Main Page   Namespace List   Class Hierarchy   Alphabetical List   Compound List   File List   Compound Members   File Members  

peformat.h

Go to the documentation of this file.
00001 /*
00002 PeRdr - PE file disassembler
00003 Copyright (C) 1999-2002 Frediano Ziglio
00004 -----
00005 
00006 This program is free software; you can redistribute it and/or modify
00007 it under the terms of the GNU General Public License as published by
00008 the Free Software Foundation; either version 2 of the License, or
00009 (at your option) any later version.
00010 
00011 This program is distributed in the hope that it will be useful,
00012 but WITHOUT ANY WARRANTY; without even the implied warranty of
00013 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
00014 GNU General Public License for more details.
00015 
00016 You should have received a copy of the GNU General Public License
00017 along with this program; if not, write to the Free Software
00018 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
00019 -----
00020 
00021 INFORMATION
00022   www: https://freddy77.tripod.com/perdr/
00023   e-mail: freddy77@angelfire.com
00024 */
00025 #ifndef FILE_PEFORMAT_H
00026 #define FILE_PEFORMAT_H
00027 
00028 #define PE_IMAGE_SIZEOF_SHORT_NAME              8
00029 
00030 typedef struct _PE_IMAGE_SECTION_HEADER {
00031     uint8_t    Name[PE_IMAGE_SIZEOF_SHORT_NAME];
00032     union {
00033             uint32_t   PhysicalAddress;
00034             uint32_t   VirtualSize;
00035     } Misc;
00036     uint32_t   VirtualAddress;
00037     uint32_t   SizeOfRawData;
00038     uint32_t   PointerToRawData;
00039     uint32_t   PointerToRelocations;
00040     uint32_t   PointerToLinenumbers;
00041     uint16_t    NumberOfRelocations;
00042     uint16_t    NumberOfLinenumbers;
00043     uint32_t   Characteristics;
00044 } PE_IMAGE_SECTION_HEADER;
00045 
00046 typedef struct _PE_IMAGE_FILE_HEADER {
00047     uint16_t    Machine;
00048     uint16_t    NumberOfSections;
00049     uint32_t   TimeDateStamp;
00050     uint32_t   PointerToSymbolTable;
00051     uint32_t   NumberOfSymbols;
00052     uint16_t    SizeOfOptionalHeader;
00053     uint16_t    Characteristics;
00054 } PE_IMAGE_FILE_HEADER;
00055 
00056 typedef struct _PE_IMAGE_DATA_DIRECTORY {
00057     uint32_t   VirtualAddress;
00058     uint32_t   Size;
00059 } PE_IMAGE_DATA_DIRECTORY;
00060 
00061 #define PE_IMAGE_NUMBEROF_DIRECTORY_ENTRIES    16
00062 
00063 typedef struct _PE_IMAGE_OPTIONAL_HEADER {
00064     //
00065     // Standard fields.
00066     //
00067 
00068     uint16_t    Magic;
00069     uint8_t    MajorLinkerVersion;
00070     uint8_t    MinorLinkerVersion;
00071     uint32_t   SizeOfCode;
00072     uint32_t   SizeOfInitializedData;
00073     uint32_t   SizeOfUninitializedData;
00074     uint32_t   AddressOfEntryPoint;
00075     uint32_t   BaseOfCode;
00076     uint32_t   BaseOfData;
00077 
00078     //
00079     // NT additional fields.
00080     //
00081 
00082     uint32_t   ImageBase;
00083     uint32_t   SectionAlignment;
00084     uint32_t   FileAlignment;
00085     uint16_t    MajorOperatingSystemVersion;
00086     uint16_t    MinorOperatingSystemVersion;
00087     uint16_t    MajorImageVersion;
00088     uint16_t    MinorImageVersion;
00089     uint16_t    MajorSubsystemVersion;
00090     uint16_t    MinorSubsystemVersion;
00091     uint32_t   Win32VersionValue;
00092     uint32_t   SizeOfImage;
00093     uint32_t   SizeOfHeaders;
00094     uint32_t   CheckSum;
00095     uint16_t    Subsystem;
00096     uint16_t    DllCharacteristics;
00097     uint32_t   SizeOfStackReserve;
00098     uint32_t   SizeOfStackCommit;
00099     uint32_t   SizeOfHeapReserve;
00100     uint32_t   SizeOfHeapCommit;
00101     uint32_t   LoaderFlags;
00102     uint32_t   NumberOfRvaAndSizes;
00103     PE_IMAGE_DATA_DIRECTORY DataDirectory[PE_IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
00104 } PE_IMAGE_OPTIONAL_HEADER32, PE_IMAGE_OPTIONAL_HEADER;
00105 
00106 typedef struct _PE_IMAGE_NT_HEADERS {
00107     uint32_t Signature;
00108     PE_IMAGE_FILE_HEADER FileHeader;
00109     PE_IMAGE_OPTIONAL_HEADER32 OptionalHeader;
00110 } PE_IMAGE_NT_HEADERS32, PE_IMAGE_NT_HEADERS;
00111 
00112 typedef struct _PE_IMAGE_IMPORT_DESCRIPTOR {
00113     union {
00114         uint32_t   Characteristics;            // 0 for terminating null import descriptor
00115         uint32_t   OriginalFirstThunk;         // RVA to original unbound IAT (PIMAGE_THUNK_DATA)
00116     };
00117     uint32_t   TimeDateStamp;                  // 0 if not bound,
00118                                             // -1 if bound, and real date\time stamp
00119                                             //     in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
00120                                             // O.W. date/time stamp of DLL bound to (Old BIND)
00121 
00122     uint32_t   ForwarderChain;                 // -1 if no forwarders
00123     uint32_t   Name;
00124     uint32_t   FirstThunk;                     // RVA to IAT (if bound this IAT has actual addresses)
00125 } PE_IMAGE_IMPORT_DESCRIPTOR;
00126 
00127 typedef struct _PE_IMAGE_IMPORT_BY_NAME {
00128     uint16_t    Hint;
00129     uint8_t    Name[1];
00130 } PE_IMAGE_IMPORT_BY_NAME;
00131 
00132 typedef struct _PE_IMAGE_EXPORT_DIRECTORY {
00133     uint32_t   Characteristics;
00134     uint32_t   TimeDateStamp;
00135     uint16_t    MajorVersion;
00136     uint16_t    MinorVersion;
00137     uint32_t   Name;
00138     uint32_t   Base;
00139     uint32_t   NumberOfFunctions;
00140     uint32_t   NumberOfNames;
00141     uint32_t   AddressOfFunctions;     // RVA from base of image
00142     uint32_t   AddressOfNames;         // RVA from base of image
00143     uint32_t   AddressOfNameOrdinals;  // RVA from base of image
00144 } PE_IMAGE_EXPORT_DIRECTORY;
00145 
00146 typedef struct _PE_IMAGE_THUNK_DATA32 {
00147     union {
00148         uint32_t ForwarderString;
00149         uint32_t Function;
00150         uint32_t Ordinal;
00151         uint32_t AddressOfData;
00152     } u1;
00153 } PE_IMAGE_THUNK_DATA32, PE_IMAGE_THUNK_DATA;
00154 
00155 typedef struct _PE_IMAGE_BASE_RELOCATION {
00156     uint32_t   VirtualAddress;
00157     uint32_t   SizeOfBlock;
00158 //  uint16_t    TypeOffset[1];
00159 } PE_IMAGE_BASE_RELOCATION;
00160 
00161 typedef struct _PE_IMAGE_RESOURCE_DIRECTORY_ENTRY {
00162     union {
00163         uint32_t   Name; // if >0x10000 is a numeric Id
00164     } u1;
00165     union {
00166         uint32_t   OffsetToData;
00167     } u2;
00168 } PE_IMAGE_RESOURCE_DIRECTORY_ENTRY;
00169 #define RESOURCE_ENTRY_GETID(e) \
00170   (e.u1.Name&0xffffu)
00171 #define RESOURCE_ENTRY_ISSTRING(e) \
00172   ((e.u1.Name>>31)&1)
00173 #define RESOURCE_ENTRY_NAME_OFFSET(e) \
00174   (e.u1.Name&0x7fffffff)
00175 #define RESOURCE_ENTRY_ISDIRECTORY(e) \
00176   ((e.u2.OffsetToData>>31)&1)
00177 #define RESOURCE_ENTRY_DATA_OFFSET(e) \
00178   (e.u2.OffsetToData&0x7fffffff)
00179 
00180 typedef struct _PE_IMAGE_RESOURCE_DIRECTORY {
00181     uint32_t   Characteristics;
00182     uint32_t   TimeDateStamp;
00183     uint16_t    MajorVersion;
00184     uint16_t    MinorVersion;
00185     uint16_t    NumberOfNamedEntries;
00186     uint16_t    NumberOfIdEntries;
00187 //  IMAGE_RESOURCE_DIRECTORY_ENTRY DirectoryEntries[];
00188 } PE_IMAGE_RESOURCE_DIRECTORY;
00189 
00190 typedef struct _PE_IMAGE_RESOURCE_DATA_ENTRY {
00191     uint32_t   OffsetToData;
00192     uint32_t   Size;
00193     uint32_t   CodePage;
00194     uint32_t   Reserved;
00195 } PE_IMAGE_RESOURCE_DATA_ENTRY;
00196 
00197 typedef struct _PE_IMAGE_DOS_HEADER {      // DOS .EXE header
00198     uint16_t   e_magic;                     // Magic number
00199     uint16_t   e_cblp;                      // Bytes on last page of file
00200     uint16_t   e_cp;                        // Pages in file
00201     uint16_t   e_crlc;                      // Relocations
00202     uint16_t   e_cparhdr;                   // Size of header in paragraphs
00203     uint16_t   e_minalloc;                  // Minimum extra paragraphs needed
00204     uint16_t   e_maxalloc;                  // Maximum extra paragraphs needed
00205     uint16_t   e_ss;                        // Initial (relative) SS value
00206     uint16_t   e_sp;                        // Initial SP value
00207     uint16_t   e_csum;                      // Checksum
00208     uint16_t   e_ip;                        // Initial IP value
00209     uint16_t   e_cs;                        // Initial (relative) CS value
00210     uint16_t   e_lfarlc;                    // File address of relocation table
00211     uint16_t   e_ovno;                      // Overlay number
00212     uint16_t   e_res[4];                    // Reserved words
00213     uint16_t   e_oemid;                     // OEM identifier (for e_oeminfo)
00214     uint16_t   e_oeminfo;                   // OEM information; e_oemid specific
00215     uint16_t   e_res2[10];                  // Reserved words
00216     uint32_t  e_lfanew;                    // File address of new exe header
00217   } PE_IMAGE_DOS_HEADER;
00218 
00219 #define IMAGE_REL_BASED_ABSOLUTE              0
00220 #define IMAGE_REL_BASED_HIGH                  1
00221 #define IMAGE_REL_BASED_LOW                   2
00222 #define IMAGE_REL_BASED_HIGHLOW               3
00223 #define IMAGE_REL_BASED_HIGHADJ               4
00224 #define IMAGE_REL_BASED_MIPS_JMPADDR          5
00225 #define IMAGE_REL_BASED_SECTION               6
00226 #define IMAGE_REL_BASED_REL32                 7
00227 
00228 #define IMAGE_REL_BASED_MIPS_JMPADDR16        9
00229 #define IMAGE_REL_BASED_IA64_IMM64            9
00230 #define IMAGE_REL_BASED_DIR64                 10
00231 #define IMAGE_REL_BASED_HIGH3ADJ              11
00232 
00233 #define IMAGE_FILE_MACHINE_UNKNOWN           0
00234 #define IMAGE_FILE_MACHINE_I386              0x014c  // Intel 386.
00235 #define IMAGE_FILE_MACHINE_R3000             0x0162  // MIPS little-endian, 0x160 big-endian
00236 #define IMAGE_FILE_MACHINE_R4000             0x0166  // MIPS little-endian
00237 #define IMAGE_FILE_MACHINE_R10000            0x0168  // MIPS little-endian
00238 #define IMAGE_FILE_MACHINE_WCEMIPSV2         0x0169  // MIPS little-endian WCE v2
00239 #define IMAGE_FILE_MACHINE_ALPHA             0x0184  // Alpha_AXP
00240 #define IMAGE_FILE_MACHINE_POWERPC           0x01F0  // IBM PowerPC Little-Endian
00241 #define IMAGE_FILE_MACHINE_SH3               0x01a2  // SH3 little-endian
00242 #define IMAGE_FILE_MACHINE_SH3E              0x01a4  // SH3E little-endian
00243 #define IMAGE_FILE_MACHINE_SH4               0x01a6  // SH4 little-endian
00244 #define IMAGE_FILE_MACHINE_ARM               0x01c0  // ARM Little-Endian
00245 #define IMAGE_FILE_MACHINE_THUMB             0x01c2
00246 #define IMAGE_FILE_MACHINE_IA64              0x0200  // Intel 64
00247 #define IMAGE_FILE_MACHINE_MIPS16            0x0266  // MIPS
00248 #define IMAGE_FILE_MACHINE_MIPSFPU           0x0366  // MIPS
00249 #define IMAGE_FILE_MACHINE_MIPSFPU16         0x0466  // MIPS
00250 #define IMAGE_FILE_MACHINE_ALPHA64           0x0284  // ALPHA64
00251 #define IMAGE_FILE_MACHINE_AXP64             IMAGE_FILE_MACHINE_ALPHA64
00252 
00253 #define IMAGE_FILE_RELOCS_STRIPPED           0x0001  // Relocation info stripped from file.
00254 #define IMAGE_FILE_EXECUTABLE_IMAGE          0x0002  // File is executable  (i.e. no unresolved externel references).
00255 #define IMAGE_FILE_LINE_NUMS_STRIPPED        0x0004  // Line nunbers stripped from file.
00256 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008  // Local symbols stripped from file.
00257 #define IMAGE_FILE_AGGRESIVE_WS_TRIM         0x0010  // Agressively trim working set
00258 #define IMAGE_FILE_LARGE_ADDRESS_AWARE       0x0020  // App can handle >2gb addresses
00259 #define IMAGE_FILE_BYTES_REVERSED_LO         0x0080  // Bytes of machine word are reversed.
00260 #define IMAGE_FILE_32BIT_MACHINE             0x0100  // 32 bit word machine.
00261 #define IMAGE_FILE_DEBUG_STRIPPED            0x0200  // Debugging info stripped from file in .DBG file
00262 #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP   0x0400  // If Image is on removable media, copy and run from the swap file.
00263 #define IMAGE_FILE_NET_RUN_FROM_SWAP         0x0800  // If Image is on Net, copy and run from the swap file.
00264 #define IMAGE_FILE_SYSTEM                    0x1000  // System File.
00265 #define IMAGE_FILE_DLL                       0x2000  // File is a DLL.
00266 #define IMAGE_FILE_UP_SYSTEM_ONLY            0x4000  // File should only be run on a UP machine
00267 #define IMAGE_FILE_BYTES_REVERSED_HI         0x8000  // Bytes of machine word are reversed.
00268 
00269 #define IMAGE_FILE_MACHINE_UNKNOWN           0
00270 #define IMAGE_FILE_MACHINE_I386              0x014c  // Intel 386.
00271 #define IMAGE_FILE_MACHINE_R3000             0x0162  // MIPS little-endian, 0x160 big-endian
00272 #define IMAGE_FILE_MACHINE_R4000             0x0166  // MIPS little-endian
00273 #define IMAGE_FILE_MACHINE_R10000            0x0168  // MIPS little-endian
00274 #define IMAGE_FILE_MACHINE_WCEMIPSV2         0x0169  // MIPS little-endian WCE v2
00275 #define IMAGE_FILE_MACHINE_ALPHA             0x0184  // Alpha_AXP
00276 #define IMAGE_FILE_MACHINE_POWERPC           0x01F0  // IBM PowerPC Little-Endian
00277 #define IMAGE_FILE_MACHINE_SH3               0x01a2  // SH3 little-endian
00278 #define IMAGE_FILE_MACHINE_SH3E              0x01a4  // SH3E little-endian
00279 #define IMAGE_FILE_MACHINE_SH4               0x01a6  // SH4 little-endian
00280 #define IMAGE_FILE_MACHINE_ARM               0x01c0  // ARM Little-Endian
00281 #define IMAGE_FILE_MACHINE_THUMB             0x01c2
00282 #define IMAGE_FILE_MACHINE_IA64              0x0200  // Intel 64
00283 #define IMAGE_FILE_MACHINE_MIPS16            0x0266  // MIPS
00284 #define IMAGE_FILE_MACHINE_MIPSFPU           0x0366  // MIPS
00285 #define IMAGE_FILE_MACHINE_MIPSFPU16         0x0466  // MIPS
00286 #define IMAGE_FILE_MACHINE_ALPHA64           0x0284  // ALPHA64
00287 #define IMAGE_FILE_MACHINE_AXP64             IMAGE_FILE_MACHINE_ALPHA64
00288 
00289 // Subsystem Values
00290 
00291 #define IMAGE_SUBSYSTEM_UNKNOWN              0   // Unknown subsystem.
00292 #define IMAGE_SUBSYSTEM_NATIVE               1   // Image doesn't require a subsystem.
00293 #define IMAGE_SUBSYSTEM_WINDOWS_GUI          2   // Image runs in the Windows GUI subsystem.
00294 #define IMAGE_SUBSYSTEM_WINDOWS_CUI          3   // Image runs in the Windows character subsystem.
00295 #define IMAGE_SUBSYSTEM_OS2_CUI              5   // image runs in the OS/2 character subsystem.
00296 #define IMAGE_SUBSYSTEM_POSIX_CUI            7   // image runs in the Posix character subsystem.
00297 #define IMAGE_SUBSYSTEM_NATIVE_WINDOWS       8   // image is a native Win9x driver.
00298 #define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI       9   // Image runs in the Windows CE subsystem.
00299 
00300 //
00301 // Section characteristics.
00302 //
00303 //      IMAGE_SCN_TYPE_REG                   0x00000000  // Reserved.
00304 //      IMAGE_SCN_TYPE_DSECT                 0x00000001  // Reserved.
00305 //      IMAGE_SCN_TYPE_NOLOAD                0x00000002  // Reserved.
00306 //      IMAGE_SCN_TYPE_GROUP                 0x00000004  // Reserved.
00307 #define IMAGE_SCN_TYPE_NO_PAD                0x00000008  // Reserved.
00308 //      IMAGE_SCN_TYPE_COPY                  0x00000010  // Reserved.
00309 
00310 #define IMAGE_SCN_CNT_CODE                   0x00000020  // Section contains code.
00311 #define IMAGE_SCN_CNT_INITIALIZED_DATA       0x00000040  // Section contains initialized data.
00312 #define IMAGE_SCN_CNT_UNINITIALIZED_DATA     0x00000080  // Section contains uninitialized data.
00313 
00314 #define IMAGE_SCN_LNK_OTHER                  0x00000100  // Reserved.
00315 #define IMAGE_SCN_LNK_INFO                   0x00000200  // Section contains comments or some other type of information.
00316 //      IMAGE_SCN_TYPE_OVER                  0x00000400  // Reserved.
00317 #define IMAGE_SCN_LNK_REMOVE                 0x00000800  // Section contents will not become part of image.
00318 #define IMAGE_SCN_LNK_COMDAT                 0x00001000  // Section contents comdat.
00319 //                                           0x00002000  // Reserved.
00320 //      IMAGE_SCN_MEM_PROTECTED - Obsolete   0x00004000
00321 #define IMAGE_SCN_NO_DEFER_SPEC_EXC          0x00004000  // Reset speculative exceptions handling bits in the TLB entries for this section.
00322 #define IMAGE_SCN_GPREL                      0x00008000  // Section content can be accessed relative to GP
00323 #define IMAGE_SCN_MEM_FARDATA                0x00008000
00324 //      IMAGE_SCN_MEM_SYSHEAP  - Obsolete    0x00010000
00325 #define IMAGE_SCN_MEM_PURGEABLE              0x00020000
00326 #define IMAGE_SCN_MEM_16BIT                  0x00020000
00327 #define IMAGE_SCN_MEM_LOCKED                 0x00040000
00328 #define IMAGE_SCN_MEM_PRELOAD                0x00080000
00329 
00330 #define IMAGE_SCN_ALIGN_1BYTES               0x00100000  //
00331 #define IMAGE_SCN_ALIGN_2BYTES               0x00200000  //
00332 #define IMAGE_SCN_ALIGN_4BYTES               0x00300000  //
00333 #define IMAGE_SCN_ALIGN_8BYTES               0x00400000  //
00334 #define IMAGE_SCN_ALIGN_16BYTES              0x00500000  // Default alignment if no others are specified.
00335 #define IMAGE_SCN_ALIGN_32BYTES              0x00600000  //
00336 #define IMAGE_SCN_ALIGN_64BYTES              0x00700000  //
00337 #define IMAGE_SCN_ALIGN_128BYTES             0x00800000  //
00338 #define IMAGE_SCN_ALIGN_256BYTES             0x00900000  //
00339 #define IMAGE_SCN_ALIGN_512BYTES             0x00A00000  //
00340 #define IMAGE_SCN_ALIGN_1024BYTES            0x00B00000  //
00341 #define IMAGE_SCN_ALIGN_2048BYTES            0x00C00000  //
00342 #define IMAGE_SCN_ALIGN_4096BYTES            0x00D00000  //
00343 #define IMAGE_SCN_ALIGN_8192BYTES            0x00E00000  //
00344 // Unused                                    0x00F00000
00345 
00346 #define IMAGE_SCN_LNK_NRELOC_OVFL            0x01000000  // Section contains extended relocations.
00347 #define IMAGE_SCN_MEM_DISCARDABLE            0x02000000  // Section can be discarded.
00348 #define IMAGE_SCN_MEM_NOT_CACHED             0x04000000  // Section is not cachable.
00349 #define IMAGE_SCN_MEM_NOT_PAGED              0x08000000  // Section is not pageable.
00350 #define IMAGE_SCN_MEM_SHARED                 0x10000000  // Section is shareable.
00351 #define IMAGE_SCN_MEM_EXECUTE                0x20000000  // Section is executable.
00352 #define IMAGE_SCN_MEM_READ                   0x40000000  // Section is readable.
00353 #define IMAGE_SCN_MEM_WRITE                  0x80000000  // Section is writeable.
00354 
00355 #define IMAGE_DOS_SIGNATURE                 0x5A4D      // MZ
00356 #define IMAGE_NT_SIGNATURE                  0x00004550  // PE00
00357 
00358 #define IMAGE_NT_OPTIONAL_HDR_MAGIC      0x10b
00359 
00360 // !!!
00361 #define FIELD_OFFSET(type, field)    (((char*)&(((type *)0)->field))-((char*)0))
00362 
00363 #define IMAGE_ORDINAL_FLAG 0x80000000
00364 #define IMAGE_ORDINAL(Ordinal) (Ordinal & 0xffff)
00365 #define IMAGE_SNAP_BY_ORDINAL(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG) != 0)
00366 
00367 // Directory Entries
00368 
00369 #define IMAGE_DIRECTORY_ENTRY_EXPORT          0   // Export Directory
00370 #define IMAGE_DIRECTORY_ENTRY_IMPORT          1   // Import Directory
00371 #define IMAGE_DIRECTORY_ENTRY_RESOURCE        2   // Resource Directory
00372 #define IMAGE_DIRECTORY_ENTRY_EXCEPTION       3   // Exception Directory
00373 #define IMAGE_DIRECTORY_ENTRY_SECURITY        4   // Security Directory
00374 #define IMAGE_DIRECTORY_ENTRY_BASERELOC       5   // Base Relocation Table
00375 #define IMAGE_DIRECTORY_ENTRY_DEBUG           6   // Debug Directory
00376 //      IMAGE_DIRECTORY_ENTRY_COPYRIGHT       7   // (X86 usage)
00377 #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE    7   // Architecture Specific Data
00378 #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR       8   // RVA of GP
00379 #define IMAGE_DIRECTORY_ENTRY_TLS             9   // TLS Directory
00380 #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    10   // Load Configuration Directory
00381 #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   11   // Bound Import Directory in headers
00382 #define IMAGE_DIRECTORY_ENTRY_IAT            12   // Import Address Table
00383 #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   13   // Delay Load Import Descriptors
00384 #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14   // COM Runtime descriptor
00385 
00386 /*
00387  * Resource specific
00388  */
00389 // !!! pack problem
00390 typedef struct NEWHEADER
00391  {
00392   uint16_t Reserved; // zero
00393   uint16_t ResType;  // 1 = icona
00394   uint16_t ResCount; // # of resources
00395 } NEWHEADER;
00396 
00397 
00398 
00399 typedef struct ICONRESDIR 
00400 {
00401   uint8_t Width;
00402   uint8_t Height;
00403   uint8_t ColorCount;
00404   uint8_t reserved;
00405 } ICONRESDIR;
00406 
00407 typedef struct CURSORDIR 
00408 {
00409   uint16_t Width;
00410   uint16_t Height;
00411 } CURSORDIR;
00412 
00413 // !!! pack problem
00414 typedef struct RESDIR
00415 {
00416     union
00417     {
00418         ICONRESDIR   Icon;
00419         CURSORDIR    Cursor;
00420     } ResInfo;
00421     uint16_t Planes;
00422     uint16_t BitCount;
00423     uint32_t BytesInRes;
00424     uint16_t IconCursorId;
00425 } RESDIR;
00426 
00427 #endif //FILE_PEFORMAT_H

Generated on Mon Jan 13 22:20:34 2003 for perdr by doxygen1.2.15