Home | History | Annotate | Line # | Download | only in x86_64
      1  1.1  jakllsch /*	$NetBSD: pe.h,v 1.1.1.1 2014/04/01 16:16:07 jakllsch Exp $	*/
      2  1.1  jakllsch 
      3  1.1  jakllsch /*
      4  1.1  jakllsch     PE32+ header file
      5  1.1  jakllsch  */
      6  1.1  jakllsch #ifndef _PE_H
      7  1.1  jakllsch #define _PE_H
      8  1.1  jakllsch 
      9  1.1  jakllsch #define IMAGE_DOS_SIGNATURE                 0x5A4D      // MZ
     10  1.1  jakllsch #define IMAGE_OS2_SIGNATURE                 0x454E      // NE
     11  1.1  jakllsch #define IMAGE_OS2_SIGNATURE_LE              0x454C      // LE
     12  1.1  jakllsch #define IMAGE_NT_SIGNATURE                  0x00004550  // PE00
     13  1.1  jakllsch #define IMAGE_EDOS_SIGNATURE                0x44454550  // PEED
     14  1.1  jakllsch 
     15  1.1  jakllsch 
     16  1.1  jakllsch typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
     17  1.1  jakllsch     UINT16   e_magic;                     // Magic number
     18  1.1  jakllsch     UINT16   e_cblp;                      // Bytes on last page of file
     19  1.1  jakllsch     UINT16   e_cp;                        // Pages in file
     20  1.1  jakllsch     UINT16   e_crlc;                      // Relocations
     21  1.1  jakllsch     UINT16   e_cparhdr;                   // Size of header in paragraphs
     22  1.1  jakllsch     UINT16   e_minalloc;                  // Minimum extra paragraphs needed
     23  1.1  jakllsch     UINT16   e_maxalloc;                  // Maximum extra paragraphs needed
     24  1.1  jakllsch     UINT16   e_ss;                        // Initial (relative) SS value
     25  1.1  jakllsch     UINT16   e_sp;                        // Initial SP value
     26  1.1  jakllsch     UINT16   e_csum;                      // Checksum
     27  1.1  jakllsch     UINT16   e_ip;                        // Initial IP value
     28  1.1  jakllsch     UINT16   e_cs;                        // Initial (relative) CS value
     29  1.1  jakllsch     UINT16   e_lfarlc;                    // File address of relocation table
     30  1.1  jakllsch     UINT16   e_ovno;                      // Overlay number
     31  1.1  jakllsch     UINT16   e_res[4];                    // Reserved words
     32  1.1  jakllsch     UINT16   e_oemid;                     // OEM identifier (for e_oeminfo)
     33  1.1  jakllsch     UINT16   e_oeminfo;                   // OEM information; e_oemid specific
     34  1.1  jakllsch     UINT16   e_res2[10];                  // Reserved words
     35  1.1  jakllsch     UINT32   e_lfanew;                    // File address of new exe header
     36  1.1  jakllsch   } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
     37  1.1  jakllsch 
     38  1.1  jakllsch typedef struct _IMAGE_OS2_HEADER {      // OS/2 .EXE header
     39  1.1  jakllsch     UINT16   ne_magic;                    // Magic number
     40  1.1  jakllsch     UINT8    ne_ver;                      // Version number
     41  1.1  jakllsch     UINT8    ne_rev;                      // Revision number
     42  1.1  jakllsch     UINT16   ne_enttab;                   // Offset of Entry Table
     43  1.1  jakllsch     UINT16   ne_cbenttab;                 // Number of bytes in Entry Table
     44  1.1  jakllsch     UINT32   ne_crc;                      // Checksum of whole file
     45  1.1  jakllsch     UINT16   ne_flags;                    // Flag UINT16
     46  1.1  jakllsch     UINT16   ne_autodata;                 // Automatic data segment number
     47  1.1  jakllsch     UINT16   ne_heap;                     // Initial heap allocation
     48  1.1  jakllsch     UINT16   ne_stack;                    // Initial stack allocation
     49  1.1  jakllsch     UINT32   ne_csip;                     // Initial CS:IP setting
     50  1.1  jakllsch     UINT32   ne_sssp;                     // Initial SS:SP setting
     51  1.1  jakllsch     UINT16   ne_cseg;                     // Count of file segments
     52  1.1  jakllsch     UINT16   ne_cmod;                     // Entries in Module Reference Table
     53  1.1  jakllsch     UINT16   ne_cbnrestab;                // Size of non-resident name table
     54  1.1  jakllsch     UINT16   ne_segtab;                   // Offset of Segment Table
     55  1.1  jakllsch     UINT16   ne_rsrctab;                  // Offset of Resource Table
     56  1.1  jakllsch     UINT16   ne_restab;                   // Offset of resident name table
     57  1.1  jakllsch     UINT16   ne_modtab;                   // Offset of Module Reference Table
     58  1.1  jakllsch     UINT16   ne_imptab;                   // Offset of Imported Names Table
     59  1.1  jakllsch     UINT32   ne_nrestab;                  // Offset of Non-resident Names Table
     60  1.1  jakllsch     UINT16   ne_cmovent;                  // Count of movable entries
     61  1.1  jakllsch     UINT16   ne_align;                    // Segment alignment shift count
     62  1.1  jakllsch     UINT16   ne_cres;                     // Count of resource segments
     63  1.1  jakllsch     UINT8    ne_exetyp;                   // Target Operating system
     64  1.1  jakllsch     UINT8    ne_flagsothers;              // Other .EXE flags
     65  1.1  jakllsch     UINT16   ne_pretthunks;               // offset to return thunks
     66  1.1  jakllsch     UINT16   ne_psegrefbytes;             // offset to segment ref. bytes
     67  1.1  jakllsch     UINT16   ne_swaparea;                 // Minimum code swap area size
     68  1.1  jakllsch     UINT16   ne_expver;                   // Expected Windows version number
     69  1.1  jakllsch   } IMAGE_OS2_HEADER, *PIMAGE_OS2_HEADER;
     70  1.1  jakllsch 
     71  1.1  jakllsch //
     72  1.1  jakllsch // File header format.
     73  1.1  jakllsch //
     74  1.1  jakllsch 
     75  1.1  jakllsch typedef struct _IMAGE_FILE_HEADER {
     76  1.1  jakllsch     UINT16   Machine;
     77  1.1  jakllsch     UINT16   NumberOfSections;
     78  1.1  jakllsch     UINT32   TimeDateStamp;
     79  1.1  jakllsch     UINT32   PointerToSymbolTable;
     80  1.1  jakllsch     UINT32   NumberOfSymbols;
     81  1.1  jakllsch     UINT16   SizeOfOptionalHeader;
     82  1.1  jakllsch     UINT16   Characteristics;
     83  1.1  jakllsch } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
     84  1.1  jakllsch 
     85  1.1  jakllsch #define IMAGE_SIZEOF_FILE_HEADER             20
     86  1.1  jakllsch 
     87  1.1  jakllsch #define IMAGE_FILE_RELOCS_STRIPPED           0x0001  // Relocation info stripped from file.
     88  1.1  jakllsch #define IMAGE_FILE_EXECUTABLE_IMAGE          0x0002  // File is executable  (i.e. no unresolved externel references).
     89  1.1  jakllsch #define IMAGE_FILE_LINE_NUMS_STRIPPED        0x0004  // Line nunbers stripped from file.
     90  1.1  jakllsch #define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008  // Local symbols stripped from file.
     91  1.1  jakllsch #define IMAGE_FILE_BYTES_REVERSED_LO         0x0080  // Bytes of machine word are reversed.
     92  1.1  jakllsch #define IMAGE_FILE_32BIT_MACHINE             0x0100  // 32 bit word machine.
     93  1.1  jakllsch #define IMAGE_FILE_DEBUG_STRIPPED            0x0200  // Debugging info stripped from file in .DBG file
     94  1.1  jakllsch #define IMAGE_FILE_SYSTEM                    0x1000  // System File.
     95  1.1  jakllsch #define IMAGE_FILE_DLL                       0x2000  // File is a DLL.
     96  1.1  jakllsch #define IMAGE_FILE_BYTES_REVERSED_HI         0x8000  // Bytes of machine word are reversed.
     97  1.1  jakllsch 
     98  1.1  jakllsch #define IMAGE_FILE_MACHINE_UNKNOWN           0
     99  1.1  jakllsch #define IMAGE_FILE_MACHINE_I386              0x14c   // Intel 386.
    100  1.1  jakllsch #define IMAGE_FILE_MACHINE_R3000             0x162   // MIPS little-endian, 0540 big-endian
    101  1.1  jakllsch #define IMAGE_FILE_MACHINE_R4000             0x166   // MIPS little-endian
    102  1.1  jakllsch #define IMAGE_FILE_MACHINE_ALPHA             0x184   // Alpha_AXP
    103  1.1  jakllsch #define IMAGE_FILE_MACHINE_ARMTHUMB_MIXED    0x1c2   // Arm/Thumb
    104  1.1  jakllsch #define IMAGE_FILE_MACHINE_POWERPC           0x1F0   // IBM PowerPC Little-Endian
    105  1.1  jakllsch #define IMAGE_FILE_MACHINE_IA64              0x200   // IA-64
    106  1.1  jakllsch #define IMAGE_FILE_MACHINE_TAHOE             0x7cc   // Intel EM machine
    107  1.1  jakllsch #define IMAGE_FILE_MACHINE_EBC               0xebc   // EFI Byte Code
    108  1.1  jakllsch #define IMAGE_FILE_MACHINE_X64               0x8664  // x86_64
    109  1.1  jakllsch //
    110  1.1  jakllsch // Directory format.
    111  1.1  jakllsch //
    112  1.1  jakllsch 
    113  1.1  jakllsch typedef struct _IMAGE_DATA_DIRECTORY {
    114  1.1  jakllsch     UINT32   VirtualAddress;
    115  1.1  jakllsch     UINT32   Size;
    116  1.1  jakllsch } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
    117  1.1  jakllsch 
    118  1.1  jakllsch #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES    16
    119  1.1  jakllsch 
    120  1.1  jakllsch //
    121  1.1  jakllsch // Optional header format.
    122  1.1  jakllsch //
    123  1.1  jakllsch 
    124  1.1  jakllsch typedef struct _IMAGE_OPTIONAL_HEADER {
    125  1.1  jakllsch     //
    126  1.1  jakllsch     // Standard fields.
    127  1.1  jakllsch     //
    128  1.1  jakllsch 
    129  1.1  jakllsch     UINT16    Magic;
    130  1.1  jakllsch     UINT8     MajorLinkerVersion;
    131  1.1  jakllsch     UINT8     MinorLinkerVersion;
    132  1.1  jakllsch     UINT32    SizeOfCode;
    133  1.1  jakllsch     UINT32    SizeOfInitializedData;
    134  1.1  jakllsch     UINT32    SizeOfUninitializedData;
    135  1.1  jakllsch     UINT32    AddressOfEntryPoint;
    136  1.1  jakllsch     UINT32    BaseOfCode;
    137  1.1  jakllsch     UINT32    BaseOfData;
    138  1.1  jakllsch 
    139  1.1  jakllsch     //
    140  1.1  jakllsch     // NT additional fields.
    141  1.1  jakllsch     //
    142  1.1  jakllsch 
    143  1.1  jakllsch     UINT32   ImageBase;
    144  1.1  jakllsch     UINT32   SectionAlignment;
    145  1.1  jakllsch     UINT32   FileAlignment;
    146  1.1  jakllsch     UINT16   MajorOperatingSystemVersion;
    147  1.1  jakllsch     UINT16   MinorOperatingSystemVersion;
    148  1.1  jakllsch     UINT16   MajorImageVersion;
    149  1.1  jakllsch     UINT16   MinorImageVersion;
    150  1.1  jakllsch     UINT16   MajorSubsystemVersion;
    151  1.1  jakllsch     UINT16   MinorSubsystemVersion;
    152  1.1  jakllsch     UINT32   Reserved1;
    153  1.1  jakllsch     UINT32   SizeOfImage;
    154  1.1  jakllsch     UINT32   SizeOfHeaders;
    155  1.1  jakllsch     UINT32   CheckSum;
    156  1.1  jakllsch     UINT16   Subsystem;
    157  1.1  jakllsch     UINT16   DllCharacteristics;
    158  1.1  jakllsch     UINT32   SizeOfStackReserve;
    159  1.1  jakllsch     UINT32   SizeOfStackCommit;
    160  1.1  jakllsch     UINT32   SizeOfHeapReserve;
    161  1.1  jakllsch     UINT32   SizeOfHeapCommit;
    162  1.1  jakllsch     UINT32   LoaderFlags;
    163  1.1  jakllsch     UINT32   NumberOfRvaAndSizes;
    164  1.1  jakllsch     IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
    165  1.1  jakllsch } IMAGE_OPTIONAL_HEADER, *PIMAGE_OPTIONAL_HEADER;
    166  1.1  jakllsch 
    167  1.1  jakllsch typedef struct _IMAGE_ROM_OPTIONAL_HEADER {
    168  1.1  jakllsch     UINT16  Magic;
    169  1.1  jakllsch     UINT8   MajorLinkerVersion;
    170  1.1  jakllsch     UINT8   MinorLinkerVersion;
    171  1.1  jakllsch     UINT32  SizeOfCode;
    172  1.1  jakllsch     UINT32  SizeOfInitializedData;
    173  1.1  jakllsch     UINT32  SizeOfUninitializedData;
    174  1.1  jakllsch     UINT32  AddressOfEntryPoint;
    175  1.1  jakllsch     UINT32  BaseOfCode;
    176  1.1  jakllsch     UINT32  BaseOfData;
    177  1.1  jakllsch     UINT32  BaseOfBss;
    178  1.1  jakllsch     UINT32  GprMask;
    179  1.1  jakllsch     UINT32  CprMask[4];
    180  1.1  jakllsch     UINT32  GpValue;
    181  1.1  jakllsch } IMAGE_ROM_OPTIONAL_HEADER, *PIMAGE_ROM_OPTIONAL_HEADER;
    182  1.1  jakllsch 
    183  1.1  jakllsch #define IMAGE_SIZEOF_ROM_OPTIONAL_HEADER      56
    184  1.1  jakllsch #define IMAGE_SIZEOF_STD_OPTIONAL_HEADER      28
    185  1.1  jakllsch #define IMAGE_SIZEOF_NT_OPTIONAL_HEADER      224
    186  1.1  jakllsch 
    187  1.1  jakllsch #define IMAGE_NT_OPTIONAL_HDR_MAGIC        0x10b
    188  1.1  jakllsch #define IMAGE_ROM_OPTIONAL_HDR_MAGIC       0x107
    189  1.1  jakllsch 
    190  1.1  jakllsch typedef struct _IMAGE_NT_HEADERS {
    191  1.1  jakllsch     UINT32 Signature;
    192  1.1  jakllsch     IMAGE_FILE_HEADER FileHeader;
    193  1.1  jakllsch     IMAGE_OPTIONAL_HEADER OptionalHeader;
    194  1.1  jakllsch } IMAGE_NT_HEADERS, *PIMAGE_NT_HEADERS;
    195  1.1  jakllsch 
    196  1.1  jakllsch typedef struct _IMAGE_ROM_HEADERS {
    197  1.1  jakllsch     IMAGE_FILE_HEADER FileHeader;
    198  1.1  jakllsch     IMAGE_ROM_OPTIONAL_HEADER OptionalHeader;
    199  1.1  jakllsch } IMAGE_ROM_HEADERS, *PIMAGE_ROM_HEADERS;
    200  1.1  jakllsch 
    201  1.1  jakllsch #define IMAGE_FIRST_SECTION( ntheader ) ((PIMAGE_SECTION_HEADER)        \
    202  1.1  jakllsch     ((UINT32)ntheader +                                                  \
    203  1.1  jakllsch      FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) +                 \
    204  1.1  jakllsch      ((PIMAGE_NT_HEADERS)(ntheader))->FileHeader.SizeOfOptionalHeader   \
    205  1.1  jakllsch     ))
    206  1.1  jakllsch 
    207  1.1  jakllsch 
    208  1.1  jakllsch // Subsystem Values
    209  1.1  jakllsch 
    210  1.1  jakllsch #define IMAGE_SUBSYSTEM_UNKNOWN              0   // Unknown subsystem.
    211  1.1  jakllsch #define IMAGE_SUBSYSTEM_NATIVE               1   // Image doesn't require a subsystem.
    212  1.1  jakllsch #define IMAGE_SUBSYSTEM_WINDOWS_GUI          2   // Image runs in the Windows GUI subsystem.
    213  1.1  jakllsch #define IMAGE_SUBSYSTEM_WINDOWS_CUI          3   // Image runs in the Windows character subsystem.
    214  1.1  jakllsch #define IMAGE_SUBSYSTEM_OS2_CUI              5   // image runs in the OS/2 character subsystem.
    215  1.1  jakllsch #define IMAGE_SUBSYSTEM_POSIX_CUI            7   // image run  in the Posix character subsystem.
    216  1.1  jakllsch 
    217  1.1  jakllsch 
    218  1.1  jakllsch // Directory Entries
    219  1.1  jakllsch 
    220  1.1  jakllsch #define IMAGE_DIRECTORY_ENTRY_EXPORT         0   // Export Directory
    221  1.1  jakllsch #define IMAGE_DIRECTORY_ENTRY_IMPORT         1   // Import Directory
    222  1.1  jakllsch #define IMAGE_DIRECTORY_ENTRY_RESOURCE       2   // Resource Directory
    223  1.1  jakllsch #define IMAGE_DIRECTORY_ENTRY_EXCEPTION      3   // Exception Directory
    224  1.1  jakllsch #define IMAGE_DIRECTORY_ENTRY_SECURITY       4   // Security Directory
    225  1.1  jakllsch #define IMAGE_DIRECTORY_ENTRY_BASERELOC      5   // Base Relocation Table
    226  1.1  jakllsch #define IMAGE_DIRECTORY_ENTRY_DEBUG          6   // Debug Directory
    227  1.1  jakllsch #define IMAGE_DIRECTORY_ENTRY_COPYRIGHT      7   // Description String
    228  1.1  jakllsch #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR      8   // Machine Value (MIPS GP)
    229  1.1  jakllsch #define IMAGE_DIRECTORY_ENTRY_TLS            9   // TLS Directory
    230  1.1  jakllsch #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG   10   // Load Configuration Directory
    231  1.1  jakllsch 
    232  1.1  jakllsch //
    233  1.1  jakllsch // Section header format.
    234  1.1  jakllsch //
    235  1.1  jakllsch 
    236  1.1  jakllsch #define IMAGE_SIZEOF_SHORT_NAME              8
    237  1.1  jakllsch 
    238  1.1  jakllsch typedef struct _IMAGE_SECTION_HEADER {
    239  1.1  jakllsch     UINT8   Name[IMAGE_SIZEOF_SHORT_NAME];
    240  1.1  jakllsch     union {
    241  1.1  jakllsch             UINT32   PhysicalAddress;
    242  1.1  jakllsch             UINT32   VirtualSize;
    243  1.1  jakllsch     } Misc;
    244  1.1  jakllsch     UINT32   VirtualAddress;
    245  1.1  jakllsch     UINT32   SizeOfRawData;
    246  1.1  jakllsch     UINT32   PointerToRawData;
    247  1.1  jakllsch     UINT32   PointerToRelocations;
    248  1.1  jakllsch     UINT32   PointerToLinenumbers;
    249  1.1  jakllsch     UINT16   NumberOfRelocations;
    250  1.1  jakllsch     UINT16   NumberOfLinenumbers;
    251  1.1  jakllsch     UINT32   Characteristics;
    252  1.1  jakllsch } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
    253  1.1  jakllsch 
    254  1.1  jakllsch #define IMAGE_SIZEOF_SECTION_HEADER          40
    255  1.1  jakllsch 
    256  1.1  jakllsch #define IMAGE_SCN_TYPE_NO_PAD                0x00000008  // Reserved.
    257  1.1  jakllsch 
    258  1.1  jakllsch #define IMAGE_SCN_CNT_CODE                   0x00000020  // Section contains code.
    259  1.1  jakllsch #define IMAGE_SCN_CNT_INITIALIZED_DATA       0x00000040  // Section contains initialized data.
    260  1.1  jakllsch #define IMAGE_SCN_CNT_UNINITIALIZED_DATA     0x00000080  // Section contains uninitialized data.
    261  1.1  jakllsch 
    262  1.1  jakllsch #define IMAGE_SCN_LNK_OTHER                  0x00000100  // Reserved.
    263  1.1  jakllsch #define IMAGE_SCN_LNK_INFO                   0x00000200  // Section contains comments or some other type of information.
    264  1.1  jakllsch #define IMAGE_SCN_LNK_REMOVE                 0x00000800  // Section contents will not become part of image.
    265  1.1  jakllsch #define IMAGE_SCN_LNK_COMDAT                 0x00001000  // Section contents comdat.
    266  1.1  jakllsch 
    267  1.1  jakllsch #define IMAGE_SCN_ALIGN_1BYTES               0x00100000  //
    268  1.1  jakllsch #define IMAGE_SCN_ALIGN_2BYTES               0x00200000  //
    269  1.1  jakllsch #define IMAGE_SCN_ALIGN_4BYTES               0x00300000  //
    270  1.1  jakllsch #define IMAGE_SCN_ALIGN_8BYTES               0x00400000  //
    271  1.1  jakllsch #define IMAGE_SCN_ALIGN_16BYTES              0x00500000  // Default alignment if no others are specified.
    272  1.1  jakllsch #define IMAGE_SCN_ALIGN_32BYTES              0x00600000  //
    273  1.1  jakllsch #define IMAGE_SCN_ALIGN_64BYTES              0x00700000  //
    274  1.1  jakllsch 
    275  1.1  jakllsch #define IMAGE_SCN_MEM_DISCARDABLE            0x02000000  // Section can be discarded.
    276  1.1  jakllsch #define IMAGE_SCN_MEM_NOT_CACHED             0x04000000  // Section is not cachable.
    277  1.1  jakllsch #define IMAGE_SCN_MEM_NOT_PAGED              0x08000000  // Section is not pageable.
    278  1.1  jakllsch #define IMAGE_SCN_MEM_SHARED                 0x10000000  // Section is shareable.
    279  1.1  jakllsch #define IMAGE_SCN_MEM_EXECUTE                0x20000000  // Section is executable.
    280  1.1  jakllsch #define IMAGE_SCN_MEM_READ                   0x40000000  // Section is readable.
    281  1.1  jakllsch #define IMAGE_SCN_MEM_WRITE                  0x80000000  // Section is writeable.
    282  1.1  jakllsch 
    283  1.1  jakllsch //
    284  1.1  jakllsch // Symbol format.
    285  1.1  jakllsch //
    286  1.1  jakllsch 
    287  1.1  jakllsch 
    288  1.1  jakllsch #define IMAGE_SIZEOF_SYMBOL                  18
    289  1.1  jakllsch 
    290  1.1  jakllsch //
    291  1.1  jakllsch // Section values.
    292  1.1  jakllsch //
    293  1.1  jakllsch // Symbols have a section number of the section in which they are
    294  1.1  jakllsch // defined. Otherwise, section numbers have the following meanings:
    295  1.1  jakllsch //
    296  1.1  jakllsch 
    297  1.1  jakllsch #define IMAGE_SYM_UNDEFINED           (UINT16)0           // Symbol is undefined or is common.
    298  1.1  jakllsch #define IMAGE_SYM_ABSOLUTE            (UINT16)-1          // Symbol is an absolute value.
    299  1.1  jakllsch #define IMAGE_SYM_DEBUG               (UINT16)-2          // Symbol is a special debug item.
    300  1.1  jakllsch 
    301  1.1  jakllsch //
    302  1.1  jakllsch // Type (fundamental) values.
    303  1.1  jakllsch //
    304  1.1  jakllsch 
    305  1.1  jakllsch #define IMAGE_SYM_TYPE_NULL                  0           // no type.
    306  1.1  jakllsch #define IMAGE_SYM_TYPE_VOID                  1           //
    307  1.1  jakllsch #define IMAGE_SYM_TYPE_CHAR                  2           // type character.
    308  1.1  jakllsch #define IMAGE_SYM_TYPE_SHORT                 3           // type short integer.
    309  1.1  jakllsch #define IMAGE_SYM_TYPE_INT                   4           //
    310  1.1  jakllsch #define IMAGE_SYM_TYPE_LONG                  5           //
    311  1.1  jakllsch #define IMAGE_SYM_TYPE_FLOAT                 6           //
    312  1.1  jakllsch #define IMAGE_SYM_TYPE_DOUBLE                7           //
    313  1.1  jakllsch #define IMAGE_SYM_TYPE_STRUCT                8           //
    314  1.1  jakllsch #define IMAGE_SYM_TYPE_UNION                 9           //
    315  1.1  jakllsch #define IMAGE_SYM_TYPE_ENUM                  10          // enumeration.
    316  1.1  jakllsch #define IMAGE_SYM_TYPE_MOE                   11          // member of enumeration.
    317  1.1  jakllsch #define IMAGE_SYM_TYPE_BYTE                  12          //
    318  1.1  jakllsch #define IMAGE_SYM_TYPE_WORD                  13          //
    319  1.1  jakllsch #define IMAGE_SYM_TYPE_UINT                  14          //
    320  1.1  jakllsch #define IMAGE_SYM_TYPE_DWORD                 15          //
    321  1.1  jakllsch 
    322  1.1  jakllsch //
    323  1.1  jakllsch // Type (derived) values.
    324  1.1  jakllsch //
    325  1.1  jakllsch 
    326  1.1  jakllsch #define IMAGE_SYM_DTYPE_NULL                 0           // no derived type.
    327  1.1  jakllsch #define IMAGE_SYM_DTYPE_POINTER              1           // pointer.
    328  1.1  jakllsch #define IMAGE_SYM_DTYPE_FUNCTION             2           // function.
    329  1.1  jakllsch #define IMAGE_SYM_DTYPE_ARRAY                3           // array.
    330  1.1  jakllsch 
    331  1.1  jakllsch //
    332  1.1  jakllsch // Storage classes.
    333  1.1  jakllsch //
    334  1.1  jakllsch 
    335  1.1  jakllsch #define IMAGE_SYM_CLASS_END_OF_FUNCTION      (BYTE )-1
    336  1.1  jakllsch #define IMAGE_SYM_CLASS_NULL                 0
    337  1.1  jakllsch #define IMAGE_SYM_CLASS_AUTOMATIC            1
    338  1.1  jakllsch #define IMAGE_SYM_CLASS_EXTERNAL             2
    339  1.1  jakllsch #define IMAGE_SYM_CLASS_STATIC               3
    340  1.1  jakllsch #define IMAGE_SYM_CLASS_REGISTER             4
    341  1.1  jakllsch #define IMAGE_SYM_CLASS_EXTERNAL_DEF         5
    342  1.1  jakllsch #define IMAGE_SYM_CLASS_LABEL                6
    343  1.1  jakllsch #define IMAGE_SYM_CLASS_UNDEFINED_LABEL      7
    344  1.1  jakllsch #define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT     8
    345  1.1  jakllsch #define IMAGE_SYM_CLASS_ARGUMENT             9
    346  1.1  jakllsch #define IMAGE_SYM_CLASS_STRUCT_TAG           10
    347  1.1  jakllsch #define IMAGE_SYM_CLASS_MEMBER_OF_UNION      11
    348  1.1  jakllsch #define IMAGE_SYM_CLASS_UNION_TAG            12
    349  1.1  jakllsch #define IMAGE_SYM_CLASS_TYPE_DEFINITION      13
    350  1.1  jakllsch #define IMAGE_SYM_CLASS_UNDEFINED_STATIC     14
    351  1.1  jakllsch #define IMAGE_SYM_CLASS_ENUM_TAG             15
    352  1.1  jakllsch #define IMAGE_SYM_CLASS_MEMBER_OF_ENUM       16
    353  1.1  jakllsch #define IMAGE_SYM_CLASS_REGISTER_PARAM       17
    354  1.1  jakllsch #define IMAGE_SYM_CLASS_BIT_FIELD            18
    355  1.1  jakllsch #define IMAGE_SYM_CLASS_BLOCK                100
    356  1.1  jakllsch #define IMAGE_SYM_CLASS_FUNCTION             101
    357  1.1  jakllsch #define IMAGE_SYM_CLASS_END_OF_STRUCT        102
    358  1.1  jakllsch #define IMAGE_SYM_CLASS_FILE                 103
    359  1.1  jakllsch // new
    360  1.1  jakllsch #define IMAGE_SYM_CLASS_SECTION              104
    361  1.1  jakllsch #define IMAGE_SYM_CLASS_WEAK_EXTERNAL        105
    362  1.1  jakllsch 
    363  1.1  jakllsch // type packing constants
    364  1.1  jakllsch 
    365  1.1  jakllsch #define N_BTMASK                            017
    366  1.1  jakllsch #define N_TMASK                             060
    367  1.1  jakllsch #define N_TMASK1                            0300
    368  1.1  jakllsch #define N_TMASK2                            0360
    369  1.1  jakllsch #define N_BTSHFT                            4
    370  1.1  jakllsch #define N_TSHIFT                            2
    371  1.1  jakllsch 
    372  1.1  jakllsch // MACROS
    373  1.1  jakllsch 
    374  1.1  jakllsch //
    375  1.1  jakllsch // Communal selection types.
    376  1.1  jakllsch //
    377  1.1  jakllsch 
    378  1.1  jakllsch #define IMAGE_COMDAT_SELECT_NODUPLICATES   1
    379  1.1  jakllsch #define IMAGE_COMDAT_SELECT_ANY            2
    380  1.1  jakllsch #define IMAGE_COMDAT_SELECT_SAME_SIZE      3
    381  1.1  jakllsch #define IMAGE_COMDAT_SELECT_EXACT_MATCH    4
    382  1.1  jakllsch #define IMAGE_COMDAT_SELECT_ASSOCIATIVE    5
    383  1.1  jakllsch 
    384  1.1  jakllsch #define IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY 1
    385  1.1  jakllsch #define IMAGE_WEAK_EXTERN_SEARCH_LIBRARY   2
    386  1.1  jakllsch #define IMAGE_WEAK_EXTERN_SEARCH_ALIAS     3
    387  1.1  jakllsch 
    388  1.1  jakllsch 
    389  1.1  jakllsch //
    390  1.1  jakllsch // Relocation format.
    391  1.1  jakllsch //
    392  1.1  jakllsch 
    393  1.1  jakllsch typedef struct _IMAGE_RELOCATION {
    394  1.1  jakllsch     UINT32   VirtualAddress;
    395  1.1  jakllsch     UINT32   SymbolTableIndex;
    396  1.1  jakllsch     UINT16    Type;
    397  1.1  jakllsch } IMAGE_RELOCATION;
    398  1.1  jakllsch 
    399  1.1  jakllsch #define IMAGE_SIZEOF_RELOCATION              10
    400  1.1  jakllsch 
    401  1.1  jakllsch //
    402  1.1  jakllsch // I386 relocation types.
    403  1.1  jakllsch //
    404  1.1  jakllsch 
    405  1.1  jakllsch #define IMAGE_REL_I386_ABSOLUTE              0           // Reference is absolute, no relocation is necessary
    406  1.1  jakllsch #define IMAGE_REL_I386_DIR16                 01          // Direct 16-bit reference to the symbols virtual address
    407  1.1  jakllsch #define IMAGE_REL_I386_REL16                 02          // PC-relative 16-bit reference to the symbols virtual address
    408  1.1  jakllsch #define IMAGE_REL_I386_DIR32                 06          // Direct 32-bit reference to the symbols virtual address
    409  1.1  jakllsch #define IMAGE_REL_I386_DIR32NB               07          // Direct 32-bit reference to the symbols virtual address, base not included
    410  1.1  jakllsch #define IMAGE_REL_I386_SEG12                 011         // Direct 16-bit reference to the segment-selector bits of a 32-bit virtual address
    411  1.1  jakllsch #define IMAGE_REL_I386_SECTION               012
    412  1.1  jakllsch #define IMAGE_REL_I386_SECREL                013
    413  1.1  jakllsch #define IMAGE_REL_I386_REL32                 024         // PC-relative 32-bit reference to the symbols virtual address
    414  1.1  jakllsch 
    415  1.1  jakllsch //
    416  1.1  jakllsch // MIPS relocation types.
    417  1.1  jakllsch //
    418  1.1  jakllsch 
    419  1.1  jakllsch #define IMAGE_REL_MIPS_ABSOLUTE              0           // Reference is absolute, no relocation is necessary
    420  1.1  jakllsch #define IMAGE_REL_MIPS_REFHALF               01
    421  1.1  jakllsch #define IMAGE_REL_MIPS_REFWORD               02
    422  1.1  jakllsch #define IMAGE_REL_MIPS_JMPADDR               03
    423  1.1  jakllsch #define IMAGE_REL_MIPS_REFHI                 04
    424  1.1  jakllsch #define IMAGE_REL_MIPS_REFLO                 05
    425  1.1  jakllsch #define IMAGE_REL_MIPS_GPREL                 06
    426  1.1  jakllsch #define IMAGE_REL_MIPS_LITERAL               07
    427  1.1  jakllsch #define IMAGE_REL_MIPS_SECTION               012
    428  1.1  jakllsch #define IMAGE_REL_MIPS_SECREL                013
    429  1.1  jakllsch #define IMAGE_REL_MIPS_REFWORDNB             042
    430  1.1  jakllsch #define IMAGE_REL_MIPS_PAIR                  045
    431  1.1  jakllsch 
    432  1.1  jakllsch //
    433  1.1  jakllsch // Alpha Relocation types.
    434  1.1  jakllsch //
    435  1.1  jakllsch 
    436  1.1  jakllsch #define IMAGE_REL_ALPHA_ABSOLUTE             0x0
    437  1.1  jakllsch #define IMAGE_REL_ALPHA_REFLONG              0x1
    438  1.1  jakllsch #define IMAGE_REL_ALPHA_REFQUAD              0x2
    439  1.1  jakllsch #define IMAGE_REL_ALPHA_GPREL32              0x3
    440  1.1  jakllsch #define IMAGE_REL_ALPHA_LITERAL              0x4
    441  1.1  jakllsch #define IMAGE_REL_ALPHA_LITUSE               0x5
    442  1.1  jakllsch #define IMAGE_REL_ALPHA_GPDISP               0x6
    443  1.1  jakllsch #define IMAGE_REL_ALPHA_BRADDR               0x7
    444  1.1  jakllsch #define IMAGE_REL_ALPHA_HINT                 0x8
    445  1.1  jakllsch #define IMAGE_REL_ALPHA_INLINE_REFLONG       0x9
    446  1.1  jakllsch #define IMAGE_REL_ALPHA_REFHI                0xA
    447  1.1  jakllsch #define IMAGE_REL_ALPHA_REFLO                0xB
    448  1.1  jakllsch #define IMAGE_REL_ALPHA_PAIR                 0xC
    449  1.1  jakllsch #define IMAGE_REL_ALPHA_MATCH                0xD
    450  1.1  jakllsch #define IMAGE_REL_ALPHA_SECTION              0xE
    451  1.1  jakllsch #define IMAGE_REL_ALPHA_SECREL               0xF
    452  1.1  jakllsch #define IMAGE_REL_ALPHA_REFLONGNB            0x10
    453  1.1  jakllsch 
    454  1.1  jakllsch //
    455  1.1  jakllsch // IBM PowerPC relocation types.
    456  1.1  jakllsch //
    457  1.1  jakllsch 
    458  1.1  jakllsch #define IMAGE_REL_PPC_ABSOLUTE 0x0000  // NOP
    459  1.1  jakllsch #define IMAGE_REL_PPC_ADDR64   0x0001  // 64-bit address
    460  1.1  jakllsch #define IMAGE_REL_PPC_ADDR32   0x0002  // 32-bit address
    461  1.1  jakllsch #define IMAGE_REL_PPC_ADDR24   0x0003  // 26-bit address, shifted left 2 (branch absolute)
    462  1.1  jakllsch #define IMAGE_REL_PPC_ADDR16   0x0004  // 16-bit address
    463  1.1  jakllsch #define IMAGE_REL_PPC_ADDR14   0x0005  // 16-bit address, shifted left 2 (load doubleword)
    464  1.1  jakllsch #define IMAGE_REL_PPC_REL24    0x0006  // 26-bit PC-relative offset, shifted left 2 (branch relative)
    465  1.1  jakllsch #define IMAGE_REL_PPC_REL14    0x0007  // 16-bit PC-relative offset, shifted left 2 (br cond relative)
    466  1.1  jakllsch #define IMAGE_REL_PPC_TOCREL16 0x0008  // 16-bit offset from TOC base
    467  1.1  jakllsch #define IMAGE_REL_PPC_TOCREL14 0x0009  // 16-bit offset from TOC base, shifted left 2 (load doubleword)
    468  1.1  jakllsch 
    469  1.1  jakllsch #define IMAGE_REL_PPC_ADDR32NB 0x000A  // 32-bit addr w/o image base
    470  1.1  jakllsch #define IMAGE_REL_PPC_SECREL   0x000B  // va of containing section (as in an image sectionhdr)
    471  1.1  jakllsch #define IMAGE_REL_PPC_SECTION  0x000C  // sectionheader number
    472  1.1  jakllsch #define IMAGE_REL_PPC_IFGLUE   0x000D  // substitute TOC restore instruction iff symbol is glue code
    473  1.1  jakllsch #define IMAGE_REL_PPC_IMGLUE   0x000E  // symbol is glue code; virtual address is TOC restore instruction
    474  1.1  jakllsch 
    475  1.1  jakllsch #define IMAGE_REL_PPC_TYPEMASK 0x00FF  // mask to isolate above values in IMAGE_RELOCATION.Type
    476  1.1  jakllsch 
    477  1.1  jakllsch // Flag bits in IMAGE_RELOCATION.TYPE
    478  1.1  jakllsch 
    479  1.1  jakllsch #define IMAGE_REL_PPC_NEG      0x0100  // subtract reloc value rather than adding it
    480  1.1  jakllsch #define IMAGE_REL_PPC_BRTAKEN  0x0200  // fix branch prediction bit to predict branch taken
    481  1.1  jakllsch #define IMAGE_REL_PPC_BRNTAKEN 0x0400  // fix branch prediction bit to predict branch not taken
    482  1.1  jakllsch #define IMAGE_REL_PPC_TOCDEFN  0x0800  // toc slot defined in file (or, data in toc)
    483  1.1  jakllsch 
    484  1.1  jakllsch //
    485  1.1  jakllsch // Based relocation format.
    486  1.1  jakllsch //
    487  1.1  jakllsch 
    488  1.1  jakllsch typedef struct _IMAGE_BASE_RELOCATION {
    489  1.1  jakllsch     UINT32   VirtualAddress;
    490  1.1  jakllsch     UINT32   SizeOfBlock;
    491  1.1  jakllsch //  UINT16    TypeOffset[1];
    492  1.1  jakllsch } IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION;
    493  1.1  jakllsch 
    494  1.1  jakllsch #define IMAGE_SIZEOF_BASE_RELOCATION         8
    495  1.1  jakllsch 
    496  1.1  jakllsch //
    497  1.1  jakllsch // Based relocation types.
    498  1.1  jakllsch //
    499  1.1  jakllsch 
    500  1.1  jakllsch #define IMAGE_REL_BASED_ABSOLUTE              0
    501  1.1  jakllsch #define IMAGE_REL_BASED_HIGH                  1
    502  1.1  jakllsch #define IMAGE_REL_BASED_LOW                   2
    503  1.1  jakllsch #define IMAGE_REL_BASED_HIGHLOW               3
    504  1.1  jakllsch #define IMAGE_REL_BASED_HIGHADJ               4
    505  1.1  jakllsch #define IMAGE_REL_BASED_MIPS_JMPADDR          5
    506  1.1  jakllsch #define IMAGE_REL_BASED_IA64_IMM64            9
    507  1.1  jakllsch #define IMAGE_REL_BASED_DIR64                 10
    508  1.1  jakllsch 
    509  1.1  jakllsch //
    510  1.1  jakllsch // Line number format.
    511  1.1  jakllsch //
    512  1.1  jakllsch 
    513  1.1  jakllsch typedef struct _IMAGE_LINENUMBER {
    514  1.1  jakllsch     union {
    515  1.1  jakllsch         UINT32   SymbolTableIndex;               // Symbol table index of function name if Linenumber is 0.
    516  1.1  jakllsch         UINT32   VirtualAddress;                 // Virtual address of line number.
    517  1.1  jakllsch     } Type;
    518  1.1  jakllsch     UINT16    Linenumber;                         // Line number.
    519  1.1  jakllsch } IMAGE_LINENUMBER;
    520  1.1  jakllsch 
    521  1.1  jakllsch #define IMAGE_SIZEOF_LINENUMBER              6
    522  1.1  jakllsch 
    523  1.1  jakllsch //
    524  1.1  jakllsch // Archive format.
    525  1.1  jakllsch //
    526  1.1  jakllsch 
    527  1.1  jakllsch #define IMAGE_ARCHIVE_START_SIZE             8
    528  1.1  jakllsch #define IMAGE_ARCHIVE_START                  "!<arch>\n"
    529  1.1  jakllsch #define IMAGE_ARCHIVE_END                    "`\n"
    530  1.1  jakllsch #define IMAGE_ARCHIVE_PAD                    "\n"
    531  1.1  jakllsch #define IMAGE_ARCHIVE_LINKER_MEMBER          "/               "
    532  1.1  jakllsch #define IMAGE_ARCHIVE_LONGNAMES_MEMBER       "//              "
    533  1.1  jakllsch 
    534  1.1  jakllsch typedef struct _IMAGE_ARCHIVE_MEMBER_HEADER {
    535  1.1  jakllsch     UINT8     Name[16];                          // File member name - `/' terminated.
    536  1.1  jakllsch     UINT8     Date[12];                          // File member date - decimal.
    537  1.1  jakllsch     UINT8     UserID[6];                         // File member user id - decimal.
    538  1.1  jakllsch     UINT8     GroupID[6];                        // File member group id - decimal.
    539  1.1  jakllsch     UINT8     Mode[8];                           // File member mode - octal.
    540  1.1  jakllsch     UINT8     Size[10];                          // File member size - decimal.
    541  1.1  jakllsch     UINT8     EndHeader[2];                      // String to end header.
    542  1.1  jakllsch } IMAGE_ARCHIVE_MEMBER_HEADER, *PIMAGE_ARCHIVE_MEMBER_HEADER;
    543  1.1  jakllsch 
    544  1.1  jakllsch #define IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR      60
    545  1.1  jakllsch 
    546  1.1  jakllsch //
    547  1.1  jakllsch // DLL support.
    548  1.1  jakllsch //
    549  1.1  jakllsch 
    550  1.1  jakllsch //
    551  1.1  jakllsch // Export Format
    552  1.1  jakllsch //
    553  1.1  jakllsch 
    554  1.1  jakllsch typedef struct _IMAGE_EXPORT_DIRECTORY {
    555  1.1  jakllsch     UINT32   Characteristics;
    556  1.1  jakllsch     UINT32   TimeDateStamp;
    557  1.1  jakllsch     UINT16   MajorVersion;
    558  1.1  jakllsch     UINT16   MinorVersion;
    559  1.1  jakllsch     UINT32   Name;
    560  1.1  jakllsch     UINT32   Base;
    561  1.1  jakllsch     UINT32   NumberOfFunctions;
    562  1.1  jakllsch     UINT32   NumberOfNames;
    563  1.1  jakllsch     UINT32   *AddressOfFunctions;
    564  1.1  jakllsch     UINT32   *AddressOfNames;
    565  1.1  jakllsch     UINT32   *AddressOfNameOrdinals;
    566  1.1  jakllsch } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
    567  1.1  jakllsch 
    568  1.1  jakllsch //
    569  1.1  jakllsch // Import Format
    570  1.1  jakllsch //
    571  1.1  jakllsch 
    572  1.1  jakllsch typedef struct _IMAGE_IMPORT_BY_NAME {
    573  1.1  jakllsch     UINT16    Hint;
    574  1.1  jakllsch     UINT8     Name[1];
    575  1.1  jakllsch } IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
    576  1.1  jakllsch 
    577  1.1  jakllsch typedef struct _IMAGE_THUNK_DATA {
    578  1.1  jakllsch     union {
    579  1.1  jakllsch         UINT32 Function;
    580  1.1  jakllsch         UINT32 Ordinal;
    581  1.1  jakllsch         PIMAGE_IMPORT_BY_NAME AddressOfData;
    582  1.1  jakllsch     } u1;
    583  1.1  jakllsch } IMAGE_THUNK_DATA, *PIMAGE_THUNK_DATA;
    584  1.1  jakllsch 
    585  1.1  jakllsch #define IMAGE_ORDINAL_FLAG 0x80000000
    586  1.1  jakllsch #define IMAGE_SNAP_BY_ORDINAL(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG) != 0)
    587  1.1  jakllsch #define IMAGE_ORDINAL(Ordinal) (Ordinal & 0xffff)
    588  1.1  jakllsch 
    589  1.1  jakllsch typedef struct _IMAGE_IMPORT_DESCRIPTOR {
    590  1.1  jakllsch     UINT32   Characteristics;
    591  1.1  jakllsch     UINT32   TimeDateStamp;
    592  1.1  jakllsch     UINT32   ForwarderChain;
    593  1.1  jakllsch     UINT32   Name;
    594  1.1  jakllsch     PIMAGE_THUNK_DATA FirstThunk;
    595  1.1  jakllsch } IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR;
    596  1.1  jakllsch 
    597  1.1  jakllsch #endif
    598