1
2
3
4
5
6
7
8
9
10
11#ifndef _PE_H
12#define _PE_H
13
14typedef struct _IMAGE_DOS_HEADER {
15 uint16_t e_magic;
16 uint16_t e_cblp;
17 uint16_t e_cp;
18 uint16_t e_crlc;
19 uint16_t e_cparhdr;
20 uint16_t e_minalloc;
21 uint16_t e_maxalloc;
22 uint16_t e_ss;
23 uint16_t e_sp;
24 uint16_t e_csum;
25 uint16_t e_ip;
26 uint16_t e_cs;
27 uint16_t e_lfarlc;
28 uint16_t e_ovno;
29 uint16_t e_res[4];
30 uint16_t e_oemid;
31 uint16_t e_oeminfo;
32 uint16_t e_res2[10];
33 uint32_t e_lfanew;
34} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
35
36#define IMAGE_DOS_SIGNATURE 0x5A4D
37#define IMAGE_NT_SIGNATURE 0x00004550
38
39#define IMAGE_FILE_MACHINE_ARM 0x01c0
40#define IMAGE_FILE_MACHINE_THUMB 0x01c2
41#define IMAGE_FILE_MACHINE_ARMNT 0x01c4
42#define IMAGE_FILE_MACHINE_AMD64 0x8664
43#define IMAGE_FILE_MACHINE_ARM64 0xaa64
44#define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b
45#define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b
46#define IMAGE_SUBSYSTEM_EFI_APPLICATION 10
47
48typedef struct _IMAGE_FILE_HEADER {
49 uint16_t Machine;
50 uint16_t NumberOfSections;
51 uint32_t TimeDateStamp;
52 uint32_t PointerToSymbolTable;
53 uint32_t NumberOfSymbols;
54 uint16_t SizeOfOptionalHeader;
55 uint16_t Characteristics;
56} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
57
58typedef struct _IMAGE_DATA_DIRECTORY {
59 uint32_t VirtualAddress;
60 uint32_t Size;
61} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
62
63#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
64
65typedef struct _IMAGE_OPTIONAL_HEADER64 {
66 uint16_t Magic;
67 uint8_t MajorLinkerVersion;
68 uint8_t MinorLinkerVersion;
69 uint32_t SizeOfCode;
70 uint32_t SizeOfInitializedData;
71 uint32_t SizeOfUninitializedData;
72 uint32_t AddressOfEntryPoint;
73 uint32_t BaseOfCode;
74 uint64_t ImageBase;
75 uint32_t SectionAlignment;
76 uint32_t FileAlignment;
77 uint16_t MajorOperatingSystemVersion;
78 uint16_t MinorOperatingSystemVersion;
79 uint16_t MajorImageVersion;
80 uint16_t MinorImageVersion;
81 uint16_t MajorSubsystemVersion;
82 uint16_t MinorSubsystemVersion;
83 uint32_t Win32VersionValue;
84 uint32_t SizeOfImage;
85 uint32_t SizeOfHeaders;
86 uint32_t CheckSum;
87 uint16_t Subsystem;
88 uint16_t DllCharacteristics;
89 uint64_t SizeOfStackReserve;
90 uint64_t SizeOfStackCommit;
91 uint64_t SizeOfHeapReserve;
92 uint64_t SizeOfHeapCommit;
93 uint32_t LoaderFlags;
94 uint32_t NumberOfRvaAndSizes;
95 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
96} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
97
98typedef struct _IMAGE_NT_HEADERS64 {
99 uint32_t Signature;
100 IMAGE_FILE_HEADER FileHeader;
101 IMAGE_OPTIONAL_HEADER64 OptionalHeader;
102} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;
103
104typedef struct _IMAGE_OPTIONAL_HEADER {
105
106
107
108 uint16_t Magic;
109 uint8_t MajorLinkerVersion;
110 uint8_t MinorLinkerVersion;
111 uint32_t SizeOfCode;
112 uint32_t SizeOfInitializedData;
113 uint32_t SizeOfUninitializedData;
114 uint32_t AddressOfEntryPoint;
115 uint32_t BaseOfCode;
116 uint32_t BaseOfData;
117
118
119
120 uint32_t ImageBase;
121 uint32_t SectionAlignment;
122 uint32_t FileAlignment;
123 uint16_t MajorOperatingSystemVersion;
124 uint16_t MinorOperatingSystemVersion;
125 uint16_t MajorImageVersion;
126 uint16_t MinorImageVersion;
127 uint16_t MajorSubsystemVersion;
128 uint16_t MinorSubsystemVersion;
129 uint32_t Win32VersionValue;
130 uint32_t SizeOfImage;
131 uint32_t SizeOfHeaders;
132 uint32_t CheckSum;
133 uint16_t Subsystem;
134 uint16_t DllCharacteristics;
135 uint32_t SizeOfStackReserve;
136 uint32_t SizeOfStackCommit;
137 uint32_t SizeOfHeapReserve;
138 uint32_t SizeOfHeapCommit;
139 uint32_t LoaderFlags;
140 uint32_t NumberOfRvaAndSizes;
141 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
142
143} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
144
145typedef struct _IMAGE_NT_HEADERS {
146 uint32_t Signature;
147 IMAGE_FILE_HEADER FileHeader;
148 IMAGE_OPTIONAL_HEADER32 OptionalHeader;
149} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
150
151#define IMAGE_SIZEOF_SHORT_NAME 8
152
153typedef struct _IMAGE_SECTION_HEADER {
154 uint8_t Name[IMAGE_SIZEOF_SHORT_NAME];
155 union {
156 uint32_t PhysicalAddress;
157 uint32_t VirtualSize;
158 } Misc;
159 uint32_t VirtualAddress;
160 uint32_t SizeOfRawData;
161 uint32_t PointerToRawData;
162 uint32_t PointerToRelocations;
163 uint32_t PointerToLinenumbers;
164 uint16_t NumberOfRelocations;
165 uint16_t NumberOfLinenumbers;
166 uint32_t Characteristics;
167} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
168
169#define IMAGE_DIRECTORY_ENTRY_BASERELOC 5
170
171typedef struct _IMAGE_BASE_RELOCATION
172{
173 uint32_t VirtualAddress;
174 uint32_t SizeOfBlock;
175
176} IMAGE_BASE_RELOCATION,*PIMAGE_BASE_RELOCATION;
177
178typedef struct _IMAGE_RELOCATION
179{
180 union {
181 uint32_t VirtualAddress;
182 uint32_t RelocCount;
183 } DUMMYUNIONNAME;
184 uint32_t SymbolTableIndex;
185 uint16_t Type;
186} IMAGE_RELOCATION, *PIMAGE_RELOCATION;
187
188#define IMAGE_SIZEOF_RELOCATION 10
189
190
191#define IMAGE_REL_BASED_ABSOLUTE 0
192#define IMAGE_REL_BASED_HIGH 1
193#define IMAGE_REL_BASED_LOW 2
194#define IMAGE_REL_BASED_HIGHLOW 3
195#define IMAGE_REL_BASED_HIGHADJ 4
196#define IMAGE_REL_BASED_MIPS_JMPADDR 5
197#define IMAGE_REL_BASED_ARM_MOV32A 5
198#define IMAGE_REL_BASED_ARM_MOV32 5
199#define IMAGE_REL_BASED_SECTION 6
200#define IMAGE_REL_BASED_REL 7
201#define IMAGE_REL_BASED_ARM_MOV32T 7
202#define IMAGE_REL_BASED_THUMB_MOV32 7
203#define IMAGE_REL_BASED_MIPS_JMPADDR16 9
204#define IMAGE_REL_BASED_IA64_IMM64 9
205#define IMAGE_REL_BASED_DIR64 10
206#define IMAGE_REL_BASED_HIGH3ADJ 11
207
208
209#define IMAGE_REL_ARM_ABSOLUTE 0x0000
210#define IMAGE_REL_ARM_ADDR 0x0001
211#define IMAGE_REL_ARM_ADDR32NB 0x0002
212#define IMAGE_REL_ARM_BRANCH24 0x0003
213#define IMAGE_REL_ARM_BRANCH11 0x0004
214#define IMAGE_REL_ARM_TOKEN 0x0005
215#define IMAGE_REL_ARM_GPREL12 0x0006
216#define IMAGE_REL_ARM_GPREL7 0x0007
217#define IMAGE_REL_ARM_BLX24 0x0008
218#define IMAGE_REL_ARM_BLX11 0x0009
219#define IMAGE_REL_ARM_SECTION 0x000E
220#define IMAGE_REL_ARM_SECREL 0x000F
221#define IMAGE_REL_ARM_MOV32A 0x0010
222#define IMAGE_REL_ARM_MOV32T 0x0011
223#define IMAGE_REL_ARM_BRANCH20T 0x0012
224#define IMAGE_REL_ARM_BRANCH24T 0x0014
225#define IMAGE_REL_ARM_BLX23T 0x0015
226
227
228#define IMAGE_REL_ARM64_ABSOLUTE 0x0000
229#define IMAGE_REL_ARM64_ADDR32 0x0001
230#define IMAGE_REL_ARM64_ADDR32NB 0x0002
231#define IMAGE_REL_ARM64_BRANCH26 0x0003
232#define IMAGE_REL_ARM64_PAGEBASE_REL21 0x0004
233#define IMAGE_REL_ARM64_REL21 0x0005
234#define IMAGE_REL_ARM64_PAGEOFFSET_12A 0x0006
235#define IMAGE_REL_ARM64_PAGEOFFSET_12L 0x0007
236#define IMAGE_REL_ARM64_SECREL 0x0008
237#define IMAGE_REL_ARM64_SECREL_LOW12A 0x0009
238#define IMAGE_REL_ARM64_SECREL_HIGH12A 0x000A
239#define IMAGE_REL_ARM64_SECREL_LOW12L 0x000B
240#define IMAGE_REL_ARM64_TOKEN 0x000C
241#define IMAGE_REL_ARM64_SECTION 0x000D
242#define IMAGE_REL_ARM64_ADDR64 0x000E
243
244
245#define IMAGE_REL_AMD64_ABSOLUTE 0x0000
246#define IMAGE_REL_AMD64_ADDR64 0x0001
247#define IMAGE_REL_AMD64_ADDR32 0x0002
248#define IMAGE_REL_AMD64_ADDR32NB 0x0003
249#define IMAGE_REL_AMD64_REL32 0x0004
250#define IMAGE_REL_AMD64_REL32_1 0x0005
251#define IMAGE_REL_AMD64_REL32_2 0x0006
252#define IMAGE_REL_AMD64_REL32_3 0x0007
253#define IMAGE_REL_AMD64_REL32_4 0x0008
254#define IMAGE_REL_AMD64_REL32_5 0x0009
255#define IMAGE_REL_AMD64_SECTION 0x000A
256#define IMAGE_REL_AMD64_SECREL 0x000B
257#define IMAGE_REL_AMD64_SECREL7 0x000C
258#define IMAGE_REL_AMD64_TOKEN 0x000D
259#define IMAGE_REL_AMD64_SREL32 0x000E
260#define IMAGE_REL_AMD64_PAIR 0x000F
261#define IMAGE_REL_AMD64_SSPAN32 0x0010
262
263#endif
264