#ifndef ___internal_ldrPE_h

#define ___internal_ldrPE_h

#include <iprt/types.h>

#include <iprt/assert.h>

#pragma pack(4) /** @todo Necessary? */

#define IMAGE_NT_SIGNATURE 0x00004550

#define IMAGE_FILE_MACHINE_I386 0x014c

#define IMAGE_FILE_MACHINE_AMD64 0x8664

#define IMAGE_FILE_RELOCS_STRIPPED 0x0001

#define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002

#define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004

#define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008

#define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010

#define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020

#define IMAGE_FILE_16BIT_MACHINE 0x0040

#define IMAGE_FILE_BYTES_REVERSED_LO 0x0080

#define IMAGE_FILE_32BIT_MACHINE 0x0100

#define IMAGE_FILE_DEBUG_STRIPPED 0x0200

#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400

#define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800

#define IMAGE_FILE_SYSTEM 0x1000

#define IMAGE_FILE_DLL 0x2000

#define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000

#define IMAGE_FILE_BYTES_REVERSED_HI 0x8000

#define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10B

#define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20B

#define IMAGE_SUBSYSTEM_UNKNOWN 0x0

#define IMAGE_SUBSYSTEM_NATIVE 0x1

#define IMAGE_SUBSYSTEM_WINDOWS_GUI 0x2

#define IMAGE_SUBSYSTEM_WINDOWS_CUI 0x3

#define IMAGE_SUBSYSTEM_OS2_GUI 0x4

#define IMAGE_SUBSYSTEM_OS2_CUI 0x5

#define IMAGE_SUBSYSTEM_POSIX_CUI 0x7

#define IMAGE_LIBRARY_PROCESS_INIT 0x0001

#define IMAGE_LIBRARY_PROCESS_TERM 0x0002

#define IMAGE_LIBRARY_THREAD_INIT 0x0004

#define IMAGE_LIBRARY_THREAD_TERM 0x0008

#define IMAGE_DLLCHARACTERISTICS_RESERVED 0x0010

#define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA 0x0020

#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040

#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY 0x0080

#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT 0x0100

#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200

#define IMAGE_DLLCHARACTERISTICS_NO_SEH 0x0400

#define IMAGE_DLLCHARACTERISTICS_NO_BIND 0x0800

#define IMAGE_DLLCHARACTERISTICS_APPCONTAINER 0x1000

#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER 0x2000

#define IMAGE_DLLCHARACTERISTICS_GUARD_CF 0x4000

#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000

#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 0x10

#define IMAGE_DIRECTORY_ENTRY_EXPORT 0x0

#define IMAGE_DIRECTORY_ENTRY_IMPORT 0x1

#define IMAGE_DIRECTORY_ENTRY_RESOURCE 0x2

#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x3

#define IMAGE_DIRECTORY_ENTRY_SECURITY 0x4

#define IMAGE_DIRECTORY_ENTRY_BASERELOC 0x5

#define IMAGE_DIRECTORY_ENTRY_DEBUG 0x6

#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 0x7

#define IMAGE_DIRECTORY_ENTRY_COPYRIGHT IMAGE_DIRECTORY_ENTRY_ARCHITECTURE

#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x8

#define IMAGE_DIRECTORY_ENTRY_TLS 0x9

#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0xa

#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0xb

#define IMAGE_DIRECTORY_ENTRY_IAT 0xc

#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0xd

#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0xe

#define IMAGE_SIZEOF_SHORT_NAME 0x8

#define IMAGE_SCN_TYPE_REG 0x00000000

#define IMAGE_SCN_TYPE_DSECT 0x00000001

#define IMAGE_SCN_TYPE_NOLOAD 0x00000002

#define IMAGE_SCN_TYPE_GROUP 0x00000004

#define IMAGE_SCN_TYPE_NO_PAD 0x00000008

#define IMAGE_SCN_TYPE_COPY 0x00000010

#define IMAGE_SCN_CNT_CODE 0x00000020

#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040

#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080

#define IMAGE_SCN_LNK_OTHER 0x00000100

#define IMAGE_SCN_LNK_INFO 0x00000200

#define IMAGE_SCN_TYPE_OVER 0x00000400

#define IMAGE_SCN_LNK_REMOVE 0x00000800

#define IMAGE_SCN_LNK_COMDAT 0x00001000

#define IMAGE_SCN_MEM_PROTECTED 0x00004000

#define IMAGE_SCN_NO_DEFER_SPEC_EXC 0x00004000

#define IMAGE_SCN_GPREL 0x00008000

#define IMAGE_SCN_MEM_FARDATA 0x00008000

#define IMAGE_SCN_MEM_SYSHEAP 0x00010000

#define IMAGE_SCN_MEM_PURGEABLE 0x00020000

#define IMAGE_SCN_MEM_16BIT 0x00020000

#define IMAGE_SCN_MEM_LOCKED 0x00040000

#define IMAGE_SCN_MEM_PRELOAD 0x00080000

#define IMAGE_SCN_ALIGN_1BYTES 0x00100000

#define IMAGE_SCN_ALIGN_2BYTES 0x00200000

#define IMAGE_SCN_ALIGN_4BYTES 0x00300000

#define IMAGE_SCN_ALIGN_8BYTES 0x00400000

#define IMAGE_SCN_ALIGN_16BYTES 0x00500000

#define IMAGE_SCN_ALIGN_32BYTES 0x00600000

#define IMAGE_SCN_ALIGN_64BYTES 0x00700000

#define IMAGE_SCN_ALIGN_128BYTES 0x00800000

#define IMAGE_SCN_ALIGN_256BYTES 0x00900000

#define IMAGE_SCN_ALIGN_512BYTES 0x00A00000

#define IMAGE_SCN_ALIGN_1024BYTES 0x00B00000

#define IMAGE_SCN_ALIGN_2048BYTES 0x00C00000

#define IMAGE_SCN_ALIGN_4096BYTES 0x00D00000

#define IMAGE_SCN_ALIGN_8192BYTES 0x00E00000

#define IMAGE_SCN_ALIGN_MASK 0x00F00000

#define IMAGE_SCN_ALIGN_SHIFT 20

#define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000

#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000

#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000

#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000

#define IMAGE_SCN_MEM_SHARED 0x10000000

#define IMAGE_SCN_MEM_EXECUTE 0x20000000

#define IMAGE_SCN_MEM_READ 0x40000000

#define IMAGE_SCN_MEM_WRITE 0x80000000

#define IMAGE_REL_BASED_ABSOLUTE 0x0

#define IMAGE_REL_BASED_HIGH 0x1

#define IMAGE_REL_BASED_LOW 0x2

#define IMAGE_REL_BASED_HIGHLOW 0x3

#define IMAGE_REL_BASED_HIGHADJ 0x4

#define IMAGE_REL_BASED_MIPS_JMPADDR 0x5

#define IMAGE_REL_BASED_MIPS_JMPADDR16 0x9

#define IMAGE_REL_BASED_IA64_IMM64 0x9

#define IMAGE_REL_BASED_DIR64 0xa

#define IMAGE_REL_BASED_HIGH3ADJ 0xb

#define IMAGE_ORDINAL_FLAG32 0x80000000

#define IMAGE_ORDINAL32(ord) ((ord) & 0xffff)

#define IMAGE_SNAP_BY_ORDINAL32(ord) (!!((ord) & IMAGE_ORDINAL_FLAG32))

#define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL

#define IMAGE_ORDINAL64(ord) ((ord) & 0xffff)

#define IMAGE_SNAP_BY_ORDINAL64(ord) (!!((ord) & IMAGE_ORDINAL_FLAG64))

#define IMAGE_DEBUG_TYPE_UNKNOWN UINT32_C(0x0)

#define IMAGE_DEBUG_TYPE_COFF UINT32_C(0x1)

#define IMAGE_DEBUG_TYPE_CODEVIEW UINT32_C(0x2)

#define IMAGE_DEBUG_TYPE_FPO UINT32_C(0x3)

#define IMAGE_DEBUG_TYPE_MISC UINT32_C(0x4)

#define IMAGE_DEBUG_TYPE_EXCEPTION UINT32_C(0x5)

#define IMAGE_DEBUG_TYPE_FIXUP UINT32_C(0x6)

#define IMAGE_DEBUG_TYPE_OMAP_TO_SRC UINT32_C(0x7)

#define IMAGE_DEBUG_TYPE_OMAP_FROM_SRC UINT32_C(0x8)

#define IMAGE_DEBUG_TYPE_BORLAND UINT32_C(0x9)

#define IMAGE_DEBUG_TYPE_RESERVED10 UINT32_C(0x10)

#define IMAGE_DEBUG_MISC_EXENAME UINT32_C(1)

#define WIN_CERT_REVISION_1_0 UINT16_C(0x0100)

#define WIN_CERT_REVISION_2_0 UINT16_C(0x0200)

#define WIN_CERT_TYPE_X509 UINT16_C(1)

#define WIN_CERT_TYPE_PKCS_SIGNED_DATA UINT16_C(2)

#define WIN_CERT_TYPE_RESERVED_1 UINT16_C(3)

#define WIN_CERT_TYPE_TS_STACK_SIGNED UINT16_C(4)

#define WIN_CERT_TYPE_EFI_PKCS115 UINT16_C(0x0ef0)

#define WIN_CERT_TYPE_EFI_GUID UINT16_C(0x0ef1)

#define WIN_CERTIFICATE_ALIGNMENT 8

#define IMAGE_SEPARATE_DEBUG_SIGNATURE UINT16_C(0x4944)

#define IMAGE_SIZE_OF_SYMBOL 18

#define IMAGE_SIZE_OF_SYMBOL_EX 20

#define IMAGE_SYM_UNDEFINED INT16_C(0)

#define IMAGE_SYM_ABSOLUTE INT16_C(-1)

#define IMAGE_SYM_DEBUG INT16_C(-2)

#define IMAGE_SYM_CLASS_END_OF_FUNCTION UINT8_C(0xff) /* -1 */

#define IMAGE_SYM_CLASS_NULL UINT8_C(0)

#define IMAGE_SYM_CLASS_AUTOMATIC UINT8_C(1)

#define IMAGE_SYM_CLASS_EXTERNAL UINT8_C(2)

#define IMAGE_SYM_CLASS_STATIC UINT8_C(3)

#define IMAGE_SYM_CLASS_REGISTER UINT8_C(4)

#define IMAGE_SYM_CLASS_EXTERNAL_DEF UINT8_C(5)

#define IMAGE_SYM_CLASS_LABEL UINT8_C(6)

#define IMAGE_SYM_CLASS_UNDEFINED_LABEL UINT8_C(7)

#define IMAGE_SYM_CLASS_MEMBER_OF_STRUCT UINT8_C(8)

#define IMAGE_SYM_CLASS_ARGUMENT UINT8_C(9)

#define IMAGE_SYM_CLASS_STRUCT_TAG UINT8_C(10)

#define IMAGE_SYM_CLASS_MEMBER_OF_UNION UINT8_C(11)

#define IMAGE_SYM_CLASS_UNION_TAG UINT8_C(12)

#define IMAGE_SYM_CLASS_TYPE_DEFINITION UINT8_C(13)

#define IMAGE_SYM_CLASS_UNDEFINED_STATIC UINT8_C(14)

#define IMAGE_SYM_CLASS_ENUM_TAG UINT8_C(15)

#define IMAGE_SYM_CLASS_MEMBER_OF_ENUM UINT8_C(16)

#define IMAGE_SYM_CLASS_REGISTER_PARAM UINT8_C(17)

#define IMAGE_SYM_CLASS_BIT_FIELD UINT8_C(18)

#define IMAGE_SYM_CLASS_FAR_EXTERNAL UINT8_C(68)

#define IMAGE_SYM_CLASS_BLOCK UINT8_C(100)

#define IMAGE_SYM_CLASS_FUNCTION UINT8_C(101)

#define IMAGE_SYM_CLASS_END_OF_STRUCT UINT8_C(102)

#define IMAGE_SYM_CLASS_FILE UINT8_C(103)

#define IMAGE_SYM_CLASS_SECTION UINT8_C(104)

#define IMAGE_SYM_CLASS_WEAK_EXTERNAL UINT8_C(105)

#define IMAGE_SYM_CLASS_CLR_TOKEN UINT8_C(107)

#define IMAGE_SYM_TYPE_NULL UINT16_C(0x0000)

#define IMAGE_SYM_TYPE_VOID UINT16_C(0x0001)

#define IMAGE_SYM_TYPE_CHAR UINT16_C(0x0002)

#define IMAGE_SYM_TYPE_SHORT UINT16_C(0x0003)

#define IMAGE_SYM_TYPE_INT UINT16_C(0x0004)

#define IMAGE_SYM_TYPE_LONG UINT16_C(0x0005)

#define IMAGE_SYM_TYPE_FLOAT UINT16_C(0x0006)

#define IMAGE_SYM_TYPE_DOUBLE UINT16_C(0x0007)

#define IMAGE_SYM_TYPE_STRUCT UINT16_C(0x0008)

#define IMAGE_SYM_TYPE_UNION UINT16_C(0x0009)

#define IMAGE_SYM_TYPE_ENUM UINT16_C(0x000a)

#define IMAGE_SYM_TYPE_MOE UINT16_C(0x000b)

#define IMAGE_SYM_TYPE_BYTE UINT16_C(0x000c)

#define IMAGE_SYM_TYPE_WORD UINT16_C(0x000d)

#define IMAGE_SYM_TYPE_UINT UINT16_C(0x000e)

#define IMAGE_SYM_TYPE_DWORD UINT16_C(0x000f)

#define IMAGE_SYM_TYPE_PCODE UINT16_C(0x8000)

#define IMAGE_SYM_DTYPE_NULL UINT16_C(0x0)

#define IMAGE_SYM_DTYPE_POINTER UINT16_C(0x1)

#define IMAGE_SYM_DTYPE_FUNCTION UINT16_C(0x2)

#define IMAGE_SYM_DTYPE_ARRAY UINT16_C(0x3)

#define N_BTMASK UINT16_C(0x000f)

#define N_TMASK UINT16_C(0x0030)

#define N_TMASK1 UINT16_C(0x00c0)

#define N_TMASK2 UINT16_C(0x00f0)

#define N_BTSHFT 4

#define N_TSHIFT 2

#define BTYPE(a_Type) ( (a_Type) & N_BTMASK )

#define ISPTR(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_POINTER << N_BTSHFT) )

#define ISFCN(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_FUNCTION << N_BTSHFT) )

#define ISARY(a_Type) ( ((a_Type) & N_TMASK) == (IMAGE_SYM_DTYPE_ARRAY << N_BTSHFT) )

#define ISTAG(a_StorageClass) ( (a_StorageClass) == IMAGE_SYM_CLASS_STRUCT_TAG \

|| (a_StorageClass) == IMAGE_SYM_CLASS_UNION_TAG \

|| (a_StorageClass) == IMAGE_SYM_CLASS_ENUM_TAG )

typedef struct _IMAGE_FILE_HEADER

{

uint16_t Machine; /**< 0x00 */

uint16_t NumberOfSections; /**< 0x02 */

uint32_t TimeDateStamp; /**< 0x04 */

uint32_t PointerToSymbolTable; /**< 0x08 */

uint32_t NumberOfSymbols; /**< 0x0c */

uint16_t SizeOfOptionalHeader; /**< 0x10 */

uint16_t Characteristics; /**< 0x12 */

} IMAGE_FILE_HEADER; /* size: 0x14 */

AssertCompileSize(IMAGE_FILE_HEADER, 0x14);

typedef IMAGE_FILE_HEADER *PIMAGE_FILE_HEADER;

typedef IMAGE_FILE_HEADER const *PCIMAGE_FILE_HEADER;

typedef struct _IMAGE_DATA_DIRECTORY

{

uint32_t VirtualAddress;

uint32_t Size;

} IMAGE_DATA_DIRECTORY;

typedef IMAGE_DATA_DIRECTORY *PIMAGE_DATA_DIRECTORY;

typedef IMAGE_DATA_DIRECTORY const *PCIMAGE_DATA_DIRECTORY;

typedef struct _IMAGE_OPTIONAL_HEADER32

{

uint16_t Magic; /**< 0x00 */

uint8_t MajorLinkerVersion; /**< 0x02 */

uint8_t MinorLinkerVersion; /**< 0x03 */

uint32_t SizeOfCode; /**< 0x04 */

uint32_t SizeOfInitializedData; /**< 0x08 */

uint32_t SizeOfUninitializedData; /**< 0x0c */

uint32_t AddressOfEntryPoint; /**< 0x10 */

uint32_t BaseOfCode; /**< 0x14 */

uint32_t BaseOfData; /**< 0x18 */

uint32_t ImageBase; /**< 0x1c */

uint32_t SectionAlignment; /**< 0x20 */

uint32_t FileAlignment; /**< 0x24 */

uint16_t MajorOperatingSystemVersion; /**< 0x28 */

uint16_t MinorOperatingSystemVersion; /**< 0x2a */

uint16_t MajorImageVersion; /**< 0x2c */

uint16_t MinorImageVersion; /**< 0x2e */

uint16_t MajorSubsystemVersion; /**< 0x30 */

uint16_t MinorSubsystemVersion; /**< 0x32 */

uint32_t Win32VersionValue; /**< 0x34 */

uint32_t SizeOfImage; /**< 0x38 */

uint32_t SizeOfHeaders; /**< 0x3c */

uint32_t CheckSum; /**< 0x40 */

uint16_t Subsystem; /**< 0x44 */

uint16_t DllCharacteristics; /**< 0x46 */

uint32_t SizeOfStackReserve; /**< 0x48 */

uint32_t SizeOfStackCommit; /**< 0x4c */

uint32_t SizeOfHeapReserve; /**< 0x50 */

uint32_t SizeOfHeapCommit; /**< 0x54 */

uint32_t LoaderFlags; /**< 0x58 */

uint32_t NumberOfRvaAndSizes; /**< 0x5c */

IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x60; 0x10*8 = 0x80 */

} IMAGE_OPTIONAL_HEADER32; /* size: 0xe0 */

AssertCompileSize(IMAGE_OPTIONAL_HEADER32, 0xe0);

typedef IMAGE_OPTIONAL_HEADER32 *PIMAGE_OPTIONAL_HEADER32;

typedef IMAGE_OPTIONAL_HEADER32 const *PCIMAGE_OPTIONAL_HEADER32;

typedef struct _IMAGE_OPTIONAL_HEADER64

{

uint16_t Magic; /**< 0x00 */

uint8_t MajorLinkerVersion; /**< 0x02 */

uint8_t MinorLinkerVersion; /**< 0x03 */

uint32_t SizeOfCode; /**< 0x04 */

uint32_t SizeOfInitializedData; /**< 0x08 */

uint32_t SizeOfUninitializedData; /**< 0x0c */

uint32_t AddressOfEntryPoint; /**< 0x10 */

uint32_t BaseOfCode; /**< 0x14 */

uint64_t ImageBase; /**< 0x18 */

uint32_t SectionAlignment; /**< 0x20 */

uint32_t FileAlignment; /**< 0x24 */

uint16_t MajorOperatingSystemVersion; /**< 0x28 */

uint16_t MinorOperatingSystemVersion; /**< 0x2a */

uint16_t MajorImageVersion; /**< 0x2c */

uint16_t MinorImageVersion; /**< 0x2e */

uint16_t MajorSubsystemVersion; /**< 0x30 */

uint16_t MinorSubsystemVersion; /**< 0x32 */

uint32_t Win32VersionValue; /**< 0x34 */

uint32_t SizeOfImage; /**< 0x38 */

uint32_t SizeOfHeaders; /**< 0x3c */

uint32_t CheckSum; /**< 0x40 */

uint16_t Subsystem; /**< 0x44 */

uint16_t DllCharacteristics; /**< 0x46 */

uint64_t SizeOfStackReserve; /**< 0x48 */

uint64_t SizeOfStackCommit; /**< 0x50 */

uint64_t SizeOfHeapReserve; /**< 0x58 */

uint64_t SizeOfHeapCommit; /**< 0x60 */

uint32_t LoaderFlags; /**< 0x68 */

uint32_t NumberOfRvaAndSizes; /**< 0x6c */

IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; /**< 0x70; 0x10*8 = 0x80 */

} IMAGE_OPTIONAL_HEADER64; /* size: 0xf0 */

typedef IMAGE_OPTIONAL_HEADER64 *PIMAGE_OPTIONAL_HEADER64;

typedef IMAGE_OPTIONAL_HEADER64 const *PCIMAGE_OPTIONAL_HEADER64;

typedef struct _IMAGE_NT_HEADERS

{

uint32_t Signature; /**< 0x00 */

IMAGE_FILE_HEADER FileHeader; /**< 0x04 */

IMAGE_OPTIONAL_HEADER32 OptionalHeader; /**< 0x18 */

} IMAGE_NT_HEADERS32; /* size: 0xf8 */

AssertCompileSize(IMAGE_NT_HEADERS32, 0xf8);

AssertCompileMemberOffset(IMAGE_NT_HEADERS32, FileHeader, 4);

AssertCompileMemberOffset(IMAGE_NT_HEADERS32, OptionalHeader, 24);

typedef IMAGE_NT_HEADERS32 *PIMAGE_NT_HEADERS32;

typedef IMAGE_NT_HEADERS32 const *PCIMAGE_NT_HEADERS32;

typedef struct _IMAGE_NT_HEADERS64

{

uint32_t Signature; /**< 0x00 */

IMAGE_FILE_HEADER FileHeader; /**< 0x04 */

IMAGE_OPTIONAL_HEADER64 OptionalHeader; /**< 0x18 */

} IMAGE_NT_HEADERS64; /**< 0x108 */

AssertCompileSize(IMAGE_NT_HEADERS64, 0x108);

AssertCompileMemberOffset(IMAGE_NT_HEADERS64, FileHeader, 4);

AssertCompileMemberOffset(IMAGE_NT_HEADERS64, OptionalHeader, 24);

typedef IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;

typedef IMAGE_NT_HEADERS64 const *PCIMAGE_NT_HEADERS64;

typedef struct _IMAGE_SECTION_HEADER

{

uint8_t Name[IMAGE_SIZEOF_SHORT_NAME];

union

{

uint32_t PhysicalAddress;

uint32_t VirtualSize;

} Misc;

uint32_t VirtualAddress;

uint32_t SizeOfRawData;

uint32_t PointerToRawData;

uint32_t PointerToRelocations;

uint32_t PointerToLinenumbers;

uint16_t NumberOfRelocations;

uint16_t NumberOfLinenumbers;

uint32_t Characteristics;

} IMAGE_SECTION_HEADER;

typedef IMAGE_SECTION_HEADER *PIMAGE_SECTION_HEADER;

typedef IMAGE_SECTION_HEADER const *PCIMAGE_SECTION_HEADER;

typedef struct _IMAGE_BASE_RELOCATION

{

uint32_t VirtualAddress;

uint32_t SizeOfBlock;

} IMAGE_BASE_RELOCATION;

typedef IMAGE_BASE_RELOCATION *PIMAGE_BASE_RELOCATION;

typedef IMAGE_BASE_RELOCATION const *PCIMAGE_BASE_RELOCATION;

typedef struct _IMAGE_EXPORT_DIRECTORY

{

uint32_t Characteristics;

uint32_t TimeDateStamp;

uint16_t MajorVersion;

uint16_t MinorVersion;

uint32_t Name;

uint32_t Base;

uint32_t NumberOfFunctions;

uint32_t NumberOfNames;

uint32_t AddressOfFunctions;

uint32_t AddressOfNames;

uint32_t AddressOfNameOrdinals;

} IMAGE_EXPORT_DIRECTORY;

typedef IMAGE_EXPORT_DIRECTORY *PIMAGE_EXPORT_DIRECTORY;

typedef IMAGE_EXPORT_DIRECTORY const *PCIMAGE_EXPORT_DIRECTORY;

typedef struct _IMAGE_IMPORT_DESCRIPTOR

{

union

{

uint32_t Characteristics;

uint32_t OriginalFirstThunk;

} u;

uint32_t TimeDateStamp;

uint32_t ForwarderChain;

uint32_t Name;

uint32_t FirstThunk;

} IMAGE_IMPORT_DESCRIPTOR;

typedef IMAGE_IMPORT_DESCRIPTOR *PIMAGE_IMPORT_DESCRIPTOR;

typedef IMAGE_IMPORT_DESCRIPTOR const *PCIMAGE_IMPORT_DESCRIPTOR;

typedef struct _IMAGE_IMPORT_BY_NAME

{

uint16_t Hint;

uint8_t Name[1];

} IMAGE_IMPORT_BY_NAME;

typedef IMAGE_IMPORT_BY_NAME *PIMAGE_IMPORT_BY_NAME;

typedef IMAGE_IMPORT_BY_NAME const *PCIMAGE_IMPORT_BY_NAME;

typedef struct _IMAGE_THUNK_DATA64

{

union

{

uint64_t ForwarderString;

uint64_t Function;

uint64_t Ordinal;

uint64_t AddressOfData;

} u1;

} IMAGE_THUNK_DATA64;

typedef IMAGE_THUNK_DATA64 *PIMAGE_THUNK_DATA64;

typedef IMAGE_THUNK_DATA64 const *PCIMAGE_THUNK_DATA64;

typedef struct _IMAGE_THUNK_DATA32

{

union

{

uint32_t ForwarderString;

uint32_t Function;

uint32_t Ordinal;

uint32_t AddressOfData;

} u1;

} IMAGE_THUNK_DATA32;

typedef IMAGE_THUNK_DATA32 *PIMAGE_THUNK_DATA32;

typedef IMAGE_THUNK_DATA32 const *PCIMAGE_THUNK_DATA32;

#pragma pack()

typedef struct _IMAGE_LOAD_CONFIG_CODE_INTEGRITY

{

uint16_t Flags;

uint16_t Catalog;

uint32_t CatalogOffset;

uint32_t Reserved;

} IMAGE_LOAD_CONFIG_CODE_INTEGRITY;

AssertCompileSize(IMAGE_LOAD_CONFIG_CODE_INTEGRITY, 12);

typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY *PIMAGE_LOAD_CONFIG_CODE_INTEGRITY;

typedef IMAGE_LOAD_CONFIG_CODE_INTEGRITY const *PCIMAGE_LOAD_CONFIG_CODE_INTEGRITY;

typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V1

{

uint32_t Size;

uint32_t TimeDateStamp;

uint16_t MajorVersion;

uint16_t MinorVersion;

uint32_t GlobalFlagsClear;

uint32_t GlobalFlagsSet;

uint32_t CriticalSectionDefaultTimeout;

uint32_t DeCommitFreeBlockThreshold;

uint32_t DeCommitTotalFreeThreshold;

uint32_t LockPrefixTable;

uint32_t MaximumAllocationSize;

uint32_t VirtualMemoryThreshold;

uint32_t ProcessHeapFlags;

uint32_t ProcessAffinityMask;

uint16_t CSDVersion;

uint16_t Reserved1;

uint32_t EditList;

uint32_t SecurityCookie;

} IMAGE_LOAD_CONFIG_DIRECTORY32_V1;

AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V1, 0x40);

typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V1;

typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V1 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V1;

typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V2

{

uint32_t Size;

uint32_t TimeDateStamp;

uint16_t MajorVersion;

uint16_t MinorVersion;

uint32_t GlobalFlagsClear;

uint32_t GlobalFlagsSet;

uint32_t CriticalSectionDefaultTimeout;

uint32_t DeCommitFreeBlockThreshold;

uint32_t DeCommitTotalFreeThreshold;

uint32_t LockPrefixTable;

uint32_t MaximumAllocationSize;

uint32_t VirtualMemoryThreshold;

uint32_t ProcessHeapFlags;

uint32_t ProcessAffinityMask;

uint16_t CSDVersion;

uint16_t Reserved1;

uint32_t EditList;

uint32_t SecurityCookie;

uint32_t SEHandlerTable;

uint32_t SEHandlerCount;

} IMAGE_LOAD_CONFIG_DIRECTORY32_V2;

AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V2, 0x48);

typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V2;

typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V2;

typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V3

{

uint32_t Size;

uint32_t TimeDateStamp;

uint16_t MajorVersion;

uint16_t MinorVersion;

uint32_t GlobalFlagsClear;

uint32_t GlobalFlagsSet;

uint32_t CriticalSectionDefaultTimeout;

uint32_t DeCommitFreeBlockThreshold;

uint32_t DeCommitTotalFreeThreshold;

uint32_t LockPrefixTable;

uint32_t MaximumAllocationSize;

uint32_t VirtualMemoryThreshold;

uint32_t ProcessHeapFlags;

uint32_t ProcessAffinityMask;

uint16_t CSDVersion;

uint16_t Reserved1;

uint32_t EditList;

uint32_t SecurityCookie;

uint32_t SEHandlerTable;

uint32_t SEHandlerCount;

uint32_t GuardCFCCheckFunctionPointer;

uint32_t Reserved2;

uint32_t GuardCFFunctionTable;

uint32_t GuardCFFunctionCount;

uint32_t GuardFlags;

} IMAGE_LOAD_CONFIG_DIRECTORY32_V3;

AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V3, 0x5c);

typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V3;

typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V3;

typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY32_V4

{

uint32_t Size;

uint32_t TimeDateStamp;

uint16_t MajorVersion;

uint16_t MinorVersion;

uint32_t GlobalFlagsClear;

uint32_t GlobalFlagsSet;

uint32_t CriticalSectionDefaultTimeout;

uint32_t DeCommitFreeBlockThreshold;

uint32_t DeCommitTotalFreeThreshold;

uint32_t LockPrefixTable;

uint32_t MaximumAllocationSize;

uint32_t VirtualMemoryThreshold;

uint32_t ProcessHeapFlags;

uint32_t ProcessAffinityMask;

uint16_t CSDVersion;

uint16_t Reserved1;

uint32_t EditList;

uint32_t SecurityCookie;

uint32_t SEHandlerTable;

uint32_t SEHandlerCount;

uint32_t GuardCFCCheckFunctionPointer;

uint32_t Reserved2;

uint32_t GuardCFFunctionTable;

uint32_t GuardCFFunctionCount;

uint32_t GuardFlags;

IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;

} IMAGE_LOAD_CONFIG_DIRECTORY32_V4;

AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY32_V4, 0x68);

typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY32_V4;

typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY32_V4;

typedef IMAGE_LOAD_CONFIG_DIRECTORY32_V4 IMAGE_LOAD_CONFIG_DIRECTORY32;

typedef PIMAGE_LOAD_CONFIG_DIRECTORY32_V4 PIMAGE_LOAD_CONFIG_DIRECTORY32;

typedef PCIMAGE_LOAD_CONFIG_DIRECTORY32_V4 PCIMAGE_LOAD_CONFIG_DIRECTORY32;

typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V2

{

uint32_t Size;

uint32_t TimeDateStamp;

uint16_t MajorVersion;

uint16_t MinorVersion;

uint32_t GlobalFlagsClear;

uint32_t GlobalFlagsSet;

uint32_t CriticalSectionDefaultTimeout;

uint64_t DeCommitFreeBlockThreshold;

uint64_t DeCommitTotalFreeThreshold;

uint64_t LockPrefixTable;

uint64_t MaximumAllocationSize;

uint64_t VirtualMemoryThreshold;

uint64_t ProcessAffinityMask;

uint32_t ProcessHeapFlags;

uint16_t CSDVersion;

uint16_t Reserved1;

uint64_t EditList;

uint64_t SecurityCookie;

uint64_t SEHandlerTable;

uint64_t SEHandlerCount;

} IMAGE_LOAD_CONFIG_DIRECTORY64_V2;

AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V2, 0x70);

typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V2;

typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V2 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V2;

#pragma pack(4) /* Why not 8 byte alignment, baka microsofties?!? */

typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V3

{

uint32_t Size;

uint32_t TimeDateStamp;

uint16_t MajorVersion;

uint16_t MinorVersion;

uint32_t GlobalFlagsClear;

uint32_t GlobalFlagsSet;

uint32_t CriticalSectionDefaultTimeout;

uint64_t DeCommitFreeBlockThreshold;

uint64_t DeCommitTotalFreeThreshold;

uint64_t LockPrefixTable;

uint64_t MaximumAllocationSize;

uint64_t VirtualMemoryThreshold;

uint64_t ProcessAffinityMask;

uint32_t ProcessHeapFlags;

uint16_t CSDVersion;

uint16_t Reserved1;

uint64_t EditList;

uint64_t SecurityCookie;

uint64_t SEHandlerTable;

uint64_t SEHandlerCount;

uint64_t GuardCFCCheckFunctionPointer;

uint64_t Reserved2;

uint64_t GuardCFFunctionTable;

uint64_t GuardCFFunctionCount;

uint32_t GuardFlags;

} IMAGE_LOAD_CONFIG_DIRECTORY64_V3;

#pragma pack()

AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V3, 0x94);

typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V3;

typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V3 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V3;

typedef struct _IMAGE_LOAD_CONFIG_DIRECTORY64_V4

{

uint32_t Size;

uint32_t TimeDateStamp;

uint16_t MajorVersion;

uint16_t MinorVersion;

uint32_t GlobalFlagsClear;

uint32_t GlobalFlagsSet;

uint32_t CriticalSectionDefaultTimeout;

uint64_t DeCommitFreeBlockThreshold;

uint64_t DeCommitTotalFreeThreshold;

uint64_t LockPrefixTable;

uint64_t MaximumAllocationSize;

uint64_t VirtualMemoryThreshold;

uint64_t ProcessAffinityMask;

uint32_t ProcessHeapFlags;

uint16_t CSDVersion;

uint16_t Reserved1;

uint64_t EditList;

uint64_t SecurityCookie;

uint64_t SEHandlerTable;

uint64_t SEHandlerCount;

uint64_t GuardCFCCheckFunctionPointer;

uint64_t Reserved2;

uint64_t GuardCFFunctionTable;

uint64_t GuardCFFunctionCount;

uint32_t GuardFlags;

IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;

} IMAGE_LOAD_CONFIG_DIRECTORY64_V4;

AssertCompileSize(IMAGE_LOAD_CONFIG_DIRECTORY64_V4, 0xa0);

typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 *PIMAGE_LOAD_CONFIG_DIRECTORY64_V4;

typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 const *PCIMAGE_LOAD_CONFIG_DIRECTORY64_V4;

typedef IMAGE_LOAD_CONFIG_DIRECTORY64_V4 IMAGE_LOAD_CONFIG_DIRECTORY64;

typedef PIMAGE_LOAD_CONFIG_DIRECTORY64_V4 PIMAGE_LOAD_CONFIG_DIRECTORY64;

typedef PCIMAGE_LOAD_CONFIG_DIRECTORY64_V4 PCIMAGE_LOAD_CONFIG_DIRECTORY64;

typedef struct _IMAGE_DEBUG_DIRECTORY

{

uint32_t Characteristics;

uint32_t TimeDateStamp;

uint16_t MajorVersion;

uint16_t MinorVersion;

uint32_t Type;

uint32_t SizeOfData;

uint32_t AddressOfRawData;

uint32_t PointerToRawData;

} IMAGE_DEBUG_DIRECTORY;

AssertCompileSize(IMAGE_DEBUG_DIRECTORY, 28);

typedef IMAGE_DEBUG_DIRECTORY *PIMAGE_DEBUG_DIRECTORY;

typedef IMAGE_DEBUG_DIRECTORY const *PCIMAGE_DEBUG_DIRECTORY;

typedef struct _IMAGE_DEBUG_MISC

{

uint32_t DataType;

uint32_t Length;

uint8_t Unicode;

uint8_t Reserved[3];

uint8_t Data[1];

} IMAGE_DEBUG_MISC;

AssertCompileSize(IMAGE_DEBUG_MISC, 16);

typedef IMAGE_DEBUG_MISC *PIMAGE_DEBUG_MISC;

typedef IMAGE_DEBUG_MISC const *PCIMAGE_DEBUG_MISC;

typedef struct WIN_CERTIFICATE

{

uint32_t dwLength;

uint16_t wRevision;

uint16_t wCertificateType;

uint8_t bCertificate[8];

} WIN_CERTIFICATE;

AssertCompileSize(WIN_CERTIFICATE, 16);

typedef WIN_CERTIFICATE *PWIN_CERTIFICATE;

typedef WIN_CERTIFICATE const *PCWIN_CERTIFICATE;

typedef struct _IMAGE_SEPARATE_DEBUG_HEADER

{

uint16_t Signature; /**< 0x00 */

uint16_t Flags; /**< 0x02 */

uint16_t Machine; /**< 0x04 */

uint16_t Characteristics; /**< 0x06 */

uint32_t TimeDateStamp; /**< 0x08 */

uint32_t CheckSum; /**< 0x0c */

uint32_t ImageBase; /**< 0x10 */

uint32_t SizeOfImage; /**< 0x14 */

uint32_t NumberOfSections; /**< 0x18 */

uint32_t ExportedNamesSize; /**< 0x1c */

uint32_t DebugDirectorySize; /**< 0x20 */

uint32_t SectionAlignment; /**< 0x24 */

uint32_t Reserved[2]; /**< 0x28 */

} IMAGE_SEPARATE_DEBUG_HEADER; /* size: 0x30 */

AssertCompileSize(IMAGE_SEPARATE_DEBUG_HEADER, 0x30);

typedef IMAGE_SEPARATE_DEBUG_HEADER *PIMAGE_SEPARATE_DEBUG_HEADER;

typedef IMAGE_SEPARATE_DEBUG_HEADER const *PCIMAGE_SEPARATE_DEBUG_HEADER;

typedef struct _IMAGE_COFF_SYMBOLS_HEADER

{

uint32_t NumberOfSymbols;

uint32_t LvaToFirstSymbol;

uint32_t NumberOfLinenumbers;

uint32_t LvaToFirstLinenumber;

uint32_t RvaToFirstByteOfCode;

uint32_t RvaToLastByteOfCode;

uint32_t RvaToFirstByteOfData;

uint32_t RvaToLastByteOfData;

} IMAGE_COFF_SYMBOLS_HEADER;

AssertCompileSize(IMAGE_COFF_SYMBOLS_HEADER, 0x20);

typedef IMAGE_COFF_SYMBOLS_HEADER *PIMAGE_COFF_SYMBOLS_HEADER;

typedef IMAGE_COFF_SYMBOLS_HEADER const *PCIMAGE_COFF_SYMBOLS_HEADER;

#pragma pack(2)

typedef struct _IMAGE_LINENUMBER

{

union

{

uint32_t VirtualAddress;

uint32_t SymbolTableIndex;

} Type;

uint16_t Linenumber;

} IMAGE_LINENUMBER;

#pragma pack()

AssertCompileSize(IMAGE_LINENUMBER, 6);

typedef IMAGE_LINENUMBER *PIMAGE_LINENUMBER;

typedef IMAGE_LINENUMBER const *PCIMAGE_LINENUMBER;

#pragma pack(2)

typedef struct _IMAGE_SYMBOL

{

union

{

uint8_t ShortName[8];

struct

{

uint32_t Short;

uint32_t Long;

} Name;

uint32_t LongName[2];

} N;

uint32_t Value;

int16_t SectionNumber;

uint16_t Type;

uint8_t StorageClass;

uint8_t NumberOfAuxSymbols;

} IMAGE_SYMBOL;

#pragma pack()

AssertCompileSize(IMAGE_SYMBOL, IMAGE_SIZE_OF_SYMBOL);

typedef IMAGE_SYMBOL *PIMAGE_SYMBOL;

typedef IMAGE_SYMBOL const *PCIMAGE_SYMBOL;

#pragma pack(2)

typedef struct IMAGE_AUX_SYMBOL_TOKEN_DEF

{

uint8_t bAuxType;

uint8_t bReserved;

uint32_t SymbolTableIndex;

uint8_t rgbReserved[12];

} IMAGE_AUX_SYMBOL_TOKEN_DEF;

#pragma pack()

AssertCompileSize(IMAGE_AUX_SYMBOL_TOKEN_DEF, IMAGE_SIZE_OF_SYMBOL);

typedef IMAGE_AUX_SYMBOL_TOKEN_DEF *PIMAGE_AUX_SYMBOL_TOKEN_DEF;

typedef IMAGE_AUX_SYMBOL_TOKEN_DEF const *PCIMAGE_AUX_SYMBOL_TOKEN_DEF;

#pragma pack(1)

typedef union _IMAGE_AUX_SYMBOL

{

struct

{

uint32_t TagIndex;

union

{

struct

{

uint16_t Linenumber;

uint16_t Size;

} LnSz;

} Misc;

union

{

struct

{

uint32_t PointerToLinenumber;

uint32_t PointerToNextFunction;

} Function;

struct

{

uint16_t Dimension[4];

} Array;

} FcnAry;

uint16_t TvIndex;

} Sym;

struct

{

uint8_t Name[IMAGE_SIZE_OF_SYMBOL];

} File;

struct

{

uint32_t Length;

uint16_t NumberOfRelocations;

uint16_t NumberOfLinenumbers;

uint32_t CheckSum;

uint16_t Number;

uint8_t Selection;

uint8_t bReserved;

uint16_t HighNumber;

} Section;

IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;

struct

{

uint32_t crc;

uint8_t rgbReserved[14];

} CRC;

} IMAGE_AUX_SYMBOL;

#pragma pack()

AssertCompileSize(IMAGE_AUX_SYMBOL, IMAGE_SIZE_OF_SYMBOL);

typedef IMAGE_AUX_SYMBOL *PIMAGE_AUX_SYMBOL;

typedef IMAGE_AUX_SYMBOL const *PCIMAGE_AUX_SYMBOL;

typedef struct _IMAGE_SYMBOL_EX

{

union

{

uint8_t ShortName[8];

struct

{

uint32_t Short;

uint32_t Long;

} Name;

uint32_t LongName[2];

} N;

uint32_t Value;

int32_t SectionNumber; /* The difference from IMAGE_SYMBOL */

uint16_t Type;

uint8_t StorageClass;

uint8_t NumberOfAuxSymbols;

} IMAGE_SYMBOL_EX;

AssertCompileSize(IMAGE_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);

typedef IMAGE_SYMBOL_EX *PIMAGE_SYMBOL_EX;

typedef IMAGE_SYMBOL_EX const *PCIMAGE_SYMBOL_EX;

typedef union _IMAGE_AUX_SYMBOL_EX

{

struct

{

uint32_t WeakDefaultSymIndex;

uint32_t WeakSearchType;

uint8_t rgbReserved[12];

} Sym;

struct

{

uint8_t Name[IMAGE_SIZE_OF_SYMBOL_EX];

} File;

struct

{

uint32_t Length;

uint16_t NumberOfRelocations;

uint16_t NumberOfLinenumbers;

uint32_t CheckSum;

uint16_t Number;

uint8_t Selection;

uint8_t bReserved;

uint16_t HighNumber;

uint8_t rgbReserved[2];

} Section;

IMAGE_AUX_SYMBOL_TOKEN_DEF TokenDef;

struct

{

uint32_t crc;

uint8_t rgbReserved[16];

} CRC;

} IMAGE_AUX_SYMBOL_EX;

AssertCompileSize(IMAGE_AUX_SYMBOL_EX, IMAGE_SIZE_OF_SYMBOL_EX);

typedef IMAGE_AUX_SYMBOL_EX *PIMAGE_AUX_SYMBOL_EX;

typedef IMAGE_AUX_SYMBOL_EX const *PCIMAGE_AUX_SYMBOL_EX;

#endif