const IMAGE_SYM_SECTION_MAX_EX: u32 = 0x7fff_ffff;
864
865// Values for `ImageSymbol::typ` (basic component).
866
867/// no type.
868pub const IMAGE_SYM_TYPE_NULL: u16 = 0x0000;
869pub const IMAGE_SYM_TYPE_VOID: u16 = 0x0001;
870/// type character.
871pub const IMAGE_SYM_TYPE_CHAR: u16 = 0x0002;
872/// type short integer.
873pub const IMAGE_SYM_TYPE_SHORT: u16 = 0x0003;
874pub const IMAGE_SYM_TYPE_INT: u16 = 0x0004;
875pub const IMAGE_SYM_TYPE_LONG: u16 = 0x0005;
876pub const IMAGE_SYM_TYPE_FLOAT: u16 = 0x0006;
877pub const IMAGE_SYM_TYPE_DOUBLE: u16 = 0x0007;
878pub const IMAGE_SYM_TYPE_STRUCT: u16 = 0x0008;
879pub const IMAGE_SYM_TYPE_UNION: u16 = 0x0009;
880/// enumeration.
881pub const IMAGE_SYM_TYPE_ENUM: u16 = 0x000A;
882/// member of enumeration.
883pub const IMAGE_SYM_TYPE_MOE: u16 = 0x000B;
884pub const IMAGE_SYM_TYPE_BYTE: u16 = 0x000C;
885pub const IMAGE_SYM_TYPE_WORD: u16 = 0x000D;
886pub const IMAGE_SYM_TYPE_UINT: u16 = 0x000E;
887pub const IMAGE_SYM_TYPE_DWORD: u16 = 0x000F;
888pub const IMAGE_SYM_TYPE_PCODE: u16 = 0x8000;
889
890// Values for `ImageSymbol::typ` (derived component).
891
892/// no derived type.
893pub const IMAGE_SYM_DTYPE_NULL: u16 = 0;
894/// pointer.
895pub const IMAGE_SYM_DTYPE_POINTER: u16 = 1;
896/// function.
897pub const IMAGE_SYM_DTYPE_FUNCTION: u16 = 2;
898/// array.
899pub const IMAGE_SYM_DTYPE_ARRAY: u16 = 3;
900
901// Values for `ImageSymbol::storage_class`.
902pub const IMAGE_SYM_CLASS_END_OF_FUNCTION: u8 = 0xff;
903pub const IMAGE_SYM_CLASS_NULL: u8 = 0x00;
904pub const IMAGE_SYM_CLASS_AUTOMATIC: u8 = 0x01;
905pub const IMAGE_SYM_CLASS_EXTERNAL: u8 = 0x02;
906pub const IMAGE_SYM_CLASS_STATIC: u8 = 0x03;
907pub const IMAGE_SYM_CLASS_REGISTER: u8 = 0x04;
908pub const IMAGE_SYM_CLASS_EXTERNAL_DEF: u8 = 0x05;
909pub const IMAGE_SYM_CLASS_LABEL: u8 = 0x06;
910pub const IMAGE_SYM_CLASS_UNDEFINED_LABEL: u8 = 0x07;
911pub const IMAGE_SYM_CLASS_MEMBER_OF_STRUCT: u8 = 0x08;
912pub const IMAGE_SYM_CLASS_ARGUMENT: u8 = 0x09;
913pub const IMAGE_SYM_CLASS_STRUCT_TAG: u8 = 0x0A;
914pub const IMAGE_SYM_CLASS_MEMBER_OF_UNION: u8 = 0x0B;
915pub const IMAGE_SYM_CLASS_UNION_TAG: u8 = 0x0C;
916pub const IMAGE_SYM_CLASS_TYPE_DEFINITION: u8 = 0x0D;
917pub const IMAGE_SYM_CLASS_UNDEFINED_STATIC: u8 = 0x0E;
918pub const IMAGE_SYM_CLASS_ENUM_TAG: u8 = 0x0F;
919pub const IMAGE_SYM_CLASS_MEMBER_OF_ENUM: u8 = 0x10;
920pub const IMAGE_SYM_CLASS_REGISTER_PARAM: u8 = 0x11;
921pub const IMAGE_SYM_CLASS_BIT_FIELD: u8 = 0x12;
922
923pub const IMAGE_SYM_CLASS_FAR_EXTERNAL: u8 = 0x44;
924
925pub const IMAGE_SYM_CLASS_BLOCK: u8 = 0x64;
926pub const IMAGE_SYM_CLASS_FUNCTION: u8 = 0x65;
927pub const IMAGE_SYM_CLASS_END_OF_STRUCT: u8 = 0x66;
928pub const IMAGE_SYM_CLASS_FILE: u8 = 0x67;
929// new
930pub const IMAGE_SYM_CLASS_SECTION: u8 = 0x68;
931pub const IMAGE_SYM_CLASS_WEAK_EXTERNAL: u8 = 0x69;
932
933pub const IMAGE_SYM_CLASS_CLR_TOKEN: u8 = 0x6B;
934
935// type packing constants
936
937pub const N_BTMASK: u16 = 0x000F;
938pub const N_TMASK: u16 = 0x0030;
939pub const N_TMASK1: u16 = 0x00C0;
940pub const N_TMASK2: u16 = 0x00F0;
941pub const N_BTSHFT: usize = 4;
942pub const N_TSHIFT: usize = 2;
943
944pub const IMAGE_SYM_DTYPE_SHIFT: usize = N_BTSHFT;
945
946//
947// Auxiliary entry format.
948//
949
950// Used for both ImageSymbol and ImageSymbolEx (with padding).
951// This struct has alignment 1.
952#[derive(Debug, Clone, Copy)]
953#[repr(C)]
954pub struct ImageAuxSymbolTokenDef {
955 /// IMAGE_AUX_SYMBOL_TYPE
956 pub aux_type: u8,
957 /// Must be 0
958 pub reserved1: u8,
959 pub symbol_table_index: U32Bytes<LE>,
960 /// Must be 0
961 pub reserved2: [u8; 12],
962}
963
964pub const IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF: u16 = 1;
965
966/// Auxiliary symbol format 1: function definitions.
967// This struct has alignment 1.
968#[derive(Debug, Clone, Copy)]
969#[repr(C)]
970pub struct ImageAuxSymbolFunction {
971 pub tag_index: U32Bytes<LE>,
972 pub total_size: U32Bytes<LE>,
973 pub pointer_to_linenumber: U32Bytes<LE>,
974 pub pointer_to_next_function: U32Bytes<LE>,
975 pub unused: [u8; 2],
976}
977
978/// Auxiliary symbol format 2: .bf and .ef symbols.
979// This struct has alignment 1.
980#[derive(Debug, Clone, Copy)]
981#[repr(C)]
982pub struct ImageAuxSymbolFunctionBeginEnd {
983 pub unused1: [u8; 4],
984 /// declaration line number
985 pub linenumber: U16Bytes<LE>,
986 pub unused2: [u8; 6],
987 pub pointer_to_next_function: U32Bytes<LE>,
988 pub unused3: [u8; 2],
989}
990
991/// Auxiliary symbol format 3: weak externals.
992///
993/// Used for both `ImageSymbol` and `ImageSymbolEx` (both with padding).
994// This struct has alignment 1.
995#[derive(Debug, Clone, Copy)]
996#[repr(C)]
997pub struct ImageAuxSymbolWeak {
998 /// the weak extern default symbol index
999 pub weak_default_sym_index: U32Bytes<LE>,
1000 pub weak_search_type: U32Bytes<LE>,
1001}
1002
1003/// Auxiliary symbol format 5: sections.
1004///
1005/// Used for both `ImageSymbol` and `ImageSymbolEx` (with padding).
1006// This struct has alignment 1.
1007#[derive(Debug, Clone, Copy)]
1008#[repr(C)]
1009pub struct ImageAuxSymbolSection {
1010 /// section length
1011 pub length: U32Bytes<LE>,
1012 /// number of relocation entries
1013 pub number_of_relocations: U16Bytes<LE>,
1014 /// number of line numbers
1015 pub number_of_linenumbers: U16Bytes<LE>,
1016 /// checksum for communal
1017 pub check_sum: U32Bytes<LE>,
1018 /// section number to associate with
1019 pub number: U16Bytes<LE>,
1020 /// communal selection type
1021 pub selection: u8,
1022 pub reserved: u8,
1023 /// high bits of the section number
1024 pub high_number: U16Bytes<LE>,
1025}
1026
1027// Used for both ImageSymbol and ImageSymbolEx (both with padding).
1028// This struct has alignment 1.
1029#[derive(Debug, Clone, Copy)]
1030#[repr(C)]
1031pub struct ImageAuxSymbolCrc {
1032 pub crc: U32Bytes<LE>,
1033}
1034
1035//
1036// Communal selection types.
1037//
1038
1039pub const IMAGE_COMDAT_SELECT_NODUPLICATES: u8 = 1;
1040pub const IMAGE_COMDAT_SELECT_ANY: u8 = 2;
1041pub const IMAGE_COMDAT_SELECT_SAME_SIZE: u8 = 3;
1042pub const IMAGE_COMDAT_SELECT_EXACT_MATCH: u8 = 4;
1043pub const IMAGE_COMDAT_SELECT_ASSOCIATIVE: u8 = 5;
1044pub const IMAGE_COMDAT_SELECT_LARGEST: u8 = 6;
1045pub const IMAGE_COMDAT_SELECT_NEWEST: u8 = 7;
1046
1047pub const IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY: u16 = 1;
1048pub const IMAGE_WEAK_EXTERN_SEARCH_LIBRARY: u16 = 2;
1049pub const IMAGE_WEAK_EXTERN_SEARCH_ALIAS: u16 = 3;
1050pub const IMAGE_WEAK_EXTERN_ANTI_DEPENDENCY: u16 = 4;
1051
1052//
1053// Relocation format.
1054//
1055
1056// This struct has alignment 1.
1057#[derive(Debug, Clone, Copy)]
1058#[repr(C)]
1059pub struct ImageRelocation {
1060 /// Also `RelocCount` when IMAGE_SCN_LNK_NRELOC_OVFL is set
1061 pub virtual_address: U32Bytes<LE>,
1062 pub symbol_table_index: U32Bytes<LE>,
1063 pub typ: U16Bytes<LE>,
1064}
1065
1066//
1067// I386 relocation types.
1068//
1069/// Reference is absolute, no relocation is necessary
1070pub const IMAGE_REL_I386_ABSOLUTE: u16 = 0x0000;
1071/// Direct 16-bit reference to the symbols virtual address
1072pub const IMAGE_REL_I386_DIR16: u16 = 0x0001;
1073/// PC-relative 16-bit reference to the symbols virtual address
1074pub const IMAGE_REL_I386_REL16: u16 = 0x0002;
1075/// Direct 32-bit reference to the symbols virtual address
1076pub const IMAGE_REL_I386_DIR32: u16 = 0x0006;
1077/// Direct 32-bit reference to the symbols virtual address, base not included
1078pub const IMAGE_REL_I386_DIR32NB: u16 = 0x0007;
1079/// Direct 16-bit reference to the segment-selector bits of a 32-bit virtual address
1080pub const IMAGE_REL_I386_SEG12: u16 = 0x0009;
1081pub const IMAGE_REL_I386_SECTION: u16 = 0x000A;
1082pub const IMAGE_REL_I386_SECREL: u16 = 0x000B;
1083/// clr token
1084pub const IMAGE_REL_I386_TOKEN: u16 = 0x000C;
1085/// 7 bit offset from base of section containing target
1086pub const IMAGE_REL_I386_SECREL7: u16 = 0x000D;
1087/// PC-relative 32-bit reference to the symbols virtual address
1088pub const IMAGE_REL_I386_REL32: u16 = 0x0014;
1089
1090//
1091// MIPS relocation types.
1092//
1093/// Reference is absolute, no relocation is necessary
1094pub const IMAGE_REL_MIPS_ABSOLUTE: u16 = 0x0000;
1095pub const IMAGE_REL_MIPS_REFHALF: u16 = 0x0001;
1096pub const IMAGE_REL_MIPS_REFWORD: u16 = 0x0002;
1097pub const IMAGE_REL_MIPS_JMPADDR: u16 = 0x0003;
1098pub const IMAGE_REL_MIPS_REFHI: u16 = 0x0004;
1099pub const IMAGE_REL_MIPS_REFLO: u16 = 0x0005;
1100pub const IMAGE_REL_MIPS_GPREL: u16 = 0x0006;
1101pub const IMAGE_REL_MIPS_LITERAL: u16 = 0x0007;
1102pub const IMAGE_REL_MIPS_SECTION: u16 = 0x000A;
1103pub const IMAGE_REL_MIPS_SECREL: u16 = 0x000B;
1104/// Low 16-bit section relative reference (used for >32k TLS)
1105pub const IMAGE_REL_MIPS_SECRELLO: u16 = 0x000C;
1106/// High 16-bit section relative reference (used for >32k TLS)
1107pub const IMAGE_REL_MIPS_SECRELHI: u16 = 0x000D;
1108/// clr token
1109pub const IMAGE_REL_MIPS_TOKEN: u16 = 0x000E;
1110pub const IMAGE_REL_MIPS_JMPADDR16: u16 = 0x0010;
1111pub const IMAGE_REL_MIPS_REFWORDNB: u16 = 0x0022;
1112pub const IMAGE_REL_MIPS_PAIR: u16 = 0x0025;
1113
1114//
1115// Alpha Relocation types.
1116//
1117pub const IMAGE_REL_ALPHA_ABSOLUTE: u16 = 0x0000;
1118pub const IMAGE_REL_ALPHA_REFLONG: u16 = 0x0001;
1119pub const IMAGE_REL_ALPHA_REFQUAD: u16 = 0x0002;
1120pub const IMAGE_REL_ALPHA_GPREL32: u16 = 0x0003;
1121pub const IMAGE_REL_ALPHA_LITERAL: u16 = 0x0004;
1122pub const IMAGE_REL_ALPHA_LITUSE: u16 = 0x0005;
1123pub const IMAGE_REL_ALPHA_GPDISP: u16 = 0x0006;
1124pub const IMAGE_REL_ALPHA_BRADDR: u16 = 0x0007;
1125pub const IMAGE_REL_ALPHA_HINT: u16 = 0x0008;
1126pub const IMAGE_REL_ALPHA_INLINE_REFLONG: u16 = 0x0009;
1127pub const IMAGE_REL_ALPHA_REFHI: u16 = 0x000A;
1128pub const IMAGE_REL_ALPHA_REFLO: u16 = 0x000B;
1129pub const IMAGE_REL_ALPHA_PAIR: u16 = 0x000C;
1130pub const IMAGE_REL_ALPHA_MATCH: u16 = 0x000D;
1131pub const IMAGE_REL_ALPHA_SECTION: u16 = 0x000E;
1132pub const IMAGE_REL_ALPHA_SECREL: u16 = 0x000F;
1133pub const IMAGE_REL_ALPHA_REFLONGNB: u16 = 0x0010;
1134/// Low 16-bit section relative reference
1135pub const IMAGE_REL_ALPHA_SECRELLO: u16 = 0x0011;
1136/// High 16-bit section relative reference
1137pub const IMAGE_REL_ALPHA_SECRELHI: u16 = 0x0012;
1138/// High 16 bits of 48 bit reference
1139pub const IMAGE_REL_ALPHA_REFQ3: u16 = 0x0013;
1140/// Middle 16 bits of 48 bit reference
1141pub const IMAGE_REL_ALPHA_REFQ2: u16 = 0x0014;
1142/// Low 16 bits of 48 bit reference
1143pub const IMAGE_REL_ALPHA_REFQ1: u16 = 0x0015;
1144/// Low 16-bit GP relative reference
1145pub const IMAGE_REL_ALPHA_GPRELLO: u16 = 0x0016;
1146/// High 16-bit GP relative reference
1147pub const IMAGE_REL_ALPHA_GPRELHI: u16 = 0x0017;
1148
1149//
1150// IBM PowerPC relocation types.
1151//
1152/// NOP
1153pub const IMAGE_REL_PPC_ABSOLUTE: u16 = 0x0000;
1154/// 64-bit address
1155pub const IMAGE_REL_PPC_ADDR64: u16 = 0x0001;
1156/// 32-bit address
1157pub const IMAGE_REL_PPC_ADDR32: u16 = 0x0002;
1158/// 26-bit address, shifted left 2 (branch absolute)
1159pub const IMAGE_REL_PPC_ADDR24: u16 = 0x0003;
1160/// 16-bit address
1161pub const IMAGE_REL_PPC_ADDR16: u16 = 0x0004;
1162/// 16-bit address, shifted left 2 (load doubleword)
1163pub const IMAGE_REL_PPC_ADDR14: u16 = 0x0005;
1164/// 26-bit PC-relative offset, shifted left 2 (branch relative)
1165pub const IMAGE_REL_PPC_REL24: u16 = 0x0006;
1166/// 16-bit PC-relative offset, shifted left 2 (br cond relative)
1167pub const IMAGE_REL_PPC_REL14: u16 = 0x0007;
1168/// 16-bit offset from TOC base
1169pub const IMAGE_REL_PPC_TOCREL16: u16 = 0x0008;
1170/// 16-bit offset from TOC base, shifted left 2 (load doubleword)
1171pub const IMAGE_REL_PPC_TOCREL14: u16 = 0x0009;
1172
1173/// 32-bit addr w/o image base
1174pub const IMAGE_REL_PPC_ADDR32NB: u16 = 0x000A;
1175/// va of containing section (as in an image sectionhdr)
1176pub const IMAGE_REL_PPC_SECREL: u16 = 0x000B;
1177/// sectionheader number
1178pub const IMAGE_REL_PPC_SECTION: u16 = 0x000C;
1179/// substitute TOC restore instruction iff symbol is glue code
1180pub const IMAGE_REL_PPC_IFGLUE: u16 = 0x000D;
1181/// symbol is glue code; virtual address is TOC restore instruction
1182pub const IMAGE_REL_PPC_IMGLUE: u16 = 0x000E;
1183/// va of containing section (limited to 16 bits)
1184pub const IMAGE_REL_PPC_SECREL16: u16 = 0x000F;
1185pub const IMAGE_REL_PPC_REFHI: u16 = 0x0010;
1186pub const IMAGE_REL_PPC_REFLO: u16 = 0x0011;
1187pub const IMAGE_REL_PPC_PAIR: u16 = 0x0012;
1188/// Low 16-bit section relative reference (used for >32k TLS)
1189pub const IMAGE_REL_PPC_SECRELLO: u16 = 0x0013;
1190/// High 16-bit section relative reference (used for >32k TLS)
1191pub const IMAGE_REL_PPC_SECRELHI: u16 = 0x0014;
1192pub const IMAGE_REL_PPC_GPREL: u16 = 0x0015;
1193/// clr token
1194pub const IMAGE_REL_PPC_TOKEN: u16 = 0x0016;
1195
1196/// mask to isolate above values in IMAGE_RELOCATION.Type
1197pub const IMAGE_REL_PPC_TYPEMASK: u16 = 0x00FF;
1198
1199// Flag bits in `ImageRelocation::typ`.
1200
1201/// subtract reloc value rather than adding it
1202pub const IMAGE_REL_PPC_NEG: u16 = 0x0100;
1203/// fix branch prediction bit to predict branch taken
1204pub const IMAGE_REL_PPC_BRTAKEN: u16 = 0x0200;
1205/// fix branch prediction bit to predict branch not taken
1206pub const IMAGE_REL_PPC_BRNTAKEN: u16 = 0x0400;
1207/// toc slot defined in file (or, data in toc)
1208pub const IMAGE_REL_PPC_TOCDEFN: u16 = 0x0800;
1209
1210//
1211// Hitachi SH3 relocation types.
1212//
1213/// No relocation
1214pub const IMAGE_REL_SH3_ABSOLUTE: u16 = 0x0000;
1215/// 16 bit direct
1216pub const IMAGE_REL_SH3_DIRECT16: u16 = 0x0001;
1217/// 32 bit direct
1218pub const IMAGE_REL_SH3_DIRECT32: u16 = 0x0002;
1219/// 8 bit direct, -128..255
1220pub const IMAGE_REL_SH3_DIRECT8: u16 = 0x0003;
1221/// 8 bit direct .W (0 ext.)
1222pub const IMAGE_REL_SH3_DIRECT8_WORD: u16 = 0x0004;
1223/// 8 bit direct .L (0 ext.)
1224pub const IMAGE_REL_SH3_DIRECT8_LONG: u16 = 0x0005;
1225/// 4 bit direct (0 ext.)
1226pub const IMAGE_REL_SH3_DIRECT4: u16 = 0x0006;
1227/// 4 bit direct .W (0 ext.)
1228pub const IMAGE_REL_SH3_DIRECT4_WORD: u16 = 0x0007;
1229/// 4 bit direct .L (0 ext.)
1230pub const IMAGE_REL_SH3_DIRECT4_LONG: u16 = 0x0008;
1231/// 8 bit PC relative .W
1232pub const IMAGE_REL_SH3_PCREL8_WORD: u16 = 0x0009;
1233/// 8 bit PC relative .L
1234pub const IMAGE_REL_SH3_PCREL8_LONG: u16 = 0x000A;
1235/// 12 LSB PC relative .W
1236pub const IMAGE_REL_SH3_PCREL12_WORD: u16 = 0x000B;
1237/// Start of EXE section
1238pub const IMAGE_REL_SH3_STARTOF_SECTION: u16 = 0x000C;
1239/// Size of EXE section
1240pub const IMAGE_REL_SH3_SIZEOF_SECTION: u16 = 0x000D;
1241/// Section table index
1242pub const IMAGE_REL_SH3_SECTION: u16 = 0x000E;
1243/// Offset within section
1244pub const IMAGE_REL_SH3_SECREL: u16 = 0x000F;
1245/// 32 bit direct not based
1246pub const IMAGE_REL_SH3_DIRECT32_NB: u16 = 0x0010;
1247/// GP-relative addressing
1248pub const IMAGE_REL_SH3_GPREL4_LONG: u16 = 0x0011;
1249/// clr token
1250pub const IMAGE_REL_SH3_TOKEN: u16 = 0x0012;
1251/// Offset from current instruction in longwords
1252/// if not NOMODE, insert the inverse of the low bit at bit 32 to select PTA/PTB
1253pub const IMAGE_REL_SHM_PCRELPT: u16 = 0x0013;
1254/// Low bits of 32-bit address
1255pub const IMAGE_REL_SHM_REFLO: u16 = 0x0014;
1256/// High bits of 32-bit address
1257pub const IMAGE_REL_SHM_REFHALF: u16 = 0x0015;
1258/// Low bits of relative reference
1259pub const IMAGE_REL_SHM_RELLO: u16 = 0x0016;
1260/// High bits of relative reference
1261pub const IMAGE_REL_SHM_RELHALF: u16 = 0x0017;
1262/// offset operand for relocation
1263pub const IMAGE_REL_SHM_PAIR: u16 = 0x0018;
1264
1265/// relocation ignores section mode
1266pub const IMAGE_REL_SH_NOMODE: u16 = 0x8000;
1267
1268/// No relocation required
1269pub const IMAGE_REL_ARM_ABSOLUTE: u16 = 0x0000;
1270/// 32 bit address
1271pub const IMAGE_REL_ARM_ADDR32: u16 = 0x0001;
1272/// 32 bit address w/o image base
1273pub const IMAGE_REL_ARM_ADDR32NB: u16 = 0x0002;
1274/// 24 bit offset << 2 & sign ext.
1275pub const IMAGE_REL_ARM_BRANCH24: u16 = 0x0003;
1276/// Thumb: 2 11 bit offsets
1277pub const IMAGE_REL_ARM_BRANCH11: u16 = 0x0004;
1278/// clr token
1279pub const IMAGE_REL_ARM_TOKEN: u16 = 0x0005;
1280/// GP-relative addressing (ARM)
1281pub const IMAGE_REL_ARM_GPREL12: u16 = 0x0006;
1282/// GP-relative addressing (Thumb)
1283pub const IMAGE_REL_ARM_GPREL7: u16 = 0x0007;
1284pub const IMAGE_REL_ARM_BLX24: u16 = 0x0008;
1285pub const IMAGE_REL_ARM_BLX11: u16 = 0x0009;
1286/// 32-bit relative address from byte following reloc
1287pub const IMAGE_REL_ARM_REL32: u16 = 0x000A;
1288/// Section table index
1289pub const IMAGE_REL_ARM_SECTION: u16 = 0x000E;
1290/// Offset within section
1291pub const IMAGE_REL_ARM_SECREL: u16 = 0x000F;
1292/// ARM: MOVW/MOVT
1293pub const IMAGE_REL_ARM_MOV32A: u16 = 0x0010;
1294/// ARM: MOVW/MOVT (deprecated)
1295pub const IMAGE_REL_ARM_MOV32: u16 = 0x0010;
1296/// Thumb: MOVW/MOVT
1297pub const IMAGE_REL_ARM_MOV32T: u16 = 0x0011;
1298/// Thumb: MOVW/MOVT (deprecated)
1299pub const IMAGE_REL_THUMB_MOV32: u16 = 0x0011;
1300/// Thumb: 32-bit conditional B
1301pub const IMAGE_REL_ARM_BRANCH20T: u16 = 0x0012;
1302/// Thumb: 32-bit conditional B (deprecated)
1303pub const IMAGE_REL_THUMB_BRANCH20: u16 = 0x0012;
1304/// Thumb: 32-bit B or BL
1305pub const IMAGE_REL_ARM_BRANCH24T: u16 = 0x0014;
1306/// Thumb: 32-bit B or BL (deprecated)
1307pub const IMAGE_REL_THUMB_BRANCH24: u16 = 0x0014;
1308/// Thumb: BLX immediate
1309pub const IMAGE_REL_ARM_BLX23T: u16 = 0x0015;
1310/// Thumb: BLX immediate (deprecated)
1311pub const IMAGE_REL_THUMB_BLX23: u16 = 0x0015;
1312
1313pub const IMAGE_REL_AM_ABSOLUTE: u16 = 0x0000;
1314pub const IMAGE_REL_AM_ADDR32: u16 = 0x0001;
1315pub const IMAGE_REL_AM_ADDR32NB: u16 = 0x0002;
1316pub const IMAGE_REL_AM_CALL32: u16 = 0x0003;
1317pub const IMAGE_REL_AM_FUNCINFO: u16 = 0x0004;
1318pub const IMAGE_REL_AM_REL32_1: u16 = 0x0005;
1319pub const IMAGE_REL_AM_REL32_2: u16 = 0x0006;
1320pub const IMAGE_REL_AM_SECREL: u16 = 0x0007;
1321pub const IMAGE_REL_AM_SECTION: u16 = 0x0008;
1322pub const IMAGE_REL_AM_TOKEN: u16 = 0x0009;
1323
1324//
1325// ARM64 relocations types.
1326//
1327
1328/// No relocation required
1329pub const IMAGE_REL_ARM64_ABSOLUTE: u16 = 0x0000;
1330/// 32 bit address. Review! do we need it?
1331pub const IMAGE_REL_ARM64_ADDR32: u16 = 0x0001;
1332/// 32 bit address w/o image base (RVA: for Data/PData/XData)
1333pub const IMAGE_REL_ARM64_ADDR32NB: u16 = 0x0002;
1334/// 26 bit offset << 2 & sign ext. for B & BL
1335pub const IMAGE_REL_ARM64_BRANCH26: u16 = 0x0003;
1336/// ADRP
1337pub const IMAGE_REL_ARM64_PAGEBASE_REL21: u16 = 0x0004;
1338/// ADR
1339pub const IMAGE_REL_ARM64_REL21: u16 = 0x0005;
1340/// ADD/ADDS (immediate) with zero shift, for page offset
1341pub const IMAGE_REL_ARM64_PAGEOFFSET_12A: u16 = 0x0006;
1342/// LDR (indexed, unsigned immediate), for page offset
1343pub const IMAGE_REL_ARM64_PAGEOFFSET_12L: u16 = 0x0007;
1344/// Offset within section
1345pub const IMAGE_REL_ARM64_SECREL: u16 = 0x0008;
1346/// ADD/ADDS (immediate) with zero shift, for bit 0:11 of section offset
1347pub const IMAGE_REL_ARM64_SECREL_LOW12A: u16 = 0x0009;
1348/// ADD/ADDS (immediate) with zero shift, for bit 12:23 of section offset
1349pub const IMAGE_REL_ARM64_SECREL_HIGH12A: u16 = 0x000A;
1350/// LDR (indexed, unsigned immediate), for bit 0:11 of section offset
1351pub const IMAGE_REL_ARM64_SECREL_LOW12L: u16 = 0x000B;
1352pub const IMAGE_REL_ARM64_TOKEN: u16 = 0x000C;
1353/// Section table index
1354pub const IMAGE_REL_ARM64_SECTION: u16 = 0x000D;
1355/// 64 bit address
1356pub const IMAGE_REL_ARM64_ADDR64: u16 = 0x000E;
1357/// 19 bit offset << 2 & sign ext. for conditional B
1358pub const IMAGE_REL_ARM64_BRANCH19: u16 = 0x000F;
1359/// TBZ/TBNZ
1360pub const IMAGE_REL_ARM64_BRANCH14: u16 = 0x0010;
1361/// 32-bit relative address from byte following reloc
1362pub const IMAGE_REL_ARM64_REL32: u16 = 0x0011;
1363
1364//
1365// x64 relocations
1366//
1367/// Reference is absolute, no relocation is necessary
1368pub const IMAGE_REL_AMD64_ABSOLUTE: u16 = 0x0000;
1369/// 64-bit address (VA).
1370pub const IMAGE_REL_AMD64_ADDR64: u16 = 0x0001;
1371/// 32-bit address (VA).
1372pub const IMAGE_REL_AMD64_ADDR32: u16 = 0x0002;
1373/// 32-bit address w/o image base (RVA).
1374pub const IMAGE_REL_AMD64_ADDR32NB: u16 = 0x0003;
1375/// 32-bit relative address from byte following reloc
1376pub const IMAGE_REL_AMD64_REL32: u16 = 0x0004;
1377/// 32-bit relative address from byte distance 1 from reloc
1378pub const IMAGE_REL_AMD64_REL32_1: u16 = 0x0005;
1379/// 32-bit relative address from byte distance 2 from reloc
1380pub const IMAGE_REL_AMD64_REL32_2: u16 = 0x0006;
1381/// 32-bit relative address from byte distance 3 from reloc
1382pub const IMAGE_REL_AMD64_REL32_3: u16 = 0x0007;
1383/// 32-bit relative address from byte distance 4 from reloc
1384pub const IMAGE_REL_AMD64_REL32_4: u16 = 0x0008;
1385/// 32-bit relative address from byte distance 5 from reloc
1386pub const IMAGE_REL_AMD64_REL32_5: u16 = 0x0009;
1387/// Section index
1388pub const IMAGE_REL_AMD64_SECTION: u16 = 0x000A;
1389/// 32 bit offset from base of section containing target
1390pub const IMAGE_REL_AMD64_SECREL: u16 = 0x000B;
1391/// 7 bit unsigned offset from base of section containing target
1392pub const IMAGE_REL_AMD64_SECREL7: u16 = 0x000C;
1393/// 32 bit metadata token
1394pub const IMAGE_REL_AMD64_TOKEN: u16 = 0x000D;
1395/// 32 bit signed span-dependent value emitted into object
1396pub const IMAGE_REL_AMD64_SREL32: u16 = 0x000E;
1397pub const IMAGE_REL_AMD64_PAIR: u16 = 0x000F;
1398/// 32 bit signed span-dependent value applied at link time
1399pub const IMAGE_REL_AMD64_SSPAN32: u16 = 0x0010;
1400pub const IMAGE_REL_AMD64_EHANDLER: u16 = 0x0011;
1401/// Indirect branch to an import
1402pub const IMAGE_REL_AMD64_IMPORT_BR: u16 = 0x0012;
1403/// Indirect call to an import
1404pub const IMAGE_REL_AMD64_IMPORT_CALL: u16 = 0x0013;
1405/// Indirect branch to a CFG check
1406pub const IMAGE_REL_AMD64_CFG_BR: u16 = 0x0014;
1407/// Indirect branch to a CFG check, with REX.W prefix
1408pub const IMAGE_REL_AMD64_CFG_BR_REX: u16 = 0x0015;
1409/// Indirect call to a CFG check
1410pub const IMAGE_REL_AMD64_CFG_CALL: u16 = 0x0016;
1411/// Indirect branch to a target in RAX (no CFG)
1412pub const IMAGE_REL_AMD64_INDIR_BR: u16 = 0x0017;
1413/// Indirect branch to a target in RAX, with REX.W prefix (no CFG)
1414pub const IMAGE_REL_AMD64_INDIR_BR_REX: u16 = 0x0018;
1415/// Indirect call to a target in RAX (no CFG)
1416pub const IMAGE_REL_AMD64_INDIR_CALL: u16 = 0x0019;
1417/// Indirect branch for a switch table using Reg 0 (RAX)
1418pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_FIRST: u16 = 0x0020;
1419/// Indirect branch for a switch table using Reg 15 (R15)
1420pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_LAST: u16 = 0x002F;
1421
1422//
1423// IA64 relocation types.
1424//
1425pub const IMAGE_REL_IA64_ABSOLUTE: u16 = 0x0000;
1426pub const IMAGE_REL_IA64_IMM14: u16 = 0x0001;
1427pub const IMAGE_REL_IA64_IMM22: u16 = 0x0002;
1428pub const IMAGE_REL_IA64_IMM64: u16 = 0x0003;
1429pub const IMAGE_REL_IA64_DIR32: u16 = 0x0004;
1430pub const IMAGE_REL_IA64_DIR64: u16 = 0x0005;
1431pub const IMAGE_REL_IA64_PCREL21B: u16 = 0x0006;
1432pub const IMAGE_REL_IA64_PCREL21M: u16 = 0x0007;
1433pub const IMAGE_REL_IA64_PCREL21F: u16 = 0x0008;
1434pub const IMAGE_REL_IA64_GPREL22: u16 = 0x0009;
1435pub const IMAGE_REL_IA64_LTOFF22: u16 = 0x000A;
1436pub const IMAGE_REL_IA64_SECTION: u16 = 0x000B;
1437pub const IMAGE_REL_IA64_SECREL22: u16 = 0x000C;
1438pub const IMAGE_REL_IA64_SECREL64I: u16 = 0x000D;
1439pub const IMAGE_REL_IA64_SECREL32: u16 = 0x000E;
1440//
1441pub const IMAGE_REL_IA64_DIR32NB: u16 = 0x0010;
1442pub const IMAGE_REL_IA64_SREL14: u16 = 0x0011;
1443pub const IMAGE_REL_IA64_SREL22: u16 = 0x0012;
1444pub const IMAGE_REL_IA64_SREL32: u16 = 0x0013;
1445pub const IMAGE_REL_IA64_UREL32: u16 = 0x0014;
1446/// This is always a BRL and never converted
1447pub const IMAGE_REL_IA64_PCREL60X: u16 = 0x0015;
1448/// If possible, convert to MBB bundle with NOP.B in slot 1
1449pub const IMAGE_REL_IA64_PCREL60B: u16 = 0x0016;
1450/// If possible, convert to MFB bundle with NOP.F in slot 1
1451pub const IMAGE_REL_IA64_PCREL60F: u16 = 0x0017;
1452/// If possible, convert to MIB bundle with NOP.I in slot 1
1453pub const IMAGE_REL_IA64_PCREL60I: u16 = 0x0018;
1454/// If possible, convert to MMB bundle with NOP.M in slot 1
1455pub const IMAGE_REL_IA64_PCREL60M: u16 = 0x0019;
1456pub const IMAGE_REL_IA64_IMMGPREL64: u16 = 0x001A;
1457/// clr token
1458pub const IMAGE_REL_IA64_TOKEN: u16 = 0x001B;
1459pub const IMAGE_REL_IA64_GPREL32: u16 = 0x001C;
1460pub const IMAGE_REL_IA64_ADDEND: u16 = 0x001F;
1461
1462//
1463// CEF relocation types.
1464//
1465/// Reference is absolute, no relocation is necessary
1466pub const IMAGE_REL_CEF_ABSOLUTE: u16 = 0x0000;
1467/// 32-bit address (VA).
1468pub const IMAGE_REL_CEF_ADDR32: u16 = 0x0001;
1469/// 64-bit address (VA).
1470pub const IMAGE_REL_CEF_ADDR64: u16 = 0x0002;
1471/// 32-bit address w/o image base (RVA).
1472pub const IMAGE_REL_CEF_ADDR32NB: u16 = 0x0003;
1473/// Section index
1474pub const IMAGE_REL_CEF_SECTION: u16 = 0x0004;
1475/// 32 bit offset from base of section containing target
1476pub const IMAGE_REL_CEF_SECREL: u16 = 0x0005;
1477/// 32 bit metadata token
1478pub const IMAGE_REL_CEF_TOKEN: u16 = 0x0006;
1479
1480//
1481// clr relocation types.
1482//
1483/// Reference is absolute, no relocation is necessary
1484pub const IMAGE_REL_CEE_ABSOLUTE: u16 = 0x0000;
1485/// 32-bit address (VA).
1486pub const IMAGE_REL_CEE_ADDR32: u16 = 0x0001;
1487/// 64-bit address (VA).
1488pub const IMAGE_REL_CEE_ADDR64: u16 = 0x0002;
1489/// 32-bit address w/o image base (RVA).
1490pub const IMAGE_REL_CEE_ADDR32NB: u16 = 0x0003;
1491/// Section index
1492pub const IMAGE_REL_CEE_SECTION: u16 = 0x0004;
1493/// 32 bit offset from base of section containing target
1494pub const IMAGE_REL_CEE_SECREL: u16 = 0x0005;
1495/// 32 bit metadata token
1496pub const IMAGE_REL_CEE_TOKEN: u16 = 0x0006;
1497
1498/// No relocation required
1499pub const IMAGE_REL_M32R_ABSOLUTE: u16 = 0x0000;
1500/// 32 bit address
1501pub const IMAGE_REL_M32R_ADDR32: u16 = 0x0001;
1502/// 32 bit address w/o image base
1503pub const IMAGE_REL_M32R_ADDR32NB: u16 = 0x0002;
1504/// 24 bit address
1505pub const IMAGE_REL_M32R_ADDR24: u16 = 0x0003;
1506/// GP relative addressing
1507pub const IMAGE_REL_M32R_GPREL16: u16 = 0x0004;
1508/// 24 bit offset << 2 & sign ext.
1509pub const IMAGE_REL_M32R_PCREL24: u16 = 0x0005;
1510/// 16 bit offset << 2 & sign ext.
1511pub const IMAGE_REL_M32R_PCREL16: u16 = 0x0006;
1512/// 8 bit offset << 2 & sign ext.
1513pub const IMAGE_REL_M32R_PCREL8: u16 = 0x0007;
1514/// 16 MSBs
1515pub const IMAGE_REL_M32R_REFHALF: u16 = 0x0008;
1516/// 16 MSBs; adj for LSB sign ext.
1517pub const IMAGE_REL_M32R_REFHI: u16 = 0x0009;
1518/// 16 LSBs
1519pub const IMAGE_REL_M32R_REFLO: u16 = 0x000A;
1520/// Link HI and LO
1521pub const IMAGE_REL_M32R_PAIR: u16 = 0x000B;
1522/// Section table index
1523pub const IMAGE_REL_M32R_SECTION: u16 = 0x000C;
1524/// 32 bit section relative reference
1525pub const IMAGE_REL_M32R_SECREL32: u16 = 0x000D;
1526/// clr token
1527pub const IMAGE_REL_M32R_TOKEN: u16 = 0x000E;
1528
1529/// No relocation required
1530pub const IMAGE_REL_EBC_ABSOLUTE: u16 = 0x0000;
1531/// 32 bit address w/o image base
1532pub const IMAGE_REL_EBC_ADDR32NB: u16 = 0x0001;
1533/// 32-bit relative address from byte following reloc
1534pub const IMAGE_REL_EBC_REL32: u16 = 0x0002;
1535/// Section table index
1536pub const IMAGE_REL_EBC_SECTION: u16 = 0x0003;
1537/// Offset within section
1538pub const IMAGE_REL_EBC_SECREL: u16 = 0x0004;
1539
1540/*
1541// TODO?
1542#define EXT_IMM64(Value, Address, Size, InstPos, ValPos) /* Intel-IA64-Filler */ \
1543 Value |= (((ULONGLONG)((*(Address) >> InstPos) & (((ULONGLONG)1 << Size) - 1))) << ValPos) // Intel-IA64-Filler
1544
1545#define INS_IMM64(Value, Address, Size, InstPos, ValPos) /* Intel-IA64-Filler */\
1546 *(PDWORD)Address = (*(PDWORD)Address & ~(((1 << Size) - 1) << InstPos)) | /* Intel-IA64-Filler */\
1547 ((DWORD)((((ULONGLONG)Value >> ValPos) & (((ULONGLONG)1 << Size) - 1))) << InstPos) // Intel-IA64-Filler
1548*/
1549
1550/// Intel-IA64-Filler
1551pub const EMARCH_ENC_I17_IMM7B_INST_WORD_X: u16 = 3;
1552/// Intel-IA64-Filler
1553pub const EMARCH_ENC_I17_IMM7B_SIZE_X: u16 = 7;
1554/// Intel-IA64-Filler
1555pub const EMARCH_ENC_I17_IMM7B_INST_WORD_POS_X: u16 = 4;
1556/// Intel-IA64-Filler
1557pub const EMARCH_ENC_I17_IMM7B_VAL_POS_X: u16 = 0;
1558
1559/// Intel-IA64-Filler
1560pub const EMARCH_ENC_I17_IMM9D_INST_WORD_X: u16 = 3;
1561/// Intel-IA64-Filler
1562pub const EMARCH_ENC_I17_IMM9D_SIZE_X: u16 = 9;
1563/// Intel-IA64-Filler
1564pub const EMARCH_ENC_I17_IMM9D_INST_WORD_POS_X: u16 = 18;
1565/// Intel-IA64-Filler
1566pub const EMARCH_ENC_I17_IMM9D_VAL_POS_X: u16 = 7;
1567
1568/// Intel-IA64-Filler
1569pub const EMARCH_ENC_I17_IMM5C_INST_WORD_X: u16 = 3;
1570/// Intel-IA64-Filler
1571pub const EMARCH_ENC_I17_IMM5C_SIZE_X: u16 = 5;
1572/// Intel-IA64-Filler
1573pub const EMARCH_ENC_I17_IMM5C_INST_WORD_POS_X: u16 = 13;
1574/// Intel-IA64-Filler
1575pub const EMARCH_ENC_I17_IMM5C_VAL_POS_X: u16 = 16;
1576
1577/// Intel-IA64-Filler
1578pub const EMARCH_ENC_I17_IC_INST_WORD_X: u16 = 3;
1579/// Intel-IA64-Filler
1580pub const EMARCH_ENC_I17_IC_SIZE_X: u16 = 1;
1581/// Intel-IA64-Filler
1582pub const EMARCH_ENC_I17_IC_INST_WORD_POS_X: u16 = 12;
1583/// Intel-IA64-Filler
1584pub const EMARCH_ENC_I17_IC_VAL_POS_X: u16 = 21;
1585
1586/// Intel-IA64-Filler
1587pub const EMARCH_ENC_I17_IMM41A_INST_WORD_X: u16 = 1;
1588/// Intel-IA64-Filler
1589pub const EMARCH_ENC_I17_IMM41A_SIZE_X: u16 = 10;
1590/// Intel-IA64-Filler
1591pub const EMARCH_ENC_I17_IMM41A_INST_WORD_POS_X: u16 = 14;
1592/// Intel-IA64-Filler
1593pub const EMARCH_ENC_I17_IMM41A_VAL_POS_X: u16 = 22;
1594
1595/// Intel-IA64-Filler
1596pub const EMARCH_ENC_I17_IMM41B_INST_WORD_X: u16 = 1;
1597/// Intel-IA64-Filler
1598pub const EMARCH_ENC_I17_IMM41B_SIZE_X: u16 = 8;
1599/// Intel-IA64-Filler
1600pub const EMARCH_ENC_I17_IMM41B_INST_WORD_POS_X: u16 = 24;
1601/// Intel-IA64-Filler
1602pub const EMARCH_ENC_I17_IMM41B_VAL_POS_X: u16 = 32;
1603
1604/// Intel-IA64-Filler
1605pub const EMARCH_ENC_I17_IMM41C_INST_WORD_X: u16 = 2;
1606/// Intel-IA64-Filler
1607pub const EMARCH_ENC_I17_IMM41C_SIZE_X: u16 = 23;
1608/// Intel-IA64-Filler
1609pub const EMARCH_ENC_I17_IMM41C_INST_WORD_POS_X: u16 = 0;
1610/// Intel-IA64-Filler
1611pub const EMARCH_ENC_I17_IMM41C_VAL_POS_X: u16 = 40;
1612
1613/// Intel-IA64-Filler
1614pub const EMARCH_ENC_I17_SIGN_INST_WORD_X: u16 = 3;
1615/// Intel-IA64-Filler
1616pub const EMARCH_ENC_I17_SIGN_SIZE_X: u16 = 1;
1617/// Intel-IA64-Filler
1618pub const EMARCH_ENC_I17_SIGN_INST_WORD_POS_X: u16 = 27;
1619/// Intel-IA64-Filler
1620pub const EMARCH_ENC_I17_SIGN_VAL_POS_X: u16 = 63;
1621
1622/// Intel-IA64-Filler
1623pub const X3_OPCODE_INST_WORD_X: u16 = 3;
1624/// Intel-IA64-Filler
1625pub const X3_OPCODE_SIZE_X: u16 = 4;
1626/// Intel-IA64-Filler
1627pub const X3_OPCODE_INST_WORD_POS_X: u16 = 28;
1628/// Intel-IA64-Filler
1629pub const X3_OPCODE_SIGN_VAL_POS_X: u16 = 0;
1630
1631/// Intel-IA64-Filler
1632pub const X3_I_INST_WORD_X: u16 = 3;
1633/// Intel-IA64-Filler
1634pub const X3_I_SIZE_X: u16 = 1;
1635/// Intel-IA64-Filler
1636pub const X3_I_INST_WORD_POS_X: u16 = 27;
1637/// Intel-IA64-Filler
1638pub const X3_I_SIGN_VAL_POS_X: u16 = 59;
1639
1640/// Intel-IA64-Filler
1641pub const X3_D_WH_INST_WORD_X: u16 = 3;
1642/// Intel-IA64-Filler
1643pub const X3_D_WH_SIZE_X: u16 = 3;
1644/// Intel-IA64-Filler
1645pub const X3_D_WH_INST_WORD_POS_X: u16 = 24;
1646/// Intel-IA64-Filler
1647pub const X3_D_WH_SIGN_VAL_POS_X: u16 = 0;
1648
1649/// Intel-IA64-Filler
1650pub const X3_IMM20_INST_WORD_X: u16 = 3;
1651/// Intel-IA64-Filler
1652pub const X3_IMM20_SIZE_X: u16 = 20;
1653/// Intel-IA64-Filler
1654pub const X3_IMM20_INST_WORD_POS_X: u16 = 4;
1655/// Intel-IA64-Filler
1656pub const X3_IMM20_SIGN_VAL_POS_X: u16 = 0;
1657
1658/// Intel-IA64-Filler
1659pub const X3_IMM39_1_INST_WORD_X: u16 = 2;
1660/// Intel-IA64-Filler
1661pub const X3_IMM39_1_SIZE_X: u16 = 23;
1662/// Intel-IA64-Filler
1663pub const X3_IMM39_1_INST_WORD_POS_X: u16 = 0;
1664/// Intel-IA64-Filler
1665pub const X3_IMM39_1_SIGN_VAL_POS_X: u16 = 36;
1666
1667/// Intel-IA64-Filler
1668pub const X3_IMM39_2_INST_WORD_X: u16 = 1;
1669/// Intel-IA64-Filler
1670pub const X3_IMM39_2_SIZE_X: u16 = 16;
1671/// Intel-IA64-Filler
1672pub const X3_IMM39_2_INST_WORD_POS_X: u16 = 16;
1673/// Intel-IA64-Filler
1674pub const X3_IMM39_2_SIGN_VAL_POS_X: u16 = 20;
1675
1676/// Intel-IA64-Filler
1677pub const X3_P_INST_WORD_X: u16 = 3;
1678/// Intel-IA64-Filler
1679pub const X3_P_SIZE_X: u16 = 4;
1680/// Intel-IA64-Filler
1681pub const X3_P_INST_WORD_POS_X: u16 = 0;
1682/// Intel-IA64-Filler
1683pub const X3_P_SIGN_VAL_POS_X: u16 = 0;
1684
1685/// Intel-IA64-Filler
1686pub const X3_TMPLT_INST_WORD_X: u16 = 0;
1687/// Intel-IA64-Filler
1688pub const X3_TMPLT_SIZE_X: u16 = 4;
1689/// Intel-IA64-Filler
1690pub const X3_TMPLT_INST_WORD_POS_X: u16 = 0;
1691/// Intel-IA64-Filler
1692pub const X3_TMPLT_SIGN_VAL_POS_X: u16 = 0;
1693
1694/// Intel-IA64-Filler
1695pub const X3_BTYPE_QP_INST_WORD_X: u16 = 2;
1696/// Intel-IA64-Filler
1697pub const X3_BTYPE_QP_SIZE_X: u16 = 9;
1698/// Intel-IA64-Filler
1699pub const X3_BTYPE_QP_INST_WORD_POS_X: u16 = 23;
1700/// Intel-IA64-Filler
1701pub const X3_BTYPE_QP_INST_VAL_POS_X: u16 = 0;
1702
1703/// Intel-IA64-Filler
1704pub const X3_EMPTY_INST_WORD_X: u16 = 1;
1705/// Intel-IA64-Filler
1706pub const X3_EMPTY_SIZE_X: u16 = 2;
1707/// Intel-IA64-Filler
1708pub const X3_EMPTY_INST_WORD_POS_X: u16 = 14;
1709/// Intel-IA64-Filler
1710pub const X3_EMPTY_INST_VAL_POS_X: u16 = 0;
1711
1712//
1713// Line number format.
1714//
1715
1716// This struct has alignment 1.
1717#[derive(Debug, Clone, Copy)]
1718#[repr(C)]
1719pub struct ImageLinenumber {
1720 /// Symbol table index of function name if Linenumber is 0.
1721 /// Otherwise virtual address of line number.
1722 pub symbol_table_index_or_virtual_address: U32Bytes<LE>,
1723 /// Line number.
1724 pub linenumber: U16Bytes<LE>,
1725}
1726
1727//
1728// Based relocation format.
1729//
1730
1731#[derive(Debug, Clone, Copy)]
1732#[repr(C)]
1733pub struct ImageBaseRelocation {
1734 pub virtual_address: U32<LE>,
1735 pub size_of_block: U32<LE>,
1736 // pub type_offset[1]: U16<LE>,
1737}
1738
1739//
1740// Based relocation types.
1741//
1742
1743pub const IMAGE_REL_BASED_ABSOLUTE: u16 = 0;
1744pub const IMAGE_REL_BASED_HIGH: u16 = 1;
1745pub const IMAGE_REL_BASED_LOW: u16 = 2;
1746pub const IMAGE_REL_BASED_HIGHLOW: u16 = 3;
1747pub const IMAGE_REL_BASED_HIGHADJ: u16 = 4;
1748pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_5: u16 = 5;
1749pub const IMAGE_REL_BASED_RESERVED: u16 = 6;
1750pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_7: u16 = 7;
1751pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_8: u16 = 8;
1752pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_9: u16 = 9;
1753pub const IMAGE_REL_BASED_DIR64: u16 = 10;
1754
1755//
1756// Platform-specific based relocation types.
1757//
1758
1759pub const IMAGE_REL_BASED_IA64_IMM64: u16 = 9;
1760
1761pub const IMAGE_REL_BASED_MIPS_JMPADDR: u16 = 5;
1762pub const IMAGE_REL_BASED_MIPS_JMPADDR16: u16 = 9;
1763
1764pub const IMAGE_REL_BASED_ARM_MOV32: u16 = 5;
1765pub const IMAGE_REL_BASED_THUMB_MOV32: u16 = 7;
1766
1767pub const IMAGE_REL_BASED_RISCV_HIGH20: u16 = 5;
1768pub const IMAGE_REL_BASED_RISCV_LOW12I: u16 = 7;
1769pub const IMAGE_REL_BASED_RISCV_LOW12S: u16 = 8;
1770
1771//
1772// Archive format.
1773//
1774
1775pub const IMAGE_ARCHIVE_START_SIZE: usize = 8;
1776pub const IMAGE_ARCHIVE_START: &[u8; 8] = b"!<arch>\n";
1777pub const IMAGE_ARCHIVE_END: &[u8] = b"`\n";
1778pub const IMAGE_ARCHIVE_PAD: &[u8] = b"\n";
1779pub const IMAGE_ARCHIVE_LINKER_MEMBER: &[u8; 16] = b"/ ";
1780pub const IMAGE_ARCHIVE_LONGNAMES_MEMBER: &[u8; 16] = b"// ";
1781pub const IMAGE_ARCHIVE_HYBRIDMAP_MEMBER: &[u8; 16] = b"/<HYBRIDMAP>/ ";
1782
1783#[derive(Debug, Clone, Copy)]
1784#[repr(C)]
1785pub struct ImageArchiveMemberHeader {
1786 /// File member name - `/' terminated.
1787 pub name: [u8; 16],
1788 /// File member date - decimal.
1789 pub date: [u8; 12],
1790 /// File member user id - decimal.
1791 pub user_id: [u8; 6],
1792 /// File member group id - decimal.
1793 pub group_id: [u8; 6],
1794 /// File member mode - octal.
1795 pub mode: [u8; 8],
1796 /// File member size - decimal.
1797 pub size: [u8; 10],
1798 /// String to end header.
1799 pub end_header: [u8; 2],
1800}
1801
1802pub const IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR: u16 = 60;
1803
1804//
1805// DLL support.
1806//
1807
1808//
1809// Export Format
1810//
1811
1812#[derive(Debug, Clone, Copy)]
1813#[repr(C)]
1814pub struct ImageExportDirectory {
1815 pub characteristics: U32<LE>,
1816 pub time_date_stamp: U32<LE>,
1817 pub major_version: U16<LE>,
1818 pub minor_version: U16<LE>,
1819 pub name: U32<LE>,
1820 pub base: U32<LE>,
1821 pub number_of_functions: U32<LE>,
1822 pub number_of_names: U32<LE>,
1823 /// RVA from base of image
1824 pub address_of_functions: U32<LE>,
1825 /// RVA from base of image
1826 pub address_of_names: U32<LE>,
1827 /// RVA from base of image
1828 pub address_of_name_ordinals: U32<LE>,
1829}
1830
1831//
1832// Import Format
1833//
1834
1835#[derive(Debug, Clone, Copy)]
1836#[repr(C)]
1837pub struct ImageImportByName {
1838 pub hint: U16<LE>,
1839 //pub name: [i8; 1],
1840}
1841
1842#[derive(Debug, Clone, Copy)]
1843#[repr(C)]
1844pub struct ImageThunkData64(pub U64<LE>);
1845/*
1846 union {
1847/// PBYTE
1848 pub forwarder_string: U64<LE>,
1849/// PDWORD
1850 pub function: U64<LE>,
1851 pub ordinal: U64<LE>,
1852/// PIMAGE_IMPORT_BY_NAME
1853 pub address_of_data: U64<LE>,
1854 } u1;
1855*/
1856
1857#[derive(Debug, Clone, Copy)]
1858#[repr(C)]
1859pub struct ImageThunkData32(pub U32<LE>);
1860/*
1861 union {
1862/// PBYTE
1863 pub forwarder_string: U32<LE>,
1864/// PDWORD
1865 pub function: U32<LE>,
1866 pub ordinal: U32<LE>,
1867/// PIMAGE_IMPORT_BY_NAME
1868 pub address_of_data: U32<LE>,
1869 } u1;
1870}
1871*/
1872
1873pub const IMAGE_ORDINAL_FLAG64: u64 = 0x8000000000000000;
1874pub const IMAGE_ORDINAL_FLAG32: u32 = 0x80000000;
1875
1876/*
1877#define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)
1878#define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)
1879#define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
1880#define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
1881
1882*/
1883
1884//
1885// Thread Local Storage
1886//
1887
1888#[derive(Debug, Clone, Copy)]
1889#[repr(C)]
1890pub struct ImageTlsDirectory64 {
1891 pub start_address_of_raw_data: U64<LE>,
1892 pub end_address_of_raw_data: U64<LE>,
1893 /// PDWORD
1894 pub address_of_index: U64<LE>,
1895 /// PIMAGE_TLS_CALLBACK *;
1896 pub address_of_call_backs: U64<LE>,
1897 pub size_of_zero_fill: U32<LE>,
1898 pub characteristics: U32<LE>,
1899}
1900
1901#[derive(Debug, Clone, Copy)]
1902#[repr(C)]
1903pub struct ImageTlsDirectory32 {
1904 pub start_address_of_raw_data: U32<LE>,
1905 pub end_address_of_raw_data: U32<LE>,
1906 /// PDWORD
1907 pub address_of_index: U32<LE>,
1908 /// PIMAGE_TLS_CALLBACK *
1909 pub address_of_call_backs: U32<LE>,
1910 pub size_of_zero_fill: U32<LE>,
1911 pub characteristics: U32<LE>,
1912}
1913
1914#[derive(Debug, Clone, Copy)]
1915#[repr(C)]
1916pub struct ImageImportDescriptor {
1917 /// RVA to original unbound IAT (`ImageThunkData32`/`ImageThunkData64`)
1918 /// 0 for terminating null import descriptor
1919 pub original_first_thunk: U32Bytes<LE>,
1920 /// 0 if not bound,
1921 /// -1 if bound, and real date\time stamp
1922 /// in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
1923 /// O.W. date/time stamp of DLL bound to (Old BIND)
1924 pub time_date_stamp: U32Bytes<LE>,
1925 /// -1 if no forwarders
1926 pub forwarder_chain: U32Bytes<LE>,
1927 pub name: U32Bytes<LE>,
1928 /// RVA to IAT (if bound this IAT has actual addresses)
1929 pub first_thunk: U32Bytes<LE>,
1930}
1931
1932impl ImageImportDescriptor {
1933 /// Tell whether this import descriptor is the null descriptor
1934 /// (used to mark the end of the iterator array in a PE)
1935 pub fn is_null(&self) -> bool {
1936 self.original_first_thunk.get(LE) == 0
1937 && self.time_date_stamp.get(LE) == 0
1938 && self.forwarder_chain.get(LE) == 0
1939 && self.name.get(LE) == 0
1940 && self.first_thunk.get(LE) == 0
1941 }
1942}
1943
1944//
1945// New format import descriptors pointed to by DataDirectory[ IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT ]
1946//
1947
1948#[derive(Debug, Clone, Copy)]
1949#[repr(C)]
1950pub struct ImageBoundImportDescriptor {
1951 pub time_date_stamp: U32<LE>,
1952 pub offset_module_name: U16<LE>,
1953 pub number_of_module_forwarder_refs: U16<LE>,
1954 // Array of zero or more IMAGE_BOUND_FORWARDER_REF follows
1955}
1956
1957#[derive(Debug, Clone, Copy)]
1958#[repr(C)]
1959pub struct ImageBoundForwarderRef {
1960 pub time_date_stamp: U32<LE>,
1961 pub offset_module_name: U16<LE>,
1962 pub reserved: U16<LE>,
1963}
1964
1965#[derive(Debug, Clone, Copy)]
1966#[repr(C)]
1967pub struct ImageDelayloadDescriptor {
1968 pub attributes: U32<LE>,
1969
1970 /// RVA to the name of the target library (NULL-terminate ASCII string)
1971 pub dll_name_rva: U32<LE>,
1972 /// RVA to the HMODULE caching location (PHMODULE)
1973 pub module_handle_rva: U32<LE>,
1974 /// RVA to the start of the IAT (PIMAGE_THUNK_DATA)
1975 pub import_address_table_rva: U32<LE>,
1976 /// RVA to the start of the name table (PIMAGE_THUNK_DATA::AddressOfData)
1977 pub import_name_table_rva: U32<LE>,
1978 /// RVA to an optional bound IAT
1979 pub bound_import_address_table_rva: U32<LE>,
1980 /// RVA to an optional unload info table
1981 pub unload_information_table_rva: U32<LE>,
1982 /// 0 if not bound, otherwise, date/time of the target DLL
1983 pub time_date_stamp: U32<LE>,
1984}
1985
1986impl ImageDelayloadDescriptor {
1987 /// Tell whether this delay-load import descriptor is the null descriptor
1988 /// (used to mark the end of the iterator array in a PE)
1989 pub fn is_null(&self) -> bool {
1990 self.attributes.get(LE) == 0
1991 && self.dll_name_rva.get(LE) == 0
1992 && self.module_handle_rva.get(LE) == 0
1993 && self.import_address_table_rva.get(LE) == 0
1994 && self.import_name_table_rva.get(LE) == 0
1995 && self.bound_import_address_table_rva.get(LE) == 0
1996 && self.unload_information_table_rva.get(LE) == 0
1997 && self.time_date_stamp.get(LE) == 0
1998 }
1999}
2000
2001/// Delay load version 2 flag for `ImageDelayloadDescriptor::attributes`.
2002pub const IMAGE_DELAYLOAD_RVA_BASED: u32 = 0x8000_0000;
2003
2004//
2005// Resource Format.
2006//
2007
2008//
2009// Resource directory consists of two counts, following by a variable length
2010// array of directory entries. The first count is the number of entries at
2011// beginning of the array that have actual names associated with each entry.
2012// The entries are in ascending order, case insensitive strings. The second
2013// count is the number of entries that immediately follow the named entries.
2014// This second count identifies the number of entries that have 16-bit integer
2015// Ids as their name. These entries are also sorted in ascending order.
2016//
2017// This structure allows fast lookup by either name or number, but for any
2018// given resource entry only one form of lookup is supported, not both.
2019// This is consistent with the syntax of the .RC file and the .RES file.
2020//
2021
2022#[derive(Debug, Clone, Copy)]
2023#[repr(C)]
2024pub struct ImageResourceDirectory {
2025 pub characteristics: U32<LE>,
2026 pub time_date_stamp: U32<LE>,
2027 pub major_version: U16<LE>,
2028 pub minor_version: U16<LE>,
2029 pub number_of_named_entries: U16<LE>,
2030 pub number_of_id_entries: U16<LE>,
2031}
2032
2033pub const IMAGE_RESOURCE_NAME_IS_STRING: u32 = 0x8000_0000;
2034pub const IMAGE_RESOURCE_DATA_IS_DIRECTORY: u32 = 0x8000_0000;
2035//
2036// Each directory contains the 32-bit Name of the entry and an offset,
2037// relative to the beginning of the resource directory of the data associated
2038// with this directory entry. If the name of the entry is an actual text
2039// string instead of an integer Id, then the high order bit of the name field
2040// is set to one and the low order 31-bits are an offset, relative to the
2041// beginning of the resource directory of the string, which is of type
2042// IMAGE_RESOURCE_DIRECTORY_STRING. Otherwise the high bit is clear and the
2043// low-order 16-bits are the integer Id that identify this resource directory
2044// entry. If the directory entry is yet another resource directory (i.e. a
2045// subdirectory), then the high order bit of the offset field will be
2046// set to indicate this. Otherwise the high bit is clear and the offset
2047// field points to a resource data entry.
2048//
2049
2050#[derive(Debug, Clone, Copy)]
2051#[repr(C)]
2052pub struct ImageResourceDirectoryEntry {
2053 pub name_or_id: U32<LE>,
2054 pub offset_to_data_or_directory: U32<LE>,
2055}
2056
2057//
2058// For resource directory entries that have actual string names, the Name
2059// field of the directory entry points to an object of the following type.
2060// All of these string objects are stored together after the last resource
2061// directory entry and before the first resource data object. This minimizes
2062// the impact of these variable length objects on the alignment of the fixed
2063// size directory entry objects.
2064//
2065
2066#[derive(Debug, Clone, Copy)]
2067#[repr(C)]
2068pub struct ImageResourceDirectoryString {
2069 pub length: U16<LE>,
2070 //pub name_string: [i8; 1],
2071}
2072
2073#[derive(Debug, Clone, Copy)]
2074#[repr(C)]
2075pub struct ImageResourceDirStringU {
2076 pub length: U16<LE>,
2077 //pub name_string: [U16<LE>; 1],
2078}
2079
2080//
2081// Each resource data entry describes a leaf node in the resource directory
2082// tree. It contains an offset, relative to the beginning of the resource
2083// directory of the data for the resource, a size field that gives the number
2084// of bytes of data at that offset, a CodePage that should be used when
2085// decoding code point values within the resource data. Typically for new
2086// applications the code page would be the unicode code page.
2087//
2088
2089#[derive(Debug, Clone, Copy)]
2090#[repr(C)]
2091pub struct ImageResourceDataEntry {
2092 /// RVA of the data.
2093 pub offset_to_data: U32<LE>,
2094 pub size: U32<LE>,
2095 pub code_page: U32<LE>,
2096 pub reserved: U32<LE>,
2097}
2098
2099// Resource type: https://docs.microsoft.com/en-us/windows/win32/menurc/resource-types
2100
2101/// ID for: Hardware-dependent cursor resource.
2102pub const RT_CURSOR: u16 = 1;
2103/// ID for: Bitmap resource.
2104pub const RT_BITMAP: u16 = 2;
2105/// ID for: Hardware-dependent icon resource.
2106pub const RT_ICON: u16 = 3;
2107/// ID for: Menu resource.
2108pub const RT_MENU: u16 = 4;
2109/// ID for: Dialog box.
2110pub const RT_DIALOG: u16 = 5;
2111/// ID for: String-table entry.
2112pub const RT_STRING: u16 = 6;
2113/// ID for: Font directory resource.
2114pub const RT_FONTDIR: u16 = 7;
2115/// ID for: Font resource.
2116pub const RT_FONT: u16 = 8;
2117/// ID for: Accelerator table.
2118pub const RT_ACCELERATOR: u16 = 9;
2119/// ID for: Application-defined resource (raw data).
2120pub const RT_RCDATA: u16 = 10;
2121/// ID for: Message-table entry.
2122pub const RT_MESSAGETABLE: u16 = 11;
2123/// ID for: Hardware-independent cursor resource.
2124pub const RT_GROUP_CURSOR: u16 = 12;
2125/// ID for: Hardware-independent icon resource.
2126pub const RT_GROUP_ICON: u16 = 14;
2127/// ID for: Version resource.
2128pub const RT_VERSION: u16 = 16;
2129/// ID for: Allows a resource editing tool to associate a string with an .rc file.
2130pub const RT_DLGINCLUDE: u16 = 17;
2131/// ID for: Plug and Play resource.
2132pub const RT_PLUGPLAY: u16 = 19;
2133/// ID for: VXD.
2134pub const RT_VXD: u16 = 20;
2135/// ID for: Animated cursor.
2136pub const RT_ANICURSOR: u16 = 21;
2137/// ID for: Animated icon.
2138pub const RT_ANIICON: u16 = 22;
2139/// ID for: HTML resource.
2140pub const RT_HTML: u16 = 23;
2141/// ID for: Side-by-Side Assembly Manifest.
2142pub const RT_MANIFEST: u16 = 24;
2143
2144//
2145// Code Integrity in loadconfig (CI)
2146//
2147
2148#[derive(Debug, Clone, Copy)]
2149#[repr(C)]
2150pub struct ImageLoadConfigCodeIntegrity {
2151 /// Flags to indicate if CI information is available, etc.
2152 pub flags: U16<LE>,
2153 /// 0xFFFF means not available
2154 pub catalog: U16<LE>,
2155 pub catalog_offset: U32<LE>,
2156 /// Additional bitmask to be defined later
2157 pub reserved: U32<LE>,
2158}
2159
2160//
2161// Dynamic value relocation table in loadconfig
2162//
2163
2164#[derive(Debug, Clone, Copy)]
2165#[repr(C)]
2166pub struct ImageDynamicRelocationTable {
2167 pub version: U32<LE>,
2168 pub size: U32<LE>,
2169 // DynamicRelocations: [ImageDynamicRelocation; 0],
2170}
2171
2172//
2173// Dynamic value relocation entries following IMAGE_DYNAMIC_RELOCATION_TABLE
2174//
2175
2176#[derive(Debug, Clone, Copy)]
2177#[repr(C)]
2178pub struct ImageDynamicRelocation32 {
2179 pub symbol: U32<LE>,
2180 pub base_reloc_size: U32<LE>,
2181 // BaseRelocations: [ImageBaseRelocation; 0],
2182}
2183
2184#[derive(Debug, Clone, Copy)]
2185#[repr(C)]
2186pub struct ImageDynamicRelocation64 {
2187 pub symbol: U64<LE>,
2188 pub base_reloc_size: U32<LE>,
2189 // BaseRelocations: [ImageBaseRelocation; 0],
2190}
2191
2192#[derive(Debug, Clone, Copy)]
2193#[repr(C)]
2194pub struct ImageDynamicRelocation32V2 {
2195 pub header_size: U32<LE>,
2196 pub fixup_info_size: U32<LE>,
2197 pub symbol: U32<LE>,
2198 pub symbol_group: U32<LE>,
2199 pub flags: U32<LE>,
2200 // ... variable length header fields
2201 // pub fixup_info: [u8; fixup_info_size]
2202}
2203
2204#[derive(Debug, Clone, Copy)]
2205#[repr(C)]
2206pub struct ImageDynamicRelocation64V2 {
2207 pub header_size: U32<LE>,
2208 pub fixup_info_size: U32<LE>,
2209 pub symbol: U64<LE>,
2210 pub symbol_group: U32<LE>,
2211 pub flags: U32<LE>,
2212 // ... variable length header fields
2213 // pub fixup_info[u8; fixup_info_size]
2214}
2215
2216//
2217// Defined symbolic dynamic relocation entries.
2218//
2219
2220pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE: u32 = 0x0000_0001;
2221pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE: u32 = 0x0000_0002;
2222pub const IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER: u32 = 0x0000_0003;
2223pub const IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER: u32 = 0x0000_0004;
2224pub const IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH: u32 = 0x0000_0005;
2225
2226// This struct has alignment 1.
2227#[derive(Debug, Clone, Copy)]
2228#[repr(C)]
2229pub struct ImagePrologueDynamicRelocationHeader {
2230 pub prologue_byte_count: u8,
2231 // pub prologue_bytes: [u8; prologue_byte_count],
2232}
2233
2234// This struct has alignment 1.
2235#[derive(Debug, Clone, Copy)]
2236#[repr(C)]
2237pub struct ImageEpilogueDynamicRelocationHeader {
2238 pub epilogue_count: U32Bytes<LE>,
2239 pub epilogue_byte_count: u8,
2240 pub branch_descriptor_element_size: u8,
2241 pub branch_descriptor_count: U16Bytes<LE>,
2242 // pub branch_descriptors[...],
2243 // pub branch_descriptor_bit_map[...],
2244}
2245
2246/*
2247// TODO? bitfields
2248// TODO: unaligned?
2249#[derive(Debug, Clone, Copy)]
2250#[repr(C)]
2251pub struct ImageImportControlTransferDynamicRelocation {
2252 DWORD PageRelativeOffset : 12;
2253 DWORD IndirectCall : 1;
2254 DWORD IATIndex : 19;
2255}
2256
2257// TODO: unaligned?
2258#[derive(Debug, Clone, Copy)]
2259#[repr(C)]
2260pub struct ImageIndirControlTransferDynamicRelocation {
2261 WORD PageRelativeOffset : 12;
2262 WORD IndirectCall : 1;
2263 WORD RexWPrefix : 1;
2264 WORD CfgCheck : 1;
2265 WORD Reserved : 1;
2266}
2267
2268// TODO: unaligned?
2269#[derive(Debug, Clone, Copy)]
2270#[repr(C)]
2271pub struct ImageSwitchtableBranchDynamicRelocation {
2272 WORD PageRelativeOffset : 12;
2273 WORD RegisterNumber : 4;
2274}
2275*/
2276
2277//
2278// Load Configuration Directory Entry
2279//
2280
2281#[derive(Debug, Clone, Copy)]
2282#[repr(C)]
2283pub struct ImageLoadConfigDirectory32 {
2284 pub size: U32<LE>,
2285 pub time_date_stamp: U32<LE>,
2286 pub major_version: U16<LE>,
2287 pub minor_version: U16<LE>,
2288 pub global_flags_clear: U32<LE>,
2289 pub global_flags_set: U32<LE>,
2290 pub critical_section_default_timeout: U32<LE>,
2291 pub de_commit_free_block_threshold: U32<LE>,
2292 pub de_commit_total_free_threshold: U32<LE>,
2293 /// VA
2294 pub lock_prefix_table: U32<LE>,
2295 pub maximum_allocation_size: U32<LE>,
2296 pub virtual_memory_threshold: U32<LE>,
2297 pub process_heap_flags: U32<LE>,
2298 pub process_affinity_mask: U32<LE>,
2299 pub csd_version: U16<LE>,
2300 pub dependent_load_flags: U16<LE>,
2301 /// VA
2302 pub edit_list: U32<LE>,
2303 /// VA
2304 pub security_cookie: U32<LE>,
2305 /// VA
2306 pub sehandler_table: U32<LE>,
2307 pub sehandler_count: U32<LE>,
2308 /// VA
2309 pub guard_cf_check_function_pointer: U32<LE>,
2310 /// VA
2311 pub guard_cf_dispatch_function_pointer: U32<LE>,
2312 /// VA
2313 pub guard_cf_function_table: U32<LE>,
2314 pub guard_cf_function_count: U32<LE>,
2315 pub guard_flags: U32<LE>,
2316 pub code_integrity: ImageLoadConfigCodeIntegrity,
2317 /// VA
2318 pub guard_address_taken_iat_entry_table: U32<LE>,
2319 pub guard_address_taken_iat_entry_count: U32<LE>,
2320 /// VA
2321 pub guard_long_jump_target_table: U32<LE>,
2322 pub guard_long_jump_target_count: U32<LE>,
2323 /// VA
2324 pub dynamic_value_reloc_table: U32<LE>,
2325 pub chpe_metadata_pointer: U32<LE>,
2326 /// VA
2327 pub guard_rf_failure_routine: U32<LE>,
2328 /// VA
2329 pub guard_rf_failure_routine_function_pointer: U32<LE>,
2330 pub dynamic_value_reloc_table_offset: U32<LE>,
2331 pub dynamic_value_reloc_table_section: U16<LE>,
2332 pub reserved2: U16<LE>,
2333 /// VA
2334 pub guard_rf_verify_stack_pointer_function_pointer: U32<LE>,
2335 pub hot_patch_table_offset: U32<LE>,
2336 pub reserved3: U32<LE>,
2337 /// VA
2338 pub enclave_configuration_pointer: U32<LE>,
2339 /// VA
2340 pub volatile_metadata_pointer: U32<LE>,
2341}
2342
2343#[derive(Debug, Clone, Copy)]
2344#[repr(C)]
2345pub struct ImageLoadConfigDirectory64 {
2346 pub size: U32<LE>,
2347 pub time_date_stamp: U32<LE>,
2348 pub major_version: U16<LE>,
2349 pub minor_version: U16<LE>,
2350 pub global_flags_clear: U32<LE>,
2351 pub global_flags_set: U32<LE>,
2352 pub critical_section_default_timeout: U32<LE>,
2353 pub de_commit_free_block_threshold: U64<LE>,
2354 pub de_commit_total_free_threshold: U64<LE>,
2355 /// VA
2356 pub lock_prefix_table: U64<LE>,
2357 pub maximum_allocation_size: U64<LE>,
2358 pub virtual_memory_threshold: U64<LE>,
2359 pub process_affinity_mask: U64<LE>,
2360 pub process_heap_flags: U32<LE>,
2361 pub csd_version: U16<LE>,
2362 pub dependent_load_flags: U16<LE>,
2363 /// VA
2364 pub edit_list: U64<LE>,
2365 /// VA
2366 pub security_cookie: U64<LE>,
2367 /// VA
2368 pub sehandler_table: U64<LE>,
2369 pub sehandler_count: U64<LE>,
2370 /// VA
2371 pub guard_cf_check_function_pointer: U64<LE>,
2372 /// VA
2373 pub guard_cf_dispatch_function_pointer: U64<LE>,
2374 /// VA
2375 pub guard_cf_function_table: U64<LE>,
2376 pub guard_cf_function_count: U64<LE>,
2377 pub guard_flags: U32<LE>,
2378 pub code_integrity: ImageLoadConfigCodeIntegrity,
2379 /// VA
2380 pub guard_address_taken_iat_entry_table: U64<LE>,
2381 pub guard_address_taken_iat_entry_count: U64<LE>,
2382 /// VA
2383 pub guard_long_jump_target_table: U64<LE>,
2384 pub guard_long_jump_target_count: U64<LE>,
2385 /// VA
2386 pub dynamic_value_reloc_table: U64<LE>,
2387 /// VA
2388 pub chpe_metadata_pointer: U64<LE>,
2389 /// VA
2390 pub guard_rf_failure_routine: U64<LE>,
2391 /// VA
2392 pub guard_rf_failure_routine_function_pointer: U64<LE>,
2393 pub dynamic_value_reloc_table_offset: U32<LE>,
2394 pub dynamic_value_reloc_table_section: U16<LE>,
2395 pub reserved2: U16<LE>,
2396 /// VA
2397 pub guard_rf_verify_stack_pointer_function_pointer: U64<LE>,
2398 pub hot_patch_table_offset: U32<LE>,
2399 pub reserved3: U32<LE>,
2400 /// VA
2401 pub enclave_configuration_pointer: U64<LE>,
2402 /// VA
2403 pub volatile_metadata_pointer: U64<LE>,
2404}
2405
2406#[derive(Debug, Clone, Copy)]
2407#[repr(C)]
2408pub struct ImageHotPatchInfo {
2409 pub version: U32<LE>,
2410 pub size: U32<LE>,
2411 pub sequence_number: U32<LE>,
2412 pub base_image_list: U32<LE>,
2413 pub base_image_count: U32<LE>,
2414 /// Version 2 and later
2415 pub buffer_offset: U32<LE>,
2416 /// Version 3 and later
2417 pub extra_patch_size: U32<LE>,
2418}
2419
2420#[derive(Debug, Clone, Copy)]
2421#[repr(C)]
2422pub struct ImageHotPatchBase {
2423 pub sequence_number: U32<LE>,
2424 pub flags: U32<LE>,
2425 pub original_time_date_stamp: U32<LE>,
2426 pub original_check_sum: U32<LE>,
2427 pub code_integrity_info: U32<LE>,
2428 pub code_integrity_size: U32<LE>,
2429 pub patch_table: U32<LE>,
2430 /// Version 2 and later
2431 pub buffer_offset: U32<LE>,
2432}
2433
2434#[derive(Debug, Clone, Copy)]
2435#[repr(C)]
2436pub struct ImageHotPatchHashes {
2437 pub sha256: [u8; 32],
2438 pub sha1: [u8; 20],
2439}
2440
2441pub const IMAGE_HOT_PATCH_BASE_OBLIGATORY: u32 = 0x0000_0001;
2442pub const IMAGE_HOT_PATCH_BASE_CAN_ROLL_BACK: u32 = 0x0000_0002;
2443
2444pub const IMAGE_HOT_PATCH_CHUNK_INVERSE: u32 = 0x8000_0000;
2445pub const IMAGE_HOT_PATCH_CHUNK_OBLIGATORY: u32 = 0x4000_0000;
2446pub const IMAGE_HOT_PATCH_CHUNK_RESERVED: u32 = 0x3FF0_3000;
2447pub const IMAGE_HOT_PATCH_CHUNK_TYPE: u32 = 0x000F_C000;
2448pub const IMAGE_HOT_PATCH_CHUNK_SOURCE_RVA: u32 = 0x0000_8000;
2449pub const IMAGE_HOT_PATCH_CHUNK_TARGET_RVA: u32 = 0x0000_4000;
2450pub const IMAGE_HOT_PATCH_CHUNK_SIZE: u32 = 0x0000_0FFF;
2451
2452pub const IMAGE_HOT_PATCH_NONE: u32 = 0x0000_0000;
2453pub const IMAGE_HOT_PATCH_FUNCTION: u32 = 0x0001_C000;
2454pub const IMAGE_HOT_PATCH_ABSOLUTE: u32 = 0x0002_C000;
2455pub const IMAGE_HOT_PATCH_REL32: u32 = 0x0003_C000;
2456pub const IMAGE_HOT_PATCH_CALL_TARGET: u32 = 0x0004_4000;
2457pub const IMAGE_HOT_PATCH_INDIRECT: u32 = 0x0005_C000;
2458pub const IMAGE_HOT_PATCH_NO_CALL_TARGET: u32 = 0x0006_4000;
2459pub const IMAGE_HOT_PATCH_DYNAMIC_VALUE: u32 = 0x0007_8000;
2460
2461/// Module performs control flow integrity checks using system-supplied support
2462pub const IMAGE_GUARD_CF_INSTRUMENTED: u32 = 0x0000_0100;
2463/// Module performs control flow and write integrity checks
2464pub const IMAGE_GUARD_CFW_INSTRUMENTED: u32 = 0x0000_0200;
2465/// Module contains valid control flow target metadata
2466pub const IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT: u32 = 0x0000_0400;
2467/// Module does not make use of the /GS security cookie
2468pub const IMAGE_GUARD_SECURITY_COOKIE_UNUSED: u32 = 0x0000_0800;
2469/// Module supports read only delay load IAT
2470pub const IMAGE_GUARD_PROTECT_DELAYLOAD_IAT: u32 = 0x0000_1000;
2471/// Delayload import table in its own .didat section (with nothing else in it) that can be freely reprotected
2472pub const IMAGE_GUARD_DELAYLOAD_IAT_IN_ITS_OWN_SECTION: u32 = 0x0000_2000;
2473/// Module contains suppressed export information.
2474///
2475/// This also infers that the address taken taken IAT table is also present in the load config.
2476pub const IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT: u32 = 0x0000_4000;
2477/// Module enables suppression of exports
2478pub const IMAGE_GUARD_CF_ENABLE_EXPORT_SUPPRESSION: u32 = 0x0000_8000;
2479/// Module contains longjmp target information
2480pub const IMAGE_GUARD_CF_LONGJUMP_TABLE_PRESENT: u32 = 0x0001_0000;
2481/// Module contains return flow instrumentation and metadata
2482pub const IMAGE_GUARD_RF_INSTRUMENTED: u32 = 0x0002_0000;
2483/// Module requests that the OS enable return flow protection
2484pub const IMAGE_GUARD_RF_ENABLE: u32 = 0x0004_0000;
2485/// Module requests that the OS enable return flow protection in strict mode
2486pub const IMAGE_GUARD_RF_STRICT: u32 = 0x0008_0000;
2487/// Module was built with retpoline support
2488pub const IMAGE_GUARD_RETPOLINE_PRESENT: u32 = 0x0010_0000;
2489
2490/// Stride of Guard CF function table encoded in these bits (additional count of bytes per element)
2491pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_MASK: u32 = 0xF000_0000;
2492/// Shift to right-justify Guard CF function table stride
2493pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_SHIFT: u32 = 28;
2494
2495//
2496// GFIDS table entry flags.
2497//
2498
2499/// The containing GFID entry is suppressed
2500pub const IMAGE_GUARD_FLAG_FID_SUPPRESSED: u16 = 0x01;
2501/// The containing GFID entry is export suppressed
2502pub const IMAGE_GUARD_FLAG_EXPORT_SUPPRESSED: u16 = 0x02;
2503
2504//
2505// WIN CE Exception table format
2506//
2507
2508//
2509// Function table entry format. Function table is pointed to by the
2510// IMAGE_DIRECTORY_ENTRY_EXCEPTION directory entry.
2511//
2512
2513/*
2514// TODO? bitfields
2515#[derive(Debug, Clone, Copy)]
2516#[repr(C)]
2517pub struct ImageCeRuntimeFunctionEntry {
2518 pub func_start: U32<LE>,
2519 DWORD PrologLen : 8;
2520 DWORD FuncLen : 22;
2521 DWORD ThirtyTwoBit : 1;
2522 DWORD ExceptionFlag : 1;
2523}
2524*/
2525
2526#[derive(Debug, Clone, Copy)]
2527#[repr(C)]
2528pub struct ImageArmRuntimeFunctionEntry {
2529 pub begin_address: U32<LE>,
2530 pub unwind_data: U32<LE>,
2531}
2532
2533#[derive(Debug, Clone, Copy)]
2534#[repr(C)]
2535pub struct ImageArm64RuntimeFunctionEntry {
2536 pub begin_address: U32<LE>,
2537 pub unwind_data: U32<LE>,
2538}
2539
2540#[derive(Debug, Clone, Copy)]
2541#[repr(C)]
2542pub struct ImageAlpha64RuntimeFunctionEntry {
2543 pub begin_address: U64<LE>,
2544 pub end_address: U64<LE>,
2545 pub exception_handler: U64<LE>,
2546 pub handler_data: U64<LE>,
2547 pub prolog_end_address: U64<LE>,
2548}
2549
2550#[derive(Debug, Clone, Copy)]
2551#[repr(C)]
2552pub struct ImageAlphaRuntimeFunctionEntry {
2553 pub begin_address: U32<LE>,
2554 pub end_address: U32<LE>,
2555 pub exception_handler: U32<LE>,
2556 pub handler_data: U32<LE>,
2557 pub prolog_end_address: U32<LE>,
2558}
2559
2560#[derive(Debug, Clone, Copy)]
2561#[repr(C)]
2562pub struct ImageRuntimeFunctionEntry {
2563 pub begin_address: U32<LE>,
2564 pub end_address: U32<LE>,
2565 pub unwind_info_address_or_data: U32<LE>,
2566}
2567
2568//
2569// Software enclave information
2570//
2571
2572pub const IMAGE_ENCLAVE_LONG_ID_LENGTH: usize = 32;
2573pub const IMAGE_ENCLAVE_SHORT_ID_LENGTH: usize = 16;
2574
2575#[derive(Debug, Clone, Copy)]
2576#[repr(C)]
2577pub struct ImageEnclaveConfig32 {
2578 pub size: U32<LE>,
2579 pub minimum_required_config_size: U32<LE>,
2580 pub policy_flags: U32<LE>,
2581 pub number_of_imports: U32<LE>,
2582 pub import_list: U32<LE>,
2583 pub import_entry_size: U32<LE>,
2584 pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2585 pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2586 pub image_version: U32<LE>,
2587 pub security_version: U32<LE>,
2588 pub enclave_size: U32<LE>,
2589 pub number_of_threads: U32<LE>,
2590 pub enclave_flags: U32<LE>,
2591}
2592
2593#[derive(Debug, Clone, Copy)]
2594#[repr(C)]
2595pub struct ImageEnclaveConfig64 {
2596 pub size: U32<LE>,
2597 pub minimum_required_config_size: U32<LE>,
2598 pub policy_flags: U32<LE>,
2599 pub number_of_imports: U32<LE>,
2600 pub import_list: U32<LE>,
2601 pub import_entry_size: U32<LE>,
2602 pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2603 pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2604 pub image_version: U32<LE>,
2605 pub security_version: U32<LE>,
2606 pub enclave_size: U64<LE>,
2607 pub number_of_threads: U32<LE>,
2608 pub enclave_flags: U32<LE>,
2609}
2610
2611//pub const IMAGE_ENCLAVE_MINIMUM_CONFIG_SIZE: usize = FIELD_OFFSET(IMAGE_ENCLAVE_CONFIG, EnclaveFlags);
2612
2613pub const IMAGE_ENCLAVE_POLICY_DEBUGGABLE: u32 = 0x0000_0001;
2614
2615pub const IMAGE_ENCLAVE_FLAG_PRIMARY_IMAGE: u32 = 0x0000_0001;
2616
2617#[derive(Debug, Clone, Copy)]
2618#[repr(C)]
2619pub struct ImageEnclaveImport {
2620 pub match_type: U32<LE>,
2621 pub minimum_security_version: U32<LE>,
2622 pub unique_or_author_id: [u8; IMAGE_ENCLAVE_LONG_ID_LENGTH],
2623 pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2624 pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2625 pub import_name: U32<LE>,
2626 pub reserved: U32<LE>,
2627}
2628
2629pub const IMAGE_ENCLAVE_IMPORT_MATCH_NONE: u32 = 0x0000_0000;
2630pub const IMAGE_ENCLAVE_IMPORT_MATCH_UNIQUE_ID: u32 = 0x0000_0001;
2631pub const IMAGE_ENCLAVE_IMPORT_MATCH_AUTHOR_ID: u32 = 0x0000_0002;
2632pub const IMAGE_ENCLAVE_IMPORT_MATCH_FAMILY_ID: u32 = 0x0000_0003;
2633pub const IMAGE_ENCLAVE_IMPORT_MATCH_IMAGE_ID: u32 = 0x0000_0004;
2634
2635//
2636// Debug Format
2637//
2638
2639#[derive(Debug, Clone, Copy)]
2640#[repr(C)]
2641pub struct ImageDebugDirectory {
2642 pub characteristics: U32<LE>,
2643 pub time_date_stamp: U32<LE>,
2644 pub major_version: U16<LE>,
2645 pub minor_version: U16<LE>,
2646 pub typ: U32<LE>,
2647 pub size_of_data: U32<LE>,
2648 pub address_of_raw_data: U32<LE>,
2649 pub pointer_to_raw_data: U32<LE>,
2650}
2651
2652pub const IMAGE_DEBUG_TYPE_UNKNOWN: u32 = 0;
2653pub const IMAGE_DEBUG_TYPE_COFF: u32 = 1;
2654pub const IMAGE_DEBUG_TYPE_CODEVIEW: u32 = 2;
2655pub const IMAGE_DEBUG_TYPE_FPO: u32 = 3;
2656pub const IMAGE_DEBUG_TYPE_MISC: u32 = 4;
2657pub const IMAGE_DEBUG_TYPE_EXCEPTION: u32 = 5;
2658pub const IMAGE_DEBUG_TYPE_FIXUP: u32 = 6;
2659pub const IMAGE_DEBUG_TYPE_OMAP_TO_SRC: u32 = 7;
2660pub const IMAGE_DEBUG_TYPE_OMAP_FROM_SRC: u32 = 8;
2661pub const IMAGE_DEBUG_TYPE_BORLAND: u32 = 9;
2662pub const IMAGE_DEBUG_TYPE_RESERVED10: u32 = 10;
2663pub const IMAGE_DEBUG_TYPE_CLSID: u32 = 11;
2664pub const IMAGE_DEBUG_TYPE_VC_FEATURE: u32 = 12;
2665pub const IMAGE_DEBUG_TYPE_POGO: u32 = 13;
2666pub const IMAGE_DEBUG_TYPE_ILTCG: u32 = 14;
2667pub const IMAGE_DEBUG_TYPE_MPX: u32 = 15;
2668pub const IMAGE_DEBUG_TYPE_REPRO: u32 = 16;
2669
2670#[derive(Debug, Clone, Copy)]
2671#[repr(C)]
2672pub struct ImageCoffSymbolsHeader {
2673 pub number_of_symbols: U32<LE>,
2674 pub lva_to_first_symbol: U32<LE>,
2675 pub number_of_linenumbers: U32<LE>,
2676 pub lva_to_first_linenumber: U32<LE>,
2677 pub rva_to_first_byte_of_code: U32<LE>,
2678 pub rva_to_last_byte_of_code: U32<LE>,
2679 pub rva_to_first_byte_of_data: U32<LE>,
2680 pub rva_to_last_byte_of_data: U32<LE>,
2681}
2682
2683pub const FRAME_FPO: u16 = 0;
2684pub const FRAME_TRAP: u16 = 1;
2685pub const FRAME_TSS: u16 = 2;
2686pub const FRAME_NONFPO: u16 = 3;
2687
2688/*
2689// TODO? bitfields
2690#[derive(Debug, Clone, Copy)]
2691#[repr(C)]
2692pub struct FpoData {
2693/// offset 1st byte of function code
2694 pub ul_off_start: U32<LE>,
2695/// # bytes in function
2696 pub cb_proc_size: U32<LE>,
2697/// # bytes in locals/4
2698 pub cdw_locals: U32<LE>,
2699/// # bytes in params/4
2700 pub cdw_params: U16<LE>,
2701/// # bytes in prolog
2702 WORD cbProlog : 8;
2703/// # regs saved
2704 WORD cbRegs : 3;
2705/// TRUE if SEH in func
2706 WORD fHasSEH : 1;
2707/// TRUE if EBP has been allocated
2708 WORD fUseBP : 1;
2709/// reserved for future use
2710 WORD reserved : 1;
2711/// frame type
2712 WORD cbFrame : 2;
2713}
2714pub const SIZEOF_RFPO_DATA: usize = 16;
2715*/
2716
2717pub const IMAGE_DEBUG_MISC_EXENAME: u16 = 1;
2718
2719#[derive(Debug, Clone, Copy)]
2720#[repr(C)]
2721pub struct ImageDebugMisc {
2722 /// type of misc data, see defines
2723 pub data_type: U32<LE>,
2724 /// total length of record, rounded to four byte multiple.
2725 pub length: U32<LE>,
2726 /// TRUE if data is unicode string
2727 pub unicode: u8,
2728 pub reserved: [u8; 3],
2729 // Actual data
2730 //pub data: [u8; 1],
2731}
2732
2733//
2734// Function table extracted from MIPS/ALPHA/IA64 images. Does not contain
2735// information needed only for runtime support. Just those fields for
2736// each entry needed by a debugger.
2737//
2738
2739#[derive(Debug, Clone, Copy)]
2740#[repr(C)]
2741pub struct ImageFunctionEntry {
2742 pub starting_address: U32<LE>,
2743 pub ending_address: U32<LE>,
2744 pub end_of_prologue: U32<LE>,
2745}
2746
2747#[derive(Debug, Clone, Copy)]
2748#[repr(C)]
2749pub struct ImageFunctionEntry64 {
2750 pub starting_address: U64<LE>,
2751 pub ending_address: U64<LE>,
2752 pub end_of_prologue_or_unwind_info_address: U64<LE>,
2753}
2754
2755//
2756// Debugging information can be stripped from an image file and placed
2757// in a separate .DBG file, whose file name part is the same as the
2758// image file name part (e.g. symbols for CMD.EXE could be stripped
2759// and placed in CMD.DBG). This is indicated by the IMAGE_FILE_DEBUG_STRIPPED
2760// flag in the Characteristics field of the file header. The beginning of
2761// the .DBG file contains the following structure which captures certain
2762// information from the image file. This allows a debug to proceed even if
2763// the original image file is not accessible. This header is followed by
2764// zero of more IMAGE_SECTION_HEADER structures, followed by zero or more
2765// IMAGE_DEBUG_DIRECTORY structures. The latter structures and those in
2766// the image file contain file offsets relative to the beginning of the
2767// .DBG file.
2768//
2769// If symbols have been stripped from an image, the IMAGE_DEBUG_MISC structure
2770// is left in the image file, but not mapped. This allows a debugger to
2771// compute the name of the .DBG file, from the name of the image in the
2772// IMAGE_DEBUG_MISC structure.
2773//
2774
2775#[derive(Debug, Clone, Copy)]
2776#[repr(C)]
2777pub struct ImageSeparateDebugHeader {
2778 pub signature: U16<LE>,
2779 pub flags: U16<LE>,
2780 pub machine: U16<LE>,
2781 pub characteristics: U16<LE>,
2782 pub time_date_stamp: U32<LE>,
2783 pub check_sum: U32<LE>,
2784 pub image_base: U32<LE>,
2785 pub size_of_image: U32<LE>,
2786 pub number_of_sections: U32<LE>,
2787 pub exported_names_size: U32<LE>,
2788 pub debug_directory_size: U32<LE>,
2789 pub section_alignment: U32<LE>,
2790 pub reserved: [U32<LE>; 2],
2791}
2792
2793#[derive(Debug, Clone, Copy)]
2794#[repr(C)]
2795pub struct NonPagedDebugInfo {
2796 pub signature: U16<LE>,
2797 pub flags: U16<LE>,
2798 pub size: U32<LE>,
2799 pub machine: U16<LE>,
2800 pub characteristics: U16<LE>,
2801 pub time_date_stamp: U32<LE>,
2802 pub check_sum: U32<LE>,
2803 pub size_of_image: U32<LE>,
2804 pub image_base: U64<LE>,
2805 //debug_directory_size
2806 //ImageDebugDirectory
2807}
2808
2809pub const IMAGE_SEPARATE_DEBUG_SIGNATURE: u16 = 0x4944;
2810pub const NON_PAGED_DEBUG_SIGNATURE: u16 = 0x494E;
2811
2812pub const IMAGE_SEPARATE_DEBUG_FLAGS_MASK: u16 = 0x8000;
2813/// when DBG was updated, the old checksum didn't match.
2814pub const IMAGE_SEPARATE_DEBUG_MISMATCH: u16 = 0x8000;
2815
2816//
2817// The .arch section is made up of headers, each describing an amask position/value
2818// pointing to an array of IMAGE_ARCHITECTURE_ENTRY's. Each "array" (both the header
2819// and entry arrays) are terminiated by a quadword of 0xffffffffL.
2820//
2821// NOTE: There may be quadwords of 0 sprinkled around and must be skipped.
2822//
2823
2824/*
2825// TODO? bitfields
2826#[derive(Debug, Clone, Copy)]
2827#[repr(C)]
2828pub struct ImageArchitectureHeader {
2829 /// 1 -> code section depends on mask bit
2830 /// 0 -> new instruction depends on mask bit
2831 unsigned int AmaskValue: 1;
2832 /// MBZ
2833 int :7;
2834 /// Amask bit in question for this fixup
2835 unsigned int AmaskShift: 8;
2836 /// MBZ
2837 int :16;
2838 /// RVA into .arch section to array of ARCHITECTURE_ENTRY's
2839 pub first_entry_rva: U32<LE>,
2840}
2841*/
2842
2843#[derive(Debug, Clone, Copy)]
2844#[repr(C)]
2845pub struct ImageArchitectureEntry {
2846 /// RVA of instruction to fixup
2847 pub fixup_inst_rva: U32<LE>,
2848 /// fixup instruction (see alphaops.h)
2849 pub new_inst: U32<LE>,
2850}
2851
2852// The following structure defines the new import object. Note the values of the first two fields,
2853// which must be set as stated in order to differentiate old and new import members.
2854// Following this structure, the linker emits two null-terminated strings used to recreate the
2855// import at the time of use. The first string is the import's name, the second is the dll's name.
2856
2857pub const IMPORT_OBJECT_HDR_SIG2: u16 = 0xffff;
2858
2859#[derive(Debug, Clone, Copy)]
2860#[repr(C)]
2861pub struct ImportObjectHeader {
2862 /// Must be IMAGE_FILE_MACHINE_UNKNOWN
2863 pub sig1: U16<LE>,
2864 /// Must be IMPORT_OBJECT_HDR_SIG2.
2865 pub sig2: U16<LE>,
2866 pub version: U16<LE>,
2867 pub machine: U16<LE>,
2868 /// Time/date stamp
2869 pub time_date_stamp: U32<LE>,
2870 /// particularly useful for incremental links
2871 pub size_of_data: U32<LE>,
2872
2873 /// if grf & IMPORT_OBJECT_ORDINAL
2874 pub ordinal_or_hint: U16<LE>,
2875
2876 // WORD Type : 2;
2877 // WORD NameType : 3;
2878 // WORD Reserved : 11;
2879 pub name_type: U16<LE>,
2880}
2881
2882pub const IMPORT_OBJECT_TYPE_MASK: u16 = 0b11;
2883pub const IMPORT_OBJECT_TYPE_SHIFT: u16 = 0;
2884pub const IMPORT_OBJECT_CODE: u16 = 0;
2885pub const IMPORT_OBJECT_DATA: u16 = 1;
2886pub const IMPORT_OBJECT_CONST: u16 = 2;
2887
2888pub const IMPORT_OBJECT_NAME_MASK: u16 = 0b111;
2889pub const IMPORT_OBJECT_NAME_SHIFT: u16 = 2;
2890/// Import by ordinal
2891pub const IMPORT_OBJECT_ORDINAL: u16 = 0;
2892/// Import name == public symbol name.
2893pub const IMPORT_OBJECT_NAME: u16 = 1;
2894/// Import name == public symbol name skipping leading ?, @, or optionally _.
2895pub const IMPORT_OBJECT_NAME_NO_PREFIX: u16 = 2;
2896/// Import name == public symbol name skipping leading ?, @, or optionally _ and truncating at first @.
2897pub const IMPORT_OBJECT_NAME_UNDECORATE: u16 = 3;
2898/// Import name == a name is explicitly provided after the DLL name.
2899pub const IMPORT_OBJECT_NAME_EXPORTAS: u16 = 4;
2900
2901// COM+ Header entry point flags.
2902pub const COMIMAGE_FLAGS_ILONLY: u32 = 0x0000_0001;
2903pub const COMIMAGE_FLAGS_32BITREQUIRED: u32 = 0x0000_0002;
2904pub const COMIMAGE_FLAGS_IL_LIBRARY: u32 = 0x0000_0004;
2905pub const COMIMAGE_FLAGS_STRONGNAMESIGNED: u32 = 0x0000_0008;
2906pub const COMIMAGE_FLAGS_NATIVE_ENTRYPOINT: u32 = 0x0000_0010;
2907pub const COMIMAGE_FLAGS_TRACKDEBUGDATA: u32 = 0x0001_0000;
2908pub const COMIMAGE_FLAGS_32BITPREFERRED: u32 = 0x0002_0000;
2909
2910// Version flags for image.
2911pub const COR_VERSION_MAJOR_V2: u16 = 2;
2912pub const COR_VERSION_MAJOR: u16 = COR_VERSION_MAJOR_V2;
2913pub const COR_VERSION_MINOR: u16 = 5;
2914pub const COR_DELETED_NAME_LENGTH: usize = 8;
2915pub const COR_VTABLEGAP_NAME_LENGTH: usize = 8;
2916
2917// Maximum size of a NativeType descriptor.
2918pub const NATIVE_TYPE_MAX_CB: u16 = 1;
2919pub const COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE: u16 = 0xFF;
2920
2921// Consts for the MIH FLAGS
2922pub const IMAGE_COR_MIH_METHODRVA: u16 = 0x01;
2923pub const IMAGE_COR_MIH_EHRVA: u16 = 0x02;
2924pub const IMAGE_COR_MIH_BASICBLOCK: u16 = 0x08;
2925
2926// V-table constants
2927/// V-table slots are 32-bits in size.
2928pub const COR_VTABLE_32BIT: u16 = 0x01;
2929/// V-table slots are 64-bits in size.
2930pub const COR_VTABLE_64BIT: u16 = 0x02;
2931/// If set, transition from unmanaged.
2932pub const COR_VTABLE_FROM_UNMANAGED: u16 = 0x04;
2933/// If set, transition from unmanaged with keeping the current appdomain.
2934pub const COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN: u16 = 0x08;
2935/// Call most derived method described by
2936pub const COR_VTABLE_CALL_MOST_DERIVED: u16 = 0x10;
2937
2938// EATJ constants
2939/// Size of a jump thunk reserved range.
2940pub const IMAGE_COR_EATJ_THUNK_SIZE: usize = 32;
2941
2942// Max name lengths
2943pub const MAX_CLASS_NAME: usize = 1024;
2944pub const MAX_PACKAGE_NAME: usize = 1024;
2945
2946// CLR 2.0 header structure.
2947#[derive(Debug, Clone, Copy)]
2948#[repr(C)]
2949pub struct ImageCor20Header {
2950 // Header versioning
2951 pub cb: U32<LE>,
2952 pub major_runtime_version: U16<LE>,
2953 pub minor_runtime_version: U16<LE>,
2954
2955 // Symbol table and startup information
2956 pub meta_data: ImageDataDirectory,
2957 pub flags: U32<LE>,
2958
2959 // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is not set, EntryPointToken represents a managed entrypoint.
2960 // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is set, EntryPointRVA represents an RVA to a native entrypoint.
2961 pub entry_point_token_or_rva: U32<LE>,
2962
2963 // Binding information
2964 pub resources: ImageDataDirectory,
2965 pub strong_name_signature: ImageDataDirectory,
2966
2967 // Regular fixup and binding information
2968 pub code_manager_table: ImageDataDirectory,
2969 pub vtable_fixups: ImageDataDirectory,
2970 pub export_address_table_jumps: ImageDataDirectory,
2971
2972 // Precompiled image info (internal use only - set to zero)
2973 pub managed_native_header: ImageDataDirectory,
2974}
2975
2976unsafe_impl_pod!(
2977 ImageDosHeader,
2978 ImageOs2Header,
2979 ImageVxdHeader,
2980 ImageFileHeader,
2981 ImageDataDirectory,
2982 ImageOptionalHeader32,
2983 ImageRomOptionalHeader,
2984 ImageOptionalHeader64,
2985 ImageNtHeaders64,
2986 ImageNtHeaders32,
2987 ImageRomHeaders,
2988 Guid,
2989 AnonObjectHeader,
2990 AnonObjectHeaderV2,
2991 AnonObjectHeaderBigobj,
2992 ImageSectionHeader,
2993 ImageSymbol,
2994 ImageSymbolBytes,
2995 ImageSymbolEx,
2996 ImageSymbolExBytes,
2997 ImageAuxSymbolTokenDef,
2998 ImageAuxSymbolFunction,
2999 ImageAuxSymbolFunctionBeginEnd,
3000 ImageAuxSymbolWeak,
3001 ImageAuxSymbolSection,
3002 ImageAuxSymbolCrc,
3003 ImageRelocation,
3004 ImageLinenumber,
3005 ImageBaseRelocation,
3006 ImageArchiveMemberHeader,
3007 ImageExportDirectory,
3008 ImageImportByName,
3009 ImageThunkData64,
3010 ImageThunkData32,
3011 ImageTlsDirectory64,
3012 ImageTlsDirectory32,
3013 ImageImportDescriptor,
3014 ImageBoundImportDescriptor,
3015 ImageBoundForwarderRef,
3016 ImageDelayloadDescriptor,
3017 ImageResourceDirectory,
3018 ImageResourceDirectoryEntry,
3019 ImageResourceDirectoryString,
3020 ImageResourceDirStringU,
3021 ImageResourceDataEntry,
3022 ImageLoadConfigCodeIntegrity,
3023 ImageDynamicRelocationTable,
3024 ImageDynamicRelocation32,
3025 ImageDynamicRelocation64,
3026 ImageDynamicRelocation32V2,
3027 ImageDynamicRelocation64V2,
3028 ImagePrologueDynamicRelocationHeader,
3029 ImageEpilogueDynamicRelocationHeader,
3030 //ImageImportControlTransferDynamicRelocation,
3031 //ImageIndirControlTransferDynamicRelocation,
3032 //ImageSwitchtableBranchDynamicRelocation,
3033 ImageLoadConfigDirectory32,
3034 ImageLoadConfigDirectory64,
3035 ImageHotPatchInfo,
3036 ImageHotPatchBase,
3037 ImageHotPatchHashes,
3038 //ImageCeRuntimeFunctionEntry,
3039 ImageArmRuntimeFunctionEntry,
3040 ImageArm64RuntimeFunctionEntry,
3041 ImageAlpha64RuntimeFunctionEntry,
3042 ImageAlphaRuntimeFunctionEntry,
3043 ImageRuntimeFunctionEntry,
3044 ImageEnclaveConfig32,
3045 ImageEnclaveConfig64,
3046 ImageEnclaveImport,
3047 ImageDebugDirectory,
3048 ImageCoffSymbolsHeader,
3049 //FpoData,
3050 ImageDebugMisc,
3051 ImageFunctionEntry,
3052 ImageFunctionEntry64,
3053 ImageSeparateDebugHeader,
3054 NonPagedDebugInfo,
3055 //ImageArchitectureHeader,
3056 ImageArchitectureEntry,
3057 ImportObjectHeader,
3058 ImageCor20Header,
3059 MaskedRichHeaderEntry,
3060);
3061