/*- * Copyright (c) 2015 Kai Wang * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * $Id: pe.h 3441 2016-04-07 15:04:20Z emaste $ */ #ifndef _PE_H_ #define _PE_H_ #include /* * MS-DOS header. */ typedef struct _PE_DosHdr { char dh_magic[2]; uint16_t dh_lastsize; uint16_t dh_nblock; uint16_t dh_nreloc; uint16_t dh_hdrsize; uint16_t dh_minalloc; uint16_t dh_maxalloc; uint16_t dh_ss; uint16_t dh_sp; uint16_t dh_checksum; uint16_t dh_ip; uint16_t dh_cs; uint16_t dh_relocpos; uint16_t dh_noverlay; uint16_t dh_reserved1[4]; uint16_t dh_oemid; uint16_t dh_oeminfo; uint16_t dh_reserved2[10]; uint32_t dh_lfanew; } PE_DosHdr; /* * Rich header. */ typedef struct _PE_RichHdr { uint32_t rh_xor; uint32_t rh_total; uint32_t *rh_compid; uint32_t *rh_cnt; } PE_RichHdr; /* * COFF header: Machine Types. */ #define IMAGE_FILE_MACHINE_UNKNOWN 0x0 /* not specified */ #define IMAGE_FILE_MACHINE_AM33 0x1d3 /* Matsushita AM33 */ #define IMAGE_FILE_MACHINE_AMD64 0x8664 /* x86-64 */ #define IMAGE_FILE_MACHINE_ARM 0x1c0 /* ARM LE */ #define IMAGE_FILE_MACHINE_ARMNT 0x1c4 /* ARMv7(or higher) Thumb */ #define IMAGE_FILE_MACHINE_ARM64 0xaa64 /* ARMv8 64-bit */ #define IMAGE_FILE_MACHINE_EBC 0xebc /* EFI byte code */ #define IMAGE_FILE_MACHINE_I386 0x14c /* x86 */ #define IMAGE_FILE_MACHINE_IA64 0x200 /* IA64 */ #define IMAGE_FILE_MACHINE_M32R 0x9041 /* Mitsubishi M32R LE */ #define IMAGE_FILE_MACHINE_MIPS16 0x266 /* MIPS16 */ #define IMAGE_FILE_MACHINE_MIPSFPU 0x366 /* MIPS with FPU */ #define IMAGE_FILE_MACHINE_MIPSFPU16 0x466 /* MIPS16 with FPU */ #define IMAGE_FILE_MACHINE_POWERPC 0x1f0 /* Power PC LE */ #define IMAGE_FILE_MACHINE_POWERPCFP 0x1f1 /* Power PC floating point */ #define IMAGE_FILE_MACHINE_R4000 0x166 /* MIPS R4000 LE */ #define IMAGE_FILE_MACHINE_RISCV32 0x5032 /* RISC-V 32-bit */ #define IMAGE_FILE_MACHINE_RISCV64 0x5064 /* RISC-V 64-bit */ #define IMAGE_FILE_MACHINE_RISCV128 0x5128 /* RISC-V 128-bit */ #define IMAGE_FILE_MACHINE_SH3 0x1a2 /* Hitachi SH3 */ #define IMAGE_FILE_MACHINE_SH3DSP 0x1a3 /* Hitachi SH3 DSP */ #define IMAGE_FILE_MACHINE_SH4 0x1a6 /* Hitachi SH4 */ #define IMAGE_FILE_MACHINE_SH5 0x1a8 /* Hitachi SH5 */ #define IMAGE_FILE_MACHINE_THUMB 0x1c2 /* ARM or Thumb interworking */ #define IMAGE_FILE_MACHINE_WCEMIPSV2 0x169 /* MIPS LE WCE v2 */ /* * COFF header: Characteristics */ #define IMAGE_FILE_RELOCS_STRIPPED 0x0001 #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 #define IMAGE_FILE_AGGRESSIVE_WS_TRIM 0x0010 #define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 #define IMAGE_FILE_32BIT_MACHINE 0x0100 #define IMAGE_FILE_DEBUG_STRIPPED 0x0200 #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 #define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 #define IMAGE_FILE_SYSTEM 0x1000 #define IMAGE_FILE_DLL 0x2000 #define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 /* * COFF Header. */ typedef struct _PE_CoffHdr { uint16_t ch_machine; uint16_t ch_nsec; uint32_t ch_timestamp; uint32_t ch_symptr; uint32_t ch_nsym; uint16_t ch_optsize; uint16_t ch_char; } PE_CoffHdr; /* * Optional Header: Subsystem. */ #define IMAGE_SUBSYSTEM_UNKNOWN 0 #define IMAGE_SUBSYSTEM_NATIVE 1 #define IMAGE_SUBSYSTEM_WINDOWS_GUI 2 #define IMAGE_SUBSYSTEM_WINDOWS_CUI 3 #define IMAGE_SUBSYSTEM_POSIX_CUI 7 #define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI 9 #define IMAGE_SUBSYSTEM_EFI_APPLICATION 10 #define IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER 11 #define IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER 12 #define IMAGE_SUBSYSTEM_EFI_ROM 13 #define IMAGE_SUBSYSTEM_XBOX 14 /* * Optional Header: DLL Characteristics */ #define IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE 0x0040 #define IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY 0x0080 #define IMAGE_DLL_CHARACTERISTICS_NX_COMPAT 0x0100 #define IMAGE_DLL_CHARACTERISTICS_NO_ISOLATION 0x0200 #define IMAGE_DLL_CHARACTERISTICS_NO_SEH 0x0400 #define IMAGE_DLL_CHARACTERISTICS_NO_BIND 0x0800 #define IMAGE_DLL_CHARACTERISTICS_WDM_DRIVER 0x2000 #define IMAGE_DLL_CHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000 /* * Optional Header. */ #define PE_FORMAT_ROM 0x107 #define PE_FORMAT_32 0x10b #define PE_FORMAT_32P 0x20b typedef struct _PE_OptHdr { uint16_t oh_magic; uint8_t oh_ldvermajor; uint8_t oh_ldverminor; uint32_t oh_textsize; uint32_t oh_datasize; uint32_t oh_bsssize; uint32_t oh_entry; uint32_t oh_textbase; uint32_t oh_database; uint64_t oh_imgbase; uint32_t oh_secalign; uint32_t oh_filealign; uint16_t oh_osvermajor; uint16_t oh_osverminor; uint16_t oh_imgvermajor; uint16_t oh_imgverminor; uint16_t oh_subvermajor; uint16_t oh_subverminor; uint32_t oh_win32ver; uint32_t oh_imgsize; uint32_t oh_hdrsize; uint32_t oh_checksum; uint16_t oh_subsystem; uint16_t oh_dllchar; uint64_t oh_stacksizer; uint64_t oh_stacksizec; uint64_t oh_heapsizer; uint64_t oh_heapsizec; uint32_t oh_ldrflags; uint32_t oh_ndatadir; } PE_OptHdr; /* * Optional Header: Data Directories. */ #define PE_DD_EXPORT 0 #define PE_DD_IMPORT 1 #define PE_DD_RESROUCE 2 #define PE_DD_EXCEPTION 3 #define PE_DD_CERTIFICATE 4 #define PE_DD_BASERELOC 5 #define PE_DD_DEBUG 6 #define PE_DD_ARCH 7 #define PE_DD_GLOBALPTR 8 #define PE_DD_TLS 9 #define PE_DD_LOADCONFIG 10 #define PE_DD_BOUNDIMPORT 11 #define PE_DD_IAT 12 #define PE_DD_DELAYIMPORT 13 #define PE_DD_CLRRUNTIME 14 #define PE_DD_RESERVED 15 #define PE_DD_MAX 16 typedef struct _PE_DataDirEntry { uint32_t de_addr; uint32_t de_size; } PE_DataDirEntry; typedef struct _PE_DataDir { PE_DataDirEntry dd_e[PE_DD_MAX]; uint32_t dd_total; } PE_DataDir; /* * Section Headers: Section flags. */ #define IMAGE_SCN_TYPE_NO_PAD 0x00000008 #define IMAGE_SCN_CNT_CODE 0x00000020 #define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040 #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 #define IMAGE_SCN_LNK_OTHER 0x00000100 #define IMAGE_SCN_LNK_INFO 0x00000200 #define IMAGE_SCN_LNK_REMOVE 0x00000800 #define IMAGE_SCN_LNK_COMDAT 0x00001000 #define IMAGE_SCN_GPREL 0x00008000 #define IMAGE_SCN_MEM_PURGEABLE 0x00020000 #define IMAGE_SCN_MEM_16BIT 0x00020000 #define IMAGE_SCN_MEM_LOCKED 0x00040000 #define IMAGE_SCN_MEM_PRELOAD 0x00080000 #define IMAGE_SCN_ALIGN_1BYTES 0x00100000 #define IMAGE_SCN_ALIGN_2BYTES 0x00200000 #define IMAGE_SCN_ALIGN_4BYTES 0x00300000 #define IMAGE_SCN_ALIGN_8BYTES 0x00400000 #define IMAGE_SCN_ALIGN_16BYTES 0x00500000 #define IMAGE_SCN_ALIGN_32BYTES 0x00600000 #define IMAGE_SCN_ALIGN_64BYTES 0x00700000 #define IMAGE_SCN_ALIGN_128BYTES 0x00800000 #define IMAGE_SCN_ALIGN_256BYTES 0x00900000 #define IMAGE_SCN_ALIGN_512BYTES 0x00A00000 #define IMAGE_SCN_ALIGN_1024BYTES 0x00B00000 #define IMAGE_SCN_ALIGN_2048BYTES 0x00C00000 #define IMAGE_SCN_ALIGN_4096BYTES 0x00D00000 #define IMAGE_SCN_ALIGN_8192BYTES 0x00E00000 #define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000 #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000 #define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 #define IMAGE_SCN_MEM_NOT_PAGED 0x08000000 #define IMAGE_SCN_MEM_SHARED 0x10000000 #define IMAGE_SCN_MEM_EXECUTE 0x20000000 #define IMAGE_SCN_MEM_READ 0x40000000 #define IMAGE_SCN_MEM_WRITE 0x80000000 /* * Section Headers. */ typedef struct _PE_SecHdr { char sh_name[8]; uint32_t sh_virtsize; uint32_t sh_addr; uint32_t sh_rawsize; uint32_t sh_rawptr; uint32_t sh_relocptr; uint32_t sh_lineptr; uint16_t sh_nreloc; uint16_t sh_nline; uint32_t sh_char; } PE_SecHdr; #endif /* !_PE_H_ */