Make your own free website on Tripod.com
Main Page   Namespace List   Class Hierarchy   Alphabetical List   Compound List   File List   Compound Members   File Members  

peformat.h

Go to the documentation of this file.
00001 /*
00002 PeRdr - PE file disassembler
00003 Copyright (C) 1999-2002 Frediano Ziglio
00004 -----
00005 
00006 This program is free software; you can redistribute it and/or modify
00007 it under the terms of the GNU General Public License as published by
00008 the Free Software Foundation; either version 2 of the License, or
00009 (at your option) any later version.
00010 
00011 This program is distributed in the hope that it will be useful,
00012 but WITHOUT ANY WARRANTY; without even the implied warranty of
00013 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
00014 GNU General Public License for more details.
00015 
00016 You should have received a copy of the GNU General Public License
00017 along with this program; if not, write to the Free Software
00018 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
00019 -----
00020 
00021 INFORMATION
00022   www: http://freddy77.tripod.com/perdr/
00023   e-mail: freddy77@angelfire.com
00024 */
00025 #ifndef FILE_PEFORMAT_H
00026 #define FILE_PEFORMAT_H
00027 
00028 #define PE_IMAGE_SIZEOF_SHORT_NAME              8
00029 
00030 typedef struct _PE_IMAGE_SECTION_HEADER {
00031     uint8_t    Name[PE_IMAGE_SIZEOF_SHORT_NAME];
00032     union {
00033             uint32_t   PhysicalAddress;
00034             uint32_t   VirtualSize;
00035     } Misc;
00036     uint32_t   VirtualAddress;
00037     uint32_t   SizeOfRawData;
00038     uint32_t   PointerToRawData;
00039     uint32_t   PointerToRelocations;
00040     uint32_t   PointerToLinenumbers;
00041     uint16_t    NumberOfRelocations;
00042     uint16_t    NumberOfLinenumbers;
00043     uint32_t   Characteristics;
00044 } PE_IMAGE_SECTION_HEADER;
00045 
00046 typedef struct _PE_IMAGE_FILE_HEADER {
00047     uint16_t    Machine;
00048     uint16_t    NumberOfSections;
00049     uint32_t   TimeDateStamp;
00050     uint32_t   PointerToSymbolTable;
00051     uint32_t   NumberOfSymbols;
00052     uint16_t    SizeOfOptionalHeader;
00053     uint16_t    Characteristics;
00054 } PE_IMAGE_FILE_HEADER;
00055 
00056 typedef struct _PE_IMAGE_DATA_DIRECTORY {
00057     uint32_t   VirtualAddress;
00058     uint32_t   Size;
00059 } PE_IMAGE_DATA_DIRECTORY;
00060 
00061 #define PE_IMAGE_NUMBEROF_DIRECTORY_ENTRIES    16
00062 
00063 typedef struct _PE_IMAGE_OPTIONAL_HEADER {
00064     //
00065     // Standard fields.
00066     //
00067 
00068     uint16_t    Magic;
00069     uint8_t    MajorLinkerVersion;
00070     uint8_t    MinorLinkerVersion;
00071     uint32_t   SizeOfCode;
00072     uint32_t   SizeOfInitializedData;
00073     uint32_t   SizeOfUninitializedData;
00074     uint32_t   AddressOfEntryPoint;
00075     uint32_t   BaseOfCode;
00076     uint32_t   BaseOfData;
00077 
00078     //
00079     // NT additional fields.
00080     //
00081 
00082     uint32_t   ImageBase;
00083     uint32_t   SectionAlignment;
00084     uint32_t   FileAlignment;
00085     uint16_t    MajorOperatingSystemVersion;
00086     uint16_t    MinorOperatingSystemVersion;
00087     uint16_t    MajorImageVersion;
00088     uint16_t    MinorImageVersion;
00089     uint16_t    MajorSubsystemVersion;
00090     uint16_t    MinorSubsystemVersion;
00091     uint32_t   Win32VersionValue;
00092     uint32_t   SizeOfImage;
00093     uint32_t   SizeOfHeaders;
00094     uint32_t   CheckSum;
00095     uint16_t    Subsystem;
00096     uint16_t    DllCharacteristics;
00097     uint32_t   SizeOfStackReserve;
00098     uint32_t   SizeOfStackCommit;
00099     uint32_t   SizeOfHeapReserve;
00100     uint32_t   SizeOfHeapCommit;
00101     uint32_t   LoaderFlags;
00102     uint32_t   NumberOfRvaAndSizes;
00103     PE_IMAGE_DATA_DIRECTORY DataDirectory[PE_IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
00104 } PE_IMAGE_OPTIONAL_HEADER32, PE_IMAGE_OPTIONAL_HEADER;
00105 
00106 typedef struct _PE_IMAGE_NT_HEADERS {
00107     uint32_t Signature;
00108     PE_IMAGE_FILE_HEADER FileHeader;
00109     PE_IMAGE_OPTIONAL_HEADER32 OptionalHeader;
00110 } PE_IMAGE_NT_HEADERS32, PE_IMAGE_NT_HEADERS;
00111 
00112 typedef struct _PE_IMAGE_IMPORT_DESCRIPTOR {
00113     union {
00114         uint32_t   Characteristics;            // 0 for terminating null import descriptor
00115         uint32_t   OriginalFirstThunk;         // RVA to original unbound IAT (PIMAGE_THUNK_DATA)
00116     };
00117     uint32_t   TimeDateStamp;                  // 0 if not bound,
00118                                             // -1 if bound, and real date\time stamp
00119                                             //     in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
00120                                             // O.W. date/time stamp of DLL bound to (Old BIND)
00121 
00122     uint32_t   ForwarderChain;                 // -1 if no forwarders
00123     uint32_t   Name;
00124     uint32_t   FirstThunk;                     // RVA to IAT (if bound this IAT has actual addresses)
00125 } PE_IMAGE_IMPORT_DESCRIPTOR;
00126 
00127 typedef struct _PE_IMAGE_IMPORT_BY_NAME {
00128     uint16_t    Hint;
00129     uint8_t    Name[1];
00130 } PE_IMAGE_IMPORT_BY_NAME;
00131 
00132 typedef struct _PE_IMAGE_EXPORT_DIRECTORY {
00133     uint32_t   Characteristics;
00134     uint32_t   TimeDateStamp;
00135     uint16_t    MajorVersion;
00136     uint16_t    MinorVersion;
00137     uint32_t   Name;
00138     uint32_t   Base;
00139     uint32_t   NumberOfFunctions;
00140     uint32_t   NumberOfNames;
00141     uint32_t   AddressOfFunctions;     // RVA from base of image
00142     uint32_t   AddressOfNames;         // RVA from base of image
00143     uint32_t   AddressOfNameOrdinals;  // RVA from base of image
00144 } PE_IMAGE_EXPORT_DIRECTORY;
00145 
00146 typedef struct _PE_IMAGE_THUNK_DATA32 {
00147     union {
00148         uint32_t ForwarderString;
00149         uint32_t Function;
00150         uint32_t Ordinal;
00151         uint32_t AddressOfData;
00152     } u1;
00153 } PE_IMAGE_THUNK_DATA32, PE_IMAGE_THUNK_DATA;
00154 
00155 typedef struct _PE_IMAGE_BASE_RELOCATION {
00156     uint32_t   VirtualAddress;
00157     uint32_t   SizeOfBlock;
00158 //  uint16_t    TypeOffset[1];
00159 } PE_IMAGE_BASE_RELOCATION;
00160 
00161 typedef struct _PE_IMAGE_RESOURCE_DIRECTORY_ENTRY {
00162     union {
00163         uint32_t   Name; // if >0x10000 is a numeric Id
00164     } u1;
00165     union {
00166         uint32_t   OffsetToData;
00167     } u2;
00168 } PE_IMAGE_RESOURCE_DIRECTORY_ENTRY;
00169 #define RESOURCE_ENTRY_GETID(e) \
00170   (e.u1.Name&0xffffu)
00171 #define RESOURCE_ENTRY_ISSTRING(e) \
00172   ((e.u1.Name>>31)&1)
00173 #define RESOURCE_ENTRY_NAME_OFFSET(e) \
00174   (e.u1.Name&0x7fffffff)
00175 #define RESOURCE_ENTRY_ISDIRECTORY(e) \
00176   ((e.u2.OffsetToData>>31)&1)
00177 #define RESOURCE_ENTRY_DATA_OFFSET(e) \
00178   (e.u2.OffsetToData&0x7fffffff)
00179 
00180 typedef struct _PE_IMAGE_RESOURCE_DIRECTORY {
00181     uint32_t   Characteristics;
00182     uint32_t   TimeDateStamp;
00183     uint16_t    MajorVersion;
00184     uint16_t    MinorVersion;
00185     uint16_t    NumberOfNamedEntries;
00186     uint16_t    NumberOfIdEntries;
00187 //  IMAGE_RESOURCE_DIRECTORY_ENTRY DirectoryEntries[];
00188 } PE_IMAGE_RESOURCE_DIRECTORY;
00189 
00190 typedef struct _PE_IMAGE_RESOURCE_DATA_ENTRY {
00191     uint32_t   OffsetToData;
00192     uint32_t   Size;
00193     uint32_t   CodePage;
00194     uint32_t   Reserved;
00195 } PE_IMAGE_RESOURCE_DATA_ENTRY;
00196 
00197 typedef struct _PE_IMAGE_DOS_HEADER {      // DOS .EXE header
00198     uint16_t   e_magic;                     // Magic number
00199     uint16_t   e_cblp;                      // Bytes on last page of file
00200     uint16_t   e_cp;                        // Pages in file
00201     uint16_t   e_crlc;                      // Relocations
00202     uint16_t   e_cparhdr;                   // Size of header in paragraphs
00203     uint16_t   e_minalloc;                  // Minimum extra paragraphs needed
00204     uint16_t   e_maxalloc;                  // Maximum extra paragraphs needed
00205     uint16_t   e_ss;                        // Initial (relative) SS value
00206     uint16_t   e_sp;                        // Initial SP value
00207     uint16_t   e_csum;                      // Checksum
00208     uint16_t   e_ip;                        // Initial IP value
00209     uint16_t   e_cs;                        // Initial (relative) CS value
00210     uint16_t   e_lfarlc;                    // File address of relocation table
00211     uint16_t   e_ovno;                      // Overlay number
00212     uint16_t   e_res[4];                    // Reserved words
00213     uint16_t   e_oemid;                     // OEM identifier (for e_oeminfo)
00214     uint16_t   e_oeminfo;                   // OEM information; e_oemid specific
00215     uint16_t   e_res2[10];                  // Reserved words
00216     uint32_t  e_lfanew;                    // File address of new exe header
00217   } PE_IMAGE_DOS_HEADER;
00218 
00219 #define IMAGE_REL_BASED_ABSOLUTE              0
00220 #define IMAGE_REL_BASED_HIGH                  1
00221 #define IMAGE_REL_BASED_LOW                   2
00222 #define IMAGE_REL_BASED_HIGHLOW               3
00223 #define IMAGE_REL_BASED_HIGHADJ               4
00224 #define IMAGE_REL_BASED_MIPS_JMPADDR          5
00225 #define IMAGE_REL_BASED_SECTION               6
00226 #define IMAGE_REL_BASED_REL32                 7
00227 
00228 #define IMAGE_REL_BASED_MIPS_JMPADDR16        9
00229 #define IMAGE_REL_BASED_IA64_IMM64            9
00230 #define IMAGE_REL_BASED_DIR64                 10
00231 #define IMAGE_REL_BASED_HIGH3ADJ              11
00232 
00233 #define IMAGE_FILE_MACHINE_UNKNOWN           0
00234 #define IMAGE_FILE_MACHINE_I386              0x014c  // Intel 386.
00235 #define IMAGE_FILE_MACHINE_R3000             0x0162  // MIPS little-endian, 0x160 big-endian
00236 #define IMAGE_FILE_MACHINE_R4000             0x0166  // MIPS little-endian
00237 #define IMAGE_FILE_MACHINE_R10000            0x0168  // MIPS little-endian
00238 #define IMAGE_FILE_MACHINE_WCEMIPSV2         0x0169  // MIPS little-endian WCE v2
00239 #define IMAGE_FILE_MACHINE_ALPHA             0x0184  // Alpha_AXP
00240 #define IMAGE_FILE_MACHINE_POWERPC           0x01F0  // IBM PowerPC Little-Endian
00241 #define IMAGE_FILE_MACHINE_SH3               0x01a2  // SH3 little-endian
00242 #define IMAGE_FILE_MACHINE_SH3E              0x01a4  // SH3E little-endian
00243 #define IMAGE_FILE_MACHINE_SH4               0x01a6  // SH4 little-endian
00244 #define IMAGE_FILE_MACHINE_ARM               0x01c0  // ARM Little-Endian
00245 #define IMAGE_FILE_MACHINE_THUMB             0x01c2
00246 #define IMAGE_FILE_MACHINE_IA64              0x0200  // Intel 64
00247 #define IMAGE_FILE_MACHINE_MIPS16            0x0266  // MIPS
00248 #define IMAGE_FILE_MACHINE_MIPSFPU           0x0366  // MIPS
00249 #define IMAGE_FILE_MACHINE_MIPSFPU16         0x0466  // MIPS
00250 #define IMAGE_FILE_MACHINE_ALPHA64           0x0284  // ALPHA64
00251 #define IMAGE_FILE_MACHINE_AXP64             IMAGE_FILE_MACHINE_ALPHA64
00252 
00253 #define IMAGE_FILE_RELOCS_STRIPPED           0x0001  // Relocation info stripped from file.
00254 #define IMAGE_FILE_EXECUTABLE_IMAGE          0x0002  // File is executable  (i.e. no unresolved externel references).
00255 #define IMAGE_FILE_LINE_NUMS_STRIPPED        0x0004  // Line nunbers stripped from file.
00256 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008  // Local symbols stripped from file.
00257 #define IMAGE_FILE_AGGRESIVE_WS_TRIM         0x0010  // Agressively trim working set
00258 #define IMAGE_FILE_LARGE_ADDRESS_AWARE       0x0020  // App can handle >2gb addresses
00259 #define IMAGE_FILE_BYTES_REVERSED_LO         0x0080  // Bytes of machine word are reversed.
00260 #define IMAGE_FILE_32BIT_MACHINE             0x0100  // 32 bit word machine.
00261 #define IMAGE_FILE_DEBUG_STRIPPED            0x0200  // Debugging info stripped from file in .DBG file
00262 #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP   0x0400  // If Image is on removable media, copy and run from the swap file.
00263 #define IMAGE_FILE_NET_RUN_FROM_SWAP         0x0800  // If Image is on Net, copy and run from the swap file.
00264 #define IMAGE_FILE_SYSTEM                    0x1000  // System File.
00265 #define IMAGE_FILE_DLL                       0x2000  // File is a DLL.
00266 #define IMAGE_FILE_UP_SYSTEM_ONLY            0x4000  // File should only be run on a UP machine
00267 #define IMAGE_FILE_BYTES_REVERSED_HI         0x8000  // Bytes of machine word are reversed.
00268 
00269 #define IMAGE_FILE_MACHINE_UNKNOWN           0
00270 #define IMAGE_FILE_MACHINE_I386              0x014c  // Intel 386.
00271 #define IMAGE_FILE_MACHINE_R3000             0x0162  // MIPS little-endian, 0x160 big-endian
00272 #define IMAGE_FILE_MACHINE_R4000             0x0166  // MIPS little-endian
00273 #define IMAGE_FILE_MACHINE_R10000            0x0168  // MIPS little-endian
00274 #define IMAGE_FILE_MACHINE_WCEMIPSV2         0x0169  // MIPS little-endian WCE v2
00275 #define IMAGE_FILE_MACHINE_ALPHA             0x0184  // Alpha_AXP
00276 #define IMAGE_FILE_MACHINE_POWERPC           0x01F0  // IBM PowerPC Little-Endian
00277 #define IMAGE_FILE_MACHINE_SH3               0x01a2  // SH3 little-endian
00278 #define IMAGE_FILE_MACHINE_SH3E              0x01a4  // SH3E little-endian
00279 #define IMAGE_FILE_MACHINE_SH4               0x01a6  // SH4 little-endian
00280 #define IMAGE_FILE_MACHINE_ARM               0x01c0  // ARM Little-Endian
00281 #define IMAGE_FILE_MACHINE_THUMB             0x01c2
00282 #define IMAGE_FILE_MACHINE_IA64              0x0200  // Intel 64
00283 #define IMAGE_FILE_MACHINE_MIPS16            0x0266  // MIPS
00284 #define IMAGE_FILE_MACHINE_MIPSFPU           0x0366  // MIPS
00285 #define IMAGE_FILE_MACHINE_MIPSFPU16         0x0466  // MIPS
00286 #define IMAGE_FILE_MACHINE_ALPHA64           0x0284  // ALPHA64
00287 #define IMAGE_FILE_MACHINE_AXP64             IMAGE_FILE_MACHINE_ALPHA64
00288 
00289 // Subsystem Values
00290 
00291 #define IMAGE_SUBSYSTEM_UNKNOWN              0   // Unknown subsystem.
00292 #define IMAGE_SUBSYSTEM_NATIVE               1   // Image doesn't require a subsystem.
00293 #define IMAGE_SUBSYSTEM_WINDOWS_GUI          2   // Image runs in the Windows GUI subsystem.
00294 #define IMAGE_SUBSYSTEM_WINDOWS_CUI          3   // Image runs in the Windows character subsystem.
00295 #define IMAGE_SUBSYSTEM_OS2_CUI              5   // image runs in the OS/2 character subsystem.
00296 #define IMAGE_SUBSYSTEM_POSIX_CUI            7   // image runs in the Posix character subsystem.
00297 #define IMAGE_SUBSYSTEM_NATIVE_WINDOWS       8   // image is a native Win9x driver.
00298 #define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI       9   // Image runs in the Windows CE subsystem.
00299 
00300 //
00301 // Section characteristics.
00302 //
00303 //      IMAGE_SCN_TYPE_REG                   0x00000000  // Reserved.
00304 //      IMAGE_SCN_TYPE_DSECT                 0x00000001  // Reserved.
00305 //      IMAGE_SCN_TYPE_NOLOAD                0x00000002  // Reserved.
00306 //      IMAGE_SCN_TYPE_GROUP                 0x00000004  // Reserved.
00307 #define IMAGE_SCN_TYPE_NO_PAD                0x00000008  // Reserved.
00308 //      IMAGE_SCN_TYPE_COPY                  0x00000010  // Reserved.
00309 
00310 #define IMAGE_SCN_CNT_CODE                   0x00000020  // Section contains code.
00311 #define IMAGE_SCN_CNT_INITIALIZED_DATA       0x00000040  // Section contains initialized data.
00312 #define IMAGE_SCN_CNT_UNINITIALIZED_DATA     0x00000080  // Section contains uninitialized data.
00313 
00314 #define IMAGE_SCN_LNK_OTHER                  0x00000100  // Reserved.
00315 #define IMAGE_SCN_LNK_INFO                   0x00000200  // Section contains comments or some other type of information.
00316 //      IMAGE_SCN_TYPE_OVER                  0x00000400  // Reserved.
00317 #define IMAGE_SCN_LNK_REMOVE                 0x00000800  // Section contents will not become part of image.
00318 #define IMAGE_SCN_LNK_COMDAT                 0x00001000  // Section contents comdat.
00319 //                                           0x00002000  // Reserved.
00320 //      IMAGE_SCN_MEM_PROTECTED - Obsolete   0x00004000
00321 #define IMAGE_SCN_NO_DEFER_SPEC_EXC          0x00004000  // Reset speculative exceptions handling bits in the TLB entries for this section.
00322 #define IMAGE_SCN_GPREL                      0x00008000  // Section content can be accessed relative to GP
00323 #define IMAGE_SCN_MEM_FARDATA                0x00008000
00324 //      IMAGE_SCN_MEM_SYSHEAP  - Obsolete    0x00010000
00325 #define IMAGE_SCN_MEM_PURGEABLE              0x00020000
00326 #define IMAGE_SCN_MEM_16BIT                  0x00020000
00327 #define IMAGE_SCN_MEM_LOCKED                 0x00040000
00328 #define IMAGE_SCN_MEM_PRELOAD                0x00080000
00329 
00330 #define IMAGE_SCN_ALIGN_1BYTES               0x00100000  //
00331 #define IMAGE_SCN_ALIGN_2BYTES               0x00200000  //
00332 #define IMAGE_SCN_ALIGN_4BYTES               0x00300000  //
00333 #define IMAGE_SCN_ALIGN_8BYTES               0x00400000  //
00334 #define IMAGE_SCN_ALIGN_16BYTES              0x00500000  // Default alignment if no others are specified.
00335 #define IMAGE_SCN_ALIGN_32BYTES              0x00600000  //
00336 #define IMAGE_SCN_ALIGN_64BYTES              0x00700000  //
00337 #define IMAGE_SCN_ALIGN_128BYTES             0x00800000  //
00338 #define IMAGE_SCN_ALIGN_256BYTES             0x00900000  //
00339 #define IMAGE_SCN_ALIGN_512BYTES             0x00A00000  //
00340 #define IMAGE_SCN_ALIGN_1024BYTES            0x00B00000  //
00341 #define IMAGE_SCN_ALIGN_2048BYTES            0x00C00000  //
00342 #define IMAGE_SCN_ALIGN_4096BYTES            0x00D00000  //
00343 #define IMAGE_SCN_ALIGN_8192BYTES            0x00E00000  //
00344 // Unused                                    0x00F00000
00345 
00346 #define IMAGE_SCN_LNK_NRELOC_OVFL            0x01000000  // Section contains extended relocations.
00347 #define IMAGE_SCN_MEM_DISCARDABLE            0x02000000  // Section can be discarded.
00348 #define IMAGE_SCN_MEM_NOT_CACHED             0x04000000  // Section is not cachable.
00349 #define IMAGE_SCN_MEM_NOT_PAGED              0x08000000  // Section is not pageable.
00350 #define IMAGE_SCN_MEM_SHARED                 0x10000000  // Section is shareable.
00351 #define IMAGE_SCN_MEM_EXECUTE                0x20000000  // Section is executable.
00352 #define IMAGE_SCN_MEM_READ                   0x40000000  // Section is readable.
00353 #define IMAGE_SCN_MEM_WRITE                  0x80000000  // Section is writeable.
00354 
00355 #define IMAGE_DOS_SIGNATURE                 0x5A4D      // MZ
00356 #define IMAGE_NT_SIGNATURE                  0x00004550  // PE00
00357 
00358 #define IMAGE_NT_OPTIONAL_HDR_MAGIC      0x10b
00359 
00360 // !!!
00361 #define FIELD_OFFSET(type, field)    (((char*)&(((type *)0)->field))-((char*)0))
00362 
00363 #define IMAGE_ORDINAL_FLAG 0x80000000
00364 #define IMAGE_ORDINAL(Ordinal) (Ordinal & 0xffff)
00365 #define IMAGE_SNAP_BY_ORDINAL(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG) != 0)
00366 
00367 // Directory Entries
00368 
00369 #define IMAGE_DIRECTORY_ENTRY_EXPORT          0   // Export Directory
00370 #define IMAGE_DIRECTORY_ENTRY_IMPORT          1   // Import Directory
00371 #define IMAGE_DIRECTORY_ENTRY_RESOURCE        2   // Resource Directory
00372 #define IMAGE_DIRECTORY_ENTRY_EXCEPTION       3   // Exception Directory
00373 #define IMAGE_DIRECTORY_ENTRY_SECURITY        4   // Security Directory
00374 #define IMAGE_DIRECTORY_ENTRY_BASERELOC       5   // Base Relocation Table
00375 #define IMAGE_DIRECTORY_ENTRY_DEBUG           6   // Debug Directory
00376 //      IMAGE_DIRECTORY_ENTRY_COPYRIGHT       7   // (X86 usage)
00377 #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE    7   // Architecture Specific Data
00378 #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR       8   // RVA of GP
00379 #define IMAGE_DIRECTORY_ENTRY_TLS             9   // TLS Directory
00380 #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    10   // Load Configuration Directory
00381 #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   11   // Bound Import Directory in headers
00382 #define IMAGE_DIRECTORY_ENTRY_IAT            12   // Import Address Table
00383 #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   13   // Delay Load Import Descriptors
00384 #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14   // COM Runtime descriptor
00385 
00386 /*
00387  * Resource specific
00388  */
00389 // !!! pack problem
00390 typedef struct NEWHEADER
00391  {
00392   uint16_t Reserved; // zero
00393   uint16_t ResType;  // 1 = icona
00394   uint16_t ResCount; // # of resources
00395 } NEWHEADER;
00396 
00397 
00398 
00399 typedef struct ICONRESDIR 
00400 {
00401   uint8_t Width;
00402   uint8_t Height;
00403   uint8_t ColorCount;
00404   uint8_t reserved;
00405 } ICONRESDIR;
00406 
00407 typedef struct CURSORDIR 
00408 {
00409   uint16_t Width;
00410   uint16_t Height;
00411 } CURSORDIR;
00412 
00413 // !!! pack problem
00414 typedef struct RESDIR
00415 {
00416     union
00417     {
00418         ICONRESDIR   Icon;
00419         CURSORDIR    Cursor;
00420     } ResInfo;
00421     uint16_t Planes;
00422     uint16_t BitCount;
00423     uint32_t BytesInRes;
00424     uint16_t IconCursorId;
00425 } RESDIR;
00426 
00427 #endif //FILE_PEFORMAT_H

Generated on Mon Jan 13 22:20:34 2003 for perdr by doxygen1.2.15