📄 ntimage.h
字号:
#define IMAGE_REL_PPC_SECRELHI 0x0014 // High 16-bit section relative reference (used for >32k TLS)
#define IMAGE_REL_PPC_GPREL 0x0015
#define IMAGE_REL_PPC_TOKEN 0x0016 // clr token
#define IMAGE_REL_PPC_TYPEMASK 0x00FF // mask to isolate above values in IMAGE_RELOCATION.Type
// Flag bits in IMAGE_RELOCATION.TYPE
#define IMAGE_REL_PPC_NEG 0x0100 // subtract reloc value rather than adding it
#define IMAGE_REL_PPC_BRTAKEN 0x0200 // fix branch prediction bit to predict branch taken
#define IMAGE_REL_PPC_BRNTAKEN 0x0400 // fix branch prediction bit to predict branch not taken
#define IMAGE_REL_PPC_TOCDEFN 0x0800 // toc slot defined in file (or, data in toc)
//
// Hitachi SH3 relocation types.
//
#define IMAGE_REL_SH3_ABSOLUTE 0x0000 // No relocation
#define IMAGE_REL_SH3_DIRECT16 0x0001 // 16 bit direct
#define IMAGE_REL_SH3_DIRECT32 0x0002 // 32 bit direct
#define IMAGE_REL_SH3_DIRECT8 0x0003 // 8 bit direct, -128..255
#define IMAGE_REL_SH3_DIRECT8_WORD 0x0004 // 8 bit direct .W (0 ext.)
#define IMAGE_REL_SH3_DIRECT8_LONG 0x0005 // 8 bit direct .L (0 ext.)
#define IMAGE_REL_SH3_DIRECT4 0x0006 // 4 bit direct (0 ext.)
#define IMAGE_REL_SH3_DIRECT4_WORD 0x0007 // 4 bit direct .W (0 ext.)
#define IMAGE_REL_SH3_DIRECT4_LONG 0x0008 // 4 bit direct .L (0 ext.)
#define IMAGE_REL_SH3_PCREL8_WORD 0x0009 // 8 bit PC relative .W
#define IMAGE_REL_SH3_PCREL8_LONG 0x000A // 8 bit PC relative .L
#define IMAGE_REL_SH3_PCREL12_WORD 0x000B // 12 LSB PC relative .W
#define IMAGE_REL_SH3_STARTOF_SECTION 0x000C // Start of EXE section
#define IMAGE_REL_SH3_SIZEOF_SECTION 0x000D // Size of EXE section
#define IMAGE_REL_SH3_SECTION 0x000E // Section table index
#define IMAGE_REL_SH3_SECREL 0x000F // Offset within section
#define IMAGE_REL_SH3_DIRECT32_NB 0x0010 // 32 bit direct not based
#define IMAGE_REL_SH3_GPREL4_LONG 0x0011 // GP-relative addressing
#define IMAGE_REL_SH3_TOKEN 0x0012 // clr token
#define IMAGE_REL_ARM_ABSOLUTE 0x0000 // No relocation required
#define IMAGE_REL_ARM_ADDR32 0x0001 // 32 bit address
#define IMAGE_REL_ARM_ADDR32NB 0x0002 // 32 bit address w/o image base
#define IMAGE_REL_ARM_BRANCH24 0x0003 // 24 bit offset << 2 & sign ext.
#define IMAGE_REL_ARM_BRANCH11 0x0004 // Thumb: 2 11 bit offsets
#define IMAGE_REL_ARM_TOKEN 0x0005 // clr token
#define IMAGE_REL_ARM_GPREL12 0x0006 // GP-relative addressing (ARM)
#define IMAGE_REL_ARM_GPREL7 0x0007 // GP-relative addressing (Thumb)
#define IMAGE_REL_ARM_BLX24 0x0008
#define IMAGE_REL_ARM_BLX11 0x0009
#define IMAGE_REL_ARM_SECTION 0x000E // Section table index
#define IMAGE_REL_ARM_SECREL 0x000F // Offset within section
#define IMAGE_REL_AM_ABSOLUTE 0x0000
#define IMAGE_REL_AM_ADDR32 0x0001
#define IMAGE_REL_AM_ADDR32NB 0x0002
#define IMAGE_REL_AM_CALL32 0x0003
#define IMAGE_REL_AM_FUNCINFO 0x0004
#define IMAGE_REL_AM_REL32_1 0x0005
#define IMAGE_REL_AM_REL32_2 0x0006
#define IMAGE_REL_AM_SECREL 0x0007
#define IMAGE_REL_AM_SECTION 0x0008
#define IMAGE_REL_AM_TOKEN 0x0009
//
// X86-64 relocations
//
#define IMAGE_REL_AMD64_ABSOLUTE 0x0000 // Reference is absolute, no relocation is necessary
#define IMAGE_REL_AMD64_ADDR64 0x0001 // 64-bit address (VA).
#define IMAGE_REL_AMD64_ADDR32 0x0002 // 32-bit address (VA).
#define IMAGE_REL_AMD64_ADDR32NB 0x0003 // 32-bit address w/o image base (RVA).
#define IMAGE_REL_AMD64_REL32 0x0004 // 32-bit relative address from byte following reloc
#define IMAGE_REL_AMD64_REL32_1 0x0005 // 32-bit relative address from byte distance 1 from reloc
#define IMAGE_REL_AMD64_REL32_2 0x0006 // 32-bit relative address from byte distance 2 from reloc
#define IMAGE_REL_AMD64_REL32_3 0x0007 // 32-bit relative address from byte distance 3 from reloc
#define IMAGE_REL_AMD64_REL32_4 0x0008 // 32-bit relative address from byte distance 4 from reloc
#define IMAGE_REL_AMD64_REL32_5 0x0009 // 32-bit relative address from byte distance 5 from reloc
#define IMAGE_REL_AMD64_SECTION 0x000A // Section index
#define IMAGE_REL_AMD64_SECREL 0x000B // 32 bit offset from base of section containing target
#define IMAGE_REL_AMD64_SECREL7 0x000C // 7 bit unsigned offset from base of section containing target
#define IMAGE_REL_AMD64_TOKEN 0x000D // 32 bit metadata token
//
// IA64 relocation types.
//
#define IMAGE_REL_IA64_ABSOLUTE 0x0000
#define IMAGE_REL_IA64_IMM14 0x0001
#define IMAGE_REL_IA64_IMM22 0x0002
#define IMAGE_REL_IA64_IMM64 0x0003
#define IMAGE_REL_IA64_DIR32 0x0004
#define IMAGE_REL_IA64_DIR64 0x0005
#define IMAGE_REL_IA64_PCREL21B 0x0006
#define IMAGE_REL_IA64_PCREL21M 0x0007
#define IMAGE_REL_IA64_PCREL21F 0x0008
#define IMAGE_REL_IA64_GPREL22 0x0009
#define IMAGE_REL_IA64_LTOFF22 0x000A
#define IMAGE_REL_IA64_SECTION 0x000B
#define IMAGE_REL_IA64_SECREL22 0x000C
#define IMAGE_REL_IA64_SECREL64I 0x000D
#define IMAGE_REL_IA64_SECREL32 0x000E
//
#define IMAGE_REL_IA64_DIR32NB 0x0010
#define IMAGE_REL_IA64_SREL14 0x0011
#define IMAGE_REL_IA64_SREL22 0x0012
#define IMAGE_REL_IA64_SREL32 0x0013
#define IMAGE_REL_IA64_UREL32 0x0014
#define IMAGE_REL_IA64_PCREL60X 0x0015 // This is always a BRL and never converted
#define IMAGE_REL_IA64_PCREL60B 0x0016 // If possible, convert to MBB bundle with NOP.B in slot 1
#define IMAGE_REL_IA64_PCREL60F 0x0017 // If possible, convert to MFB bundle with NOP.F in slot 1
#define IMAGE_REL_IA64_PCREL60I 0x0018 // If possible, convert to MIB bundle with NOP.I in slot 1
#define IMAGE_REL_IA64_PCREL60M 0x0019 // If possible, convert to MMB bundle with NOP.M in slot 1
#define IMAGE_REL_IA64_IMMGPREL64 0x001A
#define IMAGE_REL_IA64_TOKEN 0x001B // clr token
#define IMAGE_REL_IA64_GPREL32 0x001C
#define IMAGE_REL_IA64_ADDEND 0x001F
//
// CEF relocation types.
//
#define IMAGE_REL_CEF_ABSOLUTE 0x0000 // Reference is absolute, no relocation is necessary
#define IMAGE_REL_CEF_ADDR32 0x0001 // 32-bit address (VA).
#define IMAGE_REL_CEF_ADDR64 0x0002 // 64-bit address (VA).
#define IMAGE_REL_CEF_ADDR32NB 0x0003 // 32-bit address w/o image base (RVA).
#define IMAGE_REL_CEF_SECTION 0x0004 // Section index
#define IMAGE_REL_CEF_SECREL 0x0005 // 32 bit offset from base of section containing target
#define IMAGE_REL_CEF_TOKEN 0x0006 // 32 bit metadata token
//
// clr relocation types.
//
#define IMAGE_REL_CEE_ABSOLUTE 0x0000 // Reference is absolute, no relocation is necessary
#define IMAGE_REL_CEE_ADDR32 0x0001 // 32-bit address (VA).
#define IMAGE_REL_CEE_ADDR64 0x0002 // 64-bit address (VA).
#define IMAGE_REL_CEE_ADDR32NB 0x0003 // 32-bit address w/o image base (RVA).
#define IMAGE_REL_CEE_SECTION 0x0004 // Section index
#define IMAGE_REL_CEE_SECREL 0x0005 // 32 bit offset from base of section containing target
#define IMAGE_REL_CEE_TOKEN 0x0006 // 32 bit metadata token
#define IMAGE_REL_M32R_ABSOLUTE 0x0000 // No relocation required
#define IMAGE_REL_M32R_ADDR32 0x0001 // 32 bit address
#define IMAGE_REL_M32R_ADDR32NB 0x0002 // 32 bit address w/o image base
#define IMAGE_REL_M32R_ADDR24 0x0003 // 24 bit address
#define IMAGE_REL_M32R_GPREL16 0x0004 // GP relative addressing
#define IMAGE_REL_M32R_PCREL24 0x0005 // 24 bit offset << 2 & sign ext.
#define IMAGE_REL_M32R_PCREL16 0x0006 // 16 bit offset << 2 & sign ext.
#define IMAGE_REL_M32R_PCREL8 0x0007 // 8 bit offset << 2 & sign ext.
#define IMAGE_REL_M32R_REFHALF 0x0008 // 16 MSBs
#define IMAGE_REL_M32R_REFHI 0x0009 // 16 MSBs; adj for LSB sign ext.
#define IMAGE_REL_M32R_REFLO 0x000A // 16 LSBs
#define IMAGE_REL_M32R_PAIR 0x000B // Link HI and LO
#define IMAGE_REL_M32R_SECTION 0x000C // Section table index
#define IMAGE_REL_M32R_SECREL32 0x000D // 32 bit section relative reference
#define IMAGE_REL_M32R_TOKEN 0x000E // clr token
#define EXT_IMM64(Value, Address, Size, InstPos, ValPos) /* Intel-IA64-Filler */ \
Value |= (((ULONGLONG)((*(Address) >> InstPos) & (((ULONGLONG)1 << Size) - 1))) << ValPos) // Intel-IA64-Filler
#define INS_IMM64(Value, Address, Size, InstPos, ValPos) /* Intel-IA64-Filler */\
*(PULONG)Address = (*(PULONG)Address & ~(((1 << Size) - 1) << InstPos)) | /* Intel-IA64-Filler */\
((ULONG)((((ULONGLONG)Value >> ValPos) & (((ULONGLONG)1 << Size) - 1))) << InstPos) // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM7B_INST_WORD_X 3 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM7B_SIZE_X 7 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM7B_INST_WORD_POS_X 4 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM7B_VAL_POS_X 0 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM9D_INST_WORD_X 3 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM9D_SIZE_X 9 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM9D_INST_WORD_POS_X 18 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM9D_VAL_POS_X 7 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM5C_INST_WORD_X 3 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM5C_SIZE_X 5 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM5C_INST_WORD_POS_X 13 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM5C_VAL_POS_X 16 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IC_INST_WORD_X 3 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IC_SIZE_X 1 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IC_INST_WORD_POS_X 12 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IC_VAL_POS_X 21 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM41a_INST_WORD_X 1 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM41a_SIZE_X 10 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM41a_INST_WORD_POS_X 14 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM41a_VAL_POS_X 22 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM41b_INST_WORD_X 1 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM41b_SIZE_X 8 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM41b_INST_WORD_POS_X 24 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM41b_VAL_POS_X 32 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM41c_INST_WORD_X 2 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM41c_SIZE_X 23 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM41c_INST_WORD_POS_X 0 // Intel-IA64-Filler
#define EMARCH_ENC_I17_IMM41c_VAL_POS_X 40 // Intel-IA64-Filler
#define EMARCH_ENC_I17_SIGN_INST_WORD_X 3 // Intel-IA64-Filler
#define EMARCH_ENC_I17_SIGN_SIZE_X 1 // Intel-IA64-Filler
#define EMARCH_ENC_I17_SIGN_INST_WORD_POS_X 27 // Intel-IA64-Filler
#define EMARCH_ENC_I17_SIGN_VAL_POS_X 63 // Intel-IA64-Filler
//
// Line number format.
//
typedef struct _IMAGE_LINENUMBER {
union {
ULONG SymbolTableIndex; // Symbol table index of function name if Linenumber is 0.
ULONG VirtualAddress; // Virtual address of line number.
} Type;
USHORT Linenumber; // Line number.
} IMAGE_LINENUMBER;
typedef IMAGE_LINENUMBER UNALIGNED *PIMAGE_LINENUMBER;
#define IMAGE_SIZEOF_LINENUMBER 6
#ifndef _MAC
#include "poppack.h" // Back to 4 byte packing
#endif
//
// Based relocation format.
//
typedef struct _IMAGE_BASE_RELOCATION {
ULONG VirtualAddress;
ULONG SizeOfBlock;
// USHORT TypeOffset[1];
} IMAGE_BASE_RELOCATION;
typedef IMAGE_BASE_RELOCATION UNALIGNED * PIMAGE_BASE_RELOCATION;
#define IMAGE_SIZEOF_BASE_RELOCATION 8
//
// Based relocation types.
//
#define IMAGE_REL_BASED_ABSOLUTE 0
#define IMAGE_REL_BASED_HIGH 1
#define IMAGE_REL_BASED_LOW 2
#define IMAGE_REL_BASED_HIGHLOW 3
#define IMAGE_REL_BASED_HIGHADJ 4
#define IMAGE_REL_BASED_MIPS_JMPADDR 5
// end_winnt
#define IMAGE_REL_BASED_SECTION 6
#define IMAGE_REL_BASED_REL32 7
// IMAGE_REL_BASED_VXD_RELATIVE 8
// begin_winnt
#define IMAGE_REL_BASED_MIPS_JMPADDR16 9
#define IMAGE_REL_BASED_IA64_IMM64 9
#define IMAGE_REL_BASED_DIR64 10
//
// Archive format.
//
#define IMAGE_ARCHIVE_START_SIZE 8
#define IMAGE_ARCHIVE_START "!<arch>\n"
#define IMAGE_ARCHIVE_END "`\n"
#define IMAGE_ARCHIVE_PAD "\n"
#define IMAGE_ARCHIVE_LINKER_MEMBER "/ "
#define IMAGE_ARCHIVE_LONGNAMES_MEMBER "// "
typedef struct _IMAGE_ARCHIVE_MEMBER_HEADER {
UCHAR Name[16]; // File member name - `/' terminated.
UCHAR Date[12]; // File member date - decimal.
UCHAR UserID[6]; // File member user id - decimal.
UCHAR GroupID[6]; // File member group id - decimal.
UCHAR Mode[8]; // File member mode - octal.
UCHAR Size[10]; // File member size - decimal.
UCHAR EndHeader[2]; // String to end header.
} IMAGE_ARCHIVE_MEMBER_HEADER, *PIMAGE_ARCHIVE_MEMBER_HEADER;
#define IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR 60
//
// DLL support.
//
//
// Export Format
//
typedef struct _IMAGE_EXPORT_DIRECTORY {
ULONG Characteristics;
ULONG TimeDateStamp;
USHORT MajorVersion;
USHORT MinorVersion;
ULONG Name;
ULONG Base;
ULONG NumberOfFunctions;
ULONG NumberOfNames;
ULONG AddressOfFunctions; // RVA from base of image
ULONG AddressOfNames; // RVA from base of image
ULONG AddressOfNameOrdinals; // RVA from base of image
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -