www.pudn.com > He4Hook215b6.rar > PeHeader.h

#ifndef __PE_HEADER_H 
 #define __PE_HEADER_H 
 
#include "../Include/KTypes.h" 
 
#pragma pack(push) 
#pragma pack(1) 
 
//#define FIELD_OFFSET(type, field)    ((LONG)(INT64_PTR)&(((type *)0)->field)) 
 
#define IMAGE_DOS_SIGNATURE                 0x5a4d     //0x4D5A      // MZ 
#define IMAGE_OS2_SIGNATURE                 0x454e     //0x4E45      // NE 
#define IMAGE_OS2_SIGNATURE_LE              0x454c     //0x4C45      // LE 
#define IMAGE_NT_SIGNATURE                  0x00004550 //0x50450000  // PE00 
 
typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header 
    WORD   e_magic;                     // Magic number 
    WORD   e_cblp;                      // Bytes on last page of file 
    WORD   e_cp;                        // Pages in file 
    WORD   e_crlc;                      // Relocations 
    WORD   e_cparhdr;                   // Size of header in paragraphs 
    WORD   e_minalloc;                  // Minimum extra paragraphs needed 
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed 
    WORD   e_ss;                        // Initial (relative) SS value 
    WORD   e_sp;                        // Initial SP value 
    WORD   e_csum;                      // Checksum 
    WORD   e_ip;                        // Initial IP value 
    WORD   e_cs;                        // Initial (relative) CS value 
    WORD   e_lfarlc;                    // File address of relocation table 
    WORD   e_ovno;                      // Overlay number 
    WORD   e_res[4];                    // Reserved words 
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo) 
    WORD   e_oeminfo;                   // OEM information; e_oemid specific 
    WORD   e_res2[10];                  // Reserved words 
    LONG   e_lfanew;                    // File address of new exe header 
  } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER; 
 
// 
// File header format. 
// 
 
typedef struct _IMAGE_FILE_HEADER { 
    WORD    Machine; 
    WORD    NumberOfSections; 
    DWORD   TimeDateStamp; 
    DWORD   PointerToSymbolTable; 
    DWORD   NumberOfSymbols; 
    WORD    SizeOfOptionalHeader; 
    WORD    Characteristics; 
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; 
 
 
#define IMAGE_SIZEOF_FILE_HEADER             20 
 
// 
// Directory format. 
// 
 
typedef struct _IMAGE_DATA_DIRECTORY { 
    DWORD   VirtualAddress; 
    DWORD   Size; 
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY; 
 
#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES    16 
 
// 
// Optional header format. 
// 
 
typedef struct _IMAGE_OPTIONAL_HEADER { 
    // 
    // Standard fields. 
    // 
 
    WORD    Magic; 
    BYTE    MajorLinkerVersion; 
    BYTE    MinorLinkerVersion; 
    DWORD   SizeOfCode; 
    DWORD   SizeOfInitializedData; 
    DWORD   SizeOfUninitializedData; 
    DWORD   AddressOfEntryPoint; 
    DWORD   BaseOfCode; 
    DWORD   BaseOfData; 
 
    // 
    // NT additional fields. 
    // 
 
    DWORD   ImageBase; 
    DWORD   SectionAlignment; 
    DWORD   FileAlignment; 
    WORD    MajorOperatingSystemVersion; 
    WORD    MinorOperatingSystemVersion; 
    WORD    MajorImageVersion; 
    WORD    MinorImageVersion; 
    WORD    MajorSubsystemVersion; 
    WORD    MinorSubsystemVersion; 
    DWORD   Win32VersionValue; 
    DWORD   SizeOfImage; 
    DWORD   SizeOfHeaders; 
    DWORD   CheckSum; 
    WORD    Subsystem; 
    WORD    DllCharacteristics; 
    DWORD   SizeOfStackReserve; 
    DWORD   SizeOfStackCommit; 
    DWORD   SizeOfHeapReserve; 
    DWORD   SizeOfHeapCommit; 
    DWORD   LoaderFlags; 
    DWORD   NumberOfRvaAndSizes; 
    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; 
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32; 
 
typedef struct _IMAGE_NT_HEADERS { 
    DWORD Signature; 
    IMAGE_FILE_HEADER FileHeader; 
    IMAGE_OPTIONAL_HEADER32 OptionalHeader; 
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32; 
 
// 
// Section header format. 
// 
 
#define IMAGE_SIZEOF_SHORT_NAME              8 
 
typedef struct _IMAGE_SECTION_HEADER { 
    BYTE    Name[IMAGE_SIZEOF_SHORT_NAME]; 
    union { 
            DWORD   PhysicalAddress; 
            DWORD   VirtualSize; 
    } Misc; 
    DWORD   VirtualAddress; 
    DWORD   SizeOfRawData; 
    DWORD   PointerToRawData; 
    DWORD   PointerToRelocations; 
    DWORD   PointerToLinenumbers; 
    WORD    NumberOfRelocations; 
    WORD    NumberOfLinenumbers; 
    DWORD   Characteristics; 
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER; 
 
#define IMAGE_SIZEOF_SECTION_HEADER          40 
 
 
#define IMAGE_FIRST_SECTION32( ntheader ) ((PIMAGE_SECTION_HEADER)        \ 
    ((UINT64_PTR)ntheader +                                                  \ 
     FIELD_OFFSET( IMAGE_NT_HEADERS32, OptionalHeader ) +                 \ 
     ((PIMAGE_NT_HEADERS32)(ntheader))->FileHeader.SizeOfOptionalHeader   \ 
    )) 
 
typedef struct { 
  DWORD VirtualAddress; 
  DWORD Size; 
} RELO_HEADER, *PRELO_HEADER; 
 
 
// Directory Entries 
 
#define IMAGE_DIRECTORY_ENTRY_EXPORT          0   // Export Directory 
#define IMAGE_DIRECTORY_ENTRY_IMPORT          1   // Import Directory 
#define IMAGE_DIRECTORY_ENTRY_RESOURCE        2   // Resource Directory 
#define IMAGE_DIRECTORY_ENTRY_EXCEPTION       3   // Exception Directory 
#define IMAGE_DIRECTORY_ENTRY_SECURITY        4   // Security Directory 
#define IMAGE_DIRECTORY_ENTRY_BASERELOC       5   // Base Relocation Table 
#define IMAGE_DIRECTORY_ENTRY_DEBUG           6   // Debug Directory 
//      IMAGE_DIRECTORY_ENTRY_COPYRIGHT       7   // (X86 usage) 
#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE    7   // Architecture Specific Data 
#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR       8   // RVA of GP 
#define IMAGE_DIRECTORY_ENTRY_TLS             9   // TLS Directory 
#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    10   // Load Configuration Directory 
#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   11   // Bound Import Directory in headers 
#define IMAGE_DIRECTORY_ENTRY_IAT            12   // Import Address Table 
#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   13   // Delay Load Import Descriptors 
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14   // COM Runtime descriptor 
 
// 
// Export Format 
// 
 
typedef struct _IMAGE_EXPORT_DIRECTORY { 
    DWORD   Characteristics; 
    DWORD   TimeDateStamp; 
    WORD    MajorVersion; 
    WORD    MinorVersion; 
    DWORD   Name; 
    DWORD   Base; 
    DWORD   NumberOfFunctions; 
    DWORD   NumberOfNames; 
    DWORD   AddressOfFunctions;     // RVA from base of image 
    DWORD   AddressOfNames;         // RVA from base of image 
    DWORD   AddressOfNameOrdinals;  // RVA from base of image 
} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY; 
 
 
#pragma pack(pop) 
 
#endif //__PE_HEADER_H