diff options
Diffstat (limited to 'tools/pe_bliss/pe_structures.h')
| -rw-r--r-- | tools/pe_bliss/pe_structures.h | 1028 |
1 files changed, 0 insertions, 1028 deletions
diff --git a/tools/pe_bliss/pe_structures.h b/tools/pe_bliss/pe_structures.h deleted file mode 100644 index efc99103b2..0000000000 --- a/tools/pe_bliss/pe_structures.h +++ /dev/null @@ -1,1028 +0,0 @@ -/*************************************************************************/ -/* Copyright (c) 2015 dx, http://kaimi.ru */ -/* */ -/* Permission is hereby granted, free of charge, to any person */ -/* obtaining a copy of this software and associated documentation */ -/* files (the "Software"), to deal in the Software without */ -/* restriction, including without limitation the rights to use, */ -/* copy, modify, merge, publish, distribute, sublicense, and/or */ -/* sell copies of the Software, and to permit persons to whom the */ -/* Software is furnished to do so, subject to the following conditions: */ -/* The above copyright notice and this permission notice shall be */ -/* included in all copies or substantial portions of the Software. */ -/* */ -/* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, */ -/* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF */ -/* MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.*/ -/* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY */ -/* CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, */ -/* TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE */ -/* SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. */ -/*************************************************************************/ -#pragma once -#include <string> -#include <sstream> -#include "stdint_defs.h" -#if defined(_MSC_VER) or defined(__MINGW32__) -#define PE_BLISS_WINDOWS -#endif - -namespace pe_bliss -{ -//Enumeration of PE types -enum pe_type -{ - pe_type_32, - pe_type_64 -}; - -namespace pe_win -{ -const uint32_t image_numberof_directory_entries = 16; -const uint32_t image_nt_optional_hdr32_magic = 0x10b; -const uint32_t image_nt_optional_hdr64_magic = 0x20b; -const uint32_t image_resource_name_is_string = 0x80000000; -const uint32_t image_resource_data_is_directory = 0x80000000; - -const uint32_t image_dllcharacteristics_dynamic_base = 0x0040; // DLL can move. -const uint32_t image_dllcharacteristics_force_integrity = 0x0080; // Code Integrity Image -const uint32_t image_dllcharacteristics_nx_compat = 0x0100; // Image is NX compatible -const uint32_t image_dllcharacteristics_no_isolation = 0x0200; // Image understands isolation and doesn't want it -const uint32_t image_dllcharacteristics_no_seh = 0x0400; // Image does not use SEH. No SE handler may reside in this image -const uint32_t image_dllcharacteristics_no_bind = 0x0800; // Do not bind this image. -const uint32_t image_dllcharacteristics_wdm_driver = 0x2000; // Driver uses WDM model -const uint32_t image_dllcharacteristics_terminal_server_aware = 0x8000; - -const uint32_t image_sizeof_file_header = 20; - -const uint32_t image_file_relocs_stripped = 0x0001; // Relocation info stripped from file. -const uint32_t image_file_executable_image = 0x0002; // File is executable (i.e. no unresolved externel references). -const uint32_t image_file_line_nums_stripped = 0x0004; // Line nunbers stripped from file. -const uint32_t image_file_local_syms_stripped = 0x0008; // Local symbols stripped from file. -const uint32_t image_file_aggresive_ws_trim = 0x0010; // Agressively trim working set -const uint32_t image_file_large_address_aware = 0x0020; // App can handle >2gb addresses -const uint32_t image_file_bytes_reversed_lo = 0x0080; // Bytes of machine word are reversed. -const uint32_t image_file_32bit_machine = 0x0100; // 32 bit word machine. -const uint32_t image_file_debug_stripped = 0x0200; // Debugging info stripped from file in .DBG file -const uint32_t image_file_removable_run_from_swap = 0x0400; // If Image is on removable media, copy and run from the swap file. -const uint32_t image_file_net_run_from_swap = 0x0800; // If Image is on Net, copy and run from the swap file. -const uint32_t image_file_system = 0x1000; // System File. -const uint32_t image_file_dll = 0x2000; // File is a DLL. -const uint32_t image_file_up_system_only = 0x4000; // File should only be run on a UP machine -const uint32_t image_file_bytes_reversed_hi = 0x8000; // Bytes of machine word are reversed. - -const uint32_t image_scn_lnk_nreloc_ovfl = 0x01000000; // Section contains extended relocations. -const uint32_t image_scn_mem_discardable = 0x02000000; // Section can be discarded. -const uint32_t image_scn_mem_not_cached = 0x04000000; // Section is not cachable. -const uint32_t image_scn_mem_not_paged = 0x08000000; // Section is not pageable. -const uint32_t image_scn_mem_shared = 0x10000000; // Section is shareable. -const uint32_t image_scn_mem_execute = 0x20000000; // Section is executable. -const uint32_t image_scn_mem_read = 0x40000000; // Section is readable. -const uint32_t image_scn_mem_write = 0x80000000; // Section is writeable. - -const uint32_t image_scn_cnt_code = 0x00000020; // Section contains code. -const uint32_t image_scn_cnt_initialized_data = 0x00000040; // Section contains initialized data. -const uint32_t image_scn_cnt_uninitialized_data = 0x00000080; // Section contains uninitialized data. - -//Directory Entries -const uint32_t image_directory_entry_export = 0; // Export Directory -const uint32_t image_directory_entry_import = 1; // Import Directory -const uint32_t image_directory_entry_resource = 2; // Resource Directory -const uint32_t image_directory_entry_exception = 3; // Exception Directory -const uint32_t image_directory_entry_security = 4; // Security Directory -const uint32_t image_directory_entry_basereloc = 5; // Base Relocation Table -const uint32_t image_directory_entry_debug = 6; // Debug Directory -const uint32_t image_directory_entry_architecture = 7; // Architecture Specific Data -const uint32_t image_directory_entry_globalptr = 8; // RVA of GP -const uint32_t image_directory_entry_tls = 9; // TLS Directory -const uint32_t image_directory_entry_load_config = 10; // Load Configuration Directory -const uint32_t image_directory_entry_bound_import = 11; // Bound Import Directory in headers -const uint32_t image_directory_entry_iat = 12; // Import Address Table -const uint32_t image_directory_entry_delay_import = 13; // Delay Load Import Descriptors -const uint32_t image_directory_entry_com_descriptor = 14; // COM Runtime descriptor - -//Subsystem Values -const uint32_t image_subsystem_unknown = 0; // Unknown subsystem. -const uint32_t image_subsystem_native = 1; // Image doesn't require a subsystem. -const uint32_t image_subsystem_windows_gui = 2; // Image runs in the Windows GUI subsystem. -const uint32_t image_subsystem_windows_cui = 3; // Image runs in the Windows character subsystem. -const uint32_t image_subsystem_os2_cui = 5; // image runs in the OS/2 character subsystem. -const uint32_t image_subsystem_posix_cui = 7; // image runs in the Posix character subsystem. -const uint32_t image_subsystem_native_windows = 8; // image is a native Win9x driver. -const uint32_t image_subsystem_windows_ce_gui = 9; // Image runs in the Windows CE subsystem. -const uint32_t image_subsystem_efi_application = 10; // -const uint32_t image_subsystem_efi_boot_service_driver = 11; // -const uint32_t image_subsystem_efi_runtime_driver = 12; // -const uint32_t image_subsystem_efi_rom = 13; -const uint32_t image_subsystem_xbox = 14; -const uint32_t image_subsystem_windows_boot_application = 16; - -//Imports -const uint64_t image_ordinal_flag64 = 0x8000000000000000ull; -const uint32_t image_ordinal_flag32 = 0x80000000; - -//Based relocation types -const uint32_t image_rel_based_absolute = 0; -const uint32_t image_rel_based_high = 1; -const uint32_t image_rel_based_low = 2; -const uint32_t image_rel_based_highlow = 3; -const uint32_t image_rel_based_highadj = 4; -const uint32_t image_rel_based_mips_jmpaddr = 5; -const uint32_t image_rel_based_mips_jmpaddr16 = 9; -const uint32_t image_rel_based_ia64_imm64 = 9; -const uint32_t image_rel_based_dir64 = 10; - -//Exception directory -//The function has an exception handler that should be called when looking for functions that need to examine exceptions -const uint32_t unw_flag_ehandler = 0x01; -//The function has a termination handler that should be called when unwinding an exception -const uint32_t unw_flag_uhandler = 0x02; -//This unwind info structure is not the primary one for the procedure. -//Instead, the chained unwind info entry is the contents of a previous RUNTIME_FUNCTION entry. -//If this flag is set, then the UNW_FLAG_EHANDLER and UNW_FLAG_UHANDLER flags must be cleared. -//Also, the frame register and fixed-stack allocation fields must have the same values as in the primary unwind info -const uint32_t unw_flag_chaininfo = 0x04; - -//Debug -const uint32_t image_debug_misc_exename = 1; -const uint32_t image_debug_type_unknown = 0; -const uint32_t image_debug_type_coff = 1; -const uint32_t image_debug_type_codeview = 2; -const uint32_t image_debug_type_fpo = 3; -const uint32_t image_debug_type_misc = 4; -const uint32_t image_debug_type_exception = 5; -const uint32_t image_debug_type_fixup = 6; -const uint32_t image_debug_type_omap_to_src = 7; -const uint32_t image_debug_type_omap_from_src = 8; -const uint32_t image_debug_type_borland = 9; -const uint32_t image_debug_type_reserved10 = 10; -const uint32_t image_debug_type_clsid = 11; - - -//Storage classes -const uint32_t image_sym_class_end_of_function = static_cast<uint8_t>(-1); -const uint32_t image_sym_class_null = 0x0000; -const uint32_t image_sym_class_automatic = 0x0001; -const uint32_t image_sym_class_external = 0x0002; -const uint32_t image_sym_class_static = 0x0003; -const uint32_t image_sym_class_register = 0x0004; -const uint32_t image_sym_class_external_def = 0x0005; -const uint32_t image_sym_class_label = 0x0006; -const uint32_t image_sym_class_undefined_label = 0x0007; -const uint32_t image_sym_class_member_of_struct = 0x0008; -const uint32_t image_sym_class_argument = 0x0009; -const uint32_t image_sym_class_struct_tag = 0x000a; -const uint32_t image_sym_class_member_of_union = 0x000b; -const uint32_t image_sym_class_union_tag = 0x000c; -const uint32_t image_sym_class_type_definition = 0x000d; -const uint32_t image_sym_class_undefined_static = 0x000e; -const uint32_t image_sym_class_enum_tag = 0x000f; -const uint32_t image_sym_class_member_of_enum = 0x0010; -const uint32_t image_sym_class_register_param = 0x0011; -const uint32_t image_sym_class_bit_field = 0x0012; - -const uint32_t image_sym_class_far_external = 0x0044; - -const uint32_t image_sym_class_block = 0x0064; -const uint32_t image_sym_class_function = 0x0065; -const uint32_t image_sym_class_end_of_struct = 0x0066; -const uint32_t image_sym_class_file = 0x0067; - -const uint32_t image_sym_class_section = 0x0068; -const uint32_t image_sym_class_weak_external = 0x0069; - -const uint32_t image_sym_class_clr_token = 0x006b; - -//type packing constants -const uint32_t n_btmask = 0x000f; -const uint32_t n_tmask = 0x0030; -const uint32_t n_tmask1 = 0x00c0; -const uint32_t n_tmask2 = 0x00f0; -const uint32_t n_btshft = 4; -const uint32_t n_tshift = 2; - -//Type (derived) values. -const uint32_t image_sym_dtype_null = 0; // no derived type. -const uint32_t image_sym_dtype_pointer = 1; // pointer. -const uint32_t image_sym_dtype_function = 2; // function. -const uint32_t image_sym_dtype_array = 3; // array. - -// Is x a function? -//TODO -#ifndef ISFCN -#define ISFCN(x) (((x) & n_tmask) == (image_sym_dtype_function << n_btshft)) -#endif - -//Version info -const uint32_t vs_ffi_fileflagsmask = 0x0000003FL; - -const uint32_t vs_ffi_signature = 0xFEEF04BDL; -const uint32_t vs_ffi_strucversion = 0x00010000L; - -/* ----- VS_VERSION.dwFileFlags ----- */ -const uint32_t vs_ff_debug = 0x00000001L; -const uint32_t vs_ff_prerelease = 0x00000002L; -const uint32_t vs_ff_patched = 0x00000004L; -const uint32_t vs_ff_privatebuild = 0x00000008L; -const uint32_t vs_ff_infoinferred = 0x00000010L; -const uint32_t vs_ff_specialbuild = 0x00000020L; - -/* ----- VS_VERSION.dwFileOS ----- */ -const uint32_t vos_unknown = 0x00000000L; -const uint32_t vos_dos = 0x00010000L; -const uint32_t vos_os216 = 0x00020000L; -const uint32_t vos_os232 = 0x00030000L; -const uint32_t vos_nt = 0x00040000L; -const uint32_t vos_wince = 0x00050000L; - -const uint32_t vos__base = 0x00000000L; -const uint32_t vos__windows16 = 0x00000001L; -const uint32_t vos__pm16 = 0x00000002L; -const uint32_t vos__pm32 = 0x00000003L; -const uint32_t vos__windows32 = 0x00000004L; - -const uint32_t vos_dos_windows16 = 0x00010001L; -const uint32_t vos_dos_windows32 = 0x00010004L; -const uint32_t vos_os216_pm16 = 0x00020002L; -const uint32_t vos_os232_pm32 = 0x00030003L; -const uint32_t vos_nt_windows32 = 0x00040004L; - -/* ----- VS_VERSION.dwFileType ----- */ -const uint32_t vft_unknown = 0x00000000L; -const uint32_t vft_app = 0x00000001L; -const uint32_t vft_dll = 0x00000002L; -const uint32_t vft_drv = 0x00000003L; -const uint32_t vft_font = 0x00000004L; -const uint32_t vft_vxd = 0x00000005L; -const uint32_t vft_static_lib = 0x00000007L; - -const uint32_t message_resource_unicode = 0x0001; - -#pragma pack(push, 1) - -//Windows GUID structure -struct guid -{ - uint32_t Data1; - uint16_t Data2; - uint16_t Data3; - uint8_t Data4[8]; -}; - -//DOS .EXE header -struct image_dos_header -{ - uint16_t e_magic; // Magic number - uint16_t e_cblp; // Bytes on last page of file - uint16_t e_cp; // Pages in file - uint16_t e_crlc; // Relocations - uint16_t e_cparhdr; // Size of header in paragraphs - uint16_t e_minalloc; // Minimum extra paragraphs needed - uint16_t e_maxalloc; // Maximum extra paragraphs needed - uint16_t e_ss; // Initial (relative) SS value - uint16_t e_sp; // Initial SP value - uint16_t e_csum; // Checksum - uint16_t e_ip; // Initial IP value - uint16_t e_cs; // Initial (relative) CS value - uint16_t e_lfarlc; // File address of relocation table - uint16_t e_ovno; // Overlay number - uint16_t e_res[4]; // Reserved words - uint16_t e_oemid; // OEM identifier (for e_oeminfo) - uint16_t e_oeminfo; // OEM information; e_oemid specific - uint16_t e_res2[10]; // Reserved words - int32_t e_lfanew; // File address of new exe header -}; - -//Directory format -struct image_data_directory -{ - uint32_t VirtualAddress; - uint32_t Size; -}; - -//Optional header format -struct image_optional_header32 -{ - //Standard fields - uint16_t Magic; - uint8_t MajorLinkerVersion; - uint8_t MinorLinkerVersion; - uint32_t SizeOfCode; - uint32_t SizeOfInitializedData; - uint32_t SizeOfUninitializedData; - uint32_t AddressOfEntryPoint; - uint32_t BaseOfCode; - uint32_t BaseOfData; - - //NT additional fields - uint32_t ImageBase; - uint32_t SectionAlignment; - uint32_t FileAlignment; - uint16_t MajorOperatingSystemVersion; - uint16_t MinorOperatingSystemVersion; - uint16_t MajorImageVersion; - uint16_t MinorImageVersion; - uint16_t MajorSubsystemVersion; - uint16_t MinorSubsystemVersion; - uint32_t Win32VersionValue; - uint32_t SizeOfImage; - uint32_t SizeOfHeaders; - uint32_t CheckSum; - uint16_t Subsystem; - uint16_t DllCharacteristics; - uint32_t SizeOfStackReserve; - uint32_t SizeOfStackCommit; - uint32_t SizeOfHeapReserve; - uint32_t SizeOfHeapCommit; - uint32_t LoaderFlags; - uint32_t NumberOfRvaAndSizes; - image_data_directory DataDirectory[image_numberof_directory_entries]; -}; - -struct image_optional_header64 -{ - uint16_t Magic; - uint8_t MajorLinkerVersion; - uint8_t MinorLinkerVersion; - uint32_t SizeOfCode; - uint32_t SizeOfInitializedData; - uint32_t SizeOfUninitializedData; - uint32_t AddressOfEntryPoint; - uint32_t BaseOfCode; - uint64_t ImageBase; - uint32_t SectionAlignment; - uint32_t FileAlignment; - uint16_t MajorOperatingSystemVersion; - uint16_t MinorOperatingSystemVersion; - uint16_t MajorImageVersion; - uint16_t MinorImageVersion; - uint16_t MajorSubsystemVersion; - uint16_t MinorSubsystemVersion; - uint32_t Win32VersionValue; - uint32_t SizeOfImage; - uint32_t SizeOfHeaders; - uint32_t CheckSum; - uint16_t Subsystem; - uint16_t DllCharacteristics; - uint64_t SizeOfStackReserve; - uint64_t SizeOfStackCommit; - uint64_t SizeOfHeapReserve; - uint64_t SizeOfHeapCommit; - uint32_t LoaderFlags; - uint32_t NumberOfRvaAndSizes; - image_data_directory DataDirectory[image_numberof_directory_entries]; -}; - -struct image_file_header -{ - uint16_t Machine; - uint16_t NumberOfSections; - uint32_t TimeDateStamp; - uint32_t PointerToSymbolTable; - uint32_t NumberOfSymbols; - uint16_t SizeOfOptionalHeader; - uint16_t Characteristics; -}; - -struct image_nt_headers64 -{ - uint32_t Signature; - image_file_header FileHeader; - image_optional_header64 OptionalHeader; -}; - -struct image_nt_headers32 -{ - uint32_t Signature; - image_file_header FileHeader; - image_optional_header32 OptionalHeader; -}; - -//Section header format -struct image_section_header -{ - uint8_t Name[8]; - union - { - uint32_t PhysicalAddress; - uint32_t VirtualSize; - } Misc; - - uint32_t VirtualAddress; - uint32_t SizeOfRawData; - uint32_t PointerToRawData; - uint32_t PointerToRelocations; - uint32_t PointerToLinenumbers; - uint16_t NumberOfRelocations; - uint16_t NumberOfLinenumbers; - uint32_t Characteristics; -}; - - -/// RESOURCES /// -struct image_resource_directory -{ - uint32_t Characteristics; - uint32_t TimeDateStamp; - uint16_t MajorVersion; - uint16_t MinorVersion; - uint16_t NumberOfNamedEntries; - uint16_t NumberOfIdEntries; - // IMAGE_RESOURCE_DIRECTORY_ENTRY DirectoryEntries[]; -}; - -struct vs_fixedfileinfo -{ - uint32_t dwSignature; /* e.g. 0xfeef04bd */ - uint32_t dwStrucVersion; /* e.g. 0x00000042 = "0.42" */ - uint32_t dwFileVersionMS; /* e.g. 0x00030075 = "3.75" */ - uint32_t dwFileVersionLS; /* e.g. 0x00000031 = "0.31" */ - uint32_t dwProductVersionMS; /* e.g. 0x00030010 = "3.10" */ - uint32_t dwProductVersionLS; /* e.g. 0x00000031 = "0.31" */ - uint32_t dwFileFlagsMask; /* = 0x3F for version "0.42" */ - uint32_t dwFileFlags; /* e.g. VFF_DEBUG | VFF_PRERELEASE */ - uint32_t dwFileOS; /* e.g. VOS_DOS_WINDOWS16 */ - uint32_t dwFileType; /* e.g. VFT_DRIVER */ - uint32_t dwFileSubtype; /* e.g. VFT2_DRV_KEYBOARD */ - uint32_t dwFileDateMS; /* e.g. 0 */ - uint32_t dwFileDateLS; /* e.g. 0 */ -}; - -struct bitmapinfoheader -{ - uint32_t biSize; - int32_t biWidth; - int32_t biHeight; - uint16_t biPlanes; - uint16_t biBitCount; - uint32_t biCompression; - uint32_t biSizeImage; - int32_t biXPelsPerMeter; - int32_t biYPelsPerMeter; - uint32_t biClrUsed; - uint32_t biClrImportant; -}; - -struct message_resource_entry -{ - uint16_t Length; - uint16_t Flags; - uint8_t Text[1]; -}; - -struct message_resource_block -{ - uint32_t LowId; - uint32_t HighId; - uint32_t OffsetToEntries; -}; - -struct message_resource_data -{ - uint32_t NumberOfBlocks; - message_resource_block Blocks[1]; -}; - -struct image_resource_directory_entry -{ - union - { - struct - { - uint32_t NameOffset:31; - uint32_t NameIsString:1; - }; - uint32_t Name; - uint16_t Id; - }; - - union - { - uint32_t OffsetToData; - struct - { - uint32_t OffsetToDirectory:31; - uint32_t DataIsDirectory:1; - }; - }; -}; - -struct image_resource_data_entry -{ - uint32_t OffsetToData; - uint32_t Size; - uint32_t CodePage; - uint32_t Reserved; -}; - -#pragma pack(push, 2) -struct bitmapfileheader -{ - uint16_t bfType; - uint32_t bfSize; - uint16_t bfReserved1; - uint16_t bfReserved2; - uint32_t bfOffBits; -}; -#pragma pack(pop) - - - -//Structure representing ICON file header -struct ico_header -{ - uint16_t Reserved; - uint16_t Type; //1 - uint16_t Count; //Count of icons included in icon group -}; - -//Structure that is stored in icon group directory in PE resources -struct icon_group -{ - uint8_t Width; - uint8_t Height; - uint8_t ColorCount; - uint8_t Reserved; - uint16_t Planes; - uint16_t BitCount; - uint32_t SizeInBytes; - uint16_t Number; //Represents resource ID in PE icon list -}; - -//Structure representing ICON directory entry inside ICON file -struct icondirentry -{ - uint8_t Width; - uint8_t Height; - uint8_t ColorCount; - uint8_t Reserved; - uint16_t Planes; - uint16_t BitCount; - uint32_t SizeInBytes; - uint32_t ImageOffset; //Offset from start of header to the image -}; - -//Structure representing CURSOR file header -struct cursor_header -{ - uint16_t Reserved; - uint16_t Type; //2 - uint16_t Count; //Count of cursors included in cursor group -}; - -struct cursor_group -{ - uint16_t Width; - uint16_t Height; //Divide by 2 to get the actual height. - uint16_t Planes; - uint16_t BitCount; - uint32_t SizeInBytes; - uint16_t Number; //Represents resource ID in PE icon list -}; - -//Structure representing CURSOR directory entry inside CURSOR file -struct cursordirentry -{ - uint8_t Width; //Set to CURSOR_GROUP::Height/2. - uint8_t Height; - uint8_t ColorCount; - uint8_t Reserved; - uint16_t HotspotX; - uint16_t HotspotY; - uint32_t SizeInBytes; - uint32_t ImageOffset; //Offset from start of header to the image -}; - -//Structure representing BLOCK in version info resource -struct version_info_block //(always aligned on 32-bit (DWORD) boundary) -{ - uint16_t Length; //Length of this block (doesn't include padding) - uint16_t ValueLength; //Value length (if any) - uint16_t Type; //Value type (0 = binary, 1 = text) - uint16_t Key[1]; //Value name (block key) (always NULL terminated) - - ////////// - //WORD padding1[]; //Padding, if any (ALIGNMENT) - //xxxxx Value[]; //Value data, if any (*ALIGNED*) - //WORD padding2[]; //Padding, if any (ALIGNMENT) - //xxxxx Child[]; //Child block(s), if any (*ALIGNED*) - ////////// -}; - - -/// IMPORTS /// -#pragma pack(push, 8) -struct image_thunk_data64 -{ - union - { - uint64_t ForwarderString; // PBYTE - uint64_t Function; // PDWORD - uint64_t Ordinal; - uint64_t AddressOfData; // PIMAGE_IMPORT_BY_NAME - } u1; -}; -#pragma pack(pop) - -struct image_thunk_data32 -{ - union - { - uint32_t ForwarderString; // PBYTE - uint32_t Function; // PDWORD - uint32_t Ordinal; - uint32_t AddressOfData; // PIMAGE_IMPORT_BY_NAME - } u1; -}; - -struct image_import_descriptor -{ - union - { - uint32_t Characteristics; // 0 for terminating null import descriptor - uint32_t OriginalFirstThunk; // RVA to original unbound IAT (PIMAGE_THUNK_DATA) - }; - - uint32_t TimeDateStamp; // 0 if not bound, - // -1 if bound, and real date\time stamp - // in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) - // O.W. date/time stamp of DLL bound to (Old BIND) - - uint32_t ForwarderChain; // -1 if no forwarders - uint32_t Name; - uint32_t FirstThunk; // RVA to IAT (if bound this IAT has actual addresses) -}; - - -/// TLS /// -struct image_tls_directory64 -{ - uint64_t StartAddressOfRawData; - uint64_t EndAddressOfRawData; - uint64_t AddressOfIndex; // PDWORD - uint64_t AddressOfCallBacks; // PIMAGE_TLS_CALLBACK *; - uint32_t SizeOfZeroFill; - uint32_t Characteristics; -}; - -struct image_tls_directory32 -{ - uint32_t StartAddressOfRawData; - uint32_t EndAddressOfRawData; - uint32_t AddressOfIndex; // PDWORD - uint32_t AddressOfCallBacks; // PIMAGE_TLS_CALLBACK * - uint32_t SizeOfZeroFill; - uint32_t Characteristics; -}; - - -/// Export Format /// -struct image_export_directory -{ - uint32_t Characteristics; - uint32_t TimeDateStamp; - uint16_t MajorVersion; - uint16_t MinorVersion; - uint32_t Name; - uint32_t Base; - uint32_t NumberOfFunctions; - uint32_t NumberOfNames; - uint32_t AddressOfFunctions; // RVA from base of image - uint32_t AddressOfNames; // RVA from base of image - uint32_t AddressOfNameOrdinals; // RVA from base of image -}; - - -/// Based relocation format /// -struct image_base_relocation -{ - uint32_t VirtualAddress; - uint32_t SizeOfBlock; - // uint16_t TypeOffset[1]; -}; - - -/// New format import descriptors pointed to by DataDirectory[ IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT ] /// -struct image_bound_import_descriptor -{ - uint32_t TimeDateStamp; - uint16_t OffsetModuleName; - uint16_t NumberOfModuleForwarderRefs; - // Array of zero or more IMAGE_BOUND_FORWARDER_REF follows -}; - -struct image_bound_forwarder_ref -{ - uint32_t TimeDateStamp; - uint16_t OffsetModuleName; - uint16_t Reserved; -}; - - -/// Exception directory /// -struct image_runtime_function_entry -{ - uint32_t BeginAddress; - uint32_t EndAddress; - uint32_t UnwindInfoAddress; -}; - -enum unwind_op_codes -{ - uwop_push_nonvol = 0, /* info == register number */ - uwop_alloc_large, /* no info, alloc size in next 2 slots */ - uwop_alloc_small, /* info == size of allocation / 8 - 1 */ - uwop_set_fpreg, /* no info, FP = RSP + UNWIND_INFO.FPRegOffset*16 */ - uwop_save_nonvol, /* info == register number, offset in next slot */ - uwop_save_nonvol_far, /* info == register number, offset in next 2 slots */ - uwop_save_xmm128, /* info == XMM reg number, offset in next slot */ - uwop_save_xmm128_far, /* info == XMM reg number, offset in next 2 slots */ - uwop_push_machframe /* info == 0: no error-code, 1: error-code */ -}; - -union unwind_code -{ - struct s - { - uint8_t CodeOffset; - uint8_t UnwindOp : 4; - uint8_t OpInfo : 4; - }; - - uint16_t FrameOffset; -}; - -struct unwind_info -{ - uint8_t Version : 3; - uint8_t Flags : 5; - uint8_t SizeOfProlog; - uint8_t CountOfCodes; - uint8_t FrameRegister : 4; - uint8_t FrameOffset : 4; - unwind_code UnwindCode[1]; - /* unwind_code MoreUnwindCode[((CountOfCodes + 1) & ~1) - 1]; - * union { - * OPTIONAL ULONG ExceptionHandler; - * OPTIONAL ULONG FunctionEntry; - * }; - * OPTIONAL ULONG ExceptionData[]; */ -}; - - - -/// Debug /// -struct image_debug_misc -{ - uint32_t DataType; // type of misc data, see defines - uint32_t Length; // total length of record, rounded to four - // byte multiple. - uint8_t Unicode; // TRUE if data is unicode string - uint8_t Reserved[3]; - uint8_t Data[1]; // Actual data -}; - -struct image_coff_symbols_header -{ - uint32_t NumberOfSymbols; - uint32_t LvaToFirstSymbol; - uint32_t NumberOfLinenumbers; - uint32_t LvaToFirstLinenumber; - uint32_t RvaToFirstByteOfCode; - uint32_t RvaToLastByteOfCode; - uint32_t RvaToFirstByteOfData; - uint32_t RvaToLastByteOfData; -}; - -struct image_debug_directory -{ - uint32_t Characteristics; - uint32_t TimeDateStamp; - uint16_t MajorVersion; - uint16_t MinorVersion; - uint32_t Type; - uint32_t SizeOfData; - uint32_t AddressOfRawData; - uint32_t PointerToRawData; -}; - - -#pragma pack(push, 2) -struct image_symbol -{ - union - { - uint8_t ShortName[8]; - struct - { - uint32_t Short; // if 0, use LongName - uint32_t Long; // offset into string table - } Name; - uint32_t LongName[2]; // PBYTE [2] - } N; - uint32_t Value; - int16_t SectionNumber; - uint16_t Type; - uint8_t StorageClass; - uint8_t NumberOfAuxSymbols; -}; -#pragma pack(pop) - -//CodeView Debug OMF signature. The signature at the end of the file is -//a negative offset from the end of the file to another signature. At -//the negative offset (base address) is another signature whose filepos -//field points to the first OMFDirHeader in a chain of directories. -//The NB05 signature is used by the link utility to indicated a completely -//unpacked file. The NB06 signature is used by ilink to indicate that the -//executable has had CodeView information from an incremental link appended -//to the executable. The NB08 signature is used by cvpack to indicate that -//the CodeView Debug OMF has been packed. CodeView will only process -//executables with the NB08 signature. -struct OMFSignature -{ - char Signature[4]; // "NBxx" - uint32_t filepos; // offset in file -}; - -struct CV_INFO_PDB20 -{ - OMFSignature CvHeader; - uint32_t Signature; - uint32_t Age; - uint8_t PdbFileName[1]; -}; - -struct CV_INFO_PDB70 -{ - uint32_t CvSignature; - guid Signature; - uint32_t Age; - uint8_t PdbFileName[1]; -}; - -// directory information structure -// This structure contains the information describing the directory. -// It is pointed to by the signature at the base address or the directory -// link field of a preceeding directory. The directory entries immediately -// follow this structure. -struct OMFDirHeader -{ - uint16_t cbDirHeader; // length of this structure - uint16_t cbDirEntry; // number of bytes in each directory entry - uint32_t cDir; // number of directorie entries - int32_t lfoNextDir; // offset from base of next directory - uint32_t flags; // status flags -}; - -// directory structure -// The data in this structure is used to reference the data for each -// subsection of the CodeView Debug OMF information. Tables that are -// not associated with a specific module will have a module index of -// oxffff. These tables are the global types table, the global symbol -// table, the global public table and the library table. -struct OMFDirEntry -{ - uint16_t SubSection; // subsection type (sst...) - uint16_t iMod; // module index - int32_t lfo; // large file offset of subsection - uint32_t cb; // number of bytes in subsection -}; - - -/// CLR 2.0 header structure /// -struct image_cor20_header -{ - //Header versioning - uint32_t cb; - uint16_t MajorRuntimeVersion; - uint16_t MinorRuntimeVersion; - - // Symbol table and startup information - image_data_directory MetaData; - uint32_t Flags; - - // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is not set, EntryPointToken represents a managed entrypoint. - // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is set, EntryPointRVA represents an RVA to a native entrypoint. - union - { - uint32_t EntryPointToken; - uint32_t EntryPointRVA; - }; - - // Binding information - image_data_directory Resources; - image_data_directory StrongNameSignature; - - // Regular fixup and binding information - image_data_directory CodeManagerTable; - image_data_directory VTableFixups; - image_data_directory ExportAddressTableJumps; - - // Precompiled image info (internal use only - set to zero) - image_data_directory ManagedNativeHeader; -}; - -enum replaces_cor_hdr_numeric_defines -{ - // COM+ Header entry point flags. - comimage_flags_ilonly =0x00000001, - comimage_flags_32bitrequired =0x00000002, - comimage_flags_il_library =0x00000004, - comimage_flags_strongnamesigned =0x00000008, - comimage_flags_native_entrypoint =0x00000010, - comimage_flags_trackdebugdata =0x00010000, - - // Version flags for image. - cor_version_major_v2 =2, - cor_version_major =cor_version_major_v2, - cor_version_minor =0, - cor_deleted_name_length =8, - cor_vtablegap_name_length =8, - - // Maximum size of a NativeType descriptor. - native_type_max_cb =1, - cor_ilmethod_sect_small_max_datasize=0xff, - - // #defines for the MIH FLAGS - image_cor_mih_methodrva =0x01, - image_cor_mih_ehrva =0x02, - image_cor_mih_basicblock =0x08, - - // V-table constants - cor_vtable_32bit =0x01, // V-table slots are 32-bits in size. - cor_vtable_64bit =0x02, // V-table slots are 64-bits in size. - cor_vtable_from_unmanaged =0x04, // If set, transition from unmanaged. - cor_vtable_from_unmanaged_retain_appdomain =0x08, // If set, transition from unmanaged with keeping the current appdomain. - cor_vtable_call_most_derived =0x10, // Call most derived method described by - - // EATJ constants - image_cor_eatj_thunk_size =32, // Size of a jump thunk reserved range. - - // Max name lengths - //@todo: Change to unlimited name lengths. - max_class_name =1024, - max_package_name =1024 -}; - -/// Load Configuration Directory Entry /// -struct image_load_config_directory32 -{ - uint32_t Size; - uint32_t TimeDateStamp; - uint16_t MajorVersion; - uint16_t MinorVersion; - uint32_t GlobalFlagsClear; - uint32_t GlobalFlagsSet; - uint32_t CriticalSectionDefaultTimeout; - uint32_t DeCommitFreeBlockThreshold; - uint32_t DeCommitTotalFreeThreshold; - uint32_t LockPrefixTable; // VA - uint32_t MaximumAllocationSize; - uint32_t VirtualMemoryThreshold; - uint32_t ProcessHeapFlags; - uint32_t ProcessAffinityMask; - uint16_t CSDVersion; - uint16_t Reserved1; - uint32_t EditList; // VA - uint32_t SecurityCookie; // VA - uint32_t SEHandlerTable; // VA - uint32_t SEHandlerCount; -}; - -struct image_load_config_directory64 -{ - uint32_t Size; - uint32_t TimeDateStamp; - uint16_t MajorVersion; - uint16_t MinorVersion; - uint32_t GlobalFlagsClear; - uint32_t GlobalFlagsSet; - uint32_t CriticalSectionDefaultTimeout; - uint64_t DeCommitFreeBlockThreshold; - uint64_t DeCommitTotalFreeThreshold; - uint64_t LockPrefixTable; // VA - uint64_t MaximumAllocationSize; - uint64_t VirtualMemoryThreshold; - uint64_t ProcessAffinityMask; - uint32_t ProcessHeapFlags; - uint16_t CSDVersion; - uint16_t Reserved1; - uint64_t EditList; // VA - uint64_t SecurityCookie; // VA - uint64_t SEHandlerTable; // VA - uint64_t SEHandlerCount; -}; - -#pragma pack(pop) -} //namespace pe_win - -#ifdef PE_BLISS_WINDOWS -typedef wchar_t unicode16_t; -typedef std::basic_string<unicode16_t> u16string; -#else -//Instead of wchar_t for windows -typedef unsigned short unicode16_t; -typedef std::basic_string<unicode16_t> u16string; -#endif - -} //namespace pe_bliss |