Coverage Report

Created: 2026-03-26 07:41

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/rust/registry/src/index.crates.io-1949cf8c6b5b557f/object-0.37.3/src/pe.rs
Line
Count
Source
1
//! PE/COFF definitions.
2
//!
3
//! These definitions are independent of read/write support, although we do implement
4
//! some traits useful for those.
5
//!
6
//! This module is based heavily on "winnt.h" (10.0.17763.0).
7
8
#![allow(missing_docs)]
9
10
use core::convert::TryInto;
11
12
use crate::endian::{I32Bytes, LittleEndian as LE, U16Bytes, U32Bytes, I32, U16, U32, U64};
13
use crate::pod::Pod;
14
15
/// MZ
16
pub const IMAGE_DOS_SIGNATURE: u16 = 0x5A4D;
17
/// NE
18
pub const IMAGE_OS2_SIGNATURE: u16 = 0x454E;
19
/// LE
20
pub const IMAGE_OS2_SIGNATURE_LE: u16 = 0x454C;
21
/// LE
22
pub const IMAGE_VXD_SIGNATURE: u16 = 0x454C;
23
/// PE00
24
pub const IMAGE_NT_SIGNATURE: u32 = 0x0000_4550;
25
26
/// DOS .EXE header
27
#[derive(Debug, Clone, Copy)]
28
#[repr(C)]
29
pub struct ImageDosHeader {
30
    /// Magic number
31
    pub e_magic: U16<LE>,
32
    /// Bytes on last page of file
33
    pub e_cblp: U16<LE>,
34
    /// Pages in file
35
    pub e_cp: U16<LE>,
36
    /// Relocations
37
    pub e_crlc: U16<LE>,
38
    /// Size of header in paragraphs
39
    pub e_cparhdr: U16<LE>,
40
    /// Minimum extra paragraphs needed
41
    pub e_minalloc: U16<LE>,
42
    /// Maximum extra paragraphs needed
43
    pub e_maxalloc: U16<LE>,
44
    /// Initial (relative) SS value
45
    pub e_ss: U16<LE>,
46
    /// Initial SP value
47
    pub e_sp: U16<LE>,
48
    /// Checksum
49
    pub e_csum: U16<LE>,
50
    /// Initial IP value
51
    pub e_ip: U16<LE>,
52
    /// Initial (relative) CS value
53
    pub e_cs: U16<LE>,
54
    /// File address of relocation table
55
    pub e_lfarlc: U16<LE>,
56
    /// Overlay number
57
    pub e_ovno: U16<LE>,
58
    /// Reserved words
59
    pub e_res: [U16<LE>; 4],
60
    /// OEM identifier (for e_oeminfo)
61
    pub e_oemid: U16<LE>,
62
    /// OEM information; e_oemid specific
63
    pub e_oeminfo: U16<LE>,
64
    /// Reserved words
65
    pub e_res2: [U16<LE>; 10],
66
    /// File address of new exe header
67
    pub e_lfanew: U32<LE>,
68
}
69
70
/// OS/2 .EXE header
71
#[derive(Debug, Clone, Copy)]
72
#[repr(C)]
73
pub struct ImageOs2Header {
74
    /// Magic number
75
    pub ne_magic: U16<LE>,
76
    /// Version number
77
    pub ne_ver: i8,
78
    /// Revision number
79
    pub ne_rev: i8,
80
    /// Offset of Entry Table
81
    pub ne_enttab: U16<LE>,
82
    /// Number of bytes in Entry Table
83
    pub ne_cbenttab: U16<LE>,
84
    /// Checksum of whole file
85
    pub ne_crc: I32<LE>,
86
    /// Flag word
87
    pub ne_flags: U16<LE>,
88
    /// Automatic data segment number
89
    pub ne_autodata: U16<LE>,
90
    /// Initial heap allocation
91
    pub ne_heap: U16<LE>,
92
    /// Initial stack allocation
93
    pub ne_stack: U16<LE>,
94
    /// Initial CS:IP setting
95
    pub ne_csip: I32<LE>,
96
    /// Initial SS:SP setting
97
    pub ne_sssp: I32<LE>,
98
    /// Count of file segments
99
    pub ne_cseg: U16<LE>,
100
    /// Entries in Module Reference Table
101
    pub ne_cmod: U16<LE>,
102
    /// Size of non-resident name table
103
    pub ne_cbnrestab: U16<LE>,
104
    /// Offset of Segment Table
105
    pub ne_segtab: U16<LE>,
106
    /// Offset of Resource Table
107
    pub ne_rsrctab: U16<LE>,
108
    /// Offset of resident name table
109
    pub ne_restab: U16<LE>,
110
    /// Offset of Module Reference Table
111
    pub ne_modtab: U16<LE>,
112
    /// Offset of Imported Names Table
113
    pub ne_imptab: U16<LE>,
114
    /// Offset of Non-resident Names Table
115
    pub ne_nrestab: I32<LE>,
116
    /// Count of movable entries
117
    pub ne_cmovent: U16<LE>,
118
    /// Segment alignment shift count
119
    pub ne_align: U16<LE>,
120
    /// Count of resource segments
121
    pub ne_cres: U16<LE>,
122
    /// Target Operating system
123
    pub ne_exetyp: u8,
124
    /// Other .EXE flags
125
    pub ne_flagsothers: u8,
126
    /// offset to return thunks
127
    pub ne_pretthunks: U16<LE>,
128
    /// offset to segment ref. bytes
129
    pub ne_psegrefbytes: U16<LE>,
130
    /// Minimum code swap area size
131
    pub ne_swaparea: U16<LE>,
132
    /// Expected Windows version number
133
    pub ne_expver: U16<LE>,
134
}
135
136
/// Windows VXD header
137
#[derive(Debug, Clone, Copy)]
138
#[repr(C)]
139
pub struct ImageVxdHeader {
140
    /// Magic number
141
    pub e32_magic: U16<LE>,
142
    /// The byte ordering for the VXD
143
    pub e32_border: u8,
144
    /// The word ordering for the VXD
145
    pub e32_worder: u8,
146
    /// The EXE format level for now = 0
147
    pub e32_level: U32<LE>,
148
    /// The CPU type
149
    pub e32_cpu: U16<LE>,
150
    /// The OS type
151
    pub e32_os: U16<LE>,
152
    /// Module version
153
    pub e32_ver: U32<LE>,
154
    /// Module flags
155
    pub e32_mflags: U32<LE>,
156
    /// Module # pages
157
    pub e32_mpages: U32<LE>,
158
    /// Object # for instruction pointer
159
    pub e32_startobj: U32<LE>,
160
    /// Extended instruction pointer
161
    pub e32_eip: U32<LE>,
162
    /// Object # for stack pointer
163
    pub e32_stackobj: U32<LE>,
164
    /// Extended stack pointer
165
    pub e32_esp: U32<LE>,
166
    /// VXD page size
167
    pub e32_pagesize: U32<LE>,
168
    /// Last page size in VXD
169
    pub e32_lastpagesize: U32<LE>,
170
    /// Fixup section size
171
    pub e32_fixupsize: U32<LE>,
172
    /// Fixup section checksum
173
    pub e32_fixupsum: U32<LE>,
174
    /// Loader section size
175
    pub e32_ldrsize: U32<LE>,
176
    /// Loader section checksum
177
    pub e32_ldrsum: U32<LE>,
178
    /// Object table offset
179
    pub e32_objtab: U32<LE>,
180
    /// Number of objects in module
181
    pub e32_objcnt: U32<LE>,
182
    /// Object page map offset
183
    pub e32_objmap: U32<LE>,
184
    /// Object iterated data map offset
185
    pub e32_itermap: U32<LE>,
186
    /// Offset of Resource Table
187
    pub e32_rsrctab: U32<LE>,
188
    /// Number of resource entries
189
    pub e32_rsrccnt: U32<LE>,
190
    /// Offset of resident name table
191
    pub e32_restab: U32<LE>,
192
    /// Offset of Entry Table
193
    pub e32_enttab: U32<LE>,
194
    /// Offset of Module Directive Table
195
    pub e32_dirtab: U32<LE>,
196
    /// Number of module directives
197
    pub e32_dircnt: U32<LE>,
198
    /// Offset of Fixup Page Table
199
    pub e32_fpagetab: U32<LE>,
200
    /// Offset of Fixup Record Table
201
    pub e32_frectab: U32<LE>,
202
    /// Offset of Import Module Name Table
203
    pub e32_impmod: U32<LE>,
204
    /// Number of entries in Import Module Name Table
205
    pub e32_impmodcnt: U32<LE>,
206
    /// Offset of Import Procedure Name Table
207
    pub e32_impproc: U32<LE>,
208
    /// Offset of Per-Page Checksum Table
209
    pub e32_pagesum: U32<LE>,
210
    /// Offset of Enumerated Data Pages
211
    pub e32_datapage: U32<LE>,
212
    /// Number of preload pages
213
    pub e32_preload: U32<LE>,
214
    /// Offset of Non-resident Names Table
215
    pub e32_nrestab: U32<LE>,
216
    /// Size of Non-resident Name Table
217
    pub e32_cbnrestab: U32<LE>,
218
    /// Non-resident Name Table Checksum
219
    pub e32_nressum: U32<LE>,
220
    /// Object # for automatic data object
221
    pub e32_autodata: U32<LE>,
222
    /// Offset of the debugging information
223
    pub e32_debuginfo: U32<LE>,
224
    /// The length of the debugging info. in bytes
225
    pub e32_debuglen: U32<LE>,
226
    /// Number of instance pages in preload section of VXD file
227
    pub e32_instpreload: U32<LE>,
228
    /// Number of instance pages in demand load section of VXD file
229
    pub e32_instdemand: U32<LE>,
230
    /// Size of heap - for 16-bit apps
231
    pub e32_heapsize: U32<LE>,
232
    /// Reserved words
233
    pub e32_res3: [u8; 12],
234
    pub e32_winresoff: U32<LE>,
235
    pub e32_winreslen: U32<LE>,
236
    /// Device ID for VxD
237
    pub e32_devid: U16<LE>,
238
    /// DDK version for VxD
239
    pub e32_ddkver: U16<LE>,
240
}
241
242
/// A PE rich header entry.
243
///
244
/// Rich headers have no official documentation, but have been heavily
245
/// reversed-engineered and documented in the wild, e.g.:
246
/// * `http://www.ntcore.com/files/richsign.htm`
247
/// * `https://www.researchgate.net/figure/Structure-of-the-Rich-Header_fig1_318145388`
248
///
249
/// This data is "masked", i.e. XORed with a checksum derived from the file data.
250
#[derive(Debug, Clone, Copy)]
251
#[repr(C)]
252
pub struct MaskedRichHeaderEntry {
253
    pub masked_comp_id: U32<LE>,
254
    pub masked_count: U32<LE>,
255
}
256
257
//
258
// File header format.
259
//
260
261
#[derive(Debug, Clone, Copy)]
262
#[repr(C)]
263
pub struct ImageFileHeader {
264
    pub machine: U16<LE>,
265
    pub number_of_sections: U16<LE>,
266
    pub time_date_stamp: U32<LE>,
267
    pub pointer_to_symbol_table: U32<LE>,
268
    pub number_of_symbols: U32<LE>,
269
    pub size_of_optional_header: U16<LE>,
270
    pub characteristics: U16<LE>,
271
}
272
273
pub const IMAGE_SIZEOF_FILE_HEADER: usize = 20;
274
275
/// Relocation info stripped from file.
276
pub const IMAGE_FILE_RELOCS_STRIPPED: u16 = 0x0001;
277
/// File is executable  (i.e. no unresolved external references).
278
pub const IMAGE_FILE_EXECUTABLE_IMAGE: u16 = 0x0002;
279
/// Line numbers stripped from file.
280
pub const IMAGE_FILE_LINE_NUMS_STRIPPED: u16 = 0x0004;
281
/// Local symbols stripped from file.
282
pub const IMAGE_FILE_LOCAL_SYMS_STRIPPED: u16 = 0x0008;
283
/// Aggressively trim working set
284
pub const IMAGE_FILE_AGGRESIVE_WS_TRIM: u16 = 0x0010;
285
/// App can handle >2gb addresses
286
pub const IMAGE_FILE_LARGE_ADDRESS_AWARE: u16 = 0x0020;
287
/// Bytes of machine word are reversed.
288
pub const IMAGE_FILE_BYTES_REVERSED_LO: u16 = 0x0080;
289
/// 32 bit word machine.
290
pub const IMAGE_FILE_32BIT_MACHINE: u16 = 0x0100;
291
/// Debugging info stripped from file in .DBG file
292
pub const IMAGE_FILE_DEBUG_STRIPPED: u16 = 0x0200;
293
/// If Image is on removable media, copy and run from the swap file.
294
pub const IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP: u16 = 0x0400;
295
/// If Image is on Net, copy and run from the swap file.
296
pub const IMAGE_FILE_NET_RUN_FROM_SWAP: u16 = 0x0800;
297
/// System File.
298
pub const IMAGE_FILE_SYSTEM: u16 = 0x1000;
299
/// File is a DLL.
300
pub const IMAGE_FILE_DLL: u16 = 0x2000;
301
/// File should only be run on a UP machine
302
pub const IMAGE_FILE_UP_SYSTEM_ONLY: u16 = 0x4000;
303
/// Bytes of machine word are reversed.
304
pub const IMAGE_FILE_BYTES_REVERSED_HI: u16 = 0x8000;
305
306
pub const IMAGE_FILE_MACHINE_UNKNOWN: u16 = 0;
307
/// Useful for indicating we want to interact with the host and not a WoW guest.
308
pub const IMAGE_FILE_MACHINE_TARGET_HOST: u16 = 0x0001;
309
/// Intel 386.
310
pub const IMAGE_FILE_MACHINE_I386: u16 = 0x014c;
311
/// MIPS little-endian, 0x160 big-endian
312
pub const IMAGE_FILE_MACHINE_R3000: u16 = 0x0162;
313
/// MIPS little-endian
314
pub const IMAGE_FILE_MACHINE_R4000: u16 = 0x0166;
315
/// MIPS little-endian
316
pub const IMAGE_FILE_MACHINE_R10000: u16 = 0x0168;
317
/// MIPS little-endian WCE v2
318
pub const IMAGE_FILE_MACHINE_WCEMIPSV2: u16 = 0x0169;
319
/// Alpha_AXP
320
pub const IMAGE_FILE_MACHINE_ALPHA: u16 = 0x0184;
321
/// SH3 little-endian
322
pub const IMAGE_FILE_MACHINE_SH3: u16 = 0x01a2;
323
pub const IMAGE_FILE_MACHINE_SH3DSP: u16 = 0x01a3;
324
/// SH3E little-endian
325
pub const IMAGE_FILE_MACHINE_SH3E: u16 = 0x01a4;
326
/// SH4 little-endian
327
pub const IMAGE_FILE_MACHINE_SH4: u16 = 0x01a6;
328
/// SH5
329
pub const IMAGE_FILE_MACHINE_SH5: u16 = 0x01a8;
330
/// ARM Little-Endian
331
pub const IMAGE_FILE_MACHINE_ARM: u16 = 0x01c0;
332
/// ARM Thumb/Thumb-2 Little-Endian
333
pub const IMAGE_FILE_MACHINE_THUMB: u16 = 0x01c2;
334
/// ARM Thumb-2 Little-Endian
335
pub const IMAGE_FILE_MACHINE_ARMNT: u16 = 0x01c4;
336
pub const IMAGE_FILE_MACHINE_AM33: u16 = 0x01d3;
337
/// IBM PowerPC Little-Endian
338
pub const IMAGE_FILE_MACHINE_POWERPC: u16 = 0x01F0;
339
pub const IMAGE_FILE_MACHINE_POWERPCFP: u16 = 0x01f1;
340
/// IBM PowerPC Big-Endian
341
pub const IMAGE_FILE_MACHINE_POWERPCBE: u16 = 0x01f2;
342
/// Intel 64
343
pub const IMAGE_FILE_MACHINE_IA64: u16 = 0x0200;
344
/// MIPS
345
pub const IMAGE_FILE_MACHINE_MIPS16: u16 = 0x0266;
346
/// ALPHA64
347
pub const IMAGE_FILE_MACHINE_ALPHA64: u16 = 0x0284;
348
/// MIPS
349
pub const IMAGE_FILE_MACHINE_MIPSFPU: u16 = 0x0366;
350
/// MIPS
351
pub const IMAGE_FILE_MACHINE_MIPSFPU16: u16 = 0x0466;
352
pub const IMAGE_FILE_MACHINE_AXP64: u16 = IMAGE_FILE_MACHINE_ALPHA64;
353
/// Infineon
354
pub const IMAGE_FILE_MACHINE_TRICORE: u16 = 0x0520;
355
pub const IMAGE_FILE_MACHINE_CEF: u16 = 0x0CEF;
356
/// EFI Byte Code
357
pub const IMAGE_FILE_MACHINE_EBC: u16 = 0x0EBC;
358
/// AMD64 (K8)
359
pub const IMAGE_FILE_MACHINE_AMD64: u16 = 0x8664;
360
/// M32R little-endian
361
pub const IMAGE_FILE_MACHINE_M32R: u16 = 0x9041;
362
/// ARM64 Little-Endian
363
pub const IMAGE_FILE_MACHINE_ARM64: u16 = 0xAA64;
364
/// ARM64EC ("Emulation Compatible")
365
pub const IMAGE_FILE_MACHINE_ARM64EC: u16 = 0xA641;
366
pub const IMAGE_FILE_MACHINE_CEE: u16 = 0xC0EE;
367
/// RISCV32
368
pub const IMAGE_FILE_MACHINE_RISCV32: u16 = 0x5032;
369
/// RISCV64
370
pub const IMAGE_FILE_MACHINE_RISCV64: u16 = 0x5064;
371
/// RISCV128
372
pub const IMAGE_FILE_MACHINE_RISCV128: u16 = 0x5128;
373
/// ARM64X (Mixed ARM64 and ARM64EC)
374
pub const IMAGE_FILE_MACHINE_ARM64X: u16 = 0xA64E;
375
/// CHPE x86 ("Compiled Hybrid Portable Executable")
376
pub const IMAGE_FILE_MACHINE_CHPE_X86: u16 = 0x3A64;
377
378
//
379
// Directory format.
380
//
381
382
#[derive(Debug, Clone, Copy)]
383
#[repr(C)]
384
pub struct ImageDataDirectory {
385
    pub virtual_address: U32<LE>,
386
    pub size: U32<LE>,
387
}
388
389
pub const IMAGE_NUMBEROF_DIRECTORY_ENTRIES: usize = 16;
390
391
//
392
// Optional header format.
393
//
394
395
#[derive(Debug, Clone, Copy)]
396
#[repr(C)]
397
pub struct ImageOptionalHeader32 {
398
    // Standard fields.
399
    pub magic: U16<LE>,
400
    pub major_linker_version: u8,
401
    pub minor_linker_version: u8,
402
    pub size_of_code: U32<LE>,
403
    pub size_of_initialized_data: U32<LE>,
404
    pub size_of_uninitialized_data: U32<LE>,
405
    pub address_of_entry_point: U32<LE>,
406
    pub base_of_code: U32<LE>,
407
    pub base_of_data: U32<LE>,
408
409
    // NT additional fields.
410
    pub image_base: U32<LE>,
411
    pub section_alignment: U32<LE>,
412
    pub file_alignment: U32<LE>,
413
    pub major_operating_system_version: U16<LE>,
414
    pub minor_operating_system_version: U16<LE>,
415
    pub major_image_version: U16<LE>,
416
    pub minor_image_version: U16<LE>,
417
    pub major_subsystem_version: U16<LE>,
418
    pub minor_subsystem_version: U16<LE>,
419
    pub win32_version_value: U32<LE>,
420
    pub size_of_image: U32<LE>,
421
    pub size_of_headers: U32<LE>,
422
    pub check_sum: U32<LE>,
423
    pub subsystem: U16<LE>,
424
    pub dll_characteristics: U16<LE>,
425
    pub size_of_stack_reserve: U32<LE>,
426
    pub size_of_stack_commit: U32<LE>,
427
    pub size_of_heap_reserve: U32<LE>,
428
    pub size_of_heap_commit: U32<LE>,
429
    pub loader_flags: U32<LE>,
430
    pub number_of_rva_and_sizes: U32<LE>,
431
    //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
432
}
433
434
#[derive(Debug, Clone, Copy)]
435
#[repr(C)]
436
pub struct ImageRomOptionalHeader {
437
    pub magic: U16<LE>,
438
    pub major_linker_version: u8,
439
    pub minor_linker_version: u8,
440
    pub size_of_code: U32<LE>,
441
    pub size_of_initialized_data: U32<LE>,
442
    pub size_of_uninitialized_data: U32<LE>,
443
    pub address_of_entry_point: U32<LE>,
444
    pub base_of_code: U32<LE>,
445
    pub base_of_data: U32<LE>,
446
    pub base_of_bss: U32<LE>,
447
    pub gpr_mask: U32<LE>,
448
    pub cpr_mask: [U32<LE>; 4],
449
    pub gp_value: U32<LE>,
450
}
451
452
#[derive(Debug, Clone, Copy)]
453
#[repr(C)]
454
pub struct ImageOptionalHeader64 {
455
    pub magic: U16<LE>,
456
    pub major_linker_version: u8,
457
    pub minor_linker_version: u8,
458
    pub size_of_code: U32<LE>,
459
    pub size_of_initialized_data: U32<LE>,
460
    pub size_of_uninitialized_data: U32<LE>,
461
    pub address_of_entry_point: U32<LE>,
462
    pub base_of_code: U32<LE>,
463
    pub image_base: U64<LE>,
464
    pub section_alignment: U32<LE>,
465
    pub file_alignment: U32<LE>,
466
    pub major_operating_system_version: U16<LE>,
467
    pub minor_operating_system_version: U16<LE>,
468
    pub major_image_version: U16<LE>,
469
    pub minor_image_version: U16<LE>,
470
    pub major_subsystem_version: U16<LE>,
471
    pub minor_subsystem_version: U16<LE>,
472
    pub win32_version_value: U32<LE>,
473
    pub size_of_image: U32<LE>,
474
    pub size_of_headers: U32<LE>,
475
    pub check_sum: U32<LE>,
476
    pub subsystem: U16<LE>,
477
    pub dll_characteristics: U16<LE>,
478
    pub size_of_stack_reserve: U64<LE>,
479
    pub size_of_stack_commit: U64<LE>,
480
    pub size_of_heap_reserve: U64<LE>,
481
    pub size_of_heap_commit: U64<LE>,
482
    pub loader_flags: U32<LE>,
483
    pub number_of_rva_and_sizes: U32<LE>,
484
    //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
485
}
486
487
pub const IMAGE_NT_OPTIONAL_HDR32_MAGIC: u16 = 0x10b;
488
pub const IMAGE_NT_OPTIONAL_HDR64_MAGIC: u16 = 0x20b;
489
pub const IMAGE_ROM_OPTIONAL_HDR_MAGIC: u16 = 0x107;
490
491
#[derive(Debug, Clone, Copy)]
492
#[repr(C)]
493
pub struct ImageNtHeaders64 {
494
    pub signature: U32<LE>,
495
    pub file_header: ImageFileHeader,
496
    pub optional_header: ImageOptionalHeader64,
497
}
498
499
#[derive(Debug, Clone, Copy)]
500
#[repr(C)]
501
pub struct ImageNtHeaders32 {
502
    pub signature: U32<LE>,
503
    pub file_header: ImageFileHeader,
504
    pub optional_header: ImageOptionalHeader32,
505
}
506
507
#[derive(Debug, Clone, Copy)]
508
#[repr(C)]
509
pub struct ImageRomHeaders {
510
    pub file_header: ImageFileHeader,
511
    pub optional_header: ImageRomOptionalHeader,
512
}
513
514
// Values for `ImageOptionalHeader*::subsystem`.
515
516
/// Unknown subsystem.
517
pub const IMAGE_SUBSYSTEM_UNKNOWN: u16 = 0;
518
/// Image doesn't require a subsystem.
519
pub const IMAGE_SUBSYSTEM_NATIVE: u16 = 1;
520
/// Image runs in the Windows GUI subsystem.
521
pub const IMAGE_SUBSYSTEM_WINDOWS_GUI: u16 = 2;
522
/// Image runs in the Windows character subsystem.
523
pub const IMAGE_SUBSYSTEM_WINDOWS_CUI: u16 = 3;
524
/// image runs in the OS/2 character subsystem.
525
pub const IMAGE_SUBSYSTEM_OS2_CUI: u16 = 5;
526
/// image runs in the Posix character subsystem.
527
pub const IMAGE_SUBSYSTEM_POSIX_CUI: u16 = 7;
528
/// image is a native Win9x driver.
529
pub const IMAGE_SUBSYSTEM_NATIVE_WINDOWS: u16 = 8;
530
/// Image runs in the Windows CE subsystem.
531
pub const IMAGE_SUBSYSTEM_WINDOWS_CE_GUI: u16 = 9;
532
pub const IMAGE_SUBSYSTEM_EFI_APPLICATION: u16 = 10;
533
pub const IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER: u16 = 11;
534
pub const IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER: u16 = 12;
535
pub const IMAGE_SUBSYSTEM_EFI_ROM: u16 = 13;
536
pub const IMAGE_SUBSYSTEM_XBOX: u16 = 14;
537
pub const IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION: u16 = 16;
538
pub const IMAGE_SUBSYSTEM_XBOX_CODE_CATALOG: u16 = 17;
539
540
// Values for `ImageOptionalHeader*::dll_characteristics`.
541
542
//      IMAGE_LIBRARY_PROCESS_INIT            0x0001     // Reserved.
543
//      IMAGE_LIBRARY_PROCESS_TERM            0x0002     // Reserved.
544
//      IMAGE_LIBRARY_THREAD_INIT             0x0004     // Reserved.
545
//      IMAGE_LIBRARY_THREAD_TERM             0x0008     // Reserved.
546
/// Image can handle a high entropy 64-bit virtual address space.
547
pub const IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA: u16 = 0x0020;
548
/// DLL can move.
549
pub const IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE: u16 = 0x0040;
550
/// Code Integrity Image
551
pub const IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY: u16 = 0x0080;
552
/// Image is NX compatible
553
pub const IMAGE_DLLCHARACTERISTICS_NX_COMPAT: u16 = 0x0100;
554
/// Image understands isolation and doesn't want it
555
pub const IMAGE_DLLCHARACTERISTICS_NO_ISOLATION: u16 = 0x0200;
556
/// Image does not use SEH.  No SE handler may reside in this image
557
pub const IMAGE_DLLCHARACTERISTICS_NO_SEH: u16 = 0x0400;
558
/// Do not bind this image.
559
pub const IMAGE_DLLCHARACTERISTICS_NO_BIND: u16 = 0x0800;
560
/// Image should execute in an AppContainer
561
pub const IMAGE_DLLCHARACTERISTICS_APPCONTAINER: u16 = 0x1000;
562
/// Driver uses WDM model
563
pub const IMAGE_DLLCHARACTERISTICS_WDM_DRIVER: u16 = 0x2000;
564
/// Image supports Control Flow Guard.
565
pub const IMAGE_DLLCHARACTERISTICS_GUARD_CF: u16 = 0x4000;
566
pub const IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE: u16 = 0x8000;
567
568
// Indices for `ImageOptionalHeader*::data_directory`.
569
570
/// Export Directory
571
pub const IMAGE_DIRECTORY_ENTRY_EXPORT: usize = 0;
572
/// Import Directory
573
pub const IMAGE_DIRECTORY_ENTRY_IMPORT: usize = 1;
574
/// Resource Directory
575
pub const IMAGE_DIRECTORY_ENTRY_RESOURCE: usize = 2;
576
/// Exception Directory
577
pub const IMAGE_DIRECTORY_ENTRY_EXCEPTION: usize = 3;
578
/// Security Directory
579
pub const IMAGE_DIRECTORY_ENTRY_SECURITY: usize = 4;
580
/// Base Relocation Table
581
pub const IMAGE_DIRECTORY_ENTRY_BASERELOC: usize = 5;
582
/// Debug Directory
583
pub const IMAGE_DIRECTORY_ENTRY_DEBUG: usize = 6;
584
//      IMAGE_DIRECTORY_ENTRY_COPYRIGHT       7   // (X86 usage)
585
/// Architecture Specific Data
586
pub const IMAGE_DIRECTORY_ENTRY_ARCHITECTURE: usize = 7;
587
/// RVA of GP
588
pub const IMAGE_DIRECTORY_ENTRY_GLOBALPTR: usize = 8;
589
/// TLS Directory
590
pub const IMAGE_DIRECTORY_ENTRY_TLS: usize = 9;
591
/// Load Configuration Directory
592
pub const IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG: usize = 10;
593
/// Bound Import Directory in headers
594
pub const IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT: usize = 11;
595
/// Import Address Table
596
pub const IMAGE_DIRECTORY_ENTRY_IAT: usize = 12;
597
/// Delay Load Import Descriptors
598
pub const IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT: usize = 13;
599
/// COM Runtime descriptor
600
pub const IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR: usize = 14;
601
602
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
603
#[repr(C)]
604
pub struct Guid(pub [u8; 16]);
605
606
impl Guid {
607
    #[inline]
608
0
    pub fn data1(self) -> U32<LE> {
609
0
        U32::from_bytes(self.0[0..4].try_into().unwrap())
610
0
    }
611
612
    #[inline]
613
0
    pub fn data2(self) -> U16<LE> {
614
0
        U16::from_bytes(self.0[4..6].try_into().unwrap())
615
0
    }
616
617
    #[inline]
618
0
    pub fn data3(self) -> U16<LE> {
619
0
        U16::from_bytes(self.0[6..8].try_into().unwrap())
620
0
    }
621
622
    #[inline]
623
0
    pub fn data4(self) -> [u8; 8] {
624
0
        self.0[8..16].try_into().unwrap()
625
0
    }
626
}
627
628
pub use Guid as ClsId;
629
630
/// Non-COFF Object file header
631
#[derive(Debug, Clone, Copy)]
632
#[repr(C)]
633
pub struct AnonObjectHeader {
634
    /// Must be IMAGE_FILE_MACHINE_UNKNOWN
635
    pub sig1: U16<LE>,
636
    /// Must be 0xffff
637
    pub sig2: U16<LE>,
638
    /// >= 1 (implies the ClsId field is present)
639
    pub version: U16<LE>,
640
    pub machine: U16<LE>,
641
    pub time_date_stamp: U32<LE>,
642
    /// Used to invoke CoCreateInstance
643
    pub class_id: ClsId,
644
    /// Size of data that follows the header
645
    pub size_of_data: U32<LE>,
646
}
647
648
#[derive(Debug, Clone, Copy)]
649
#[repr(C)]
650
pub struct AnonObjectHeaderV2 {
651
    /// Must be IMAGE_FILE_MACHINE_UNKNOWN
652
    pub sig1: U16<LE>,
653
    /// Must be 0xffff
654
    pub sig2: U16<LE>,
655
    /// >= 2 (implies the Flags field is present - otherwise V1)
656
    pub version: U16<LE>,
657
    pub machine: U16<LE>,
658
    pub time_date_stamp: U32<LE>,
659
    /// Used to invoke CoCreateInstance
660
    pub class_id: ClsId,
661
    /// Size of data that follows the header
662
    pub size_of_data: U32<LE>,
663
    /// 0x1 -> contains metadata
664
    pub flags: U32<LE>,
665
    /// Size of CLR metadata
666
    pub meta_data_size: U32<LE>,
667
    /// Offset of CLR metadata
668
    pub meta_data_offset: U32<LE>,
669
}
670
671
/// The required value of `AnonObjectHeaderBigobj::class_id`.
672
pub const ANON_OBJECT_HEADER_BIGOBJ_CLASS_ID: ClsId = ClsId([
673
    0xC7, 0xA1, 0xBA, 0xD1, 0xEE, 0xBA, 0xA9, 0x4B, 0xAF, 0x20, 0xFA, 0xF6, 0x6A, 0xA4, 0xDC, 0xB8,
674
]);
675
676
#[derive(Debug, Clone, Copy)]
677
#[repr(C)]
678
pub struct AnonObjectHeaderBigobj {
679
    /* same as ANON_OBJECT_HEADER_V2 */
680
    /// Must be IMAGE_FILE_MACHINE_UNKNOWN
681
    pub sig1: U16<LE>,
682
    /// Must be 0xffff
683
    pub sig2: U16<LE>,
684
    /// >= 2 (implies the Flags field is present)
685
    pub version: U16<LE>,
686
    /// Actual machine - IMAGE_FILE_MACHINE_xxx
687
    pub machine: U16<LE>,
688
    pub time_date_stamp: U32<LE>,
689
    /// Must be `ANON_OBJECT_HEADER_BIGOBJ_CLASS_ID`.
690
    pub class_id: ClsId,
691
    /// Size of data that follows the header
692
    pub size_of_data: U32<LE>,
693
    /// 0x1 -> contains metadata
694
    pub flags: U32<LE>,
695
    /// Size of CLR metadata
696
    pub meta_data_size: U32<LE>,
697
    /// Offset of CLR metadata
698
    pub meta_data_offset: U32<LE>,
699
700
    /* bigobj specifics */
701
    /// extended from WORD
702
    pub number_of_sections: U32<LE>,
703
    pub pointer_to_symbol_table: U32<LE>,
704
    pub number_of_symbols: U32<LE>,
705
}
706
707
pub const IMAGE_SIZEOF_SHORT_NAME: usize = 8;
708
709
//
710
// Section header format.
711
//
712
713
#[derive(Debug, Default, Clone, Copy)]
714
#[repr(C)]
715
pub struct ImageSectionHeader {
716
    pub name: [u8; IMAGE_SIZEOF_SHORT_NAME],
717
    pub virtual_size: U32<LE>,
718
    pub virtual_address: U32<LE>,
719
    pub size_of_raw_data: U32<LE>,
720
    pub pointer_to_raw_data: U32<LE>,
721
    pub pointer_to_relocations: U32<LE>,
722
    pub pointer_to_linenumbers: U32<LE>,
723
    pub number_of_relocations: U16<LE>,
724
    pub number_of_linenumbers: U16<LE>,
725
    pub characteristics: U32<LE>,
726
}
727
728
pub const IMAGE_SIZEOF_SECTION_HEADER: usize = 40;
729
730
// Values for `ImageSectionHeader::characteristics`.
731
732
//      IMAGE_SCN_TYPE_REG                   0x00000000  // Reserved.
733
//      IMAGE_SCN_TYPE_DSECT                 0x00000001  // Reserved.
734
//      IMAGE_SCN_TYPE_NOLOAD                0x00000002  // Reserved.
735
//      IMAGE_SCN_TYPE_GROUP                 0x00000004  // Reserved.
736
/// Reserved.
737
pub const IMAGE_SCN_TYPE_NO_PAD: u32 = 0x0000_0008;
738
//      IMAGE_SCN_TYPE_COPY                  0x00000010  // Reserved.
739
740
/// Section contains code.
741
pub const IMAGE_SCN_CNT_CODE: u32 = 0x0000_0020;
742
/// Section contains initialized data.
743
pub const IMAGE_SCN_CNT_INITIALIZED_DATA: u32 = 0x0000_0040;
744
/// Section contains uninitialized data.
745
pub const IMAGE_SCN_CNT_UNINITIALIZED_DATA: u32 = 0x0000_0080;
746
747
/// Reserved.
748
pub const IMAGE_SCN_LNK_OTHER: u32 = 0x0000_0100;
749
/// Section contains comments or some other type of information.
750
pub const IMAGE_SCN_LNK_INFO: u32 = 0x0000_0200;
751
//      IMAGE_SCN_TYPE_OVER                  0x00000400  // Reserved.
752
/// Section contents will not become part of image.
753
pub const IMAGE_SCN_LNK_REMOVE: u32 = 0x0000_0800;
754
/// Section contents comdat.
755
pub const IMAGE_SCN_LNK_COMDAT: u32 = 0x0000_1000;
756
//                                           0x00002000  // Reserved.
757
//      IMAGE_SCN_MEM_PROTECTED - Obsolete   0x00004000
758
/// Reset speculative exceptions handling bits in the TLB entries for this section.
759
pub const IMAGE_SCN_NO_DEFER_SPEC_EXC: u32 = 0x0000_4000;
760
/// Section content can be accessed relative to GP
761
pub const IMAGE_SCN_GPREL: u32 = 0x0000_8000;
762
pub const IMAGE_SCN_MEM_FARDATA: u32 = 0x0000_8000;
763
//      IMAGE_SCN_MEM_SYSHEAP  - Obsolete    0x00010000
764
pub const IMAGE_SCN_MEM_PURGEABLE: u32 = 0x0002_0000;
765
pub const IMAGE_SCN_MEM_16BIT: u32 = 0x0002_0000;
766
pub const IMAGE_SCN_MEM_LOCKED: u32 = 0x0004_0000;
767
pub const IMAGE_SCN_MEM_PRELOAD: u32 = 0x0008_0000;
768
769
pub const IMAGE_SCN_ALIGN_1BYTES: u32 = 0x0010_0000;
770
pub const IMAGE_SCN_ALIGN_2BYTES: u32 = 0x0020_0000;
771
pub const IMAGE_SCN_ALIGN_4BYTES: u32 = 0x0030_0000;
772
pub const IMAGE_SCN_ALIGN_8BYTES: u32 = 0x0040_0000;
773
/// Default alignment if no others are specified.
774
pub const IMAGE_SCN_ALIGN_16BYTES: u32 = 0x0050_0000;
775
pub const IMAGE_SCN_ALIGN_32BYTES: u32 = 0x0060_0000;
776
pub const IMAGE_SCN_ALIGN_64BYTES: u32 = 0x0070_0000;
777
pub const IMAGE_SCN_ALIGN_128BYTES: u32 = 0x0080_0000;
778
pub const IMAGE_SCN_ALIGN_256BYTES: u32 = 0x0090_0000;
779
pub const IMAGE_SCN_ALIGN_512BYTES: u32 = 0x00A0_0000;
780
pub const IMAGE_SCN_ALIGN_1024BYTES: u32 = 0x00B0_0000;
781
pub const IMAGE_SCN_ALIGN_2048BYTES: u32 = 0x00C0_0000;
782
pub const IMAGE_SCN_ALIGN_4096BYTES: u32 = 0x00D0_0000;
783
pub const IMAGE_SCN_ALIGN_8192BYTES: u32 = 0x00E0_0000;
784
// Unused                                    0x00F0_0000
785
pub const IMAGE_SCN_ALIGN_MASK: u32 = 0x00F0_0000;
786
787
/// Section contains extended relocations.
788
pub const IMAGE_SCN_LNK_NRELOC_OVFL: u32 = 0x0100_0000;
789
/// Section can be discarded.
790
pub const IMAGE_SCN_MEM_DISCARDABLE: u32 = 0x0200_0000;
791
/// Section is not cacheable.
792
pub const IMAGE_SCN_MEM_NOT_CACHED: u32 = 0x0400_0000;
793
/// Section is not pageable.
794
pub const IMAGE_SCN_MEM_NOT_PAGED: u32 = 0x0800_0000;
795
/// Section is shareable.
796
pub const IMAGE_SCN_MEM_SHARED: u32 = 0x1000_0000;
797
/// Section is executable.
798
pub const IMAGE_SCN_MEM_EXECUTE: u32 = 0x2000_0000;
799
/// Section is readable.
800
pub const IMAGE_SCN_MEM_READ: u32 = 0x4000_0000;
801
/// Section is writeable.
802
pub const IMAGE_SCN_MEM_WRITE: u32 = 0x8000_0000;
803
804
//
805
// TLS Characteristic Flags
806
//
807
/// Tls index is scaled
808
pub const IMAGE_SCN_SCALE_INDEX: u32 = 0x0000_0001;
809
810
//
811
// Symbol format.
812
//
813
814
// This struct has alignment 1.
815
#[derive(Debug, Clone, Copy)]
816
#[repr(C)]
817
pub struct ImageSymbol {
818
    /// If first 4 bytes are 0, then second 4 bytes are offset into string table.
819
    pub name: [u8; 8],
820
    pub value: U32Bytes<LE>,
821
    pub section_number: U16Bytes<LE>,
822
    pub typ: U16Bytes<LE>,
823
    pub storage_class: u8,
824
    pub number_of_aux_symbols: u8,
825
}
826
827
pub const IMAGE_SIZEOF_SYMBOL: usize = 18;
828
829
#[derive(Debug, Clone, Copy)]
830
#[repr(C)]
831
pub struct ImageSymbolBytes(pub [u8; IMAGE_SIZEOF_SYMBOL]);
832
833
// This struct has alignment 1.
834
#[derive(Debug, Clone, Copy)]
835
#[repr(C)]
836
pub struct ImageSymbolEx {
837
    /// If first 4 bytes are 0, then second 4 bytes are offset into string table.
838
    pub name: [u8; 8],
839
    pub value: U32Bytes<LE>,
840
    pub section_number: I32Bytes<LE>,
841
    pub typ: U16Bytes<LE>,
842
    pub storage_class: u8,
843
    pub number_of_aux_symbols: u8,
844
}
845
846
pub const IMAGE_SIZEOF_SYMBOL_EX: usize = 20;
847
848
#[derive(Debug, Clone, Copy)]
849
#[repr(C)]
850
pub struct ImageSymbolExBytes(pub [u8; IMAGE_SIZEOF_SYMBOL_EX]);
851
852
// Values for `ImageSymbol::section_number`.
853
//
854
// Symbols have a section number of the section in which they are
855
// defined. Otherwise, section numbers have the following meanings:
856
857
/// Symbol is undefined or is common.
858
pub const IMAGE_SYM_UNDEFINED: i32 = 0;
859
/// Symbol is an absolute value.
860
pub const IMAGE_SYM_ABSOLUTE: i32 = -1;
861
/// Symbol is a special debug item.
862
pub const IMAGE_SYM_DEBUG: i32 = -2;
863
/// Values 0xFF00-0xFFFF are special
864
pub const IMAGE_SYM_SECTION_MAX: u16 = 0xFEFF;
865
pub const IMAGE_SYM_SECTION_MAX_EX: u32 = 0x7fff_ffff;
866
867
// Values for `ImageSymbol::typ` (basic component).
868
869
/// no type.
870
pub const IMAGE_SYM_TYPE_NULL: u16 = 0x0000;
871
pub const IMAGE_SYM_TYPE_VOID: u16 = 0x0001;
872
/// type character.
873
pub const IMAGE_SYM_TYPE_CHAR: u16 = 0x0002;
874
/// type short integer.
875
pub const IMAGE_SYM_TYPE_SHORT: u16 = 0x0003;
876
pub const IMAGE_SYM_TYPE_INT: u16 = 0x0004;
877
pub const IMAGE_SYM_TYPE_LONG: u16 = 0x0005;
878
pub const IMAGE_SYM_TYPE_FLOAT: u16 = 0x0006;
879
pub const IMAGE_SYM_TYPE_DOUBLE: u16 = 0x0007;
880
pub const IMAGE_SYM_TYPE_STRUCT: u16 = 0x0008;
881
pub const IMAGE_SYM_TYPE_UNION: u16 = 0x0009;
882
/// enumeration.
883
pub const IMAGE_SYM_TYPE_ENUM: u16 = 0x000A;
884
/// member of enumeration.
885
pub const IMAGE_SYM_TYPE_MOE: u16 = 0x000B;
886
pub const IMAGE_SYM_TYPE_BYTE: u16 = 0x000C;
887
pub const IMAGE_SYM_TYPE_WORD: u16 = 0x000D;
888
pub const IMAGE_SYM_TYPE_UINT: u16 = 0x000E;
889
pub const IMAGE_SYM_TYPE_DWORD: u16 = 0x000F;
890
pub const IMAGE_SYM_TYPE_PCODE: u16 = 0x8000;
891
892
// Values for `ImageSymbol::typ` (derived component).
893
894
/// no derived type.
895
pub const IMAGE_SYM_DTYPE_NULL: u16 = 0;
896
/// pointer.
897
pub const IMAGE_SYM_DTYPE_POINTER: u16 = 1;
898
/// function.
899
pub const IMAGE_SYM_DTYPE_FUNCTION: u16 = 2;
900
/// array.
901
pub const IMAGE_SYM_DTYPE_ARRAY: u16 = 3;
902
903
// Values for `ImageSymbol::storage_class`.
904
pub const IMAGE_SYM_CLASS_END_OF_FUNCTION: u8 = 0xff;
905
pub const IMAGE_SYM_CLASS_NULL: u8 = 0x00;
906
pub const IMAGE_SYM_CLASS_AUTOMATIC: u8 = 0x01;
907
pub const IMAGE_SYM_CLASS_EXTERNAL: u8 = 0x02;
908
pub const IMAGE_SYM_CLASS_STATIC: u8 = 0x03;
909
pub const IMAGE_SYM_CLASS_REGISTER: u8 = 0x04;
910
pub const IMAGE_SYM_CLASS_EXTERNAL_DEF: u8 = 0x05;
911
pub const IMAGE_SYM_CLASS_LABEL: u8 = 0x06;
912
pub const IMAGE_SYM_CLASS_UNDEFINED_LABEL: u8 = 0x07;
913
pub const IMAGE_SYM_CLASS_MEMBER_OF_STRUCT: u8 = 0x08;
914
pub const IMAGE_SYM_CLASS_ARGUMENT: u8 = 0x09;
915
pub const IMAGE_SYM_CLASS_STRUCT_TAG: u8 = 0x0A;
916
pub const IMAGE_SYM_CLASS_MEMBER_OF_UNION: u8 = 0x0B;
917
pub const IMAGE_SYM_CLASS_UNION_TAG: u8 = 0x0C;
918
pub const IMAGE_SYM_CLASS_TYPE_DEFINITION: u8 = 0x0D;
919
pub const IMAGE_SYM_CLASS_UNDEFINED_STATIC: u8 = 0x0E;
920
pub const IMAGE_SYM_CLASS_ENUM_TAG: u8 = 0x0F;
921
pub const IMAGE_SYM_CLASS_MEMBER_OF_ENUM: u8 = 0x10;
922
pub const IMAGE_SYM_CLASS_REGISTER_PARAM: u8 = 0x11;
923
pub const IMAGE_SYM_CLASS_BIT_FIELD: u8 = 0x12;
924
925
pub const IMAGE_SYM_CLASS_FAR_EXTERNAL: u8 = 0x44;
926
927
pub const IMAGE_SYM_CLASS_BLOCK: u8 = 0x64;
928
pub const IMAGE_SYM_CLASS_FUNCTION: u8 = 0x65;
929
pub const IMAGE_SYM_CLASS_END_OF_STRUCT: u8 = 0x66;
930
pub const IMAGE_SYM_CLASS_FILE: u8 = 0x67;
931
// new
932
pub const IMAGE_SYM_CLASS_SECTION: u8 = 0x68;
933
pub const IMAGE_SYM_CLASS_WEAK_EXTERNAL: u8 = 0x69;
934
935
pub const IMAGE_SYM_CLASS_CLR_TOKEN: u8 = 0x6B;
936
937
// type packing constants
938
939
pub const N_BTMASK: u16 = 0x000F;
940
pub const N_TMASK: u16 = 0x0030;
941
pub const N_TMASK1: u16 = 0x00C0;
942
pub const N_TMASK2: u16 = 0x00F0;
943
pub const N_BTSHFT: usize = 4;
944
pub const N_TSHIFT: usize = 2;
945
946
pub const IMAGE_SYM_DTYPE_SHIFT: usize = N_BTSHFT;
947
948
//
949
// Auxiliary entry format.
950
//
951
952
// Used for both ImageSymbol and ImageSymbolEx (with padding).
953
// This struct has alignment 1.
954
#[derive(Debug, Clone, Copy)]
955
#[repr(C)]
956
pub struct ImageAuxSymbolTokenDef {
957
    /// IMAGE_AUX_SYMBOL_TYPE
958
    pub aux_type: u8,
959
    /// Must be 0
960
    pub reserved1: u8,
961
    pub symbol_table_index: U32Bytes<LE>,
962
    /// Must be 0
963
    pub reserved2: [u8; 12],
964
}
965
966
pub const IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF: u16 = 1;
967
968
/// Auxiliary symbol format 1: function definitions.
969
// This struct has alignment 1.
970
#[derive(Debug, Clone, Copy)]
971
#[repr(C)]
972
pub struct ImageAuxSymbolFunction {
973
    pub tag_index: U32Bytes<LE>,
974
    pub total_size: U32Bytes<LE>,
975
    pub pointer_to_linenumber: U32Bytes<LE>,
976
    pub pointer_to_next_function: U32Bytes<LE>,
977
    pub unused: [u8; 2],
978
}
979
980
/// Auxiliary symbol format 2: .bf and .ef symbols.
981
// This struct has alignment 1.
982
#[derive(Debug, Clone, Copy)]
983
#[repr(C)]
984
pub struct ImageAuxSymbolFunctionBeginEnd {
985
    pub unused1: [u8; 4],
986
    /// declaration line number
987
    pub linenumber: U16Bytes<LE>,
988
    pub unused2: [u8; 6],
989
    pub pointer_to_next_function: U32Bytes<LE>,
990
    pub unused3: [u8; 2],
991
}
992
993
/// Auxiliary symbol format 3: weak externals.
994
///
995
/// Used for both `ImageSymbol` and `ImageSymbolEx` (both with padding).
996
// This struct has alignment 1.
997
#[derive(Debug, Clone, Copy)]
998
#[repr(C)]
999
pub struct ImageAuxSymbolWeak {
1000
    /// the weak extern default symbol index
1001
    pub weak_default_sym_index: U32Bytes<LE>,
1002
    pub weak_search_type: U32Bytes<LE>,
1003
}
1004
1005
/// Auxiliary symbol format 5: sections.
1006
///
1007
/// Used for both `ImageSymbol` and `ImageSymbolEx` (with padding).
1008
// This struct has alignment 1.
1009
#[derive(Debug, Clone, Copy)]
1010
#[repr(C)]
1011
pub struct ImageAuxSymbolSection {
1012
    /// section length
1013
    pub length: U32Bytes<LE>,
1014
    /// number of relocation entries
1015
    pub number_of_relocations: U16Bytes<LE>,
1016
    /// number of line numbers
1017
    pub number_of_linenumbers: U16Bytes<LE>,
1018
    /// checksum for communal
1019
    pub check_sum: U32Bytes<LE>,
1020
    /// section number to associate with
1021
    pub number: U16Bytes<LE>,
1022
    /// communal selection type
1023
    pub selection: u8,
1024
    pub reserved: u8,
1025
    /// high bits of the section number
1026
    pub high_number: U16Bytes<LE>,
1027
}
1028
1029
// Used for both ImageSymbol and ImageSymbolEx (both with padding).
1030
// This struct has alignment 1.
1031
#[derive(Debug, Clone, Copy)]
1032
#[repr(C)]
1033
pub struct ImageAuxSymbolCrc {
1034
    pub crc: U32Bytes<LE>,
1035
}
1036
1037
//
1038
// Communal selection types.
1039
//
1040
1041
pub const IMAGE_COMDAT_SELECT_NODUPLICATES: u8 = 1;
1042
pub const IMAGE_COMDAT_SELECT_ANY: u8 = 2;
1043
pub const IMAGE_COMDAT_SELECT_SAME_SIZE: u8 = 3;
1044
pub const IMAGE_COMDAT_SELECT_EXACT_MATCH: u8 = 4;
1045
pub const IMAGE_COMDAT_SELECT_ASSOCIATIVE: u8 = 5;
1046
pub const IMAGE_COMDAT_SELECT_LARGEST: u8 = 6;
1047
pub const IMAGE_COMDAT_SELECT_NEWEST: u8 = 7;
1048
1049
pub const IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY: u32 = 1;
1050
pub const IMAGE_WEAK_EXTERN_SEARCH_LIBRARY: u32 = 2;
1051
pub const IMAGE_WEAK_EXTERN_SEARCH_ALIAS: u32 = 3;
1052
pub const IMAGE_WEAK_EXTERN_ANTI_DEPENDENCY: u32 = 4;
1053
1054
//
1055
// Relocation format.
1056
//
1057
1058
// This struct has alignment 1.
1059
#[derive(Debug, Clone, Copy)]
1060
#[repr(C)]
1061
pub struct ImageRelocation {
1062
    /// Also `RelocCount` when IMAGE_SCN_LNK_NRELOC_OVFL is set
1063
    pub virtual_address: U32Bytes<LE>,
1064
    pub symbol_table_index: U32Bytes<LE>,
1065
    pub typ: U16Bytes<LE>,
1066
}
1067
1068
//
1069
// I386 relocation types.
1070
//
1071
/// Reference is absolute, no relocation is necessary
1072
pub const IMAGE_REL_I386_ABSOLUTE: u16 = 0x0000;
1073
/// Direct 16-bit reference to the symbols virtual address
1074
pub const IMAGE_REL_I386_DIR16: u16 = 0x0001;
1075
/// PC-relative 16-bit reference to the symbols virtual address
1076
pub const IMAGE_REL_I386_REL16: u16 = 0x0002;
1077
/// Direct 32-bit reference to the symbols virtual address
1078
pub const IMAGE_REL_I386_DIR32: u16 = 0x0006;
1079
/// Direct 32-bit reference to the symbols virtual address, base not included
1080
pub const IMAGE_REL_I386_DIR32NB: u16 = 0x0007;
1081
/// Direct 16-bit reference to the segment-selector bits of a 32-bit virtual address
1082
pub const IMAGE_REL_I386_SEG12: u16 = 0x0009;
1083
pub const IMAGE_REL_I386_SECTION: u16 = 0x000A;
1084
pub const IMAGE_REL_I386_SECREL: u16 = 0x000B;
1085
/// clr token
1086
pub const IMAGE_REL_I386_TOKEN: u16 = 0x000C;
1087
/// 7 bit offset from base of section containing target
1088
pub const IMAGE_REL_I386_SECREL7: u16 = 0x000D;
1089
/// PC-relative 32-bit reference to the symbols virtual address
1090
pub const IMAGE_REL_I386_REL32: u16 = 0x0014;
1091
1092
//
1093
// MIPS relocation types.
1094
//
1095
/// Reference is absolute, no relocation is necessary
1096
pub const IMAGE_REL_MIPS_ABSOLUTE: u16 = 0x0000;
1097
pub const IMAGE_REL_MIPS_REFHALF: u16 = 0x0001;
1098
pub const IMAGE_REL_MIPS_REFWORD: u16 = 0x0002;
1099
pub const IMAGE_REL_MIPS_JMPADDR: u16 = 0x0003;
1100
pub const IMAGE_REL_MIPS_REFHI: u16 = 0x0004;
1101
pub const IMAGE_REL_MIPS_REFLO: u16 = 0x0005;
1102
pub const IMAGE_REL_MIPS_GPREL: u16 = 0x0006;
1103
pub const IMAGE_REL_MIPS_LITERAL: u16 = 0x0007;
1104
pub const IMAGE_REL_MIPS_SECTION: u16 = 0x000A;
1105
pub const IMAGE_REL_MIPS_SECREL: u16 = 0x000B;
1106
/// Low 16-bit section relative reference (used for >32k TLS)
1107
pub const IMAGE_REL_MIPS_SECRELLO: u16 = 0x000C;
1108
/// High 16-bit section relative reference (used for >32k TLS)
1109
pub const IMAGE_REL_MIPS_SECRELHI: u16 = 0x000D;
1110
/// clr token
1111
pub const IMAGE_REL_MIPS_TOKEN: u16 = 0x000E;
1112
pub const IMAGE_REL_MIPS_JMPADDR16: u16 = 0x0010;
1113
pub const IMAGE_REL_MIPS_REFWORDNB: u16 = 0x0022;
1114
pub const IMAGE_REL_MIPS_PAIR: u16 = 0x0025;
1115
1116
//
1117
// Alpha Relocation types.
1118
//
1119
pub const IMAGE_REL_ALPHA_ABSOLUTE: u16 = 0x0000;
1120
pub const IMAGE_REL_ALPHA_REFLONG: u16 = 0x0001;
1121
pub const IMAGE_REL_ALPHA_REFQUAD: u16 = 0x0002;
1122
pub const IMAGE_REL_ALPHA_GPREL32: u16 = 0x0003;
1123
pub const IMAGE_REL_ALPHA_LITERAL: u16 = 0x0004;
1124
pub const IMAGE_REL_ALPHA_LITUSE: u16 = 0x0005;
1125
pub const IMAGE_REL_ALPHA_GPDISP: u16 = 0x0006;
1126
pub const IMAGE_REL_ALPHA_BRADDR: u16 = 0x0007;
1127
pub const IMAGE_REL_ALPHA_HINT: u16 = 0x0008;
1128
pub const IMAGE_REL_ALPHA_INLINE_REFLONG: u16 = 0x0009;
1129
pub const IMAGE_REL_ALPHA_REFHI: u16 = 0x000A;
1130
pub const IMAGE_REL_ALPHA_REFLO: u16 = 0x000B;
1131
pub const IMAGE_REL_ALPHA_PAIR: u16 = 0x000C;
1132
pub const IMAGE_REL_ALPHA_MATCH: u16 = 0x000D;
1133
pub const IMAGE_REL_ALPHA_SECTION: u16 = 0x000E;
1134
pub const IMAGE_REL_ALPHA_SECREL: u16 = 0x000F;
1135
pub const IMAGE_REL_ALPHA_REFLONGNB: u16 = 0x0010;
1136
/// Low 16-bit section relative reference
1137
pub const IMAGE_REL_ALPHA_SECRELLO: u16 = 0x0011;
1138
/// High 16-bit section relative reference
1139
pub const IMAGE_REL_ALPHA_SECRELHI: u16 = 0x0012;
1140
/// High 16 bits of 48 bit reference
1141
pub const IMAGE_REL_ALPHA_REFQ3: u16 = 0x0013;
1142
/// Middle 16 bits of 48 bit reference
1143
pub const IMAGE_REL_ALPHA_REFQ2: u16 = 0x0014;
1144
/// Low 16 bits of 48 bit reference
1145
pub const IMAGE_REL_ALPHA_REFQ1: u16 = 0x0015;
1146
/// Low 16-bit GP relative reference
1147
pub const IMAGE_REL_ALPHA_GPRELLO: u16 = 0x0016;
1148
/// High 16-bit GP relative reference
1149
pub const IMAGE_REL_ALPHA_GPRELHI: u16 = 0x0017;
1150
1151
//
1152
// IBM PowerPC relocation types.
1153
//
1154
/// NOP
1155
pub const IMAGE_REL_PPC_ABSOLUTE: u16 = 0x0000;
1156
/// 64-bit address
1157
pub const IMAGE_REL_PPC_ADDR64: u16 = 0x0001;
1158
/// 32-bit address
1159
pub const IMAGE_REL_PPC_ADDR32: u16 = 0x0002;
1160
/// 26-bit address, shifted left 2 (branch absolute)
1161
pub const IMAGE_REL_PPC_ADDR24: u16 = 0x0003;
1162
/// 16-bit address
1163
pub const IMAGE_REL_PPC_ADDR16: u16 = 0x0004;
1164
/// 16-bit address, shifted left 2 (load doubleword)
1165
pub const IMAGE_REL_PPC_ADDR14: u16 = 0x0005;
1166
/// 26-bit PC-relative offset, shifted left 2 (branch relative)
1167
pub const IMAGE_REL_PPC_REL24: u16 = 0x0006;
1168
/// 16-bit PC-relative offset, shifted left 2 (br cond relative)
1169
pub const IMAGE_REL_PPC_REL14: u16 = 0x0007;
1170
/// 16-bit offset from TOC base
1171
pub const IMAGE_REL_PPC_TOCREL16: u16 = 0x0008;
1172
/// 16-bit offset from TOC base, shifted left 2 (load doubleword)
1173
pub const IMAGE_REL_PPC_TOCREL14: u16 = 0x0009;
1174
1175
/// 32-bit addr w/o image base
1176
pub const IMAGE_REL_PPC_ADDR32NB: u16 = 0x000A;
1177
/// va of containing section (as in an image sectionhdr)
1178
pub const IMAGE_REL_PPC_SECREL: u16 = 0x000B;
1179
/// sectionheader number
1180
pub const IMAGE_REL_PPC_SECTION: u16 = 0x000C;
1181
/// substitute TOC restore instruction iff symbol is glue code
1182
pub const IMAGE_REL_PPC_IFGLUE: u16 = 0x000D;
1183
/// symbol is glue code; virtual address is TOC restore instruction
1184
pub const IMAGE_REL_PPC_IMGLUE: u16 = 0x000E;
1185
/// va of containing section (limited to 16 bits)
1186
pub const IMAGE_REL_PPC_SECREL16: u16 = 0x000F;
1187
pub const IMAGE_REL_PPC_REFHI: u16 = 0x0010;
1188
pub const IMAGE_REL_PPC_REFLO: u16 = 0x0011;
1189
pub const IMAGE_REL_PPC_PAIR: u16 = 0x0012;
1190
/// Low 16-bit section relative reference (used for >32k TLS)
1191
pub const IMAGE_REL_PPC_SECRELLO: u16 = 0x0013;
1192
/// High 16-bit section relative reference (used for >32k TLS)
1193
pub const IMAGE_REL_PPC_SECRELHI: u16 = 0x0014;
1194
pub const IMAGE_REL_PPC_GPREL: u16 = 0x0015;
1195
/// clr token
1196
pub const IMAGE_REL_PPC_TOKEN: u16 = 0x0016;
1197
1198
/// mask to isolate above values in IMAGE_RELOCATION.Type
1199
pub const IMAGE_REL_PPC_TYPEMASK: u16 = 0x00FF;
1200
1201
// Flag bits in `ImageRelocation::typ`.
1202
1203
/// subtract reloc value rather than adding it
1204
pub const IMAGE_REL_PPC_NEG: u16 = 0x0100;
1205
/// fix branch prediction bit to predict branch taken
1206
pub const IMAGE_REL_PPC_BRTAKEN: u16 = 0x0200;
1207
/// fix branch prediction bit to predict branch not taken
1208
pub const IMAGE_REL_PPC_BRNTAKEN: u16 = 0x0400;
1209
/// toc slot defined in file (or, data in toc)
1210
pub const IMAGE_REL_PPC_TOCDEFN: u16 = 0x0800;
1211
1212
//
1213
// Hitachi SH3 relocation types.
1214
//
1215
/// No relocation
1216
pub const IMAGE_REL_SH3_ABSOLUTE: u16 = 0x0000;
1217
/// 16 bit direct
1218
pub const IMAGE_REL_SH3_DIRECT16: u16 = 0x0001;
1219
/// 32 bit direct
1220
pub const IMAGE_REL_SH3_DIRECT32: u16 = 0x0002;
1221
/// 8 bit direct, -128..255
1222
pub const IMAGE_REL_SH3_DIRECT8: u16 = 0x0003;
1223
/// 8 bit direct .W (0 ext.)
1224
pub const IMAGE_REL_SH3_DIRECT8_WORD: u16 = 0x0004;
1225
/// 8 bit direct .L (0 ext.)
1226
pub const IMAGE_REL_SH3_DIRECT8_LONG: u16 = 0x0005;
1227
/// 4 bit direct (0 ext.)
1228
pub const IMAGE_REL_SH3_DIRECT4: u16 = 0x0006;
1229
/// 4 bit direct .W (0 ext.)
1230
pub const IMAGE_REL_SH3_DIRECT4_WORD: u16 = 0x0007;
1231
/// 4 bit direct .L (0 ext.)
1232
pub const IMAGE_REL_SH3_DIRECT4_LONG: u16 = 0x0008;
1233
/// 8 bit PC relative .W
1234
pub const IMAGE_REL_SH3_PCREL8_WORD: u16 = 0x0009;
1235
/// 8 bit PC relative .L
1236
pub const IMAGE_REL_SH3_PCREL8_LONG: u16 = 0x000A;
1237
/// 12 LSB PC relative .W
1238
pub const IMAGE_REL_SH3_PCREL12_WORD: u16 = 0x000B;
1239
/// Start of EXE section
1240
pub const IMAGE_REL_SH3_STARTOF_SECTION: u16 = 0x000C;
1241
/// Size of EXE section
1242
pub const IMAGE_REL_SH3_SIZEOF_SECTION: u16 = 0x000D;
1243
/// Section table index
1244
pub const IMAGE_REL_SH3_SECTION: u16 = 0x000E;
1245
/// Offset within section
1246
pub const IMAGE_REL_SH3_SECREL: u16 = 0x000F;
1247
/// 32 bit direct not based
1248
pub const IMAGE_REL_SH3_DIRECT32_NB: u16 = 0x0010;
1249
/// GP-relative addressing
1250
pub const IMAGE_REL_SH3_GPREL4_LONG: u16 = 0x0011;
1251
/// clr token
1252
pub const IMAGE_REL_SH3_TOKEN: u16 = 0x0012;
1253
/// Offset from current instruction in longwords
1254
/// if not NOMODE, insert the inverse of the low bit at bit 32 to select PTA/PTB
1255
pub const IMAGE_REL_SHM_PCRELPT: u16 = 0x0013;
1256
/// Low bits of 32-bit address
1257
pub const IMAGE_REL_SHM_REFLO: u16 = 0x0014;
1258
/// High bits of 32-bit address
1259
pub const IMAGE_REL_SHM_REFHALF: u16 = 0x0015;
1260
/// Low bits of relative reference
1261
pub const IMAGE_REL_SHM_RELLO: u16 = 0x0016;
1262
/// High bits of relative reference
1263
pub const IMAGE_REL_SHM_RELHALF: u16 = 0x0017;
1264
/// offset operand for relocation
1265
pub const IMAGE_REL_SHM_PAIR: u16 = 0x0018;
1266
1267
/// relocation ignores section mode
1268
pub const IMAGE_REL_SH_NOMODE: u16 = 0x8000;
1269
1270
/// No relocation required
1271
pub const IMAGE_REL_ARM_ABSOLUTE: u16 = 0x0000;
1272
/// 32 bit address
1273
pub const IMAGE_REL_ARM_ADDR32: u16 = 0x0001;
1274
/// 32 bit address w/o image base
1275
pub const IMAGE_REL_ARM_ADDR32NB: u16 = 0x0002;
1276
/// 24 bit offset << 2 & sign ext.
1277
pub const IMAGE_REL_ARM_BRANCH24: u16 = 0x0003;
1278
/// Thumb: 2 11 bit offsets
1279
pub const IMAGE_REL_ARM_BRANCH11: u16 = 0x0004;
1280
/// clr token
1281
pub const IMAGE_REL_ARM_TOKEN: u16 = 0x0005;
1282
/// GP-relative addressing (ARM)
1283
pub const IMAGE_REL_ARM_GPREL12: u16 = 0x0006;
1284
/// GP-relative addressing (Thumb)
1285
pub const IMAGE_REL_ARM_GPREL7: u16 = 0x0007;
1286
pub const IMAGE_REL_ARM_BLX24: u16 = 0x0008;
1287
pub const IMAGE_REL_ARM_BLX11: u16 = 0x0009;
1288
/// 32-bit relative address from byte following reloc
1289
pub const IMAGE_REL_ARM_REL32: u16 = 0x000A;
1290
/// Section table index
1291
pub const IMAGE_REL_ARM_SECTION: u16 = 0x000E;
1292
/// Offset within section
1293
pub const IMAGE_REL_ARM_SECREL: u16 = 0x000F;
1294
/// ARM: MOVW/MOVT
1295
pub const IMAGE_REL_ARM_MOV32A: u16 = 0x0010;
1296
/// ARM: MOVW/MOVT (deprecated)
1297
pub const IMAGE_REL_ARM_MOV32: u16 = 0x0010;
1298
/// Thumb: MOVW/MOVT
1299
pub const IMAGE_REL_ARM_MOV32T: u16 = 0x0011;
1300
/// Thumb: MOVW/MOVT (deprecated)
1301
pub const IMAGE_REL_THUMB_MOV32: u16 = 0x0011;
1302
/// Thumb: 32-bit conditional B
1303
pub const IMAGE_REL_ARM_BRANCH20T: u16 = 0x0012;
1304
/// Thumb: 32-bit conditional B (deprecated)
1305
pub const IMAGE_REL_THUMB_BRANCH20: u16 = 0x0012;
1306
/// Thumb: 32-bit B or BL
1307
pub const IMAGE_REL_ARM_BRANCH24T: u16 = 0x0014;
1308
/// Thumb: 32-bit B or BL (deprecated)
1309
pub const IMAGE_REL_THUMB_BRANCH24: u16 = 0x0014;
1310
/// Thumb: BLX immediate
1311
pub const IMAGE_REL_ARM_BLX23T: u16 = 0x0015;
1312
/// Thumb: BLX immediate (deprecated)
1313
pub const IMAGE_REL_THUMB_BLX23: u16 = 0x0015;
1314
1315
pub const IMAGE_REL_AM_ABSOLUTE: u16 = 0x0000;
1316
pub const IMAGE_REL_AM_ADDR32: u16 = 0x0001;
1317
pub const IMAGE_REL_AM_ADDR32NB: u16 = 0x0002;
1318
pub const IMAGE_REL_AM_CALL32: u16 = 0x0003;
1319
pub const IMAGE_REL_AM_FUNCINFO: u16 = 0x0004;
1320
pub const IMAGE_REL_AM_REL32_1: u16 = 0x0005;
1321
pub const IMAGE_REL_AM_REL32_2: u16 = 0x0006;
1322
pub const IMAGE_REL_AM_SECREL: u16 = 0x0007;
1323
pub const IMAGE_REL_AM_SECTION: u16 = 0x0008;
1324
pub const IMAGE_REL_AM_TOKEN: u16 = 0x0009;
1325
1326
//
1327
// ARM64 relocations types.
1328
//
1329
1330
/// No relocation required
1331
pub const IMAGE_REL_ARM64_ABSOLUTE: u16 = 0x0000;
1332
/// 32 bit address. Review! do we need it?
1333
pub const IMAGE_REL_ARM64_ADDR32: u16 = 0x0001;
1334
/// 32 bit address w/o image base (RVA: for Data/PData/XData)
1335
pub const IMAGE_REL_ARM64_ADDR32NB: u16 = 0x0002;
1336
/// 26 bit offset << 2 & sign ext. for B & BL
1337
pub const IMAGE_REL_ARM64_BRANCH26: u16 = 0x0003;
1338
/// ADRP
1339
pub const IMAGE_REL_ARM64_PAGEBASE_REL21: u16 = 0x0004;
1340
/// ADR
1341
pub const IMAGE_REL_ARM64_REL21: u16 = 0x0005;
1342
/// ADD/ADDS (immediate) with zero shift, for page offset
1343
pub const IMAGE_REL_ARM64_PAGEOFFSET_12A: u16 = 0x0006;
1344
/// LDR (indexed, unsigned immediate), for page offset
1345
pub const IMAGE_REL_ARM64_PAGEOFFSET_12L: u16 = 0x0007;
1346
/// Offset within section
1347
pub const IMAGE_REL_ARM64_SECREL: u16 = 0x0008;
1348
/// ADD/ADDS (immediate) with zero shift, for bit 0:11 of section offset
1349
pub const IMAGE_REL_ARM64_SECREL_LOW12A: u16 = 0x0009;
1350
/// ADD/ADDS (immediate) with zero shift, for bit 12:23 of section offset
1351
pub const IMAGE_REL_ARM64_SECREL_HIGH12A: u16 = 0x000A;
1352
/// LDR (indexed, unsigned immediate), for bit 0:11 of section offset
1353
pub const IMAGE_REL_ARM64_SECREL_LOW12L: u16 = 0x000B;
1354
pub const IMAGE_REL_ARM64_TOKEN: u16 = 0x000C;
1355
/// Section table index
1356
pub const IMAGE_REL_ARM64_SECTION: u16 = 0x000D;
1357
/// 64 bit address
1358
pub const IMAGE_REL_ARM64_ADDR64: u16 = 0x000E;
1359
/// 19 bit offset << 2 & sign ext. for conditional B
1360
pub const IMAGE_REL_ARM64_BRANCH19: u16 = 0x000F;
1361
/// TBZ/TBNZ
1362
pub const IMAGE_REL_ARM64_BRANCH14: u16 = 0x0010;
1363
/// 32-bit relative address from byte following reloc
1364
pub const IMAGE_REL_ARM64_REL32: u16 = 0x0011;
1365
1366
//
1367
// x64 relocations
1368
//
1369
/// Reference is absolute, no relocation is necessary
1370
pub const IMAGE_REL_AMD64_ABSOLUTE: u16 = 0x0000;
1371
/// 64-bit address (VA).
1372
pub const IMAGE_REL_AMD64_ADDR64: u16 = 0x0001;
1373
/// 32-bit address (VA).
1374
pub const IMAGE_REL_AMD64_ADDR32: u16 = 0x0002;
1375
/// 32-bit address w/o image base (RVA).
1376
pub const IMAGE_REL_AMD64_ADDR32NB: u16 = 0x0003;
1377
/// 32-bit relative address from byte following reloc
1378
pub const IMAGE_REL_AMD64_REL32: u16 = 0x0004;
1379
/// 32-bit relative address from byte distance 1 from reloc
1380
pub const IMAGE_REL_AMD64_REL32_1: u16 = 0x0005;
1381
/// 32-bit relative address from byte distance 2 from reloc
1382
pub const IMAGE_REL_AMD64_REL32_2: u16 = 0x0006;
1383
/// 32-bit relative address from byte distance 3 from reloc
1384
pub const IMAGE_REL_AMD64_REL32_3: u16 = 0x0007;
1385
/// 32-bit relative address from byte distance 4 from reloc
1386
pub const IMAGE_REL_AMD64_REL32_4: u16 = 0x0008;
1387
/// 32-bit relative address from byte distance 5 from reloc
1388
pub const IMAGE_REL_AMD64_REL32_5: u16 = 0x0009;
1389
/// Section index
1390
pub const IMAGE_REL_AMD64_SECTION: u16 = 0x000A;
1391
/// 32 bit offset from base of section containing target
1392
pub const IMAGE_REL_AMD64_SECREL: u16 = 0x000B;
1393
/// 7 bit unsigned offset from base of section containing target
1394
pub const IMAGE_REL_AMD64_SECREL7: u16 = 0x000C;
1395
/// 32 bit metadata token
1396
pub const IMAGE_REL_AMD64_TOKEN: u16 = 0x000D;
1397
/// 32 bit signed span-dependent value emitted into object
1398
pub const IMAGE_REL_AMD64_SREL32: u16 = 0x000E;
1399
pub const IMAGE_REL_AMD64_PAIR: u16 = 0x000F;
1400
/// 32 bit signed span-dependent value applied at link time
1401
pub const IMAGE_REL_AMD64_SSPAN32: u16 = 0x0010;
1402
pub const IMAGE_REL_AMD64_EHANDLER: u16 = 0x0011;
1403
/// Indirect branch to an import
1404
pub const IMAGE_REL_AMD64_IMPORT_BR: u16 = 0x0012;
1405
/// Indirect call to an import
1406
pub const IMAGE_REL_AMD64_IMPORT_CALL: u16 = 0x0013;
1407
/// Indirect branch to a CFG check
1408
pub const IMAGE_REL_AMD64_CFG_BR: u16 = 0x0014;
1409
/// Indirect branch to a CFG check, with REX.W prefix
1410
pub const IMAGE_REL_AMD64_CFG_BR_REX: u16 = 0x0015;
1411
/// Indirect call to a CFG check
1412
pub const IMAGE_REL_AMD64_CFG_CALL: u16 = 0x0016;
1413
/// Indirect branch to a target in RAX (no CFG)
1414
pub const IMAGE_REL_AMD64_INDIR_BR: u16 = 0x0017;
1415
/// Indirect branch to a target in RAX, with REX.W prefix (no CFG)
1416
pub const IMAGE_REL_AMD64_INDIR_BR_REX: u16 = 0x0018;
1417
/// Indirect call to a target in RAX (no CFG)
1418
pub const IMAGE_REL_AMD64_INDIR_CALL: u16 = 0x0019;
1419
/// Indirect branch for a switch table using Reg 0 (RAX)
1420
pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_FIRST: u16 = 0x0020;
1421
/// Indirect branch for a switch table using Reg 15 (R15)
1422
pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_LAST: u16 = 0x002F;
1423
1424
//
1425
// IA64 relocation types.
1426
//
1427
pub const IMAGE_REL_IA64_ABSOLUTE: u16 = 0x0000;
1428
pub const IMAGE_REL_IA64_IMM14: u16 = 0x0001;
1429
pub const IMAGE_REL_IA64_IMM22: u16 = 0x0002;
1430
pub const IMAGE_REL_IA64_IMM64: u16 = 0x0003;
1431
pub const IMAGE_REL_IA64_DIR32: u16 = 0x0004;
1432
pub const IMAGE_REL_IA64_DIR64: u16 = 0x0005;
1433
pub const IMAGE_REL_IA64_PCREL21B: u16 = 0x0006;
1434
pub const IMAGE_REL_IA64_PCREL21M: u16 = 0x0007;
1435
pub const IMAGE_REL_IA64_PCREL21F: u16 = 0x0008;
1436
pub const IMAGE_REL_IA64_GPREL22: u16 = 0x0009;
1437
pub const IMAGE_REL_IA64_LTOFF22: u16 = 0x000A;
1438
pub const IMAGE_REL_IA64_SECTION: u16 = 0x000B;
1439
pub const IMAGE_REL_IA64_SECREL22: u16 = 0x000C;
1440
pub const IMAGE_REL_IA64_SECREL64I: u16 = 0x000D;
1441
pub const IMAGE_REL_IA64_SECREL32: u16 = 0x000E;
1442
//
1443
pub const IMAGE_REL_IA64_DIR32NB: u16 = 0x0010;
1444
pub const IMAGE_REL_IA64_SREL14: u16 = 0x0011;
1445
pub const IMAGE_REL_IA64_SREL22: u16 = 0x0012;
1446
pub const IMAGE_REL_IA64_SREL32: u16 = 0x0013;
1447
pub const IMAGE_REL_IA64_UREL32: u16 = 0x0014;
1448
/// This is always a BRL and never converted
1449
pub const IMAGE_REL_IA64_PCREL60X: u16 = 0x0015;
1450
/// If possible, convert to MBB bundle with NOP.B in slot 1
1451
pub const IMAGE_REL_IA64_PCREL60B: u16 = 0x0016;
1452
/// If possible, convert to MFB bundle with NOP.F in slot 1
1453
pub const IMAGE_REL_IA64_PCREL60F: u16 = 0x0017;
1454
/// If possible, convert to MIB bundle with NOP.I in slot 1
1455
pub const IMAGE_REL_IA64_PCREL60I: u16 = 0x0018;
1456
/// If possible, convert to MMB bundle with NOP.M in slot 1
1457
pub const IMAGE_REL_IA64_PCREL60M: u16 = 0x0019;
1458
pub const IMAGE_REL_IA64_IMMGPREL64: u16 = 0x001A;
1459
/// clr token
1460
pub const IMAGE_REL_IA64_TOKEN: u16 = 0x001B;
1461
pub const IMAGE_REL_IA64_GPREL32: u16 = 0x001C;
1462
pub const IMAGE_REL_IA64_ADDEND: u16 = 0x001F;
1463
1464
//
1465
// CEF relocation types.
1466
//
1467
/// Reference is absolute, no relocation is necessary
1468
pub const IMAGE_REL_CEF_ABSOLUTE: u16 = 0x0000;
1469
/// 32-bit address (VA).
1470
pub const IMAGE_REL_CEF_ADDR32: u16 = 0x0001;
1471
/// 64-bit address (VA).
1472
pub const IMAGE_REL_CEF_ADDR64: u16 = 0x0002;
1473
/// 32-bit address w/o image base (RVA).
1474
pub const IMAGE_REL_CEF_ADDR32NB: u16 = 0x0003;
1475
/// Section index
1476
pub const IMAGE_REL_CEF_SECTION: u16 = 0x0004;
1477
/// 32 bit offset from base of section containing target
1478
pub const IMAGE_REL_CEF_SECREL: u16 = 0x0005;
1479
/// 32 bit metadata token
1480
pub const IMAGE_REL_CEF_TOKEN: u16 = 0x0006;
1481
1482
//
1483
// clr relocation types.
1484
//
1485
/// Reference is absolute, no relocation is necessary
1486
pub const IMAGE_REL_CEE_ABSOLUTE: u16 = 0x0000;
1487
/// 32-bit address (VA).
1488
pub const IMAGE_REL_CEE_ADDR32: u16 = 0x0001;
1489
/// 64-bit address (VA).
1490
pub const IMAGE_REL_CEE_ADDR64: u16 = 0x0002;
1491
/// 32-bit address w/o image base (RVA).
1492
pub const IMAGE_REL_CEE_ADDR32NB: u16 = 0x0003;
1493
/// Section index
1494
pub const IMAGE_REL_CEE_SECTION: u16 = 0x0004;
1495
/// 32 bit offset from base of section containing target
1496
pub const IMAGE_REL_CEE_SECREL: u16 = 0x0005;
1497
/// 32 bit metadata token
1498
pub const IMAGE_REL_CEE_TOKEN: u16 = 0x0006;
1499
1500
/// No relocation required
1501
pub const IMAGE_REL_M32R_ABSOLUTE: u16 = 0x0000;
1502
/// 32 bit address
1503
pub const IMAGE_REL_M32R_ADDR32: u16 = 0x0001;
1504
/// 32 bit address w/o image base
1505
pub const IMAGE_REL_M32R_ADDR32NB: u16 = 0x0002;
1506
/// 24 bit address
1507
pub const IMAGE_REL_M32R_ADDR24: u16 = 0x0003;
1508
/// GP relative addressing
1509
pub const IMAGE_REL_M32R_GPREL16: u16 = 0x0004;
1510
/// 24 bit offset << 2 & sign ext.
1511
pub const IMAGE_REL_M32R_PCREL24: u16 = 0x0005;
1512
/// 16 bit offset << 2 & sign ext.
1513
pub const IMAGE_REL_M32R_PCREL16: u16 = 0x0006;
1514
/// 8 bit offset << 2 & sign ext.
1515
pub const IMAGE_REL_M32R_PCREL8: u16 = 0x0007;
1516
/// 16 MSBs
1517
pub const IMAGE_REL_M32R_REFHALF: u16 = 0x0008;
1518
/// 16 MSBs; adj for LSB sign ext.
1519
pub const IMAGE_REL_M32R_REFHI: u16 = 0x0009;
1520
/// 16 LSBs
1521
pub const IMAGE_REL_M32R_REFLO: u16 = 0x000A;
1522
/// Link HI and LO
1523
pub const IMAGE_REL_M32R_PAIR: u16 = 0x000B;
1524
/// Section table index
1525
pub const IMAGE_REL_M32R_SECTION: u16 = 0x000C;
1526
/// 32 bit section relative reference
1527
pub const IMAGE_REL_M32R_SECREL32: u16 = 0x000D;
1528
/// clr token
1529
pub const IMAGE_REL_M32R_TOKEN: u16 = 0x000E;
1530
1531
/// No relocation required
1532
pub const IMAGE_REL_EBC_ABSOLUTE: u16 = 0x0000;
1533
/// 32 bit address w/o image base
1534
pub const IMAGE_REL_EBC_ADDR32NB: u16 = 0x0001;
1535
/// 32-bit relative address from byte following reloc
1536
pub const IMAGE_REL_EBC_REL32: u16 = 0x0002;
1537
/// Section table index
1538
pub const IMAGE_REL_EBC_SECTION: u16 = 0x0003;
1539
/// Offset within section
1540
pub const IMAGE_REL_EBC_SECREL: u16 = 0x0004;
1541
1542
/*
1543
// TODO?
1544
#define EXT_IMM64(Value, Address, Size, InstPos, ValPos)  /* Intel-IA64-Filler */           \
1545
    Value |= (((ULONGLONG)((*(Address) >> InstPos) & (((ULONGLONG)1 << Size) - 1))) << ValPos)  // Intel-IA64-Filler
1546
1547
#define INS_IMM64(Value, Address, Size, InstPos, ValPos)  /* Intel-IA64-Filler */\
1548
    *(PDWORD)Address = (*(PDWORD)Address & ~(((1 << Size) - 1) << InstPos)) | /* Intel-IA64-Filler */\
1549
          ((DWORD)((((ULONGLONG)Value >> ValPos) & (((ULONGLONG)1 << Size) - 1))) << InstPos)  // Intel-IA64-Filler
1550
*/
1551
1552
/// Intel-IA64-Filler
1553
pub const EMARCH_ENC_I17_IMM7B_INST_WORD_X: u16 = 3;
1554
/// Intel-IA64-Filler
1555
pub const EMARCH_ENC_I17_IMM7B_SIZE_X: u16 = 7;
1556
/// Intel-IA64-Filler
1557
pub const EMARCH_ENC_I17_IMM7B_INST_WORD_POS_X: u16 = 4;
1558
/// Intel-IA64-Filler
1559
pub const EMARCH_ENC_I17_IMM7B_VAL_POS_X: u16 = 0;
1560
1561
/// Intel-IA64-Filler
1562
pub const EMARCH_ENC_I17_IMM9D_INST_WORD_X: u16 = 3;
1563
/// Intel-IA64-Filler
1564
pub const EMARCH_ENC_I17_IMM9D_SIZE_X: u16 = 9;
1565
/// Intel-IA64-Filler
1566
pub const EMARCH_ENC_I17_IMM9D_INST_WORD_POS_X: u16 = 18;
1567
/// Intel-IA64-Filler
1568
pub const EMARCH_ENC_I17_IMM9D_VAL_POS_X: u16 = 7;
1569
1570
/// Intel-IA64-Filler
1571
pub const EMARCH_ENC_I17_IMM5C_INST_WORD_X: u16 = 3;
1572
/// Intel-IA64-Filler
1573
pub const EMARCH_ENC_I17_IMM5C_SIZE_X: u16 = 5;
1574
/// Intel-IA64-Filler
1575
pub const EMARCH_ENC_I17_IMM5C_INST_WORD_POS_X: u16 = 13;
1576
/// Intel-IA64-Filler
1577
pub const EMARCH_ENC_I17_IMM5C_VAL_POS_X: u16 = 16;
1578
1579
/// Intel-IA64-Filler
1580
pub const EMARCH_ENC_I17_IC_INST_WORD_X: u16 = 3;
1581
/// Intel-IA64-Filler
1582
pub const EMARCH_ENC_I17_IC_SIZE_X: u16 = 1;
1583
/// Intel-IA64-Filler
1584
pub const EMARCH_ENC_I17_IC_INST_WORD_POS_X: u16 = 12;
1585
/// Intel-IA64-Filler
1586
pub const EMARCH_ENC_I17_IC_VAL_POS_X: u16 = 21;
1587
1588
/// Intel-IA64-Filler
1589
pub const EMARCH_ENC_I17_IMM41A_INST_WORD_X: u16 = 1;
1590
/// Intel-IA64-Filler
1591
pub const EMARCH_ENC_I17_IMM41A_SIZE_X: u16 = 10;
1592
/// Intel-IA64-Filler
1593
pub const EMARCH_ENC_I17_IMM41A_INST_WORD_POS_X: u16 = 14;
1594
/// Intel-IA64-Filler
1595
pub const EMARCH_ENC_I17_IMM41A_VAL_POS_X: u16 = 22;
1596
1597
/// Intel-IA64-Filler
1598
pub const EMARCH_ENC_I17_IMM41B_INST_WORD_X: u16 = 1;
1599
/// Intel-IA64-Filler
1600
pub const EMARCH_ENC_I17_IMM41B_SIZE_X: u16 = 8;
1601
/// Intel-IA64-Filler
1602
pub const EMARCH_ENC_I17_IMM41B_INST_WORD_POS_X: u16 = 24;
1603
/// Intel-IA64-Filler
1604
pub const EMARCH_ENC_I17_IMM41B_VAL_POS_X: u16 = 32;
1605
1606
/// Intel-IA64-Filler
1607
pub const EMARCH_ENC_I17_IMM41C_INST_WORD_X: u16 = 2;
1608
/// Intel-IA64-Filler
1609
pub const EMARCH_ENC_I17_IMM41C_SIZE_X: u16 = 23;
1610
/// Intel-IA64-Filler
1611
pub const EMARCH_ENC_I17_IMM41C_INST_WORD_POS_X: u16 = 0;
1612
/// Intel-IA64-Filler
1613
pub const EMARCH_ENC_I17_IMM41C_VAL_POS_X: u16 = 40;
1614
1615
/// Intel-IA64-Filler
1616
pub const EMARCH_ENC_I17_SIGN_INST_WORD_X: u16 = 3;
1617
/// Intel-IA64-Filler
1618
pub const EMARCH_ENC_I17_SIGN_SIZE_X: u16 = 1;
1619
/// Intel-IA64-Filler
1620
pub const EMARCH_ENC_I17_SIGN_INST_WORD_POS_X: u16 = 27;
1621
/// Intel-IA64-Filler
1622
pub const EMARCH_ENC_I17_SIGN_VAL_POS_X: u16 = 63;
1623
1624
/// Intel-IA64-Filler
1625
pub const X3_OPCODE_INST_WORD_X: u16 = 3;
1626
/// Intel-IA64-Filler
1627
pub const X3_OPCODE_SIZE_X: u16 = 4;
1628
/// Intel-IA64-Filler
1629
pub const X3_OPCODE_INST_WORD_POS_X: u16 = 28;
1630
/// Intel-IA64-Filler
1631
pub const X3_OPCODE_SIGN_VAL_POS_X: u16 = 0;
1632
1633
/// Intel-IA64-Filler
1634
pub const X3_I_INST_WORD_X: u16 = 3;
1635
/// Intel-IA64-Filler
1636
pub const X3_I_SIZE_X: u16 = 1;
1637
/// Intel-IA64-Filler
1638
pub const X3_I_INST_WORD_POS_X: u16 = 27;
1639
/// Intel-IA64-Filler
1640
pub const X3_I_SIGN_VAL_POS_X: u16 = 59;
1641
1642
/// Intel-IA64-Filler
1643
pub const X3_D_WH_INST_WORD_X: u16 = 3;
1644
/// Intel-IA64-Filler
1645
pub const X3_D_WH_SIZE_X: u16 = 3;
1646
/// Intel-IA64-Filler
1647
pub const X3_D_WH_INST_WORD_POS_X: u16 = 24;
1648
/// Intel-IA64-Filler
1649
pub const X3_D_WH_SIGN_VAL_POS_X: u16 = 0;
1650
1651
/// Intel-IA64-Filler
1652
pub const X3_IMM20_INST_WORD_X: u16 = 3;
1653
/// Intel-IA64-Filler
1654
pub const X3_IMM20_SIZE_X: u16 = 20;
1655
/// Intel-IA64-Filler
1656
pub const X3_IMM20_INST_WORD_POS_X: u16 = 4;
1657
/// Intel-IA64-Filler
1658
pub const X3_IMM20_SIGN_VAL_POS_X: u16 = 0;
1659
1660
/// Intel-IA64-Filler
1661
pub const X3_IMM39_1_INST_WORD_X: u16 = 2;
1662
/// Intel-IA64-Filler
1663
pub const X3_IMM39_1_SIZE_X: u16 = 23;
1664
/// Intel-IA64-Filler
1665
pub const X3_IMM39_1_INST_WORD_POS_X: u16 = 0;
1666
/// Intel-IA64-Filler
1667
pub const X3_IMM39_1_SIGN_VAL_POS_X: u16 = 36;
1668
1669
/// Intel-IA64-Filler
1670
pub const X3_IMM39_2_INST_WORD_X: u16 = 1;
1671
/// Intel-IA64-Filler
1672
pub const X3_IMM39_2_SIZE_X: u16 = 16;
1673
/// Intel-IA64-Filler
1674
pub const X3_IMM39_2_INST_WORD_POS_X: u16 = 16;
1675
/// Intel-IA64-Filler
1676
pub const X3_IMM39_2_SIGN_VAL_POS_X: u16 = 20;
1677
1678
/// Intel-IA64-Filler
1679
pub const X3_P_INST_WORD_X: u16 = 3;
1680
/// Intel-IA64-Filler
1681
pub const X3_P_SIZE_X: u16 = 4;
1682
/// Intel-IA64-Filler
1683
pub const X3_P_INST_WORD_POS_X: u16 = 0;
1684
/// Intel-IA64-Filler
1685
pub const X3_P_SIGN_VAL_POS_X: u16 = 0;
1686
1687
/// Intel-IA64-Filler
1688
pub const X3_TMPLT_INST_WORD_X: u16 = 0;
1689
/// Intel-IA64-Filler
1690
pub const X3_TMPLT_SIZE_X: u16 = 4;
1691
/// Intel-IA64-Filler
1692
pub const X3_TMPLT_INST_WORD_POS_X: u16 = 0;
1693
/// Intel-IA64-Filler
1694
pub const X3_TMPLT_SIGN_VAL_POS_X: u16 = 0;
1695
1696
/// Intel-IA64-Filler
1697
pub const X3_BTYPE_QP_INST_WORD_X: u16 = 2;
1698
/// Intel-IA64-Filler
1699
pub const X3_BTYPE_QP_SIZE_X: u16 = 9;
1700
/// Intel-IA64-Filler
1701
pub const X3_BTYPE_QP_INST_WORD_POS_X: u16 = 23;
1702
/// Intel-IA64-Filler
1703
pub const X3_BTYPE_QP_INST_VAL_POS_X: u16 = 0;
1704
1705
/// Intel-IA64-Filler
1706
pub const X3_EMPTY_INST_WORD_X: u16 = 1;
1707
/// Intel-IA64-Filler
1708
pub const X3_EMPTY_SIZE_X: u16 = 2;
1709
/// Intel-IA64-Filler
1710
pub const X3_EMPTY_INST_WORD_POS_X: u16 = 14;
1711
/// Intel-IA64-Filler
1712
pub const X3_EMPTY_INST_VAL_POS_X: u16 = 0;
1713
1714
//
1715
// Line number format.
1716
//
1717
1718
// This struct has alignment 1.
1719
#[derive(Debug, Clone, Copy)]
1720
#[repr(C)]
1721
pub struct ImageLinenumber {
1722
    /// Symbol table index of function name if Linenumber is 0.
1723
    /// Otherwise virtual address of line number.
1724
    pub symbol_table_index_or_virtual_address: U32Bytes<LE>,
1725
    /// Line number.
1726
    pub linenumber: U16Bytes<LE>,
1727
}
1728
1729
//
1730
// Based relocation format.
1731
//
1732
1733
#[derive(Debug, Clone, Copy)]
1734
#[repr(C)]
1735
pub struct ImageBaseRelocation {
1736
    pub virtual_address: U32<LE>,
1737
    pub size_of_block: U32<LE>,
1738
    //  pub type_offset[1]: U16<LE>,
1739
}
1740
1741
//
1742
// Based relocation types.
1743
//
1744
1745
pub const IMAGE_REL_BASED_ABSOLUTE: u16 = 0;
1746
pub const IMAGE_REL_BASED_HIGH: u16 = 1;
1747
pub const IMAGE_REL_BASED_LOW: u16 = 2;
1748
pub const IMAGE_REL_BASED_HIGHLOW: u16 = 3;
1749
pub const IMAGE_REL_BASED_HIGHADJ: u16 = 4;
1750
pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_5: u16 = 5;
1751
pub const IMAGE_REL_BASED_RESERVED: u16 = 6;
1752
pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_7: u16 = 7;
1753
pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_8: u16 = 8;
1754
pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_9: u16 = 9;
1755
pub const IMAGE_REL_BASED_DIR64: u16 = 10;
1756
1757
//
1758
// Platform-specific based relocation types.
1759
//
1760
1761
pub const IMAGE_REL_BASED_IA64_IMM64: u16 = 9;
1762
1763
pub const IMAGE_REL_BASED_MIPS_JMPADDR: u16 = 5;
1764
pub const IMAGE_REL_BASED_MIPS_JMPADDR16: u16 = 9;
1765
1766
pub const IMAGE_REL_BASED_ARM_MOV32: u16 = 5;
1767
pub const IMAGE_REL_BASED_THUMB_MOV32: u16 = 7;
1768
1769
pub const IMAGE_REL_BASED_RISCV_HIGH20: u16 = 5;
1770
pub const IMAGE_REL_BASED_RISCV_LOW12I: u16 = 7;
1771
pub const IMAGE_REL_BASED_RISCV_LOW12S: u16 = 8;
1772
1773
//
1774
// Archive format.
1775
//
1776
1777
pub const IMAGE_ARCHIVE_START_SIZE: usize = 8;
1778
pub const IMAGE_ARCHIVE_START: &[u8; 8] = b"!<arch>\n";
1779
pub const IMAGE_ARCHIVE_END: &[u8] = b"`\n";
1780
pub const IMAGE_ARCHIVE_PAD: &[u8] = b"\n";
1781
pub const IMAGE_ARCHIVE_LINKER_MEMBER: &[u8; 16] = b"/               ";
1782
pub const IMAGE_ARCHIVE_LONGNAMES_MEMBER: &[u8; 16] = b"//              ";
1783
pub const IMAGE_ARCHIVE_HYBRIDMAP_MEMBER: &[u8; 16] = b"/<HYBRIDMAP>/   ";
1784
1785
#[derive(Debug, Clone, Copy)]
1786
#[repr(C)]
1787
pub struct ImageArchiveMemberHeader {
1788
    /// File member name - `/' terminated.
1789
    pub name: [u8; 16],
1790
    /// File member date - decimal.
1791
    pub date: [u8; 12],
1792
    /// File member user id - decimal.
1793
    pub user_id: [u8; 6],
1794
    /// File member group id - decimal.
1795
    pub group_id: [u8; 6],
1796
    /// File member mode - octal.
1797
    pub mode: [u8; 8],
1798
    /// File member size - decimal.
1799
    pub size: [u8; 10],
1800
    /// String to end header.
1801
    pub end_header: [u8; 2],
1802
}
1803
1804
pub const IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR: u16 = 60;
1805
1806
//
1807
// DLL support.
1808
//
1809
1810
//
1811
// Export Format
1812
//
1813
1814
#[derive(Debug, Clone, Copy)]
1815
#[repr(C)]
1816
pub struct ImageExportDirectory {
1817
    pub characteristics: U32<LE>,
1818
    pub time_date_stamp: U32<LE>,
1819
    pub major_version: U16<LE>,
1820
    pub minor_version: U16<LE>,
1821
    pub name: U32<LE>,
1822
    pub base: U32<LE>,
1823
    pub number_of_functions: U32<LE>,
1824
    pub number_of_names: U32<LE>,
1825
    /// RVA from base of image
1826
    pub address_of_functions: U32<LE>,
1827
    /// RVA from base of image
1828
    pub address_of_names: U32<LE>,
1829
    /// RVA from base of image
1830
    pub address_of_name_ordinals: U32<LE>,
1831
}
1832
1833
//
1834
// Import Format
1835
//
1836
1837
#[derive(Debug, Clone, Copy)]
1838
#[repr(C)]
1839
pub struct ImageImportByName {
1840
    pub hint: U16<LE>,
1841
    //pub name: [i8; 1],
1842
}
1843
1844
#[derive(Debug, Clone, Copy)]
1845
#[repr(C)]
1846
pub struct ImageThunkData64(pub U64<LE>);
1847
/*
1848
    union {
1849
/// PBYTE
1850
        pub forwarder_string: U64<LE>,
1851
/// PDWORD
1852
        pub function: U64<LE>,
1853
        pub ordinal: U64<LE>,
1854
/// PIMAGE_IMPORT_BY_NAME
1855
        pub address_of_data: U64<LE>,
1856
    } u1;
1857
*/
1858
1859
#[derive(Debug, Clone, Copy)]
1860
#[repr(C)]
1861
pub struct ImageThunkData32(pub U32<LE>);
1862
/*
1863
    union {
1864
/// PBYTE
1865
        pub forwarder_string: U32<LE>,
1866
/// PDWORD
1867
        pub function: U32<LE>,
1868
        pub ordinal: U32<LE>,
1869
/// PIMAGE_IMPORT_BY_NAME
1870
        pub address_of_data: U32<LE>,
1871
    } u1;
1872
}
1873
*/
1874
1875
pub const IMAGE_ORDINAL_FLAG64: u64 = 0x8000000000000000;
1876
pub const IMAGE_ORDINAL_FLAG32: u32 = 0x80000000;
1877
1878
/*
1879
#define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)
1880
#define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)
1881
#define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
1882
#define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
1883
1884
*/
1885
1886
//
1887
// Thread Local Storage
1888
//
1889
1890
#[derive(Debug, Clone, Copy)]
1891
#[repr(C)]
1892
pub struct ImageTlsDirectory64 {
1893
    pub start_address_of_raw_data: U64<LE>,
1894
    pub end_address_of_raw_data: U64<LE>,
1895
    /// PDWORD
1896
    pub address_of_index: U64<LE>,
1897
    /// PIMAGE_TLS_CALLBACK *;
1898
    pub address_of_call_backs: U64<LE>,
1899
    pub size_of_zero_fill: U32<LE>,
1900
    pub characteristics: U32<LE>,
1901
}
1902
1903
#[derive(Debug, Clone, Copy)]
1904
#[repr(C)]
1905
pub struct ImageTlsDirectory32 {
1906
    pub start_address_of_raw_data: U32<LE>,
1907
    pub end_address_of_raw_data: U32<LE>,
1908
    /// PDWORD
1909
    pub address_of_index: U32<LE>,
1910
    /// PIMAGE_TLS_CALLBACK *
1911
    pub address_of_call_backs: U32<LE>,
1912
    pub size_of_zero_fill: U32<LE>,
1913
    pub characteristics: U32<LE>,
1914
}
1915
1916
#[derive(Debug, Clone, Copy)]
1917
#[repr(C)]
1918
pub struct ImageImportDescriptor {
1919
    /// RVA to original unbound IAT (`ImageThunkData32`/`ImageThunkData64`)
1920
    /// 0 for terminating null import descriptor
1921
    pub original_first_thunk: U32Bytes<LE>,
1922
    /// 0 if not bound,
1923
    /// -1 if bound, and real date\time stamp
1924
    ///     in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
1925
    /// O.W. date/time stamp of DLL bound to (Old BIND)
1926
    pub time_date_stamp: U32Bytes<LE>,
1927
    /// -1 if no forwarders
1928
    pub forwarder_chain: U32Bytes<LE>,
1929
    pub name: U32Bytes<LE>,
1930
    /// RVA to IAT (if bound this IAT has actual addresses)
1931
    pub first_thunk: U32Bytes<LE>,
1932
}
1933
1934
impl ImageImportDescriptor {
1935
    /// Tell whether this import descriptor is the null descriptor
1936
    /// (used to mark the end of the iterator array in a PE)
1937
0
    pub fn is_null(&self) -> bool {
1938
0
        self.original_first_thunk.get(LE) == 0
1939
0
            && self.time_date_stamp.get(LE) == 0
1940
0
            && self.forwarder_chain.get(LE) == 0
1941
0
            && self.name.get(LE) == 0
1942
0
            && self.first_thunk.get(LE) == 0
1943
0
    }
1944
}
1945
1946
//
1947
// New format import descriptors pointed to by DataDirectory[ IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT ]
1948
//
1949
1950
#[derive(Debug, Clone, Copy)]
1951
#[repr(C)]
1952
pub struct ImageBoundImportDescriptor {
1953
    pub time_date_stamp: U32<LE>,
1954
    pub offset_module_name: U16<LE>,
1955
    pub number_of_module_forwarder_refs: U16<LE>,
1956
    // Array of zero or more IMAGE_BOUND_FORWARDER_REF follows
1957
}
1958
1959
#[derive(Debug, Clone, Copy)]
1960
#[repr(C)]
1961
pub struct ImageBoundForwarderRef {
1962
    pub time_date_stamp: U32<LE>,
1963
    pub offset_module_name: U16<LE>,
1964
    pub reserved: U16<LE>,
1965
}
1966
1967
#[derive(Debug, Clone, Copy)]
1968
#[repr(C)]
1969
pub struct ImageDelayloadDescriptor {
1970
    pub attributes: U32<LE>,
1971
1972
    /// RVA to the name of the target library (NULL-terminate ASCII string)
1973
    pub dll_name_rva: U32<LE>,
1974
    /// RVA to the HMODULE caching location (PHMODULE)
1975
    pub module_handle_rva: U32<LE>,
1976
    /// RVA to the start of the IAT (PIMAGE_THUNK_DATA)
1977
    pub import_address_table_rva: U32<LE>,
1978
    /// RVA to the start of the name table (PIMAGE_THUNK_DATA::AddressOfData)
1979
    pub import_name_table_rva: U32<LE>,
1980
    /// RVA to an optional bound IAT
1981
    pub bound_import_address_table_rva: U32<LE>,
1982
    /// RVA to an optional unload info table
1983
    pub unload_information_table_rva: U32<LE>,
1984
    /// 0 if not bound, otherwise, date/time of the target DLL
1985
    pub time_date_stamp: U32<LE>,
1986
}
1987
1988
impl ImageDelayloadDescriptor {
1989
    /// Tell whether this delay-load import descriptor is the null descriptor
1990
    /// (used to mark the end of the iterator array in a PE)
1991
0
    pub fn is_null(&self) -> bool {
1992
0
        self.attributes.get(LE) == 0
1993
0
            && self.dll_name_rva.get(LE) == 0
1994
0
            && self.module_handle_rva.get(LE) == 0
1995
0
            && self.import_address_table_rva.get(LE) == 0
1996
0
            && self.import_name_table_rva.get(LE) == 0
1997
0
            && self.bound_import_address_table_rva.get(LE) == 0
1998
0
            && self.unload_information_table_rva.get(LE) == 0
1999
0
            && self.time_date_stamp.get(LE) == 0
2000
0
    }
2001
}
2002
2003
/// Delay load version 2 flag for `ImageDelayloadDescriptor::attributes`.
2004
pub const IMAGE_DELAYLOAD_RVA_BASED: u32 = 0x8000_0000;
2005
2006
//
2007
// Resource Format.
2008
//
2009
2010
//
2011
// Resource directory consists of two counts, following by a variable length
2012
// array of directory entries.  The first count is the number of entries at
2013
// beginning of the array that have actual names associated with each entry.
2014
// The entries are in ascending order, case insensitive strings.  The second
2015
// count is the number of entries that immediately follow the named entries.
2016
// This second count identifies the number of entries that have 16-bit integer
2017
// Ids as their name.  These entries are also sorted in ascending order.
2018
//
2019
// This structure allows fast lookup by either name or number, but for any
2020
// given resource entry only one form of lookup is supported, not both.
2021
// This is consistent with the syntax of the .RC file and the .RES file.
2022
//
2023
2024
#[derive(Debug, Clone, Copy)]
2025
#[repr(C)]
2026
pub struct ImageResourceDirectory {
2027
    pub characteristics: U32<LE>,
2028
    pub time_date_stamp: U32<LE>,
2029
    pub major_version: U16<LE>,
2030
    pub minor_version: U16<LE>,
2031
    pub number_of_named_entries: U16<LE>,
2032
    pub number_of_id_entries: U16<LE>,
2033
}
2034
2035
pub const IMAGE_RESOURCE_NAME_IS_STRING: u32 = 0x8000_0000;
2036
pub const IMAGE_RESOURCE_DATA_IS_DIRECTORY: u32 = 0x8000_0000;
2037
//
2038
// Each directory contains the 32-bit Name of the entry and an offset,
2039
// relative to the beginning of the resource directory of the data associated
2040
// with this directory entry.  If the name of the entry is an actual text
2041
// string instead of an integer Id, then the high order bit of the name field
2042
// is set to one and the low order 31-bits are an offset, relative to the
2043
// beginning of the resource directory of the string, which is of type
2044
// IMAGE_RESOURCE_DIRECTORY_STRING.  Otherwise the high bit is clear and the
2045
// low-order 16-bits are the integer Id that identify this resource directory
2046
// entry. If the directory entry is yet another resource directory (i.e. a
2047
// subdirectory), then the high order bit of the offset field will be
2048
// set to indicate this.  Otherwise the high bit is clear and the offset
2049
// field points to a resource data entry.
2050
//
2051
2052
#[derive(Debug, Clone, Copy)]
2053
#[repr(C)]
2054
pub struct ImageResourceDirectoryEntry {
2055
    pub name_or_id: U32<LE>,
2056
    pub offset_to_data_or_directory: U32<LE>,
2057
}
2058
2059
//
2060
// For resource directory entries that have actual string names, the Name
2061
// field of the directory entry points to an object of the following type.
2062
// All of these string objects are stored together after the last resource
2063
// directory entry and before the first resource data object.  This minimizes
2064
// the impact of these variable length objects on the alignment of the fixed
2065
// size directory entry objects.
2066
//
2067
2068
#[derive(Debug, Clone, Copy)]
2069
#[repr(C)]
2070
pub struct ImageResourceDirectoryString {
2071
    pub length: U16<LE>,
2072
    //pub name_string: [i8; 1],
2073
}
2074
2075
#[derive(Debug, Clone, Copy)]
2076
#[repr(C)]
2077
pub struct ImageResourceDirStringU {
2078
    pub length: U16<LE>,
2079
    //pub name_string: [U16<LE>; 1],
2080
}
2081
2082
//
2083
// Each resource data entry describes a leaf node in the resource directory
2084
// tree.  It contains an offset, relative to the beginning of the resource
2085
// directory of the data for the resource, a size field that gives the number
2086
// of bytes of data at that offset, a CodePage that should be used when
2087
// decoding code point values within the resource data.  Typically for new
2088
// applications the code page would be the unicode code page.
2089
//
2090
2091
#[derive(Debug, Clone, Copy)]
2092
#[repr(C)]
2093
pub struct ImageResourceDataEntry {
2094
    /// RVA of the data.
2095
    pub offset_to_data: U32<LE>,
2096
    pub size: U32<LE>,
2097
    pub code_page: U32<LE>,
2098
    pub reserved: U32<LE>,
2099
}
2100
2101
// Resource type: https://docs.microsoft.com/en-us/windows/win32/menurc/resource-types
2102
2103
/// ID for: Hardware-dependent cursor resource.
2104
pub const RT_CURSOR: u16 = 1;
2105
/// ID for: Bitmap resource.
2106
pub const RT_BITMAP: u16 = 2;
2107
/// ID for: Hardware-dependent icon resource.
2108
pub const RT_ICON: u16 = 3;
2109
/// ID for: Menu resource.
2110
pub const RT_MENU: u16 = 4;
2111
/// ID for: Dialog box.
2112
pub const RT_DIALOG: u16 = 5;
2113
/// ID for: String-table entry.
2114
pub const RT_STRING: u16 = 6;
2115
/// ID for: Font directory resource.
2116
pub const RT_FONTDIR: u16 = 7;
2117
/// ID for: Font resource.
2118
pub const RT_FONT: u16 = 8;
2119
/// ID for: Accelerator table.
2120
pub const RT_ACCELERATOR: u16 = 9;
2121
/// ID for: Application-defined resource (raw data).
2122
pub const RT_RCDATA: u16 = 10;
2123
/// ID for: Message-table entry.
2124
pub const RT_MESSAGETABLE: u16 = 11;
2125
/// ID for: Hardware-independent cursor resource.
2126
pub const RT_GROUP_CURSOR: u16 = 12;
2127
/// ID for: Hardware-independent icon resource.
2128
pub const RT_GROUP_ICON: u16 = 14;
2129
/// ID for: Version resource.
2130
pub const RT_VERSION: u16 = 16;
2131
/// ID for: Allows a resource editing tool to associate a string with an .rc file.
2132
pub const RT_DLGINCLUDE: u16 = 17;
2133
/// ID for: Plug and Play resource.
2134
pub const RT_PLUGPLAY: u16 = 19;
2135
/// ID for: VXD.
2136
pub const RT_VXD: u16 = 20;
2137
/// ID for: Animated cursor.
2138
pub const RT_ANICURSOR: u16 = 21;
2139
/// ID for: Animated icon.
2140
pub const RT_ANIICON: u16 = 22;
2141
/// ID for: HTML resource.
2142
pub const RT_HTML: u16 = 23;
2143
/// ID for: Side-by-Side Assembly Manifest.
2144
pub const RT_MANIFEST: u16 = 24;
2145
2146
//
2147
// Code Integrity in loadconfig (CI)
2148
//
2149
2150
#[derive(Debug, Clone, Copy)]
2151
#[repr(C)]
2152
pub struct ImageLoadConfigCodeIntegrity {
2153
    /// Flags to indicate if CI information is available, etc.
2154
    pub flags: U16<LE>,
2155
    /// 0xFFFF means not available
2156
    pub catalog: U16<LE>,
2157
    pub catalog_offset: U32<LE>,
2158
    /// Additional bitmask to be defined later
2159
    pub reserved: U32<LE>,
2160
}
2161
2162
//
2163
// Dynamic value relocation table in loadconfig
2164
//
2165
2166
#[derive(Debug, Clone, Copy)]
2167
#[repr(C)]
2168
pub struct ImageDynamicRelocationTable {
2169
    pub version: U32<LE>,
2170
    pub size: U32<LE>,
2171
    // DynamicRelocations: [ImageDynamicRelocation; 0],
2172
}
2173
2174
//
2175
// Dynamic value relocation entries following IMAGE_DYNAMIC_RELOCATION_TABLE
2176
//
2177
2178
#[derive(Debug, Clone, Copy)]
2179
#[repr(C)]
2180
pub struct ImageDynamicRelocation32 {
2181
    pub symbol: U32<LE>,
2182
    pub base_reloc_size: U32<LE>,
2183
    // BaseRelocations: [ImageBaseRelocation; 0],
2184
}
2185
2186
#[derive(Debug, Clone, Copy)]
2187
#[repr(C)]
2188
pub struct ImageDynamicRelocation64 {
2189
    pub symbol: U64<LE>,
2190
    pub base_reloc_size: U32<LE>,
2191
    // BaseRelocations: [ImageBaseRelocation; 0],
2192
}
2193
2194
#[derive(Debug, Clone, Copy)]
2195
#[repr(C)]
2196
pub struct ImageDynamicRelocation32V2 {
2197
    pub header_size: U32<LE>,
2198
    pub fixup_info_size: U32<LE>,
2199
    pub symbol: U32<LE>,
2200
    pub symbol_group: U32<LE>,
2201
    pub flags: U32<LE>,
2202
    // ...     variable length header fields
2203
    // pub     fixup_info: [u8; fixup_info_size]
2204
}
2205
2206
#[derive(Debug, Clone, Copy)]
2207
#[repr(C)]
2208
pub struct ImageDynamicRelocation64V2 {
2209
    pub header_size: U32<LE>,
2210
    pub fixup_info_size: U32<LE>,
2211
    pub symbol: U64<LE>,
2212
    pub symbol_group: U32<LE>,
2213
    pub flags: U32<LE>,
2214
    // ...     variable length header fields
2215
    // pub     fixup_info[u8; fixup_info_size]
2216
}
2217
2218
//
2219
// Defined symbolic dynamic relocation entries.
2220
//
2221
2222
pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE: u32 = 0x0000_0001;
2223
pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE: u32 = 0x0000_0002;
2224
pub const IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER: u32 = 0x0000_0003;
2225
pub const IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER: u32 = 0x0000_0004;
2226
pub const IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH: u32 = 0x0000_0005;
2227
2228
// This struct has alignment 1.
2229
#[derive(Debug, Clone, Copy)]
2230
#[repr(C)]
2231
pub struct ImagePrologueDynamicRelocationHeader {
2232
    pub prologue_byte_count: u8,
2233
    // pub prologue_bytes: [u8; prologue_byte_count],
2234
}
2235
2236
// This struct has alignment 1.
2237
#[derive(Debug, Clone, Copy)]
2238
#[repr(C)]
2239
pub struct ImageEpilogueDynamicRelocationHeader {
2240
    pub epilogue_count: U32Bytes<LE>,
2241
    pub epilogue_byte_count: u8,
2242
    pub branch_descriptor_element_size: u8,
2243
    pub branch_descriptor_count: U16Bytes<LE>,
2244
    // pub branch_descriptors[...],
2245
    // pub branch_descriptor_bit_map[...],
2246
}
2247
2248
/*
2249
// TODO? bitfields
2250
// TODO: unaligned?
2251
#[derive(Debug, Clone, Copy)]
2252
#[repr(C)]
2253
pub struct ImageImportControlTransferDynamicRelocation {
2254
    DWORD       PageRelativeOffset : 12;
2255
    DWORD       IndirectCall       : 1;
2256
    DWORD       IATIndex           : 19;
2257
}
2258
2259
// TODO: unaligned?
2260
#[derive(Debug, Clone, Copy)]
2261
#[repr(C)]
2262
pub struct ImageIndirControlTransferDynamicRelocation {
2263
    WORD        PageRelativeOffset : 12;
2264
    WORD        IndirectCall       : 1;
2265
    WORD        RexWPrefix         : 1;
2266
    WORD        CfgCheck           : 1;
2267
    WORD        Reserved           : 1;
2268
}
2269
2270
// TODO: unaligned?
2271
#[derive(Debug, Clone, Copy)]
2272
#[repr(C)]
2273
pub struct ImageSwitchtableBranchDynamicRelocation {
2274
    WORD        PageRelativeOffset : 12;
2275
    WORD        RegisterNumber     : 4;
2276
}
2277
*/
2278
2279
//
2280
// Load Configuration Directory Entry
2281
//
2282
2283
#[derive(Debug, Clone, Copy)]
2284
#[repr(C)]
2285
pub struct ImageLoadConfigDirectory32 {
2286
    pub size: U32<LE>,
2287
    pub time_date_stamp: U32<LE>,
2288
    pub major_version: U16<LE>,
2289
    pub minor_version: U16<LE>,
2290
    pub global_flags_clear: U32<LE>,
2291
    pub global_flags_set: U32<LE>,
2292
    pub critical_section_default_timeout: U32<LE>,
2293
    pub de_commit_free_block_threshold: U32<LE>,
2294
    pub de_commit_total_free_threshold: U32<LE>,
2295
    /// VA
2296
    pub lock_prefix_table: U32<LE>,
2297
    pub maximum_allocation_size: U32<LE>,
2298
    pub virtual_memory_threshold: U32<LE>,
2299
    pub process_heap_flags: U32<LE>,
2300
    pub process_affinity_mask: U32<LE>,
2301
    pub csd_version: U16<LE>,
2302
    pub dependent_load_flags: U16<LE>,
2303
    /// VA
2304
    pub edit_list: U32<LE>,
2305
    /// VA
2306
    pub security_cookie: U32<LE>,
2307
    /// VA
2308
    pub sehandler_table: U32<LE>,
2309
    pub sehandler_count: U32<LE>,
2310
    /// VA
2311
    pub guard_cf_check_function_pointer: U32<LE>,
2312
    /// VA
2313
    pub guard_cf_dispatch_function_pointer: U32<LE>,
2314
    /// VA
2315
    pub guard_cf_function_table: U32<LE>,
2316
    pub guard_cf_function_count: U32<LE>,
2317
    pub guard_flags: U32<LE>,
2318
    pub code_integrity: ImageLoadConfigCodeIntegrity,
2319
    /// VA
2320
    pub guard_address_taken_iat_entry_table: U32<LE>,
2321
    pub guard_address_taken_iat_entry_count: U32<LE>,
2322
    /// VA
2323
    pub guard_long_jump_target_table: U32<LE>,
2324
    pub guard_long_jump_target_count: U32<LE>,
2325
    /// VA
2326
    pub dynamic_value_reloc_table: U32<LE>,
2327
    pub chpe_metadata_pointer: U32<LE>,
2328
    /// VA
2329
    pub guard_rf_failure_routine: U32<LE>,
2330
    /// VA
2331
    pub guard_rf_failure_routine_function_pointer: U32<LE>,
2332
    pub dynamic_value_reloc_table_offset: U32<LE>,
2333
    pub dynamic_value_reloc_table_section: U16<LE>,
2334
    pub reserved2: U16<LE>,
2335
    /// VA
2336
    pub guard_rf_verify_stack_pointer_function_pointer: U32<LE>,
2337
    pub hot_patch_table_offset: U32<LE>,
2338
    pub reserved3: U32<LE>,
2339
    /// VA
2340
    pub enclave_configuration_pointer: U32<LE>,
2341
    /// VA
2342
    pub volatile_metadata_pointer: U32<LE>,
2343
}
2344
2345
#[derive(Debug, Clone, Copy)]
2346
#[repr(C)]
2347
pub struct ImageLoadConfigDirectory64 {
2348
    pub size: U32<LE>,
2349
    pub time_date_stamp: U32<LE>,
2350
    pub major_version: U16<LE>,
2351
    pub minor_version: U16<LE>,
2352
    pub global_flags_clear: U32<LE>,
2353
    pub global_flags_set: U32<LE>,
2354
    pub critical_section_default_timeout: U32<LE>,
2355
    pub de_commit_free_block_threshold: U64<LE>,
2356
    pub de_commit_total_free_threshold: U64<LE>,
2357
    /// VA
2358
    pub lock_prefix_table: U64<LE>,
2359
    pub maximum_allocation_size: U64<LE>,
2360
    pub virtual_memory_threshold: U64<LE>,
2361
    pub process_affinity_mask: U64<LE>,
2362
    pub process_heap_flags: U32<LE>,
2363
    pub csd_version: U16<LE>,
2364
    pub dependent_load_flags: U16<LE>,
2365
    /// VA
2366
    pub edit_list: U64<LE>,
2367
    /// VA
2368
    pub security_cookie: U64<LE>,
2369
    /// VA
2370
    pub sehandler_table: U64<LE>,
2371
    pub sehandler_count: U64<LE>,
2372
    /// VA
2373
    pub guard_cf_check_function_pointer: U64<LE>,
2374
    /// VA
2375
    pub guard_cf_dispatch_function_pointer: U64<LE>,
2376
    /// VA
2377
    pub guard_cf_function_table: U64<LE>,
2378
    pub guard_cf_function_count: U64<LE>,
2379
    pub guard_flags: U32<LE>,
2380
    pub code_integrity: ImageLoadConfigCodeIntegrity,
2381
    /// VA
2382
    pub guard_address_taken_iat_entry_table: U64<LE>,
2383
    pub guard_address_taken_iat_entry_count: U64<LE>,
2384
    /// VA
2385
    pub guard_long_jump_target_table: U64<LE>,
2386
    pub guard_long_jump_target_count: U64<LE>,
2387
    /// VA
2388
    pub dynamic_value_reloc_table: U64<LE>,
2389
    /// VA
2390
    pub chpe_metadata_pointer: U64<LE>,
2391
    /// VA
2392
    pub guard_rf_failure_routine: U64<LE>,
2393
    /// VA
2394
    pub guard_rf_failure_routine_function_pointer: U64<LE>,
2395
    pub dynamic_value_reloc_table_offset: U32<LE>,
2396
    pub dynamic_value_reloc_table_section: U16<LE>,
2397
    pub reserved2: U16<LE>,
2398
    /// VA
2399
    pub guard_rf_verify_stack_pointer_function_pointer: U64<LE>,
2400
    pub hot_patch_table_offset: U32<LE>,
2401
    pub reserved3: U32<LE>,
2402
    /// VA
2403
    pub enclave_configuration_pointer: U64<LE>,
2404
    /// VA
2405
    pub volatile_metadata_pointer: U64<LE>,
2406
}
2407
2408
#[derive(Debug, Clone, Copy)]
2409
#[repr(C)]
2410
pub struct ImageHotPatchInfo {
2411
    pub version: U32<LE>,
2412
    pub size: U32<LE>,
2413
    pub sequence_number: U32<LE>,
2414
    pub base_image_list: U32<LE>,
2415
    pub base_image_count: U32<LE>,
2416
    /// Version 2 and later
2417
    pub buffer_offset: U32<LE>,
2418
    /// Version 3 and later
2419
    pub extra_patch_size: U32<LE>,
2420
}
2421
2422
#[derive(Debug, Clone, Copy)]
2423
#[repr(C)]
2424
pub struct ImageHotPatchBase {
2425
    pub sequence_number: U32<LE>,
2426
    pub flags: U32<LE>,
2427
    pub original_time_date_stamp: U32<LE>,
2428
    pub original_check_sum: U32<LE>,
2429
    pub code_integrity_info: U32<LE>,
2430
    pub code_integrity_size: U32<LE>,
2431
    pub patch_table: U32<LE>,
2432
    /// Version 2 and later
2433
    pub buffer_offset: U32<LE>,
2434
}
2435
2436
#[derive(Debug, Clone, Copy)]
2437
#[repr(C)]
2438
pub struct ImageHotPatchHashes {
2439
    pub sha256: [u8; 32],
2440
    pub sha1: [u8; 20],
2441
}
2442
2443
pub const IMAGE_HOT_PATCH_BASE_OBLIGATORY: u32 = 0x0000_0001;
2444
pub const IMAGE_HOT_PATCH_BASE_CAN_ROLL_BACK: u32 = 0x0000_0002;
2445
2446
pub const IMAGE_HOT_PATCH_CHUNK_INVERSE: u32 = 0x8000_0000;
2447
pub const IMAGE_HOT_PATCH_CHUNK_OBLIGATORY: u32 = 0x4000_0000;
2448
pub const IMAGE_HOT_PATCH_CHUNK_RESERVED: u32 = 0x3FF0_3000;
2449
pub const IMAGE_HOT_PATCH_CHUNK_TYPE: u32 = 0x000F_C000;
2450
pub const IMAGE_HOT_PATCH_CHUNK_SOURCE_RVA: u32 = 0x0000_8000;
2451
pub const IMAGE_HOT_PATCH_CHUNK_TARGET_RVA: u32 = 0x0000_4000;
2452
pub const IMAGE_HOT_PATCH_CHUNK_SIZE: u32 = 0x0000_0FFF;
2453
2454
pub const IMAGE_HOT_PATCH_NONE: u32 = 0x0000_0000;
2455
pub const IMAGE_HOT_PATCH_FUNCTION: u32 = 0x0001_C000;
2456
pub const IMAGE_HOT_PATCH_ABSOLUTE: u32 = 0x0002_C000;
2457
pub const IMAGE_HOT_PATCH_REL32: u32 = 0x0003_C000;
2458
pub const IMAGE_HOT_PATCH_CALL_TARGET: u32 = 0x0004_4000;
2459
pub const IMAGE_HOT_PATCH_INDIRECT: u32 = 0x0005_C000;
2460
pub const IMAGE_HOT_PATCH_NO_CALL_TARGET: u32 = 0x0006_4000;
2461
pub const IMAGE_HOT_PATCH_DYNAMIC_VALUE: u32 = 0x0007_8000;
2462
2463
/// Module performs control flow integrity checks using system-supplied support
2464
pub const IMAGE_GUARD_CF_INSTRUMENTED: u32 = 0x0000_0100;
2465
/// Module performs control flow and write integrity checks
2466
pub const IMAGE_GUARD_CFW_INSTRUMENTED: u32 = 0x0000_0200;
2467
/// Module contains valid control flow target metadata
2468
pub const IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT: u32 = 0x0000_0400;
2469
/// Module does not make use of the /GS security cookie
2470
pub const IMAGE_GUARD_SECURITY_COOKIE_UNUSED: u32 = 0x0000_0800;
2471
/// Module supports read only delay load IAT
2472
pub const IMAGE_GUARD_PROTECT_DELAYLOAD_IAT: u32 = 0x0000_1000;
2473
/// Delayload import table in its own .didat section (with nothing else in it) that can be freely reprotected
2474
pub const IMAGE_GUARD_DELAYLOAD_IAT_IN_ITS_OWN_SECTION: u32 = 0x0000_2000;
2475
/// Module contains suppressed export information.
2476
///
2477
/// This also infers that the address taken taken IAT table is also present in the load config.
2478
pub const IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT: u32 = 0x0000_4000;
2479
/// Module enables suppression of exports
2480
pub const IMAGE_GUARD_CF_ENABLE_EXPORT_SUPPRESSION: u32 = 0x0000_8000;
2481
/// Module contains longjmp target information
2482
pub const IMAGE_GUARD_CF_LONGJUMP_TABLE_PRESENT: u32 = 0x0001_0000;
2483
/// Module contains return flow instrumentation and metadata
2484
pub const IMAGE_GUARD_RF_INSTRUMENTED: u32 = 0x0002_0000;
2485
/// Module requests that the OS enable return flow protection
2486
pub const IMAGE_GUARD_RF_ENABLE: u32 = 0x0004_0000;
2487
/// Module requests that the OS enable return flow protection in strict mode
2488
pub const IMAGE_GUARD_RF_STRICT: u32 = 0x0008_0000;
2489
/// Module was built with retpoline support
2490
pub const IMAGE_GUARD_RETPOLINE_PRESENT: u32 = 0x0010_0000;
2491
2492
/// Stride of Guard CF function table encoded in these bits (additional count of bytes per element)
2493
pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_MASK: u32 = 0xF000_0000;
2494
/// Shift to right-justify Guard CF function table stride
2495
pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_SHIFT: u32 = 28;
2496
2497
//
2498
// GFIDS table entry flags.
2499
//
2500
2501
/// The containing GFID entry is suppressed
2502
pub const IMAGE_GUARD_FLAG_FID_SUPPRESSED: u16 = 0x01;
2503
/// The containing GFID entry is export suppressed
2504
pub const IMAGE_GUARD_FLAG_EXPORT_SUPPRESSED: u16 = 0x02;
2505
2506
//
2507
// WIN CE Exception table format
2508
//
2509
2510
//
2511
// Function table entry format.  Function table is pointed to by the
2512
// IMAGE_DIRECTORY_ENTRY_EXCEPTION directory entry.
2513
//
2514
2515
/*
2516
// TODO? bitfields
2517
#[derive(Debug, Clone, Copy)]
2518
#[repr(C)]
2519
pub struct ImageCeRuntimeFunctionEntry {
2520
    pub func_start: U32<LE>,
2521
    DWORD PrologLen : 8;
2522
    DWORD FuncLen : 22;
2523
    DWORD ThirtyTwoBit : 1;
2524
    DWORD ExceptionFlag : 1;
2525
}
2526
*/
2527
2528
#[derive(Debug, Clone, Copy)]
2529
#[repr(C)]
2530
pub struct ImageArmRuntimeFunctionEntry {
2531
    pub begin_address: U32<LE>,
2532
    pub unwind_data: U32<LE>,
2533
}
2534
2535
#[derive(Debug, Clone, Copy)]
2536
#[repr(C)]
2537
pub struct ImageArm64RuntimeFunctionEntry {
2538
    pub begin_address: U32<LE>,
2539
    pub unwind_data: U32<LE>,
2540
}
2541
2542
#[derive(Debug, Clone, Copy)]
2543
#[repr(C)]
2544
pub struct ImageAlpha64RuntimeFunctionEntry {
2545
    pub begin_address: U64<LE>,
2546
    pub end_address: U64<LE>,
2547
    pub exception_handler: U64<LE>,
2548
    pub handler_data: U64<LE>,
2549
    pub prolog_end_address: U64<LE>,
2550
}
2551
2552
#[derive(Debug, Clone, Copy)]
2553
#[repr(C)]
2554
pub struct ImageAlphaRuntimeFunctionEntry {
2555
    pub begin_address: U32<LE>,
2556
    pub end_address: U32<LE>,
2557
    pub exception_handler: U32<LE>,
2558
    pub handler_data: U32<LE>,
2559
    pub prolog_end_address: U32<LE>,
2560
}
2561
2562
#[derive(Debug, Clone, Copy)]
2563
#[repr(C)]
2564
pub struct ImageRuntimeFunctionEntry {
2565
    pub begin_address: U32<LE>,
2566
    pub end_address: U32<LE>,
2567
    pub unwind_info_address_or_data: U32<LE>,
2568
}
2569
2570
//
2571
// Software enclave information
2572
//
2573
2574
pub const IMAGE_ENCLAVE_LONG_ID_LENGTH: usize = 32;
2575
pub const IMAGE_ENCLAVE_SHORT_ID_LENGTH: usize = 16;
2576
2577
#[derive(Debug, Clone, Copy)]
2578
#[repr(C)]
2579
pub struct ImageEnclaveConfig32 {
2580
    pub size: U32<LE>,
2581
    pub minimum_required_config_size: U32<LE>,
2582
    pub policy_flags: U32<LE>,
2583
    pub number_of_imports: U32<LE>,
2584
    pub import_list: U32<LE>,
2585
    pub import_entry_size: U32<LE>,
2586
    pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2587
    pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2588
    pub image_version: U32<LE>,
2589
    pub security_version: U32<LE>,
2590
    pub enclave_size: U32<LE>,
2591
    pub number_of_threads: U32<LE>,
2592
    pub enclave_flags: U32<LE>,
2593
}
2594
2595
#[derive(Debug, Clone, Copy)]
2596
#[repr(C)]
2597
pub struct ImageEnclaveConfig64 {
2598
    pub size: U32<LE>,
2599
    pub minimum_required_config_size: U32<LE>,
2600
    pub policy_flags: U32<LE>,
2601
    pub number_of_imports: U32<LE>,
2602
    pub import_list: U32<LE>,
2603
    pub import_entry_size: U32<LE>,
2604
    pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2605
    pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2606
    pub image_version: U32<LE>,
2607
    pub security_version: U32<LE>,
2608
    pub enclave_size: U64<LE>,
2609
    pub number_of_threads: U32<LE>,
2610
    pub enclave_flags: U32<LE>,
2611
}
2612
2613
//pub const IMAGE_ENCLAVE_MINIMUM_CONFIG_SIZE: usize = FIELD_OFFSET(IMAGE_ENCLAVE_CONFIG, EnclaveFlags);
2614
2615
pub const IMAGE_ENCLAVE_POLICY_DEBUGGABLE: u32 = 0x0000_0001;
2616
2617
pub const IMAGE_ENCLAVE_FLAG_PRIMARY_IMAGE: u32 = 0x0000_0001;
2618
2619
#[derive(Debug, Clone, Copy)]
2620
#[repr(C)]
2621
pub struct ImageEnclaveImport {
2622
    pub match_type: U32<LE>,
2623
    pub minimum_security_version: U32<LE>,
2624
    pub unique_or_author_id: [u8; IMAGE_ENCLAVE_LONG_ID_LENGTH],
2625
    pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2626
    pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2627
    pub import_name: U32<LE>,
2628
    pub reserved: U32<LE>,
2629
}
2630
2631
pub const IMAGE_ENCLAVE_IMPORT_MATCH_NONE: u32 = 0x0000_0000;
2632
pub const IMAGE_ENCLAVE_IMPORT_MATCH_UNIQUE_ID: u32 = 0x0000_0001;
2633
pub const IMAGE_ENCLAVE_IMPORT_MATCH_AUTHOR_ID: u32 = 0x0000_0002;
2634
pub const IMAGE_ENCLAVE_IMPORT_MATCH_FAMILY_ID: u32 = 0x0000_0003;
2635
pub const IMAGE_ENCLAVE_IMPORT_MATCH_IMAGE_ID: u32 = 0x0000_0004;
2636
2637
//
2638
// Debug Format
2639
//
2640
2641
#[derive(Debug, Clone, Copy)]
2642
#[repr(C)]
2643
pub struct ImageDebugDirectory {
2644
    pub characteristics: U32<LE>,
2645
    pub time_date_stamp: U32<LE>,
2646
    pub major_version: U16<LE>,
2647
    pub minor_version: U16<LE>,
2648
    pub typ: U32<LE>,
2649
    pub size_of_data: U32<LE>,
2650
    pub address_of_raw_data: U32<LE>,
2651
    pub pointer_to_raw_data: U32<LE>,
2652
}
2653
2654
pub const IMAGE_DEBUG_TYPE_UNKNOWN: u32 = 0;
2655
pub const IMAGE_DEBUG_TYPE_COFF: u32 = 1;
2656
pub const IMAGE_DEBUG_TYPE_CODEVIEW: u32 = 2;
2657
pub const IMAGE_DEBUG_TYPE_FPO: u32 = 3;
2658
pub const IMAGE_DEBUG_TYPE_MISC: u32 = 4;
2659
pub const IMAGE_DEBUG_TYPE_EXCEPTION: u32 = 5;
2660
pub const IMAGE_DEBUG_TYPE_FIXUP: u32 = 6;
2661
pub const IMAGE_DEBUG_TYPE_OMAP_TO_SRC: u32 = 7;
2662
pub const IMAGE_DEBUG_TYPE_OMAP_FROM_SRC: u32 = 8;
2663
pub const IMAGE_DEBUG_TYPE_BORLAND: u32 = 9;
2664
pub const IMAGE_DEBUG_TYPE_RESERVED10: u32 = 10;
2665
pub const IMAGE_DEBUG_TYPE_CLSID: u32 = 11;
2666
pub const IMAGE_DEBUG_TYPE_VC_FEATURE: u32 = 12;
2667
pub const IMAGE_DEBUG_TYPE_POGO: u32 = 13;
2668
pub const IMAGE_DEBUG_TYPE_ILTCG: u32 = 14;
2669
pub const IMAGE_DEBUG_TYPE_MPX: u32 = 15;
2670
pub const IMAGE_DEBUG_TYPE_REPRO: u32 = 16;
2671
2672
#[derive(Debug, Clone, Copy)]
2673
#[repr(C)]
2674
pub struct ImageCoffSymbolsHeader {
2675
    pub number_of_symbols: U32<LE>,
2676
    pub lva_to_first_symbol: U32<LE>,
2677
    pub number_of_linenumbers: U32<LE>,
2678
    pub lva_to_first_linenumber: U32<LE>,
2679
    pub rva_to_first_byte_of_code: U32<LE>,
2680
    pub rva_to_last_byte_of_code: U32<LE>,
2681
    pub rva_to_first_byte_of_data: U32<LE>,
2682
    pub rva_to_last_byte_of_data: U32<LE>,
2683
}
2684
2685
pub const FRAME_FPO: u16 = 0;
2686
pub const FRAME_TRAP: u16 = 1;
2687
pub const FRAME_TSS: u16 = 2;
2688
pub const FRAME_NONFPO: u16 = 3;
2689
2690
/*
2691
// TODO? bitfields
2692
#[derive(Debug, Clone, Copy)]
2693
#[repr(C)]
2694
pub struct FpoData {
2695
/// offset 1st byte of function code
2696
    pub ul_off_start: U32<LE>,
2697
/// # bytes in function
2698
    pub cb_proc_size: U32<LE>,
2699
/// # bytes in locals/4
2700
    pub cdw_locals: U32<LE>,
2701
/// # bytes in params/4
2702
    pub cdw_params: U16<LE>,
2703
/// # bytes in prolog
2704
    WORD        cbProlog : 8;
2705
/// # regs saved
2706
    WORD        cbRegs   : 3;
2707
/// TRUE if SEH in func
2708
    WORD        fHasSEH  : 1;
2709
/// TRUE if EBP has been allocated
2710
    WORD        fUseBP   : 1;
2711
/// reserved for future use
2712
    WORD        reserved : 1;
2713
/// frame type
2714
    WORD        cbFrame  : 2;
2715
}
2716
pub const SIZEOF_RFPO_DATA: usize = 16;
2717
*/
2718
2719
pub const IMAGE_DEBUG_MISC_EXENAME: u16 = 1;
2720
2721
#[derive(Debug, Clone, Copy)]
2722
#[repr(C)]
2723
pub struct ImageDebugMisc {
2724
    /// type of misc data, see defines
2725
    pub data_type: U32<LE>,
2726
    /// total length of record, rounded to four byte multiple.
2727
    pub length: U32<LE>,
2728
    /// TRUE if data is unicode string
2729
    pub unicode: u8,
2730
    pub reserved: [u8; 3],
2731
    // Actual data
2732
    //pub data: [u8; 1],
2733
}
2734
2735
//
2736
// Function table extracted from MIPS/ALPHA/IA64 images.  Does not contain
2737
// information needed only for runtime support.  Just those fields for
2738
// each entry needed by a debugger.
2739
//
2740
2741
#[derive(Debug, Clone, Copy)]
2742
#[repr(C)]
2743
pub struct ImageFunctionEntry {
2744
    pub starting_address: U32<LE>,
2745
    pub ending_address: U32<LE>,
2746
    pub end_of_prologue: U32<LE>,
2747
}
2748
2749
#[derive(Debug, Clone, Copy)]
2750
#[repr(C)]
2751
pub struct ImageFunctionEntry64 {
2752
    pub starting_address: U64<LE>,
2753
    pub ending_address: U64<LE>,
2754
    pub end_of_prologue_or_unwind_info_address: U64<LE>,
2755
}
2756
2757
//
2758
// Debugging information can be stripped from an image file and placed
2759
// in a separate .DBG file, whose file name part is the same as the
2760
// image file name part (e.g. symbols for CMD.EXE could be stripped
2761
// and placed in CMD.DBG).  This is indicated by the IMAGE_FILE_DEBUG_STRIPPED
2762
// flag in the Characteristics field of the file header.  The beginning of
2763
// the .DBG file contains the following structure which captures certain
2764
// information from the image file.  This allows a debug to proceed even if
2765
// the original image file is not accessible.  This header is followed by
2766
// zero of more IMAGE_SECTION_HEADER structures, followed by zero or more
2767
// IMAGE_DEBUG_DIRECTORY structures.  The latter structures and those in
2768
// the image file contain file offsets relative to the beginning of the
2769
// .DBG file.
2770
//
2771
// If symbols have been stripped from an image, the IMAGE_DEBUG_MISC structure
2772
// is left in the image file, but not mapped.  This allows a debugger to
2773
// compute the name of the .DBG file, from the name of the image in the
2774
// IMAGE_DEBUG_MISC structure.
2775
//
2776
2777
#[derive(Debug, Clone, Copy)]
2778
#[repr(C)]
2779
pub struct ImageSeparateDebugHeader {
2780
    pub signature: U16<LE>,
2781
    pub flags: U16<LE>,
2782
    pub machine: U16<LE>,
2783
    pub characteristics: U16<LE>,
2784
    pub time_date_stamp: U32<LE>,
2785
    pub check_sum: U32<LE>,
2786
    pub image_base: U32<LE>,
2787
    pub size_of_image: U32<LE>,
2788
    pub number_of_sections: U32<LE>,
2789
    pub exported_names_size: U32<LE>,
2790
    pub debug_directory_size: U32<LE>,
2791
    pub section_alignment: U32<LE>,
2792
    pub reserved: [U32<LE>; 2],
2793
}
2794
2795
#[derive(Debug, Clone, Copy)]
2796
#[repr(C)]
2797
pub struct NonPagedDebugInfo {
2798
    pub signature: U16<LE>,
2799
    pub flags: U16<LE>,
2800
    pub size: U32<LE>,
2801
    pub machine: U16<LE>,
2802
    pub characteristics: U16<LE>,
2803
    pub time_date_stamp: U32<LE>,
2804
    pub check_sum: U32<LE>,
2805
    pub size_of_image: U32<LE>,
2806
    pub image_base: U64<LE>,
2807
    //debug_directory_size
2808
    //ImageDebugDirectory
2809
}
2810
2811
pub const IMAGE_SEPARATE_DEBUG_SIGNATURE: u16 = 0x4944;
2812
pub const NON_PAGED_DEBUG_SIGNATURE: u16 = 0x494E;
2813
2814
pub const IMAGE_SEPARATE_DEBUG_FLAGS_MASK: u16 = 0x8000;
2815
/// when DBG was updated, the old checksum didn't match.
2816
pub const IMAGE_SEPARATE_DEBUG_MISMATCH: u16 = 0x8000;
2817
2818
//
2819
//  The .arch section is made up of headers, each describing an amask position/value
2820
//  pointing to an array of IMAGE_ARCHITECTURE_ENTRY's.  Each "array" (both the header
2821
//  and entry arrays) are terminiated by a quadword of 0xffffffffL.
2822
//
2823
//  NOTE: There may be quadwords of 0 sprinkled around and must be skipped.
2824
//
2825
2826
/*
2827
// TODO? bitfields
2828
#[derive(Debug, Clone, Copy)]
2829
#[repr(C)]
2830
pub struct ImageArchitectureHeader {
2831
    /// 1 -> code section depends on mask bit
2832
    /// 0 -> new instruction depends on mask bit
2833
    unsigned int AmaskValue: 1;
2834
    /// MBZ
2835
    int :7;
2836
    /// Amask bit in question for this fixup
2837
    unsigned int AmaskShift: 8;
2838
    /// MBZ
2839
    int :16;
2840
    /// RVA into .arch section to array of ARCHITECTURE_ENTRY's
2841
    pub first_entry_rva: U32<LE>,
2842
}
2843
*/
2844
2845
#[derive(Debug, Clone, Copy)]
2846
#[repr(C)]
2847
pub struct ImageArchitectureEntry {
2848
    /// RVA of instruction to fixup
2849
    pub fixup_inst_rva: U32<LE>,
2850
    /// fixup instruction (see alphaops.h)
2851
    pub new_inst: U32<LE>,
2852
}
2853
2854
// The following structure defines the new import object.  Note the values of the first two fields,
2855
// which must be set as stated in order to differentiate old and new import members.
2856
// Following this structure, the linker emits two null-terminated strings used to recreate the
2857
// import at the time of use.  The first string is the import's name, the second is the dll's name.
2858
2859
pub const IMPORT_OBJECT_HDR_SIG2: u16 = 0xffff;
2860
2861
#[derive(Debug, Clone, Copy)]
2862
#[repr(C)]
2863
pub struct ImportObjectHeader {
2864
    /// Must be IMAGE_FILE_MACHINE_UNKNOWN
2865
    pub sig1: U16<LE>,
2866
    /// Must be IMPORT_OBJECT_HDR_SIG2.
2867
    pub sig2: U16<LE>,
2868
    pub version: U16<LE>,
2869
    pub machine: U16<LE>,
2870
    /// Time/date stamp
2871
    pub time_date_stamp: U32<LE>,
2872
    /// particularly useful for incremental links
2873
    pub size_of_data: U32<LE>,
2874
2875
    /// if grf & IMPORT_OBJECT_ORDINAL
2876
    pub ordinal_or_hint: U16<LE>,
2877
2878
    // WORD    Type : 2;
2879
    // WORD    NameType : 3;
2880
    // WORD    Reserved : 11;
2881
    pub name_type: U16<LE>,
2882
}
2883
2884
pub const IMPORT_OBJECT_TYPE_MASK: u16 = 0b11;
2885
pub const IMPORT_OBJECT_TYPE_SHIFT: u16 = 0;
2886
pub const IMPORT_OBJECT_CODE: u16 = 0;
2887
pub const IMPORT_OBJECT_DATA: u16 = 1;
2888
pub const IMPORT_OBJECT_CONST: u16 = 2;
2889
2890
pub const IMPORT_OBJECT_NAME_MASK: u16 = 0b111;
2891
pub const IMPORT_OBJECT_NAME_SHIFT: u16 = 2;
2892
/// Import by ordinal
2893
pub const IMPORT_OBJECT_ORDINAL: u16 = 0;
2894
/// Import name == public symbol name.
2895
pub const IMPORT_OBJECT_NAME: u16 = 1;
2896
/// Import name == public symbol name skipping leading ?, @, or optionally _.
2897
pub const IMPORT_OBJECT_NAME_NO_PREFIX: u16 = 2;
2898
/// Import name == public symbol name skipping leading ?, @, or optionally _ and truncating at first @.
2899
pub const IMPORT_OBJECT_NAME_UNDECORATE: u16 = 3;
2900
/// Import name == a name is explicitly provided after the DLL name.
2901
pub const IMPORT_OBJECT_NAME_EXPORTAS: u16 = 4;
2902
2903
// COM+ Header entry point flags.
2904
pub const COMIMAGE_FLAGS_ILONLY: u32 = 0x0000_0001;
2905
pub const COMIMAGE_FLAGS_32BITREQUIRED: u32 = 0x0000_0002;
2906
pub const COMIMAGE_FLAGS_IL_LIBRARY: u32 = 0x0000_0004;
2907
pub const COMIMAGE_FLAGS_STRONGNAMESIGNED: u32 = 0x0000_0008;
2908
pub const COMIMAGE_FLAGS_NATIVE_ENTRYPOINT: u32 = 0x0000_0010;
2909
pub const COMIMAGE_FLAGS_TRACKDEBUGDATA: u32 = 0x0001_0000;
2910
pub const COMIMAGE_FLAGS_32BITPREFERRED: u32 = 0x0002_0000;
2911
2912
// Version flags for image.
2913
pub const COR_VERSION_MAJOR_V2: u16 = 2;
2914
pub const COR_VERSION_MAJOR: u16 = COR_VERSION_MAJOR_V2;
2915
pub const COR_VERSION_MINOR: u16 = 5;
2916
pub const COR_DELETED_NAME_LENGTH: usize = 8;
2917
pub const COR_VTABLEGAP_NAME_LENGTH: usize = 8;
2918
2919
// Maximum size of a NativeType descriptor.
2920
pub const NATIVE_TYPE_MAX_CB: u16 = 1;
2921
pub const COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE: u16 = 0xFF;
2922
2923
// Consts for the MIH FLAGS
2924
pub const IMAGE_COR_MIH_METHODRVA: u16 = 0x01;
2925
pub const IMAGE_COR_MIH_EHRVA: u16 = 0x02;
2926
pub const IMAGE_COR_MIH_BASICBLOCK: u16 = 0x08;
2927
2928
// V-table constants
2929
/// V-table slots are 32-bits in size.
2930
pub const COR_VTABLE_32BIT: u16 = 0x01;
2931
/// V-table slots are 64-bits in size.
2932
pub const COR_VTABLE_64BIT: u16 = 0x02;
2933
/// If set, transition from unmanaged.
2934
pub const COR_VTABLE_FROM_UNMANAGED: u16 = 0x04;
2935
/// If set, transition from unmanaged with keeping the current appdomain.
2936
pub const COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN: u16 = 0x08;
2937
/// Call most derived method described by
2938
pub const COR_VTABLE_CALL_MOST_DERIVED: u16 = 0x10;
2939
2940
// EATJ constants
2941
/// Size of a jump thunk reserved range.
2942
pub const IMAGE_COR_EATJ_THUNK_SIZE: usize = 32;
2943
2944
// Max name lengths
2945
pub const MAX_CLASS_NAME: usize = 1024;
2946
pub const MAX_PACKAGE_NAME: usize = 1024;
2947
2948
// CLR 2.0 header structure.
2949
#[derive(Debug, Clone, Copy)]
2950
#[repr(C)]
2951
pub struct ImageCor20Header {
2952
    // Header versioning
2953
    pub cb: U32<LE>,
2954
    pub major_runtime_version: U16<LE>,
2955
    pub minor_runtime_version: U16<LE>,
2956
2957
    // Symbol table and startup information
2958
    pub meta_data: ImageDataDirectory,
2959
    pub flags: U32<LE>,
2960
2961
    // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is not set, EntryPointToken represents a managed entrypoint.
2962
    // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is set, EntryPointRVA represents an RVA to a native entrypoint.
2963
    pub entry_point_token_or_rva: U32<LE>,
2964
2965
    // Binding information
2966
    pub resources: ImageDataDirectory,
2967
    pub strong_name_signature: ImageDataDirectory,
2968
2969
    // Regular fixup and binding information
2970
    pub code_manager_table: ImageDataDirectory,
2971
    pub vtable_fixups: ImageDataDirectory,
2972
    pub export_address_table_jumps: ImageDataDirectory,
2973
2974
    // Precompiled image info (internal use only - set to zero)
2975
    pub managed_native_header: ImageDataDirectory,
2976
}
2977
2978
unsafe_impl_pod!(
2979
    ImageDosHeader,
2980
    ImageOs2Header,
2981
    ImageVxdHeader,
2982
    ImageFileHeader,
2983
    ImageDataDirectory,
2984
    ImageOptionalHeader32,
2985
    ImageRomOptionalHeader,
2986
    ImageOptionalHeader64,
2987
    ImageNtHeaders64,
2988
    ImageNtHeaders32,
2989
    ImageRomHeaders,
2990
    Guid,
2991
    AnonObjectHeader,
2992
    AnonObjectHeaderV2,
2993
    AnonObjectHeaderBigobj,
2994
    ImageSectionHeader,
2995
    ImageSymbol,
2996
    ImageSymbolBytes,
2997
    ImageSymbolEx,
2998
    ImageSymbolExBytes,
2999
    ImageAuxSymbolTokenDef,
3000
    ImageAuxSymbolFunction,
3001
    ImageAuxSymbolFunctionBeginEnd,
3002
    ImageAuxSymbolWeak,
3003
    ImageAuxSymbolSection,
3004
    ImageAuxSymbolCrc,
3005
    ImageRelocation,
3006
    ImageLinenumber,
3007
    ImageBaseRelocation,
3008
    ImageArchiveMemberHeader,
3009
    ImageExportDirectory,
3010
    ImageImportByName,
3011
    ImageThunkData64,
3012
    ImageThunkData32,
3013
    ImageTlsDirectory64,
3014
    ImageTlsDirectory32,
3015
    ImageImportDescriptor,
3016
    ImageBoundImportDescriptor,
3017
    ImageBoundForwarderRef,
3018
    ImageDelayloadDescriptor,
3019
    ImageResourceDirectory,
3020
    ImageResourceDirectoryEntry,
3021
    ImageResourceDirectoryString,
3022
    ImageResourceDirStringU,
3023
    ImageResourceDataEntry,
3024
    ImageLoadConfigCodeIntegrity,
3025
    ImageDynamicRelocationTable,
3026
    ImageDynamicRelocation32,
3027
    ImageDynamicRelocation64,
3028
    ImageDynamicRelocation32V2,
3029
    ImageDynamicRelocation64V2,
3030
    ImagePrologueDynamicRelocationHeader,
3031
    ImageEpilogueDynamicRelocationHeader,
3032
    //ImageImportControlTransferDynamicRelocation,
3033
    //ImageIndirControlTransferDynamicRelocation,
3034
    //ImageSwitchtableBranchDynamicRelocation,
3035
    ImageLoadConfigDirectory32,
3036
    ImageLoadConfigDirectory64,
3037
    ImageHotPatchInfo,
3038
    ImageHotPatchBase,
3039
    ImageHotPatchHashes,
3040
    //ImageCeRuntimeFunctionEntry,
3041
    ImageArmRuntimeFunctionEntry,
3042
    ImageArm64RuntimeFunctionEntry,
3043
    ImageAlpha64RuntimeFunctionEntry,
3044
    ImageAlphaRuntimeFunctionEntry,
3045
    ImageRuntimeFunctionEntry,
3046
    ImageEnclaveConfig32,
3047
    ImageEnclaveConfig64,
3048
    ImageEnclaveImport,
3049
    ImageDebugDirectory,
3050
    ImageCoffSymbolsHeader,
3051
    //FpoData,
3052
    ImageDebugMisc,
3053
    ImageFunctionEntry,
3054
    ImageFunctionEntry64,
3055
    ImageSeparateDebugHeader,
3056
    NonPagedDebugInfo,
3057
    //ImageArchitectureHeader,
3058
    ImageArchitectureEntry,
3059
    ImportObjectHeader,
3060
    ImageCor20Header,
3061
    MaskedRichHeaderEntry,
3062
);