-
Notifications
You must be signed in to change notification settings - Fork 115
/
pe_local.h
153 lines (139 loc) · 5.6 KB
/
pe_local.h
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
#ifndef __PE_LOCAL
#define __PE_LOCAL
#include <stdint.h>
#define DOS_MAGIC 0x5a4d //'MZ'
#define PE_MAGIC 0x4550 //'PE'
struct IMAGE_DOS_HEADER_ { // DOS .EXE header
uint16_t e_magic; // Magic number
uint16_t e_cblp; // Bytes on last page of file
uint16_t e_cp; // Pages in file
uint16_t e_crlc; // Relocations
uint16_t e_cparhdr; // Size of header in paragraphs
uint16_t e_minalloc; // Minimum extra paragraphs needed
uint16_t e_maxalloc; // Maximum extra paragraphs needed
uint16_t e_ss; // Initial (relative) SS value
uint16_t e_sp; // Initial SP value
uint16_t e_csum; // Checksum
uint16_t e_ip; // Initial IP value
uint16_t e_cs; // Initial (relative) CS value
uint16_t e_lfarlc; // File address of relocation table
uint16_t e_ovno; // Overlay number
uint16_t e_res[4]; // Reserved uint16_ts
uint16_t e_oemid; // OEM identifier (for e_oeminfo)
uint16_t e_oeminfo; // OEM information; e_oemid specific
uint16_t e_res2[10]; // Reserved uint16_ts
uint32_t e_lfanew; // 0x3C File address of new exe header
};
struct IMAGE_FILE_HEADER_ {
uint16_t Machine; //0
uint16_t NumberOfSections; //2
uint32_t TimeDateStamp; //4
uint32_t PointerToSymbolTable; //8
uint32_t NumberOfSymbols; //12
uint16_t SizeOfOptionalHeader; //16
uint16_t Characteristics; //18
}; //size 20
struct IMAGE_DATA_DIRECTORY_ {
uint32_t VirtualAddress;
uint32_t Size;
};
struct IMAGE_OPTIONAL_HEADER32_ {
//
// Standard fields.
//
uint16_t Magic; //0
uint8_t MajorLinkerVersion; //2
uint8_t MinorLinkerVersion; //3
uint32_t SizeOfCode; //4
uint32_t SizeOfInitializedData; //8
uint32_t SizeOfUninitializedData; //12
uint32_t AddressOfEntryPoint; //16
uint32_t BaseOfCode; //20
uint32_t BaseOfData; //24
//
// NT additional fields.
//
uint32_t ImageBase; //28
uint32_t SectionAlignment; //32
uint32_t FileAlignment; //36
uint16_t MajorOperatingSystemVersion; //40
uint16_t MinorOperatingSystemVersion; //42
uint16_t MajorImageVersion; //44
uint16_t MinorImageVersion; //46
uint16_t MajorSubsystemVersion; //48
uint16_t MinorSubsystemVersion; //50
uint32_t Win32VersionValue; //52
uint32_t SizeOfImage; //56
uint32_t SizeOfHeaders; //60
uint32_t CheckSum; //64
uint16_t Subsystem; //68
uint16_t DllCharacteristics; //70
uint32_t SizeOfStackReserve; //72
uint32_t SizeOfStackCommit; //76
uint32_t SizeOfHeapReserve; //80
uint32_t SizeOfHeapCommit; //84
uint32_t LoaderFlags; //88
uint32_t NumberOfRvaAndSizes; //92
IMAGE_DATA_DIRECTORY_ DataDirectory[16]; //96
}; //size 224
struct IMAGE_OPTIONAL_HEADER64_ {
//
// Standard fields.
//
uint16_t Magic; //0
uint8_t MajorLinkerVersion; //2
uint8_t MinorLinkerVersion; //3
uint32_t SizeOfCode; //4
uint32_t SizeOfInitializedData; //8
uint32_t SizeOfUninitializedData; //12
uint32_t AddressOfEntryPoint; //16
uint32_t BaseOfCode; //20
//
// NT additional fields.
//
uint64_t ImageBase; //24
uint32_t SectionAlignment; //32
uint32_t FileAlignment; //36
uint16_t MajorOperatingSystemVersion; //40
uint16_t MinorOperatingSystemVersion; //42
uint16_t MajorImageVersion; //44
uint16_t MinorImageVersion; //46
uint16_t MajorSubsystemVersion; //48
uint16_t MinorSubsystemVersion; //50
uint32_t Win32VersionValue; //52
uint32_t SizeOfImage; //56
uint32_t SizeOfHeaders; //60
uint32_t CheckSum; //64
uint16_t Subsystem; //68
uint16_t DllCharacteristics; //70
uint64_t SizeOfStackReserve; //72
uint64_t SizeOfStackCommit; //80
uint64_t SizeOfHeapReserve; //88
uint64_t SizeOfHeapCommit; //96
uint32_t LoaderFlags; //104
uint32_t NumberOfRvaAndSizes; //108
IMAGE_DATA_DIRECTORY_ DataDirectory[16]; //112
}; //size 240
struct IMAGE_NT_HEADERS32_ {
uint32_t Signature;
IMAGE_FILE_HEADER_ FileHeader;
IMAGE_OPTIONAL_HEADER32_ OptionalHeader;
};
struct IMAGE_NT_HEADERS64_ {
uint32_t Signature;
IMAGE_FILE_HEADER_ FileHeader;
IMAGE_OPTIONAL_HEADER64_ OptionalHeader;
};
struct IMAGE_SECTION_HEADER_ {
uint8_t Name[8]; //0
uint32_t VirtualSize; //8
uint32_t VirtualAddress; //12
uint32_t SizeOfRawData; //16
uint32_t PointerToRawData; //20
uint32_t PointerToRelocations; //24
uint32_t PointerToLinenumbers; //28
uint16_t NumberOfRelocations; //32
uint16_t NumberOfLinenumbers; //34
uint32_t Characteristics; //36
}; //size 40
#endif