]> git.proxmox.com Git - rustc.git/blame - vendor/object/src/pe.rs
New upstream version 1.62.1+dfsg1
[rustc.git] / vendor / object / src / pe.rs
CommitLineData
a2a8927a
XL
1//! PE/COFF definitions.
2//!
3//! These definitions are independent of read/write support, although we do implement
4//! some traits useful for those.
5//!
6//! This module is based heavily on "winnt.h" (10.0.17763.0).
7
8#![allow(missing_docs)]
9
10use crate::endian::{LittleEndian as LE, U16Bytes, U32Bytes, I32, U16, U32, U64};
11use crate::pod::Pod;
12
13/// MZ
14pub const IMAGE_DOS_SIGNATURE: u16 = 0x5A4D;
15/// NE
16pub const IMAGE_OS2_SIGNATURE: u16 = 0x454E;
17/// LE
18pub const IMAGE_OS2_SIGNATURE_LE: u16 = 0x454C;
19/// LE
20pub const IMAGE_VXD_SIGNATURE: u16 = 0x454C;
21/// PE00
22pub const IMAGE_NT_SIGNATURE: u32 = 0x0000_4550;
23
24/// DOS .EXE header
25#[derive(Debug, Clone, Copy)]
26#[repr(C)]
27pub struct ImageDosHeader {
28 /// Magic number
29 pub e_magic: U16<LE>,
30 /// Bytes on last page of file
31 pub e_cblp: U16<LE>,
32 /// Pages in file
33 pub e_cp: U16<LE>,
34 /// Relocations
35 pub e_crlc: U16<LE>,
36 /// Size of header in paragraphs
37 pub e_cparhdr: U16<LE>,
38 /// Minimum extra paragraphs needed
39 pub e_minalloc: U16<LE>,
40 /// Maximum extra paragraphs needed
41 pub e_maxalloc: U16<LE>,
42 /// Initial (relative) SS value
43 pub e_ss: U16<LE>,
44 /// Initial SP value
45 pub e_sp: U16<LE>,
46 /// Checksum
47 pub e_csum: U16<LE>,
48 /// Initial IP value
49 pub e_ip: U16<LE>,
50 /// Initial (relative) CS value
51 pub e_cs: U16<LE>,
52 /// File address of relocation table
53 pub e_lfarlc: U16<LE>,
54 /// Overlay number
55 pub e_ovno: U16<LE>,
56 /// Reserved words
57 pub e_res: [U16<LE>; 4],
58 /// OEM identifier (for e_oeminfo)
59 pub e_oemid: U16<LE>,
60 /// OEM information; e_oemid specific
61 pub e_oeminfo: U16<LE>,
62 /// Reserved words
63 pub e_res2: [U16<LE>; 10],
64 /// File address of new exe header
65 pub e_lfanew: U32<LE>,
66}
67
68/// OS/2 .EXE header
69#[derive(Debug, Clone, Copy)]
70#[repr(C)]
71pub struct ImageOs2Header {
72 /// Magic number
73 pub ne_magic: U16<LE>,
74 /// Version number
75 pub ne_ver: i8,
76 /// Revision number
77 pub ne_rev: i8,
78 /// Offset of Entry Table
79 pub ne_enttab: U16<LE>,
80 /// Number of bytes in Entry Table
81 pub ne_cbenttab: U16<LE>,
82 /// Checksum of whole file
83 pub ne_crc: I32<LE>,
84 /// Flag word
85 pub ne_flags: U16<LE>,
86 /// Automatic data segment number
87 pub ne_autodata: U16<LE>,
88 /// Initial heap allocation
89 pub ne_heap: U16<LE>,
90 /// Initial stack allocation
91 pub ne_stack: U16<LE>,
92 /// Initial CS:IP setting
93 pub ne_csip: I32<LE>,
94 /// Initial SS:SP setting
95 pub ne_sssp: I32<LE>,
96 /// Count of file segments
97 pub ne_cseg: U16<LE>,
98 /// Entries in Module Reference Table
99 pub ne_cmod: U16<LE>,
100 /// Size of non-resident name table
101 pub ne_cbnrestab: U16<LE>,
102 /// Offset of Segment Table
103 pub ne_segtab: U16<LE>,
104 /// Offset of Resource Table
105 pub ne_rsrctab: U16<LE>,
106 /// Offset of resident name table
107 pub ne_restab: U16<LE>,
108 /// Offset of Module Reference Table
109 pub ne_modtab: U16<LE>,
110 /// Offset of Imported Names Table
111 pub ne_imptab: U16<LE>,
112 /// Offset of Non-resident Names Table
113 pub ne_nrestab: I32<LE>,
114 /// Count of movable entries
115 pub ne_cmovent: U16<LE>,
116 /// Segment alignment shift count
117 pub ne_align: U16<LE>,
118 /// Count of resource segments
119 pub ne_cres: U16<LE>,
120 /// Target Operating system
121 pub ne_exetyp: u8,
122 /// Other .EXE flags
123 pub ne_flagsothers: u8,
124 /// offset to return thunks
125 pub ne_pretthunks: U16<LE>,
126 /// offset to segment ref. bytes
127 pub ne_psegrefbytes: U16<LE>,
128 /// Minimum code swap area size
129 pub ne_swaparea: U16<LE>,
130 /// Expected Windows version number
131 pub ne_expver: U16<LE>,
132}
133
134/// Windows VXD header
135#[derive(Debug, Clone, Copy)]
136#[repr(C)]
137pub struct ImageVxdHeader {
138 /// Magic number
139 pub e32_magic: U16<LE>,
140 /// The byte ordering for the VXD
141 pub e32_border: u8,
142 /// The word ordering for the VXD
143 pub e32_worder: u8,
144 /// The EXE format level for now = 0
145 pub e32_level: U32<LE>,
146 /// The CPU type
147 pub e32_cpu: U16<LE>,
148 /// The OS type
149 pub e32_os: U16<LE>,
150 /// Module version
151 pub e32_ver: U32<LE>,
152 /// Module flags
153 pub e32_mflags: U32<LE>,
154 /// Module # pages
155 pub e32_mpages: U32<LE>,
156 /// Object # for instruction pointer
157 pub e32_startobj: U32<LE>,
158 /// Extended instruction pointer
159 pub e32_eip: U32<LE>,
160 /// Object # for stack pointer
161 pub e32_stackobj: U32<LE>,
162 /// Extended stack pointer
163 pub e32_esp: U32<LE>,
164 /// VXD page size
165 pub e32_pagesize: U32<LE>,
166 /// Last page size in VXD
167 pub e32_lastpagesize: U32<LE>,
168 /// Fixup section size
169 pub e32_fixupsize: U32<LE>,
170 /// Fixup section checksum
171 pub e32_fixupsum: U32<LE>,
172 /// Loader section size
173 pub e32_ldrsize: U32<LE>,
174 /// Loader section checksum
175 pub e32_ldrsum: U32<LE>,
176 /// Object table offset
177 pub e32_objtab: U32<LE>,
178 /// Number of objects in module
179 pub e32_objcnt: U32<LE>,
180 /// Object page map offset
181 pub e32_objmap: U32<LE>,
182 /// Object iterated data map offset
183 pub e32_itermap: U32<LE>,
184 /// Offset of Resource Table
185 pub e32_rsrctab: U32<LE>,
186 /// Number of resource entries
187 pub e32_rsrccnt: U32<LE>,
188 /// Offset of resident name table
189 pub e32_restab: U32<LE>,
190 /// Offset of Entry Table
191 pub e32_enttab: U32<LE>,
192 /// Offset of Module Directive Table
193 pub e32_dirtab: U32<LE>,
194 /// Number of module directives
195 pub e32_dircnt: U32<LE>,
196 /// Offset of Fixup Page Table
197 pub e32_fpagetab: U32<LE>,
198 /// Offset of Fixup Record Table
199 pub e32_frectab: U32<LE>,
200 /// Offset of Import Module Name Table
201 pub e32_impmod: U32<LE>,
202 /// Number of entries in Import Module Name Table
203 pub e32_impmodcnt: U32<LE>,
204 /// Offset of Import Procedure Name Table
205 pub e32_impproc: U32<LE>,
206 /// Offset of Per-Page Checksum Table
207 pub e32_pagesum: U32<LE>,
208 /// Offset of Enumerated Data Pages
209 pub e32_datapage: U32<LE>,
210 /// Number of preload pages
211 pub e32_preload: U32<LE>,
212 /// Offset of Non-resident Names Table
213 pub e32_nrestab: U32<LE>,
214 /// Size of Non-resident Name Table
215 pub e32_cbnrestab: U32<LE>,
216 /// Non-resident Name Table Checksum
217 pub e32_nressum: U32<LE>,
218 /// Object # for automatic data object
219 pub e32_autodata: U32<LE>,
220 /// Offset of the debugging information
221 pub e32_debuginfo: U32<LE>,
222 /// The length of the debugging info. in bytes
223 pub e32_debuglen: U32<LE>,
224 /// Number of instance pages in preload section of VXD file
225 pub e32_instpreload: U32<LE>,
226 /// Number of instance pages in demand load section of VXD file
227 pub e32_instdemand: U32<LE>,
228 /// Size of heap - for 16-bit apps
229 pub e32_heapsize: U32<LE>,
230 /// Reserved words
231 pub e32_res3: [u8; 12],
232 pub e32_winresoff: U32<LE>,
233 pub e32_winreslen: U32<LE>,
234 /// Device ID for VxD
235 pub e32_devid: U16<LE>,
236 /// DDK version for VxD
237 pub e32_ddkver: U16<LE>,
238}
239
240/// A PE rich header entry.
241///
242/// Rich headers have no official documentation, but have been heavily
243/// reversed-engineered and documented in the wild, e.g.:
244/// * `http://www.ntcore.com/files/richsign.htm`
245/// * `https://www.researchgate.net/figure/Structure-of-the-Rich-Header_fig1_318145388`
246///
247/// This data is "masked", i.e. XORed with a checksum derived from the file data.
248#[derive(Debug, Clone, Copy)]
249#[repr(C)]
250pub struct MaskedRichHeaderEntry {
251 pub masked_comp_id: U32<LE>,
252 pub masked_count: U32<LE>,
253}
254
255//
256// File header format.
257//
258
259#[derive(Debug, Clone, Copy)]
260#[repr(C)]
261pub struct ImageFileHeader {
262 pub machine: U16<LE>,
263 pub number_of_sections: U16<LE>,
264 pub time_date_stamp: U32<LE>,
265 pub pointer_to_symbol_table: U32<LE>,
266 pub number_of_symbols: U32<LE>,
267 pub size_of_optional_header: U16<LE>,
268 pub characteristics: U16<LE>,
269}
270
271pub const IMAGE_SIZEOF_FILE_HEADER: usize = 20;
272
273/// Relocation info stripped from file.
274pub const IMAGE_FILE_RELOCS_STRIPPED: u16 = 0x0001;
275/// File is executable (i.e. no unresolved external references).
276pub const IMAGE_FILE_EXECUTABLE_IMAGE: u16 = 0x0002;
277/// Line nunbers stripped from file.
278pub const IMAGE_FILE_LINE_NUMS_STRIPPED: u16 = 0x0004;
279/// Local symbols stripped from file.
280pub const IMAGE_FILE_LOCAL_SYMS_STRIPPED: u16 = 0x0008;
281/// Aggressively trim working set
282pub const IMAGE_FILE_AGGRESIVE_WS_TRIM: u16 = 0x0010;
283/// App can handle >2gb addresses
284pub const IMAGE_FILE_LARGE_ADDRESS_AWARE: u16 = 0x0020;
285/// Bytes of machine word are reversed.
286pub const IMAGE_FILE_BYTES_REVERSED_LO: u16 = 0x0080;
287/// 32 bit word machine.
288pub const IMAGE_FILE_32BIT_MACHINE: u16 = 0x0100;
289/// Debugging info stripped from file in .DBG file
290pub const IMAGE_FILE_DEBUG_STRIPPED: u16 = 0x0200;
291/// If Image is on removable media, copy and run from the swap file.
292pub const IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP: u16 = 0x0400;
293/// If Image is on Net, copy and run from the swap file.
294pub const IMAGE_FILE_NET_RUN_FROM_SWAP: u16 = 0x0800;
295/// System File.
296pub const IMAGE_FILE_SYSTEM: u16 = 0x1000;
297/// File is a DLL.
298pub const IMAGE_FILE_DLL: u16 = 0x2000;
299/// File should only be run on a UP machine
300pub const IMAGE_FILE_UP_SYSTEM_ONLY: u16 = 0x4000;
301/// Bytes of machine word are reversed.
302pub const IMAGE_FILE_BYTES_REVERSED_HI: u16 = 0x8000;
303
304pub const IMAGE_FILE_MACHINE_UNKNOWN: u16 = 0;
305/// Useful for indicating we want to interact with the host and not a WoW guest.
306pub const IMAGE_FILE_MACHINE_TARGET_HOST: u16 = 0x0001;
307/// Intel 386.
308pub const IMAGE_FILE_MACHINE_I386: u16 = 0x014c;
309/// MIPS little-endian, 0x160 big-endian
310pub const IMAGE_FILE_MACHINE_R3000: u16 = 0x0162;
311/// MIPS little-endian
312pub const IMAGE_FILE_MACHINE_R4000: u16 = 0x0166;
313/// MIPS little-endian
314pub const IMAGE_FILE_MACHINE_R10000: u16 = 0x0168;
315/// MIPS little-endian WCE v2
316pub const IMAGE_FILE_MACHINE_WCEMIPSV2: u16 = 0x0169;
317/// Alpha_AXP
318pub const IMAGE_FILE_MACHINE_ALPHA: u16 = 0x0184;
319/// SH3 little-endian
320pub const IMAGE_FILE_MACHINE_SH3: u16 = 0x01a2;
321pub const IMAGE_FILE_MACHINE_SH3DSP: u16 = 0x01a3;
322/// SH3E little-endian
323pub const IMAGE_FILE_MACHINE_SH3E: u16 = 0x01a4;
324/// SH4 little-endian
325pub const IMAGE_FILE_MACHINE_SH4: u16 = 0x01a6;
326/// SH5
327pub const IMAGE_FILE_MACHINE_SH5: u16 = 0x01a8;
328/// ARM Little-Endian
329pub const IMAGE_FILE_MACHINE_ARM: u16 = 0x01c0;
330/// ARM Thumb/Thumb-2 Little-Endian
331pub const IMAGE_FILE_MACHINE_THUMB: u16 = 0x01c2;
332/// ARM Thumb-2 Little-Endian
333pub const IMAGE_FILE_MACHINE_ARMNT: u16 = 0x01c4;
334pub const IMAGE_FILE_MACHINE_AM33: u16 = 0x01d3;
335/// IBM PowerPC Little-Endian
336pub const IMAGE_FILE_MACHINE_POWERPC: u16 = 0x01F0;
337pub const IMAGE_FILE_MACHINE_POWERPCFP: u16 = 0x01f1;
338/// Intel 64
339pub const IMAGE_FILE_MACHINE_IA64: u16 = 0x0200;
340/// MIPS
341pub const IMAGE_FILE_MACHINE_MIPS16: u16 = 0x0266;
342/// ALPHA64
343pub const IMAGE_FILE_MACHINE_ALPHA64: u16 = 0x0284;
344/// MIPS
345pub const IMAGE_FILE_MACHINE_MIPSFPU: u16 = 0x0366;
346/// MIPS
347pub const IMAGE_FILE_MACHINE_MIPSFPU16: u16 = 0x0466;
348pub const IMAGE_FILE_MACHINE_AXP64: u16 = IMAGE_FILE_MACHINE_ALPHA64;
349/// Infineon
350pub const IMAGE_FILE_MACHINE_TRICORE: u16 = 0x0520;
351pub const IMAGE_FILE_MACHINE_CEF: u16 = 0x0CEF;
352/// EFI Byte Code
353pub const IMAGE_FILE_MACHINE_EBC: u16 = 0x0EBC;
354/// AMD64 (K8)
355pub const IMAGE_FILE_MACHINE_AMD64: u16 = 0x8664;
356/// M32R little-endian
357pub const IMAGE_FILE_MACHINE_M32R: u16 = 0x9041;
358/// ARM64 Little-Endian
359pub const IMAGE_FILE_MACHINE_ARM64: u16 = 0xAA64;
360pub const IMAGE_FILE_MACHINE_CEE: u16 = 0xC0EE;
361/// RISCV32
362pub const IMAGE_FILE_MACHINE_RISCV32: u16 = 0x5032;
363/// RISCV64
364pub const IMAGE_FILE_MACHINE_RISCV64: u16 = 0x5064;
365/// RISCV128
366pub const IMAGE_FILE_MACHINE_RISCV128: u16 = 0x5128;
367
368//
369// Directory format.
370//
371
372#[derive(Debug, Clone, Copy)]
373#[repr(C)]
374pub struct ImageDataDirectory {
375 pub virtual_address: U32<LE>,
376 pub size: U32<LE>,
377}
378
379pub const IMAGE_NUMBEROF_DIRECTORY_ENTRIES: usize = 16;
380
381//
382// Optional header format.
383//
384
385#[derive(Debug, Clone, Copy)]
386#[repr(C)]
387pub struct ImageOptionalHeader32 {
388 // Standard fields.
389 pub magic: U16<LE>,
390 pub major_linker_version: u8,
391 pub minor_linker_version: u8,
392 pub size_of_code: U32<LE>,
393 pub size_of_initialized_data: U32<LE>,
394 pub size_of_uninitialized_data: U32<LE>,
395 pub address_of_entry_point: U32<LE>,
396 pub base_of_code: U32<LE>,
397 pub base_of_data: U32<LE>,
398
399 // NT additional fields.
400 pub image_base: U32<LE>,
401 pub section_alignment: U32<LE>,
402 pub file_alignment: U32<LE>,
403 pub major_operating_system_version: U16<LE>,
404 pub minor_operating_system_version: U16<LE>,
405 pub major_image_version: U16<LE>,
406 pub minor_image_version: U16<LE>,
407 pub major_subsystem_version: U16<LE>,
408 pub minor_subsystem_version: U16<LE>,
409 pub win32_version_value: U32<LE>,
410 pub size_of_image: U32<LE>,
411 pub size_of_headers: U32<LE>,
412 pub check_sum: U32<LE>,
413 pub subsystem: U16<LE>,
414 pub dll_characteristics: U16<LE>,
415 pub size_of_stack_reserve: U32<LE>,
416 pub size_of_stack_commit: U32<LE>,
417 pub size_of_heap_reserve: U32<LE>,
418 pub size_of_heap_commit: U32<LE>,
419 pub loader_flags: U32<LE>,
420 pub number_of_rva_and_sizes: U32<LE>,
421 //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
422}
423
424#[derive(Debug, Clone, Copy)]
425#[repr(C)]
426pub struct ImageRomOptionalHeader {
427 pub magic: U16<LE>,
428 pub major_linker_version: u8,
429 pub minor_linker_version: u8,
430 pub size_of_code: U32<LE>,
431 pub size_of_initialized_data: U32<LE>,
432 pub size_of_uninitialized_data: U32<LE>,
433 pub address_of_entry_point: U32<LE>,
434 pub base_of_code: U32<LE>,
435 pub base_of_data: U32<LE>,
436 pub base_of_bss: U32<LE>,
437 pub gpr_mask: U32<LE>,
438 pub cpr_mask: [U32<LE>; 4],
439 pub gp_value: U32<LE>,
440}
441
442#[derive(Debug, Clone, Copy)]
443#[repr(C)]
444pub struct ImageOptionalHeader64 {
445 pub magic: U16<LE>,
446 pub major_linker_version: u8,
447 pub minor_linker_version: u8,
448 pub size_of_code: U32<LE>,
449 pub size_of_initialized_data: U32<LE>,
450 pub size_of_uninitialized_data: U32<LE>,
451 pub address_of_entry_point: U32<LE>,
452 pub base_of_code: U32<LE>,
453 pub image_base: U64<LE>,
454 pub section_alignment: U32<LE>,
455 pub file_alignment: U32<LE>,
456 pub major_operating_system_version: U16<LE>,
457 pub minor_operating_system_version: U16<LE>,
458 pub major_image_version: U16<LE>,
459 pub minor_image_version: U16<LE>,
460 pub major_subsystem_version: U16<LE>,
461 pub minor_subsystem_version: U16<LE>,
462 pub win32_version_value: U32<LE>,
463 pub size_of_image: U32<LE>,
464 pub size_of_headers: U32<LE>,
465 pub check_sum: U32<LE>,
466 pub subsystem: U16<LE>,
467 pub dll_characteristics: U16<LE>,
468 pub size_of_stack_reserve: U64<LE>,
469 pub size_of_stack_commit: U64<LE>,
470 pub size_of_heap_reserve: U64<LE>,
471 pub size_of_heap_commit: U64<LE>,
472 pub loader_flags: U32<LE>,
473 pub number_of_rva_and_sizes: U32<LE>,
474 //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
475}
476
477pub const IMAGE_NT_OPTIONAL_HDR32_MAGIC: u16 = 0x10b;
478pub const IMAGE_NT_OPTIONAL_HDR64_MAGIC: u16 = 0x20b;
479pub const IMAGE_ROM_OPTIONAL_HDR_MAGIC: u16 = 0x107;
480
481#[derive(Debug, Clone, Copy)]
482#[repr(C)]
483pub struct ImageNtHeaders64 {
484 pub signature: U32<LE>,
485 pub file_header: ImageFileHeader,
486 pub optional_header: ImageOptionalHeader64,
487}
488
489#[derive(Debug, Clone, Copy)]
490#[repr(C)]
491pub struct ImageNtHeaders32 {
492 pub signature: U32<LE>,
493 pub file_header: ImageFileHeader,
494 pub optional_header: ImageOptionalHeader32,
495}
496
497#[derive(Debug, Clone, Copy)]
498#[repr(C)]
499pub struct ImageRomHeaders {
500 pub file_header: ImageFileHeader,
501 pub optional_header: ImageRomOptionalHeader,
502}
503
504// Values for `ImageOptionalHeader*::subsystem`.
505
506/// Unknown subsystem.
507pub const IMAGE_SUBSYSTEM_UNKNOWN: u16 = 0;
508/// Image doesn't require a subsystem.
509pub const IMAGE_SUBSYSTEM_NATIVE: u16 = 1;
510/// Image runs in the Windows GUI subsystem.
511pub const IMAGE_SUBSYSTEM_WINDOWS_GUI: u16 = 2;
512/// Image runs in the Windows character subsystem.
513pub const IMAGE_SUBSYSTEM_WINDOWS_CUI: u16 = 3;
514/// image runs in the OS/2 character subsystem.
515pub const IMAGE_SUBSYSTEM_OS2_CUI: u16 = 5;
516/// image runs in the Posix character subsystem.
517pub const IMAGE_SUBSYSTEM_POSIX_CUI: u16 = 7;
518/// image is a native Win9x driver.
519pub const IMAGE_SUBSYSTEM_NATIVE_WINDOWS: u16 = 8;
520/// Image runs in the Windows CE subsystem.
521pub const IMAGE_SUBSYSTEM_WINDOWS_CE_GUI: u16 = 9;
522pub const IMAGE_SUBSYSTEM_EFI_APPLICATION: u16 = 10;
523pub const IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER: u16 = 11;
524pub const IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER: u16 = 12;
525pub const IMAGE_SUBSYSTEM_EFI_ROM: u16 = 13;
526pub const IMAGE_SUBSYSTEM_XBOX: u16 = 14;
527pub const IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION: u16 = 16;
528pub const IMAGE_SUBSYSTEM_XBOX_CODE_CATALOG: u16 = 17;
529
530// Values for `ImageOptionalHeader*::dll_characteristics`.
531
532// IMAGE_LIBRARY_PROCESS_INIT 0x0001 // Reserved.
533// IMAGE_LIBRARY_PROCESS_TERM 0x0002 // Reserved.
534// IMAGE_LIBRARY_THREAD_INIT 0x0004 // Reserved.
535// IMAGE_LIBRARY_THREAD_TERM 0x0008 // Reserved.
536/// Image can handle a high entropy 64-bit virtual address space.
537pub const IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA: u16 = 0x0020;
538/// DLL can move.
539pub const IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE: u16 = 0x0040;
540/// Code Integrity Image
541pub const IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY: u16 = 0x0080;
542/// Image is NX compatible
543pub const IMAGE_DLLCHARACTERISTICS_NX_COMPAT: u16 = 0x0100;
544/// Image understands isolation and doesn't want it
545pub const IMAGE_DLLCHARACTERISTICS_NO_ISOLATION: u16 = 0x0200;
546/// Image does not use SEH. No SE handler may reside in this image
547pub const IMAGE_DLLCHARACTERISTICS_NO_SEH: u16 = 0x0400;
548/// Do not bind this image.
549pub const IMAGE_DLLCHARACTERISTICS_NO_BIND: u16 = 0x0800;
550/// Image should execute in an AppContainer
551pub const IMAGE_DLLCHARACTERISTICS_APPCONTAINER: u16 = 0x1000;
552/// Driver uses WDM model
553pub const IMAGE_DLLCHARACTERISTICS_WDM_DRIVER: u16 = 0x2000;
554/// Image supports Control Flow Guard.
555pub const IMAGE_DLLCHARACTERISTICS_GUARD_CF: u16 = 0x4000;
556pub const IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE: u16 = 0x8000;
557
558// Indices for `ImageOptionalHeader*::data_directory`.
559
560/// Export Directory
561pub const IMAGE_DIRECTORY_ENTRY_EXPORT: usize = 0;
562/// Import Directory
563pub const IMAGE_DIRECTORY_ENTRY_IMPORT: usize = 1;
564/// Resource Directory
565pub const IMAGE_DIRECTORY_ENTRY_RESOURCE: usize = 2;
566/// Exception Directory
567pub const IMAGE_DIRECTORY_ENTRY_EXCEPTION: usize = 3;
568/// Security Directory
569pub const IMAGE_DIRECTORY_ENTRY_SECURITY: usize = 4;
570/// Base Relocation Table
571pub const IMAGE_DIRECTORY_ENTRY_BASERELOC: usize = 5;
572/// Debug Directory
573pub const IMAGE_DIRECTORY_ENTRY_DEBUG: usize = 6;
574// IMAGE_DIRECTORY_ENTRY_COPYRIGHT 7 // (X86 usage)
575/// Architecture Specific Data
576pub const IMAGE_DIRECTORY_ENTRY_ARCHITECTURE: usize = 7;
577/// RVA of GP
578pub const IMAGE_DIRECTORY_ENTRY_GLOBALPTR: usize = 8;
579/// TLS Directory
580pub const IMAGE_DIRECTORY_ENTRY_TLS: usize = 9;
581/// Load Configuration Directory
582pub const IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG: usize = 10;
583/// Bound Import Directory in headers
584pub const IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT: usize = 11;
585/// Import Address Table
586pub const IMAGE_DIRECTORY_ENTRY_IAT: usize = 12;
587/// Delay Load Import Descriptors
588pub const IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT: usize = 13;
589/// COM Runtime descriptor
590pub const IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR: usize = 14;
591
592#[derive(Debug, Clone, Copy)]
593#[repr(C)]
594pub struct Guid {
595 pub data1: U32<LE>,
596 pub data2: U16<LE>,
597 pub data3: U16<LE>,
598 pub data4: [u8; 8],
599}
600
601pub type ClsId = Guid;
602
603/// Non-COFF Object file header
604#[derive(Debug, Clone, Copy)]
605#[repr(C)]
606pub struct AnonObjectHeader {
607 /// Must be IMAGE_FILE_MACHINE_UNKNOWN
608 pub sig1: U16<LE>,
609 /// Must be 0xffff
610 pub sig2: U16<LE>,
611 /// >= 1 (implies the ClsId field is present)
612 pub version: U16<LE>,
613 pub machine: U16<LE>,
614 pub time_date_stamp: U32<LE>,
615 /// Used to invoke CoCreateInstance
616 pub class_id: ClsId,
617 /// Size of data that follows the header
618 pub size_of_data: U32<LE>,
619}
620
621#[derive(Debug, Clone, Copy)]
622#[repr(C)]
623pub struct AnonObjectHeaderV2 {
624 /// Must be IMAGE_FILE_MACHINE_UNKNOWN
625 pub sig1: U16<LE>,
626 /// Must be 0xffff
627 pub sig2: U16<LE>,
628 /// >= 2 (implies the Flags field is present - otherwise V1)
629 pub version: U16<LE>,
630 pub machine: U16<LE>,
631 pub time_date_stamp: U32<LE>,
632 /// Used to invoke CoCreateInstance
633 pub class_id: ClsId,
634 /// Size of data that follows the header
635 pub size_of_data: U32<LE>,
636 /// 0x1 -> contains metadata
637 pub flags: U32<LE>,
638 /// Size of CLR metadata
639 pub meta_data_size: U32<LE>,
640 /// Offset of CLR metadata
641 pub meta_data_offset: U32<LE>,
642}
643
644#[derive(Debug, Clone, Copy)]
645#[repr(C)]
646pub struct AnonObjectHeaderBigobj {
647 /* same as ANON_OBJECT_HEADER_V2 */
648 /// Must be IMAGE_FILE_MACHINE_UNKNOWN
649 pub sig1: U16<LE>,
650 /// Must be 0xffff
651 pub sig2: U16<LE>,
652 /// >= 2 (implies the Flags field is present)
653 pub version: U16<LE>,
654 /// Actual machine - IMAGE_FILE_MACHINE_xxx
655 pub machine: U16<LE>,
656 pub time_date_stamp: U32<LE>,
657 /// {D1BAA1C7-BAEE-4ba9-AF20-FAF66AA4DCB8}
658 pub class_id: ClsId,
659 /// Size of data that follows the header
660 pub size_of_data: U32<LE>,
661 /// 0x1 -> contains metadata
662 pub flags: U32<LE>,
663 /// Size of CLR metadata
664 pub meta_data_size: U32<LE>,
665 /// Offset of CLR metadata
666 pub meta_data_offset: U32<LE>,
667
668 /* bigobj specifics */
669 /// extended from WORD
670 pub number_of_sections: U32<LE>,
671 pub pointer_to_symbol_table: U32<LE>,
672 pub number_of_symbols: U32<LE>,
673}
674
675pub const IMAGE_SIZEOF_SHORT_NAME: usize = 8;
676
677//
678// Section header format.
679//
680
681#[derive(Debug, Default, Clone, Copy)]
682#[repr(C)]
683pub struct ImageSectionHeader {
684 pub name: [u8; IMAGE_SIZEOF_SHORT_NAME],
685 pub virtual_size: U32<LE>,
686 pub virtual_address: U32<LE>,
687 pub size_of_raw_data: U32<LE>,
688 pub pointer_to_raw_data: U32<LE>,
689 pub pointer_to_relocations: U32<LE>,
690 pub pointer_to_linenumbers: U32<LE>,
691 pub number_of_relocations: U16<LE>,
692 pub number_of_linenumbers: U16<LE>,
693 pub characteristics: U32<LE>,
694}
695
696pub const IMAGE_SIZEOF_SECTION_HEADER: usize = 40;
697
698// Values for `ImageSectionHeader::characteristics`.
699
700// IMAGE_SCN_TYPE_REG 0x00000000 // Reserved.
701// IMAGE_SCN_TYPE_DSECT 0x00000001 // Reserved.
702// IMAGE_SCN_TYPE_NOLOAD 0x00000002 // Reserved.
703// IMAGE_SCN_TYPE_GROUP 0x00000004 // Reserved.
704/// Reserved.
705pub const IMAGE_SCN_TYPE_NO_PAD: u32 = 0x0000_0008;
706// IMAGE_SCN_TYPE_COPY 0x00000010 // Reserved.
707
708/// Section contains code.
709pub const IMAGE_SCN_CNT_CODE: u32 = 0x0000_0020;
710/// Section contains initialized data.
711pub const IMAGE_SCN_CNT_INITIALIZED_DATA: u32 = 0x0000_0040;
712/// Section contains uninitialized data.
713pub const IMAGE_SCN_CNT_UNINITIALIZED_DATA: u32 = 0x0000_0080;
714
715/// Reserved.
716pub const IMAGE_SCN_LNK_OTHER: u32 = 0x0000_0100;
717/// Section contains comments or some other type of information.
718pub const IMAGE_SCN_LNK_INFO: u32 = 0x0000_0200;
719// IMAGE_SCN_TYPE_OVER 0x00000400 // Reserved.
720/// Section contents will not become part of image.
721pub const IMAGE_SCN_LNK_REMOVE: u32 = 0x0000_0800;
722/// Section contents comdat.
723pub const IMAGE_SCN_LNK_COMDAT: u32 = 0x0000_1000;
724// 0x00002000 // Reserved.
725// IMAGE_SCN_MEM_PROTECTED - Obsolete 0x00004000
726/// Reset speculative exceptions handling bits in the TLB entries for this section.
727pub const IMAGE_SCN_NO_DEFER_SPEC_EXC: u32 = 0x0000_4000;
728/// Section content can be accessed relative to GP
729pub const IMAGE_SCN_GPREL: u32 = 0x0000_8000;
730pub const IMAGE_SCN_MEM_FARDATA: u32 = 0x0000_8000;
731// IMAGE_SCN_MEM_SYSHEAP - Obsolete 0x00010000
732pub const IMAGE_SCN_MEM_PURGEABLE: u32 = 0x0002_0000;
733pub const IMAGE_SCN_MEM_16BIT: u32 = 0x0002_0000;
734pub const IMAGE_SCN_MEM_LOCKED: u32 = 0x0004_0000;
735pub const IMAGE_SCN_MEM_PRELOAD: u32 = 0x0008_0000;
736
737pub const IMAGE_SCN_ALIGN_1BYTES: u32 = 0x0010_0000;
738pub const IMAGE_SCN_ALIGN_2BYTES: u32 = 0x0020_0000;
739pub const IMAGE_SCN_ALIGN_4BYTES: u32 = 0x0030_0000;
740pub const IMAGE_SCN_ALIGN_8BYTES: u32 = 0x0040_0000;
741/// Default alignment if no others are specified.
742pub const IMAGE_SCN_ALIGN_16BYTES: u32 = 0x0050_0000;
743pub const IMAGE_SCN_ALIGN_32BYTES: u32 = 0x0060_0000;
744pub const IMAGE_SCN_ALIGN_64BYTES: u32 = 0x0070_0000;
745pub const IMAGE_SCN_ALIGN_128BYTES: u32 = 0x0080_0000;
746pub const IMAGE_SCN_ALIGN_256BYTES: u32 = 0x0090_0000;
747pub const IMAGE_SCN_ALIGN_512BYTES: u32 = 0x00A0_0000;
748pub const IMAGE_SCN_ALIGN_1024BYTES: u32 = 0x00B0_0000;
749pub const IMAGE_SCN_ALIGN_2048BYTES: u32 = 0x00C0_0000;
750pub const IMAGE_SCN_ALIGN_4096BYTES: u32 = 0x00D0_0000;
751pub const IMAGE_SCN_ALIGN_8192BYTES: u32 = 0x00E0_0000;
752// Unused 0x00F0_0000
753pub const IMAGE_SCN_ALIGN_MASK: u32 = 0x00F0_0000;
754
755/// Section contains extended relocations.
756pub const IMAGE_SCN_LNK_NRELOC_OVFL: u32 = 0x0100_0000;
757/// Section can be discarded.
758pub const IMAGE_SCN_MEM_DISCARDABLE: u32 = 0x0200_0000;
759/// Section is not cachable.
760pub const IMAGE_SCN_MEM_NOT_CACHED: u32 = 0x0400_0000;
761/// Section is not pageable.
762pub const IMAGE_SCN_MEM_NOT_PAGED: u32 = 0x0800_0000;
763/// Section is shareable.
764pub const IMAGE_SCN_MEM_SHARED: u32 = 0x1000_0000;
765/// Section is executable.
766pub const IMAGE_SCN_MEM_EXECUTE: u32 = 0x2000_0000;
767/// Section is readable.
768pub const IMAGE_SCN_MEM_READ: u32 = 0x4000_0000;
769/// Section is writeable.
770pub const IMAGE_SCN_MEM_WRITE: u32 = 0x8000_0000;
771
772//
773// TLS Characteristic Flags
774//
775/// Tls index is scaled
776pub const IMAGE_SCN_SCALE_INDEX: u32 = 0x0000_0001;
777
778//
779// Symbol format.
780//
781
782// This struct has alignment 1.
783#[derive(Debug, Clone, Copy)]
784#[repr(C)]
785pub struct ImageSymbol {
786 /// If first 4 bytes are 0, then second 4 bytes are offset into string table.
787 pub name: [u8; 8],
788 pub value: U32Bytes<LE>,
789 pub section_number: U16Bytes<LE>,
790 pub typ: U16Bytes<LE>,
791 pub storage_class: u8,
792 pub number_of_aux_symbols: u8,
793}
794
795pub const IMAGE_SIZEOF_SYMBOL: usize = 18;
796
797#[derive(Debug, Clone, Copy)]
798#[repr(C)]
799pub struct ImageSymbolBytes(pub [u8; IMAGE_SIZEOF_SYMBOL]);
800
801// This struct has alignment 1.
802#[derive(Debug, Clone, Copy)]
803#[repr(C)]
804pub struct ImageSymbolEx {
805 /// If first 4 bytes are 0, then second 4 bytes are offset into string table.
806 pub name: [u8; 8],
807 pub value: U32Bytes<LE>,
808 pub section_number: U32Bytes<LE>,
809 pub typ: U16Bytes<LE>,
810 pub storage_class: u8,
811 pub number_of_aux_symbols: u8,
812}
813
814pub const IMAGE_SIZEOF_SYMBOL_EX: usize = 20;
815
816#[derive(Debug, Clone, Copy)]
817#[repr(C)]
818pub struct ImageSymbolExBytes(pub [u8; IMAGE_SIZEOF_SYMBOL_EX]);
819
820// Values for `ImageSymbol::section_number`.
821//
822// Symbols have a section number of the section in which they are
823// defined. Otherwise, section numbers have the following meanings:
824
825/// Symbol is undefined or is common.
826pub const IMAGE_SYM_UNDEFINED: u16 = 0;
827/// Symbol is an absolute value.
828pub const IMAGE_SYM_ABSOLUTE: u16 = 0xffff;
829/// Symbol is a special debug item.
830pub const IMAGE_SYM_DEBUG: u16 = 0xfffe;
831/// Values 0xFF00-0xFFFF are special
832pub const IMAGE_SYM_SECTION_MAX: u16 = 0xFEFF;
833pub const IMAGE_SYM_SECTION_MAX_EX: u32 = 0x7fff_ffff;
834
835// Values for `ImageSymbol::typ` (basic component).
836
837/// no type.
838pub const IMAGE_SYM_TYPE_NULL: u16 = 0x0000;
839pub const IMAGE_SYM_TYPE_VOID: u16 = 0x0001;
840/// type character.
841pub const IMAGE_SYM_TYPE_CHAR: u16 = 0x0002;
842/// type short integer.
843pub const IMAGE_SYM_TYPE_SHORT: u16 = 0x0003;
844pub const IMAGE_SYM_TYPE_INT: u16 = 0x0004;
845pub const IMAGE_SYM_TYPE_LONG: u16 = 0x0005;
846pub const IMAGE_SYM_TYPE_FLOAT: u16 = 0x0006;
847pub const IMAGE_SYM_TYPE_DOUBLE: u16 = 0x0007;
848pub const IMAGE_SYM_TYPE_STRUCT: u16 = 0x0008;
849pub const IMAGE_SYM_TYPE_UNION: u16 = 0x0009;
850/// enumeration.
851pub const IMAGE_SYM_TYPE_ENUM: u16 = 0x000A;
852/// member of enumeration.
853pub const IMAGE_SYM_TYPE_MOE: u16 = 0x000B;
854pub const IMAGE_SYM_TYPE_BYTE: u16 = 0x000C;
855pub const IMAGE_SYM_TYPE_WORD: u16 = 0x000D;
856pub const IMAGE_SYM_TYPE_UINT: u16 = 0x000E;
857pub const IMAGE_SYM_TYPE_DWORD: u16 = 0x000F;
858pub const IMAGE_SYM_TYPE_PCODE: u16 = 0x8000;
859
860// Values for `ImageSymbol::typ` (derived component).
861
862/// no derived type.
863pub const IMAGE_SYM_DTYPE_NULL: u16 = 0;
864/// pointer.
865pub const IMAGE_SYM_DTYPE_POINTER: u16 = 1;
866/// function.
867pub const IMAGE_SYM_DTYPE_FUNCTION: u16 = 2;
868/// array.
869pub const IMAGE_SYM_DTYPE_ARRAY: u16 = 3;
870
871// Values for `ImageSymbol::storage_class`.
872pub const IMAGE_SYM_CLASS_END_OF_FUNCTION: u8 = 0xff;
873pub const IMAGE_SYM_CLASS_NULL: u8 = 0x00;
874pub const IMAGE_SYM_CLASS_AUTOMATIC: u8 = 0x01;
875pub const IMAGE_SYM_CLASS_EXTERNAL: u8 = 0x02;
876pub const IMAGE_SYM_CLASS_STATIC: u8 = 0x03;
877pub const IMAGE_SYM_CLASS_REGISTER: u8 = 0x04;
878pub const IMAGE_SYM_CLASS_EXTERNAL_DEF: u8 = 0x05;
879pub const IMAGE_SYM_CLASS_LABEL: u8 = 0x06;
880pub const IMAGE_SYM_CLASS_UNDEFINED_LABEL: u8 = 0x07;
881pub const IMAGE_SYM_CLASS_MEMBER_OF_STRUCT: u8 = 0x08;
882pub const IMAGE_SYM_CLASS_ARGUMENT: u8 = 0x09;
883pub const IMAGE_SYM_CLASS_STRUCT_TAG: u8 = 0x0A;
884pub const IMAGE_SYM_CLASS_MEMBER_OF_UNION: u8 = 0x0B;
885pub const IMAGE_SYM_CLASS_UNION_TAG: u8 = 0x0C;
886pub const IMAGE_SYM_CLASS_TYPE_DEFINITION: u8 = 0x0D;
887pub const IMAGE_SYM_CLASS_UNDEFINED_STATIC: u8 = 0x0E;
888pub const IMAGE_SYM_CLASS_ENUM_TAG: u8 = 0x0F;
889pub const IMAGE_SYM_CLASS_MEMBER_OF_ENUM: u8 = 0x10;
890pub const IMAGE_SYM_CLASS_REGISTER_PARAM: u8 = 0x11;
891pub const IMAGE_SYM_CLASS_BIT_FIELD: u8 = 0x12;
892
893pub const IMAGE_SYM_CLASS_FAR_EXTERNAL: u8 = 0x44;
894
895pub const IMAGE_SYM_CLASS_BLOCK: u8 = 0x64;
896pub const IMAGE_SYM_CLASS_FUNCTION: u8 = 0x65;
897pub const IMAGE_SYM_CLASS_END_OF_STRUCT: u8 = 0x66;
898pub const IMAGE_SYM_CLASS_FILE: u8 = 0x67;
899// new
900pub const IMAGE_SYM_CLASS_SECTION: u8 = 0x68;
901pub const IMAGE_SYM_CLASS_WEAK_EXTERNAL: u8 = 0x69;
902
903pub const IMAGE_SYM_CLASS_CLR_TOKEN: u8 = 0x6B;
904
905// type packing constants
906
907pub const N_BTMASK: u16 = 0x000F;
908pub const N_TMASK: u16 = 0x0030;
909pub const N_TMASK1: u16 = 0x00C0;
910pub const N_TMASK2: u16 = 0x00F0;
911pub const N_BTSHFT: usize = 4;
912pub const N_TSHIFT: usize = 2;
913
914pub const IMAGE_SYM_DTYPE_SHIFT: usize = N_BTSHFT;
915
916impl ImageSymbol {
917 #[inline]
918 pub fn base_type(&self) -> u16 {
919 self.typ.get(LE) & N_BTMASK
920 }
921
922 #[inline]
923 pub fn derived_type(&self) -> u16 {
924 (self.typ.get(LE) & N_TMASK) >> N_BTSHFT
925 }
926}
927
928impl ImageSymbolEx {
929 #[inline]
930 pub fn base_type(&self) -> u16 {
931 self.typ.get(LE) & N_BTMASK
932 }
933
934 #[inline]
935 pub fn derived_type(&self) -> u16 {
936 (self.typ.get(LE) & N_TMASK) >> N_BTSHFT
937 }
938}
939
940//
941// Auxiliary entry format.
942//
943
944// Used for both ImageSymbol and ImageSymbolEx (with padding).
945// This struct has alignment 1.
946#[derive(Debug, Clone, Copy)]
947#[repr(C)]
948pub struct ImageAuxSymbolTokenDef {
949 /// IMAGE_AUX_SYMBOL_TYPE
950 pub aux_type: u8,
951 /// Must be 0
952 pub reserved1: u8,
953 pub symbol_table_index: U32Bytes<LE>,
954 /// Must be 0
955 pub reserved2: [u8; 12],
956}
957
958pub const IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF: u16 = 1;
959
960/// Auxiliary symbol format 1: function definitions.
961// This struct has alignment 1.
962#[derive(Debug, Clone, Copy)]
963#[repr(C)]
964pub struct ImageAuxSymbolFunction {
965 pub tag_index: U32Bytes<LE>,
966 pub total_size: U32Bytes<LE>,
967 pub pointer_to_linenumber: U32Bytes<LE>,
968 pub pointer_to_next_function: U32Bytes<LE>,
969 pub unused: [u8; 2],
970}
971
972/// Auxiliary symbol format 2: .bf and .ef symbols.
973// This struct has alignment 1.
974#[derive(Debug, Clone, Copy)]
975#[repr(C)]
976pub struct ImageAuxSymbolFunctionBeginEnd {
977 pub unused1: [u8; 4],
978 /// declaration line number
979 pub linenumber: U16Bytes<LE>,
980 pub unused2: [u8; 6],
981 pub pointer_to_next_function: U32Bytes<LE>,
982 pub unused3: [u8; 2],
983}
984
985/// Auxiliary symbol format 3: weak externals.
986///
987/// Used for both `ImageSymbol` and `ImageSymbolEx` (both with padding).
988// This struct has alignment 1.
989#[derive(Debug, Clone, Copy)]
990#[repr(C)]
991pub struct ImageAuxSymbolWeak {
992 /// the weak extern default symbol index
993 pub weak_default_sym_index: U32Bytes<LE>,
994 pub weak_search_type: U32Bytes<LE>,
995}
996
997/// Auxiliary symbol format 5: sections.
998///
999/// Used for both `ImageSymbol` and `ImageSymbolEx` (with padding).
1000// This struct has alignment 1.
1001#[derive(Debug, Clone, Copy)]
1002#[repr(C)]
1003pub struct ImageAuxSymbolSection {
1004 /// section length
1005 pub length: U32Bytes<LE>,
1006 /// number of relocation entries
1007 pub number_of_relocations: U16Bytes<LE>,
1008 /// number of line numbers
1009 pub number_of_linenumbers: U16Bytes<LE>,
1010 /// checksum for communal
1011 pub check_sum: U32Bytes<LE>,
1012 /// section number to associate with
1013 pub number: U16Bytes<LE>,
1014 /// communal selection type
1015 pub selection: u8,
1016 pub reserved: u8,
1017 /// high bits of the section number
1018 pub high_number: U16Bytes<LE>,
1019}
1020
1021// Used for both ImageSymbol and ImageSymbolEx (both with padding).
1022// This struct has alignment 1.
1023#[derive(Debug, Clone, Copy)]
1024#[repr(C)]
1025pub struct ImageAuxSymbolCrc {
1026 pub crc: U32Bytes<LE>,
1027}
1028
1029//
1030// Communal selection types.
1031//
1032
1033pub const IMAGE_COMDAT_SELECT_NODUPLICATES: u8 = 1;
1034pub const IMAGE_COMDAT_SELECT_ANY: u8 = 2;
1035pub const IMAGE_COMDAT_SELECT_SAME_SIZE: u8 = 3;
1036pub const IMAGE_COMDAT_SELECT_EXACT_MATCH: u8 = 4;
1037pub const IMAGE_COMDAT_SELECT_ASSOCIATIVE: u8 = 5;
1038pub const IMAGE_COMDAT_SELECT_LARGEST: u8 = 6;
1039pub const IMAGE_COMDAT_SELECT_NEWEST: u8 = 7;
1040
1041pub const IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY: u16 = 1;
1042pub const IMAGE_WEAK_EXTERN_SEARCH_LIBRARY: u16 = 2;
1043pub const IMAGE_WEAK_EXTERN_SEARCH_ALIAS: u16 = 3;
1044pub const IMAGE_WEAK_EXTERN_ANTI_DEPENDENCY: u16 = 4;
1045
1046//
1047// Relocation format.
1048//
1049
1050// This struct has alignment 1.
1051#[derive(Debug, Clone, Copy)]
1052#[repr(C)]
1053pub struct ImageRelocation {
1054 /// Also `RelocCount` when IMAGE_SCN_LNK_NRELOC_OVFL is set
1055 pub virtual_address: U32Bytes<LE>,
1056 pub symbol_table_index: U32Bytes<LE>,
1057 pub typ: U16Bytes<LE>,
1058}
1059
1060//
1061// I386 relocation types.
1062//
1063/// Reference is absolute, no relocation is necessary
1064pub const IMAGE_REL_I386_ABSOLUTE: u16 = 0x0000;
1065/// Direct 16-bit reference to the symbols virtual address
1066pub const IMAGE_REL_I386_DIR16: u16 = 0x0001;
1067/// PC-relative 16-bit reference to the symbols virtual address
1068pub const IMAGE_REL_I386_REL16: u16 = 0x0002;
1069/// Direct 32-bit reference to the symbols virtual address
1070pub const IMAGE_REL_I386_DIR32: u16 = 0x0006;
1071/// Direct 32-bit reference to the symbols virtual address, base not included
1072pub const IMAGE_REL_I386_DIR32NB: u16 = 0x0007;
1073/// Direct 16-bit reference to the segment-selector bits of a 32-bit virtual address
1074pub const IMAGE_REL_I386_SEG12: u16 = 0x0009;
1075pub const IMAGE_REL_I386_SECTION: u16 = 0x000A;
1076pub const IMAGE_REL_I386_SECREL: u16 = 0x000B;
1077/// clr token
1078pub const IMAGE_REL_I386_TOKEN: u16 = 0x000C;
1079/// 7 bit offset from base of section containing target
1080pub const IMAGE_REL_I386_SECREL7: u16 = 0x000D;
1081/// PC-relative 32-bit reference to the symbols virtual address
1082pub const IMAGE_REL_I386_REL32: u16 = 0x0014;
1083
1084//
1085// MIPS relocation types.
1086//
1087/// Reference is absolute, no relocation is necessary
1088pub const IMAGE_REL_MIPS_ABSOLUTE: u16 = 0x0000;
1089pub const IMAGE_REL_MIPS_REFHALF: u16 = 0x0001;
1090pub const IMAGE_REL_MIPS_REFWORD: u16 = 0x0002;
1091pub const IMAGE_REL_MIPS_JMPADDR: u16 = 0x0003;
1092pub const IMAGE_REL_MIPS_REFHI: u16 = 0x0004;
1093pub const IMAGE_REL_MIPS_REFLO: u16 = 0x0005;
1094pub const IMAGE_REL_MIPS_GPREL: u16 = 0x0006;
1095pub const IMAGE_REL_MIPS_LITERAL: u16 = 0x0007;
1096pub const IMAGE_REL_MIPS_SECTION: u16 = 0x000A;
1097pub const IMAGE_REL_MIPS_SECREL: u16 = 0x000B;
1098/// Low 16-bit section relative referemce (used for >32k TLS)
1099pub const IMAGE_REL_MIPS_SECRELLO: u16 = 0x000C;
1100/// High 16-bit section relative reference (used for >32k TLS)
1101pub const IMAGE_REL_MIPS_SECRELHI: u16 = 0x000D;
1102/// clr token
1103pub const IMAGE_REL_MIPS_TOKEN: u16 = 0x000E;
1104pub const IMAGE_REL_MIPS_JMPADDR16: u16 = 0x0010;
1105pub const IMAGE_REL_MIPS_REFWORDNB: u16 = 0x0022;
1106pub const IMAGE_REL_MIPS_PAIR: u16 = 0x0025;
1107
1108//
1109// Alpha Relocation types.
1110//
1111pub const IMAGE_REL_ALPHA_ABSOLUTE: u16 = 0x0000;
1112pub const IMAGE_REL_ALPHA_REFLONG: u16 = 0x0001;
1113pub const IMAGE_REL_ALPHA_REFQUAD: u16 = 0x0002;
1114pub const IMAGE_REL_ALPHA_GPREL32: u16 = 0x0003;
1115pub const IMAGE_REL_ALPHA_LITERAL: u16 = 0x0004;
1116pub const IMAGE_REL_ALPHA_LITUSE: u16 = 0x0005;
1117pub const IMAGE_REL_ALPHA_GPDISP: u16 = 0x0006;
1118pub const IMAGE_REL_ALPHA_BRADDR: u16 = 0x0007;
1119pub const IMAGE_REL_ALPHA_HINT: u16 = 0x0008;
1120pub const IMAGE_REL_ALPHA_INLINE_REFLONG: u16 = 0x0009;
1121pub const IMAGE_REL_ALPHA_REFHI: u16 = 0x000A;
1122pub const IMAGE_REL_ALPHA_REFLO: u16 = 0x000B;
1123pub const IMAGE_REL_ALPHA_PAIR: u16 = 0x000C;
1124pub const IMAGE_REL_ALPHA_MATCH: u16 = 0x000D;
1125pub const IMAGE_REL_ALPHA_SECTION: u16 = 0x000E;
1126pub const IMAGE_REL_ALPHA_SECREL: u16 = 0x000F;
1127pub const IMAGE_REL_ALPHA_REFLONGNB: u16 = 0x0010;
1128/// Low 16-bit section relative reference
1129pub const IMAGE_REL_ALPHA_SECRELLO: u16 = 0x0011;
1130/// High 16-bit section relative reference
1131pub const IMAGE_REL_ALPHA_SECRELHI: u16 = 0x0012;
1132/// High 16 bits of 48 bit reference
1133pub const IMAGE_REL_ALPHA_REFQ3: u16 = 0x0013;
1134/// Middle 16 bits of 48 bit reference
1135pub const IMAGE_REL_ALPHA_REFQ2: u16 = 0x0014;
1136/// Low 16 bits of 48 bit reference
1137pub const IMAGE_REL_ALPHA_REFQ1: u16 = 0x0015;
1138/// Low 16-bit GP relative reference
1139pub const IMAGE_REL_ALPHA_GPRELLO: u16 = 0x0016;
1140/// High 16-bit GP relative reference
1141pub const IMAGE_REL_ALPHA_GPRELHI: u16 = 0x0017;
1142
1143//
1144// IBM PowerPC relocation types.
1145//
1146/// NOP
1147pub const IMAGE_REL_PPC_ABSOLUTE: u16 = 0x0000;
1148/// 64-bit address
1149pub const IMAGE_REL_PPC_ADDR64: u16 = 0x0001;
1150/// 32-bit address
1151pub const IMAGE_REL_PPC_ADDR32: u16 = 0x0002;
1152/// 26-bit address, shifted left 2 (branch absolute)
1153pub const IMAGE_REL_PPC_ADDR24: u16 = 0x0003;
1154/// 16-bit address
1155pub const IMAGE_REL_PPC_ADDR16: u16 = 0x0004;
1156/// 16-bit address, shifted left 2 (load doubleword)
1157pub const IMAGE_REL_PPC_ADDR14: u16 = 0x0005;
1158/// 26-bit PC-relative offset, shifted left 2 (branch relative)
1159pub const IMAGE_REL_PPC_REL24: u16 = 0x0006;
1160/// 16-bit PC-relative offset, shifted left 2 (br cond relative)
1161pub const IMAGE_REL_PPC_REL14: u16 = 0x0007;
1162/// 16-bit offset from TOC base
1163pub const IMAGE_REL_PPC_TOCREL16: u16 = 0x0008;
1164/// 16-bit offset from TOC base, shifted left 2 (load doubleword)
1165pub const IMAGE_REL_PPC_TOCREL14: u16 = 0x0009;
1166
1167/// 32-bit addr w/o image base
1168pub const IMAGE_REL_PPC_ADDR32NB: u16 = 0x000A;
1169/// va of containing section (as in an image sectionhdr)
1170pub const IMAGE_REL_PPC_SECREL: u16 = 0x000B;
1171/// sectionheader number
1172pub const IMAGE_REL_PPC_SECTION: u16 = 0x000C;
1173/// substitute TOC restore instruction iff symbol is glue code
1174pub const IMAGE_REL_PPC_IFGLUE: u16 = 0x000D;
1175/// symbol is glue code; virtual address is TOC restore instruction
1176pub const IMAGE_REL_PPC_IMGLUE: u16 = 0x000E;
1177/// va of containing section (limited to 16 bits)
1178pub const IMAGE_REL_PPC_SECREL16: u16 = 0x000F;
1179pub const IMAGE_REL_PPC_REFHI: u16 = 0x0010;
1180pub const IMAGE_REL_PPC_REFLO: u16 = 0x0011;
1181pub const IMAGE_REL_PPC_PAIR: u16 = 0x0012;
1182/// Low 16-bit section relative reference (used for >32k TLS)
1183pub const IMAGE_REL_PPC_SECRELLO: u16 = 0x0013;
1184/// High 16-bit section relative reference (used for >32k TLS)
1185pub const IMAGE_REL_PPC_SECRELHI: u16 = 0x0014;
1186pub const IMAGE_REL_PPC_GPREL: u16 = 0x0015;
1187/// clr token
1188pub const IMAGE_REL_PPC_TOKEN: u16 = 0x0016;
1189
1190/// mask to isolate above values in IMAGE_RELOCATION.Type
1191pub const IMAGE_REL_PPC_TYPEMASK: u16 = 0x00FF;
1192
1193// Flag bits in `ImageRelocation::typ`.
1194
1195/// subtract reloc value rather than adding it
1196pub const IMAGE_REL_PPC_NEG: u16 = 0x0100;
1197/// fix branch prediction bit to predict branch taken
1198pub const IMAGE_REL_PPC_BRTAKEN: u16 = 0x0200;
1199/// fix branch prediction bit to predict branch not taken
1200pub const IMAGE_REL_PPC_BRNTAKEN: u16 = 0x0400;
1201/// toc slot defined in file (or, data in toc)
1202pub const IMAGE_REL_PPC_TOCDEFN: u16 = 0x0800;
1203
1204//
1205// Hitachi SH3 relocation types.
1206//
1207/// No relocation
1208pub const IMAGE_REL_SH3_ABSOLUTE: u16 = 0x0000;
1209/// 16 bit direct
1210pub const IMAGE_REL_SH3_DIRECT16: u16 = 0x0001;
1211/// 32 bit direct
1212pub const IMAGE_REL_SH3_DIRECT32: u16 = 0x0002;
1213/// 8 bit direct, -128..255
1214pub const IMAGE_REL_SH3_DIRECT8: u16 = 0x0003;
1215/// 8 bit direct .W (0 ext.)
1216pub const IMAGE_REL_SH3_DIRECT8_WORD: u16 = 0x0004;
1217/// 8 bit direct .L (0 ext.)
1218pub const IMAGE_REL_SH3_DIRECT8_LONG: u16 = 0x0005;
1219/// 4 bit direct (0 ext.)
1220pub const IMAGE_REL_SH3_DIRECT4: u16 = 0x0006;
1221/// 4 bit direct .W (0 ext.)
1222pub const IMAGE_REL_SH3_DIRECT4_WORD: u16 = 0x0007;
1223/// 4 bit direct .L (0 ext.)
1224pub const IMAGE_REL_SH3_DIRECT4_LONG: u16 = 0x0008;
1225/// 8 bit PC relative .W
1226pub const IMAGE_REL_SH3_PCREL8_WORD: u16 = 0x0009;
1227/// 8 bit PC relative .L
1228pub const IMAGE_REL_SH3_PCREL8_LONG: u16 = 0x000A;
1229/// 12 LSB PC relative .W
1230pub const IMAGE_REL_SH3_PCREL12_WORD: u16 = 0x000B;
1231/// Start of EXE section
1232pub const IMAGE_REL_SH3_STARTOF_SECTION: u16 = 0x000C;
1233/// Size of EXE section
1234pub const IMAGE_REL_SH3_SIZEOF_SECTION: u16 = 0x000D;
1235/// Section table index
1236pub const IMAGE_REL_SH3_SECTION: u16 = 0x000E;
1237/// Offset within section
1238pub const IMAGE_REL_SH3_SECREL: u16 = 0x000F;
1239/// 32 bit direct not based
1240pub const IMAGE_REL_SH3_DIRECT32_NB: u16 = 0x0010;
1241/// GP-relative addressing
1242pub const IMAGE_REL_SH3_GPREL4_LONG: u16 = 0x0011;
1243/// clr token
1244pub const IMAGE_REL_SH3_TOKEN: u16 = 0x0012;
1245/// Offset from current instruction in longwords
1246/// if not NOMODE, insert the inverse of the low bit at bit 32 to select PTA/PTB
1247pub const IMAGE_REL_SHM_PCRELPT: u16 = 0x0013;
1248/// Low bits of 32-bit address
1249pub const IMAGE_REL_SHM_REFLO: u16 = 0x0014;
1250/// High bits of 32-bit address
1251pub const IMAGE_REL_SHM_REFHALF: u16 = 0x0015;
1252/// Low bits of relative reference
1253pub const IMAGE_REL_SHM_RELLO: u16 = 0x0016;
1254/// High bits of relative reference
1255pub const IMAGE_REL_SHM_RELHALF: u16 = 0x0017;
1256/// offset operand for relocation
1257pub const IMAGE_REL_SHM_PAIR: u16 = 0x0018;
1258
1259/// relocation ignores section mode
1260pub const IMAGE_REL_SH_NOMODE: u16 = 0x8000;
1261
1262/// No relocation required
1263pub const IMAGE_REL_ARM_ABSOLUTE: u16 = 0x0000;
1264/// 32 bit address
1265pub const IMAGE_REL_ARM_ADDR32: u16 = 0x0001;
1266/// 32 bit address w/o image base
1267pub const IMAGE_REL_ARM_ADDR32NB: u16 = 0x0002;
1268/// 24 bit offset << 2 & sign ext.
1269pub const IMAGE_REL_ARM_BRANCH24: u16 = 0x0003;
1270/// Thumb: 2 11 bit offsets
1271pub const IMAGE_REL_ARM_BRANCH11: u16 = 0x0004;
1272/// clr token
1273pub const IMAGE_REL_ARM_TOKEN: u16 = 0x0005;
1274/// GP-relative addressing (ARM)
1275pub const IMAGE_REL_ARM_GPREL12: u16 = 0x0006;
1276/// GP-relative addressing (Thumb)
1277pub const IMAGE_REL_ARM_GPREL7: u16 = 0x0007;
1278pub const IMAGE_REL_ARM_BLX24: u16 = 0x0008;
1279pub const IMAGE_REL_ARM_BLX11: u16 = 0x0009;
04454e1e
FG
1280/// 32-bit relative address from byte following reloc
1281pub const IMAGE_REL_ARM_REL32: u16 = 0x000A;
a2a8927a
XL
1282/// Section table index
1283pub const IMAGE_REL_ARM_SECTION: u16 = 0x000E;
1284/// Offset within section
1285pub const IMAGE_REL_ARM_SECREL: u16 = 0x000F;
1286/// ARM: MOVW/MOVT
1287pub const IMAGE_REL_ARM_MOV32A: u16 = 0x0010;
1288/// ARM: MOVW/MOVT (deprecated)
1289pub const IMAGE_REL_ARM_MOV32: u16 = 0x0010;
1290/// Thumb: MOVW/MOVT
1291pub const IMAGE_REL_ARM_MOV32T: u16 = 0x0011;
1292/// Thumb: MOVW/MOVT (deprecated)
1293pub const IMAGE_REL_THUMB_MOV32: u16 = 0x0011;
1294/// Thumb: 32-bit conditional B
1295pub const IMAGE_REL_ARM_BRANCH20T: u16 = 0x0012;
1296/// Thumb: 32-bit conditional B (deprecated)
1297pub const IMAGE_REL_THUMB_BRANCH20: u16 = 0x0012;
1298/// Thumb: 32-bit B or BL
1299pub const IMAGE_REL_ARM_BRANCH24T: u16 = 0x0014;
1300/// Thumb: 32-bit B or BL (deprecated)
1301pub const IMAGE_REL_THUMB_BRANCH24: u16 = 0x0014;
1302/// Thumb: BLX immediate
1303pub const IMAGE_REL_ARM_BLX23T: u16 = 0x0015;
1304/// Thumb: BLX immediate (deprecated)
1305pub const IMAGE_REL_THUMB_BLX23: u16 = 0x0015;
1306
1307pub const IMAGE_REL_AM_ABSOLUTE: u16 = 0x0000;
1308pub const IMAGE_REL_AM_ADDR32: u16 = 0x0001;
1309pub const IMAGE_REL_AM_ADDR32NB: u16 = 0x0002;
1310pub const IMAGE_REL_AM_CALL32: u16 = 0x0003;
1311pub const IMAGE_REL_AM_FUNCINFO: u16 = 0x0004;
1312pub const IMAGE_REL_AM_REL32_1: u16 = 0x0005;
1313pub const IMAGE_REL_AM_REL32_2: u16 = 0x0006;
1314pub const IMAGE_REL_AM_SECREL: u16 = 0x0007;
1315pub const IMAGE_REL_AM_SECTION: u16 = 0x0008;
1316pub const IMAGE_REL_AM_TOKEN: u16 = 0x0009;
1317
1318//
1319// ARM64 relocations types.
1320//
1321
1322/// No relocation required
1323pub const IMAGE_REL_ARM64_ABSOLUTE: u16 = 0x0000;
1324/// 32 bit address. Review! do we need it?
1325pub const IMAGE_REL_ARM64_ADDR32: u16 = 0x0001;
1326/// 32 bit address w/o image base (RVA: for Data/PData/XData)
1327pub const IMAGE_REL_ARM64_ADDR32NB: u16 = 0x0002;
1328/// 26 bit offset << 2 & sign ext. for B & BL
1329pub const IMAGE_REL_ARM64_BRANCH26: u16 = 0x0003;
1330/// ADRP
1331pub const IMAGE_REL_ARM64_PAGEBASE_REL21: u16 = 0x0004;
1332/// ADR
1333pub const IMAGE_REL_ARM64_REL21: u16 = 0x0005;
1334/// ADD/ADDS (immediate) with zero shift, for page offset
1335pub const IMAGE_REL_ARM64_PAGEOFFSET_12A: u16 = 0x0006;
1336/// LDR (indexed, unsigned immediate), for page offset
1337pub const IMAGE_REL_ARM64_PAGEOFFSET_12L: u16 = 0x0007;
1338/// Offset within section
1339pub const IMAGE_REL_ARM64_SECREL: u16 = 0x0008;
1340/// ADD/ADDS (immediate) with zero shift, for bit 0:11 of section offset
1341pub const IMAGE_REL_ARM64_SECREL_LOW12A: u16 = 0x0009;
1342/// ADD/ADDS (immediate) with zero shift, for bit 12:23 of section offset
1343pub const IMAGE_REL_ARM64_SECREL_HIGH12A: u16 = 0x000A;
1344/// LDR (indexed, unsigned immediate), for bit 0:11 of section offset
1345pub const IMAGE_REL_ARM64_SECREL_LOW12L: u16 = 0x000B;
1346pub const IMAGE_REL_ARM64_TOKEN: u16 = 0x000C;
1347/// Section table index
1348pub const IMAGE_REL_ARM64_SECTION: u16 = 0x000D;
1349/// 64 bit address
1350pub const IMAGE_REL_ARM64_ADDR64: u16 = 0x000E;
1351/// 19 bit offset << 2 & sign ext. for conditional B
1352pub const IMAGE_REL_ARM64_BRANCH19: u16 = 0x000F;
04454e1e
FG
1353/// TBZ/TBNZ
1354pub const IMAGE_REL_ARM64_BRANCH14: u16 = 0x0010;
1355/// 32-bit relative address from byte following reloc
1356pub const IMAGE_REL_ARM64_REL32: u16 = 0x0011;
a2a8927a
XL
1357
1358//
1359// x64 relocations
1360//
1361/// Reference is absolute, no relocation is necessary
1362pub const IMAGE_REL_AMD64_ABSOLUTE: u16 = 0x0000;
1363/// 64-bit address (VA).
1364pub const IMAGE_REL_AMD64_ADDR64: u16 = 0x0001;
1365/// 32-bit address (VA).
1366pub const IMAGE_REL_AMD64_ADDR32: u16 = 0x0002;
1367/// 32-bit address w/o image base (RVA).
1368pub const IMAGE_REL_AMD64_ADDR32NB: u16 = 0x0003;
1369/// 32-bit relative address from byte following reloc
1370pub const IMAGE_REL_AMD64_REL32: u16 = 0x0004;
1371/// 32-bit relative address from byte distance 1 from reloc
1372pub const IMAGE_REL_AMD64_REL32_1: u16 = 0x0005;
1373/// 32-bit relative address from byte distance 2 from reloc
1374pub const IMAGE_REL_AMD64_REL32_2: u16 = 0x0006;
1375/// 32-bit relative address from byte distance 3 from reloc
1376pub const IMAGE_REL_AMD64_REL32_3: u16 = 0x0007;
1377/// 32-bit relative address from byte distance 4 from reloc
1378pub const IMAGE_REL_AMD64_REL32_4: u16 = 0x0008;
1379/// 32-bit relative address from byte distance 5 from reloc
1380pub const IMAGE_REL_AMD64_REL32_5: u16 = 0x0009;
1381/// Section index
1382pub const IMAGE_REL_AMD64_SECTION: u16 = 0x000A;
1383/// 32 bit offset from base of section containing target
1384pub const IMAGE_REL_AMD64_SECREL: u16 = 0x000B;
1385/// 7 bit unsigned offset from base of section containing target
1386pub const IMAGE_REL_AMD64_SECREL7: u16 = 0x000C;
1387/// 32 bit metadata token
1388pub const IMAGE_REL_AMD64_TOKEN: u16 = 0x000D;
1389/// 32 bit signed span-dependent value emitted into object
1390pub const IMAGE_REL_AMD64_SREL32: u16 = 0x000E;
1391pub const IMAGE_REL_AMD64_PAIR: u16 = 0x000F;
1392/// 32 bit signed span-dependent value applied at link time
1393pub const IMAGE_REL_AMD64_SSPAN32: u16 = 0x0010;
1394pub const IMAGE_REL_AMD64_EHANDLER: u16 = 0x0011;
1395/// Indirect branch to an import
1396pub const IMAGE_REL_AMD64_IMPORT_BR: u16 = 0x0012;
1397/// Indirect call to an import
1398pub const IMAGE_REL_AMD64_IMPORT_CALL: u16 = 0x0013;
1399/// Indirect branch to a CFG check
1400pub const IMAGE_REL_AMD64_CFG_BR: u16 = 0x0014;
1401/// Indirect branch to a CFG check, with REX.W prefix
1402pub const IMAGE_REL_AMD64_CFG_BR_REX: u16 = 0x0015;
1403/// Indirect call to a CFG check
1404pub const IMAGE_REL_AMD64_CFG_CALL: u16 = 0x0016;
1405/// Indirect branch to a target in RAX (no CFG)
1406pub const IMAGE_REL_AMD64_INDIR_BR: u16 = 0x0017;
1407/// Indirect branch to a target in RAX, with REX.W prefix (no CFG)
1408pub const IMAGE_REL_AMD64_INDIR_BR_REX: u16 = 0x0018;
1409/// Indirect call to a target in RAX (no CFG)
1410pub const IMAGE_REL_AMD64_INDIR_CALL: u16 = 0x0019;
1411/// Indirect branch for a switch table using Reg 0 (RAX)
1412pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_FIRST: u16 = 0x0020;
1413/// Indirect branch for a switch table using Reg 15 (R15)
1414pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_LAST: u16 = 0x002F;
1415
1416//
1417// IA64 relocation types.
1418//
1419pub const IMAGE_REL_IA64_ABSOLUTE: u16 = 0x0000;
1420pub const IMAGE_REL_IA64_IMM14: u16 = 0x0001;
1421pub const IMAGE_REL_IA64_IMM22: u16 = 0x0002;
1422pub const IMAGE_REL_IA64_IMM64: u16 = 0x0003;
1423pub const IMAGE_REL_IA64_DIR32: u16 = 0x0004;
1424pub const IMAGE_REL_IA64_DIR64: u16 = 0x0005;
1425pub const IMAGE_REL_IA64_PCREL21B: u16 = 0x0006;
1426pub const IMAGE_REL_IA64_PCREL21M: u16 = 0x0007;
1427pub const IMAGE_REL_IA64_PCREL21F: u16 = 0x0008;
1428pub const IMAGE_REL_IA64_GPREL22: u16 = 0x0009;
1429pub const IMAGE_REL_IA64_LTOFF22: u16 = 0x000A;
1430pub const IMAGE_REL_IA64_SECTION: u16 = 0x000B;
1431pub const IMAGE_REL_IA64_SECREL22: u16 = 0x000C;
1432pub const IMAGE_REL_IA64_SECREL64I: u16 = 0x000D;
1433pub const IMAGE_REL_IA64_SECREL32: u16 = 0x000E;
1434//
1435pub const IMAGE_REL_IA64_DIR32NB: u16 = 0x0010;
1436pub const IMAGE_REL_IA64_SREL14: u16 = 0x0011;
1437pub const IMAGE_REL_IA64_SREL22: u16 = 0x0012;
1438pub const IMAGE_REL_IA64_SREL32: u16 = 0x0013;
1439pub const IMAGE_REL_IA64_UREL32: u16 = 0x0014;
1440/// This is always a BRL and never converted
1441pub const IMAGE_REL_IA64_PCREL60X: u16 = 0x0015;
1442/// If possible, convert to MBB bundle with NOP.B in slot 1
1443pub const IMAGE_REL_IA64_PCREL60B: u16 = 0x0016;
1444/// If possible, convert to MFB bundle with NOP.F in slot 1
1445pub const IMAGE_REL_IA64_PCREL60F: u16 = 0x0017;
1446/// If possible, convert to MIB bundle with NOP.I in slot 1
1447pub const IMAGE_REL_IA64_PCREL60I: u16 = 0x0018;
1448/// If possible, convert to MMB bundle with NOP.M in slot 1
1449pub const IMAGE_REL_IA64_PCREL60M: u16 = 0x0019;
1450pub const IMAGE_REL_IA64_IMMGPREL64: u16 = 0x001A;
1451/// clr token
1452pub const IMAGE_REL_IA64_TOKEN: u16 = 0x001B;
1453pub const IMAGE_REL_IA64_GPREL32: u16 = 0x001C;
1454pub const IMAGE_REL_IA64_ADDEND: u16 = 0x001F;
1455
1456//
1457// CEF relocation types.
1458//
1459/// Reference is absolute, no relocation is necessary
1460pub const IMAGE_REL_CEF_ABSOLUTE: u16 = 0x0000;
1461/// 32-bit address (VA).
1462pub const IMAGE_REL_CEF_ADDR32: u16 = 0x0001;
1463/// 64-bit address (VA).
1464pub const IMAGE_REL_CEF_ADDR64: u16 = 0x0002;
1465/// 32-bit address w/o image base (RVA).
1466pub const IMAGE_REL_CEF_ADDR32NB: u16 = 0x0003;
1467/// Section index
1468pub const IMAGE_REL_CEF_SECTION: u16 = 0x0004;
1469/// 32 bit offset from base of section containing target
1470pub const IMAGE_REL_CEF_SECREL: u16 = 0x0005;
1471/// 32 bit metadata token
1472pub const IMAGE_REL_CEF_TOKEN: u16 = 0x0006;
1473
1474//
1475// clr relocation types.
1476//
1477/// Reference is absolute, no relocation is necessary
1478pub const IMAGE_REL_CEE_ABSOLUTE: u16 = 0x0000;
1479/// 32-bit address (VA).
1480pub const IMAGE_REL_CEE_ADDR32: u16 = 0x0001;
1481/// 64-bit address (VA).
1482pub const IMAGE_REL_CEE_ADDR64: u16 = 0x0002;
1483/// 32-bit address w/o image base (RVA).
1484pub const IMAGE_REL_CEE_ADDR32NB: u16 = 0x0003;
1485/// Section index
1486pub const IMAGE_REL_CEE_SECTION: u16 = 0x0004;
1487/// 32 bit offset from base of section containing target
1488pub const IMAGE_REL_CEE_SECREL: u16 = 0x0005;
1489/// 32 bit metadata token
1490pub const IMAGE_REL_CEE_TOKEN: u16 = 0x0006;
1491
1492/// No relocation required
1493pub const IMAGE_REL_M32R_ABSOLUTE: u16 = 0x0000;
1494/// 32 bit address
1495pub const IMAGE_REL_M32R_ADDR32: u16 = 0x0001;
1496/// 32 bit address w/o image base
1497pub const IMAGE_REL_M32R_ADDR32NB: u16 = 0x0002;
1498/// 24 bit address
1499pub const IMAGE_REL_M32R_ADDR24: u16 = 0x0003;
1500/// GP relative addressing
1501pub const IMAGE_REL_M32R_GPREL16: u16 = 0x0004;
1502/// 24 bit offset << 2 & sign ext.
1503pub const IMAGE_REL_M32R_PCREL24: u16 = 0x0005;
1504/// 16 bit offset << 2 & sign ext.
1505pub const IMAGE_REL_M32R_PCREL16: u16 = 0x0006;
1506/// 8 bit offset << 2 & sign ext.
1507pub const IMAGE_REL_M32R_PCREL8: u16 = 0x0007;
1508/// 16 MSBs
1509pub const IMAGE_REL_M32R_REFHALF: u16 = 0x0008;
1510/// 16 MSBs; adj for LSB sign ext.
1511pub const IMAGE_REL_M32R_REFHI: u16 = 0x0009;
1512/// 16 LSBs
1513pub const IMAGE_REL_M32R_REFLO: u16 = 0x000A;
1514/// Link HI and LO
1515pub const IMAGE_REL_M32R_PAIR: u16 = 0x000B;
1516/// Section table index
1517pub const IMAGE_REL_M32R_SECTION: u16 = 0x000C;
1518/// 32 bit section relative reference
1519pub const IMAGE_REL_M32R_SECREL32: u16 = 0x000D;
1520/// clr token
1521pub const IMAGE_REL_M32R_TOKEN: u16 = 0x000E;
1522
1523/// No relocation required
1524pub const IMAGE_REL_EBC_ABSOLUTE: u16 = 0x0000;
1525/// 32 bit address w/o image base
1526pub const IMAGE_REL_EBC_ADDR32NB: u16 = 0x0001;
1527/// 32-bit relative address from byte following reloc
1528pub const IMAGE_REL_EBC_REL32: u16 = 0x0002;
1529/// Section table index
1530pub const IMAGE_REL_EBC_SECTION: u16 = 0x0003;
1531/// Offset within section
1532pub const IMAGE_REL_EBC_SECREL: u16 = 0x0004;
1533
1534/*
1535// TODO?
1536#define EXT_IMM64(Value, Address, Size, InstPos, ValPos) /* Intel-IA64-Filler */ \
1537 Value |= (((ULONGLONG)((*(Address) >> InstPos) & (((ULONGLONG)1 << Size) - 1))) << ValPos) // Intel-IA64-Filler
1538
1539#define INS_IMM64(Value, Address, Size, InstPos, ValPos) /* Intel-IA64-Filler */\
1540 *(PDWORD)Address = (*(PDWORD)Address & ~(((1 << Size) - 1) << InstPos)) | /* Intel-IA64-Filler */\
1541 ((DWORD)((((ULONGLONG)Value >> ValPos) & (((ULONGLONG)1 << Size) - 1))) << InstPos) // Intel-IA64-Filler
1542*/
1543
1544/// Intel-IA64-Filler
1545pub const EMARCH_ENC_I17_IMM7B_INST_WORD_X: u16 = 3;
1546/// Intel-IA64-Filler
1547pub const EMARCH_ENC_I17_IMM7B_SIZE_X: u16 = 7;
1548/// Intel-IA64-Filler
1549pub const EMARCH_ENC_I17_IMM7B_INST_WORD_POS_X: u16 = 4;
1550/// Intel-IA64-Filler
1551pub const EMARCH_ENC_I17_IMM7B_VAL_POS_X: u16 = 0;
1552
1553/// Intel-IA64-Filler
1554pub const EMARCH_ENC_I17_IMM9D_INST_WORD_X: u16 = 3;
1555/// Intel-IA64-Filler
1556pub const EMARCH_ENC_I17_IMM9D_SIZE_X: u16 = 9;
1557/// Intel-IA64-Filler
1558pub const EMARCH_ENC_I17_IMM9D_INST_WORD_POS_X: u16 = 18;
1559/// Intel-IA64-Filler
1560pub const EMARCH_ENC_I17_IMM9D_VAL_POS_X: u16 = 7;
1561
1562/// Intel-IA64-Filler
1563pub const EMARCH_ENC_I17_IMM5C_INST_WORD_X: u16 = 3;
1564/// Intel-IA64-Filler
1565pub const EMARCH_ENC_I17_IMM5C_SIZE_X: u16 = 5;
1566/// Intel-IA64-Filler
1567pub const EMARCH_ENC_I17_IMM5C_INST_WORD_POS_X: u16 = 13;
1568/// Intel-IA64-Filler
1569pub const EMARCH_ENC_I17_IMM5C_VAL_POS_X: u16 = 16;
1570
1571/// Intel-IA64-Filler
1572pub const EMARCH_ENC_I17_IC_INST_WORD_X: u16 = 3;
1573/// Intel-IA64-Filler
1574pub const EMARCH_ENC_I17_IC_SIZE_X: u16 = 1;
1575/// Intel-IA64-Filler
1576pub const EMARCH_ENC_I17_IC_INST_WORD_POS_X: u16 = 12;
1577/// Intel-IA64-Filler
1578pub const EMARCH_ENC_I17_IC_VAL_POS_X: u16 = 21;
1579
1580/// Intel-IA64-Filler
1581pub const EMARCH_ENC_I17_IMM41A_INST_WORD_X: u16 = 1;
1582/// Intel-IA64-Filler
1583pub const EMARCH_ENC_I17_IMM41A_SIZE_X: u16 = 10;
1584/// Intel-IA64-Filler
1585pub const EMARCH_ENC_I17_IMM41A_INST_WORD_POS_X: u16 = 14;
1586/// Intel-IA64-Filler
1587pub const EMARCH_ENC_I17_IMM41A_VAL_POS_X: u16 = 22;
1588
1589/// Intel-IA64-Filler
1590pub const EMARCH_ENC_I17_IMM41B_INST_WORD_X: u16 = 1;
1591/// Intel-IA64-Filler
1592pub const EMARCH_ENC_I17_IMM41B_SIZE_X: u16 = 8;
1593/// Intel-IA64-Filler
1594pub const EMARCH_ENC_I17_IMM41B_INST_WORD_POS_X: u16 = 24;
1595/// Intel-IA64-Filler
1596pub const EMARCH_ENC_I17_IMM41B_VAL_POS_X: u16 = 32;
1597
1598/// Intel-IA64-Filler
1599pub const EMARCH_ENC_I17_IMM41C_INST_WORD_X: u16 = 2;
1600/// Intel-IA64-Filler
1601pub const EMARCH_ENC_I17_IMM41C_SIZE_X: u16 = 23;
1602/// Intel-IA64-Filler
1603pub const EMARCH_ENC_I17_IMM41C_INST_WORD_POS_X: u16 = 0;
1604/// Intel-IA64-Filler
1605pub const EMARCH_ENC_I17_IMM41C_VAL_POS_X: u16 = 40;
1606
1607/// Intel-IA64-Filler
1608pub const EMARCH_ENC_I17_SIGN_INST_WORD_X: u16 = 3;
1609/// Intel-IA64-Filler
1610pub const EMARCH_ENC_I17_SIGN_SIZE_X: u16 = 1;
1611/// Intel-IA64-Filler
1612pub const EMARCH_ENC_I17_SIGN_INST_WORD_POS_X: u16 = 27;
1613/// Intel-IA64-Filler
1614pub const EMARCH_ENC_I17_SIGN_VAL_POS_X: u16 = 63;
1615
1616/// Intel-IA64-Filler
1617pub const X3_OPCODE_INST_WORD_X: u16 = 3;
1618/// Intel-IA64-Filler
1619pub const X3_OPCODE_SIZE_X: u16 = 4;
1620/// Intel-IA64-Filler
1621pub const X3_OPCODE_INST_WORD_POS_X: u16 = 28;
1622/// Intel-IA64-Filler
1623pub const X3_OPCODE_SIGN_VAL_POS_X: u16 = 0;
1624
1625/// Intel-IA64-Filler
1626pub const X3_I_INST_WORD_X: u16 = 3;
1627/// Intel-IA64-Filler
1628pub const X3_I_SIZE_X: u16 = 1;
1629/// Intel-IA64-Filler
1630pub const X3_I_INST_WORD_POS_X: u16 = 27;
1631/// Intel-IA64-Filler
1632pub const X3_I_SIGN_VAL_POS_X: u16 = 59;
1633
1634/// Intel-IA64-Filler
1635pub const X3_D_WH_INST_WORD_X: u16 = 3;
1636/// Intel-IA64-Filler
1637pub const X3_D_WH_SIZE_X: u16 = 3;
1638/// Intel-IA64-Filler
1639pub const X3_D_WH_INST_WORD_POS_X: u16 = 24;
1640/// Intel-IA64-Filler
1641pub const X3_D_WH_SIGN_VAL_POS_X: u16 = 0;
1642
1643/// Intel-IA64-Filler
1644pub const X3_IMM20_INST_WORD_X: u16 = 3;
1645/// Intel-IA64-Filler
1646pub const X3_IMM20_SIZE_X: u16 = 20;
1647/// Intel-IA64-Filler
1648pub const X3_IMM20_INST_WORD_POS_X: u16 = 4;
1649/// Intel-IA64-Filler
1650pub const X3_IMM20_SIGN_VAL_POS_X: u16 = 0;
1651
1652/// Intel-IA64-Filler
1653pub const X3_IMM39_1_INST_WORD_X: u16 = 2;
1654/// Intel-IA64-Filler
1655pub const X3_IMM39_1_SIZE_X: u16 = 23;
1656/// Intel-IA64-Filler
1657pub const X3_IMM39_1_INST_WORD_POS_X: u16 = 0;
1658/// Intel-IA64-Filler
1659pub const X3_IMM39_1_SIGN_VAL_POS_X: u16 = 36;
1660
1661/// Intel-IA64-Filler
1662pub const X3_IMM39_2_INST_WORD_X: u16 = 1;
1663/// Intel-IA64-Filler
1664pub const X3_IMM39_2_SIZE_X: u16 = 16;
1665/// Intel-IA64-Filler
1666pub const X3_IMM39_2_INST_WORD_POS_X: u16 = 16;
1667/// Intel-IA64-Filler
1668pub const X3_IMM39_2_SIGN_VAL_POS_X: u16 = 20;
1669
1670/// Intel-IA64-Filler
1671pub const X3_P_INST_WORD_X: u16 = 3;
1672/// Intel-IA64-Filler
1673pub const X3_P_SIZE_X: u16 = 4;
1674/// Intel-IA64-Filler
1675pub const X3_P_INST_WORD_POS_X: u16 = 0;
1676/// Intel-IA64-Filler
1677pub const X3_P_SIGN_VAL_POS_X: u16 = 0;
1678
1679/// Intel-IA64-Filler
1680pub const X3_TMPLT_INST_WORD_X: u16 = 0;
1681/// Intel-IA64-Filler
1682pub const X3_TMPLT_SIZE_X: u16 = 4;
1683/// Intel-IA64-Filler
1684pub const X3_TMPLT_INST_WORD_POS_X: u16 = 0;
1685/// Intel-IA64-Filler
1686pub const X3_TMPLT_SIGN_VAL_POS_X: u16 = 0;
1687
1688/// Intel-IA64-Filler
1689pub const X3_BTYPE_QP_INST_WORD_X: u16 = 2;
1690/// Intel-IA64-Filler
1691pub const X3_BTYPE_QP_SIZE_X: u16 = 9;
1692/// Intel-IA64-Filler
1693pub const X3_BTYPE_QP_INST_WORD_POS_X: u16 = 23;
1694/// Intel-IA64-Filler
1695pub const X3_BTYPE_QP_INST_VAL_POS_X: u16 = 0;
1696
1697/// Intel-IA64-Filler
1698pub const X3_EMPTY_INST_WORD_X: u16 = 1;
1699/// Intel-IA64-Filler
1700pub const X3_EMPTY_SIZE_X: u16 = 2;
1701/// Intel-IA64-Filler
1702pub const X3_EMPTY_INST_WORD_POS_X: u16 = 14;
1703/// Intel-IA64-Filler
1704pub const X3_EMPTY_INST_VAL_POS_X: u16 = 0;
1705
1706//
1707// Line number format.
1708//
1709
1710// This struct has alignment 1.
1711#[derive(Debug, Clone, Copy)]
1712#[repr(C)]
1713pub struct ImageLinenumber {
1714 /// Symbol table index of function name if Linenumber is 0.
1715 /// Otherwise virtual address of line number.
1716 pub symbol_table_index_or_virtual_address: U32Bytes<LE>,
1717 /// Line number.
1718 pub linenumber: U16Bytes<LE>,
1719}
1720
1721//
1722// Based relocation format.
1723//
1724
1725#[derive(Debug, Clone, Copy)]
1726#[repr(C)]
1727pub struct ImageBaseRelocation {
1728 pub virtual_address: U32<LE>,
1729 pub size_of_block: U32<LE>,
1730 // pub type_offset[1]: U16<LE>,
1731}
1732
1733//
1734// Based relocation types.
1735//
1736
1737pub const IMAGE_REL_BASED_ABSOLUTE: u16 = 0;
1738pub const IMAGE_REL_BASED_HIGH: u16 = 1;
1739pub const IMAGE_REL_BASED_LOW: u16 = 2;
1740pub const IMAGE_REL_BASED_HIGHLOW: u16 = 3;
1741pub const IMAGE_REL_BASED_HIGHADJ: u16 = 4;
1742pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_5: u16 = 5;
1743pub const IMAGE_REL_BASED_RESERVED: u16 = 6;
1744pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_7: u16 = 7;
1745pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_8: u16 = 8;
1746pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_9: u16 = 9;
1747pub const IMAGE_REL_BASED_DIR64: u16 = 10;
1748
1749//
1750// Platform-specific based relocation types.
1751//
1752
1753pub const IMAGE_REL_BASED_IA64_IMM64: u16 = 9;
1754
1755pub const IMAGE_REL_BASED_MIPS_JMPADDR: u16 = 5;
1756pub const IMAGE_REL_BASED_MIPS_JMPADDR16: u16 = 9;
1757
1758pub const IMAGE_REL_BASED_ARM_MOV32: u16 = 5;
1759pub const IMAGE_REL_BASED_THUMB_MOV32: u16 = 7;
1760
1761pub const IMAGE_REL_BASED_RISCV_HIGH20: u16 = 5;
1762pub const IMAGE_REL_BASED_RISCV_LOW12I: u16 = 7;
1763pub const IMAGE_REL_BASED_RISCV_LOW12S: u16 = 8;
1764
1765//
1766// Archive format.
1767//
1768
1769pub const IMAGE_ARCHIVE_START_SIZE: usize = 8;
1770pub const IMAGE_ARCHIVE_START: &[u8; 8] = b"!<arch>\n";
1771pub const IMAGE_ARCHIVE_END: &[u8] = b"`\n";
1772pub const IMAGE_ARCHIVE_PAD: &[u8] = b"\n";
1773pub const IMAGE_ARCHIVE_LINKER_MEMBER: &[u8; 16] = b"/ ";
1774pub const IMAGE_ARCHIVE_LONGNAMES_MEMBER: &[u8; 16] = b"// ";
1775pub const IMAGE_ARCHIVE_HYBRIDMAP_MEMBER: &[u8; 16] = b"/<HYBRIDMAP>/ ";
1776
1777#[derive(Debug, Clone, Copy)]
1778#[repr(C)]
1779pub struct ImageArchiveMemberHeader {
1780 /// File member name - `/' terminated.
1781 pub name: [u8; 16],
1782 /// File member date - decimal.
1783 pub date: [u8; 12],
1784 /// File member user id - decimal.
1785 pub user_id: [u8; 6],
1786 /// File member group id - decimal.
1787 pub group_id: [u8; 6],
1788 /// File member mode - octal.
1789 pub mode: [u8; 8],
1790 /// File member size - decimal.
1791 pub size: [u8; 10],
1792 /// String to end header.
1793 pub end_header: [u8; 2],
1794}
1795
1796pub const IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR: u16 = 60;
1797
1798//
1799// DLL support.
1800//
1801
1802//
1803// Export Format
1804//
1805
1806#[derive(Debug, Clone, Copy)]
1807#[repr(C)]
1808pub struct ImageExportDirectory {
1809 pub characteristics: U32<LE>,
1810 pub time_date_stamp: U32<LE>,
1811 pub major_version: U16<LE>,
1812 pub minor_version: U16<LE>,
1813 pub name: U32<LE>,
1814 pub base: U32<LE>,
1815 pub number_of_functions: U32<LE>,
1816 pub number_of_names: U32<LE>,
1817 /// RVA from base of image
1818 pub address_of_functions: U32<LE>,
1819 /// RVA from base of image
1820 pub address_of_names: U32<LE>,
1821 /// RVA from base of image
1822 pub address_of_name_ordinals: U32<LE>,
1823}
1824
1825//
1826// Import Format
1827//
1828
1829#[derive(Debug, Clone, Copy)]
1830#[repr(C)]
1831pub struct ImageImportByName {
1832 pub hint: U16<LE>,
1833 //pub name: [i8; 1],
1834}
1835
1836#[derive(Debug, Clone, Copy)]
1837#[repr(C)]
1838pub struct ImageThunkData64(pub U64<LE>);
1839/*
1840 union {
1841/// PBYTE
1842 pub forwarder_string: U64<LE>,
1843/// PDWORD
1844 pub function: U64<LE>,
1845 pub ordinal: U64<LE>,
1846/// PIMAGE_IMPORT_BY_NAME
1847 pub address_of_data: U64<LE>,
1848 } u1;
1849*/
1850
1851#[derive(Debug, Clone, Copy)]
1852#[repr(C)]
1853pub struct ImageThunkData32(pub U32<LE>);
1854/*
1855 union {
1856/// PBYTE
1857 pub forwarder_string: U32<LE>,
1858/// PDWORD
1859 pub function: U32<LE>,
1860 pub ordinal: U32<LE>,
1861/// PIMAGE_IMPORT_BY_NAME
1862 pub address_of_data: U32<LE>,
1863 } u1;
1864}
1865*/
1866
1867pub const IMAGE_ORDINAL_FLAG64: u64 = 0x8000000000000000;
1868pub const IMAGE_ORDINAL_FLAG32: u32 = 0x80000000;
1869
1870/*
1871#define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)
1872#define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)
1873#define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
1874#define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
1875
1876*/
1877
1878//
1879// Thread Local Storage
1880//
1881
1882#[derive(Debug, Clone, Copy)]
1883#[repr(C)]
1884pub struct ImageTlsDirectory64 {
1885 pub start_address_of_raw_data: U64<LE>,
1886 pub end_address_of_raw_data: U64<LE>,
1887 /// PDWORD
1888 pub address_of_index: U64<LE>,
1889 /// PIMAGE_TLS_CALLBACK *;
1890 pub address_of_call_backs: U64<LE>,
1891 pub size_of_zero_fill: U32<LE>,
1892 pub characteristics: U32<LE>,
1893}
1894
1895#[derive(Debug, Clone, Copy)]
1896#[repr(C)]
1897pub struct ImageTlsDirectory32 {
1898 pub start_address_of_raw_data: U32<LE>,
1899 pub end_address_of_raw_data: U32<LE>,
1900 /// PDWORD
1901 pub address_of_index: U32<LE>,
1902 /// PIMAGE_TLS_CALLBACK *
1903 pub address_of_call_backs: U32<LE>,
1904 pub size_of_zero_fill: U32<LE>,
1905 pub characteristics: U32<LE>,
1906}
1907
1908#[derive(Debug, Clone, Copy)]
1909#[repr(C)]
1910pub struct ImageImportDescriptor {
1911 /// RVA to original unbound IAT (`ImageThunkData32`/`ImageThunkData64`)
1912 /// 0 for terminating null import descriptor
1913 pub original_first_thunk: U32Bytes<LE>,
1914 /// 0 if not bound,
1915 /// -1 if bound, and real date\time stamp
1916 /// in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
1917 /// O.W. date/time stamp of DLL bound to (Old BIND)
1918 pub time_date_stamp: U32Bytes<LE>,
1919 /// -1 if no forwarders
1920 pub forwarder_chain: U32Bytes<LE>,
1921 pub name: U32Bytes<LE>,
1922 /// RVA to IAT (if bound this IAT has actual addresses)
1923 pub first_thunk: U32Bytes<LE>,
1924}
1925
1926impl ImageImportDescriptor {
1927 /// Tell whether this import descriptor is the null descriptor
1928 /// (used to mark the end of the iterator array in a PE)
1929 pub fn is_null(&self) -> bool {
1930 self.original_first_thunk.get(LE) == 0
1931 && self.time_date_stamp.get(LE) == 0
1932 && self.forwarder_chain.get(LE) == 0
1933 && self.name.get(LE) == 0
1934 && self.first_thunk.get(LE) == 0
1935 }
1936}
1937
1938//
1939// New format import descriptors pointed to by DataDirectory[ IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT ]
1940//
1941
1942#[derive(Debug, Clone, Copy)]
1943#[repr(C)]
1944pub struct ImageBoundImportDescriptor {
1945 pub time_date_stamp: U32<LE>,
1946 pub offset_module_name: U16<LE>,
1947 pub number_of_module_forwarder_refs: U16<LE>,
1948 // Array of zero or more IMAGE_BOUND_FORWARDER_REF follows
1949}
1950
1951#[derive(Debug, Clone, Copy)]
1952#[repr(C)]
1953pub struct ImageBoundForwarderRef {
1954 pub time_date_stamp: U32<LE>,
1955 pub offset_module_name: U16<LE>,
1956 pub reserved: U16<LE>,
1957}
1958
1959#[derive(Debug, Clone, Copy)]
1960#[repr(C)]
1961pub struct ImageDelayloadDescriptor {
1962 pub attributes: U32<LE>,
1963
1964 /// RVA to the name of the target library (NULL-terminate ASCII string)
1965 pub dll_name_rva: U32<LE>,
1966 /// RVA to the HMODULE caching location (PHMODULE)
1967 pub module_handle_rva: U32<LE>,
1968 /// RVA to the start of the IAT (PIMAGE_THUNK_DATA)
1969 pub import_address_table_rva: U32<LE>,
1970 /// RVA to the start of the name table (PIMAGE_THUNK_DATA::AddressOfData)
1971 pub import_name_table_rva: U32<LE>,
1972 /// RVA to an optional bound IAT
1973 pub bound_import_address_table_rva: U32<LE>,
1974 /// RVA to an optional unload info table
1975 pub unload_information_table_rva: U32<LE>,
1976 /// 0 if not bound, otherwise, date/time of the target DLL
1977 pub time_date_stamp: U32<LE>,
1978}
1979
1980/// Delay load version 2 flag for `ImageDelayloadDescriptor::attributes`.
1981pub const IMAGE_DELAYLOAD_RVA_BASED: u32 = 0x8000_0000;
1982
1983//
1984// Resource Format.
1985//
1986
1987//
1988// Resource directory consists of two counts, following by a variable length
1989// array of directory entries. The first count is the number of entries at
1990// beginning of the array that have actual names associated with each entry.
1991// The entries are in ascending order, case insensitive strings. The second
1992// count is the number of entries that immediately follow the named entries.
1993// This second count identifies the number of entries that have 16-bit integer
1994// Ids as their name. These entries are also sorted in ascending order.
1995//
1996// This structure allows fast lookup by either name or number, but for any
1997// given resource entry only one form of lookup is supported, not both.
1998// This is consistant with the syntax of the .RC file and the .RES file.
1999//
2000
2001#[derive(Debug, Clone, Copy)]
2002#[repr(C)]
2003pub struct ImageResourceDirectory {
2004 pub characteristics: U32<LE>,
2005 pub time_date_stamp: U32<LE>,
2006 pub major_version: U16<LE>,
2007 pub minor_version: U16<LE>,
2008 pub number_of_named_entries: U16<LE>,
2009 pub number_of_id_entries: U16<LE>,
a2a8927a
XL
2010}
2011
2012pub const IMAGE_RESOURCE_NAME_IS_STRING: u32 = 0x8000_0000;
2013pub const IMAGE_RESOURCE_DATA_IS_DIRECTORY: u32 = 0x8000_0000;
2014//
2015// Each directory contains the 32-bit Name of the entry and an offset,
2016// relative to the beginning of the resource directory of the data associated
2017// with this directory entry. If the name of the entry is an actual text
2018// string instead of an integer Id, then the high order bit of the name field
2019// is set to one and the low order 31-bits are an offset, relative to the
2020// beginning of the resource directory of the string, which is of type
2021// IMAGE_RESOURCE_DIRECTORY_STRING. Otherwise the high bit is clear and the
2022// low-order 16-bits are the integer Id that identify this resource directory
2023// entry. If the directory entry is yet another resource directory (i.e. a
2024// subdirectory), then the high order bit of the offset field will be
2025// set to indicate this. Otherwise the high bit is clear and the offset
2026// field points to a resource data entry.
2027//
2028
2029#[derive(Debug, Clone, Copy)]
2030#[repr(C)]
2031pub struct ImageResourceDirectoryEntry {
2032 pub name_or_id: U32<LE>,
2033 pub offset_to_data_or_directory: U32<LE>,
2034}
2035
2036//
2037// For resource directory entries that have actual string names, the Name
2038// field of the directory entry points to an object of the following type.
2039// All of these string objects are stored together after the last resource
2040// directory entry and before the first resource data object. This minimizes
2041// the impact of these variable length objects on the alignment of the fixed
2042// size directory entry objects.
2043//
2044
2045#[derive(Debug, Clone, Copy)]
2046#[repr(C)]
2047pub struct ImageResourceDirectoryString {
2048 pub length: U16<LE>,
2049 //pub name_string: [i8; 1],
2050}
2051
2052#[derive(Debug, Clone, Copy)]
2053#[repr(C)]
2054pub struct ImageResourceDirStringU {
2055 pub length: U16<LE>,
2056 //pub name_string: [U16<LE>; 1],
2057}
2058
2059//
2060// Each resource data entry describes a leaf node in the resource directory
2061// tree. It contains an offset, relative to the beginning of the resource
2062// directory of the data for the resource, a size field that gives the number
2063// of bytes of data at that offset, a CodePage that should be used when
2064// decoding code point values within the resource data. Typically for new
2065// applications the code page would be the unicode code page.
2066//
2067
2068#[derive(Debug, Clone, Copy)]
2069#[repr(C)]
2070pub struct ImageResourceDataEntry {
04454e1e 2071 /// RVA of the data.
a2a8927a
XL
2072 pub offset_to_data: U32<LE>,
2073 pub size: U32<LE>,
2074 pub code_page: U32<LE>,
2075 pub reserved: U32<LE>,
2076}
2077
04454e1e
FG
2078// Resource type: https://docs.microsoft.com/en-us/windows/win32/menurc/resource-types
2079
2080/// ID for: Hardware-dependent cursor resource.
2081pub const RT_CURSOR: u16 = 1;
2082/// ID for: Bitmap resource.
2083pub const RT_BITMAP: u16 = 2;
2084/// ID for: Hardware-dependent icon resource.
2085pub const RT_ICON: u16 = 3;
2086/// ID for: Menu resource.
2087pub const RT_MENU: u16 = 4;
2088/// ID for: Dialog box.
2089pub const RT_DIALOG: u16 = 5;
2090/// ID for: String-table entry.
2091pub const RT_STRING: u16 = 6;
2092/// ID for: Font directory resource.
2093pub const RT_FONTDIR: u16 = 7;
2094/// ID for: Font resource.
2095pub const RT_FONT: u16 = 8;
2096/// ID for: Accelerator table.
2097pub const RT_ACCELERATOR: u16 = 9;
2098/// ID for: Application-defined resource (raw data).
2099pub const RT_RCDATA: u16 = 10;
2100/// ID for: Message-table entry.
2101pub const RT_MESSAGETABLE: u16 = 11;
2102/// ID for: Hardware-independent cursor resource.
2103pub const RT_GROUP_CURSOR: u16 = 12;
2104/// ID for: Hardware-independent icon resource.
2105pub const RT_GROUP_ICON: u16 = 14;
2106/// ID for: Version resource.
2107pub const RT_VERSION: u16 = 16;
2108/// ID for: Allows a resource editing tool to associate a string with an .rc file.
2109pub const RT_DLGINCLUDE: u16 = 17;
2110/// ID for: Plug and Play resource.
2111pub const RT_PLUGPLAY: u16 = 19;
2112/// ID for: VXD.
2113pub const RT_VXD: u16 = 20;
2114/// ID for: Animated cursor.
2115pub const RT_ANICURSOR: u16 = 21;
2116/// ID for: Animated icon.
2117pub const RT_ANIICON: u16 = 22;
2118/// ID for: HTML resource.
2119pub const RT_HTML: u16 = 23;
2120/// ID for: Side-by-Side Assembly Manifest.
2121pub const RT_MANIFEST: u16 = 24;
2122
a2a8927a
XL
2123//
2124// Code Integrity in loadconfig (CI)
2125//
2126
2127#[derive(Debug, Clone, Copy)]
2128#[repr(C)]
2129pub struct ImageLoadConfigCodeIntegrity {
2130 /// Flags to indicate if CI information is available, etc.
2131 pub flags: U16<LE>,
2132 /// 0xFFFF means not available
2133 pub catalog: U16<LE>,
2134 pub catalog_offset: U32<LE>,
2135 /// Additional bitmask to be defined later
2136 pub reserved: U32<LE>,
2137}
2138
2139//
2140// Dynamic value relocation table in loadconfig
2141//
2142
2143#[derive(Debug, Clone, Copy)]
2144#[repr(C)]
2145pub struct ImageDynamicRelocationTable {
2146 pub version: U32<LE>,
2147 pub size: U32<LE>,
2148 // DynamicRelocations: [ImageDynamicRelocation; 0],
2149}
2150
2151//
2152// Dynamic value relocation entries following IMAGE_DYNAMIC_RELOCATION_TABLE
2153//
2154
2155#[derive(Debug, Clone, Copy)]
2156#[repr(C)]
2157pub struct ImageDynamicRelocation32 {
2158 pub symbol: U32<LE>,
2159 pub base_reloc_size: U32<LE>,
2160 // BaseRelocations: [ImageBaseRelocation; 0],
2161}
2162
2163#[derive(Debug, Clone, Copy)]
2164#[repr(C)]
2165pub struct ImageDynamicRelocation64 {
2166 pub symbol: U64<LE>,
2167 pub base_reloc_size: U32<LE>,
2168 // BaseRelocations: [ImageBaseRelocation; 0],
2169}
2170
2171#[derive(Debug, Clone, Copy)]
2172#[repr(C)]
2173pub struct ImageDynamicRelocation32V2 {
2174 pub header_size: U32<LE>,
2175 pub fixup_info_size: U32<LE>,
2176 pub symbol: U32<LE>,
2177 pub symbol_group: U32<LE>,
2178 pub flags: U32<LE>,
2179 // ... variable length header fields
2180 // pub fixup_info: [u8; fixup_info_size]
2181}
2182
2183#[derive(Debug, Clone, Copy)]
2184#[repr(C)]
2185pub struct ImageDynamicRelocation64V2 {
2186 pub header_size: U32<LE>,
2187 pub fixup_info_size: U32<LE>,
2188 pub symbol: U64<LE>,
2189 pub symbol_group: U32<LE>,
2190 pub flags: U32<LE>,
2191 // ... variable length header fields
2192 // pub fixup_info[u8; fixup_info_size]
2193}
2194
2195//
2196// Defined symbolic dynamic relocation entries.
2197//
2198
2199pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE: u32 = 0x0000_0001;
2200pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE: u32 = 0x0000_0002;
2201pub const IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER: u32 = 0x0000_0003;
2202pub const IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER: u32 = 0x0000_0004;
2203pub const IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH: u32 = 0x0000_0005;
2204
2205// This struct has alignment 1.
2206#[derive(Debug, Clone, Copy)]
2207#[repr(C)]
2208pub struct ImagePrologueDynamicRelocationHeader {
2209 pub prologue_byte_count: u8,
2210 // pub prologue_bytes: [u8; prologue_byte_count],
2211}
2212
2213// This struct has alignment 1.
2214#[derive(Debug, Clone, Copy)]
2215#[repr(C)]
2216pub struct ImageEpilogueDynamicRelocationHeader {
2217 pub epilogue_count: U32Bytes<LE>,
2218 pub epilogue_byte_count: u8,
2219 pub branch_descriptor_element_size: u8,
2220 pub branch_descriptor_count: U16Bytes<LE>,
2221 // pub branch_descriptors[...],
2222 // pub branch_descriptor_bit_map[...],
2223}
2224
2225/*
2226// TODO? bitfields
2227// TODO: unaligned?
2228#[derive(Debug, Clone, Copy)]
2229#[repr(C)]
2230pub struct ImageImportControlTransferDynamicRelocation {
2231 DWORD PageRelativeOffset : 12;
2232 DWORD IndirectCall : 1;
2233 DWORD IATIndex : 19;
2234}
2235
2236// TODO: unaligned?
2237#[derive(Debug, Clone, Copy)]
2238#[repr(C)]
2239pub struct ImageIndirControlTransferDynamicRelocation {
2240 WORD PageRelativeOffset : 12;
2241 WORD IndirectCall : 1;
2242 WORD RexWPrefix : 1;
2243 WORD CfgCheck : 1;
2244 WORD Reserved : 1;
2245}
2246
2247// TODO: unaligned?
2248#[derive(Debug, Clone, Copy)]
2249#[repr(C)]
2250pub struct ImageSwitchtableBranchDynamicRelocation {
2251 WORD PageRelativeOffset : 12;
2252 WORD RegisterNumber : 4;
2253}
2254*/
2255
2256//
2257// Load Configuration Directory Entry
2258//
2259
2260#[derive(Debug, Clone, Copy)]
2261#[repr(C)]
2262pub struct ImageLoadConfigDirectory32 {
2263 pub size: U32<LE>,
2264 pub time_date_stamp: U32<LE>,
2265 pub major_version: U16<LE>,
2266 pub minor_version: U16<LE>,
2267 pub global_flags_clear: U32<LE>,
2268 pub global_flags_set: U32<LE>,
2269 pub critical_section_default_timeout: U32<LE>,
2270 pub de_commit_free_block_threshold: U32<LE>,
2271 pub de_commit_total_free_threshold: U32<LE>,
2272 /// VA
2273 pub lock_prefix_table: U32<LE>,
2274 pub maximum_allocation_size: U32<LE>,
2275 pub virtual_memory_threshold: U32<LE>,
2276 pub process_heap_flags: U32<LE>,
2277 pub process_affinity_mask: U32<LE>,
2278 pub csd_version: U16<LE>,
2279 pub dependent_load_flags: U16<LE>,
2280 /// VA
2281 pub edit_list: U32<LE>,
2282 /// VA
2283 pub security_cookie: U32<LE>,
2284 /// VA
2285 pub sehandler_table: U32<LE>,
2286 pub sehandler_count: U32<LE>,
2287 /// VA
2288 pub guard_cf_check_function_pointer: U32<LE>,
2289 /// VA
2290 pub guard_cf_dispatch_function_pointer: U32<LE>,
2291 /// VA
2292 pub guard_cf_function_table: U32<LE>,
2293 pub guard_cf_function_count: U32<LE>,
2294 pub guard_flags: U32<LE>,
2295 pub code_integrity: ImageLoadConfigCodeIntegrity,
2296 /// VA
2297 pub guard_address_taken_iat_entry_table: U32<LE>,
2298 pub guard_address_taken_iat_entry_count: U32<LE>,
2299 /// VA
2300 pub guard_long_jump_target_table: U32<LE>,
2301 pub guard_long_jump_target_count: U32<LE>,
2302 /// VA
2303 pub dynamic_value_reloc_table: U32<LE>,
2304 pub chpe_metadata_pointer: U32<LE>,
2305 /// VA
2306 pub guard_rf_failure_routine: U32<LE>,
2307 /// VA
2308 pub guard_rf_failure_routine_function_pointer: U32<LE>,
2309 pub dynamic_value_reloc_table_offset: U32<LE>,
2310 pub dynamic_value_reloc_table_section: U16<LE>,
2311 pub reserved2: U16<LE>,
2312 /// VA
2313 pub guard_rf_verify_stack_pointer_function_pointer: U32<LE>,
2314 pub hot_patch_table_offset: U32<LE>,
2315 pub reserved3: U32<LE>,
2316 /// VA
2317 pub enclave_configuration_pointer: U32<LE>,
2318 /// VA
2319 pub volatile_metadata_pointer: U32<LE>,
2320}
2321
2322#[derive(Debug, Clone, Copy)]
2323#[repr(C)]
2324pub struct ImageLoadConfigDirectory64 {
2325 pub size: U32<LE>,
2326 pub time_date_stamp: U32<LE>,
2327 pub major_version: U16<LE>,
2328 pub minor_version: U16<LE>,
2329 pub global_flags_clear: U32<LE>,
2330 pub global_flags_set: U32<LE>,
2331 pub critical_section_default_timeout: U32<LE>,
2332 pub de_commit_free_block_threshold: U64<LE>,
2333 pub de_commit_total_free_threshold: U64<LE>,
2334 /// VA
2335 pub lock_prefix_table: U64<LE>,
2336 pub maximum_allocation_size: U64<LE>,
2337 pub virtual_memory_threshold: U64<LE>,
2338 pub process_affinity_mask: U64<LE>,
2339 pub process_heap_flags: U32<LE>,
2340 pub csd_version: U16<LE>,
2341 pub dependent_load_flags: U16<LE>,
2342 /// VA
2343 pub edit_list: U64<LE>,
2344 /// VA
2345 pub security_cookie: U64<LE>,
2346 /// VA
2347 pub sehandler_table: U64<LE>,
2348 pub sehandler_count: U64<LE>,
2349 /// VA
2350 pub guard_cf_check_function_pointer: U64<LE>,
2351 /// VA
2352 pub guard_cf_dispatch_function_pointer: U64<LE>,
2353 /// VA
2354 pub guard_cf_function_table: U64<LE>,
2355 pub guard_cf_function_count: U64<LE>,
2356 pub guard_flags: U32<LE>,
2357 pub code_integrity: ImageLoadConfigCodeIntegrity,
2358 /// VA
2359 pub guard_address_taken_iat_entry_table: U64<LE>,
2360 pub guard_address_taken_iat_entry_count: U64<LE>,
2361 /// VA
2362 pub guard_long_jump_target_table: U64<LE>,
2363 pub guard_long_jump_target_count: U64<LE>,
2364 /// VA
2365 pub dynamic_value_reloc_table: U64<LE>,
2366 /// VA
2367 pub chpe_metadata_pointer: U64<LE>,
2368 /// VA
2369 pub guard_rf_failure_routine: U64<LE>,
2370 /// VA
2371 pub guard_rf_failure_routine_function_pointer: U64<LE>,
2372 pub dynamic_value_reloc_table_offset: U32<LE>,
2373 pub dynamic_value_reloc_table_section: U16<LE>,
2374 pub reserved2: U16<LE>,
2375 /// VA
2376 pub guard_rf_verify_stack_pointer_function_pointer: U64<LE>,
2377 pub hot_patch_table_offset: U32<LE>,
2378 pub reserved3: U32<LE>,
2379 /// VA
2380 pub enclave_configuration_pointer: U64<LE>,
2381 /// VA
2382 pub volatile_metadata_pointer: U64<LE>,
2383}
2384
2385#[derive(Debug, Clone, Copy)]
2386#[repr(C)]
2387pub struct ImageHotPatchInfo {
2388 pub version: U32<LE>,
2389 pub size: U32<LE>,
2390 pub sequence_number: U32<LE>,
2391 pub base_image_list: U32<LE>,
2392 pub base_image_count: U32<LE>,
2393 /// Version 2 and later
2394 pub buffer_offset: U32<LE>,
2395 /// Version 3 and later
2396 pub extra_patch_size: U32<LE>,
2397}
2398
2399#[derive(Debug, Clone, Copy)]
2400#[repr(C)]
2401pub struct ImageHotPatchBase {
2402 pub sequence_number: U32<LE>,
2403 pub flags: U32<LE>,
2404 pub original_time_date_stamp: U32<LE>,
2405 pub original_check_sum: U32<LE>,
2406 pub code_integrity_info: U32<LE>,
2407 pub code_integrity_size: U32<LE>,
2408 pub patch_table: U32<LE>,
2409 /// Version 2 and later
2410 pub buffer_offset: U32<LE>,
2411}
2412
2413#[derive(Debug, Clone, Copy)]
2414#[repr(C)]
2415pub struct ImageHotPatchHashes {
2416 pub sha256: [u8; 32],
2417 pub sha1: [u8; 20],
2418}
2419
2420pub const IMAGE_HOT_PATCH_BASE_OBLIGATORY: u32 = 0x0000_0001;
2421pub const IMAGE_HOT_PATCH_BASE_CAN_ROLL_BACK: u32 = 0x0000_0002;
2422
2423pub const IMAGE_HOT_PATCH_CHUNK_INVERSE: u32 = 0x8000_0000;
2424pub const IMAGE_HOT_PATCH_CHUNK_OBLIGATORY: u32 = 0x4000_0000;
2425pub const IMAGE_HOT_PATCH_CHUNK_RESERVED: u32 = 0x3FF0_3000;
2426pub const IMAGE_HOT_PATCH_CHUNK_TYPE: u32 = 0x000F_C000;
2427pub const IMAGE_HOT_PATCH_CHUNK_SOURCE_RVA: u32 = 0x0000_8000;
2428pub const IMAGE_HOT_PATCH_CHUNK_TARGET_RVA: u32 = 0x0000_4000;
2429pub const IMAGE_HOT_PATCH_CHUNK_SIZE: u32 = 0x0000_0FFF;
2430
2431pub const IMAGE_HOT_PATCH_NONE: u32 = 0x0000_0000;
2432pub const IMAGE_HOT_PATCH_FUNCTION: u32 = 0x0001_C000;
2433pub const IMAGE_HOT_PATCH_ABSOLUTE: u32 = 0x0002_C000;
2434pub const IMAGE_HOT_PATCH_REL32: u32 = 0x0003_C000;
2435pub const IMAGE_HOT_PATCH_CALL_TARGET: u32 = 0x0004_4000;
2436pub const IMAGE_HOT_PATCH_INDIRECT: u32 = 0x0005_C000;
2437pub const IMAGE_HOT_PATCH_NO_CALL_TARGET: u32 = 0x0006_4000;
2438pub const IMAGE_HOT_PATCH_DYNAMIC_VALUE: u32 = 0x0007_8000;
2439
2440/// Module performs control flow integrity checks using system-supplied support
2441pub const IMAGE_GUARD_CF_INSTRUMENTED: u32 = 0x0000_0100;
2442/// Module performs control flow and write integrity checks
2443pub const IMAGE_GUARD_CFW_INSTRUMENTED: u32 = 0x0000_0200;
2444/// Module contains valid control flow target metadata
2445pub const IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT: u32 = 0x0000_0400;
2446/// Module does not make use of the /GS security cookie
2447pub const IMAGE_GUARD_SECURITY_COOKIE_UNUSED: u32 = 0x0000_0800;
2448/// Module supports read only delay load IAT
2449pub const IMAGE_GUARD_PROTECT_DELAYLOAD_IAT: u32 = 0x0000_1000;
2450/// Delayload import table in its own .didat section (with nothing else in it) that can be freely reprotected
2451pub const IMAGE_GUARD_DELAYLOAD_IAT_IN_ITS_OWN_SECTION: u32 = 0x0000_2000;
2452/// Module contains suppressed export information.
2453///
2454/// This also infers that the address taken taken IAT table is also present in the load config.
2455pub const IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT: u32 = 0x0000_4000;
2456/// Module enables suppression of exports
2457pub const IMAGE_GUARD_CF_ENABLE_EXPORT_SUPPRESSION: u32 = 0x0000_8000;
2458/// Module contains longjmp target information
2459pub const IMAGE_GUARD_CF_LONGJUMP_TABLE_PRESENT: u32 = 0x0001_0000;
2460/// Module contains return flow instrumentation and metadata
2461pub const IMAGE_GUARD_RF_INSTRUMENTED: u32 = 0x0002_0000;
2462/// Module requests that the OS enable return flow protection
2463pub const IMAGE_GUARD_RF_ENABLE: u32 = 0x0004_0000;
2464/// Module requests that the OS enable return flow protection in strict mode
2465pub const IMAGE_GUARD_RF_STRICT: u32 = 0x0008_0000;
2466/// Module was built with retpoline support
2467pub const IMAGE_GUARD_RETPOLINE_PRESENT: u32 = 0x0010_0000;
2468
2469/// Stride of Guard CF function table encoded in these bits (additional count of bytes per element)
2470pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_MASK: u32 = 0xF000_0000;
2471/// Shift to right-justify Guard CF function table stride
2472pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_SHIFT: u32 = 28;
2473
2474//
2475// GFIDS table entry flags.
2476//
2477
2478/// The containing GFID entry is suppressed
2479pub const IMAGE_GUARD_FLAG_FID_SUPPRESSED: u16 = 0x01;
2480/// The containing GFID entry is export suppressed
2481pub const IMAGE_GUARD_FLAG_EXPORT_SUPPRESSED: u16 = 0x02;
2482
2483//
2484// WIN CE Exception table format
2485//
2486
2487//
2488// Function table entry format. Function table is pointed to by the
2489// IMAGE_DIRECTORY_ENTRY_EXCEPTION directory entry.
2490//
2491
2492/*
2493// TODO? bitfields
2494#[derive(Debug, Clone, Copy)]
2495#[repr(C)]
2496pub struct ImageCeRuntimeFunctionEntry {
2497 pub func_start: U32<LE>,
2498 DWORD PrologLen : 8;
2499 DWORD FuncLen : 22;
2500 DWORD ThirtyTwoBit : 1;
2501 DWORD ExceptionFlag : 1;
2502}
2503*/
2504
2505#[derive(Debug, Clone, Copy)]
2506#[repr(C)]
2507pub struct ImageArmRuntimeFunctionEntry {
2508 pub begin_address: U32<LE>,
2509 pub unwind_data: U32<LE>,
2510}
2511
2512#[derive(Debug, Clone, Copy)]
2513#[repr(C)]
2514pub struct ImageArm64RuntimeFunctionEntry {
2515 pub begin_address: U32<LE>,
2516 pub unwind_data: U32<LE>,
2517}
2518
2519#[derive(Debug, Clone, Copy)]
2520#[repr(C)]
2521pub struct ImageAlpha64RuntimeFunctionEntry {
2522 pub begin_address: U64<LE>,
2523 pub end_address: U64<LE>,
2524 pub exception_handler: U64<LE>,
2525 pub handler_data: U64<LE>,
2526 pub prolog_end_address: U64<LE>,
2527}
2528
2529#[derive(Debug, Clone, Copy)]
2530#[repr(C)]
2531pub struct ImageAlphaRuntimeFunctionEntry {
2532 pub begin_address: U32<LE>,
2533 pub end_address: U32<LE>,
2534 pub exception_handler: U32<LE>,
2535 pub handler_data: U32<LE>,
2536 pub prolog_end_address: U32<LE>,
2537}
2538
2539#[derive(Debug, Clone, Copy)]
2540#[repr(C)]
2541pub struct ImageRuntimeFunctionEntry {
2542 pub begin_address: U32<LE>,
2543 pub end_address: U32<LE>,
2544 pub unwind_info_address_or_data: U32<LE>,
2545}
2546
2547//
2548// Sofware enclave information
2549//
2550
2551pub const IMAGE_ENCLAVE_LONG_ID_LENGTH: usize = 32;
2552pub const IMAGE_ENCLAVE_SHORT_ID_LENGTH: usize = 16;
2553
2554#[derive(Debug, Clone, Copy)]
2555#[repr(C)]
2556pub struct ImageEnclaveConfig32 {
2557 pub size: U32<LE>,
2558 pub minimum_required_config_size: U32<LE>,
2559 pub policy_flags: U32<LE>,
2560 pub number_of_imports: U32<LE>,
2561 pub import_list: U32<LE>,
2562 pub import_entry_size: U32<LE>,
2563 pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2564 pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2565 pub image_version: U32<LE>,
2566 pub security_version: U32<LE>,
2567 pub enclave_size: U32<LE>,
2568 pub number_of_threads: U32<LE>,
2569 pub enclave_flags: U32<LE>,
2570}
2571
2572#[derive(Debug, Clone, Copy)]
2573#[repr(C)]
2574pub struct ImageEnclaveConfig64 {
2575 pub size: U32<LE>,
2576 pub minimum_required_config_size: U32<LE>,
2577 pub policy_flags: U32<LE>,
2578 pub number_of_imports: U32<LE>,
2579 pub import_list: U32<LE>,
2580 pub import_entry_size: U32<LE>,
2581 pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2582 pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2583 pub image_version: U32<LE>,
2584 pub security_version: U32<LE>,
2585 pub enclave_size: U64<LE>,
2586 pub number_of_threads: U32<LE>,
2587 pub enclave_flags: U32<LE>,
2588}
2589
2590//pub const IMAGE_ENCLAVE_MINIMUM_CONFIG_SIZE: usize = FIELD_OFFSET(IMAGE_ENCLAVE_CONFIG, EnclaveFlags);
2591
2592pub const IMAGE_ENCLAVE_POLICY_DEBUGGABLE: u32 = 0x0000_0001;
2593
2594pub const IMAGE_ENCLAVE_FLAG_PRIMARY_IMAGE: u32 = 0x0000_0001;
2595
2596#[derive(Debug, Clone, Copy)]
2597#[repr(C)]
2598pub struct ImageEnclaveImport {
2599 pub match_type: U32<LE>,
2600 pub minimum_security_version: U32<LE>,
2601 pub unique_or_author_id: [u8; IMAGE_ENCLAVE_LONG_ID_LENGTH],
2602 pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2603 pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2604 pub import_name: U32<LE>,
2605 pub reserved: U32<LE>,
2606}
2607
2608pub const IMAGE_ENCLAVE_IMPORT_MATCH_NONE: u32 = 0x0000_0000;
2609pub const IMAGE_ENCLAVE_IMPORT_MATCH_UNIQUE_ID: u32 = 0x0000_0001;
2610pub const IMAGE_ENCLAVE_IMPORT_MATCH_AUTHOR_ID: u32 = 0x0000_0002;
2611pub const IMAGE_ENCLAVE_IMPORT_MATCH_FAMILY_ID: u32 = 0x0000_0003;
2612pub const IMAGE_ENCLAVE_IMPORT_MATCH_IMAGE_ID: u32 = 0x0000_0004;
2613
2614//
2615// Debug Format
2616//
2617
2618#[derive(Debug, Clone, Copy)]
2619#[repr(C)]
2620pub struct ImageDebugDirectory {
2621 pub characteristics: U32<LE>,
2622 pub time_date_stamp: U32<LE>,
2623 pub major_version: U16<LE>,
2624 pub minor_version: U16<LE>,
2625 pub typ: U32<LE>,
2626 pub size_of_data: U32<LE>,
2627 pub address_of_raw_data: U32<LE>,
2628 pub pointer_to_raw_data: U32<LE>,
2629}
2630
2631pub const IMAGE_DEBUG_TYPE_UNKNOWN: u32 = 0;
2632pub const IMAGE_DEBUG_TYPE_COFF: u32 = 1;
2633pub const IMAGE_DEBUG_TYPE_CODEVIEW: u32 = 2;
2634pub const IMAGE_DEBUG_TYPE_FPO: u32 = 3;
2635pub const IMAGE_DEBUG_TYPE_MISC: u32 = 4;
2636pub const IMAGE_DEBUG_TYPE_EXCEPTION: u32 = 5;
2637pub const IMAGE_DEBUG_TYPE_FIXUP: u32 = 6;
2638pub const IMAGE_DEBUG_TYPE_OMAP_TO_SRC: u32 = 7;
2639pub const IMAGE_DEBUG_TYPE_OMAP_FROM_SRC: u32 = 8;
2640pub const IMAGE_DEBUG_TYPE_BORLAND: u32 = 9;
2641pub const IMAGE_DEBUG_TYPE_RESERVED10: u32 = 10;
2642pub const IMAGE_DEBUG_TYPE_CLSID: u32 = 11;
2643pub const IMAGE_DEBUG_TYPE_VC_FEATURE: u32 = 12;
2644pub const IMAGE_DEBUG_TYPE_POGO: u32 = 13;
2645pub const IMAGE_DEBUG_TYPE_ILTCG: u32 = 14;
2646pub const IMAGE_DEBUG_TYPE_MPX: u32 = 15;
2647pub const IMAGE_DEBUG_TYPE_REPRO: u32 = 16;
2648
2649#[derive(Debug, Clone, Copy)]
2650#[repr(C)]
2651pub struct ImageCoffSymbolsHeader {
2652 pub number_of_symbols: U32<LE>,
2653 pub lva_to_first_symbol: U32<LE>,
2654 pub number_of_linenumbers: U32<LE>,
2655 pub lva_to_first_linenumber: U32<LE>,
2656 pub rva_to_first_byte_of_code: U32<LE>,
2657 pub rva_to_last_byte_of_code: U32<LE>,
2658 pub rva_to_first_byte_of_data: U32<LE>,
2659 pub rva_to_last_byte_of_data: U32<LE>,
2660}
2661
2662pub const FRAME_FPO: u16 = 0;
2663pub const FRAME_TRAP: u16 = 1;
2664pub const FRAME_TSS: u16 = 2;
2665pub const FRAME_NONFPO: u16 = 3;
2666
2667/*
2668// TODO? bitfields
2669#[derive(Debug, Clone, Copy)]
2670#[repr(C)]
2671pub struct FpoData {
2672/// offset 1st byte of function code
2673 pub ul_off_start: U32<LE>,
2674/// # bytes in function
2675 pub cb_proc_size: U32<LE>,
2676/// # bytes in locals/4
2677 pub cdw_locals: U32<LE>,
2678/// # bytes in params/4
2679 pub cdw_params: U16<LE>,
2680/// # bytes in prolog
2681 WORD cbProlog : 8;
2682/// # regs saved
2683 WORD cbRegs : 3;
2684/// TRUE if SEH in func
2685 WORD fHasSEH : 1;
2686/// TRUE if EBP has been allocated
2687 WORD fUseBP : 1;
2688/// reserved for future use
2689 WORD reserved : 1;
2690/// frame type
2691 WORD cbFrame : 2;
2692}
2693pub const SIZEOF_RFPO_DATA: usize = 16;
2694*/
2695
2696pub const IMAGE_DEBUG_MISC_EXENAME: u16 = 1;
2697
2698#[derive(Debug, Clone, Copy)]
2699#[repr(C)]
2700pub struct ImageDebugMisc {
2701 /// type of misc data, see defines
2702 pub data_type: U32<LE>,
2703 /// total length of record, rounded to four byte multiple.
2704 pub length: U32<LE>,
2705 /// TRUE if data is unicode string
2706 pub unicode: u8,
2707 pub reserved: [u8; 3],
2708 // Actual data
2709 //pub data: [u8; 1],
2710}
2711
2712//
2713// Function table extracted from MIPS/ALPHA/IA64 images. Does not contain
2714// information needed only for runtime support. Just those fields for
2715// each entry needed by a debugger.
2716//
2717
2718#[derive(Debug, Clone, Copy)]
2719#[repr(C)]
2720pub struct ImageFunctionEntry {
2721 pub starting_address: U32<LE>,
2722 pub ending_address: U32<LE>,
2723 pub end_of_prologue: U32<LE>,
2724}
2725
2726#[derive(Debug, Clone, Copy)]
2727#[repr(C)]
2728pub struct ImageFunctionEntry64 {
2729 pub starting_address: U64<LE>,
2730 pub ending_address: U64<LE>,
2731 pub end_of_prologue_or_unwind_info_address: U64<LE>,
2732}
2733
2734//
2735// Debugging information can be stripped from an image file and placed
2736// in a separate .DBG file, whose file name part is the same as the
2737// image file name part (e.g. symbols for CMD.EXE could be stripped
2738// and placed in CMD.DBG). This is indicated by the IMAGE_FILE_DEBUG_STRIPPED
2739// flag in the Characteristics field of the file header. The beginning of
2740// the .DBG file contains the following structure which captures certain
2741// information from the image file. This allows a debug to proceed even if
2742// the original image file is not accessable. This header is followed by
2743// zero of more IMAGE_SECTION_HEADER structures, followed by zero or more
2744// IMAGE_DEBUG_DIRECTORY structures. The latter structures and those in
2745// the image file contain file offsets relative to the beginning of the
2746// .DBG file.
2747//
2748// If symbols have been stripped from an image, the IMAGE_DEBUG_MISC structure
2749// is left in the image file, but not mapped. This allows a debugger to
2750// compute the name of the .DBG file, from the name of the image in the
2751// IMAGE_DEBUG_MISC structure.
2752//
2753
2754#[derive(Debug, Clone, Copy)]
2755#[repr(C)]
2756pub struct ImageSeparateDebugHeader {
2757 pub signature: U16<LE>,
2758 pub flags: U16<LE>,
2759 pub machine: U16<LE>,
2760 pub characteristics: U16<LE>,
2761 pub time_date_stamp: U32<LE>,
2762 pub check_sum: U32<LE>,
2763 pub image_base: U32<LE>,
2764 pub size_of_image: U32<LE>,
2765 pub number_of_sections: U32<LE>,
2766 pub exported_names_size: U32<LE>,
2767 pub debug_directory_size: U32<LE>,
2768 pub section_alignment: U32<LE>,
2769 pub reserved: [U32<LE>; 2],
2770}
2771
2772#[derive(Debug, Clone, Copy)]
2773#[repr(C)]
2774pub struct NonPagedDebugInfo {
2775 pub signature: U16<LE>,
2776 pub flags: U16<LE>,
2777 pub size: U32<LE>,
2778 pub machine: U16<LE>,
2779 pub characteristics: U16<LE>,
2780 pub time_date_stamp: U32<LE>,
2781 pub check_sum: U32<LE>,
2782 pub size_of_image: U32<LE>,
2783 pub image_base: U64<LE>,
2784 //debug_directory_size
2785 //ImageDebugDirectory
2786}
2787
2788pub const IMAGE_SEPARATE_DEBUG_SIGNATURE: u16 = 0x4944;
2789pub const NON_PAGED_DEBUG_SIGNATURE: u16 = 0x494E;
2790
2791pub const IMAGE_SEPARATE_DEBUG_FLAGS_MASK: u16 = 0x8000;
2792/// when DBG was updated, the old checksum didn't match.
2793pub const IMAGE_SEPARATE_DEBUG_MISMATCH: u16 = 0x8000;
2794
2795//
2796// The .arch section is made up of headers, each describing an amask position/value
2797// pointing to an array of IMAGE_ARCHITECTURE_ENTRY's. Each "array" (both the header
2798// and entry arrays) are terminiated by a quadword of 0xffffffffL.
2799//
2800// NOTE: There may be quadwords of 0 sprinkled around and must be skipped.
2801//
2802
2803/*
2804// TODO? bitfields
2805#[derive(Debug, Clone, Copy)]
2806#[repr(C)]
2807pub struct ImageArchitectureHeader {
2808 /// 1 -> code section depends on mask bit
2809 /// 0 -> new instruction depends on mask bit
2810 unsigned int AmaskValue: 1;
2811 /// MBZ
2812 int :7;
2813 /// Amask bit in question for this fixup
2814 unsigned int AmaskShift: 8;
2815 /// MBZ
2816 int :16;
2817 /// RVA into .arch section to array of ARCHITECTURE_ENTRY's
2818 pub first_entry_rva: U32<LE>,
2819}
2820*/
2821
2822#[derive(Debug, Clone, Copy)]
2823#[repr(C)]
2824pub struct ImageArchitectureEntry {
2825 /// RVA of instruction to fixup
2826 pub fixup_inst_rva: U32<LE>,
2827 /// fixup instruction (see alphaops.h)
2828 pub new_inst: U32<LE>,
2829}
2830
2831// The following structure defines the new import object. Note the values of the first two fields,
2832// which must be set as stated in order to differentiate old and new import members.
2833// Following this structure, the linker emits two null-terminated strings used to recreate the
2834// import at the time of use. The first string is the import's name, the second is the dll's name.
2835
2836pub const IMPORT_OBJECT_HDR_SIG2: u16 = 0xffff;
2837
2838#[derive(Debug, Clone, Copy)]
2839#[repr(C)]
2840pub struct ImportObjectHeader {
2841 /// Must be IMAGE_FILE_MACHINE_UNKNOWN
2842 pub sig1: U16<LE>,
2843 /// Must be IMPORT_OBJECT_HDR_SIG2.
2844 pub sig2: U16<LE>,
2845 pub version: U16<LE>,
2846 pub machine: U16<LE>,
2847 /// Time/date stamp
2848 pub time_date_stamp: U32<LE>,
2849 /// particularly useful for incremental links
2850 pub size_of_data: U32<LE>,
2851
2852 /// if grf & IMPORT_OBJECT_ORDINAL
2853 pub ordinal_or_hint: U16<LE>,
2854
2855 // WORD Type : 2;
2856 // WORD NameType : 3;
2857 // WORD Reserved : 11;
2858 pub name_type: U16<LE>,
2859}
2860
2861pub const IMPORT_OBJECT_CODE: u16 = 0;
2862pub const IMPORT_OBJECT_DATA: u16 = 1;
2863pub const IMPORT_OBJECT_CONST: u16 = 2;
2864
2865/// Import by ordinal
2866pub const IMPORT_OBJECT_ORDINAL: u16 = 0;
2867/// Import name == public symbol name.
2868pub const IMPORT_OBJECT_NAME: u16 = 1;
2869/// Import name == public symbol name skipping leading ?, @, or optionally _.
2870pub const IMPORT_OBJECT_NAME_NO_PREFIX: u16 = 2;
2871/// Import name == public symbol name skipping leading ?, @, or optionally _ and truncating at first @.
2872pub const IMPORT_OBJECT_NAME_UNDECORATE: u16 = 3;
2873/// Import name == a name is explicitly provided after the DLL name.
2874pub const IMPORT_OBJECT_NAME_EXPORTAS: u16 = 4;
2875
2876// COM+ Header entry point flags.
2877pub const COMIMAGE_FLAGS_ILONLY: u32 = 0x0000_0001;
2878pub const COMIMAGE_FLAGS_32BITREQUIRED: u32 = 0x0000_0002;
2879pub const COMIMAGE_FLAGS_IL_LIBRARY: u32 = 0x0000_0004;
2880pub const COMIMAGE_FLAGS_STRONGNAMESIGNED: u32 = 0x0000_0008;
2881pub const COMIMAGE_FLAGS_NATIVE_ENTRYPOINT: u32 = 0x0000_0010;
2882pub const COMIMAGE_FLAGS_TRACKDEBUGDATA: u32 = 0x0001_0000;
2883pub const COMIMAGE_FLAGS_32BITPREFERRED: u32 = 0x0002_0000;
2884
2885// Version flags for image.
2886pub const COR_VERSION_MAJOR_V2: u16 = 2;
2887pub const COR_VERSION_MAJOR: u16 = COR_VERSION_MAJOR_V2;
2888pub const COR_VERSION_MINOR: u16 = 5;
2889pub const COR_DELETED_NAME_LENGTH: usize = 8;
2890pub const COR_VTABLEGAP_NAME_LENGTH: usize = 8;
2891
2892// Maximum size of a NativeType descriptor.
2893pub const NATIVE_TYPE_MAX_CB: u16 = 1;
2894pub const COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE: u16 = 0xFF;
2895
2896// Consts for the MIH FLAGS
2897pub const IMAGE_COR_MIH_METHODRVA: u16 = 0x01;
2898pub const IMAGE_COR_MIH_EHRVA: u16 = 0x02;
2899pub const IMAGE_COR_MIH_BASICBLOCK: u16 = 0x08;
2900
2901// V-table constants
2902/// V-table slots are 32-bits in size.
2903pub const COR_VTABLE_32BIT: u16 = 0x01;
2904/// V-table slots are 64-bits in size.
2905pub const COR_VTABLE_64BIT: u16 = 0x02;
2906/// If set, transition from unmanaged.
2907pub const COR_VTABLE_FROM_UNMANAGED: u16 = 0x04;
2908/// If set, transition from unmanaged with keeping the current appdomain.
2909pub const COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN: u16 = 0x08;
2910/// Call most derived method described by
2911pub const COR_VTABLE_CALL_MOST_DERIVED: u16 = 0x10;
2912
2913// EATJ constants
2914/// Size of a jump thunk reserved range.
2915pub const IMAGE_COR_EATJ_THUNK_SIZE: usize = 32;
2916
2917// Max name lengths
2918pub const MAX_CLASS_NAME: usize = 1024;
2919pub const MAX_PACKAGE_NAME: usize = 1024;
2920
2921// CLR 2.0 header structure.
2922#[derive(Debug, Clone, Copy)]
2923#[repr(C)]
2924pub struct ImageCor20Header {
2925 // Header versioning
2926 pub cb: U32<LE>,
2927 pub major_runtime_version: U16<LE>,
2928 pub minor_runtime_version: U16<LE>,
2929
2930 // Symbol table and startup information
2931 pub meta_data: ImageDataDirectory,
2932 pub flags: U32<LE>,
2933
2934 // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is not set, EntryPointToken represents a managed entrypoint.
2935 // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is set, EntryPointRVA represents an RVA to a native entrypoint.
2936 pub entry_point_token_or_rva: U32<LE>,
2937
2938 // Binding information
2939 pub resources: ImageDataDirectory,
2940 pub strong_name_signature: ImageDataDirectory,
2941
2942 // Regular fixup and binding information
2943 pub code_manager_table: ImageDataDirectory,
2944 pub vtable_fixups: ImageDataDirectory,
2945 pub export_address_table_jumps: ImageDataDirectory,
2946
2947 // Precompiled image info (internal use only - set to zero)
2948 pub managed_native_header: ImageDataDirectory,
2949}
2950
2951unsafe_impl_pod!(
2952 ImageDosHeader,
2953 ImageOs2Header,
2954 ImageVxdHeader,
2955 ImageFileHeader,
2956 ImageDataDirectory,
2957 ImageOptionalHeader32,
2958 ImageRomOptionalHeader,
2959 ImageOptionalHeader64,
2960 ImageNtHeaders64,
2961 ImageNtHeaders32,
2962 ImageRomHeaders,
2963 Guid,
2964 AnonObjectHeader,
2965 AnonObjectHeaderV2,
2966 AnonObjectHeaderBigobj,
2967 ImageSectionHeader,
2968 ImageSymbol,
2969 ImageSymbolBytes,
2970 ImageSymbolEx,
2971 ImageSymbolExBytes,
2972 ImageAuxSymbolTokenDef,
2973 ImageAuxSymbolFunction,
2974 ImageAuxSymbolFunctionBeginEnd,
2975 ImageAuxSymbolWeak,
2976 ImageAuxSymbolSection,
2977 ImageAuxSymbolCrc,
2978 ImageRelocation,
2979 ImageLinenumber,
2980 ImageBaseRelocation,
2981 ImageArchiveMemberHeader,
2982 ImageExportDirectory,
2983 ImageImportByName,
2984 ImageThunkData64,
2985 ImageThunkData32,
2986 ImageTlsDirectory64,
2987 ImageTlsDirectory32,
2988 ImageImportDescriptor,
2989 ImageBoundImportDescriptor,
2990 ImageBoundForwarderRef,
2991 ImageDelayloadDescriptor,
2992 ImageResourceDirectory,
2993 ImageResourceDirectoryEntry,
2994 ImageResourceDirectoryString,
2995 ImageResourceDirStringU,
2996 ImageResourceDataEntry,
2997 ImageLoadConfigCodeIntegrity,
2998 ImageDynamicRelocationTable,
2999 ImageDynamicRelocation32,
3000 ImageDynamicRelocation64,
3001 ImageDynamicRelocation32V2,
3002 ImageDynamicRelocation64V2,
3003 ImagePrologueDynamicRelocationHeader,
3004 ImageEpilogueDynamicRelocationHeader,
3005 //ImageImportControlTransferDynamicRelocation,
3006 //ImageIndirControlTransferDynamicRelocation,
3007 //ImageSwitchtableBranchDynamicRelocation,
3008 ImageLoadConfigDirectory32,
3009 ImageLoadConfigDirectory64,
3010 ImageHotPatchInfo,
3011 ImageHotPatchBase,
3012 ImageHotPatchHashes,
3013 //ImageCeRuntimeFunctionEntry,
3014 ImageArmRuntimeFunctionEntry,
3015 ImageArm64RuntimeFunctionEntry,
3016 ImageAlpha64RuntimeFunctionEntry,
3017 ImageAlphaRuntimeFunctionEntry,
3018 ImageRuntimeFunctionEntry,
3019 ImageEnclaveConfig32,
3020 ImageEnclaveConfig64,
3021 ImageEnclaveImport,
3022 ImageDebugDirectory,
3023 ImageCoffSymbolsHeader,
3024 //FpoData,
3025 ImageDebugMisc,
3026 ImageFunctionEntry,
3027 ImageFunctionEntry64,
3028 ImageSeparateDebugHeader,
3029 NonPagedDebugInfo,
3030 //ImageArchitectureHeader,
3031 ImageArchitectureEntry,
3032 ImportObjectHeader,
3033 ImageCor20Header,
3034 MaskedRichHeaderEntry,
3035);