1 /* 2 * Copyright (c) 2018 Virtuozzo International GmbH 3 * 4 * This work is licensed under the terms of the GNU GPL, version 2 or later. 5 * 6 */ 7 8 #ifndef PE_H 9 #define PE_H 10 11 12 typedef struct IMAGE_DOS_HEADER { 13 uint16_t e_magic; /* 0x00: MZ Header signature */ 14 uint16_t e_cblp; /* 0x02: Bytes on last page of file */ 15 uint16_t e_cp; /* 0x04: Pages in file */ 16 uint16_t e_crlc; /* 0x06: Relocations */ 17 uint16_t e_cparhdr; /* 0x08: Size of header in paragraphs */ 18 uint16_t e_minalloc; /* 0x0a: Minimum extra paragraphs needed */ 19 uint16_t e_maxalloc; /* 0x0c: Maximum extra paragraphs needed */ 20 uint16_t e_ss; /* 0x0e: Initial (relative) SS value */ 21 uint16_t e_sp; /* 0x10: Initial SP value */ 22 uint16_t e_csum; /* 0x12: Checksum */ 23 uint16_t e_ip; /* 0x14: Initial IP value */ 24 uint16_t e_cs; /* 0x16: Initial (relative) CS value */ 25 uint16_t e_lfarlc; /* 0x18: File address of relocation table */ 26 uint16_t e_ovno; /* 0x1a: Overlay number */ 27 uint16_t e_res[4]; /* 0x1c: Reserved words */ 28 uint16_t e_oemid; /* 0x24: OEM identifier (for e_oeminfo) */ 29 uint16_t e_oeminfo; /* 0x26: OEM information; e_oemid specific */ 30 uint16_t e_res2[10]; /* 0x28: Reserved words */ 31 uint32_t e_lfanew; /* 0x3c: Offset to extended header */ 32 } __attribute__ ((packed)) IMAGE_DOS_HEADER; 33 34 typedef struct IMAGE_FILE_HEADER { 35 uint16_t Machine; 36 uint16_t NumberOfSections; 37 uint32_t TimeDateStamp; 38 uint32_t PointerToSymbolTable; 39 uint32_t NumberOfSymbols; 40 uint16_t SizeOfOptionalHeader; 41 uint16_t Characteristics; 42 } __attribute__ ((packed)) IMAGE_FILE_HEADER; 43 44 typedef struct IMAGE_DATA_DIRECTORY { 45 uint32_t VirtualAddress; 46 uint32_t Size; 47 } __attribute__ ((packed)) IMAGE_DATA_DIRECTORY; 48 49 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 50 51 typedef struct IMAGE_OPTIONAL_HEADER64 { 52 uint16_t Magic; /* 0x20b */ 53 uint8_t MajorLinkerVersion; 54 uint8_t MinorLinkerVersion; 55 uint32_t SizeOfCode; 56 uint32_t SizeOfInitializedData; 57 uint32_t SizeOfUninitializedData; 58 uint32_t AddressOfEntryPoint; 59 uint32_t BaseOfCode; 60 uint64_t ImageBase; 61 uint32_t SectionAlignment; 62 uint32_t FileAlignment; 63 uint16_t MajorOperatingSystemVersion; 64 uint16_t MinorOperatingSystemVersion; 65 uint16_t MajorImageVersion; 66 uint16_t MinorImageVersion; 67 uint16_t MajorSubsystemVersion; 68 uint16_t MinorSubsystemVersion; 69 uint32_t Win32VersionValue; 70 uint32_t SizeOfImage; 71 uint32_t SizeOfHeaders; 72 uint32_t CheckSum; 73 uint16_t Subsystem; 74 uint16_t DllCharacteristics; 75 uint64_t SizeOfStackReserve; 76 uint64_t SizeOfStackCommit; 77 uint64_t SizeOfHeapReserve; 78 uint64_t SizeOfHeapCommit; 79 uint32_t LoaderFlags; 80 uint32_t NumberOfRvaAndSizes; 81 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; 82 } __attribute__ ((packed)) IMAGE_OPTIONAL_HEADER64; 83 84 typedef struct IMAGE_NT_HEADERS64 { 85 uint32_t Signature; 86 IMAGE_FILE_HEADER FileHeader; 87 IMAGE_OPTIONAL_HEADER64 OptionalHeader; 88 } __attribute__ ((packed)) IMAGE_NT_HEADERS64; 89 90 #define IMAGE_FILE_DEBUG_DIRECTORY 6 91 92 typedef struct IMAGE_DEBUG_DIRECTORY { 93 uint32_t Characteristics; 94 uint32_t TimeDateStamp; 95 uint16_t MajorVersion; 96 uint16_t MinorVersion; 97 uint32_t Type; 98 uint32_t SizeOfData; 99 uint32_t AddressOfRawData; 100 uint32_t PointerToRawData; 101 } __attribute__ ((packed)) IMAGE_DEBUG_DIRECTORY; 102 103 #define IMAGE_DEBUG_TYPE_CODEVIEW 2 104 105 typedef struct guid_t { 106 uint32_t a; 107 uint16_t b; 108 uint16_t c; 109 uint8_t d[2]; 110 uint8_t e[6]; 111 } __attribute__ ((packed)) guid_t; 112 113 typedef struct OMFSignatureRSDS { 114 char Signature[4]; 115 guid_t guid; 116 uint32_t age; 117 char name[]; 118 } __attribute__ ((packed)) OMFSignatureRSDS; 119 120 #endif /* PE_H */ 121