📄 imagehlp.int
字号:
const
IMAGE_SEPARATION = (64*1024);
{$EXTERNALSYM IMAGE_SEPARATION}
type
PLOADED_IMAGE = ^LOADED_IMAGE;
{$EXTERNALSYM PLOADED_IMAGE}
_LOADED_IMAGE = record
ModuleName: PChar;
hFile: THandle;
MappedAddress: PAnsiChar; // PUCHAR;
FileHeader: PImageNtHeaders;
LastRvaSection: PImageSectionHeader;
NumberOfSections: ULONG;
Sections: PImageSectionHeader;
Characteristics: ULONG;
fSystemImage: ByteBool;
fDOSImage: ByteBool;
Links: LIST_ENTRY;
SizeOfImage: ULONG;
end;
{$EXTERNALSYM _LOADED_IMAGE}
LOADED_IMAGE = _LOADED_IMAGE;
{$EXTERNALSYM LOADED_IMAGE}
TLoadedImage = LOADED_IMAGE;
PLoadedImage = PLOADED_IMAGE;
// line 152
function ReBaseImage(CurrentImageName: PAnsiChar; SymbolPath: PAnsiChar; fReBase: BOOL;
fRebaseSysfileOk: BOOL; fGoingDown: BOOL; CheckImageSize: ULONG;
var OldImageSize: ULONG; var OldImageBase: ULONG_PTR; var NewImageSize: ULONG;
var NewImageBase: ULONG_PTR; TimeStamp: ULONG): BOOL; stdcall;
{$EXTERNALSYM ReBaseImage}
// line 199
//
// Define checksum function prototypes.
//
function CheckSumMappedFile(BaseAddress: Pointer; FileLength: DWORD;
out HeaderSum, CheckSum: DWORD): PImageNtHeaders; stdcall;
{$EXTERNALSYM CheckSumMappedFile}
// line 227
function GetImageUnusedHeaderBytes(const LoadedImage: LOADED_IMAGE;
var SizeUnusedHeaderBytes: DWORD): DWORD; stdcall;
{$EXTERNALSYM GetImageUnusedHeaderBytes}
// line 285
function MapAndLoad(ImageName, DllPath: PChar; var LoadedImage: LOADED_IMAGE;
DotDll: BOOL; ReadOnly: BOOL): BOOL; stdcall;
{$EXTERNALSYM MapAndLoad}
function UnMapAndLoad(const LoadedImage: LOADED_IMAGE): BOOL; stdcall;
{$EXTERNALSYM UnMapAndLoad}
function TouchFileTimes(const FileHandle: THandle; const pSystemTime: TSystemTime): BOOL; stdcall;
{$EXTERNALSYM TouchFileTimes}
// line 347
function ImageDirectoryEntryToData(Base: Pointer; MappedAsImage: ByteBool;
DirectoryEntry: USHORT; var Size: ULONG): Pointer; stdcall;
{$EXTERNALSYM ImageDirectoryEntryToData}
function ImageRvaToSection(NtHeaders: PImageNtHeaders; Base: Pointer; Rva: ULONG): PImageSectionHeader; stdcall;
{$EXTERNALSYM ImageRvaToSection}
function ImageRvaToVa(NtHeaders: PImageNtHeaders; Base: Pointer; Rva: ULONG;
LastRvaSection: PPImageSectionHeader): Pointer; stdcall;
{$EXTERNALSYM ImageRvaToVa}
// line 461
//
// UnDecorateSymbolName Flags
//
const
UNDNAME_COMPLETE = ($0000); // Enable full undecoration
{$EXTERNALSYM UNDNAME_COMPLETE}
UNDNAME_NO_LEADING_UNDERSCORES = ($0001); // Remove leading underscores from MS extended keywords
{$EXTERNALSYM UNDNAME_NO_LEADING_UNDERSCORES}
UNDNAME_NO_MS_KEYWORDS = ($0002); // Disable expansion of MS extended keywords
{$EXTERNALSYM UNDNAME_NO_MS_KEYWORDS}
UNDNAME_NO_FUNCTION_RETURNS = ($0004); // Disable expansion of return type for primary declaration
{$EXTERNALSYM UNDNAME_NO_FUNCTION_RETURNS}
UNDNAME_NO_ALLOCATION_MODEL = ($0008); // Disable expansion of the declaration model
{$EXTERNALSYM UNDNAME_NO_ALLOCATION_MODEL}
UNDNAME_NO_ALLOCATION_LANGUAGE = ($0010); // Disable expansion of the declaration language specifier
{$EXTERNALSYM UNDNAME_NO_ALLOCATION_LANGUAGE}
UNDNAME_NO_MS_THISTYPE = ($0020); // NYI Disable expansion of MS keywords on the 'this' type for primary declaration
{$EXTERNALSYM UNDNAME_NO_MS_THISTYPE}
UNDNAME_NO_CV_THISTYPE = ($0040); // NYI Disable expansion of CV modifiers on the 'this' type for primary declaration
{$EXTERNALSYM UNDNAME_NO_CV_THISTYPE}
UNDNAME_NO_THISTYPE = ($0060); // Disable all modifiers on the 'this' type
{$EXTERNALSYM UNDNAME_NO_THISTYPE}
UNDNAME_NO_ACCESS_SPECIFIERS = ($0080); // Disable expansion of access specifiers for members
{$EXTERNALSYM UNDNAME_NO_ACCESS_SPECIFIERS}
UNDNAME_NO_THROW_SIGNATURES = ($0100); // Disable expansion of 'throw-signatures' for functions and pointers to functions
{$EXTERNALSYM UNDNAME_NO_THROW_SIGNATURES}
UNDNAME_NO_MEMBER_TYPE = ($0200); // Disable expansion of 'static' or 'virtual'ness of members
{$EXTERNALSYM UNDNAME_NO_MEMBER_TYPE}
UNDNAME_NO_RETURN_UDT_MODEL = ($0400); // Disable expansion of MS model for UDT returns
{$EXTERNALSYM UNDNAME_NO_RETURN_UDT_MODEL}
UNDNAME_32_BIT_DECODE = ($0800); // Undecorate 32-bit decorated names
{$EXTERNALSYM UNDNAME_32_BIT_DECODE}
UNDNAME_NAME_ONLY = ($1000); // Crack only the name for primary declaration;
{$EXTERNALSYM UNDNAME_NAME_ONLY}
// return just [scope::]name. Does expand template params
UNDNAME_NO_ARGUMENTS = ($2000); // Don't undecorate arguments to function
{$EXTERNALSYM UNDNAME_NO_ARGUMENTS}
UNDNAME_NO_SPECIAL_SYMS = ($4000); // Don't undecorate special names (v-table, vcall, vector xxx, metatype, etc)
{$EXTERNALSYM UNDNAME_NO_SPECIAL_SYMS}
function UnDecorateSymbolName(DecoratedName: PAnsiChar; UnDecoratedName: PAnsiChar;
UndecoratedLength: DWORD; Flags: DWORD): DWORD; stdcall;
{$EXTERNALSYM UnDecorateSymbolName}
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -