📄 winnt.h
字号:
#define IMAGE_DIRECTORY_ENTRY_TLS 9#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11#define IMAGE_DIRECTORY_ENTRY_IAT 12 /* Import Address Table */#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14/* Subsystem Values */#define IMAGE_SUBSYSTEM_UNKNOWN 0#define IMAGE_SUBSYSTEM_NATIVE 1#define IMAGE_SUBSYSTEM_WINDOWS_GUI 2 /* Windows GUI subsystem */#define IMAGE_SUBSYSTEM_WINDOWS_CUI 3 /* Windows character subsystem*/#define IMAGE_SUBSYSTEM_OS2_CUI 5#define IMAGE_SUBSYSTEM_POSIX_CUI 7typedef struct IMAGE_FILE_HEADER { WORD Machine; WORD NumberOfSections; DWORD TimeDateStamp; DWORD PointerToSymbolTable; DWORD NumberOfSymbols; WORD SizeOfOptionalHeader; WORD Characteristics;} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;typedef struct IMAGE_DATA_DIRECTORY { DWORD VirtualAddress; DWORD Size;} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16typedef struct IMAGE_OPTIONAL_HEADER { /* Standard fields */ WORD Magic; BYTE MajorLinkerVersion; BYTE MinorLinkerVersion; DWORD SizeOfCode; DWORD SizeOfInitializedData; DWORD SizeOfUninitializedData; DWORD AddressOfEntryPoint; DWORD BaseOfCode; DWORD BaseOfData; /* NT additional fields */ DWORD ImageBase; DWORD SectionAlignment; DWORD FileAlignment; WORD MajorOperatingSystemVersion; WORD MinorOperatingSystemVersion; WORD MajorImageVersion; WORD MinorImageVersion; WORD MajorSubsystemVersion; WORD MinorSubsystemVersion; DWORD Win32VersionValue; DWORD SizeOfImage; DWORD SizeOfHeaders; DWORD CheckSum; WORD Subsystem; WORD DllCharacteristics; DWORD SizeOfStackReserve; DWORD SizeOfStackCommit; DWORD SizeOfHeapReserve; DWORD SizeOfHeapCommit; DWORD LoaderFlags; DWORD NumberOfRvaAndSizes; IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];} IMAGE_OPTIONAL_HEADER, *PIMAGE_OPTIONAL_HEADER;typedef struct IMAGE_NT_HEADERS { DWORD Signature; IMAGE_FILE_HEADER FileHeader; IMAGE_OPTIONAL_HEADER OptionalHeader;} IMAGE_NT_HEADERS, *PIMAGE_NT_HEADERS;#define IMAGE_SIZEOF_SHORT_NAME 8typedef struct IMAGE_SECTION_HEADER { BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; union { DWORD PhysicalAddress; DWORD VirtualSize; } Misc; DWORD VirtualAddress; DWORD SizeOfRawData; DWORD PointerToRawData; DWORD PointerToRelocations; DWORD PointerToLinenumbers; WORD NumberOfRelocations; WORD NumberOfLinenumbers; DWORD Characteristics;} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;#define IMAGE_SIZEOF_SECTION_HEADER 40#define IMAGE_FIRST_SECTION(ntheader) \ ((PIMAGE_SECTION_HEADER)((LPBYTE)&((PIMAGE_NT_HEADERS)(ntheader))->OptionalHeader + \ ((PIMAGE_NT_HEADERS)(ntheader))->FileHeader.SizeOfOptionalHeader))/* These defines are for the Characteristics bitfield. *//* #define IMAGE_SCN_TYPE_REG 0x00000000 - Reserved *//* #define IMAGE_SCN_TYPE_DSECT 0x00000001 - Reserved *//* #define IMAGE_SCN_TYPE_NOLOAD 0x00000002 - Reserved *//* #define IMAGE_SCN_TYPE_GROUP 0x00000004 - Reserved *//* #define IMAGE_SCN_TYPE_NO_PAD 0x00000008 - Reserved *//* #define IMAGE_SCN_TYPE_COPY 0x00000010 - Reserved */#define IMAGE_SCN_CNT_CODE 0x00000020#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080#define IMAGE_SCN_LNK_OTHER 0x00000100 #define IMAGE_SCN_LNK_INFO 0x00000200 /* #define IMAGE_SCN_TYPE_OVER 0x00000400 - Reserved */#define IMAGE_SCN_LNK_REMOVE 0x00000800#define IMAGE_SCN_LNK_COMDAT 0x00001000/* 0x00002000 - Reserved *//* #define IMAGE_SCN_MEM_PROTECTED 0x00004000 - Obsolete */#define IMAGE_SCN_MEM_FARDATA 0x00008000/* #define IMAGE_SCN_MEM_SYSHEAP 0x00010000 - Obsolete */#define IMAGE_SCN_MEM_PURGEABLE 0x00020000#define IMAGE_SCN_MEM_16BIT 0x00020000#define IMAGE_SCN_MEM_LOCKED 0x00040000#define IMAGE_SCN_MEM_PRELOAD 0x00080000#define IMAGE_SCN_ALIGN_1BYTES 0x00100000#define IMAGE_SCN_ALIGN_2BYTES 0x00200000#define IMAGE_SCN_ALIGN_4BYTES 0x00300000#define IMAGE_SCN_ALIGN_8BYTES 0x00400000#define IMAGE_SCN_ALIGN_16BYTES 0x00500000 /* Default */#define IMAGE_SCN_ALIGN_32BYTES 0x00600000#define IMAGE_SCN_ALIGN_64BYTES 0x00700000/* 0x00800000 - Unused */#define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000#define IMAGE_SCN_MEM_SHARED 0x10000000#define IMAGE_SCN_MEM_EXECUTE 0x20000000#define IMAGE_SCN_MEM_READ 0x40000000#define IMAGE_SCN_MEM_WRITE 0x80000000#include "pshpack2.h"typedef struct IMAGE_SYMBOL { union { BYTE ShortName[8]; struct { DWORD Short; DWORD Long; } Name; DWORD LongName[2]; } N; DWORD Value; SHORT SectionNumber; WORD Type; BYTE StorageClass; BYTE NumberOfAuxSymbols;} IMAGE_SYMBOL;typedef IMAGE_SYMBOL *PIMAGE_SYMBOL;#define IMAGE_SIZEOF_SYMBOL 18typedef struct IMAGE_LINENUMBER { union { DWORD SymbolTableIndex; DWORD VirtualAddress; } Type; WORD Linenumber;} IMAGE_LINENUMBER;typedef IMAGE_LINENUMBER *PIMAGE_LINENUMBER;#define IMAGE_SIZEOF_LINENUMBER 6typedef union IMAGE_AUX_SYMBOL { struct { DWORD TagIndex; union { struct { WORD Linenumber; WORD Size; } LnSz; DWORD TotalSize; } Misc; union { struct { DWORD PointerToLinenumber; DWORD PointerToNextFunction; } Function; struct { WORD Dimension[4]; } Array; } FcnAry; WORD TvIndex; } Sym; struct { BYTE Name[IMAGE_SIZEOF_SYMBOL]; } File; struct { DWORD Length; WORD NumberOfRelocations; WORD NumberOfLinenumbers; DWORD CheckSum; SHORT Number; BYTE Selection; } Section;} IMAGE_AUX_SYMBOL;typedef IMAGE_AUX_SYMBOL *PIMAGE_AUX_SYMBOL;#define IMAGE_SIZEOF_AUX_SYMBOL 18#include "poppack.h"#define IMAGE_SYM_UNDEFINED (SHORT)0#define IMAGE_SYM_ABSOLUTE (SHORT)-1#define IMAGE_SYM_DEBUG (SHORT)-2#define IMAGE_SYM_TYPE_NULL 0x0000#define IMAGE_SYM_TYPE_VOID 0x0001#define IMAGE_SYM_TYPE_CHAR 0x0002#define IMAGE_SYM_TYPE_SHORT 0x0003#define IMAGE_SYM_TYPE_INT 0x0004#define IMAGE_SYM_TYPE_LONG 0x0005#define IMAGE_SYM_TYPE_FLOAT 0x0006#define IMAGE_SYM_TYPE_DOUBLE 0x0007#define IMAGE_SYM_TYPE_STRUCT 0x0008#define IMAGE_SYM_TYPE_UNION 0x0009#define IMAGE_SYM_TYPE_ENUM 0x000A#define IMAGE_SYM_TYPE_MOE 0x000B#define IMAGE_SYM_TYPE_BYTE 0x000C#define IMAGE_SYM_TYPE_WORD 0x000D#define IMAGE_SYM_TYPE_UINT 0x000E#define IMAGE_SYM_TYPE_DWORD 0x000F#define IMAGE_SYM_TYPE_PCODE 0x8000#define IMAGE_SYM_DTYPE_NULL 0#define IMAGE_SYM_DTYPE_POINTER 1#define IMAGE_SYM_DTYPE_FUNCTION 2#define IMAGE_SYM_DTYPE_ARRAY 3#define IMAGE_SYM_CLASS_END_OF_FUNCTION (BYTE )-1#define IMAGE_SYM_CLASS_NULL 0x0000#define IMAGE_SYM_CLASS_AUTOMATIC 0x0001#define IMAGE_SYM_CLASS_EXTERNAL 0x0002#define IMAGE_SYM_CLASS_STATIC 0x0003#define IMAGE_SYM_CLASS_REGISTER 0x0004#define IMAGE_SYM_CLASS_EXTERNAL_DEF 0x0005#define IMAGE_SYM_CLASS_LABEL 0x0006#define IMAGE_SYM_CLASS_UNDEFINED_LABEL 0x0007#define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT 0x0008#define IMAGE_SYM_CLASS_ARGUMENT 0x0009#define IMAGE_SYM_CLASS_STRUCT_TAG 0x000A#define IMAGE_SYM_CLASS_MEMBER_OF_UNION 0x000B#define IMAGE_SYM_CLASS_UNION_TAG 0x000C#define IMAGE_SYM_CLASS_TYPE_DEFINITION 0x000D#define IMAGE_SYM_CLASS_UNDEFINED_STATIC 0x000E#define IMAGE_SYM_CLASS_ENUM_TAG 0x000F#define IMAGE_SYM_CLASS_MEMBER_OF_ENUM 0x0010#define IMAGE_SYM_CLASS_REGISTER_PARAM 0x0011#define IMAGE_SYM_CLASS_BIT_FIELD 0x0012#define IMAGE_SYM_CLASS_FAR_EXTERNAL 0x0044#define IMAGE_SYM_CLASS_BLOCK 0x0064#define IMAGE_SYM_CLASS_FUNCTION 0x0065#define IMAGE_SYM_CLASS_END_OF_STRUCT 0x0066#define IMAGE_SYM_CLASS_FILE 0x0067#define IMAGE_SYM_CLASS_SECTION 0x0068#define IMAGE_SYM_CLASS_WEAK_EXTERNAL 0x0069#define N_BTMASK 0x000F#define N_TMASK 0x0030#define N_TMASK1 0x00C0#define N_TMASK2 0x00F0#define N_BTSHFT 4#define N_TSHIFT 2#define BTYPE(x) ((x) & N_BTMASK)#ifndef ISPTR#define ISPTR(x) (((x) & N_TMASK) == (IMAGE_SYM_DTYPE_POINTER << N_BTSHFT))#endif#ifndef ISFCN#define ISFCN(x) (((x) & N_TMASK) == (IMAGE_SYM_DTYPE_FUNCTION << N_BTSHFT))#endif#ifndef ISARY#define ISARY(x) (((x) & N_TMASK) == (IMAGE_SYM_DTYPE_ARRAY << N_BTSHFT))#endif#ifndef ISTAG#define ISTAG(x) ((x)==IMAGE_SYM_CLASS_STRUCT_TAG || (x)==IMAGE_SYM_CLASS_UNION_TAG || (x)==IMAGE_SYM_CLASS_ENUM_TAG)#endif#ifndef INCREF#define INCREF(x) ((((x)&~N_BTMASK)<<N_TSHIFT)|(IMAGE_SYM_DTYPE_POINTER<<N_BTSHFT)|((x)&N_BTMASK))#endif#ifndef DECREF#define DECREF(x) ((((x)>>N_TSHIFT)&~N_BTMASK)|((x)&N_BTMASK))#endif#define IMAGE_COMDAT_SELECT_NODUPLICATES 1#define IMAGE_COMDAT_SELECT_ANY 2#define IMAGE_COMDAT_SELECT_SAME_SIZE 3#define IMAGE_COMDAT_SELECT_EXACT_MATCH 4#define IMAGE_COMDAT_SELECT_ASSOCIATIVE 5#define IMAGE_COMDAT_SELECT_LARGEST 6#define IMAGE_COMDAT_SELECT_NEWEST 7#define IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY 1#define IMAGE_WEAK_EXTERN_SEARCH_LIBRARY 2#define IMAGE_WEAK_EXTERN_SEARCH_ALIAS 3/* Export module directory */typedef struct IMAGE_EXPORT_DIRECTORY { DWORD Characteristics; DWORD TimeDateStamp; WORD MajorVersion; WORD MinorVersion; DWORD Name; DWORD Base; DWORD NumberOfFunctions; DWORD NumberOfNames; LPDWORD *AddressOfFunctions; LPDWORD *AddressOfNames; LPWORD *AddressOfNameOrdinals;} IMAGE_EXPORT_DIRECTORY,*PIMAGE_EXPORT_DIRECTORY;/* Import name entry */typedef struct IMAGE_IMPORT_BY_NAME { WORD Hint; BYTE Name[1];} IMAGE_IMPORT_BY_NAME,*PIMAGE_IMPORT_BY_NAME;/* Import thunk */typedef struct IMAGE_THUNK_DATA { union { LPBYTE ForwarderString; FARPROC Function; DWORD Ordinal; PIMAGE_IMPORT_BY_NAME AddressOfData; } u1;} IMAGE_THUNK_DATA,*PIMAGE_THUNK_DATA;/* Import module directory */typedef struct IMAGE_IMPORT_DESCRIPTOR { union { DWORD Characteristics; /* 0 for terminating null import descriptor */ PIMAGE_THUNK_DATA OriginalFirstThunk; /* RVA to original unbound IAT */ } u; DWORD TimeDateStamp; /* 0 if not bound, * -1 if bound, and real date\time stamp * in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT * (new BIND) * otherwise date/time stamp of DLL bound to * (Old BIND) */ DWORD ForwarderChain; /* -1 if no forwarders */ DWORD Name; /* RVA to IAT (if bound this IAT has actual addresses) */ PIMAGE_THUNK_DATA FirstThunk; } IMAGE_IMPORT_DESCRIPTOR,*PIMAGE_IMPORT_DESCRIPTOR;#define IMAGE_ORDINAL_FLAG 0x80000000#define IMAGE_SNAP_BY_ORDINAL(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG) != 0)#define IMAGE_ORDINAL(Ordinal) (Ordinal & 0xffff)typedef struct IMAGE_BOUND_IMPORT_DESCRIPTOR{ DWORD TimeDateStamp; WORD OffsetModuleName; WORD NumberOfModuleForwarderRefs;/* Array of zero or more IMAGE_BOUND_FORWARDER_REF follows */} IMAGE_BOUND_IMPORT_DESCRIPTOR, *PIMAGE_BOUND_IMPORT_DESCRIPTOR;typedef struct IMAGE_BOUND_FORWARDER_REF{ DWORD TimeDateStamp; WORD OffsetModuleName; WORD Reserved;} IMAGE_BOUND_FORWARDER_REF, *PIMAGE_BOUND_FORWARDER_REF;typedef struct IMAGE_BASE_RELOCATION{ DWORD VirtualAddress; DWORD SizeOfBlock; WORD TypeOffset[1];} IMAGE_BASE_RELOCATION,*PIMAGE_BASE_RELOCATION;typedef struct IMAGE_RELOCATION{ union { DWORD VirtualAddress; DWORD RelocCount; } u; DWORD SymbolTableIndex; WORD Type;} IMAGE_RELOCATION;typedef IMAGE_RELOCATION *PIMAGE_RELOCATION;#define IMAGE_SIZEOF_RELOCATION 10/* generic relocation types */#define IMAGE_REL_BASED_ABSOLUTE 0#define IMAGE_REL_BASED_HIGH 1#define IMAGE_REL_BASED_LOW 2#define IMAGE_REL_BASED_HIGHLOW 3#define IMAGE_REL_BASED_HIGHADJ 4#define IMAGE_REL_BASED_MIPS_JMPADDR 5#define IMAGE_REL_BASED_SECTION 6#define IMAGE_REL_BASED_REL 7
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -