1 | //! PE/COFF definitions. |
2 | //! |
3 | //! These definitions are independent of read/write support, although we do implement |
4 | //! some traits useful for those. |
5 | //! |
6 | //! This module is based heavily on "winnt.h" (10.0.17763.0). |
7 | |
8 | #![allow (missing_docs)] |
9 | |
10 | use core::convert::TryInto; |
11 | |
12 | use crate::endian::{I32Bytes, LittleEndian as LE, U16Bytes, U32Bytes, I32, U16, U32, U64}; |
13 | use crate::pod::Pod; |
14 | |
15 | /// MZ |
16 | pub const IMAGE_DOS_SIGNATURE: u16 = 0x5A4D; |
17 | /// NE |
18 | pub const IMAGE_OS2_SIGNATURE: u16 = 0x454E; |
19 | /// LE |
20 | pub const IMAGE_OS2_SIGNATURE_LE: u16 = 0x454C; |
21 | /// LE |
22 | pub const IMAGE_VXD_SIGNATURE: u16 = 0x454C; |
23 | /// PE00 |
24 | pub const IMAGE_NT_SIGNATURE: u32 = 0x0000_4550; |
25 | |
26 | /// DOS .EXE header |
27 | #[derive (Debug, Clone, Copy)] |
28 | #[repr (C)] |
29 | pub struct ImageDosHeader { |
30 | /// Magic number |
31 | pub e_magic: U16<LE>, |
32 | /// Bytes on last page of file |
33 | pub e_cblp: U16<LE>, |
34 | /// Pages in file |
35 | pub e_cp: U16<LE>, |
36 | /// Relocations |
37 | pub e_crlc: U16<LE>, |
38 | /// Size of header in paragraphs |
39 | pub e_cparhdr: U16<LE>, |
40 | /// Minimum extra paragraphs needed |
41 | pub e_minalloc: U16<LE>, |
42 | /// Maximum extra paragraphs needed |
43 | pub e_maxalloc: U16<LE>, |
44 | /// Initial (relative) SS value |
45 | pub e_ss: U16<LE>, |
46 | /// Initial SP value |
47 | pub e_sp: U16<LE>, |
48 | /// Checksum |
49 | pub e_csum: U16<LE>, |
50 | /// Initial IP value |
51 | pub e_ip: U16<LE>, |
52 | /// Initial (relative) CS value |
53 | pub e_cs: U16<LE>, |
54 | /// File address of relocation table |
55 | pub e_lfarlc: U16<LE>, |
56 | /// Overlay number |
57 | pub e_ovno: U16<LE>, |
58 | /// Reserved words |
59 | pub e_res: [U16<LE>; 4], |
60 | /// OEM identifier (for e_oeminfo) |
61 | pub e_oemid: U16<LE>, |
62 | /// OEM information; e_oemid specific |
63 | pub e_oeminfo: U16<LE>, |
64 | /// Reserved words |
65 | pub e_res2: [U16<LE>; 10], |
66 | /// File address of new exe header |
67 | pub e_lfanew: U32<LE>, |
68 | } |
69 | |
70 | /// OS/2 .EXE header |
71 | #[derive (Debug, Clone, Copy)] |
72 | #[repr (C)] |
73 | pub struct ImageOs2Header { |
74 | /// Magic number |
75 | pub ne_magic: U16<LE>, |
76 | /// Version number |
77 | pub ne_ver: i8, |
78 | /// Revision number |
79 | pub ne_rev: i8, |
80 | /// Offset of Entry Table |
81 | pub ne_enttab: U16<LE>, |
82 | /// Number of bytes in Entry Table |
83 | pub ne_cbenttab: U16<LE>, |
84 | /// Checksum of whole file |
85 | pub ne_crc: I32<LE>, |
86 | /// Flag word |
87 | pub ne_flags: U16<LE>, |
88 | /// Automatic data segment number |
89 | pub ne_autodata: U16<LE>, |
90 | /// Initial heap allocation |
91 | pub ne_heap: U16<LE>, |
92 | /// Initial stack allocation |
93 | pub ne_stack: U16<LE>, |
94 | /// Initial CS:IP setting |
95 | pub ne_csip: I32<LE>, |
96 | /// Initial SS:SP setting |
97 | pub ne_sssp: I32<LE>, |
98 | /// Count of file segments |
99 | pub ne_cseg: U16<LE>, |
100 | /// Entries in Module Reference Table |
101 | pub ne_cmod: U16<LE>, |
102 | /// Size of non-resident name table |
103 | pub ne_cbnrestab: U16<LE>, |
104 | /// Offset of Segment Table |
105 | pub ne_segtab: U16<LE>, |
106 | /// Offset of Resource Table |
107 | pub ne_rsrctab: U16<LE>, |
108 | /// Offset of resident name table |
109 | pub ne_restab: U16<LE>, |
110 | /// Offset of Module Reference Table |
111 | pub ne_modtab: U16<LE>, |
112 | /// Offset of Imported Names Table |
113 | pub ne_imptab: U16<LE>, |
114 | /// Offset of Non-resident Names Table |
115 | pub ne_nrestab: I32<LE>, |
116 | /// Count of movable entries |
117 | pub ne_cmovent: U16<LE>, |
118 | /// Segment alignment shift count |
119 | pub ne_align: U16<LE>, |
120 | /// Count of resource segments |
121 | pub ne_cres: U16<LE>, |
122 | /// Target Operating system |
123 | pub ne_exetyp: u8, |
124 | /// Other .EXE flags |
125 | pub ne_flagsothers: u8, |
126 | /// offset to return thunks |
127 | pub ne_pretthunks: U16<LE>, |
128 | /// offset to segment ref. bytes |
129 | pub ne_psegrefbytes: U16<LE>, |
130 | /// Minimum code swap area size |
131 | pub ne_swaparea: U16<LE>, |
132 | /// Expected Windows version number |
133 | pub ne_expver: U16<LE>, |
134 | } |
135 | |
136 | /// Windows VXD header |
137 | #[derive (Debug, Clone, Copy)] |
138 | #[repr (C)] |
139 | pub struct ImageVxdHeader { |
140 | /// Magic number |
141 | pub e32_magic: U16<LE>, |
142 | /// The byte ordering for the VXD |
143 | pub e32_border: u8, |
144 | /// The word ordering for the VXD |
145 | pub e32_worder: u8, |
146 | /// The EXE format level for now = 0 |
147 | pub e32_level: U32<LE>, |
148 | /// The CPU type |
149 | pub e32_cpu: U16<LE>, |
150 | /// The OS type |
151 | pub e32_os: U16<LE>, |
152 | /// Module version |
153 | pub e32_ver: U32<LE>, |
154 | /// Module flags |
155 | pub e32_mflags: U32<LE>, |
156 | /// Module # pages |
157 | pub e32_mpages: U32<LE>, |
158 | /// Object # for instruction pointer |
159 | pub e32_startobj: U32<LE>, |
160 | /// Extended instruction pointer |
161 | pub e32_eip: U32<LE>, |
162 | /// Object # for stack pointer |
163 | pub e32_stackobj: U32<LE>, |
164 | /// Extended stack pointer |
165 | pub e32_esp: U32<LE>, |
166 | /// VXD page size |
167 | pub e32_pagesize: U32<LE>, |
168 | /// Last page size in VXD |
169 | pub e32_lastpagesize: U32<LE>, |
170 | /// Fixup section size |
171 | pub e32_fixupsize: U32<LE>, |
172 | /// Fixup section checksum |
173 | pub e32_fixupsum: U32<LE>, |
174 | /// Loader section size |
175 | pub e32_ldrsize: U32<LE>, |
176 | /// Loader section checksum |
177 | pub e32_ldrsum: U32<LE>, |
178 | /// Object table offset |
179 | pub e32_objtab: U32<LE>, |
180 | /// Number of objects in module |
181 | pub e32_objcnt: U32<LE>, |
182 | /// Object page map offset |
183 | pub e32_objmap: U32<LE>, |
184 | /// Object iterated data map offset |
185 | pub e32_itermap: U32<LE>, |
186 | /// Offset of Resource Table |
187 | pub e32_rsrctab: U32<LE>, |
188 | /// Number of resource entries |
189 | pub e32_rsrccnt: U32<LE>, |
190 | /// Offset of resident name table |
191 | pub e32_restab: U32<LE>, |
192 | /// Offset of Entry Table |
193 | pub e32_enttab: U32<LE>, |
194 | /// Offset of Module Directive Table |
195 | pub e32_dirtab: U32<LE>, |
196 | /// Number of module directives |
197 | pub e32_dircnt: U32<LE>, |
198 | /// Offset of Fixup Page Table |
199 | pub e32_fpagetab: U32<LE>, |
200 | /// Offset of Fixup Record Table |
201 | pub e32_frectab: U32<LE>, |
202 | /// Offset of Import Module Name Table |
203 | pub e32_impmod: U32<LE>, |
204 | /// Number of entries in Import Module Name Table |
205 | pub e32_impmodcnt: U32<LE>, |
206 | /// Offset of Import Procedure Name Table |
207 | pub e32_impproc: U32<LE>, |
208 | /// Offset of Per-Page Checksum Table |
209 | pub e32_pagesum: U32<LE>, |
210 | /// Offset of Enumerated Data Pages |
211 | pub e32_datapage: U32<LE>, |
212 | /// Number of preload pages |
213 | pub e32_preload: U32<LE>, |
214 | /// Offset of Non-resident Names Table |
215 | pub e32_nrestab: U32<LE>, |
216 | /// Size of Non-resident Name Table |
217 | pub e32_cbnrestab: U32<LE>, |
218 | /// Non-resident Name Table Checksum |
219 | pub e32_nressum: U32<LE>, |
220 | /// Object # for automatic data object |
221 | pub e32_autodata: U32<LE>, |
222 | /// Offset of the debugging information |
223 | pub e32_debuginfo: U32<LE>, |
224 | /// The length of the debugging info. in bytes |
225 | pub e32_debuglen: U32<LE>, |
226 | /// Number of instance pages in preload section of VXD file |
227 | pub e32_instpreload: U32<LE>, |
228 | /// Number of instance pages in demand load section of VXD file |
229 | pub e32_instdemand: U32<LE>, |
230 | /// Size of heap - for 16-bit apps |
231 | pub e32_heapsize: U32<LE>, |
232 | /// Reserved words |
233 | pub e32_res3: [u8; 12], |
234 | pub e32_winresoff: U32<LE>, |
235 | pub e32_winreslen: U32<LE>, |
236 | /// Device ID for VxD |
237 | pub e32_devid: U16<LE>, |
238 | /// DDK version for VxD |
239 | pub e32_ddkver: U16<LE>, |
240 | } |
241 | |
242 | /// A PE rich header entry. |
243 | /// |
244 | /// Rich headers have no official documentation, but have been heavily |
245 | /// reversed-engineered and documented in the wild, e.g.: |
246 | /// * `http://www.ntcore.com/files/richsign.htm` |
247 | /// * `https://www.researchgate.net/figure/Structure-of-the-Rich-Header_fig1_318145388` |
248 | /// |
249 | /// This data is "masked", i.e. XORed with a checksum derived from the file data. |
250 | #[derive (Debug, Clone, Copy)] |
251 | #[repr (C)] |
252 | pub struct MaskedRichHeaderEntry { |
253 | pub masked_comp_id: U32<LE>, |
254 | pub masked_count: U32<LE>, |
255 | } |
256 | |
257 | // |
258 | // File header format. |
259 | // |
260 | |
261 | #[derive (Debug, Clone, Copy)] |
262 | #[repr (C)] |
263 | pub struct ImageFileHeader { |
264 | pub machine: U16<LE>, |
265 | pub number_of_sections: U16<LE>, |
266 | pub time_date_stamp: U32<LE>, |
267 | pub pointer_to_symbol_table: U32<LE>, |
268 | pub number_of_symbols: U32<LE>, |
269 | pub size_of_optional_header: U16<LE>, |
270 | pub characteristics: U16<LE>, |
271 | } |
272 | |
273 | pub const IMAGE_SIZEOF_FILE_HEADER: usize = 20; |
274 | |
275 | /// Relocation info stripped from file. |
276 | pub const IMAGE_FILE_RELOCS_STRIPPED: u16 = 0x0001; |
277 | /// File is executable (i.e. no unresolved external references). |
278 | pub const IMAGE_FILE_EXECUTABLE_IMAGE: u16 = 0x0002; |
279 | /// Line numbers stripped from file. |
280 | pub const IMAGE_FILE_LINE_NUMS_STRIPPED: u16 = 0x0004; |
281 | /// Local symbols stripped from file. |
282 | pub const IMAGE_FILE_LOCAL_SYMS_STRIPPED: u16 = 0x0008; |
283 | /// Aggressively trim working set |
284 | pub const IMAGE_FILE_AGGRESIVE_WS_TRIM: u16 = 0x0010; |
285 | /// App can handle >2gb addresses |
286 | pub const IMAGE_FILE_LARGE_ADDRESS_AWARE: u16 = 0x0020; |
287 | /// Bytes of machine word are reversed. |
288 | pub const IMAGE_FILE_BYTES_REVERSED_LO: u16 = 0x0080; |
289 | /// 32 bit word machine. |
290 | pub const IMAGE_FILE_32BIT_MACHINE: u16 = 0x0100; |
291 | /// Debugging info stripped from file in .DBG file |
292 | pub const IMAGE_FILE_DEBUG_STRIPPED: u16 = 0x0200; |
293 | /// If Image is on removable media, copy and run from the swap file. |
294 | pub const IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP: u16 = 0x0400; |
295 | /// If Image is on Net, copy and run from the swap file. |
296 | pub const IMAGE_FILE_NET_RUN_FROM_SWAP: u16 = 0x0800; |
297 | /// System File. |
298 | pub const IMAGE_FILE_SYSTEM: u16 = 0x1000; |
299 | /// File is a DLL. |
300 | pub const IMAGE_FILE_DLL: u16 = 0x2000; |
301 | /// File should only be run on a UP machine |
302 | pub const IMAGE_FILE_UP_SYSTEM_ONLY: u16 = 0x4000; |
303 | /// Bytes of machine word are reversed. |
304 | pub const IMAGE_FILE_BYTES_REVERSED_HI: u16 = 0x8000; |
305 | |
306 | pub const IMAGE_FILE_MACHINE_UNKNOWN: u16 = 0; |
307 | /// Useful for indicating we want to interact with the host and not a WoW guest. |
308 | pub const IMAGE_FILE_MACHINE_TARGET_HOST: u16 = 0x0001; |
309 | /// Intel 386. |
310 | pub const IMAGE_FILE_MACHINE_I386: u16 = 0x014c; |
311 | /// MIPS little-endian, 0x160 big-endian |
312 | pub const IMAGE_FILE_MACHINE_R3000: u16 = 0x0162; |
313 | /// MIPS little-endian |
314 | pub const IMAGE_FILE_MACHINE_R4000: u16 = 0x0166; |
315 | /// MIPS little-endian |
316 | pub const IMAGE_FILE_MACHINE_R10000: u16 = 0x0168; |
317 | /// MIPS little-endian WCE v2 |
318 | pub const IMAGE_FILE_MACHINE_WCEMIPSV2: u16 = 0x0169; |
319 | /// Alpha_AXP |
320 | pub const IMAGE_FILE_MACHINE_ALPHA: u16 = 0x0184; |
321 | /// SH3 little-endian |
322 | pub const IMAGE_FILE_MACHINE_SH3: u16 = 0x01a2; |
323 | pub const IMAGE_FILE_MACHINE_SH3DSP: u16 = 0x01a3; |
324 | /// SH3E little-endian |
325 | pub const IMAGE_FILE_MACHINE_SH3E: u16 = 0x01a4; |
326 | /// SH4 little-endian |
327 | pub const IMAGE_FILE_MACHINE_SH4: u16 = 0x01a6; |
328 | /// SH5 |
329 | pub const IMAGE_FILE_MACHINE_SH5: u16 = 0x01a8; |
330 | /// ARM Little-Endian |
331 | pub const IMAGE_FILE_MACHINE_ARM: u16 = 0x01c0; |
332 | /// ARM Thumb/Thumb-2 Little-Endian |
333 | pub const IMAGE_FILE_MACHINE_THUMB: u16 = 0x01c2; |
334 | /// ARM Thumb-2 Little-Endian |
335 | pub const IMAGE_FILE_MACHINE_ARMNT: u16 = 0x01c4; |
336 | pub const IMAGE_FILE_MACHINE_AM33: u16 = 0x01d3; |
337 | /// IBM PowerPC Little-Endian |
338 | pub const IMAGE_FILE_MACHINE_POWERPC: u16 = 0x01F0; |
339 | pub const IMAGE_FILE_MACHINE_POWERPCFP: u16 = 0x01f1; |
340 | /// Intel 64 |
341 | pub const IMAGE_FILE_MACHINE_IA64: u16 = 0x0200; |
342 | /// MIPS |
343 | pub const IMAGE_FILE_MACHINE_MIPS16: u16 = 0x0266; |
344 | /// ALPHA64 |
345 | pub const IMAGE_FILE_MACHINE_ALPHA64: u16 = 0x0284; |
346 | /// MIPS |
347 | pub const IMAGE_FILE_MACHINE_MIPSFPU: u16 = 0x0366; |
348 | /// MIPS |
349 | pub const IMAGE_FILE_MACHINE_MIPSFPU16: u16 = 0x0466; |
350 | pub const IMAGE_FILE_MACHINE_AXP64: u16 = IMAGE_FILE_MACHINE_ALPHA64; |
351 | /// Infineon |
352 | pub const IMAGE_FILE_MACHINE_TRICORE: u16 = 0x0520; |
353 | pub const IMAGE_FILE_MACHINE_CEF: u16 = 0x0CEF; |
354 | /// EFI Byte Code |
355 | pub const IMAGE_FILE_MACHINE_EBC: u16 = 0x0EBC; |
356 | /// AMD64 (K8) |
357 | pub const IMAGE_FILE_MACHINE_AMD64: u16 = 0x8664; |
358 | /// M32R little-endian |
359 | pub const IMAGE_FILE_MACHINE_M32R: u16 = 0x9041; |
360 | /// ARM64 Little-Endian |
361 | pub const IMAGE_FILE_MACHINE_ARM64: u16 = 0xAA64; |
362 | /// ARM64EC ("Emulation Compatible") |
363 | pub const IMAGE_FILE_MACHINE_ARM64EC: u16 = 0xA641; |
364 | pub const IMAGE_FILE_MACHINE_CEE: u16 = 0xC0EE; |
365 | /// RISCV32 |
366 | pub const IMAGE_FILE_MACHINE_RISCV32: u16 = 0x5032; |
367 | /// RISCV64 |
368 | pub const IMAGE_FILE_MACHINE_RISCV64: u16 = 0x5064; |
369 | /// RISCV128 |
370 | pub const IMAGE_FILE_MACHINE_RISCV128: u16 = 0x5128; |
371 | |
372 | // |
373 | // Directory format. |
374 | // |
375 | |
376 | #[derive (Debug, Clone, Copy)] |
377 | #[repr (C)] |
378 | pub struct ImageDataDirectory { |
379 | pub virtual_address: U32<LE>, |
380 | pub size: U32<LE>, |
381 | } |
382 | |
383 | pub const IMAGE_NUMBEROF_DIRECTORY_ENTRIES: usize = 16; |
384 | |
385 | // |
386 | // Optional header format. |
387 | // |
388 | |
389 | #[derive (Debug, Clone, Copy)] |
390 | #[repr (C)] |
391 | pub struct ImageOptionalHeader32 { |
392 | // Standard fields. |
393 | pub magic: U16<LE>, |
394 | pub major_linker_version: u8, |
395 | pub minor_linker_version: u8, |
396 | pub size_of_code: U32<LE>, |
397 | pub size_of_initialized_data: U32<LE>, |
398 | pub size_of_uninitialized_data: U32<LE>, |
399 | pub address_of_entry_point: U32<LE>, |
400 | pub base_of_code: U32<LE>, |
401 | pub base_of_data: U32<LE>, |
402 | |
403 | // NT additional fields. |
404 | pub image_base: U32<LE>, |
405 | pub section_alignment: U32<LE>, |
406 | pub file_alignment: U32<LE>, |
407 | pub major_operating_system_version: U16<LE>, |
408 | pub minor_operating_system_version: U16<LE>, |
409 | pub major_image_version: U16<LE>, |
410 | pub minor_image_version: U16<LE>, |
411 | pub major_subsystem_version: U16<LE>, |
412 | pub minor_subsystem_version: U16<LE>, |
413 | pub win32_version_value: U32<LE>, |
414 | pub size_of_image: U32<LE>, |
415 | pub size_of_headers: U32<LE>, |
416 | pub check_sum: U32<LE>, |
417 | pub subsystem: U16<LE>, |
418 | pub dll_characteristics: U16<LE>, |
419 | pub size_of_stack_reserve: U32<LE>, |
420 | pub size_of_stack_commit: U32<LE>, |
421 | pub size_of_heap_reserve: U32<LE>, |
422 | pub size_of_heap_commit: U32<LE>, |
423 | pub loader_flags: U32<LE>, |
424 | pub number_of_rva_and_sizes: U32<LE>, |
425 | //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES], |
426 | } |
427 | |
428 | #[derive (Debug, Clone, Copy)] |
429 | #[repr (C)] |
430 | pub struct ImageRomOptionalHeader { |
431 | pub magic: U16<LE>, |
432 | pub major_linker_version: u8, |
433 | pub minor_linker_version: u8, |
434 | pub size_of_code: U32<LE>, |
435 | pub size_of_initialized_data: U32<LE>, |
436 | pub size_of_uninitialized_data: U32<LE>, |
437 | pub address_of_entry_point: U32<LE>, |
438 | pub base_of_code: U32<LE>, |
439 | pub base_of_data: U32<LE>, |
440 | pub base_of_bss: U32<LE>, |
441 | pub gpr_mask: U32<LE>, |
442 | pub cpr_mask: [U32<LE>; 4], |
443 | pub gp_value: U32<LE>, |
444 | } |
445 | |
446 | #[derive (Debug, Clone, Copy)] |
447 | #[repr (C)] |
448 | pub struct ImageOptionalHeader64 { |
449 | pub magic: U16<LE>, |
450 | pub major_linker_version: u8, |
451 | pub minor_linker_version: u8, |
452 | pub size_of_code: U32<LE>, |
453 | pub size_of_initialized_data: U32<LE>, |
454 | pub size_of_uninitialized_data: U32<LE>, |
455 | pub address_of_entry_point: U32<LE>, |
456 | pub base_of_code: U32<LE>, |
457 | pub image_base: U64<LE>, |
458 | pub section_alignment: U32<LE>, |
459 | pub file_alignment: U32<LE>, |
460 | pub major_operating_system_version: U16<LE>, |
461 | pub minor_operating_system_version: U16<LE>, |
462 | pub major_image_version: U16<LE>, |
463 | pub minor_image_version: U16<LE>, |
464 | pub major_subsystem_version: U16<LE>, |
465 | pub minor_subsystem_version: U16<LE>, |
466 | pub win32_version_value: U32<LE>, |
467 | pub size_of_image: U32<LE>, |
468 | pub size_of_headers: U32<LE>, |
469 | pub check_sum: U32<LE>, |
470 | pub subsystem: U16<LE>, |
471 | pub dll_characteristics: U16<LE>, |
472 | pub size_of_stack_reserve: U64<LE>, |
473 | pub size_of_stack_commit: U64<LE>, |
474 | pub size_of_heap_reserve: U64<LE>, |
475 | pub size_of_heap_commit: U64<LE>, |
476 | pub loader_flags: U32<LE>, |
477 | pub number_of_rva_and_sizes: U32<LE>, |
478 | //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES], |
479 | } |
480 | |
481 | pub const IMAGE_NT_OPTIONAL_HDR32_MAGIC: u16 = 0x10b; |
482 | pub const IMAGE_NT_OPTIONAL_HDR64_MAGIC: u16 = 0x20b; |
483 | pub const IMAGE_ROM_OPTIONAL_HDR_MAGIC: u16 = 0x107; |
484 | |
485 | #[derive (Debug, Clone, Copy)] |
486 | #[repr (C)] |
487 | pub struct ImageNtHeaders64 { |
488 | pub signature: U32<LE>, |
489 | pub file_header: ImageFileHeader, |
490 | pub optional_header: ImageOptionalHeader64, |
491 | } |
492 | |
493 | #[derive (Debug, Clone, Copy)] |
494 | #[repr (C)] |
495 | pub struct ImageNtHeaders32 { |
496 | pub signature: U32<LE>, |
497 | pub file_header: ImageFileHeader, |
498 | pub optional_header: ImageOptionalHeader32, |
499 | } |
500 | |
501 | #[derive (Debug, Clone, Copy)] |
502 | #[repr (C)] |
503 | pub struct ImageRomHeaders { |
504 | pub file_header: ImageFileHeader, |
505 | pub optional_header: ImageRomOptionalHeader, |
506 | } |
507 | |
508 | // Values for `ImageOptionalHeader*::subsystem`. |
509 | |
510 | /// Unknown subsystem. |
511 | pub const IMAGE_SUBSYSTEM_UNKNOWN: u16 = 0; |
512 | /// Image doesn't require a subsystem. |
513 | pub const IMAGE_SUBSYSTEM_NATIVE: u16 = 1; |
514 | /// Image runs in the Windows GUI subsystem. |
515 | pub const IMAGE_SUBSYSTEM_WINDOWS_GUI: u16 = 2; |
516 | /// Image runs in the Windows character subsystem. |
517 | pub const IMAGE_SUBSYSTEM_WINDOWS_CUI: u16 = 3; |
518 | /// image runs in the OS/2 character subsystem. |
519 | pub const IMAGE_SUBSYSTEM_OS2_CUI: u16 = 5; |
520 | /// image runs in the Posix character subsystem. |
521 | pub const IMAGE_SUBSYSTEM_POSIX_CUI: u16 = 7; |
522 | /// image is a native Win9x driver. |
523 | pub const IMAGE_SUBSYSTEM_NATIVE_WINDOWS: u16 = 8; |
524 | /// Image runs in the Windows CE subsystem. |
525 | pub const IMAGE_SUBSYSTEM_WINDOWS_CE_GUI: u16 = 9; |
526 | pub const IMAGE_SUBSYSTEM_EFI_APPLICATION: u16 = 10; |
527 | pub const IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER: u16 = 11; |
528 | pub const IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER: u16 = 12; |
529 | pub const IMAGE_SUBSYSTEM_EFI_ROM: u16 = 13; |
530 | pub const IMAGE_SUBSYSTEM_XBOX: u16 = 14; |
531 | pub const IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION: u16 = 16; |
532 | pub const IMAGE_SUBSYSTEM_XBOX_CODE_CATALOG: u16 = 17; |
533 | |
534 | // Values for `ImageOptionalHeader*::dll_characteristics`. |
535 | |
536 | // IMAGE_LIBRARY_PROCESS_INIT 0x0001 // Reserved. |
537 | // IMAGE_LIBRARY_PROCESS_TERM 0x0002 // Reserved. |
538 | // IMAGE_LIBRARY_THREAD_INIT 0x0004 // Reserved. |
539 | // IMAGE_LIBRARY_THREAD_TERM 0x0008 // Reserved. |
540 | /// Image can handle a high entropy 64-bit virtual address space. |
541 | pub const IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA: u16 = 0x0020; |
542 | /// DLL can move. |
543 | pub const IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE: u16 = 0x0040; |
544 | /// Code Integrity Image |
545 | pub const IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY: u16 = 0x0080; |
546 | /// Image is NX compatible |
547 | pub const IMAGE_DLLCHARACTERISTICS_NX_COMPAT: u16 = 0x0100; |
548 | /// Image understands isolation and doesn't want it |
549 | pub const IMAGE_DLLCHARACTERISTICS_NO_ISOLATION: u16 = 0x0200; |
550 | /// Image does not use SEH. No SE handler may reside in this image |
551 | pub const IMAGE_DLLCHARACTERISTICS_NO_SEH: u16 = 0x0400; |
552 | /// Do not bind this image. |
553 | pub const IMAGE_DLLCHARACTERISTICS_NO_BIND: u16 = 0x0800; |
554 | /// Image should execute in an AppContainer |
555 | pub const IMAGE_DLLCHARACTERISTICS_APPCONTAINER: u16 = 0x1000; |
556 | /// Driver uses WDM model |
557 | pub const IMAGE_DLLCHARACTERISTICS_WDM_DRIVER: u16 = 0x2000; |
558 | /// Image supports Control Flow Guard. |
559 | pub const IMAGE_DLLCHARACTERISTICS_GUARD_CF: u16 = 0x4000; |
560 | pub const IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE: u16 = 0x8000; |
561 | |
562 | // Indices for `ImageOptionalHeader*::data_directory`. |
563 | |
564 | /// Export Directory |
565 | pub const IMAGE_DIRECTORY_ENTRY_EXPORT: usize = 0; |
566 | /// Import Directory |
567 | pub const IMAGE_DIRECTORY_ENTRY_IMPORT: usize = 1; |
568 | /// Resource Directory |
569 | pub const IMAGE_DIRECTORY_ENTRY_RESOURCE: usize = 2; |
570 | /// Exception Directory |
571 | pub const IMAGE_DIRECTORY_ENTRY_EXCEPTION: usize = 3; |
572 | /// Security Directory |
573 | pub const IMAGE_DIRECTORY_ENTRY_SECURITY: usize = 4; |
574 | /// Base Relocation Table |
575 | pub const IMAGE_DIRECTORY_ENTRY_BASERELOC: usize = 5; |
576 | /// Debug Directory |
577 | pub const IMAGE_DIRECTORY_ENTRY_DEBUG: usize = 6; |
578 | // IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // (X86 usage) |
579 | /// Architecture Specific Data |
580 | pub const IMAGE_DIRECTORY_ENTRY_ARCHITECTURE: usize = 7; |
581 | /// RVA of GP |
582 | pub const IMAGE_DIRECTORY_ENTRY_GLOBALPTR: usize = 8; |
583 | /// TLS Directory |
584 | pub const IMAGE_DIRECTORY_ENTRY_TLS: usize = 9; |
585 | /// Load Configuration Directory |
586 | pub const IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG: usize = 10; |
587 | /// Bound Import Directory in headers |
588 | pub const IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT: usize = 11; |
589 | /// Import Address Table |
590 | pub const IMAGE_DIRECTORY_ENTRY_IAT: usize = 12; |
591 | /// Delay Load Import Descriptors |
592 | pub const IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT: usize = 13; |
593 | /// COM Runtime descriptor |
594 | pub const IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR: usize = 14; |
595 | |
596 | #[derive (Debug, Clone, Copy, PartialEq, Eq)] |
597 | #[repr (C)] |
598 | pub struct Guid(pub [u8; 16]); |
599 | |
600 | impl Guid { |
601 | #[inline ] |
602 | pub fn data1(self) -> U32<LE> { |
603 | U32::from_bytes(self.0[0..4].try_into().unwrap()) |
604 | } |
605 | |
606 | #[inline ] |
607 | pub fn data2(self) -> U16<LE> { |
608 | U16::from_bytes(self.0[4..6].try_into().unwrap()) |
609 | } |
610 | |
611 | #[inline ] |
612 | pub fn data3(self) -> U16<LE> { |
613 | U16::from_bytes(self.0[6..8].try_into().unwrap()) |
614 | } |
615 | |
616 | #[inline ] |
617 | pub fn data4(self) -> [u8; 8] { |
618 | self.0[8..16].try_into().unwrap() |
619 | } |
620 | } |
621 | |
622 | pub use Guid as ClsId; |
623 | |
624 | /// Non-COFF Object file header |
625 | #[derive (Debug, Clone, Copy)] |
626 | #[repr (C)] |
627 | pub struct AnonObjectHeader { |
628 | /// Must be IMAGE_FILE_MACHINE_UNKNOWN |
629 | pub sig1: U16<LE>, |
630 | /// Must be 0xffff |
631 | pub sig2: U16<LE>, |
632 | /// >= 1 (implies the ClsId field is present) |
633 | pub version: U16<LE>, |
634 | pub machine: U16<LE>, |
635 | pub time_date_stamp: U32<LE>, |
636 | /// Used to invoke CoCreateInstance |
637 | pub class_id: ClsId, |
638 | /// Size of data that follows the header |
639 | pub size_of_data: U32<LE>, |
640 | } |
641 | |
642 | #[derive (Debug, Clone, Copy)] |
643 | #[repr (C)] |
644 | pub struct AnonObjectHeaderV2 { |
645 | /// Must be IMAGE_FILE_MACHINE_UNKNOWN |
646 | pub sig1: U16<LE>, |
647 | /// Must be 0xffff |
648 | pub sig2: U16<LE>, |
649 | /// >= 2 (implies the Flags field is present - otherwise V1) |
650 | pub version: U16<LE>, |
651 | pub machine: U16<LE>, |
652 | pub time_date_stamp: U32<LE>, |
653 | /// Used to invoke CoCreateInstance |
654 | pub class_id: ClsId, |
655 | /// Size of data that follows the header |
656 | pub size_of_data: U32<LE>, |
657 | /// 0x1 -> contains metadata |
658 | pub flags: U32<LE>, |
659 | /// Size of CLR metadata |
660 | pub meta_data_size: U32<LE>, |
661 | /// Offset of CLR metadata |
662 | pub meta_data_offset: U32<LE>, |
663 | } |
664 | |
665 | /// The required value of `AnonObjectHeaderBigobj::class_id`. |
666 | pub const ANON_OBJECT_HEADER_BIGOBJ_CLASS_ID: ClsId = ClsId([ |
667 | 0xC7, 0xA1, 0xBA, 0xD1, 0xEE, 0xBA, 0xA9, 0x4B, 0xAF, 0x20, 0xFA, 0xF6, 0x6A, 0xA4, 0xDC, 0xB8, |
668 | ]); |
669 | |
670 | #[derive (Debug, Clone, Copy)] |
671 | #[repr (C)] |
672 | pub struct AnonObjectHeaderBigobj { |
673 | /* same as ANON_OBJECT_HEADER_V2 */ |
674 | /// Must be IMAGE_FILE_MACHINE_UNKNOWN |
675 | pub sig1: U16<LE>, |
676 | /// Must be 0xffff |
677 | pub sig2: U16<LE>, |
678 | /// >= 2 (implies the Flags field is present) |
679 | pub version: U16<LE>, |
680 | /// Actual machine - IMAGE_FILE_MACHINE_xxx |
681 | pub machine: U16<LE>, |
682 | pub time_date_stamp: U32<LE>, |
683 | /// Must be `ANON_OBJECT_HEADER_BIGOBJ_CLASS_ID`. |
684 | pub class_id: ClsId, |
685 | /// Size of data that follows the header |
686 | pub size_of_data: U32<LE>, |
687 | /// 0x1 -> contains metadata |
688 | pub flags: U32<LE>, |
689 | /// Size of CLR metadata |
690 | pub meta_data_size: U32<LE>, |
691 | /// Offset of CLR metadata |
692 | pub meta_data_offset: U32<LE>, |
693 | |
694 | /* bigobj specifics */ |
695 | /// extended from WORD |
696 | pub number_of_sections: U32<LE>, |
697 | pub pointer_to_symbol_table: U32<LE>, |
698 | pub number_of_symbols: U32<LE>, |
699 | } |
700 | |
701 | pub const IMAGE_SIZEOF_SHORT_NAME: usize = 8; |
702 | |
703 | // |
704 | // Section header format. |
705 | // |
706 | |
707 | #[derive (Debug, Default, Clone, Copy)] |
708 | #[repr (C)] |
709 | pub struct ImageSectionHeader { |
710 | pub name: [u8; IMAGE_SIZEOF_SHORT_NAME], |
711 | pub virtual_size: U32<LE>, |
712 | pub virtual_address: U32<LE>, |
713 | pub size_of_raw_data: U32<LE>, |
714 | pub pointer_to_raw_data: U32<LE>, |
715 | pub pointer_to_relocations: U32<LE>, |
716 | pub pointer_to_linenumbers: U32<LE>, |
717 | pub number_of_relocations: U16<LE>, |
718 | pub number_of_linenumbers: U16<LE>, |
719 | pub characteristics: U32<LE>, |
720 | } |
721 | |
722 | pub const IMAGE_SIZEOF_SECTION_HEADER: usize = 40; |
723 | |
724 | // Values for `ImageSectionHeader::characteristics`. |
725 | |
726 | // IMAGE_SCN_TYPE_REG 0x00000000 // Reserved. |
727 | // IMAGE_SCN_TYPE_DSECT 0x00000001 // Reserved. |
728 | // IMAGE_SCN_TYPE_NOLOAD 0x00000002 // Reserved. |
729 | // IMAGE_SCN_TYPE_GROUP 0x00000004 // Reserved. |
730 | /// Reserved. |
731 | pub const IMAGE_SCN_TYPE_NO_PAD: u32 = 0x0000_0008; |
732 | // IMAGE_SCN_TYPE_COPY 0x00000010 // Reserved. |
733 | |
734 | /// Section contains code. |
735 | pub const IMAGE_SCN_CNT_CODE: u32 = 0x0000_0020; |
736 | /// Section contains initialized data. |
737 | pub const IMAGE_SCN_CNT_INITIALIZED_DATA: u32 = 0x0000_0040; |
738 | /// Section contains uninitialized data. |
739 | pub const IMAGE_SCN_CNT_UNINITIALIZED_DATA: u32 = 0x0000_0080; |
740 | |
741 | /// Reserved. |
742 | pub const IMAGE_SCN_LNK_OTHER: u32 = 0x0000_0100; |
743 | /// Section contains comments or some other type of information. |
744 | pub const IMAGE_SCN_LNK_INFO: u32 = 0x0000_0200; |
745 | // IMAGE_SCN_TYPE_OVER 0x00000400 // Reserved. |
746 | /// Section contents will not become part of image. |
747 | pub const IMAGE_SCN_LNK_REMOVE: u32 = 0x0000_0800; |
748 | /// Section contents comdat. |
749 | pub const IMAGE_SCN_LNK_COMDAT: u32 = 0x0000_1000; |
750 | // 0x00002000 // Reserved. |
751 | // IMAGE_SCN_MEM_PROTECTED - Obsolete 0x00004000 |
752 | /// Reset speculative exceptions handling bits in the TLB entries for this section. |
753 | pub const IMAGE_SCN_NO_DEFER_SPEC_EXC: u32 = 0x0000_4000; |
754 | /// Section content can be accessed relative to GP |
755 | pub const IMAGE_SCN_GPREL: u32 = 0x0000_8000; |
756 | pub const IMAGE_SCN_MEM_FARDATA: u32 = 0x0000_8000; |
757 | // IMAGE_SCN_MEM_SYSHEAP - Obsolete 0x00010000 |
758 | pub const IMAGE_SCN_MEM_PURGEABLE: u32 = 0x0002_0000; |
759 | pub const IMAGE_SCN_MEM_16BIT: u32 = 0x0002_0000; |
760 | pub const IMAGE_SCN_MEM_LOCKED: u32 = 0x0004_0000; |
761 | pub const IMAGE_SCN_MEM_PRELOAD: u32 = 0x0008_0000; |
762 | |
763 | pub const IMAGE_SCN_ALIGN_1BYTES: u32 = 0x0010_0000; |
764 | pub const IMAGE_SCN_ALIGN_2BYTES: u32 = 0x0020_0000; |
765 | pub const IMAGE_SCN_ALIGN_4BYTES: u32 = 0x0030_0000; |
766 | pub const IMAGE_SCN_ALIGN_8BYTES: u32 = 0x0040_0000; |
767 | /// Default alignment if no others are specified. |
768 | pub const IMAGE_SCN_ALIGN_16BYTES: u32 = 0x0050_0000; |
769 | pub const IMAGE_SCN_ALIGN_32BYTES: u32 = 0x0060_0000; |
770 | pub const IMAGE_SCN_ALIGN_64BYTES: u32 = 0x0070_0000; |
771 | pub const IMAGE_SCN_ALIGN_128BYTES: u32 = 0x0080_0000; |
772 | pub const IMAGE_SCN_ALIGN_256BYTES: u32 = 0x0090_0000; |
773 | pub const IMAGE_SCN_ALIGN_512BYTES: u32 = 0x00A0_0000; |
774 | pub const IMAGE_SCN_ALIGN_1024BYTES: u32 = 0x00B0_0000; |
775 | pub const IMAGE_SCN_ALIGN_2048BYTES: u32 = 0x00C0_0000; |
776 | pub const IMAGE_SCN_ALIGN_4096BYTES: u32 = 0x00D0_0000; |
777 | pub const IMAGE_SCN_ALIGN_8192BYTES: u32 = 0x00E0_0000; |
778 | // Unused 0x00F0_0000 |
779 | pub const IMAGE_SCN_ALIGN_MASK: u32 = 0x00F0_0000; |
780 | |
781 | /// Section contains extended relocations. |
782 | pub const IMAGE_SCN_LNK_NRELOC_OVFL: u32 = 0x0100_0000; |
783 | /// Section can be discarded. |
784 | pub const IMAGE_SCN_MEM_DISCARDABLE: u32 = 0x0200_0000; |
785 | /// Section is not cacheable. |
786 | pub const IMAGE_SCN_MEM_NOT_CACHED: u32 = 0x0400_0000; |
787 | /// Section is not pageable. |
788 | pub const IMAGE_SCN_MEM_NOT_PAGED: u32 = 0x0800_0000; |
789 | /// Section is shareable. |
790 | pub const IMAGE_SCN_MEM_SHARED: u32 = 0x1000_0000; |
791 | /// Section is executable. |
792 | pub const IMAGE_SCN_MEM_EXECUTE: u32 = 0x2000_0000; |
793 | /// Section is readable. |
794 | pub const IMAGE_SCN_MEM_READ: u32 = 0x4000_0000; |
795 | /// Section is writeable. |
796 | pub const IMAGE_SCN_MEM_WRITE: u32 = 0x8000_0000; |
797 | |
798 | // |
799 | // TLS Characteristic Flags |
800 | // |
801 | /// Tls index is scaled |
802 | pub const IMAGE_SCN_SCALE_INDEX: u32 = 0x0000_0001; |
803 | |
804 | // |
805 | // Symbol format. |
806 | // |
807 | |
808 | // This struct has alignment 1. |
809 | #[derive (Debug, Clone, Copy)] |
810 | #[repr (C)] |
811 | pub struct ImageSymbol { |
812 | /// If first 4 bytes are 0, then second 4 bytes are offset into string table. |
813 | pub name: [u8; 8], |
814 | pub value: U32Bytes<LE>, |
815 | pub section_number: U16Bytes<LE>, |
816 | pub typ: U16Bytes<LE>, |
817 | pub storage_class: u8, |
818 | pub number_of_aux_symbols: u8, |
819 | } |
820 | |
821 | pub const IMAGE_SIZEOF_SYMBOL: usize = 18; |
822 | |
823 | #[derive (Debug, Clone, Copy)] |
824 | #[repr (C)] |
825 | pub struct ImageSymbolBytes(pub [u8; IMAGE_SIZEOF_SYMBOL]); |
826 | |
827 | // This struct has alignment 1. |
828 | #[derive (Debug, Clone, Copy)] |
829 | #[repr (C)] |
830 | pub struct ImageSymbolEx { |
831 | /// If first 4 bytes are 0, then second 4 bytes are offset into string table. |
832 | pub name: [u8; 8], |
833 | pub value: U32Bytes<LE>, |
834 | pub section_number: I32Bytes<LE>, |
835 | pub typ: U16Bytes<LE>, |
836 | pub storage_class: u8, |
837 | pub number_of_aux_symbols: u8, |
838 | } |
839 | |
840 | pub const IMAGE_SIZEOF_SYMBOL_EX: usize = 20; |
841 | |
842 | #[derive (Debug, Clone, Copy)] |
843 | #[repr (C)] |
844 | pub struct ImageSymbolExBytes(pub [u8; IMAGE_SIZEOF_SYMBOL_EX]); |
845 | |
846 | // Values for `ImageSymbol::section_number`. |
847 | // |
848 | // Symbols have a section number of the section in which they are |
849 | // defined. Otherwise, section numbers have the following meanings: |
850 | |
851 | /// Symbol is undefined or is common. |
852 | pub const IMAGE_SYM_UNDEFINED: i32 = 0; |
853 | /// Symbol is an absolute value. |
854 | pub const IMAGE_SYM_ABSOLUTE: i32 = -1; |
855 | /// Symbol is a special debug item. |
856 | pub const IMAGE_SYM_DEBUG: i32 = -2; |
857 | /// Values 0xFF00-0xFFFF are special |
858 | pub const IMAGE_SYM_SECTION_MAX: u16 = 0xFEFF; |
859 | pub const IMAGE_SYM_SECTION_MAX_EX: u32 = 0x7fff_ffff; |
860 | |
861 | // Values for `ImageSymbol::typ` (basic component). |
862 | |
863 | /// no type. |
864 | pub const IMAGE_SYM_TYPE_NULL: u16 = 0x0000; |
865 | pub const IMAGE_SYM_TYPE_VOID: u16 = 0x0001; |
866 | /// type character. |
867 | pub const IMAGE_SYM_TYPE_CHAR: u16 = 0x0002; |
868 | /// type short integer. |
869 | pub const IMAGE_SYM_TYPE_SHORT: u16 = 0x0003; |
870 | pub const IMAGE_SYM_TYPE_INT: u16 = 0x0004; |
871 | pub const IMAGE_SYM_TYPE_LONG: u16 = 0x0005; |
872 | pub const IMAGE_SYM_TYPE_FLOAT: u16 = 0x0006; |
873 | pub const IMAGE_SYM_TYPE_DOUBLE: u16 = 0x0007; |
874 | pub const IMAGE_SYM_TYPE_STRUCT: u16 = 0x0008; |
875 | pub const IMAGE_SYM_TYPE_UNION: u16 = 0x0009; |
876 | /// enumeration. |
877 | pub const IMAGE_SYM_TYPE_ENUM: u16 = 0x000A; |
878 | /// member of enumeration. |
879 | pub const IMAGE_SYM_TYPE_MOE: u16 = 0x000B; |
880 | pub const IMAGE_SYM_TYPE_BYTE: u16 = 0x000C; |
881 | pub const IMAGE_SYM_TYPE_WORD: u16 = 0x000D; |
882 | pub const IMAGE_SYM_TYPE_UINT: u16 = 0x000E; |
883 | pub const IMAGE_SYM_TYPE_DWORD: u16 = 0x000F; |
884 | pub const IMAGE_SYM_TYPE_PCODE: u16 = 0x8000; |
885 | |
886 | // Values for `ImageSymbol::typ` (derived component). |
887 | |
888 | /// no derived type. |
889 | pub const IMAGE_SYM_DTYPE_NULL: u16 = 0; |
890 | /// pointer. |
891 | pub const IMAGE_SYM_DTYPE_POINTER: u16 = 1; |
892 | /// function. |
893 | pub const IMAGE_SYM_DTYPE_FUNCTION: u16 = 2; |
894 | /// array. |
895 | pub const IMAGE_SYM_DTYPE_ARRAY: u16 = 3; |
896 | |
897 | // Values for `ImageSymbol::storage_class`. |
898 | pub const IMAGE_SYM_CLASS_END_OF_FUNCTION: u8 = 0xff; |
899 | pub const IMAGE_SYM_CLASS_NULL: u8 = 0x00; |
900 | pub const IMAGE_SYM_CLASS_AUTOMATIC: u8 = 0x01; |
901 | pub const IMAGE_SYM_CLASS_EXTERNAL: u8 = 0x02; |
902 | pub const IMAGE_SYM_CLASS_STATIC: u8 = 0x03; |
903 | pub const IMAGE_SYM_CLASS_REGISTER: u8 = 0x04; |
904 | pub const IMAGE_SYM_CLASS_EXTERNAL_DEF: u8 = 0x05; |
905 | pub const IMAGE_SYM_CLASS_LABEL: u8 = 0x06; |
906 | pub const IMAGE_SYM_CLASS_UNDEFINED_LABEL: u8 = 0x07; |
907 | pub const IMAGE_SYM_CLASS_MEMBER_OF_STRUCT: u8 = 0x08; |
908 | pub const IMAGE_SYM_CLASS_ARGUMENT: u8 = 0x09; |
909 | pub const IMAGE_SYM_CLASS_STRUCT_TAG: u8 = 0x0A; |
910 | pub const IMAGE_SYM_CLASS_MEMBER_OF_UNION: u8 = 0x0B; |
911 | pub const IMAGE_SYM_CLASS_UNION_TAG: u8 = 0x0C; |
912 | pub const IMAGE_SYM_CLASS_TYPE_DEFINITION: u8 = 0x0D; |
913 | pub const IMAGE_SYM_CLASS_UNDEFINED_STATIC: u8 = 0x0E; |
914 | pub const IMAGE_SYM_CLASS_ENUM_TAG: u8 = 0x0F; |
915 | pub const IMAGE_SYM_CLASS_MEMBER_OF_ENUM: u8 = 0x10; |
916 | pub const IMAGE_SYM_CLASS_REGISTER_PARAM: u8 = 0x11; |
917 | pub const IMAGE_SYM_CLASS_BIT_FIELD: u8 = 0x12; |
918 | |
919 | pub const IMAGE_SYM_CLASS_FAR_EXTERNAL: u8 = 0x44; |
920 | |
921 | pub const IMAGE_SYM_CLASS_BLOCK: u8 = 0x64; |
922 | pub const IMAGE_SYM_CLASS_FUNCTION: u8 = 0x65; |
923 | pub const IMAGE_SYM_CLASS_END_OF_STRUCT: u8 = 0x66; |
924 | pub const IMAGE_SYM_CLASS_FILE: u8 = 0x67; |
925 | // new |
926 | pub const IMAGE_SYM_CLASS_SECTION: u8 = 0x68; |
927 | pub const IMAGE_SYM_CLASS_WEAK_EXTERNAL: u8 = 0x69; |
928 | |
929 | pub const IMAGE_SYM_CLASS_CLR_TOKEN: u8 = 0x6B; |
930 | |
931 | // type packing constants |
932 | |
933 | pub const N_BTMASK: u16 = 0x000F; |
934 | pub const N_TMASK: u16 = 0x0030; |
935 | pub const N_TMASK1: u16 = 0x00C0; |
936 | pub const N_TMASK2: u16 = 0x00F0; |
937 | pub const N_BTSHFT: usize = 4; |
938 | pub const N_TSHIFT: usize = 2; |
939 | |
940 | pub const IMAGE_SYM_DTYPE_SHIFT: usize = N_BTSHFT; |
941 | |
942 | // |
943 | // Auxiliary entry format. |
944 | // |
945 | |
946 | // Used for both ImageSymbol and ImageSymbolEx (with padding). |
947 | // This struct has alignment 1. |
948 | #[derive (Debug, Clone, Copy)] |
949 | #[repr (C)] |
950 | pub struct ImageAuxSymbolTokenDef { |
951 | /// IMAGE_AUX_SYMBOL_TYPE |
952 | pub aux_type: u8, |
953 | /// Must be 0 |
954 | pub reserved1: u8, |
955 | pub symbol_table_index: U32Bytes<LE>, |
956 | /// Must be 0 |
957 | pub reserved2: [u8; 12], |
958 | } |
959 | |
960 | pub const IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF: u16 = 1; |
961 | |
962 | /// Auxiliary symbol format 1: function definitions. |
963 | // This struct has alignment 1. |
964 | #[derive (Debug, Clone, Copy)] |
965 | #[repr (C)] |
966 | pub struct ImageAuxSymbolFunction { |
967 | pub tag_index: U32Bytes<LE>, |
968 | pub total_size: U32Bytes<LE>, |
969 | pub pointer_to_linenumber: U32Bytes<LE>, |
970 | pub pointer_to_next_function: U32Bytes<LE>, |
971 | pub unused: [u8; 2], |
972 | } |
973 | |
974 | /// Auxiliary symbol format 2: .bf and .ef symbols. |
975 | // This struct has alignment 1. |
976 | #[derive (Debug, Clone, Copy)] |
977 | #[repr (C)] |
978 | pub struct ImageAuxSymbolFunctionBeginEnd { |
979 | pub unused1: [u8; 4], |
980 | /// declaration line number |
981 | pub linenumber: U16Bytes<LE>, |
982 | pub unused2: [u8; 6], |
983 | pub pointer_to_next_function: U32Bytes<LE>, |
984 | pub unused3: [u8; 2], |
985 | } |
986 | |
987 | /// Auxiliary symbol format 3: weak externals. |
988 | /// |
989 | /// Used for both `ImageSymbol` and `ImageSymbolEx` (both with padding). |
990 | // This struct has alignment 1. |
991 | #[derive (Debug, Clone, Copy)] |
992 | #[repr (C)] |
993 | pub struct ImageAuxSymbolWeak { |
994 | /// the weak extern default symbol index |
995 | pub weak_default_sym_index: U32Bytes<LE>, |
996 | pub weak_search_type: U32Bytes<LE>, |
997 | } |
998 | |
999 | /// Auxiliary symbol format 5: sections. |
1000 | /// |
1001 | /// Used for both `ImageSymbol` and `ImageSymbolEx` (with padding). |
1002 | // This struct has alignment 1. |
1003 | #[derive (Debug, Clone, Copy)] |
1004 | #[repr (C)] |
1005 | pub struct ImageAuxSymbolSection { |
1006 | /// section length |
1007 | pub length: U32Bytes<LE>, |
1008 | /// number of relocation entries |
1009 | pub number_of_relocations: U16Bytes<LE>, |
1010 | /// number of line numbers |
1011 | pub number_of_linenumbers: U16Bytes<LE>, |
1012 | /// checksum for communal |
1013 | pub check_sum: U32Bytes<LE>, |
1014 | /// section number to associate with |
1015 | pub number: U16Bytes<LE>, |
1016 | /// communal selection type |
1017 | pub selection: u8, |
1018 | pub reserved: u8, |
1019 | /// high bits of the section number |
1020 | pub high_number: U16Bytes<LE>, |
1021 | } |
1022 | |
1023 | // Used for both ImageSymbol and ImageSymbolEx (both with padding). |
1024 | // This struct has alignment 1. |
1025 | #[derive (Debug, Clone, Copy)] |
1026 | #[repr (C)] |
1027 | pub struct ImageAuxSymbolCrc { |
1028 | pub crc: U32Bytes<LE>, |
1029 | } |
1030 | |
1031 | // |
1032 | // Communal selection types. |
1033 | // |
1034 | |
1035 | pub const IMAGE_COMDAT_SELECT_NODUPLICATES: u8 = 1; |
1036 | pub const IMAGE_COMDAT_SELECT_ANY: u8 = 2; |
1037 | pub const IMAGE_COMDAT_SELECT_SAME_SIZE: u8 = 3; |
1038 | pub const IMAGE_COMDAT_SELECT_EXACT_MATCH: u8 = 4; |
1039 | pub const IMAGE_COMDAT_SELECT_ASSOCIATIVE: u8 = 5; |
1040 | pub const IMAGE_COMDAT_SELECT_LARGEST: u8 = 6; |
1041 | pub const IMAGE_COMDAT_SELECT_NEWEST: u8 = 7; |
1042 | |
1043 | pub const IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY: u16 = 1; |
1044 | pub const IMAGE_WEAK_EXTERN_SEARCH_LIBRARY: u16 = 2; |
1045 | pub const IMAGE_WEAK_EXTERN_SEARCH_ALIAS: u16 = 3; |
1046 | pub const IMAGE_WEAK_EXTERN_ANTI_DEPENDENCY: u16 = 4; |
1047 | |
1048 | // |
1049 | // Relocation format. |
1050 | // |
1051 | |
1052 | // This struct has alignment 1. |
1053 | #[derive (Debug, Clone, Copy)] |
1054 | #[repr (C)] |
1055 | pub struct ImageRelocation { |
1056 | /// Also `RelocCount` when IMAGE_SCN_LNK_NRELOC_OVFL is set |
1057 | pub virtual_address: U32Bytes<LE>, |
1058 | pub symbol_table_index: U32Bytes<LE>, |
1059 | pub typ: U16Bytes<LE>, |
1060 | } |
1061 | |
1062 | // |
1063 | // I386 relocation types. |
1064 | // |
1065 | /// Reference is absolute, no relocation is necessary |
1066 | pub const IMAGE_REL_I386_ABSOLUTE: u16 = 0x0000; |
1067 | /// Direct 16-bit reference to the symbols virtual address |
1068 | pub const IMAGE_REL_I386_DIR16: u16 = 0x0001; |
1069 | /// PC-relative 16-bit reference to the symbols virtual address |
1070 | pub const IMAGE_REL_I386_REL16: u16 = 0x0002; |
1071 | /// Direct 32-bit reference to the symbols virtual address |
1072 | pub const IMAGE_REL_I386_DIR32: u16 = 0x0006; |
1073 | /// Direct 32-bit reference to the symbols virtual address, base not included |
1074 | pub const IMAGE_REL_I386_DIR32NB: u16 = 0x0007; |
1075 | /// Direct 16-bit reference to the segment-selector bits of a 32-bit virtual address |
1076 | pub const IMAGE_REL_I386_SEG12: u16 = 0x0009; |
1077 | pub const IMAGE_REL_I386_SECTION: u16 = 0x000A; |
1078 | pub const IMAGE_REL_I386_SECREL: u16 = 0x000B; |
1079 | /// clr token |
1080 | pub const IMAGE_REL_I386_TOKEN: u16 = 0x000C; |
1081 | /// 7 bit offset from base of section containing target |
1082 | pub const IMAGE_REL_I386_SECREL7: u16 = 0x000D; |
1083 | /// PC-relative 32-bit reference to the symbols virtual address |
1084 | pub const IMAGE_REL_I386_REL32: u16 = 0x0014; |
1085 | |
1086 | // |
1087 | // MIPS relocation types. |
1088 | // |
1089 | /// Reference is absolute, no relocation is necessary |
1090 | pub const IMAGE_REL_MIPS_ABSOLUTE: u16 = 0x0000; |
1091 | pub const IMAGE_REL_MIPS_REFHALF: u16 = 0x0001; |
1092 | pub const IMAGE_REL_MIPS_REFWORD: u16 = 0x0002; |
1093 | pub const IMAGE_REL_MIPS_JMPADDR: u16 = 0x0003; |
1094 | pub const IMAGE_REL_MIPS_REFHI: u16 = 0x0004; |
1095 | pub const IMAGE_REL_MIPS_REFLO: u16 = 0x0005; |
1096 | pub const IMAGE_REL_MIPS_GPREL: u16 = 0x0006; |
1097 | pub const IMAGE_REL_MIPS_LITERAL: u16 = 0x0007; |
1098 | pub const IMAGE_REL_MIPS_SECTION: u16 = 0x000A; |
1099 | pub const IMAGE_REL_MIPS_SECREL: u16 = 0x000B; |
1100 | /// Low 16-bit section relative reference (used for >32k TLS) |
1101 | pub const IMAGE_REL_MIPS_SECRELLO: u16 = 0x000C; |
1102 | /// High 16-bit section relative reference (used for >32k TLS) |
1103 | pub const IMAGE_REL_MIPS_SECRELHI: u16 = 0x000D; |
1104 | /// clr token |
1105 | pub const IMAGE_REL_MIPS_TOKEN: u16 = 0x000E; |
1106 | pub const IMAGE_REL_MIPS_JMPADDR16: u16 = 0x0010; |
1107 | pub const IMAGE_REL_MIPS_REFWORDNB: u16 = 0x0022; |
1108 | pub const IMAGE_REL_MIPS_PAIR: u16 = 0x0025; |
1109 | |
1110 | // |
1111 | // Alpha Relocation types. |
1112 | // |
1113 | pub const IMAGE_REL_ALPHA_ABSOLUTE: u16 = 0x0000; |
1114 | pub const IMAGE_REL_ALPHA_REFLONG: u16 = 0x0001; |
1115 | pub const IMAGE_REL_ALPHA_REFQUAD: u16 = 0x0002; |
1116 | pub const IMAGE_REL_ALPHA_GPREL32: u16 = 0x0003; |
1117 | pub const IMAGE_REL_ALPHA_LITERAL: u16 = 0x0004; |
1118 | pub const IMAGE_REL_ALPHA_LITUSE: u16 = 0x0005; |
1119 | pub const IMAGE_REL_ALPHA_GPDISP: u16 = 0x0006; |
1120 | pub const IMAGE_REL_ALPHA_BRADDR: u16 = 0x0007; |
1121 | pub const IMAGE_REL_ALPHA_HINT: u16 = 0x0008; |
1122 | pub const IMAGE_REL_ALPHA_INLINE_REFLONG: u16 = 0x0009; |
1123 | pub const IMAGE_REL_ALPHA_REFHI: u16 = 0x000A; |
1124 | pub const IMAGE_REL_ALPHA_REFLO: u16 = 0x000B; |
1125 | pub const IMAGE_REL_ALPHA_PAIR: u16 = 0x000C; |
1126 | pub const IMAGE_REL_ALPHA_MATCH: u16 = 0x000D; |
1127 | pub const IMAGE_REL_ALPHA_SECTION: u16 = 0x000E; |
1128 | pub const IMAGE_REL_ALPHA_SECREL: u16 = 0x000F; |
1129 | pub const IMAGE_REL_ALPHA_REFLONGNB: u16 = 0x0010; |
1130 | /// Low 16-bit section relative reference |
1131 | pub const IMAGE_REL_ALPHA_SECRELLO: u16 = 0x0011; |
1132 | /// High 16-bit section relative reference |
1133 | pub const IMAGE_REL_ALPHA_SECRELHI: u16 = 0x0012; |
1134 | /// High 16 bits of 48 bit reference |
1135 | pub const IMAGE_REL_ALPHA_REFQ3: u16 = 0x0013; |
1136 | /// Middle 16 bits of 48 bit reference |
1137 | pub const IMAGE_REL_ALPHA_REFQ2: u16 = 0x0014; |
1138 | /// Low 16 bits of 48 bit reference |
1139 | pub const IMAGE_REL_ALPHA_REFQ1: u16 = 0x0015; |
1140 | /// Low 16-bit GP relative reference |
1141 | pub const IMAGE_REL_ALPHA_GPRELLO: u16 = 0x0016; |
1142 | /// High 16-bit GP relative reference |
1143 | pub const IMAGE_REL_ALPHA_GPRELHI: u16 = 0x0017; |
1144 | |
1145 | // |
1146 | // IBM PowerPC relocation types. |
1147 | // |
1148 | /// NOP |
1149 | pub const IMAGE_REL_PPC_ABSOLUTE: u16 = 0x0000; |
1150 | /// 64-bit address |
1151 | pub const IMAGE_REL_PPC_ADDR64: u16 = 0x0001; |
1152 | /// 32-bit address |
1153 | pub const IMAGE_REL_PPC_ADDR32: u16 = 0x0002; |
1154 | /// 26-bit address, shifted left 2 (branch absolute) |
1155 | pub const IMAGE_REL_PPC_ADDR24: u16 = 0x0003; |
1156 | /// 16-bit address |
1157 | pub const IMAGE_REL_PPC_ADDR16: u16 = 0x0004; |
1158 | /// 16-bit address, shifted left 2 (load doubleword) |
1159 | pub const IMAGE_REL_PPC_ADDR14: u16 = 0x0005; |
1160 | /// 26-bit PC-relative offset, shifted left 2 (branch relative) |
1161 | pub const IMAGE_REL_PPC_REL24: u16 = 0x0006; |
1162 | /// 16-bit PC-relative offset, shifted left 2 (br cond relative) |
1163 | pub const IMAGE_REL_PPC_REL14: u16 = 0x0007; |
1164 | /// 16-bit offset from TOC base |
1165 | pub const IMAGE_REL_PPC_TOCREL16: u16 = 0x0008; |
1166 | /// 16-bit offset from TOC base, shifted left 2 (load doubleword) |
1167 | pub const IMAGE_REL_PPC_TOCREL14: u16 = 0x0009; |
1168 | |
1169 | /// 32-bit addr w/o image base |
1170 | pub const IMAGE_REL_PPC_ADDR32NB: u16 = 0x000A; |
1171 | /// va of containing section (as in an image sectionhdr) |
1172 | pub const IMAGE_REL_PPC_SECREL: u16 = 0x000B; |
1173 | /// sectionheader number |
1174 | pub const IMAGE_REL_PPC_SECTION: u16 = 0x000C; |
1175 | /// substitute TOC restore instruction iff symbol is glue code |
1176 | pub const IMAGE_REL_PPC_IFGLUE: u16 = 0x000D; |
1177 | /// symbol is glue code; virtual address is TOC restore instruction |
1178 | pub const IMAGE_REL_PPC_IMGLUE: u16 = 0x000E; |
1179 | /// va of containing section (limited to 16 bits) |
1180 | pub const IMAGE_REL_PPC_SECREL16: u16 = 0x000F; |
1181 | pub const IMAGE_REL_PPC_REFHI: u16 = 0x0010; |
1182 | pub const IMAGE_REL_PPC_REFLO: u16 = 0x0011; |
1183 | pub const IMAGE_REL_PPC_PAIR: u16 = 0x0012; |
1184 | /// Low 16-bit section relative reference (used for >32k TLS) |
1185 | pub const IMAGE_REL_PPC_SECRELLO: u16 = 0x0013; |
1186 | /// High 16-bit section relative reference (used for >32k TLS) |
1187 | pub const IMAGE_REL_PPC_SECRELHI: u16 = 0x0014; |
1188 | pub const IMAGE_REL_PPC_GPREL: u16 = 0x0015; |
1189 | /// clr token |
1190 | pub const IMAGE_REL_PPC_TOKEN: u16 = 0x0016; |
1191 | |
1192 | /// mask to isolate above values in IMAGE_RELOCATION.Type |
1193 | pub const IMAGE_REL_PPC_TYPEMASK: u16 = 0x00FF; |
1194 | |
1195 | // Flag bits in `ImageRelocation::typ`. |
1196 | |
1197 | /// subtract reloc value rather than adding it |
1198 | pub const IMAGE_REL_PPC_NEG: u16 = 0x0100; |
1199 | /// fix branch prediction bit to predict branch taken |
1200 | pub const IMAGE_REL_PPC_BRTAKEN: u16 = 0x0200; |
1201 | /// fix branch prediction bit to predict branch not taken |
1202 | pub const IMAGE_REL_PPC_BRNTAKEN: u16 = 0x0400; |
1203 | /// toc slot defined in file (or, data in toc) |
1204 | pub const IMAGE_REL_PPC_TOCDEFN: u16 = 0x0800; |
1205 | |
1206 | // |
1207 | // Hitachi SH3 relocation types. |
1208 | // |
1209 | /// No relocation |
1210 | pub const IMAGE_REL_SH3_ABSOLUTE: u16 = 0x0000; |
1211 | /// 16 bit direct |
1212 | pub const IMAGE_REL_SH3_DIRECT16: u16 = 0x0001; |
1213 | /// 32 bit direct |
1214 | pub const IMAGE_REL_SH3_DIRECT32: u16 = 0x0002; |
1215 | /// 8 bit direct, -128..255 |
1216 | pub const IMAGE_REL_SH3_DIRECT8: u16 = 0x0003; |
1217 | /// 8 bit direct .W (0 ext.) |
1218 | pub const IMAGE_REL_SH3_DIRECT8_WORD: u16 = 0x0004; |
1219 | /// 8 bit direct .L (0 ext.) |
1220 | pub const IMAGE_REL_SH3_DIRECT8_LONG: u16 = 0x0005; |
1221 | /// 4 bit direct (0 ext.) |
1222 | pub const IMAGE_REL_SH3_DIRECT4: u16 = 0x0006; |
1223 | /// 4 bit direct .W (0 ext.) |
1224 | pub const IMAGE_REL_SH3_DIRECT4_WORD: u16 = 0x0007; |
1225 | /// 4 bit direct .L (0 ext.) |
1226 | pub const IMAGE_REL_SH3_DIRECT4_LONG: u16 = 0x0008; |
1227 | /// 8 bit PC relative .W |
1228 | pub const IMAGE_REL_SH3_PCREL8_WORD: u16 = 0x0009; |
1229 | /// 8 bit PC relative .L |
1230 | pub const IMAGE_REL_SH3_PCREL8_LONG: u16 = 0x000A; |
1231 | /// 12 LSB PC relative .W |
1232 | pub const IMAGE_REL_SH3_PCREL12_WORD: u16 = 0x000B; |
1233 | /// Start of EXE section |
1234 | pub const IMAGE_REL_SH3_STARTOF_SECTION: u16 = 0x000C; |
1235 | /// Size of EXE section |
1236 | pub const IMAGE_REL_SH3_SIZEOF_SECTION: u16 = 0x000D; |
1237 | /// Section table index |
1238 | pub const IMAGE_REL_SH3_SECTION: u16 = 0x000E; |
1239 | /// Offset within section |
1240 | pub const IMAGE_REL_SH3_SECREL: u16 = 0x000F; |
1241 | /// 32 bit direct not based |
1242 | pub const IMAGE_REL_SH3_DIRECT32_NB: u16 = 0x0010; |
1243 | /// GP-relative addressing |
1244 | pub const IMAGE_REL_SH3_GPREL4_LONG: u16 = 0x0011; |
1245 | /// clr token |
1246 | pub const IMAGE_REL_SH3_TOKEN: u16 = 0x0012; |
1247 | /// Offset from current instruction in longwords |
1248 | /// if not NOMODE, insert the inverse of the low bit at bit 32 to select PTA/PTB |
1249 | pub const IMAGE_REL_SHM_PCRELPT: u16 = 0x0013; |
1250 | /// Low bits of 32-bit address |
1251 | pub const IMAGE_REL_SHM_REFLO: u16 = 0x0014; |
1252 | /// High bits of 32-bit address |
1253 | pub const IMAGE_REL_SHM_REFHALF: u16 = 0x0015; |
1254 | /// Low bits of relative reference |
1255 | pub const IMAGE_REL_SHM_RELLO: u16 = 0x0016; |
1256 | /// High bits of relative reference |
1257 | pub const IMAGE_REL_SHM_RELHALF: u16 = 0x0017; |
1258 | /// offset operand for relocation |
1259 | pub const IMAGE_REL_SHM_PAIR: u16 = 0x0018; |
1260 | |
1261 | /// relocation ignores section mode |
1262 | pub const IMAGE_REL_SH_NOMODE: u16 = 0x8000; |
1263 | |
1264 | /// No relocation required |
1265 | pub const IMAGE_REL_ARM_ABSOLUTE: u16 = 0x0000; |
1266 | /// 32 bit address |
1267 | pub const IMAGE_REL_ARM_ADDR32: u16 = 0x0001; |
1268 | /// 32 bit address w/o image base |
1269 | pub const IMAGE_REL_ARM_ADDR32NB: u16 = 0x0002; |
1270 | /// 24 bit offset << 2 & sign ext. |
1271 | pub const IMAGE_REL_ARM_BRANCH24: u16 = 0x0003; |
1272 | /// Thumb: 2 11 bit offsets |
1273 | pub const IMAGE_REL_ARM_BRANCH11: u16 = 0x0004; |
1274 | /// clr token |
1275 | pub const IMAGE_REL_ARM_TOKEN: u16 = 0x0005; |
1276 | /// GP-relative addressing (ARM) |
1277 | pub const IMAGE_REL_ARM_GPREL12: u16 = 0x0006; |
1278 | /// GP-relative addressing (Thumb) |
1279 | pub const IMAGE_REL_ARM_GPREL7: u16 = 0x0007; |
1280 | pub const IMAGE_REL_ARM_BLX24: u16 = 0x0008; |
1281 | pub const IMAGE_REL_ARM_BLX11: u16 = 0x0009; |
1282 | /// 32-bit relative address from byte following reloc |
1283 | pub const IMAGE_REL_ARM_REL32: u16 = 0x000A; |
1284 | /// Section table index |
1285 | pub const IMAGE_REL_ARM_SECTION: u16 = 0x000E; |
1286 | /// Offset within section |
1287 | pub const IMAGE_REL_ARM_SECREL: u16 = 0x000F; |
1288 | /// ARM: MOVW/MOVT |
1289 | pub const IMAGE_REL_ARM_MOV32A: u16 = 0x0010; |
1290 | /// ARM: MOVW/MOVT (deprecated) |
1291 | pub const IMAGE_REL_ARM_MOV32: u16 = 0x0010; |
1292 | /// Thumb: MOVW/MOVT |
1293 | pub const IMAGE_REL_ARM_MOV32T: u16 = 0x0011; |
1294 | /// Thumb: MOVW/MOVT (deprecated) |
1295 | pub const IMAGE_REL_THUMB_MOV32: u16 = 0x0011; |
1296 | /// Thumb: 32-bit conditional B |
1297 | pub const IMAGE_REL_ARM_BRANCH20T: u16 = 0x0012; |
1298 | /// Thumb: 32-bit conditional B (deprecated) |
1299 | pub const IMAGE_REL_THUMB_BRANCH20: u16 = 0x0012; |
1300 | /// Thumb: 32-bit B or BL |
1301 | pub const IMAGE_REL_ARM_BRANCH24T: u16 = 0x0014; |
1302 | /// Thumb: 32-bit B or BL (deprecated) |
1303 | pub const IMAGE_REL_THUMB_BRANCH24: u16 = 0x0014; |
1304 | /// Thumb: BLX immediate |
1305 | pub const IMAGE_REL_ARM_BLX23T: u16 = 0x0015; |
1306 | /// Thumb: BLX immediate (deprecated) |
1307 | pub const IMAGE_REL_THUMB_BLX23: u16 = 0x0015; |
1308 | |
1309 | pub const IMAGE_REL_AM_ABSOLUTE: u16 = 0x0000; |
1310 | pub const IMAGE_REL_AM_ADDR32: u16 = 0x0001; |
1311 | pub const IMAGE_REL_AM_ADDR32NB: u16 = 0x0002; |
1312 | pub const IMAGE_REL_AM_CALL32: u16 = 0x0003; |
1313 | pub const IMAGE_REL_AM_FUNCINFO: u16 = 0x0004; |
1314 | pub const IMAGE_REL_AM_REL32_1: u16 = 0x0005; |
1315 | pub const IMAGE_REL_AM_REL32_2: u16 = 0x0006; |
1316 | pub const IMAGE_REL_AM_SECREL: u16 = 0x0007; |
1317 | pub const IMAGE_REL_AM_SECTION: u16 = 0x0008; |
1318 | pub const IMAGE_REL_AM_TOKEN: u16 = 0x0009; |
1319 | |
1320 | // |
1321 | // ARM64 relocations types. |
1322 | // |
1323 | |
1324 | /// No relocation required |
1325 | pub const IMAGE_REL_ARM64_ABSOLUTE: u16 = 0x0000; |
1326 | /// 32 bit address. Review! do we need it? |
1327 | pub const IMAGE_REL_ARM64_ADDR32: u16 = 0x0001; |
1328 | /// 32 bit address w/o image base (RVA: for Data/PData/XData) |
1329 | pub const IMAGE_REL_ARM64_ADDR32NB: u16 = 0x0002; |
1330 | /// 26 bit offset << 2 & sign ext. for B & BL |
1331 | pub const IMAGE_REL_ARM64_BRANCH26: u16 = 0x0003; |
1332 | /// ADRP |
1333 | pub const IMAGE_REL_ARM64_PAGEBASE_REL21: u16 = 0x0004; |
1334 | /// ADR |
1335 | pub const IMAGE_REL_ARM64_REL21: u16 = 0x0005; |
1336 | /// ADD/ADDS (immediate) with zero shift, for page offset |
1337 | pub const IMAGE_REL_ARM64_PAGEOFFSET_12A: u16 = 0x0006; |
1338 | /// LDR (indexed, unsigned immediate), for page offset |
1339 | pub const IMAGE_REL_ARM64_PAGEOFFSET_12L: u16 = 0x0007; |
1340 | /// Offset within section |
1341 | pub const IMAGE_REL_ARM64_SECREL: u16 = 0x0008; |
1342 | /// ADD/ADDS (immediate) with zero shift, for bit 0:11 of section offset |
1343 | pub const IMAGE_REL_ARM64_SECREL_LOW12A: u16 = 0x0009; |
1344 | /// ADD/ADDS (immediate) with zero shift, for bit 12:23 of section offset |
1345 | pub const IMAGE_REL_ARM64_SECREL_HIGH12A: u16 = 0x000A; |
1346 | /// LDR (indexed, unsigned immediate), for bit 0:11 of section offset |
1347 | pub const IMAGE_REL_ARM64_SECREL_LOW12L: u16 = 0x000B; |
1348 | pub const IMAGE_REL_ARM64_TOKEN: u16 = 0x000C; |
1349 | /// Section table index |
1350 | pub const IMAGE_REL_ARM64_SECTION: u16 = 0x000D; |
1351 | /// 64 bit address |
1352 | pub const IMAGE_REL_ARM64_ADDR64: u16 = 0x000E; |
1353 | /// 19 bit offset << 2 & sign ext. for conditional B |
1354 | pub const IMAGE_REL_ARM64_BRANCH19: u16 = 0x000F; |
1355 | /// TBZ/TBNZ |
1356 | pub const IMAGE_REL_ARM64_BRANCH14: u16 = 0x0010; |
1357 | /// 32-bit relative address from byte following reloc |
1358 | pub const IMAGE_REL_ARM64_REL32: u16 = 0x0011; |
1359 | |
1360 | // |
1361 | // x64 relocations |
1362 | // |
1363 | /// Reference is absolute, no relocation is necessary |
1364 | pub const IMAGE_REL_AMD64_ABSOLUTE: u16 = 0x0000; |
1365 | /// 64-bit address (VA). |
1366 | pub const IMAGE_REL_AMD64_ADDR64: u16 = 0x0001; |
1367 | /// 32-bit address (VA). |
1368 | pub const IMAGE_REL_AMD64_ADDR32: u16 = 0x0002; |
1369 | /// 32-bit address w/o image base (RVA). |
1370 | pub const IMAGE_REL_AMD64_ADDR32NB: u16 = 0x0003; |
1371 | /// 32-bit relative address from byte following reloc |
1372 | pub const IMAGE_REL_AMD64_REL32: u16 = 0x0004; |
1373 | /// 32-bit relative address from byte distance 1 from reloc |
1374 | pub const IMAGE_REL_AMD64_REL32_1: u16 = 0x0005; |
1375 | /// 32-bit relative address from byte distance 2 from reloc |
1376 | pub const IMAGE_REL_AMD64_REL32_2: u16 = 0x0006; |
1377 | /// 32-bit relative address from byte distance 3 from reloc |
1378 | pub const IMAGE_REL_AMD64_REL32_3: u16 = 0x0007; |
1379 | /// 32-bit relative address from byte distance 4 from reloc |
1380 | pub const IMAGE_REL_AMD64_REL32_4: u16 = 0x0008; |
1381 | /// 32-bit relative address from byte distance 5 from reloc |
1382 | pub const IMAGE_REL_AMD64_REL32_5: u16 = 0x0009; |
1383 | /// Section index |
1384 | pub const IMAGE_REL_AMD64_SECTION: u16 = 0x000A; |
1385 | /// 32 bit offset from base of section containing target |
1386 | pub const IMAGE_REL_AMD64_SECREL: u16 = 0x000B; |
1387 | /// 7 bit unsigned offset from base of section containing target |
1388 | pub const IMAGE_REL_AMD64_SECREL7: u16 = 0x000C; |
1389 | /// 32 bit metadata token |
1390 | pub const IMAGE_REL_AMD64_TOKEN: u16 = 0x000D; |
1391 | /// 32 bit signed span-dependent value emitted into object |
1392 | pub const IMAGE_REL_AMD64_SREL32: u16 = 0x000E; |
1393 | pub const IMAGE_REL_AMD64_PAIR: u16 = 0x000F; |
1394 | /// 32 bit signed span-dependent value applied at link time |
1395 | pub const IMAGE_REL_AMD64_SSPAN32: u16 = 0x0010; |
1396 | pub const IMAGE_REL_AMD64_EHANDLER: u16 = 0x0011; |
1397 | /// Indirect branch to an import |
1398 | pub const IMAGE_REL_AMD64_IMPORT_BR: u16 = 0x0012; |
1399 | /// Indirect call to an import |
1400 | pub const IMAGE_REL_AMD64_IMPORT_CALL: u16 = 0x0013; |
1401 | /// Indirect branch to a CFG check |
1402 | pub const IMAGE_REL_AMD64_CFG_BR: u16 = 0x0014; |
1403 | /// Indirect branch to a CFG check, with REX.W prefix |
1404 | pub const IMAGE_REL_AMD64_CFG_BR_REX: u16 = 0x0015; |
1405 | /// Indirect call to a CFG check |
1406 | pub const IMAGE_REL_AMD64_CFG_CALL: u16 = 0x0016; |
1407 | /// Indirect branch to a target in RAX (no CFG) |
1408 | pub const IMAGE_REL_AMD64_INDIR_BR: u16 = 0x0017; |
1409 | /// Indirect branch to a target in RAX, with REX.W prefix (no CFG) |
1410 | pub const IMAGE_REL_AMD64_INDIR_BR_REX: u16 = 0x0018; |
1411 | /// Indirect call to a target in RAX (no CFG) |
1412 | pub const IMAGE_REL_AMD64_INDIR_CALL: u16 = 0x0019; |
1413 | /// Indirect branch for a switch table using Reg 0 (RAX) |
1414 | pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_FIRST: u16 = 0x0020; |
1415 | /// Indirect branch for a switch table using Reg 15 (R15) |
1416 | pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_LAST: u16 = 0x002F; |
1417 | |
1418 | // |
1419 | // IA64 relocation types. |
1420 | // |
1421 | pub const IMAGE_REL_IA64_ABSOLUTE: u16 = 0x0000; |
1422 | pub const IMAGE_REL_IA64_IMM14: u16 = 0x0001; |
1423 | pub const IMAGE_REL_IA64_IMM22: u16 = 0x0002; |
1424 | pub const IMAGE_REL_IA64_IMM64: u16 = 0x0003; |
1425 | pub const IMAGE_REL_IA64_DIR32: u16 = 0x0004; |
1426 | pub const IMAGE_REL_IA64_DIR64: u16 = 0x0005; |
1427 | pub const IMAGE_REL_IA64_PCREL21B: u16 = 0x0006; |
1428 | pub const IMAGE_REL_IA64_PCREL21M: u16 = 0x0007; |
1429 | pub const IMAGE_REL_IA64_PCREL21F: u16 = 0x0008; |
1430 | pub const IMAGE_REL_IA64_GPREL22: u16 = 0x0009; |
1431 | pub const IMAGE_REL_IA64_LTOFF22: u16 = 0x000A; |
1432 | pub const IMAGE_REL_IA64_SECTION: u16 = 0x000B; |
1433 | pub const IMAGE_REL_IA64_SECREL22: u16 = 0x000C; |
1434 | pub const IMAGE_REL_IA64_SECREL64I: u16 = 0x000D; |
1435 | pub const IMAGE_REL_IA64_SECREL32: u16 = 0x000E; |
1436 | // |
1437 | pub const IMAGE_REL_IA64_DIR32NB: u16 = 0x0010; |
1438 | pub const IMAGE_REL_IA64_SREL14: u16 = 0x0011; |
1439 | pub const IMAGE_REL_IA64_SREL22: u16 = 0x0012; |
1440 | pub const IMAGE_REL_IA64_SREL32: u16 = 0x0013; |
1441 | pub const IMAGE_REL_IA64_UREL32: u16 = 0x0014; |
1442 | /// This is always a BRL and never converted |
1443 | pub const IMAGE_REL_IA64_PCREL60X: u16 = 0x0015; |
1444 | /// If possible, convert to MBB bundle with NOP.B in slot 1 |
1445 | pub const IMAGE_REL_IA64_PCREL60B: u16 = 0x0016; |
1446 | /// If possible, convert to MFB bundle with NOP.F in slot 1 |
1447 | pub const IMAGE_REL_IA64_PCREL60F: u16 = 0x0017; |
1448 | /// If possible, convert to MIB bundle with NOP.I in slot 1 |
1449 | pub const IMAGE_REL_IA64_PCREL60I: u16 = 0x0018; |
1450 | /// If possible, convert to MMB bundle with NOP.M in slot 1 |
1451 | pub const IMAGE_REL_IA64_PCREL60M: u16 = 0x0019; |
1452 | pub const IMAGE_REL_IA64_IMMGPREL64: u16 = 0x001A; |
1453 | /// clr token |
1454 | pub const IMAGE_REL_IA64_TOKEN: u16 = 0x001B; |
1455 | pub const IMAGE_REL_IA64_GPREL32: u16 = 0x001C; |
1456 | pub const IMAGE_REL_IA64_ADDEND: u16 = 0x001F; |
1457 | |
1458 | // |
1459 | // CEF relocation types. |
1460 | // |
1461 | /// Reference is absolute, no relocation is necessary |
1462 | pub const IMAGE_REL_CEF_ABSOLUTE: u16 = 0x0000; |
1463 | /// 32-bit address (VA). |
1464 | pub const IMAGE_REL_CEF_ADDR32: u16 = 0x0001; |
1465 | /// 64-bit address (VA). |
1466 | pub const IMAGE_REL_CEF_ADDR64: u16 = 0x0002; |
1467 | /// 32-bit address w/o image base (RVA). |
1468 | pub const IMAGE_REL_CEF_ADDR32NB: u16 = 0x0003; |
1469 | /// Section index |
1470 | pub const IMAGE_REL_CEF_SECTION: u16 = 0x0004; |
1471 | /// 32 bit offset from base of section containing target |
1472 | pub const IMAGE_REL_CEF_SECREL: u16 = 0x0005; |
1473 | /// 32 bit metadata token |
1474 | pub const IMAGE_REL_CEF_TOKEN: u16 = 0x0006; |
1475 | |
1476 | // |
1477 | // clr relocation types. |
1478 | // |
1479 | /// Reference is absolute, no relocation is necessary |
1480 | pub const IMAGE_REL_CEE_ABSOLUTE: u16 = 0x0000; |
1481 | /// 32-bit address (VA). |
1482 | pub const IMAGE_REL_CEE_ADDR32: u16 = 0x0001; |
1483 | /// 64-bit address (VA). |
1484 | pub const IMAGE_REL_CEE_ADDR64: u16 = 0x0002; |
1485 | /// 32-bit address w/o image base (RVA). |
1486 | pub const IMAGE_REL_CEE_ADDR32NB: u16 = 0x0003; |
1487 | /// Section index |
1488 | pub const IMAGE_REL_CEE_SECTION: u16 = 0x0004; |
1489 | /// 32 bit offset from base of section containing target |
1490 | pub const IMAGE_REL_CEE_SECREL: u16 = 0x0005; |
1491 | /// 32 bit metadata token |
1492 | pub const IMAGE_REL_CEE_TOKEN: u16 = 0x0006; |
1493 | |
1494 | /// No relocation required |
1495 | pub const IMAGE_REL_M32R_ABSOLUTE: u16 = 0x0000; |
1496 | /// 32 bit address |
1497 | pub const IMAGE_REL_M32R_ADDR32: u16 = 0x0001; |
1498 | /// 32 bit address w/o image base |
1499 | pub const IMAGE_REL_M32R_ADDR32NB: u16 = 0x0002; |
1500 | /// 24 bit address |
1501 | pub const IMAGE_REL_M32R_ADDR24: u16 = 0x0003; |
1502 | /// GP relative addressing |
1503 | pub const IMAGE_REL_M32R_GPREL16: u16 = 0x0004; |
1504 | /// 24 bit offset << 2 & sign ext. |
1505 | pub const IMAGE_REL_M32R_PCREL24: u16 = 0x0005; |
1506 | /// 16 bit offset << 2 & sign ext. |
1507 | pub const IMAGE_REL_M32R_PCREL16: u16 = 0x0006; |
1508 | /// 8 bit offset << 2 & sign ext. |
1509 | pub const IMAGE_REL_M32R_PCREL8: u16 = 0x0007; |
1510 | /// 16 MSBs |
1511 | pub const IMAGE_REL_M32R_REFHALF: u16 = 0x0008; |
1512 | /// 16 MSBs; adj for LSB sign ext. |
1513 | pub const IMAGE_REL_M32R_REFHI: u16 = 0x0009; |
1514 | /// 16 LSBs |
1515 | pub const IMAGE_REL_M32R_REFLO: u16 = 0x000A; |
1516 | /// Link HI and LO |
1517 | pub const IMAGE_REL_M32R_PAIR: u16 = 0x000B; |
1518 | /// Section table index |
1519 | pub const IMAGE_REL_M32R_SECTION: u16 = 0x000C; |
1520 | /// 32 bit section relative reference |
1521 | pub const IMAGE_REL_M32R_SECREL32: u16 = 0x000D; |
1522 | /// clr token |
1523 | pub const IMAGE_REL_M32R_TOKEN: u16 = 0x000E; |
1524 | |
1525 | /// No relocation required |
1526 | pub const IMAGE_REL_EBC_ABSOLUTE: u16 = 0x0000; |
1527 | /// 32 bit address w/o image base |
1528 | pub const IMAGE_REL_EBC_ADDR32NB: u16 = 0x0001; |
1529 | /// 32-bit relative address from byte following reloc |
1530 | pub const IMAGE_REL_EBC_REL32: u16 = 0x0002; |
1531 | /// Section table index |
1532 | pub const IMAGE_REL_EBC_SECTION: u16 = 0x0003; |
1533 | /// Offset within section |
1534 | pub const IMAGE_REL_EBC_SECREL: u16 = 0x0004; |
1535 | |
1536 | /* |
1537 | // TODO? |
1538 | #define EXT_IMM64(Value, Address, Size, InstPos, ValPos) /* Intel-IA64-Filler */ \ |
1539 | Value |= (((ULONGLONG)((*(Address) >> InstPos) & (((ULONGLONG)1 << Size) - 1))) << ValPos) // Intel-IA64-Filler |
1540 | |
1541 | #define INS_IMM64(Value, Address, Size, InstPos, ValPos) /* Intel-IA64-Filler */\ |
1542 | *(PDWORD)Address = (*(PDWORD)Address & ~(((1 << Size) - 1) << InstPos)) | /* Intel-IA64-Filler */\ |
1543 | ((DWORD)((((ULONGLONG)Value >> ValPos) & (((ULONGLONG)1 << Size) - 1))) << InstPos) // Intel-IA64-Filler |
1544 | */ |
1545 | |
1546 | /// Intel-IA64-Filler |
1547 | pub const EMARCH_ENC_I17_IMM7B_INST_WORD_X: u16 = 3; |
1548 | /// Intel-IA64-Filler |
1549 | pub const EMARCH_ENC_I17_IMM7B_SIZE_X: u16 = 7; |
1550 | /// Intel-IA64-Filler |
1551 | pub const EMARCH_ENC_I17_IMM7B_INST_WORD_POS_X: u16 = 4; |
1552 | /// Intel-IA64-Filler |
1553 | pub const EMARCH_ENC_I17_IMM7B_VAL_POS_X: u16 = 0; |
1554 | |
1555 | /// Intel-IA64-Filler |
1556 | pub const EMARCH_ENC_I17_IMM9D_INST_WORD_X: u16 = 3; |
1557 | /// Intel-IA64-Filler |
1558 | pub const EMARCH_ENC_I17_IMM9D_SIZE_X: u16 = 9; |
1559 | /// Intel-IA64-Filler |
1560 | pub const EMARCH_ENC_I17_IMM9D_INST_WORD_POS_X: u16 = 18; |
1561 | /// Intel-IA64-Filler |
1562 | pub const EMARCH_ENC_I17_IMM9D_VAL_POS_X: u16 = 7; |
1563 | |
1564 | /// Intel-IA64-Filler |
1565 | pub const EMARCH_ENC_I17_IMM5C_INST_WORD_X: u16 = 3; |
1566 | /// Intel-IA64-Filler |
1567 | pub const EMARCH_ENC_I17_IMM5C_SIZE_X: u16 = 5; |
1568 | /// Intel-IA64-Filler |
1569 | pub const EMARCH_ENC_I17_IMM5C_INST_WORD_POS_X: u16 = 13; |
1570 | /// Intel-IA64-Filler |
1571 | pub const EMARCH_ENC_I17_IMM5C_VAL_POS_X: u16 = 16; |
1572 | |
1573 | /// Intel-IA64-Filler |
1574 | pub const EMARCH_ENC_I17_IC_INST_WORD_X: u16 = 3; |
1575 | /// Intel-IA64-Filler |
1576 | pub const EMARCH_ENC_I17_IC_SIZE_X: u16 = 1; |
1577 | /// Intel-IA64-Filler |
1578 | pub const EMARCH_ENC_I17_IC_INST_WORD_POS_X: u16 = 12; |
1579 | /// Intel-IA64-Filler |
1580 | pub const EMARCH_ENC_I17_IC_VAL_POS_X: u16 = 21; |
1581 | |
1582 | /// Intel-IA64-Filler |
1583 | pub const EMARCH_ENC_I17_IMM41A_INST_WORD_X: u16 = 1; |
1584 | /// Intel-IA64-Filler |
1585 | pub const EMARCH_ENC_I17_IMM41A_SIZE_X: u16 = 10; |
1586 | /// Intel-IA64-Filler |
1587 | pub const EMARCH_ENC_I17_IMM41A_INST_WORD_POS_X: u16 = 14; |
1588 | /// Intel-IA64-Filler |
1589 | pub const EMARCH_ENC_I17_IMM41A_VAL_POS_X: u16 = 22; |
1590 | |
1591 | /// Intel-IA64-Filler |
1592 | pub const EMARCH_ENC_I17_IMM41B_INST_WORD_X: u16 = 1; |
1593 | /// Intel-IA64-Filler |
1594 | pub const EMARCH_ENC_I17_IMM41B_SIZE_X: u16 = 8; |
1595 | /// Intel-IA64-Filler |
1596 | pub const EMARCH_ENC_I17_IMM41B_INST_WORD_POS_X: u16 = 24; |
1597 | /// Intel-IA64-Filler |
1598 | pub const EMARCH_ENC_I17_IMM41B_VAL_POS_X: u16 = 32; |
1599 | |
1600 | /// Intel-IA64-Filler |
1601 | pub const EMARCH_ENC_I17_IMM41C_INST_WORD_X: u16 = 2; |
1602 | /// Intel-IA64-Filler |
1603 | pub const EMARCH_ENC_I17_IMM41C_SIZE_X: u16 = 23; |
1604 | /// Intel-IA64-Filler |
1605 | pub const EMARCH_ENC_I17_IMM41C_INST_WORD_POS_X: u16 = 0; |
1606 | /// Intel-IA64-Filler |
1607 | pub const EMARCH_ENC_I17_IMM41C_VAL_POS_X: u16 = 40; |
1608 | |
1609 | /// Intel-IA64-Filler |
1610 | pub const EMARCH_ENC_I17_SIGN_INST_WORD_X: u16 = 3; |
1611 | /// Intel-IA64-Filler |
1612 | pub const EMARCH_ENC_I17_SIGN_SIZE_X: u16 = 1; |
1613 | /// Intel-IA64-Filler |
1614 | pub const EMARCH_ENC_I17_SIGN_INST_WORD_POS_X: u16 = 27; |
1615 | /// Intel-IA64-Filler |
1616 | pub const EMARCH_ENC_I17_SIGN_VAL_POS_X: u16 = 63; |
1617 | |
1618 | /// Intel-IA64-Filler |
1619 | pub const X3_OPCODE_INST_WORD_X: u16 = 3; |
1620 | /// Intel-IA64-Filler |
1621 | pub const X3_OPCODE_SIZE_X: u16 = 4; |
1622 | /// Intel-IA64-Filler |
1623 | pub const X3_OPCODE_INST_WORD_POS_X: u16 = 28; |
1624 | /// Intel-IA64-Filler |
1625 | pub const X3_OPCODE_SIGN_VAL_POS_X: u16 = 0; |
1626 | |
1627 | /// Intel-IA64-Filler |
1628 | pub const X3_I_INST_WORD_X: u16 = 3; |
1629 | /// Intel-IA64-Filler |
1630 | pub const X3_I_SIZE_X: u16 = 1; |
1631 | /// Intel-IA64-Filler |
1632 | pub const X3_I_INST_WORD_POS_X: u16 = 27; |
1633 | /// Intel-IA64-Filler |
1634 | pub const X3_I_SIGN_VAL_POS_X: u16 = 59; |
1635 | |
1636 | /// Intel-IA64-Filler |
1637 | pub const X3_D_WH_INST_WORD_X: u16 = 3; |
1638 | /// Intel-IA64-Filler |
1639 | pub const X3_D_WH_SIZE_X: u16 = 3; |
1640 | /// Intel-IA64-Filler |
1641 | pub const X3_D_WH_INST_WORD_POS_X: u16 = 24; |
1642 | /// Intel-IA64-Filler |
1643 | pub const X3_D_WH_SIGN_VAL_POS_X: u16 = 0; |
1644 | |
1645 | /// Intel-IA64-Filler |
1646 | pub const X3_IMM20_INST_WORD_X: u16 = 3; |
1647 | /// Intel-IA64-Filler |
1648 | pub const X3_IMM20_SIZE_X: u16 = 20; |
1649 | /// Intel-IA64-Filler |
1650 | pub const X3_IMM20_INST_WORD_POS_X: u16 = 4; |
1651 | /// Intel-IA64-Filler |
1652 | pub const X3_IMM20_SIGN_VAL_POS_X: u16 = 0; |
1653 | |
1654 | /// Intel-IA64-Filler |
1655 | pub const X3_IMM39_1_INST_WORD_X: u16 = 2; |
1656 | /// Intel-IA64-Filler |
1657 | pub const X3_IMM39_1_SIZE_X: u16 = 23; |
1658 | /// Intel-IA64-Filler |
1659 | pub const X3_IMM39_1_INST_WORD_POS_X: u16 = 0; |
1660 | /// Intel-IA64-Filler |
1661 | pub const X3_IMM39_1_SIGN_VAL_POS_X: u16 = 36; |
1662 | |
1663 | /// Intel-IA64-Filler |
1664 | pub const X3_IMM39_2_INST_WORD_X: u16 = 1; |
1665 | /// Intel-IA64-Filler |
1666 | pub const X3_IMM39_2_SIZE_X: u16 = 16; |
1667 | /// Intel-IA64-Filler |
1668 | pub const X3_IMM39_2_INST_WORD_POS_X: u16 = 16; |
1669 | /// Intel-IA64-Filler |
1670 | pub const X3_IMM39_2_SIGN_VAL_POS_X: u16 = 20; |
1671 | |
1672 | /// Intel-IA64-Filler |
1673 | pub const X3_P_INST_WORD_X: u16 = 3; |
1674 | /// Intel-IA64-Filler |
1675 | pub const X3_P_SIZE_X: u16 = 4; |
1676 | /// Intel-IA64-Filler |
1677 | pub const X3_P_INST_WORD_POS_X: u16 = 0; |
1678 | /// Intel-IA64-Filler |
1679 | pub const X3_P_SIGN_VAL_POS_X: u16 = 0; |
1680 | |
1681 | /// Intel-IA64-Filler |
1682 | pub const X3_TMPLT_INST_WORD_X: u16 = 0; |
1683 | /// Intel-IA64-Filler |
1684 | pub const X3_TMPLT_SIZE_X: u16 = 4; |
1685 | /// Intel-IA64-Filler |
1686 | pub const X3_TMPLT_INST_WORD_POS_X: u16 = 0; |
1687 | /// Intel-IA64-Filler |
1688 | pub const X3_TMPLT_SIGN_VAL_POS_X: u16 = 0; |
1689 | |
1690 | /// Intel-IA64-Filler |
1691 | pub const X3_BTYPE_QP_INST_WORD_X: u16 = 2; |
1692 | /// Intel-IA64-Filler |
1693 | pub const X3_BTYPE_QP_SIZE_X: u16 = 9; |
1694 | /// Intel-IA64-Filler |
1695 | pub const X3_BTYPE_QP_INST_WORD_POS_X: u16 = 23; |
1696 | /// Intel-IA64-Filler |
1697 | pub const X3_BTYPE_QP_INST_VAL_POS_X: u16 = 0; |
1698 | |
1699 | /// Intel-IA64-Filler |
1700 | pub const X3_EMPTY_INST_WORD_X: u16 = 1; |
1701 | /// Intel-IA64-Filler |
1702 | pub const X3_EMPTY_SIZE_X: u16 = 2; |
1703 | /// Intel-IA64-Filler |
1704 | pub const X3_EMPTY_INST_WORD_POS_X: u16 = 14; |
1705 | /// Intel-IA64-Filler |
1706 | pub const X3_EMPTY_INST_VAL_POS_X: u16 = 0; |
1707 | |
1708 | // |
1709 | // Line number format. |
1710 | // |
1711 | |
1712 | // This struct has alignment 1. |
1713 | #[derive (Debug, Clone, Copy)] |
1714 | #[repr (C)] |
1715 | pub struct ImageLinenumber { |
1716 | /// Symbol table index of function name if Linenumber is 0. |
1717 | /// Otherwise virtual address of line number. |
1718 | pub symbol_table_index_or_virtual_address: U32Bytes<LE>, |
1719 | /// Line number. |
1720 | pub linenumber: U16Bytes<LE>, |
1721 | } |
1722 | |
1723 | // |
1724 | // Based relocation format. |
1725 | // |
1726 | |
1727 | #[derive (Debug, Clone, Copy)] |
1728 | #[repr (C)] |
1729 | pub struct ImageBaseRelocation { |
1730 | pub virtual_address: U32<LE>, |
1731 | pub size_of_block: U32<LE>, |
1732 | // pub type_offset[1]: U16<LE>, |
1733 | } |
1734 | |
1735 | // |
1736 | // Based relocation types. |
1737 | // |
1738 | |
1739 | pub const IMAGE_REL_BASED_ABSOLUTE: u16 = 0; |
1740 | pub const IMAGE_REL_BASED_HIGH: u16 = 1; |
1741 | pub const IMAGE_REL_BASED_LOW: u16 = 2; |
1742 | pub const IMAGE_REL_BASED_HIGHLOW: u16 = 3; |
1743 | pub const IMAGE_REL_BASED_HIGHADJ: u16 = 4; |
1744 | pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_5: u16 = 5; |
1745 | pub const IMAGE_REL_BASED_RESERVED: u16 = 6; |
1746 | pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_7: u16 = 7; |
1747 | pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_8: u16 = 8; |
1748 | pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_9: u16 = 9; |
1749 | pub const IMAGE_REL_BASED_DIR64: u16 = 10; |
1750 | |
1751 | // |
1752 | // Platform-specific based relocation types. |
1753 | // |
1754 | |
1755 | pub const IMAGE_REL_BASED_IA64_IMM64: u16 = 9; |
1756 | |
1757 | pub const IMAGE_REL_BASED_MIPS_JMPADDR: u16 = 5; |
1758 | pub const IMAGE_REL_BASED_MIPS_JMPADDR16: u16 = 9; |
1759 | |
1760 | pub const IMAGE_REL_BASED_ARM_MOV32: u16 = 5; |
1761 | pub const IMAGE_REL_BASED_THUMB_MOV32: u16 = 7; |
1762 | |
1763 | pub const IMAGE_REL_BASED_RISCV_HIGH20: u16 = 5; |
1764 | pub const IMAGE_REL_BASED_RISCV_LOW12I: u16 = 7; |
1765 | pub const IMAGE_REL_BASED_RISCV_LOW12S: u16 = 8; |
1766 | |
1767 | // |
1768 | // Archive format. |
1769 | // |
1770 | |
1771 | pub const IMAGE_ARCHIVE_START_SIZE: usize = 8; |
1772 | pub const IMAGE_ARCHIVE_START: &[u8; 8] = b"!<arch> \n" ; |
1773 | pub const IMAGE_ARCHIVE_END: &[u8] = b"` \n" ; |
1774 | pub const IMAGE_ARCHIVE_PAD: &[u8] = b" \n" ; |
1775 | pub const IMAGE_ARCHIVE_LINKER_MEMBER: &[u8; 16] = b"/ " ; |
1776 | pub const IMAGE_ARCHIVE_LONGNAMES_MEMBER: &[u8; 16] = b"// " ; |
1777 | pub const IMAGE_ARCHIVE_HYBRIDMAP_MEMBER: &[u8; 16] = b"/<HYBRIDMAP>/ " ; |
1778 | |
1779 | #[derive (Debug, Clone, Copy)] |
1780 | #[repr (C)] |
1781 | pub struct ImageArchiveMemberHeader { |
1782 | /// File member name - `/' terminated. |
1783 | pub name: [u8; 16], |
1784 | /// File member date - decimal. |
1785 | pub date: [u8; 12], |
1786 | /// File member user id - decimal. |
1787 | pub user_id: [u8; 6], |
1788 | /// File member group id - decimal. |
1789 | pub group_id: [u8; 6], |
1790 | /// File member mode - octal. |
1791 | pub mode: [u8; 8], |
1792 | /// File member size - decimal. |
1793 | pub size: [u8; 10], |
1794 | /// String to end header. |
1795 | pub end_header: [u8; 2], |
1796 | } |
1797 | |
1798 | pub const IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR: u16 = 60; |
1799 | |
1800 | // |
1801 | // DLL support. |
1802 | // |
1803 | |
1804 | // |
1805 | // Export Format |
1806 | // |
1807 | |
1808 | #[derive (Debug, Clone, Copy)] |
1809 | #[repr (C)] |
1810 | pub struct ImageExportDirectory { |
1811 | pub characteristics: U32<LE>, |
1812 | pub time_date_stamp: U32<LE>, |
1813 | pub major_version: U16<LE>, |
1814 | pub minor_version: U16<LE>, |
1815 | pub name: U32<LE>, |
1816 | pub base: U32<LE>, |
1817 | pub number_of_functions: U32<LE>, |
1818 | pub number_of_names: U32<LE>, |
1819 | /// RVA from base of image |
1820 | pub address_of_functions: U32<LE>, |
1821 | /// RVA from base of image |
1822 | pub address_of_names: U32<LE>, |
1823 | /// RVA from base of image |
1824 | pub address_of_name_ordinals: U32<LE>, |
1825 | } |
1826 | |
1827 | // |
1828 | // Import Format |
1829 | // |
1830 | |
1831 | #[derive (Debug, Clone, Copy)] |
1832 | #[repr (C)] |
1833 | pub struct ImageImportByName { |
1834 | pub hint: U16<LE>, |
1835 | //pub name: [i8; 1], |
1836 | } |
1837 | |
1838 | #[derive (Debug, Clone, Copy)] |
1839 | #[repr (C)] |
1840 | pub struct ImageThunkData64(pub U64<LE>); |
1841 | /* |
1842 | union { |
1843 | /// PBYTE |
1844 | pub forwarder_string: U64<LE>, |
1845 | /// PDWORD |
1846 | pub function: U64<LE>, |
1847 | pub ordinal: U64<LE>, |
1848 | /// PIMAGE_IMPORT_BY_NAME |
1849 | pub address_of_data: U64<LE>, |
1850 | } u1; |
1851 | */ |
1852 | |
1853 | #[derive (Debug, Clone, Copy)] |
1854 | #[repr (C)] |
1855 | pub struct ImageThunkData32(pub U32<LE>); |
1856 | /* |
1857 | union { |
1858 | /// PBYTE |
1859 | pub forwarder_string: U32<LE>, |
1860 | /// PDWORD |
1861 | pub function: U32<LE>, |
1862 | pub ordinal: U32<LE>, |
1863 | /// PIMAGE_IMPORT_BY_NAME |
1864 | pub address_of_data: U32<LE>, |
1865 | } u1; |
1866 | } |
1867 | */ |
1868 | |
1869 | pub const IMAGE_ORDINAL_FLAG64: u64 = 0x8000000000000000; |
1870 | pub const IMAGE_ORDINAL_FLAG32: u32 = 0x80000000; |
1871 | |
1872 | /* |
1873 | #define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff) |
1874 | #define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff) |
1875 | #define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0) |
1876 | #define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0) |
1877 | |
1878 | */ |
1879 | |
1880 | // |
1881 | // Thread Local Storage |
1882 | // |
1883 | |
1884 | #[derive (Debug, Clone, Copy)] |
1885 | #[repr (C)] |
1886 | pub struct ImageTlsDirectory64 { |
1887 | pub start_address_of_raw_data: U64<LE>, |
1888 | pub end_address_of_raw_data: U64<LE>, |
1889 | /// PDWORD |
1890 | pub address_of_index: U64<LE>, |
1891 | /// PIMAGE_TLS_CALLBACK *; |
1892 | pub address_of_call_backs: U64<LE>, |
1893 | pub size_of_zero_fill: U32<LE>, |
1894 | pub characteristics: U32<LE>, |
1895 | } |
1896 | |
1897 | #[derive (Debug, Clone, Copy)] |
1898 | #[repr (C)] |
1899 | pub struct ImageTlsDirectory32 { |
1900 | pub start_address_of_raw_data: U32<LE>, |
1901 | pub end_address_of_raw_data: U32<LE>, |
1902 | /// PDWORD |
1903 | pub address_of_index: U32<LE>, |
1904 | /// PIMAGE_TLS_CALLBACK * |
1905 | pub address_of_call_backs: U32<LE>, |
1906 | pub size_of_zero_fill: U32<LE>, |
1907 | pub characteristics: U32<LE>, |
1908 | } |
1909 | |
1910 | #[derive (Debug, Clone, Copy)] |
1911 | #[repr (C)] |
1912 | pub struct ImageImportDescriptor { |
1913 | /// RVA to original unbound IAT (`ImageThunkData32`/`ImageThunkData64`) |
1914 | /// 0 for terminating null import descriptor |
1915 | pub original_first_thunk: U32Bytes<LE>, |
1916 | /// 0 if not bound, |
1917 | /// -1 if bound, and real date\time stamp |
1918 | /// in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) |
1919 | /// O.W. date/time stamp of DLL bound to (Old BIND) |
1920 | pub time_date_stamp: U32Bytes<LE>, |
1921 | /// -1 if no forwarders |
1922 | pub forwarder_chain: U32Bytes<LE>, |
1923 | pub name: U32Bytes<LE>, |
1924 | /// RVA to IAT (if bound this IAT has actual addresses) |
1925 | pub first_thunk: U32Bytes<LE>, |
1926 | } |
1927 | |
1928 | impl ImageImportDescriptor { |
1929 | /// Tell whether this import descriptor is the null descriptor |
1930 | /// (used to mark the end of the iterator array in a PE) |
1931 | pub fn is_null(&self) -> bool { |
1932 | self.original_first_thunk.get(LE) == 0 |
1933 | && self.time_date_stamp.get(LE) == 0 |
1934 | && self.forwarder_chain.get(LE) == 0 |
1935 | && self.name.get(LE) == 0 |
1936 | && self.first_thunk.get(LE) == 0 |
1937 | } |
1938 | } |
1939 | |
1940 | // |
1941 | // New format import descriptors pointed to by DataDirectory[ IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT ] |
1942 | // |
1943 | |
1944 | #[derive (Debug, Clone, Copy)] |
1945 | #[repr (C)] |
1946 | pub struct ImageBoundImportDescriptor { |
1947 | pub time_date_stamp: U32<LE>, |
1948 | pub offset_module_name: U16<LE>, |
1949 | pub number_of_module_forwarder_refs: U16<LE>, |
1950 | // Array of zero or more IMAGE_BOUND_FORWARDER_REF follows |
1951 | } |
1952 | |
1953 | #[derive (Debug, Clone, Copy)] |
1954 | #[repr (C)] |
1955 | pub struct ImageBoundForwarderRef { |
1956 | pub time_date_stamp: U32<LE>, |
1957 | pub offset_module_name: U16<LE>, |
1958 | pub reserved: U16<LE>, |
1959 | } |
1960 | |
1961 | #[derive (Debug, Clone, Copy)] |
1962 | #[repr (C)] |
1963 | pub struct ImageDelayloadDescriptor { |
1964 | pub attributes: U32<LE>, |
1965 | |
1966 | /// RVA to the name of the target library (NULL-terminate ASCII string) |
1967 | pub dll_name_rva: U32<LE>, |
1968 | /// RVA to the HMODULE caching location (PHMODULE) |
1969 | pub module_handle_rva: U32<LE>, |
1970 | /// RVA to the start of the IAT (PIMAGE_THUNK_DATA) |
1971 | pub import_address_table_rva: U32<LE>, |
1972 | /// RVA to the start of the name table (PIMAGE_THUNK_DATA::AddressOfData) |
1973 | pub import_name_table_rva: U32<LE>, |
1974 | /// RVA to an optional bound IAT |
1975 | pub bound_import_address_table_rva: U32<LE>, |
1976 | /// RVA to an optional unload info table |
1977 | pub unload_information_table_rva: U32<LE>, |
1978 | /// 0 if not bound, otherwise, date/time of the target DLL |
1979 | pub time_date_stamp: U32<LE>, |
1980 | } |
1981 | |
1982 | impl ImageDelayloadDescriptor { |
1983 | /// Tell whether this delay-load import descriptor is the null descriptor |
1984 | /// (used to mark the end of the iterator array in a PE) |
1985 | pub fn is_null(&self) -> bool { |
1986 | self.attributes.get(LE) == 0 |
1987 | && self.dll_name_rva.get(LE) == 0 |
1988 | && self.module_handle_rva.get(LE) == 0 |
1989 | && self.import_address_table_rva.get(LE) == 0 |
1990 | && self.import_name_table_rva.get(LE) == 0 |
1991 | && self.bound_import_address_table_rva.get(LE) == 0 |
1992 | && self.unload_information_table_rva.get(LE) == 0 |
1993 | && self.time_date_stamp.get(LE) == 0 |
1994 | } |
1995 | } |
1996 | |
1997 | /// Delay load version 2 flag for `ImageDelayloadDescriptor::attributes`. |
1998 | pub const IMAGE_DELAYLOAD_RVA_BASED: u32 = 0x8000_0000; |
1999 | |
2000 | // |
2001 | // Resource Format. |
2002 | // |
2003 | |
2004 | // |
2005 | // Resource directory consists of two counts, following by a variable length |
2006 | // array of directory entries. The first count is the number of entries at |
2007 | // beginning of the array that have actual names associated with each entry. |
2008 | // The entries are in ascending order, case insensitive strings. The second |
2009 | // count is the number of entries that immediately follow the named entries. |
2010 | // This second count identifies the number of entries that have 16-bit integer |
2011 | // Ids as their name. These entries are also sorted in ascending order. |
2012 | // |
2013 | // This structure allows fast lookup by either name or number, but for any |
2014 | // given resource entry only one form of lookup is supported, not both. |
2015 | // This is consistent with the syntax of the .RC file and the .RES file. |
2016 | // |
2017 | |
2018 | #[derive (Debug, Clone, Copy)] |
2019 | #[repr (C)] |
2020 | pub struct ImageResourceDirectory { |
2021 | pub characteristics: U32<LE>, |
2022 | pub time_date_stamp: U32<LE>, |
2023 | pub major_version: U16<LE>, |
2024 | pub minor_version: U16<LE>, |
2025 | pub number_of_named_entries: U16<LE>, |
2026 | pub number_of_id_entries: U16<LE>, |
2027 | } |
2028 | |
2029 | pub const IMAGE_RESOURCE_NAME_IS_STRING: u32 = 0x8000_0000; |
2030 | pub const IMAGE_RESOURCE_DATA_IS_DIRECTORY: u32 = 0x8000_0000; |
2031 | // |
2032 | // Each directory contains the 32-bit Name of the entry and an offset, |
2033 | // relative to the beginning of the resource directory of the data associated |
2034 | // with this directory entry. If the name of the entry is an actual text |
2035 | // string instead of an integer Id, then the high order bit of the name field |
2036 | // is set to one and the low order 31-bits are an offset, relative to the |
2037 | // beginning of the resource directory of the string, which is of type |
2038 | // IMAGE_RESOURCE_DIRECTORY_STRING. Otherwise the high bit is clear and the |
2039 | // low-order 16-bits are the integer Id that identify this resource directory |
2040 | // entry. If the directory entry is yet another resource directory (i.e. a |
2041 | // subdirectory), then the high order bit of the offset field will be |
2042 | // set to indicate this. Otherwise the high bit is clear and the offset |
2043 | // field points to a resource data entry. |
2044 | // |
2045 | |
2046 | #[derive (Debug, Clone, Copy)] |
2047 | #[repr (C)] |
2048 | pub struct ImageResourceDirectoryEntry { |
2049 | pub name_or_id: U32<LE>, |
2050 | pub offset_to_data_or_directory: U32<LE>, |
2051 | } |
2052 | |
2053 | // |
2054 | // For resource directory entries that have actual string names, the Name |
2055 | // field of the directory entry points to an object of the following type. |
2056 | // All of these string objects are stored together after the last resource |
2057 | // directory entry and before the first resource data object. This minimizes |
2058 | // the impact of these variable length objects on the alignment of the fixed |
2059 | // size directory entry objects. |
2060 | // |
2061 | |
2062 | #[derive (Debug, Clone, Copy)] |
2063 | #[repr (C)] |
2064 | pub struct ImageResourceDirectoryString { |
2065 | pub length: U16<LE>, |
2066 | //pub name_string: [i8; 1], |
2067 | } |
2068 | |
2069 | #[derive (Debug, Clone, Copy)] |
2070 | #[repr (C)] |
2071 | pub struct ImageResourceDirStringU { |
2072 | pub length: U16<LE>, |
2073 | //pub name_string: [U16<LE>; 1], |
2074 | } |
2075 | |
2076 | // |
2077 | // Each resource data entry describes a leaf node in the resource directory |
2078 | // tree. It contains an offset, relative to the beginning of the resource |
2079 | // directory of the data for the resource, a size field that gives the number |
2080 | // of bytes of data at that offset, a CodePage that should be used when |
2081 | // decoding code point values within the resource data. Typically for new |
2082 | // applications the code page would be the unicode code page. |
2083 | // |
2084 | |
2085 | #[derive (Debug, Clone, Copy)] |
2086 | #[repr (C)] |
2087 | pub struct ImageResourceDataEntry { |
2088 | /// RVA of the data. |
2089 | pub offset_to_data: U32<LE>, |
2090 | pub size: U32<LE>, |
2091 | pub code_page: U32<LE>, |
2092 | pub reserved: U32<LE>, |
2093 | } |
2094 | |
2095 | // Resource type: https://docs.microsoft.com/en-us/windows/win32/menurc/resource-types |
2096 | |
2097 | /// ID for: Hardware-dependent cursor resource. |
2098 | pub const RT_CURSOR: u16 = 1; |
2099 | /// ID for: Bitmap resource. |
2100 | pub const RT_BITMAP: u16 = 2; |
2101 | /// ID for: Hardware-dependent icon resource. |
2102 | pub const RT_ICON: u16 = 3; |
2103 | /// ID for: Menu resource. |
2104 | pub const RT_MENU: u16 = 4; |
2105 | /// ID for: Dialog box. |
2106 | pub const RT_DIALOG: u16 = 5; |
2107 | /// ID for: String-table entry. |
2108 | pub const RT_STRING: u16 = 6; |
2109 | /// ID for: Font directory resource. |
2110 | pub const RT_FONTDIR: u16 = 7; |
2111 | /// ID for: Font resource. |
2112 | pub const RT_FONT: u16 = 8; |
2113 | /// ID for: Accelerator table. |
2114 | pub const RT_ACCELERATOR: u16 = 9; |
2115 | /// ID for: Application-defined resource (raw data). |
2116 | pub const RT_RCDATA: u16 = 10; |
2117 | /// ID for: Message-table entry. |
2118 | pub const RT_MESSAGETABLE: u16 = 11; |
2119 | /// ID for: Hardware-independent cursor resource. |
2120 | pub const RT_GROUP_CURSOR: u16 = 12; |
2121 | /// ID for: Hardware-independent icon resource. |
2122 | pub const RT_GROUP_ICON: u16 = 14; |
2123 | /// ID for: Version resource. |
2124 | pub const RT_VERSION: u16 = 16; |
2125 | /// ID for: Allows a resource editing tool to associate a string with an .rc file. |
2126 | pub const RT_DLGINCLUDE: u16 = 17; |
2127 | /// ID for: Plug and Play resource. |
2128 | pub const RT_PLUGPLAY: u16 = 19; |
2129 | /// ID for: VXD. |
2130 | pub const RT_VXD: u16 = 20; |
2131 | /// ID for: Animated cursor. |
2132 | pub const RT_ANICURSOR: u16 = 21; |
2133 | /// ID for: Animated icon. |
2134 | pub const RT_ANIICON: u16 = 22; |
2135 | /// ID for: HTML resource. |
2136 | pub const RT_HTML: u16 = 23; |
2137 | /// ID for: Side-by-Side Assembly Manifest. |
2138 | pub const RT_MANIFEST: u16 = 24; |
2139 | |
2140 | // |
2141 | // Code Integrity in loadconfig (CI) |
2142 | // |
2143 | |
2144 | #[derive (Debug, Clone, Copy)] |
2145 | #[repr (C)] |
2146 | pub struct ImageLoadConfigCodeIntegrity { |
2147 | /// Flags to indicate if CI information is available, etc. |
2148 | pub flags: U16<LE>, |
2149 | /// 0xFFFF means not available |
2150 | pub catalog: U16<LE>, |
2151 | pub catalog_offset: U32<LE>, |
2152 | /// Additional bitmask to be defined later |
2153 | pub reserved: U32<LE>, |
2154 | } |
2155 | |
2156 | // |
2157 | // Dynamic value relocation table in loadconfig |
2158 | // |
2159 | |
2160 | #[derive (Debug, Clone, Copy)] |
2161 | #[repr (C)] |
2162 | pub struct ImageDynamicRelocationTable { |
2163 | pub version: U32<LE>, |
2164 | pub size: U32<LE>, |
2165 | // DynamicRelocations: [ImageDynamicRelocation; 0], |
2166 | } |
2167 | |
2168 | // |
2169 | // Dynamic value relocation entries following IMAGE_DYNAMIC_RELOCATION_TABLE |
2170 | // |
2171 | |
2172 | #[derive (Debug, Clone, Copy)] |
2173 | #[repr (C)] |
2174 | pub struct ImageDynamicRelocation32 { |
2175 | pub symbol: U32<LE>, |
2176 | pub base_reloc_size: U32<LE>, |
2177 | // BaseRelocations: [ImageBaseRelocation; 0], |
2178 | } |
2179 | |
2180 | #[derive (Debug, Clone, Copy)] |
2181 | #[repr (C)] |
2182 | pub struct ImageDynamicRelocation64 { |
2183 | pub symbol: U64<LE>, |
2184 | pub base_reloc_size: U32<LE>, |
2185 | // BaseRelocations: [ImageBaseRelocation; 0], |
2186 | } |
2187 | |
2188 | #[derive (Debug, Clone, Copy)] |
2189 | #[repr (C)] |
2190 | pub struct ImageDynamicRelocation32V2 { |
2191 | pub header_size: U32<LE>, |
2192 | pub fixup_info_size: U32<LE>, |
2193 | pub symbol: U32<LE>, |
2194 | pub symbol_group: U32<LE>, |
2195 | pub flags: U32<LE>, |
2196 | // ... variable length header fields |
2197 | // pub fixup_info: [u8; fixup_info_size] |
2198 | } |
2199 | |
2200 | #[derive (Debug, Clone, Copy)] |
2201 | #[repr (C)] |
2202 | pub struct ImageDynamicRelocation64V2 { |
2203 | pub header_size: U32<LE>, |
2204 | pub fixup_info_size: U32<LE>, |
2205 | pub symbol: U64<LE>, |
2206 | pub symbol_group: U32<LE>, |
2207 | pub flags: U32<LE>, |
2208 | // ... variable length header fields |
2209 | // pub fixup_info[u8; fixup_info_size] |
2210 | } |
2211 | |
2212 | // |
2213 | // Defined symbolic dynamic relocation entries. |
2214 | // |
2215 | |
2216 | pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE: u32 = 0x0000_0001; |
2217 | pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE: u32 = 0x0000_0002; |
2218 | pub const IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER: u32 = 0x0000_0003; |
2219 | pub const IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER: u32 = 0x0000_0004; |
2220 | pub const IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH: u32 = 0x0000_0005; |
2221 | |
2222 | // This struct has alignment 1. |
2223 | #[derive (Debug, Clone, Copy)] |
2224 | #[repr (C)] |
2225 | pub struct ImagePrologueDynamicRelocationHeader { |
2226 | pub prologue_byte_count: u8, |
2227 | // pub prologue_bytes: [u8; prologue_byte_count], |
2228 | } |
2229 | |
2230 | // This struct has alignment 1. |
2231 | #[derive (Debug, Clone, Copy)] |
2232 | #[repr (C)] |
2233 | pub struct ImageEpilogueDynamicRelocationHeader { |
2234 | pub epilogue_count: U32Bytes<LE>, |
2235 | pub epilogue_byte_count: u8, |
2236 | pub branch_descriptor_element_size: u8, |
2237 | pub branch_descriptor_count: U16Bytes<LE>, |
2238 | // pub branch_descriptors[...], |
2239 | // pub branch_descriptor_bit_map[...], |
2240 | } |
2241 | |
2242 | /* |
2243 | // TODO? bitfields |
2244 | // TODO: unaligned? |
2245 | #[derive(Debug, Clone, Copy)] |
2246 | #[repr(C)] |
2247 | pub struct ImageImportControlTransferDynamicRelocation { |
2248 | DWORD PageRelativeOffset : 12; |
2249 | DWORD IndirectCall : 1; |
2250 | DWORD IATIndex : 19; |
2251 | } |
2252 | |
2253 | // TODO: unaligned? |
2254 | #[derive(Debug, Clone, Copy)] |
2255 | #[repr(C)] |
2256 | pub struct ImageIndirControlTransferDynamicRelocation { |
2257 | WORD PageRelativeOffset : 12; |
2258 | WORD IndirectCall : 1; |
2259 | WORD RexWPrefix : 1; |
2260 | WORD CfgCheck : 1; |
2261 | WORD Reserved : 1; |
2262 | } |
2263 | |
2264 | // TODO: unaligned? |
2265 | #[derive(Debug, Clone, Copy)] |
2266 | #[repr(C)] |
2267 | pub struct ImageSwitchtableBranchDynamicRelocation { |
2268 | WORD PageRelativeOffset : 12; |
2269 | WORD RegisterNumber : 4; |
2270 | } |
2271 | */ |
2272 | |
2273 | // |
2274 | // Load Configuration Directory Entry |
2275 | // |
2276 | |
2277 | #[derive (Debug, Clone, Copy)] |
2278 | #[repr (C)] |
2279 | pub struct ImageLoadConfigDirectory32 { |
2280 | pub size: U32<LE>, |
2281 | pub time_date_stamp: U32<LE>, |
2282 | pub major_version: U16<LE>, |
2283 | pub minor_version: U16<LE>, |
2284 | pub global_flags_clear: U32<LE>, |
2285 | pub global_flags_set: U32<LE>, |
2286 | pub critical_section_default_timeout: U32<LE>, |
2287 | pub de_commit_free_block_threshold: U32<LE>, |
2288 | pub de_commit_total_free_threshold: U32<LE>, |
2289 | /// VA |
2290 | pub lock_prefix_table: U32<LE>, |
2291 | pub maximum_allocation_size: U32<LE>, |
2292 | pub virtual_memory_threshold: U32<LE>, |
2293 | pub process_heap_flags: U32<LE>, |
2294 | pub process_affinity_mask: U32<LE>, |
2295 | pub csd_version: U16<LE>, |
2296 | pub dependent_load_flags: U16<LE>, |
2297 | /// VA |
2298 | pub edit_list: U32<LE>, |
2299 | /// VA |
2300 | pub security_cookie: U32<LE>, |
2301 | /// VA |
2302 | pub sehandler_table: U32<LE>, |
2303 | pub sehandler_count: U32<LE>, |
2304 | /// VA |
2305 | pub guard_cf_check_function_pointer: U32<LE>, |
2306 | /// VA |
2307 | pub guard_cf_dispatch_function_pointer: U32<LE>, |
2308 | /// VA |
2309 | pub guard_cf_function_table: U32<LE>, |
2310 | pub guard_cf_function_count: U32<LE>, |
2311 | pub guard_flags: U32<LE>, |
2312 | pub code_integrity: ImageLoadConfigCodeIntegrity, |
2313 | /// VA |
2314 | pub guard_address_taken_iat_entry_table: U32<LE>, |
2315 | pub guard_address_taken_iat_entry_count: U32<LE>, |
2316 | /// VA |
2317 | pub guard_long_jump_target_table: U32<LE>, |
2318 | pub guard_long_jump_target_count: U32<LE>, |
2319 | /// VA |
2320 | pub dynamic_value_reloc_table: U32<LE>, |
2321 | pub chpe_metadata_pointer: U32<LE>, |
2322 | /// VA |
2323 | pub guard_rf_failure_routine: U32<LE>, |
2324 | /// VA |
2325 | pub guard_rf_failure_routine_function_pointer: U32<LE>, |
2326 | pub dynamic_value_reloc_table_offset: U32<LE>, |
2327 | pub dynamic_value_reloc_table_section: U16<LE>, |
2328 | pub reserved2: U16<LE>, |
2329 | /// VA |
2330 | pub guard_rf_verify_stack_pointer_function_pointer: U32<LE>, |
2331 | pub hot_patch_table_offset: U32<LE>, |
2332 | pub reserved3: U32<LE>, |
2333 | /// VA |
2334 | pub enclave_configuration_pointer: U32<LE>, |
2335 | /// VA |
2336 | pub volatile_metadata_pointer: U32<LE>, |
2337 | } |
2338 | |
2339 | #[derive (Debug, Clone, Copy)] |
2340 | #[repr (C)] |
2341 | pub struct ImageLoadConfigDirectory64 { |
2342 | pub size: U32<LE>, |
2343 | pub time_date_stamp: U32<LE>, |
2344 | pub major_version: U16<LE>, |
2345 | pub minor_version: U16<LE>, |
2346 | pub global_flags_clear: U32<LE>, |
2347 | pub global_flags_set: U32<LE>, |
2348 | pub critical_section_default_timeout: U32<LE>, |
2349 | pub de_commit_free_block_threshold: U64<LE>, |
2350 | pub de_commit_total_free_threshold: U64<LE>, |
2351 | /// VA |
2352 | pub lock_prefix_table: U64<LE>, |
2353 | pub maximum_allocation_size: U64<LE>, |
2354 | pub virtual_memory_threshold: U64<LE>, |
2355 | pub process_affinity_mask: U64<LE>, |
2356 | pub process_heap_flags: U32<LE>, |
2357 | pub csd_version: U16<LE>, |
2358 | pub dependent_load_flags: U16<LE>, |
2359 | /// VA |
2360 | pub edit_list: U64<LE>, |
2361 | /// VA |
2362 | pub security_cookie: U64<LE>, |
2363 | /// VA |
2364 | pub sehandler_table: U64<LE>, |
2365 | pub sehandler_count: U64<LE>, |
2366 | /// VA |
2367 | pub guard_cf_check_function_pointer: U64<LE>, |
2368 | /// VA |
2369 | pub guard_cf_dispatch_function_pointer: U64<LE>, |
2370 | /// VA |
2371 | pub guard_cf_function_table: U64<LE>, |
2372 | pub guard_cf_function_count: U64<LE>, |
2373 | pub guard_flags: U32<LE>, |
2374 | pub code_integrity: ImageLoadConfigCodeIntegrity, |
2375 | /// VA |
2376 | pub guard_address_taken_iat_entry_table: U64<LE>, |
2377 | pub guard_address_taken_iat_entry_count: U64<LE>, |
2378 | /// VA |
2379 | pub guard_long_jump_target_table: U64<LE>, |
2380 | pub guard_long_jump_target_count: U64<LE>, |
2381 | /// VA |
2382 | pub dynamic_value_reloc_table: U64<LE>, |
2383 | /// VA |
2384 | pub chpe_metadata_pointer: U64<LE>, |
2385 | /// VA |
2386 | pub guard_rf_failure_routine: U64<LE>, |
2387 | /// VA |
2388 | pub guard_rf_failure_routine_function_pointer: U64<LE>, |
2389 | pub dynamic_value_reloc_table_offset: U32<LE>, |
2390 | pub dynamic_value_reloc_table_section: U16<LE>, |
2391 | pub reserved2: U16<LE>, |
2392 | /// VA |
2393 | pub guard_rf_verify_stack_pointer_function_pointer: U64<LE>, |
2394 | pub hot_patch_table_offset: U32<LE>, |
2395 | pub reserved3: U32<LE>, |
2396 | /// VA |
2397 | pub enclave_configuration_pointer: U64<LE>, |
2398 | /// VA |
2399 | pub volatile_metadata_pointer: U64<LE>, |
2400 | } |
2401 | |
2402 | #[derive (Debug, Clone, Copy)] |
2403 | #[repr (C)] |
2404 | pub struct ImageHotPatchInfo { |
2405 | pub version: U32<LE>, |
2406 | pub size: U32<LE>, |
2407 | pub sequence_number: U32<LE>, |
2408 | pub base_image_list: U32<LE>, |
2409 | pub base_image_count: U32<LE>, |
2410 | /// Version 2 and later |
2411 | pub buffer_offset: U32<LE>, |
2412 | /// Version 3 and later |
2413 | pub extra_patch_size: U32<LE>, |
2414 | } |
2415 | |
2416 | #[derive (Debug, Clone, Copy)] |
2417 | #[repr (C)] |
2418 | pub struct ImageHotPatchBase { |
2419 | pub sequence_number: U32<LE>, |
2420 | pub flags: U32<LE>, |
2421 | pub original_time_date_stamp: U32<LE>, |
2422 | pub original_check_sum: U32<LE>, |
2423 | pub code_integrity_info: U32<LE>, |
2424 | pub code_integrity_size: U32<LE>, |
2425 | pub patch_table: U32<LE>, |
2426 | /// Version 2 and later |
2427 | pub buffer_offset: U32<LE>, |
2428 | } |
2429 | |
2430 | #[derive (Debug, Clone, Copy)] |
2431 | #[repr (C)] |
2432 | pub struct ImageHotPatchHashes { |
2433 | pub sha256: [u8; 32], |
2434 | pub sha1: [u8; 20], |
2435 | } |
2436 | |
2437 | pub const IMAGE_HOT_PATCH_BASE_OBLIGATORY: u32 = 0x0000_0001; |
2438 | pub const IMAGE_HOT_PATCH_BASE_CAN_ROLL_BACK: u32 = 0x0000_0002; |
2439 | |
2440 | pub const IMAGE_HOT_PATCH_CHUNK_INVERSE: u32 = 0x8000_0000; |
2441 | pub const IMAGE_HOT_PATCH_CHUNK_OBLIGATORY: u32 = 0x4000_0000; |
2442 | pub const IMAGE_HOT_PATCH_CHUNK_RESERVED: u32 = 0x3FF0_3000; |
2443 | pub const IMAGE_HOT_PATCH_CHUNK_TYPE: u32 = 0x000F_C000; |
2444 | pub const IMAGE_HOT_PATCH_CHUNK_SOURCE_RVA: u32 = 0x0000_8000; |
2445 | pub const IMAGE_HOT_PATCH_CHUNK_TARGET_RVA: u32 = 0x0000_4000; |
2446 | pub const IMAGE_HOT_PATCH_CHUNK_SIZE: u32 = 0x0000_0FFF; |
2447 | |
2448 | pub const IMAGE_HOT_PATCH_NONE: u32 = 0x0000_0000; |
2449 | pub const IMAGE_HOT_PATCH_FUNCTION: u32 = 0x0001_C000; |
2450 | pub const IMAGE_HOT_PATCH_ABSOLUTE: u32 = 0x0002_C000; |
2451 | pub const IMAGE_HOT_PATCH_REL32: u32 = 0x0003_C000; |
2452 | pub const IMAGE_HOT_PATCH_CALL_TARGET: u32 = 0x0004_4000; |
2453 | pub const IMAGE_HOT_PATCH_INDIRECT: u32 = 0x0005_C000; |
2454 | pub const IMAGE_HOT_PATCH_NO_CALL_TARGET: u32 = 0x0006_4000; |
2455 | pub const IMAGE_HOT_PATCH_DYNAMIC_VALUE: u32 = 0x0007_8000; |
2456 | |
2457 | /// Module performs control flow integrity checks using system-supplied support |
2458 | pub const IMAGE_GUARD_CF_INSTRUMENTED: u32 = 0x0000_0100; |
2459 | /// Module performs control flow and write integrity checks |
2460 | pub const IMAGE_GUARD_CFW_INSTRUMENTED: u32 = 0x0000_0200; |
2461 | /// Module contains valid control flow target metadata |
2462 | pub const IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT: u32 = 0x0000_0400; |
2463 | /// Module does not make use of the /GS security cookie |
2464 | pub const IMAGE_GUARD_SECURITY_COOKIE_UNUSED: u32 = 0x0000_0800; |
2465 | /// Module supports read only delay load IAT |
2466 | pub const IMAGE_GUARD_PROTECT_DELAYLOAD_IAT: u32 = 0x0000_1000; |
2467 | /// Delayload import table in its own .didat section (with nothing else in it) that can be freely reprotected |
2468 | pub const IMAGE_GUARD_DELAYLOAD_IAT_IN_ITS_OWN_SECTION: u32 = 0x0000_2000; |
2469 | /// Module contains suppressed export information. |
2470 | /// |
2471 | /// This also infers that the address taken taken IAT table is also present in the load config. |
2472 | pub const IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT: u32 = 0x0000_4000; |
2473 | /// Module enables suppression of exports |
2474 | pub const IMAGE_GUARD_CF_ENABLE_EXPORT_SUPPRESSION: u32 = 0x0000_8000; |
2475 | /// Module contains longjmp target information |
2476 | pub const IMAGE_GUARD_CF_LONGJUMP_TABLE_PRESENT: u32 = 0x0001_0000; |
2477 | /// Module contains return flow instrumentation and metadata |
2478 | pub const IMAGE_GUARD_RF_INSTRUMENTED: u32 = 0x0002_0000; |
2479 | /// Module requests that the OS enable return flow protection |
2480 | pub const IMAGE_GUARD_RF_ENABLE: u32 = 0x0004_0000; |
2481 | /// Module requests that the OS enable return flow protection in strict mode |
2482 | pub const IMAGE_GUARD_RF_STRICT: u32 = 0x0008_0000; |
2483 | /// Module was built with retpoline support |
2484 | pub const IMAGE_GUARD_RETPOLINE_PRESENT: u32 = 0x0010_0000; |
2485 | |
2486 | /// Stride of Guard CF function table encoded in these bits (additional count of bytes per element) |
2487 | pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_MASK: u32 = 0xF000_0000; |
2488 | /// Shift to right-justify Guard CF function table stride |
2489 | pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_SHIFT: u32 = 28; |
2490 | |
2491 | // |
2492 | // GFIDS table entry flags. |
2493 | // |
2494 | |
2495 | /// The containing GFID entry is suppressed |
2496 | pub const IMAGE_GUARD_FLAG_FID_SUPPRESSED: u16 = 0x01; |
2497 | /// The containing GFID entry is export suppressed |
2498 | pub const IMAGE_GUARD_FLAG_EXPORT_SUPPRESSED: u16 = 0x02; |
2499 | |
2500 | // |
2501 | // WIN CE Exception table format |
2502 | // |
2503 | |
2504 | // |
2505 | // Function table entry format. Function table is pointed to by the |
2506 | // IMAGE_DIRECTORY_ENTRY_EXCEPTION directory entry. |
2507 | // |
2508 | |
2509 | /* |
2510 | // TODO? bitfields |
2511 | #[derive(Debug, Clone, Copy)] |
2512 | #[repr(C)] |
2513 | pub struct ImageCeRuntimeFunctionEntry { |
2514 | pub func_start: U32<LE>, |
2515 | DWORD PrologLen : 8; |
2516 | DWORD FuncLen : 22; |
2517 | DWORD ThirtyTwoBit : 1; |
2518 | DWORD ExceptionFlag : 1; |
2519 | } |
2520 | */ |
2521 | |
2522 | #[derive (Debug, Clone, Copy)] |
2523 | #[repr (C)] |
2524 | pub struct ImageArmRuntimeFunctionEntry { |
2525 | pub begin_address: U32<LE>, |
2526 | pub unwind_data: U32<LE>, |
2527 | } |
2528 | |
2529 | #[derive (Debug, Clone, Copy)] |
2530 | #[repr (C)] |
2531 | pub struct ImageArm64RuntimeFunctionEntry { |
2532 | pub begin_address: U32<LE>, |
2533 | pub unwind_data: U32<LE>, |
2534 | } |
2535 | |
2536 | #[derive (Debug, Clone, Copy)] |
2537 | #[repr (C)] |
2538 | pub struct ImageAlpha64RuntimeFunctionEntry { |
2539 | pub begin_address: U64<LE>, |
2540 | pub end_address: U64<LE>, |
2541 | pub exception_handler: U64<LE>, |
2542 | pub handler_data: U64<LE>, |
2543 | pub prolog_end_address: U64<LE>, |
2544 | } |
2545 | |
2546 | #[derive (Debug, Clone, Copy)] |
2547 | #[repr (C)] |
2548 | pub struct ImageAlphaRuntimeFunctionEntry { |
2549 | pub begin_address: U32<LE>, |
2550 | pub end_address: U32<LE>, |
2551 | pub exception_handler: U32<LE>, |
2552 | pub handler_data: U32<LE>, |
2553 | pub prolog_end_address: U32<LE>, |
2554 | } |
2555 | |
2556 | #[derive (Debug, Clone, Copy)] |
2557 | #[repr (C)] |
2558 | pub struct ImageRuntimeFunctionEntry { |
2559 | pub begin_address: U32<LE>, |
2560 | pub end_address: U32<LE>, |
2561 | pub unwind_info_address_or_data: U32<LE>, |
2562 | } |
2563 | |
2564 | // |
2565 | // Software enclave information |
2566 | // |
2567 | |
2568 | pub const IMAGE_ENCLAVE_LONG_ID_LENGTH: usize = 32; |
2569 | pub const IMAGE_ENCLAVE_SHORT_ID_LENGTH: usize = 16; |
2570 | |
2571 | #[derive (Debug, Clone, Copy)] |
2572 | #[repr (C)] |
2573 | pub struct ImageEnclaveConfig32 { |
2574 | pub size: U32<LE>, |
2575 | pub minimum_required_config_size: U32<LE>, |
2576 | pub policy_flags: U32<LE>, |
2577 | pub number_of_imports: U32<LE>, |
2578 | pub import_list: U32<LE>, |
2579 | pub import_entry_size: U32<LE>, |
2580 | pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH], |
2581 | pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH], |
2582 | pub image_version: U32<LE>, |
2583 | pub security_version: U32<LE>, |
2584 | pub enclave_size: U32<LE>, |
2585 | pub number_of_threads: U32<LE>, |
2586 | pub enclave_flags: U32<LE>, |
2587 | } |
2588 | |
2589 | #[derive (Debug, Clone, Copy)] |
2590 | #[repr (C)] |
2591 | pub struct ImageEnclaveConfig64 { |
2592 | pub size: U32<LE>, |
2593 | pub minimum_required_config_size: U32<LE>, |
2594 | pub policy_flags: U32<LE>, |
2595 | pub number_of_imports: U32<LE>, |
2596 | pub import_list: U32<LE>, |
2597 | pub import_entry_size: U32<LE>, |
2598 | pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH], |
2599 | pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH], |
2600 | pub image_version: U32<LE>, |
2601 | pub security_version: U32<LE>, |
2602 | pub enclave_size: U64<LE>, |
2603 | pub number_of_threads: U32<LE>, |
2604 | pub enclave_flags: U32<LE>, |
2605 | } |
2606 | |
2607 | //pub const IMAGE_ENCLAVE_MINIMUM_CONFIG_SIZE: usize = FIELD_OFFSET(IMAGE_ENCLAVE_CONFIG, EnclaveFlags); |
2608 | |
2609 | pub const IMAGE_ENCLAVE_POLICY_DEBUGGABLE: u32 = 0x0000_0001; |
2610 | |
2611 | pub const IMAGE_ENCLAVE_FLAG_PRIMARY_IMAGE: u32 = 0x0000_0001; |
2612 | |
2613 | #[derive (Debug, Clone, Copy)] |
2614 | #[repr (C)] |
2615 | pub struct ImageEnclaveImport { |
2616 | pub match_type: U32<LE>, |
2617 | pub minimum_security_version: U32<LE>, |
2618 | pub unique_or_author_id: [u8; IMAGE_ENCLAVE_LONG_ID_LENGTH], |
2619 | pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH], |
2620 | pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH], |
2621 | pub import_name: U32<LE>, |
2622 | pub reserved: U32<LE>, |
2623 | } |
2624 | |
2625 | pub const IMAGE_ENCLAVE_IMPORT_MATCH_NONE: u32 = 0x0000_0000; |
2626 | pub const IMAGE_ENCLAVE_IMPORT_MATCH_UNIQUE_ID: u32 = 0x0000_0001; |
2627 | pub const IMAGE_ENCLAVE_IMPORT_MATCH_AUTHOR_ID: u32 = 0x0000_0002; |
2628 | pub const IMAGE_ENCLAVE_IMPORT_MATCH_FAMILY_ID: u32 = 0x0000_0003; |
2629 | pub const IMAGE_ENCLAVE_IMPORT_MATCH_IMAGE_ID: u32 = 0x0000_0004; |
2630 | |
2631 | // |
2632 | // Debug Format |
2633 | // |
2634 | |
2635 | #[derive (Debug, Clone, Copy)] |
2636 | #[repr (C)] |
2637 | pub struct ImageDebugDirectory { |
2638 | pub characteristics: U32<LE>, |
2639 | pub time_date_stamp: U32<LE>, |
2640 | pub major_version: U16<LE>, |
2641 | pub minor_version: U16<LE>, |
2642 | pub typ: U32<LE>, |
2643 | pub size_of_data: U32<LE>, |
2644 | pub address_of_raw_data: U32<LE>, |
2645 | pub pointer_to_raw_data: U32<LE>, |
2646 | } |
2647 | |
2648 | pub const IMAGE_DEBUG_TYPE_UNKNOWN: u32 = 0; |
2649 | pub const IMAGE_DEBUG_TYPE_COFF: u32 = 1; |
2650 | pub const IMAGE_DEBUG_TYPE_CODEVIEW: u32 = 2; |
2651 | pub const IMAGE_DEBUG_TYPE_FPO: u32 = 3; |
2652 | pub const IMAGE_DEBUG_TYPE_MISC: u32 = 4; |
2653 | pub const IMAGE_DEBUG_TYPE_EXCEPTION: u32 = 5; |
2654 | pub const IMAGE_DEBUG_TYPE_FIXUP: u32 = 6; |
2655 | pub const IMAGE_DEBUG_TYPE_OMAP_TO_SRC: u32 = 7; |
2656 | pub const IMAGE_DEBUG_TYPE_OMAP_FROM_SRC: u32 = 8; |
2657 | pub const IMAGE_DEBUG_TYPE_BORLAND: u32 = 9; |
2658 | pub const IMAGE_DEBUG_TYPE_RESERVED10: u32 = 10; |
2659 | pub const IMAGE_DEBUG_TYPE_CLSID: u32 = 11; |
2660 | pub const IMAGE_DEBUG_TYPE_VC_FEATURE: u32 = 12; |
2661 | pub const IMAGE_DEBUG_TYPE_POGO: u32 = 13; |
2662 | pub const IMAGE_DEBUG_TYPE_ILTCG: u32 = 14; |
2663 | pub const IMAGE_DEBUG_TYPE_MPX: u32 = 15; |
2664 | pub const IMAGE_DEBUG_TYPE_REPRO: u32 = 16; |
2665 | |
2666 | #[derive (Debug, Clone, Copy)] |
2667 | #[repr (C)] |
2668 | pub struct ImageCoffSymbolsHeader { |
2669 | pub number_of_symbols: U32<LE>, |
2670 | pub lva_to_first_symbol: U32<LE>, |
2671 | pub number_of_linenumbers: U32<LE>, |
2672 | pub lva_to_first_linenumber: U32<LE>, |
2673 | pub rva_to_first_byte_of_code: U32<LE>, |
2674 | pub rva_to_last_byte_of_code: U32<LE>, |
2675 | pub rva_to_first_byte_of_data: U32<LE>, |
2676 | pub rva_to_last_byte_of_data: U32<LE>, |
2677 | } |
2678 | |
2679 | pub const FRAME_FPO: u16 = 0; |
2680 | pub const FRAME_TRAP: u16 = 1; |
2681 | pub const FRAME_TSS: u16 = 2; |
2682 | pub const FRAME_NONFPO: u16 = 3; |
2683 | |
2684 | /* |
2685 | // TODO? bitfields |
2686 | #[derive(Debug, Clone, Copy)] |
2687 | #[repr(C)] |
2688 | pub struct FpoData { |
2689 | /// offset 1st byte of function code |
2690 | pub ul_off_start: U32<LE>, |
2691 | /// # bytes in function |
2692 | pub cb_proc_size: U32<LE>, |
2693 | /// # bytes in locals/4 |
2694 | pub cdw_locals: U32<LE>, |
2695 | /// # bytes in params/4 |
2696 | pub cdw_params: U16<LE>, |
2697 | /// # bytes in prolog |
2698 | WORD cbProlog : 8; |
2699 | /// # regs saved |
2700 | WORD cbRegs : 3; |
2701 | /// TRUE if SEH in func |
2702 | WORD fHasSEH : 1; |
2703 | /// TRUE if EBP has been allocated |
2704 | WORD fUseBP : 1; |
2705 | /// reserved for future use |
2706 | WORD reserved : 1; |
2707 | /// frame type |
2708 | WORD cbFrame : 2; |
2709 | } |
2710 | pub const SIZEOF_RFPO_DATA: usize = 16; |
2711 | */ |
2712 | |
2713 | pub const IMAGE_DEBUG_MISC_EXENAME: u16 = 1; |
2714 | |
2715 | #[derive (Debug, Clone, Copy)] |
2716 | #[repr (C)] |
2717 | pub struct ImageDebugMisc { |
2718 | /// type of misc data, see defines |
2719 | pub data_type: U32<LE>, |
2720 | /// total length of record, rounded to four byte multiple. |
2721 | pub length: U32<LE>, |
2722 | /// TRUE if data is unicode string |
2723 | pub unicode: u8, |
2724 | pub reserved: [u8; 3], |
2725 | // Actual data |
2726 | //pub data: [u8; 1], |
2727 | } |
2728 | |
2729 | // |
2730 | // Function table extracted from MIPS/ALPHA/IA64 images. Does not contain |
2731 | // information needed only for runtime support. Just those fields for |
2732 | // each entry needed by a debugger. |
2733 | // |
2734 | |
2735 | #[derive (Debug, Clone, Copy)] |
2736 | #[repr (C)] |
2737 | pub struct ImageFunctionEntry { |
2738 | pub starting_address: U32<LE>, |
2739 | pub ending_address: U32<LE>, |
2740 | pub end_of_prologue: U32<LE>, |
2741 | } |
2742 | |
2743 | #[derive (Debug, Clone, Copy)] |
2744 | #[repr (C)] |
2745 | pub struct ImageFunctionEntry64 { |
2746 | pub starting_address: U64<LE>, |
2747 | pub ending_address: U64<LE>, |
2748 | pub end_of_prologue_or_unwind_info_address: U64<LE>, |
2749 | } |
2750 | |
2751 | // |
2752 | // Debugging information can be stripped from an image file and placed |
2753 | // in a separate .DBG file, whose file name part is the same as the |
2754 | // image file name part (e.g. symbols for CMD.EXE could be stripped |
2755 | // and placed in CMD.DBG). This is indicated by the IMAGE_FILE_DEBUG_STRIPPED |
2756 | // flag in the Characteristics field of the file header. The beginning of |
2757 | // the .DBG file contains the following structure which captures certain |
2758 | // information from the image file. This allows a debug to proceed even if |
2759 | // the original image file is not accessible. This header is followed by |
2760 | // zero of more IMAGE_SECTION_HEADER structures, followed by zero or more |
2761 | // IMAGE_DEBUG_DIRECTORY structures. The latter structures and those in |
2762 | // the image file contain file offsets relative to the beginning of the |
2763 | // .DBG file. |
2764 | // |
2765 | // If symbols have been stripped from an image, the IMAGE_DEBUG_MISC structure |
2766 | // is left in the image file, but not mapped. This allows a debugger to |
2767 | // compute the name of the .DBG file, from the name of the image in the |
2768 | // IMAGE_DEBUG_MISC structure. |
2769 | // |
2770 | |
2771 | #[derive (Debug, Clone, Copy)] |
2772 | #[repr (C)] |
2773 | pub struct ImageSeparateDebugHeader { |
2774 | pub signature: U16<LE>, |
2775 | pub flags: U16<LE>, |
2776 | pub machine: U16<LE>, |
2777 | pub characteristics: U16<LE>, |
2778 | pub time_date_stamp: U32<LE>, |
2779 | pub check_sum: U32<LE>, |
2780 | pub image_base: U32<LE>, |
2781 | pub size_of_image: U32<LE>, |
2782 | pub number_of_sections: U32<LE>, |
2783 | pub exported_names_size: U32<LE>, |
2784 | pub debug_directory_size: U32<LE>, |
2785 | pub section_alignment: U32<LE>, |
2786 | pub reserved: [U32<LE>; 2], |
2787 | } |
2788 | |
2789 | #[derive (Debug, Clone, Copy)] |
2790 | #[repr (C)] |
2791 | pub struct NonPagedDebugInfo { |
2792 | pub signature: U16<LE>, |
2793 | pub flags: U16<LE>, |
2794 | pub size: U32<LE>, |
2795 | pub machine: U16<LE>, |
2796 | pub characteristics: U16<LE>, |
2797 | pub time_date_stamp: U32<LE>, |
2798 | pub check_sum: U32<LE>, |
2799 | pub size_of_image: U32<LE>, |
2800 | pub image_base: U64<LE>, |
2801 | //debug_directory_size |
2802 | //ImageDebugDirectory |
2803 | } |
2804 | |
2805 | pub const IMAGE_SEPARATE_DEBUG_SIGNATURE: u16 = 0x4944; |
2806 | pub const NON_PAGED_DEBUG_SIGNATURE: u16 = 0x494E; |
2807 | |
2808 | pub const IMAGE_SEPARATE_DEBUG_FLAGS_MASK: u16 = 0x8000; |
2809 | /// when DBG was updated, the old checksum didn't match. |
2810 | pub const IMAGE_SEPARATE_DEBUG_MISMATCH: u16 = 0x8000; |
2811 | |
2812 | // |
2813 | // The .arch section is made up of headers, each describing an amask position/value |
2814 | // pointing to an array of IMAGE_ARCHITECTURE_ENTRY's. Each "array" (both the header |
2815 | // and entry arrays) are terminiated by a quadword of 0xffffffffL. |
2816 | // |
2817 | // NOTE: There may be quadwords of 0 sprinkled around and must be skipped. |
2818 | // |
2819 | |
2820 | /* |
2821 | // TODO? bitfields |
2822 | #[derive(Debug, Clone, Copy)] |
2823 | #[repr(C)] |
2824 | pub struct ImageArchitectureHeader { |
2825 | /// 1 -> code section depends on mask bit |
2826 | /// 0 -> new instruction depends on mask bit |
2827 | unsigned int AmaskValue: 1; |
2828 | /// MBZ |
2829 | int :7; |
2830 | /// Amask bit in question for this fixup |
2831 | unsigned int AmaskShift: 8; |
2832 | /// MBZ |
2833 | int :16; |
2834 | /// RVA into .arch section to array of ARCHITECTURE_ENTRY's |
2835 | pub first_entry_rva: U32<LE>, |
2836 | } |
2837 | */ |
2838 | |
2839 | #[derive (Debug, Clone, Copy)] |
2840 | #[repr (C)] |
2841 | pub struct ImageArchitectureEntry { |
2842 | /// RVA of instruction to fixup |
2843 | pub fixup_inst_rva: U32<LE>, |
2844 | /// fixup instruction (see alphaops.h) |
2845 | pub new_inst: U32<LE>, |
2846 | } |
2847 | |
2848 | // The following structure defines the new import object. Note the values of the first two fields, |
2849 | // which must be set as stated in order to differentiate old and new import members. |
2850 | // Following this structure, the linker emits two null-terminated strings used to recreate the |
2851 | // import at the time of use. The first string is the import's name, the second is the dll's name. |
2852 | |
2853 | pub const IMPORT_OBJECT_HDR_SIG2: u16 = 0xffff; |
2854 | |
2855 | #[derive (Debug, Clone, Copy)] |
2856 | #[repr (C)] |
2857 | pub struct ImportObjectHeader { |
2858 | /// Must be IMAGE_FILE_MACHINE_UNKNOWN |
2859 | pub sig1: U16<LE>, |
2860 | /// Must be IMPORT_OBJECT_HDR_SIG2. |
2861 | pub sig2: U16<LE>, |
2862 | pub version: U16<LE>, |
2863 | pub machine: U16<LE>, |
2864 | /// Time/date stamp |
2865 | pub time_date_stamp: U32<LE>, |
2866 | /// particularly useful for incremental links |
2867 | pub size_of_data: U32<LE>, |
2868 | |
2869 | /// if grf & IMPORT_OBJECT_ORDINAL |
2870 | pub ordinal_or_hint: U16<LE>, |
2871 | |
2872 | // WORD Type : 2; |
2873 | // WORD NameType : 3; |
2874 | // WORD Reserved : 11; |
2875 | pub name_type: U16<LE>, |
2876 | } |
2877 | |
2878 | pub const IMPORT_OBJECT_TYPE_MASK: u16 = 0b11; |
2879 | pub const IMPORT_OBJECT_TYPE_SHIFT: u16 = 0; |
2880 | pub const IMPORT_OBJECT_CODE: u16 = 0; |
2881 | pub const IMPORT_OBJECT_DATA: u16 = 1; |
2882 | pub const IMPORT_OBJECT_CONST: u16 = 2; |
2883 | |
2884 | pub const IMPORT_OBJECT_NAME_MASK: u16 = 0b111; |
2885 | pub const IMPORT_OBJECT_NAME_SHIFT: u16 = 2; |
2886 | /// Import by ordinal |
2887 | pub const IMPORT_OBJECT_ORDINAL: u16 = 0; |
2888 | /// Import name == public symbol name. |
2889 | pub const IMPORT_OBJECT_NAME: u16 = 1; |
2890 | /// Import name == public symbol name skipping leading ?, @, or optionally _. |
2891 | pub const IMPORT_OBJECT_NAME_NO_PREFIX: u16 = 2; |
2892 | /// Import name == public symbol name skipping leading ?, @, or optionally _ and truncating at first @. |
2893 | pub const IMPORT_OBJECT_NAME_UNDECORATE: u16 = 3; |
2894 | /// Import name == a name is explicitly provided after the DLL name. |
2895 | pub const IMPORT_OBJECT_NAME_EXPORTAS: u16 = 4; |
2896 | |
2897 | // COM+ Header entry point flags. |
2898 | pub const COMIMAGE_FLAGS_ILONLY: u32 = 0x0000_0001; |
2899 | pub const COMIMAGE_FLAGS_32BITREQUIRED: u32 = 0x0000_0002; |
2900 | pub const COMIMAGE_FLAGS_IL_LIBRARY: u32 = 0x0000_0004; |
2901 | pub const COMIMAGE_FLAGS_STRONGNAMESIGNED: u32 = 0x0000_0008; |
2902 | pub const COMIMAGE_FLAGS_NATIVE_ENTRYPOINT: u32 = 0x0000_0010; |
2903 | pub const COMIMAGE_FLAGS_TRACKDEBUGDATA: u32 = 0x0001_0000; |
2904 | pub const COMIMAGE_FLAGS_32BITPREFERRED: u32 = 0x0002_0000; |
2905 | |
2906 | // Version flags for image. |
2907 | pub const COR_VERSION_MAJOR_V2: u16 = 2; |
2908 | pub const COR_VERSION_MAJOR: u16 = COR_VERSION_MAJOR_V2; |
2909 | pub const COR_VERSION_MINOR: u16 = 5; |
2910 | pub const COR_DELETED_NAME_LENGTH: usize = 8; |
2911 | pub const COR_VTABLEGAP_NAME_LENGTH: usize = 8; |
2912 | |
2913 | // Maximum size of a NativeType descriptor. |
2914 | pub const NATIVE_TYPE_MAX_CB: u16 = 1; |
2915 | pub const COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE: u16 = 0xFF; |
2916 | |
2917 | // Consts for the MIH FLAGS |
2918 | pub const IMAGE_COR_MIH_METHODRVA: u16 = 0x01; |
2919 | pub const IMAGE_COR_MIH_EHRVA: u16 = 0x02; |
2920 | pub const IMAGE_COR_MIH_BASICBLOCK: u16 = 0x08; |
2921 | |
2922 | // V-table constants |
2923 | /// V-table slots are 32-bits in size. |
2924 | pub const COR_VTABLE_32BIT: u16 = 0x01; |
2925 | /// V-table slots are 64-bits in size. |
2926 | pub const COR_VTABLE_64BIT: u16 = 0x02; |
2927 | /// If set, transition from unmanaged. |
2928 | pub const COR_VTABLE_FROM_UNMANAGED: u16 = 0x04; |
2929 | /// If set, transition from unmanaged with keeping the current appdomain. |
2930 | pub const COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN: u16 = 0x08; |
2931 | /// Call most derived method described by |
2932 | pub const COR_VTABLE_CALL_MOST_DERIVED: u16 = 0x10; |
2933 | |
2934 | // EATJ constants |
2935 | /// Size of a jump thunk reserved range. |
2936 | pub const IMAGE_COR_EATJ_THUNK_SIZE: usize = 32; |
2937 | |
2938 | // Max name lengths |
2939 | pub const MAX_CLASS_NAME: usize = 1024; |
2940 | pub const MAX_PACKAGE_NAME: usize = 1024; |
2941 | |
2942 | // CLR 2.0 header structure. |
2943 | #[derive (Debug, Clone, Copy)] |
2944 | #[repr (C)] |
2945 | pub struct ImageCor20Header { |
2946 | // Header versioning |
2947 | pub cb: U32<LE>, |
2948 | pub major_runtime_version: U16<LE>, |
2949 | pub minor_runtime_version: U16<LE>, |
2950 | |
2951 | // Symbol table and startup information |
2952 | pub meta_data: ImageDataDirectory, |
2953 | pub flags: U32<LE>, |
2954 | |
2955 | // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is not set, EntryPointToken represents a managed entrypoint. |
2956 | // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is set, EntryPointRVA represents an RVA to a native entrypoint. |
2957 | pub entry_point_token_or_rva: U32<LE>, |
2958 | |
2959 | // Binding information |
2960 | pub resources: ImageDataDirectory, |
2961 | pub strong_name_signature: ImageDataDirectory, |
2962 | |
2963 | // Regular fixup and binding information |
2964 | pub code_manager_table: ImageDataDirectory, |
2965 | pub vtable_fixups: ImageDataDirectory, |
2966 | pub export_address_table_jumps: ImageDataDirectory, |
2967 | |
2968 | // Precompiled image info (internal use only - set to zero) |
2969 | pub managed_native_header: ImageDataDirectory, |
2970 | } |
2971 | |
2972 | unsafe_impl_pod!( |
2973 | ImageDosHeader, |
2974 | ImageOs2Header, |
2975 | ImageVxdHeader, |
2976 | ImageFileHeader, |
2977 | ImageDataDirectory, |
2978 | ImageOptionalHeader32, |
2979 | ImageRomOptionalHeader, |
2980 | ImageOptionalHeader64, |
2981 | ImageNtHeaders64, |
2982 | ImageNtHeaders32, |
2983 | ImageRomHeaders, |
2984 | Guid, |
2985 | AnonObjectHeader, |
2986 | AnonObjectHeaderV2, |
2987 | AnonObjectHeaderBigobj, |
2988 | ImageSectionHeader, |
2989 | ImageSymbol, |
2990 | ImageSymbolBytes, |
2991 | ImageSymbolEx, |
2992 | ImageSymbolExBytes, |
2993 | ImageAuxSymbolTokenDef, |
2994 | ImageAuxSymbolFunction, |
2995 | ImageAuxSymbolFunctionBeginEnd, |
2996 | ImageAuxSymbolWeak, |
2997 | ImageAuxSymbolSection, |
2998 | ImageAuxSymbolCrc, |
2999 | ImageRelocation, |
3000 | ImageLinenumber, |
3001 | ImageBaseRelocation, |
3002 | ImageArchiveMemberHeader, |
3003 | ImageExportDirectory, |
3004 | ImageImportByName, |
3005 | ImageThunkData64, |
3006 | ImageThunkData32, |
3007 | ImageTlsDirectory64, |
3008 | ImageTlsDirectory32, |
3009 | ImageImportDescriptor, |
3010 | ImageBoundImportDescriptor, |
3011 | ImageBoundForwarderRef, |
3012 | ImageDelayloadDescriptor, |
3013 | ImageResourceDirectory, |
3014 | ImageResourceDirectoryEntry, |
3015 | ImageResourceDirectoryString, |
3016 | ImageResourceDirStringU, |
3017 | ImageResourceDataEntry, |
3018 | ImageLoadConfigCodeIntegrity, |
3019 | ImageDynamicRelocationTable, |
3020 | ImageDynamicRelocation32, |
3021 | ImageDynamicRelocation64, |
3022 | ImageDynamicRelocation32V2, |
3023 | ImageDynamicRelocation64V2, |
3024 | ImagePrologueDynamicRelocationHeader, |
3025 | ImageEpilogueDynamicRelocationHeader, |
3026 | //ImageImportControlTransferDynamicRelocation, |
3027 | //ImageIndirControlTransferDynamicRelocation, |
3028 | //ImageSwitchtableBranchDynamicRelocation, |
3029 | ImageLoadConfigDirectory32, |
3030 | ImageLoadConfigDirectory64, |
3031 | ImageHotPatchInfo, |
3032 | ImageHotPatchBase, |
3033 | ImageHotPatchHashes, |
3034 | //ImageCeRuntimeFunctionEntry, |
3035 | ImageArmRuntimeFunctionEntry, |
3036 | ImageArm64RuntimeFunctionEntry, |
3037 | ImageAlpha64RuntimeFunctionEntry, |
3038 | ImageAlphaRuntimeFunctionEntry, |
3039 | ImageRuntimeFunctionEntry, |
3040 | ImageEnclaveConfig32, |
3041 | ImageEnclaveConfig64, |
3042 | ImageEnclaveImport, |
3043 | ImageDebugDirectory, |
3044 | ImageCoffSymbolsHeader, |
3045 | //FpoData, |
3046 | ImageDebugMisc, |
3047 | ImageFunctionEntry, |
3048 | ImageFunctionEntry64, |
3049 | ImageSeparateDebugHeader, |
3050 | NonPagedDebugInfo, |
3051 | //ImageArchitectureHeader, |
3052 | ImageArchitectureEntry, |
3053 | ImportObjectHeader, |
3054 | ImageCor20Header, |
3055 | MaskedRichHeaderEntry, |
3056 | ); |
3057 | |