1295484Semaste/*- 2295484Semaste * Copyright (c) 2015 Kai Wang 3295484Semaste * All rights reserved. 4295484Semaste * 5295484Semaste * Redistribution and use in source and binary forms, with or without 6295484Semaste * modification, are permitted provided that the following conditions 7295484Semaste * are met: 8295484Semaste * 1. Redistributions of source code must retain the above copyright 9295484Semaste * notice, this list of conditions and the following disclaimer. 10295484Semaste * 2. Redistributions in binary form must reproduce the above copyright 11295484Semaste * notice, this list of conditions and the following disclaimer in the 12295484Semaste * documentation and/or other materials provided with the distribution. 13295484Semaste * 14295484Semaste * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15295484Semaste * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16295484Semaste * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17295484Semaste * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18295484Semaste * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19295484Semaste * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20295484Semaste * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21295484Semaste * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22295484Semaste * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23295484Semaste * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24295484Semaste * SUCH DAMAGE. 25295484Semaste * 26300311Semaste * $Id: pe.h 3441 2016-04-07 15:04:20Z emaste $ 27295484Semaste */ 28295484Semaste 29295484Semaste#ifndef _PE_H_ 30295484Semaste#define _PE_H_ 31295484Semaste 32295484Semaste#include <stdint.h> 33295484Semaste 34295484Semaste/* 35295484Semaste * MS-DOS header. 36295484Semaste */ 37295484Semaste 38295484Semastetypedef struct _PE_DosHdr { 39295484Semaste char dh_magic[2]; 40295484Semaste uint16_t dh_lastsize; 41295484Semaste uint16_t dh_nblock; 42295484Semaste uint16_t dh_nreloc; 43295484Semaste uint16_t dh_hdrsize; 44295484Semaste uint16_t dh_minalloc; 45295484Semaste uint16_t dh_maxalloc; 46295484Semaste uint16_t dh_ss; 47295484Semaste uint16_t dh_sp; 48295484Semaste uint16_t dh_checksum; 49295484Semaste uint16_t dh_ip; 50295484Semaste uint16_t dh_cs; 51295484Semaste uint16_t dh_relocpos; 52295484Semaste uint16_t dh_noverlay; 53295484Semaste uint16_t dh_reserved1[4]; 54295484Semaste uint16_t dh_oemid; 55295484Semaste uint16_t dh_oeminfo; 56295484Semaste uint16_t dh_reserved2[10]; 57295484Semaste uint32_t dh_lfanew; 58295484Semaste} PE_DosHdr; 59295484Semaste 60295484Semaste/* 61295484Semaste * Rich header. 62295484Semaste */ 63295484Semaste 64295484Semastetypedef struct _PE_RichHdr { 65295484Semaste uint32_t rh_xor; 66295484Semaste uint32_t rh_total; 67295484Semaste uint32_t *rh_compid; 68295484Semaste uint32_t *rh_cnt; 69295484Semaste} PE_RichHdr; 70295484Semaste 71295484Semaste/* 72295484Semaste * COFF header: Machine Types. 73295484Semaste */ 74295484Semaste 75295484Semaste#define IMAGE_FILE_MACHINE_UNKNOWN 0x0 /* not specified */ 76295484Semaste#define IMAGE_FILE_MACHINE_AM33 0x1d3 /* Matsushita AM33 */ 77295484Semaste#define IMAGE_FILE_MACHINE_AMD64 0x8664 /* x86-64 */ 78295484Semaste#define IMAGE_FILE_MACHINE_ARM 0x1c0 /* ARM LE */ 79295484Semaste#define IMAGE_FILE_MACHINE_ARMNT 0x1c4 /* ARMv7(or higher) Thumb */ 80295484Semaste#define IMAGE_FILE_MACHINE_ARM64 0xaa64 /* ARMv8 64-bit */ 81295484Semaste#define IMAGE_FILE_MACHINE_EBC 0xebc /* EFI byte code */ 82295484Semaste#define IMAGE_FILE_MACHINE_I386 0x14c /* x86 */ 83295484Semaste#define IMAGE_FILE_MACHINE_IA64 0x200 /* IA64 */ 84295484Semaste#define IMAGE_FILE_MACHINE_M32R 0x9041 /* Mitsubishi M32R LE */ 85295484Semaste#define IMAGE_FILE_MACHINE_MIPS16 0x266 /* MIPS16 */ 86295484Semaste#define IMAGE_FILE_MACHINE_MIPSFPU 0x366 /* MIPS with FPU */ 87295484Semaste#define IMAGE_FILE_MACHINE_MIPSFPU16 0x466 /* MIPS16 with FPU */ 88295484Semaste#define IMAGE_FILE_MACHINE_POWERPC 0x1f0 /* Power PC LE */ 89295484Semaste#define IMAGE_FILE_MACHINE_POWERPCFP 0x1f1 /* Power PC floating point */ 90295484Semaste#define IMAGE_FILE_MACHINE_R4000 0x166 /* MIPS R4000 LE */ 91300311Semaste#define IMAGE_FILE_MACHINE_RISCV32 0x5032 /* RISC-V 32-bit */ 92300311Semaste#define IMAGE_FILE_MACHINE_RISCV64 0x5064 /* RISC-V 64-bit */ 93300311Semaste#define IMAGE_FILE_MACHINE_RISCV128 0x5128 /* RISC-V 128-bit */ 94295484Semaste#define IMAGE_FILE_MACHINE_SH3 0x1a2 /* Hitachi SH3 */ 95295484Semaste#define IMAGE_FILE_MACHINE_SH3DSP 0x1a3 /* Hitachi SH3 DSP */ 96295484Semaste#define IMAGE_FILE_MACHINE_SH4 0x1a6 /* Hitachi SH4 */ 97295484Semaste#define IMAGE_FILE_MACHINE_SH5 0x1a8 /* Hitachi SH5 */ 98295484Semaste#define IMAGE_FILE_MACHINE_THUMB 0x1c2 /* ARM or Thumb interworking */ 99295484Semaste#define IMAGE_FILE_MACHINE_WCEMIPSV2 0x169 /* MIPS LE WCE v2 */ 100295484Semaste 101295484Semaste/* 102295484Semaste * COFF header: Characteristics 103295484Semaste */ 104295484Semaste 105295484Semaste#define IMAGE_FILE_RELOCS_STRIPPED 0x0001 106295484Semaste#define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 107295484Semaste#define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 108295484Semaste#define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 109295484Semaste#define IMAGE_FILE_AGGRESSIVE_WS_TRIM 0x0010 110295484Semaste#define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 111295484Semaste#define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 112295484Semaste#define IMAGE_FILE_32BIT_MACHINE 0x0100 113295484Semaste#define IMAGE_FILE_DEBUG_STRIPPED 0x0200 114295484Semaste#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 115295484Semaste#define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 116295484Semaste#define IMAGE_FILE_SYSTEM 0x1000 117295484Semaste#define IMAGE_FILE_DLL 0x2000 118295484Semaste#define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 119295484Semaste#define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 120295484Semaste 121295484Semaste/* 122295484Semaste * COFF Header. 123295484Semaste */ 124295484Semaste 125295484Semastetypedef struct _PE_CoffHdr { 126295484Semaste uint16_t ch_machine; 127295484Semaste uint16_t ch_nsec; 128295484Semaste uint32_t ch_timestamp; 129295484Semaste uint32_t ch_symptr; 130295484Semaste uint32_t ch_nsym; 131295484Semaste uint16_t ch_optsize; 132295484Semaste uint16_t ch_char; 133295484Semaste} PE_CoffHdr; 134295484Semaste 135295484Semaste 136295484Semaste/* 137295484Semaste * Optional Header: Subsystem. 138295484Semaste */ 139295484Semaste 140295484Semaste#define IMAGE_SUBSYSTEM_UNKNOWN 0 141295484Semaste#define IMAGE_SUBSYSTEM_NATIVE 1 142295484Semaste#define IMAGE_SUBSYSTEM_WINDOWS_GUI 2 143295484Semaste#define IMAGE_SUBSYSTEM_WINDOWS_CUI 3 144295484Semaste#define IMAGE_SUBSYSTEM_POSIX_CUI 7 145295484Semaste#define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI 9 146295484Semaste#define IMAGE_SUBSYSTEM_EFI_APPLICATION 10 147295484Semaste#define IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER 11 148295484Semaste#define IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER 12 149295484Semaste#define IMAGE_SUBSYSTEM_EFI_ROM 13 150295484Semaste#define IMAGE_SUBSYSTEM_XBOX 14 151295484Semaste 152295484Semaste/* 153295484Semaste * Optional Header: DLL Characteristics 154295484Semaste */ 155295484Semaste 156295484Semaste#define IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE 0x0040 157295484Semaste#define IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY 0x0080 158295484Semaste#define IMAGE_DLL_CHARACTERISTICS_NX_COMPAT 0x0100 159295484Semaste#define IMAGE_DLL_CHARACTERISTICS_NO_ISOLATION 0x0200 160295484Semaste#define IMAGE_DLL_CHARACTERISTICS_NO_SEH 0x0400 161295484Semaste#define IMAGE_DLL_CHARACTERISTICS_NO_BIND 0x0800 162295484Semaste#define IMAGE_DLL_CHARACTERISTICS_WDM_DRIVER 0x2000 163295484Semaste#define IMAGE_DLL_CHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000 164295484Semaste 165295484Semaste/* 166295484Semaste * Optional Header. 167295484Semaste */ 168295484Semaste 169295484Semaste#define PE_FORMAT_ROM 0x107 170295484Semaste#define PE_FORMAT_32 0x10b 171295484Semaste#define PE_FORMAT_32P 0x20b 172295484Semaste 173295484Semastetypedef struct _PE_OptHdr { 174295484Semaste uint16_t oh_magic; 175295484Semaste uint8_t oh_ldvermajor; 176295484Semaste uint8_t oh_ldverminor; 177295484Semaste uint32_t oh_textsize; 178295484Semaste uint32_t oh_datasize; 179295484Semaste uint32_t oh_bsssize; 180295484Semaste uint32_t oh_entry; 181295484Semaste uint32_t oh_textbase; 182295484Semaste uint32_t oh_database; 183295484Semaste uint64_t oh_imgbase; 184295484Semaste uint32_t oh_secalign; 185295484Semaste uint32_t oh_filealign; 186295484Semaste uint16_t oh_osvermajor; 187295484Semaste uint16_t oh_osverminor; 188295484Semaste uint16_t oh_imgvermajor; 189295484Semaste uint16_t oh_imgverminor; 190295484Semaste uint16_t oh_subvermajor; 191295484Semaste uint16_t oh_subverminor; 192295484Semaste uint32_t oh_win32ver; 193295484Semaste uint32_t oh_imgsize; 194295484Semaste uint32_t oh_hdrsize; 195295484Semaste uint32_t oh_checksum; 196295484Semaste uint16_t oh_subsystem; 197295484Semaste uint16_t oh_dllchar; 198295484Semaste uint64_t oh_stacksizer; 199295484Semaste uint64_t oh_stacksizec; 200295484Semaste uint64_t oh_heapsizer; 201295484Semaste uint64_t oh_heapsizec; 202295484Semaste uint32_t oh_ldrflags; 203295484Semaste uint32_t oh_ndatadir; 204295484Semaste} PE_OptHdr; 205295484Semaste 206295484Semaste/* 207295484Semaste * Optional Header: Data Directories. 208295484Semaste */ 209295484Semaste 210295484Semaste#define PE_DD_EXPORT 0 211295484Semaste#define PE_DD_IMPORT 1 212295484Semaste#define PE_DD_RESROUCE 2 213295484Semaste#define PE_DD_EXCEPTION 3 214295484Semaste#define PE_DD_CERTIFICATE 4 215295484Semaste#define PE_DD_BASERELOC 5 216295484Semaste#define PE_DD_DEBUG 6 217295484Semaste#define PE_DD_ARCH 7 218295484Semaste#define PE_DD_GLOBALPTR 8 219295484Semaste#define PE_DD_TLS 9 220295484Semaste#define PE_DD_LOADCONFIG 10 221295484Semaste#define PE_DD_BOUNDIMPORT 11 222295484Semaste#define PE_DD_IAT 12 223295484Semaste#define PE_DD_DELAYIMPORT 13 224295484Semaste#define PE_DD_CLRRUNTIME 14 225295484Semaste#define PE_DD_RESERVED 15 226295484Semaste#define PE_DD_MAX 16 227295484Semaste 228295484Semastetypedef struct _PE_DataDirEntry { 229295484Semaste uint32_t de_addr; 230295484Semaste uint32_t de_size; 231295484Semaste} PE_DataDirEntry; 232295484Semaste 233295484Semastetypedef struct _PE_DataDir { 234295484Semaste PE_DataDirEntry dd_e[PE_DD_MAX]; 235295484Semaste uint32_t dd_total; 236295484Semaste} PE_DataDir; 237295484Semaste 238295484Semaste/* 239295484Semaste * Section Headers: Section flags. 240295484Semaste */ 241295484Semaste 242295484Semaste#define IMAGE_SCN_TYPE_NO_PAD 0x00000008 243295484Semaste#define IMAGE_SCN_CNT_CODE 0x00000020 244295484Semaste#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040 245295484Semaste#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 246295484Semaste#define IMAGE_SCN_LNK_OTHER 0x00000100 247295484Semaste#define IMAGE_SCN_LNK_INFO 0x00000200 248295484Semaste#define IMAGE_SCN_LNK_REMOVE 0x00000800 249295484Semaste#define IMAGE_SCN_LNK_COMDAT 0x00001000 250295484Semaste#define IMAGE_SCN_GPREL 0x00008000 251295484Semaste#define IMAGE_SCN_MEM_PURGEABLE 0x00020000 252295484Semaste#define IMAGE_SCN_MEM_16BIT 0x00020000 253295484Semaste#define IMAGE_SCN_MEM_LOCKED 0x00040000 254295484Semaste#define IMAGE_SCN_MEM_PRELOAD 0x00080000 255295484Semaste#define IMAGE_SCN_ALIGN_1BYTES 0x00100000 256295484Semaste#define IMAGE_SCN_ALIGN_2BYTES 0x00200000 257295484Semaste#define IMAGE_SCN_ALIGN_4BYTES 0x00300000 258295484Semaste#define IMAGE_SCN_ALIGN_8BYTES 0x00400000 259295484Semaste#define IMAGE_SCN_ALIGN_16BYTES 0x00500000 260295484Semaste#define IMAGE_SCN_ALIGN_32BYTES 0x00600000 261295484Semaste#define IMAGE_SCN_ALIGN_64BYTES 0x00700000 262295484Semaste#define IMAGE_SCN_ALIGN_128BYTES 0x00800000 263295484Semaste#define IMAGE_SCN_ALIGN_256BYTES 0x00900000 264295484Semaste#define IMAGE_SCN_ALIGN_512BYTES 0x00A00000 265295484Semaste#define IMAGE_SCN_ALIGN_1024BYTES 0x00B00000 266295484Semaste#define IMAGE_SCN_ALIGN_2048BYTES 0x00C00000 267295484Semaste#define IMAGE_SCN_ALIGN_4096BYTES 0x00D00000 268295484Semaste#define IMAGE_SCN_ALIGN_8192BYTES 0x00E00000 269295484Semaste#define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000 270295484Semaste#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000 271295484Semaste#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 272295484Semaste#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000 273295484Semaste#define IMAGE_SCN_MEM_SHARED 0x10000000 274295484Semaste#define IMAGE_SCN_MEM_EXECUTE 0x20000000 275295484Semaste#define IMAGE_SCN_MEM_READ 0x40000000 276295484Semaste#define IMAGE_SCN_MEM_WRITE 0x80000000 277295484Semaste 278295484Semaste/* 279295484Semaste * Section Headers. 280295484Semaste */ 281295484Semaste 282295484Semastetypedef struct _PE_SecHdr { 283295484Semaste char sh_name[8]; 284295484Semaste uint32_t sh_virtsize; 285295484Semaste uint32_t sh_addr; 286295484Semaste uint32_t sh_rawsize; 287295484Semaste uint32_t sh_rawptr; 288295484Semaste uint32_t sh_relocptr; 289295484Semaste uint32_t sh_lineptr; 290295484Semaste uint16_t sh_nreloc; 291295484Semaste uint16_t sh_nline; 292295484Semaste uint32_t sh_char; 293295484Semaste} PE_SecHdr; 294295484Semaste 295295484Semaste#endif /* !_PE_H_ */ 296