ntimage.h 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563
  1. #ifndef _NTIMAGE_
  2. #define _NTIMAGE_
  3. //
  4. // Image Formats
  5. //
  6. #define IMAGE_DOS_SIGNATURE 0x5A4D
  7. #define IMAGE_OS2_SIGNATURE 0x454E
  8. #define IMAGE_OS2_SIGNATURE_LE 0x454C
  9. #define IMAGE_VXD_SIGNATURE 0x454C
  10. #define IMAGE_NT_SIGNATURE 0x00004550
  11. //
  12. // Image architectures
  13. //
  14. #define IMAGE_FILE_MACHINE_AM33 0x1d3
  15. #define IMAGE_FILE_MACHINE_AMD64 0x8664
  16. #define IMAGE_FILE_MACHINE_ARM 0x1c0
  17. #define IMAGE_FILE_MACHINE_ARMV7 0x1c4
  18. #define IMAGE_FILE_MACHINE_EBC 0xebc
  19. #define IMAGE_FILE_MACHINE_I386 0x14c
  20. #define IMAGE_FILE_MACHINE_IA64 0x200
  21. #define IMAGE_FILE_MACHINE_M32R 0x9041
  22. #define IMAGE_FILE_MACHINE_MIPS16 0x266
  23. #define IMAGE_FILE_MACHINE_MIPSFPU 0x366
  24. #define IMAGE_FILE_MACHINE_MIPSFPU16 0x466
  25. #define IMAGE_FILE_MACHINE_POWERPC 0x1f0
  26. #define IMAGE_FILE_MACHINE_POWERPCFP 0x1f1
  27. #define IMAGE_FILE_MACHINE_R4000 0x166
  28. #define IMAGE_FILE_MACHINE_SH3 0x1a2
  29. #define IMAGE_FILE_MACHINE_SH3E 0x01a4
  30. #define IMAGE_FILE_MACHINE_SH3DSP 0x1a3
  31. #define IMAGE_FILE_MACHINE_SH4 0x1a6
  32. #define IMAGE_FILE_MACHINE_SH5 0x1a8
  33. #define IMAGE_FILE_MACHINE_THUMB 0x1c2
  34. #define IMAGE_FILE_MACHINE_WCEMIPSV2 0x169
  35. #define IMAGE_FILE_MACHINE_R3000 0x162
  36. #define IMAGE_FILE_MACHINE_R10000 0x168
  37. #define IMAGE_FILE_MACHINE_ALPHA 0x184
  38. #define IMAGE_FILE_MACHINE_ALPHA64 0x0284
  39. #define IMAGE_FILE_MACHINE_AXP64 IMAGE_FILE_MACHINE_ALPHA64
  40. #define IMAGE_FILE_MACHINE_CEE 0xC0EE
  41. #define IMAGE_FILE_MACHINE_TRICORE 0x0520
  42. #define IMAGE_FILE_MACHINE_CEF 0x0CEF
  43. //
  44. // DOS Image Header Format
  45. //
  46. #include <pshpack2.h>
  47. typedef struct _IMAGE_DOS_HEADER {
  48. USHORT e_magic;
  49. USHORT e_cblp;
  50. USHORT e_cp;
  51. USHORT e_crlc;
  52. USHORT e_cparhdr;
  53. USHORT e_minalloc;
  54. USHORT e_maxalloc;
  55. USHORT e_ss;
  56. USHORT e_sp;
  57. USHORT e_csum;
  58. USHORT e_ip;
  59. USHORT e_cs;
  60. USHORT e_lfarlc;
  61. USHORT e_ovno;
  62. USHORT e_res[4];
  63. USHORT e_oemid;
  64. USHORT e_oeminfo;
  65. USHORT e_res2[10];
  66. LONG e_lfanew;
  67. } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
  68. #include <poppack.h>
  69. //
  70. // Export/Import Format
  71. //
  72. #include <pshpack4.h>
  73. typedef struct _IMAGE_EXPORT_DIRECTORY {
  74. ULONG Characteristics;
  75. ULONG TimeDateStamp;
  76. USHORT MajorVersion;
  77. USHORT MinorVersion;
  78. ULONG Name;
  79. ULONG Base;
  80. ULONG NumberOfFunctions;
  81. ULONG NumberOfNames;
  82. ULONG AddressOfFunctions;
  83. ULONG AddressOfNames;
  84. ULONG AddressOfNameOrdinals;
  85. } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
  86. //
  87. // Resource Data Entry Format
  88. //
  89. typedef struct _IMAGE_RESOURCE_DATA_ENTRY {
  90. ULONG OffsetToData;
  91. ULONG Size;
  92. ULONG CodePage;
  93. ULONG Reserved;
  94. } IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;
  95. //
  96. // Load Configuration Directory Entry Format
  97. //
  98. typedef struct {
  99. ULONG Size;
  100. ULONG TimeDateStamp;
  101. USHORT MajorVersion;
  102. USHORT MinorVersion;
  103. ULONG GlobalFlagsClear;
  104. ULONG GlobalFlagsSet;
  105. ULONG CriticalSectionDefaultTimeout;
  106. ULONG DeCommitFreeBlockThreshold;
  107. ULONG DeCommitTotalFreeThreshold;
  108. ULONG LockPrefixTable;
  109. ULONG MaximumAllocationSize;
  110. ULONG VirtualMemoryThreshold;
  111. ULONG ProcessHeapFlags;
  112. ULONG ProcessAffinityMask;
  113. USHORT CSDVersion;
  114. USHORT Reserved1;
  115. ULONG EditList;
  116. ULONG SecurityCookie;
  117. ULONG SEHandlerTable;
  118. ULONG SEHandlerCount;
  119. } IMAGE_LOAD_CONFIG_DIRECTORY32, *PIMAGE_LOAD_CONFIG_DIRECTORY32;
  120. typedef struct {
  121. ULONG Size;
  122. ULONG TimeDateStamp;
  123. USHORT MajorVersion;
  124. USHORT MinorVersion;
  125. ULONG GlobalFlagsClear;
  126. ULONG GlobalFlagsSet;
  127. ULONG CriticalSectionDefaultTimeout;
  128. ULONGLONG DeCommitFreeBlockThreshold;
  129. ULONGLONG DeCommitTotalFreeThreshold;
  130. ULONGLONG LockPrefixTable;
  131. ULONGLONG MaximumAllocationSize;
  132. ULONGLONG VirtualMemoryThreshold;
  133. ULONGLONG ProcessAffinityMask;
  134. ULONG ProcessHeapFlags;
  135. USHORT CSDVersion;
  136. USHORT Reserved1;
  137. ULONGLONG EditList;
  138. ULONGLONG SecurityCookie;
  139. ULONGLONG SEHandlerTable;
  140. ULONGLONG SEHandlerCount;
  141. } IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64;
  142. #ifdef _WIN64
  143. typedef IMAGE_LOAD_CONFIG_DIRECTORY64 IMAGE_LOAD_CONFIG_DIRECTORY;
  144. typedef PIMAGE_LOAD_CONFIG_DIRECTORY64 PIMAGE_LOAD_CONFIG_DIRECTORY;
  145. #else
  146. typedef IMAGE_LOAD_CONFIG_DIRECTORY32 IMAGE_LOAD_CONFIG_DIRECTORY;
  147. typedef PIMAGE_LOAD_CONFIG_DIRECTORY32 PIMAGE_LOAD_CONFIG_DIRECTORY;
  148. #endif
  149. //
  150. // Base Relocation Format
  151. //
  152. typedef struct _IMAGE_BASE_RELOCATION {
  153. ULONG VirtualAddress;
  154. ULONG SizeOfBlock;
  155. } IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION;
  156. //
  157. // Resource Format
  158. //
  159. typedef struct _IMAGE_RESOURCE_DIRECTORY {
  160. ULONG Characteristics;
  161. ULONG TimeDateStamp;
  162. USHORT MajorVersion;
  163. USHORT MinorVersion;
  164. USHORT NumberOfNamedEntries;
  165. USHORT NumberOfIdEntries;
  166. } IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;
  167. typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING {
  168. USHORT Length;
  169. CHAR NameString[ANYSIZE_ARRAY];
  170. } IMAGE_RESOURCE_DIRECTORY_STRING, *PIMAGE_RESOURCE_DIRECTORY_STRING;
  171. //
  172. // Section Header Format
  173. //
  174. #define IMAGE_SIZEOF_SHORT_NAME 8
  175. #define IMAGE_SIZEOF_SECTION_HEADER 40
  176. typedef struct _IMAGE_SECTION_HEADER {
  177. UCHAR Name[IMAGE_SIZEOF_SHORT_NAME];
  178. union
  179. {
  180. ULONG PhysicalAddress;
  181. ULONG VirtualSize;
  182. } Misc;
  183. ULONG VirtualAddress;
  184. ULONG SizeOfRawData;
  185. ULONG PointerToRawData;
  186. ULONG PointerToRelocations;
  187. ULONG PointerToLinenumbers;
  188. USHORT NumberOfRelocations;
  189. USHORT NumberOfLinenumbers;
  190. ULONG Characteristics;
  191. } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
  192. //
  193. // Section Characteristics
  194. //
  195. #define IMAGE_SCN_CNT_CODE 0x00000020
  196. #define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040
  197. #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080
  198. #define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000
  199. #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000
  200. #define IMAGE_SCN_MEM_NOT_CACHED 0x04000000
  201. #define IMAGE_SCN_MEM_NOT_PAGED 0x08000000
  202. #define IMAGE_SCN_MEM_SHARED 0x10000000
  203. #define IMAGE_SCN_MEM_EXECUTE 0x20000000
  204. #define IMAGE_SCN_MEM_READ 0x40000000
  205. #define IMAGE_SCN_MEM_WRITE 0x80000000
  206. //
  207. // File Header Format
  208. //
  209. #define IMAGE_SIZEOF_FILE_HEADER 20
  210. typedef struct _IMAGE_FILE_HEADER {
  211. USHORT Machine;
  212. USHORT NumberOfSections;
  213. ULONG TimeDateStamp;
  214. ULONG PointerToSymbolTable;
  215. ULONG NumberOfSymbols;
  216. USHORT SizeOfOptionalHeader;
  217. USHORT Characteristics;
  218. } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
  219. //
  220. // File Characteristics
  221. //
  222. #define IMAGE_FILE_RELOCS_STRIPPED 0x0001
  223. #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002
  224. #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004
  225. #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008
  226. #define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010
  227. #define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020
  228. #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080
  229. #define IMAGE_FILE_32BIT_MACHINE 0x0100
  230. #define IMAGE_FILE_DEBUG_STRIPPED 0x0200
  231. #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400
  232. #define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800
  233. #define IMAGE_FILE_SYSTEM 0x1000
  234. #define IMAGE_FILE_DLL 0x2000
  235. #define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000
  236. #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000
  237. //
  238. // Directory format.
  239. //
  240. #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
  241. typedef struct _IMAGE_DATA_DIRECTORY {
  242. ULONG VirtualAddress;
  243. ULONG Size;
  244. } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
  245. //
  246. // Optional Header Formats
  247. //
  248. typedef struct _IMAGE_OPTIONAL_HEADER {
  249. USHORT Magic;
  250. UCHAR MajorLinkerVersion;
  251. UCHAR MinorLinkerVersion;
  252. ULONG SizeOfCode;
  253. ULONG SizeOfInitializedData;
  254. ULONG SizeOfUninitializedData;
  255. ULONG AddressOfEntryPoint;
  256. ULONG BaseOfCode;
  257. ULONG BaseOfData;
  258. ULONG ImageBase;
  259. ULONG SectionAlignment;
  260. ULONG FileAlignment;
  261. USHORT MajorOperatingSystemVersion;
  262. USHORT MinorOperatingSystemVersion;
  263. USHORT MajorImageVersion;
  264. USHORT MinorImageVersion;
  265. USHORT MajorSubsystemVersion;
  266. USHORT MinorSubsystemVersion;
  267. ULONG Win32VersionValue;
  268. ULONG SizeOfImage;
  269. ULONG SizeOfHeaders;
  270. ULONG CheckSum;
  271. USHORT Subsystem;
  272. USHORT DllCharacteristics;
  273. ULONG SizeOfStackReserve;
  274. ULONG SizeOfStackCommit;
  275. ULONG SizeOfHeapReserve;
  276. ULONG SizeOfHeapCommit;
  277. ULONG LoaderFlags;
  278. ULONG NumberOfRvaAndSizes;
  279. IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
  280. } IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
  281. typedef struct _IMAGE_ROM_OPTIONAL_HEADER {
  282. USHORT Magic;
  283. UCHAR MajorLinkerVersion;
  284. UCHAR MinorLinkerVersion;
  285. ULONG SizeOfCode;
  286. ULONG SizeOfInitializedData;
  287. ULONG SizeOfUninitializedData;
  288. ULONG AddressOfEntryPoint;
  289. ULONG BaseOfCode;
  290. ULONG BaseOfData;
  291. ULONG BaseOfBss;
  292. ULONG GprMask;
  293. ULONG CprMask[4];
  294. ULONG GpValue;
  295. } IMAGE_ROM_OPTIONAL_HEADER, *PIMAGE_ROM_OPTIONAL_HEADER;
  296. typedef struct _IMAGE_OPTIONAL_HEADER64 {
  297. USHORT Magic;
  298. UCHAR MajorLinkerVersion;
  299. UCHAR MinorLinkerVersion;
  300. ULONG SizeOfCode;
  301. ULONG SizeOfInitializedData;
  302. ULONG SizeOfUninitializedData;
  303. ULONG AddressOfEntryPoint;
  304. ULONG BaseOfCode;
  305. ULONGLONG ImageBase;
  306. ULONG SectionAlignment;
  307. ULONG FileAlignment;
  308. USHORT MajorOperatingSystemVersion;
  309. USHORT MinorOperatingSystemVersion;
  310. USHORT MajorImageVersion;
  311. USHORT MinorImageVersion;
  312. USHORT MajorSubsystemVersion;
  313. USHORT MinorSubsystemVersion;
  314. ULONG Win32VersionValue;
  315. ULONG SizeOfImage;
  316. ULONG SizeOfHeaders;
  317. ULONG CheckSum;
  318. USHORT Subsystem;
  319. USHORT DllCharacteristics;
  320. ULONGLONG SizeOfStackReserve;
  321. ULONGLONG SizeOfStackCommit;
  322. ULONGLONG SizeOfHeapReserve;
  323. ULONGLONG SizeOfHeapCommit;
  324. ULONG LoaderFlags;
  325. ULONG NumberOfRvaAndSizes;
  326. IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
  327. } IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
  328. //
  329. // Format Identifier Magics
  330. //
  331. #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b
  332. #define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b
  333. #define IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107
  334. #ifdef _WIN64
  335. typedef IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER;
  336. typedef PIMAGE_OPTIONAL_HEADER64 PIMAGE_OPTIONAL_HEADER;
  337. #define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR64_MAGIC
  338. #else
  339. typedef IMAGE_OPTIONAL_HEADER32 IMAGE_OPTIONAL_HEADER;
  340. typedef PIMAGE_OPTIONAL_HEADER32 PIMAGE_OPTIONAL_HEADER;
  341. #define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR32_MAGIC
  342. #endif
  343. //
  344. // Nt Header Formats
  345. //
  346. typedef struct _IMAGE_NT_HEADERS64 {
  347. ULONG Signature;
  348. IMAGE_FILE_HEADER FileHeader;
  349. IMAGE_OPTIONAL_HEADER64 OptionalHeader;
  350. } IMAGE_NT_HEADERS64;
  351. typedef struct _IMAGE_NT_HEADERS {
  352. ULONG Signature;
  353. IMAGE_FILE_HEADER FileHeader;
  354. IMAGE_OPTIONAL_HEADER32 OptionalHeader;
  355. } IMAGE_NT_HEADERS32;
  356. #ifdef _WIN64
  357. typedef IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS;
  358. #else
  359. typedef IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS;
  360. #endif
  361. #ifndef _NTDDK_
  362. typedef struct _IMAGE_NT_HEADERS *PIMAGE_NT_HEADERS32;
  363. typedef struct _IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
  364. #ifdef _WIN64
  365. typedef PIMAGE_NT_HEADERS64 PIMAGE_NT_HEADERS;
  366. #else
  367. typedef PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS;
  368. #endif
  369. #endif /* _NTDDK_ */
  370. //
  371. // Retreives the first image section header from the Nt Header
  372. //
  373. #define IMAGE_FIRST_SECTION( NtHeader ) ((PIMAGE_SECTION_HEADER) \
  374. ((ULONG_PTR)(NtHeader) + \
  375. FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) + \
  376. ((NtHeader))->FileHeader.SizeOfOptionalHeader \
  377. ))
  378. //
  379. // Dll Characteristics
  380. //
  381. #define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA 0x0020
  382. #define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040
  383. #define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY 0x0080
  384. #define IMAGE_DLLCHARACTERISTICS_NX_COMPAT 0x0100
  385. #define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200
  386. #define IMAGE_DLLCHARACTERISTICS_NO_SEH 0x0400
  387. #define IMAGE_DLLCHARACTERISTICS_NO_BIND 0x0800
  388. #define IMAGE_DLLCHARACTERISTICS_APPCONTAINER 0x1000
  389. #define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER 0x2000
  390. #define IMAGE_DLLCHARACTERISTICS_GUARD_CF 0x4000
  391. #define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000
  392. //
  393. // Loader Flags
  394. //
  395. #define IMAGE_LOADER_FLAGS_COMPLUS 0x00000001
  396. #define IMAGE_LOADER_FLAGS_SYSTEM_GLOBAL 0x01000000
  397. //
  398. // Directory Entry Specifiers
  399. //
  400. #define IMAGE_DIRECTORY_ENTRY_EXPORT 0
  401. #define IMAGE_DIRECTORY_ENTRY_IMPORT 1
  402. #define IMAGE_DIRECTORY_ENTRY_RESOURCE 2
  403. #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3
  404. #define IMAGE_DIRECTORY_ENTRY_SECURITY 4
  405. #define IMAGE_DIRECTORY_ENTRY_BASERELOC 5
  406. #define IMAGE_DIRECTORY_ENTRY_DEBUG 6
  407. #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7
  408. #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8
  409. #define IMAGE_DIRECTORY_ENTRY_TLS 9
  410. #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10
  411. #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11
  412. #define IMAGE_DIRECTORY_ENTRY_IAT 12
  413. #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13
  414. #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14
  415. //
  416. // Import Formats
  417. //
  418. typedef struct _IMAGE_IMPORT_BY_NAME {
  419. USHORT Hint;
  420. UCHAR Name[1];
  421. } IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
  422. #include <pshpack8.h>
  423. typedef struct _IMAGE_THUNK_DATA64 {
  424. union {
  425. ULONGLONG ForwarderString;
  426. ULONGLONG Function;
  427. ULONGLONG Ordinal;
  428. ULONGLONG AddressOfData;
  429. } u1;
  430. } IMAGE_THUNK_DATA64, *PIMAGE_THUNK_DATA64;
  431. #include <poppack.h>
  432. typedef struct _IMAGE_THUNK_DATA32 {
  433. union {
  434. ULONG ForwarderString;
  435. ULONG Function;
  436. ULONG Ordinal;
  437. ULONG AddressOfData;
  438. } u1;
  439. } IMAGE_THUNK_DATA32, *PIMAGE_THUNK_DATA32;
  440. #define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL
  441. #define IMAGE_ORDINAL_FLAG32 0x80000000
  442. #define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)
  443. #define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)
  444. #define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
  445. #define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
  446. //
  447. // Thread Local Storage (TLS)
  448. //
  449. typedef
  450. VOID
  451. (NTAPI *PIMAGE_TLS_CALLBACK) (
  452. PVOID DllHandle,
  453. ULONG Reason,
  454. PVOID Reserved
  455. );
  456. typedef struct _IMAGE_TLS_DIRECTORY64 {
  457. ULONGLONG StartAddressOfRawData;
  458. ULONGLONG EndAddressOfRawData;
  459. ULONGLONG AddressOfIndex;
  460. ULONGLONG AddressOfCallBacks;
  461. ULONG SizeOfZeroFill;
  462. ULONG Characteristics;
  463. } IMAGE_TLS_DIRECTORY64, *PIMAGE_TLS_DIRECTORY64;
  464. typedef struct _IMAGE_TLS_DIRECTORY32 {
  465. ULONG StartAddressOfRawData;
  466. ULONG EndAddressOfRawData;
  467. ULONG AddressOfIndex;
  468. ULONG AddressOfCallBacks;
  469. ULONG SizeOfZeroFill;
  470. ULONG Characteristics;
  471. } IMAGE_TLS_DIRECTORY32, *PIMAGE_TLS_DIRECTORY32;
  472. #ifdef _WIN64
  473. #define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG64
  474. #define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL64(Ordinal)
  475. typedef IMAGE_THUNK_DATA64 IMAGE_THUNK_DATA;
  476. typedef PIMAGE_THUNK_DATA64 PIMAGE_THUNK_DATA;
  477. #define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL64(Ordinal)
  478. typedef IMAGE_TLS_DIRECTORY64 IMAGE_TLS_DIRECTORY;
  479. typedef PIMAGE_TLS_DIRECTORY64 PIMAGE_TLS_DIRECTORY;
  480. #else
  481. #define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG32
  482. #define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL32(Ordinal)
  483. typedef IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA;
  484. typedef PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA;
  485. #define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL32(Ordinal)
  486. typedef IMAGE_TLS_DIRECTORY32 IMAGE_TLS_DIRECTORY;
  487. typedef PIMAGE_TLS_DIRECTORY32 PIMAGE_TLS_DIRECTORY;
  488. #endif
  489. typedef struct _IMAGE_IMPORT_DESCRIPTOR {
  490. _ANONYMOUS_UNION union {
  491. ULONG Characteristics;
  492. ULONG OriginalFirstThunk;
  493. } DUMMYUNIONNAME;
  494. ULONG TimeDateStamp;
  495. ULONG ForwarderChain;
  496. ULONG Name;
  497. ULONG FirstThunk;
  498. } IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR;
  499. #include <poppack.h>
  500. #endif /* _NTIMAGE_ */