123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563 |
- #ifndef _NTIMAGE_
- #define _NTIMAGE_
- //
- // Image Formats
- //
- #define IMAGE_DOS_SIGNATURE 0x5A4D
- #define IMAGE_OS2_SIGNATURE 0x454E
- #define IMAGE_OS2_SIGNATURE_LE 0x454C
- #define IMAGE_VXD_SIGNATURE 0x454C
- #define IMAGE_NT_SIGNATURE 0x00004550
- //
- // Image architectures
- //
- #define IMAGE_FILE_MACHINE_AM33 0x1d3
- #define IMAGE_FILE_MACHINE_AMD64 0x8664
- #define IMAGE_FILE_MACHINE_ARM 0x1c0
- #define IMAGE_FILE_MACHINE_ARMV7 0x1c4
- #define IMAGE_FILE_MACHINE_EBC 0xebc
- #define IMAGE_FILE_MACHINE_I386 0x14c
- #define IMAGE_FILE_MACHINE_IA64 0x200
- #define IMAGE_FILE_MACHINE_M32R 0x9041
- #define IMAGE_FILE_MACHINE_MIPS16 0x266
- #define IMAGE_FILE_MACHINE_MIPSFPU 0x366
- #define IMAGE_FILE_MACHINE_MIPSFPU16 0x466
- #define IMAGE_FILE_MACHINE_POWERPC 0x1f0
- #define IMAGE_FILE_MACHINE_POWERPCFP 0x1f1
- #define IMAGE_FILE_MACHINE_R4000 0x166
- #define IMAGE_FILE_MACHINE_SH3 0x1a2
- #define IMAGE_FILE_MACHINE_SH3E 0x01a4
- #define IMAGE_FILE_MACHINE_SH3DSP 0x1a3
- #define IMAGE_FILE_MACHINE_SH4 0x1a6
- #define IMAGE_FILE_MACHINE_SH5 0x1a8
- #define IMAGE_FILE_MACHINE_THUMB 0x1c2
- #define IMAGE_FILE_MACHINE_WCEMIPSV2 0x169
- #define IMAGE_FILE_MACHINE_R3000 0x162
- #define IMAGE_FILE_MACHINE_R10000 0x168
- #define IMAGE_FILE_MACHINE_ALPHA 0x184
- #define IMAGE_FILE_MACHINE_ALPHA64 0x0284
- #define IMAGE_FILE_MACHINE_AXP64 IMAGE_FILE_MACHINE_ALPHA64
- #define IMAGE_FILE_MACHINE_CEE 0xC0EE
- #define IMAGE_FILE_MACHINE_TRICORE 0x0520
- #define IMAGE_FILE_MACHINE_CEF 0x0CEF
- //
- // DOS Image Header Format
- //
- #include <pshpack2.h>
- typedef struct _IMAGE_DOS_HEADER {
- USHORT e_magic;
- USHORT e_cblp;
- USHORT e_cp;
- USHORT e_crlc;
- USHORT e_cparhdr;
- USHORT e_minalloc;
- USHORT e_maxalloc;
- USHORT e_ss;
- USHORT e_sp;
- USHORT e_csum;
- USHORT e_ip;
- USHORT e_cs;
- USHORT e_lfarlc;
- USHORT e_ovno;
- USHORT e_res[4];
- USHORT e_oemid;
- USHORT e_oeminfo;
- USHORT e_res2[10];
- LONG e_lfanew;
- } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
- #include <poppack.h>
- //
- // Export/Import Format
- //
- #include <pshpack4.h>
- typedef struct _IMAGE_EXPORT_DIRECTORY {
- ULONG Characteristics;
- ULONG TimeDateStamp;
- USHORT MajorVersion;
- USHORT MinorVersion;
- ULONG Name;
- ULONG Base;
- ULONG NumberOfFunctions;
- ULONG NumberOfNames;
- ULONG AddressOfFunctions;
- ULONG AddressOfNames;
- ULONG AddressOfNameOrdinals;
- } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
- //
- // Resource Data Entry Format
- //
- typedef struct _IMAGE_RESOURCE_DATA_ENTRY {
- ULONG OffsetToData;
- ULONG Size;
- ULONG CodePage;
- ULONG Reserved;
- } IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;
- //
- // Load Configuration Directory Entry Format
- //
- typedef struct {
- ULONG Size;
- ULONG TimeDateStamp;
- USHORT MajorVersion;
- USHORT MinorVersion;
- ULONG GlobalFlagsClear;
- ULONG GlobalFlagsSet;
- ULONG CriticalSectionDefaultTimeout;
- ULONG DeCommitFreeBlockThreshold;
- ULONG DeCommitTotalFreeThreshold;
- ULONG LockPrefixTable;
- ULONG MaximumAllocationSize;
- ULONG VirtualMemoryThreshold;
- ULONG ProcessHeapFlags;
- ULONG ProcessAffinityMask;
- USHORT CSDVersion;
- USHORT Reserved1;
- ULONG EditList;
- ULONG SecurityCookie;
- ULONG SEHandlerTable;
- ULONG SEHandlerCount;
- } IMAGE_LOAD_CONFIG_DIRECTORY32, *PIMAGE_LOAD_CONFIG_DIRECTORY32;
- typedef struct {
- ULONG Size;
- ULONG TimeDateStamp;
- USHORT MajorVersion;
- USHORT MinorVersion;
- ULONG GlobalFlagsClear;
- ULONG GlobalFlagsSet;
- ULONG CriticalSectionDefaultTimeout;
- ULONGLONG DeCommitFreeBlockThreshold;
- ULONGLONG DeCommitTotalFreeThreshold;
- ULONGLONG LockPrefixTable;
- ULONGLONG MaximumAllocationSize;
- ULONGLONG VirtualMemoryThreshold;
- ULONGLONG ProcessAffinityMask;
- ULONG ProcessHeapFlags;
- USHORT CSDVersion;
- USHORT Reserved1;
- ULONGLONG EditList;
- ULONGLONG SecurityCookie;
- ULONGLONG SEHandlerTable;
- ULONGLONG SEHandlerCount;
- } IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64;
- #ifdef _WIN64
- typedef IMAGE_LOAD_CONFIG_DIRECTORY64 IMAGE_LOAD_CONFIG_DIRECTORY;
- typedef PIMAGE_LOAD_CONFIG_DIRECTORY64 PIMAGE_LOAD_CONFIG_DIRECTORY;
- #else
- typedef IMAGE_LOAD_CONFIG_DIRECTORY32 IMAGE_LOAD_CONFIG_DIRECTORY;
- typedef PIMAGE_LOAD_CONFIG_DIRECTORY32 PIMAGE_LOAD_CONFIG_DIRECTORY;
- #endif
- //
- // Base Relocation Format
- //
- typedef struct _IMAGE_BASE_RELOCATION {
- ULONG VirtualAddress;
- ULONG SizeOfBlock;
- } IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION;
- //
- // Resource Format
- //
- typedef struct _IMAGE_RESOURCE_DIRECTORY {
- ULONG Characteristics;
- ULONG TimeDateStamp;
- USHORT MajorVersion;
- USHORT MinorVersion;
- USHORT NumberOfNamedEntries;
- USHORT NumberOfIdEntries;
- } IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;
- typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING {
- USHORT Length;
- CHAR NameString[ANYSIZE_ARRAY];
- } IMAGE_RESOURCE_DIRECTORY_STRING, *PIMAGE_RESOURCE_DIRECTORY_STRING;
- //
- // Section Header Format
- //
- #define IMAGE_SIZEOF_SHORT_NAME 8
- #define IMAGE_SIZEOF_SECTION_HEADER 40
- typedef struct _IMAGE_SECTION_HEADER {
- UCHAR Name[IMAGE_SIZEOF_SHORT_NAME];
- union
- {
- ULONG PhysicalAddress;
- ULONG VirtualSize;
- } Misc;
- ULONG VirtualAddress;
- ULONG SizeOfRawData;
- ULONG PointerToRawData;
- ULONG PointerToRelocations;
- ULONG PointerToLinenumbers;
- USHORT NumberOfRelocations;
- USHORT NumberOfLinenumbers;
- ULONG Characteristics;
- } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
- //
- // Section Characteristics
- //
- #define IMAGE_SCN_CNT_CODE 0x00000020
- #define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040
- #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080
- #define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000
- #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
- #define IMAGE_SCN_MEM_NOT_CACHED 0x04000000
- #define IMAGE_SCN_MEM_NOT_PAGED 0x08000000
- #define IMAGE_SCN_MEM_SHARED 0x10000000
- #define IMAGE_SCN_MEM_EXECUTE 0x20000000
- #define IMAGE_SCN_MEM_READ 0x40000000
- #define IMAGE_SCN_MEM_WRITE 0x80000000
- //
- // File Header Format
- //
- #define IMAGE_SIZEOF_FILE_HEADER 20
- typedef struct _IMAGE_FILE_HEADER {
- USHORT Machine;
- USHORT NumberOfSections;
- ULONG TimeDateStamp;
- ULONG PointerToSymbolTable;
- ULONG NumberOfSymbols;
- USHORT SizeOfOptionalHeader;
- USHORT Characteristics;
- } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
- //
- // File Characteristics
- //
- #define IMAGE_FILE_RELOCS_STRIPPED 0x0001
- #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002
- #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004
- #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008
- #define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010
- #define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020
- #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080
- #define IMAGE_FILE_32BIT_MACHINE 0x0100
- #define IMAGE_FILE_DEBUG_STRIPPED 0x0200
- #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400
- #define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800
- #define IMAGE_FILE_SYSTEM 0x1000
- #define IMAGE_FILE_DLL 0x2000
- #define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000
- #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000
- //
- // Directory format.
- //
- #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
- typedef struct _IMAGE_DATA_DIRECTORY {
- ULONG VirtualAddress;
- ULONG Size;
- } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
- //
- // Optional Header Formats
- //
- typedef struct _IMAGE_OPTIONAL_HEADER {
- USHORT Magic;
- UCHAR MajorLinkerVersion;
- UCHAR MinorLinkerVersion;
- ULONG SizeOfCode;
- ULONG SizeOfInitializedData;
- ULONG SizeOfUninitializedData;
- ULONG AddressOfEntryPoint;
- ULONG BaseOfCode;
- ULONG BaseOfData;
- ULONG ImageBase;
- ULONG SectionAlignment;
- ULONG FileAlignment;
- USHORT MajorOperatingSystemVersion;
- USHORT MinorOperatingSystemVersion;
- USHORT MajorImageVersion;
- USHORT MinorImageVersion;
- USHORT MajorSubsystemVersion;
- USHORT MinorSubsystemVersion;
- ULONG Win32VersionValue;
- ULONG SizeOfImage;
- ULONG SizeOfHeaders;
- ULONG CheckSum;
- USHORT Subsystem;
- USHORT DllCharacteristics;
- ULONG SizeOfStackReserve;
- ULONG SizeOfStackCommit;
- ULONG SizeOfHeapReserve;
- ULONG SizeOfHeapCommit;
- ULONG LoaderFlags;
- ULONG NumberOfRvaAndSizes;
- IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
- } IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
- typedef struct _IMAGE_ROM_OPTIONAL_HEADER {
- USHORT Magic;
- UCHAR MajorLinkerVersion;
- UCHAR MinorLinkerVersion;
- ULONG SizeOfCode;
- ULONG SizeOfInitializedData;
- ULONG SizeOfUninitializedData;
- ULONG AddressOfEntryPoint;
- ULONG BaseOfCode;
- ULONG BaseOfData;
- ULONG BaseOfBss;
- ULONG GprMask;
- ULONG CprMask[4];
- ULONG GpValue;
- } IMAGE_ROM_OPTIONAL_HEADER, *PIMAGE_ROM_OPTIONAL_HEADER;
- typedef struct _IMAGE_OPTIONAL_HEADER64 {
- USHORT Magic;
- UCHAR MajorLinkerVersion;
- UCHAR MinorLinkerVersion;
- ULONG SizeOfCode;
- ULONG SizeOfInitializedData;
- ULONG SizeOfUninitializedData;
- ULONG AddressOfEntryPoint;
- ULONG BaseOfCode;
- ULONGLONG ImageBase;
- ULONG SectionAlignment;
- ULONG FileAlignment;
- USHORT MajorOperatingSystemVersion;
- USHORT MinorOperatingSystemVersion;
- USHORT MajorImageVersion;
- USHORT MinorImageVersion;
- USHORT MajorSubsystemVersion;
- USHORT MinorSubsystemVersion;
- ULONG Win32VersionValue;
- ULONG SizeOfImage;
- ULONG SizeOfHeaders;
- ULONG CheckSum;
- USHORT Subsystem;
- USHORT DllCharacteristics;
- ULONGLONG SizeOfStackReserve;
- ULONGLONG SizeOfStackCommit;
- ULONGLONG SizeOfHeapReserve;
- ULONGLONG SizeOfHeapCommit;
- ULONG LoaderFlags;
- ULONG NumberOfRvaAndSizes;
- IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
- } IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
- //
- // Format Identifier Magics
- //
- #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b
- #define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b
- #define IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107
- #ifdef _WIN64
- typedef IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER;
- typedef PIMAGE_OPTIONAL_HEADER64 PIMAGE_OPTIONAL_HEADER;
- #define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR64_MAGIC
- #else
- typedef IMAGE_OPTIONAL_HEADER32 IMAGE_OPTIONAL_HEADER;
- typedef PIMAGE_OPTIONAL_HEADER32 PIMAGE_OPTIONAL_HEADER;
- #define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR32_MAGIC
- #endif
- //
- // Nt Header Formats
- //
- typedef struct _IMAGE_NT_HEADERS64 {
- ULONG Signature;
- IMAGE_FILE_HEADER FileHeader;
- IMAGE_OPTIONAL_HEADER64 OptionalHeader;
- } IMAGE_NT_HEADERS64;
- typedef struct _IMAGE_NT_HEADERS {
- ULONG Signature;
- IMAGE_FILE_HEADER FileHeader;
- IMAGE_OPTIONAL_HEADER32 OptionalHeader;
- } IMAGE_NT_HEADERS32;
- #ifdef _WIN64
- typedef IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS;
- #else
- typedef IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS;
- #endif
- #ifndef _NTDDK_
- typedef struct _IMAGE_NT_HEADERS *PIMAGE_NT_HEADERS32;
- typedef struct _IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
- #ifdef _WIN64
- typedef PIMAGE_NT_HEADERS64 PIMAGE_NT_HEADERS;
- #else
- typedef PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS;
- #endif
- #endif /* _NTDDK_ */
- //
- // Retreives the first image section header from the Nt Header
- //
- #define IMAGE_FIRST_SECTION( NtHeader ) ((PIMAGE_SECTION_HEADER) \
- ((ULONG_PTR)(NtHeader) + \
- FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) + \
- ((NtHeader))->FileHeader.SizeOfOptionalHeader \
- ))
- //
- // Dll Characteristics
- //
- #define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA 0x0020
- #define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040
- #define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY 0x0080
- #define IMAGE_DLLCHARACTERISTICS_NX_COMPAT 0x0100
- #define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200
- #define IMAGE_DLLCHARACTERISTICS_NO_SEH 0x0400
- #define IMAGE_DLLCHARACTERISTICS_NO_BIND 0x0800
- #define IMAGE_DLLCHARACTERISTICS_APPCONTAINER 0x1000
- #define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER 0x2000
- #define IMAGE_DLLCHARACTERISTICS_GUARD_CF 0x4000
- #define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000
- //
- // Loader Flags
- //
- #define IMAGE_LOADER_FLAGS_COMPLUS 0x00000001
- #define IMAGE_LOADER_FLAGS_SYSTEM_GLOBAL 0x01000000
- //
- // Directory Entry Specifiers
- //
- #define IMAGE_DIRECTORY_ENTRY_EXPORT 0
- #define IMAGE_DIRECTORY_ENTRY_IMPORT 1
- #define IMAGE_DIRECTORY_ENTRY_RESOURCE 2
- #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3
- #define IMAGE_DIRECTORY_ENTRY_SECURITY 4
- #define IMAGE_DIRECTORY_ENTRY_BASERELOC 5
- #define IMAGE_DIRECTORY_ENTRY_DEBUG 6
- #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7
- #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8
- #define IMAGE_DIRECTORY_ENTRY_TLS 9
- #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10
- #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11
- #define IMAGE_DIRECTORY_ENTRY_IAT 12
- #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13
- #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14
- //
- // Import Formats
- //
- typedef struct _IMAGE_IMPORT_BY_NAME {
- USHORT Hint;
- UCHAR Name[1];
- } IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
- #include <pshpack8.h>
- typedef struct _IMAGE_THUNK_DATA64 {
- union {
- ULONGLONG ForwarderString;
- ULONGLONG Function;
- ULONGLONG Ordinal;
- ULONGLONG AddressOfData;
- } u1;
- } IMAGE_THUNK_DATA64, *PIMAGE_THUNK_DATA64;
- #include <poppack.h>
- typedef struct _IMAGE_THUNK_DATA32 {
- union {
- ULONG ForwarderString;
- ULONG Function;
- ULONG Ordinal;
- ULONG AddressOfData;
- } u1;
- } IMAGE_THUNK_DATA32, *PIMAGE_THUNK_DATA32;
- #define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL
- #define IMAGE_ORDINAL_FLAG32 0x80000000
- #define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)
- #define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)
- #define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
- #define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
- //
- // Thread Local Storage (TLS)
- //
- typedef
- VOID
- (NTAPI *PIMAGE_TLS_CALLBACK) (
- PVOID DllHandle,
- ULONG Reason,
- PVOID Reserved
- );
- typedef struct _IMAGE_TLS_DIRECTORY64 {
- ULONGLONG StartAddressOfRawData;
- ULONGLONG EndAddressOfRawData;
- ULONGLONG AddressOfIndex;
- ULONGLONG AddressOfCallBacks;
- ULONG SizeOfZeroFill;
- ULONG Characteristics;
- } IMAGE_TLS_DIRECTORY64, *PIMAGE_TLS_DIRECTORY64;
- typedef struct _IMAGE_TLS_DIRECTORY32 {
- ULONG StartAddressOfRawData;
- ULONG EndAddressOfRawData;
- ULONG AddressOfIndex;
- ULONG AddressOfCallBacks;
- ULONG SizeOfZeroFill;
- ULONG Characteristics;
- } IMAGE_TLS_DIRECTORY32, *PIMAGE_TLS_DIRECTORY32;
- #ifdef _WIN64
- #define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG64
- #define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL64(Ordinal)
- typedef IMAGE_THUNK_DATA64 IMAGE_THUNK_DATA;
- typedef PIMAGE_THUNK_DATA64 PIMAGE_THUNK_DATA;
- #define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL64(Ordinal)
- typedef IMAGE_TLS_DIRECTORY64 IMAGE_TLS_DIRECTORY;
- typedef PIMAGE_TLS_DIRECTORY64 PIMAGE_TLS_DIRECTORY;
- #else
- #define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG32
- #define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL32(Ordinal)
- typedef IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA;
- typedef PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA;
- #define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL32(Ordinal)
- typedef IMAGE_TLS_DIRECTORY32 IMAGE_TLS_DIRECTORY;
- typedef PIMAGE_TLS_DIRECTORY32 PIMAGE_TLS_DIRECTORY;
- #endif
- typedef struct _IMAGE_IMPORT_DESCRIPTOR {
- _ANONYMOUS_UNION union {
- ULONG Characteristics;
- ULONG OriginalFirstThunk;
- } DUMMYUNIONNAME;
- ULONG TimeDateStamp;
- ULONG ForwarderChain;
- ULONG Name;
- ULONG FirstThunk;
- } IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR;
- #include <poppack.h>
- #endif /* _NTIMAGE_ */
|