1839529caSEd Maste /*- 2839529caSEd Maste * Copyright (c) 2015 Kai Wang 3839529caSEd Maste * All rights reserved. 4839529caSEd Maste * 5839529caSEd Maste * Redistribution and use in source and binary forms, with or without 6839529caSEd Maste * modification, are permitted provided that the following conditions 7839529caSEd Maste * are met: 8839529caSEd Maste * 1. Redistributions of source code must retain the above copyright 9839529caSEd Maste * notice, this list of conditions and the following disclaimer. 10839529caSEd Maste * 2. Redistributions in binary form must reproduce the above copyright 11839529caSEd Maste * notice, this list of conditions and the following disclaimer in the 12839529caSEd Maste * documentation and/or other materials provided with the distribution. 13839529caSEd Maste * 14839529caSEd Maste * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15839529caSEd Maste * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16839529caSEd Maste * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17839529caSEd Maste * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18839529caSEd Maste * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19839529caSEd Maste * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20839529caSEd Maste * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21839529caSEd Maste * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22839529caSEd Maste * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23839529caSEd Maste * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24839529caSEd Maste * SUCH DAMAGE. 25839529caSEd Maste * 26*b6b6f9ccSEd Maste * $Id: pe.h 3441 2016-04-07 15:04:20Z emaste $ 27839529caSEd Maste */ 28839529caSEd Maste 29839529caSEd Maste #ifndef _PE_H_ 30839529caSEd Maste #define _PE_H_ 31839529caSEd Maste 32839529caSEd Maste #include <stdint.h> 33839529caSEd Maste 34839529caSEd Maste /* 35839529caSEd Maste * MS-DOS header. 36839529caSEd Maste */ 37839529caSEd Maste 38839529caSEd Maste typedef struct _PE_DosHdr { 39839529caSEd Maste char dh_magic[2]; 40839529caSEd Maste uint16_t dh_lastsize; 41839529caSEd Maste uint16_t dh_nblock; 42839529caSEd Maste uint16_t dh_nreloc; 43839529caSEd Maste uint16_t dh_hdrsize; 44839529caSEd Maste uint16_t dh_minalloc; 45839529caSEd Maste uint16_t dh_maxalloc; 46839529caSEd Maste uint16_t dh_ss; 47839529caSEd Maste uint16_t dh_sp; 48839529caSEd Maste uint16_t dh_checksum; 49839529caSEd Maste uint16_t dh_ip; 50839529caSEd Maste uint16_t dh_cs; 51839529caSEd Maste uint16_t dh_relocpos; 52839529caSEd Maste uint16_t dh_noverlay; 53839529caSEd Maste uint16_t dh_reserved1[4]; 54839529caSEd Maste uint16_t dh_oemid; 55839529caSEd Maste uint16_t dh_oeminfo; 56839529caSEd Maste uint16_t dh_reserved2[10]; 57839529caSEd Maste uint32_t dh_lfanew; 58839529caSEd Maste } PE_DosHdr; 59839529caSEd Maste 60839529caSEd Maste /* 61839529caSEd Maste * Rich header. 62839529caSEd Maste */ 63839529caSEd Maste 64839529caSEd Maste typedef struct _PE_RichHdr { 65839529caSEd Maste uint32_t rh_xor; 66839529caSEd Maste uint32_t rh_total; 67839529caSEd Maste uint32_t *rh_compid; 68839529caSEd Maste uint32_t *rh_cnt; 69839529caSEd Maste } PE_RichHdr; 70839529caSEd Maste 71839529caSEd Maste /* 72839529caSEd Maste * COFF header: Machine Types. 73839529caSEd Maste */ 74839529caSEd Maste 75839529caSEd Maste #define IMAGE_FILE_MACHINE_UNKNOWN 0x0 /* not specified */ 76839529caSEd Maste #define IMAGE_FILE_MACHINE_AM33 0x1d3 /* Matsushita AM33 */ 77839529caSEd Maste #define IMAGE_FILE_MACHINE_AMD64 0x8664 /* x86-64 */ 78839529caSEd Maste #define IMAGE_FILE_MACHINE_ARM 0x1c0 /* ARM LE */ 79839529caSEd Maste #define IMAGE_FILE_MACHINE_ARMNT 0x1c4 /* ARMv7(or higher) Thumb */ 80839529caSEd Maste #define IMAGE_FILE_MACHINE_ARM64 0xaa64 /* ARMv8 64-bit */ 81839529caSEd Maste #define IMAGE_FILE_MACHINE_EBC 0xebc /* EFI byte code */ 82839529caSEd Maste #define IMAGE_FILE_MACHINE_I386 0x14c /* x86 */ 83839529caSEd Maste #define IMAGE_FILE_MACHINE_IA64 0x200 /* IA64 */ 84839529caSEd Maste #define IMAGE_FILE_MACHINE_M32R 0x9041 /* Mitsubishi M32R LE */ 85839529caSEd Maste #define IMAGE_FILE_MACHINE_MIPS16 0x266 /* MIPS16 */ 86839529caSEd Maste #define IMAGE_FILE_MACHINE_MIPSFPU 0x366 /* MIPS with FPU */ 87839529caSEd Maste #define IMAGE_FILE_MACHINE_MIPSFPU16 0x466 /* MIPS16 with FPU */ 88839529caSEd Maste #define IMAGE_FILE_MACHINE_POWERPC 0x1f0 /* Power PC LE */ 89839529caSEd Maste #define IMAGE_FILE_MACHINE_POWERPCFP 0x1f1 /* Power PC floating point */ 90839529caSEd Maste #define IMAGE_FILE_MACHINE_R4000 0x166 /* MIPS R4000 LE */ 91*b6b6f9ccSEd Maste #define IMAGE_FILE_MACHINE_RISCV32 0x5032 /* RISC-V 32-bit */ 92*b6b6f9ccSEd Maste #define IMAGE_FILE_MACHINE_RISCV64 0x5064 /* RISC-V 64-bit */ 93*b6b6f9ccSEd Maste #define IMAGE_FILE_MACHINE_RISCV128 0x5128 /* RISC-V 128-bit */ 94839529caSEd Maste #define IMAGE_FILE_MACHINE_SH3 0x1a2 /* Hitachi SH3 */ 95839529caSEd Maste #define IMAGE_FILE_MACHINE_SH3DSP 0x1a3 /* Hitachi SH3 DSP */ 96839529caSEd Maste #define IMAGE_FILE_MACHINE_SH4 0x1a6 /* Hitachi SH4 */ 97839529caSEd Maste #define IMAGE_FILE_MACHINE_SH5 0x1a8 /* Hitachi SH5 */ 98839529caSEd Maste #define IMAGE_FILE_MACHINE_THUMB 0x1c2 /* ARM or Thumb interworking */ 99839529caSEd Maste #define IMAGE_FILE_MACHINE_WCEMIPSV2 0x169 /* MIPS LE WCE v2 */ 100839529caSEd Maste 101839529caSEd Maste /* 102839529caSEd Maste * COFF header: Characteristics 103839529caSEd Maste */ 104839529caSEd Maste 105839529caSEd Maste #define IMAGE_FILE_RELOCS_STRIPPED 0x0001 106839529caSEd Maste #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 107839529caSEd Maste #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 108839529caSEd Maste #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 109839529caSEd Maste #define IMAGE_FILE_AGGRESSIVE_WS_TRIM 0x0010 110839529caSEd Maste #define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 111839529caSEd Maste #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 112839529caSEd Maste #define IMAGE_FILE_32BIT_MACHINE 0x0100 113839529caSEd Maste #define IMAGE_FILE_DEBUG_STRIPPED 0x0200 114839529caSEd Maste #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 115839529caSEd Maste #define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 116839529caSEd Maste #define IMAGE_FILE_SYSTEM 0x1000 117839529caSEd Maste #define IMAGE_FILE_DLL 0x2000 118839529caSEd Maste #define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 119839529caSEd Maste #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 120839529caSEd Maste 121839529caSEd Maste /* 122839529caSEd Maste * COFF Header. 123839529caSEd Maste */ 124839529caSEd Maste 125839529caSEd Maste typedef struct _PE_CoffHdr { 126839529caSEd Maste uint16_t ch_machine; 127839529caSEd Maste uint16_t ch_nsec; 128839529caSEd Maste uint32_t ch_timestamp; 129839529caSEd Maste uint32_t ch_symptr; 130839529caSEd Maste uint32_t ch_nsym; 131839529caSEd Maste uint16_t ch_optsize; 132839529caSEd Maste uint16_t ch_char; 133839529caSEd Maste } PE_CoffHdr; 134839529caSEd Maste 135839529caSEd Maste 136839529caSEd Maste /* 137839529caSEd Maste * Optional Header: Subsystem. 138839529caSEd Maste */ 139839529caSEd Maste 140839529caSEd Maste #define IMAGE_SUBSYSTEM_UNKNOWN 0 141839529caSEd Maste #define IMAGE_SUBSYSTEM_NATIVE 1 142839529caSEd Maste #define IMAGE_SUBSYSTEM_WINDOWS_GUI 2 143839529caSEd Maste #define IMAGE_SUBSYSTEM_WINDOWS_CUI 3 144839529caSEd Maste #define IMAGE_SUBSYSTEM_POSIX_CUI 7 145839529caSEd Maste #define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI 9 146839529caSEd Maste #define IMAGE_SUBSYSTEM_EFI_APPLICATION 10 147839529caSEd Maste #define IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER 11 148839529caSEd Maste #define IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER 12 149839529caSEd Maste #define IMAGE_SUBSYSTEM_EFI_ROM 13 150839529caSEd Maste #define IMAGE_SUBSYSTEM_XBOX 14 151839529caSEd Maste 152839529caSEd Maste /* 153839529caSEd Maste * Optional Header: DLL Characteristics 154839529caSEd Maste */ 155839529caSEd Maste 156839529caSEd Maste #define IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE 0x0040 157839529caSEd Maste #define IMAGE_DLL_CHARACTERISTICS_FORCE_INTEGRITY 0x0080 158839529caSEd Maste #define IMAGE_DLL_CHARACTERISTICS_NX_COMPAT 0x0100 159839529caSEd Maste #define IMAGE_DLL_CHARACTERISTICS_NO_ISOLATION 0x0200 160839529caSEd Maste #define IMAGE_DLL_CHARACTERISTICS_NO_SEH 0x0400 161839529caSEd Maste #define IMAGE_DLL_CHARACTERISTICS_NO_BIND 0x0800 162839529caSEd Maste #define IMAGE_DLL_CHARACTERISTICS_WDM_DRIVER 0x2000 163839529caSEd Maste #define IMAGE_DLL_CHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000 164839529caSEd Maste 165839529caSEd Maste /* 166839529caSEd Maste * Optional Header. 167839529caSEd Maste */ 168839529caSEd Maste 169839529caSEd Maste #define PE_FORMAT_ROM 0x107 170839529caSEd Maste #define PE_FORMAT_32 0x10b 171839529caSEd Maste #define PE_FORMAT_32P 0x20b 172839529caSEd Maste 173839529caSEd Maste typedef struct _PE_OptHdr { 174839529caSEd Maste uint16_t oh_magic; 175839529caSEd Maste uint8_t oh_ldvermajor; 176839529caSEd Maste uint8_t oh_ldverminor; 177839529caSEd Maste uint32_t oh_textsize; 178839529caSEd Maste uint32_t oh_datasize; 179839529caSEd Maste uint32_t oh_bsssize; 180839529caSEd Maste uint32_t oh_entry; 181839529caSEd Maste uint32_t oh_textbase; 182839529caSEd Maste uint32_t oh_database; 183839529caSEd Maste uint64_t oh_imgbase; 184839529caSEd Maste uint32_t oh_secalign; 185839529caSEd Maste uint32_t oh_filealign; 186839529caSEd Maste uint16_t oh_osvermajor; 187839529caSEd Maste uint16_t oh_osverminor; 188839529caSEd Maste uint16_t oh_imgvermajor; 189839529caSEd Maste uint16_t oh_imgverminor; 190839529caSEd Maste uint16_t oh_subvermajor; 191839529caSEd Maste uint16_t oh_subverminor; 192839529caSEd Maste uint32_t oh_win32ver; 193839529caSEd Maste uint32_t oh_imgsize; 194839529caSEd Maste uint32_t oh_hdrsize; 195839529caSEd Maste uint32_t oh_checksum; 196839529caSEd Maste uint16_t oh_subsystem; 197839529caSEd Maste uint16_t oh_dllchar; 198839529caSEd Maste uint64_t oh_stacksizer; 199839529caSEd Maste uint64_t oh_stacksizec; 200839529caSEd Maste uint64_t oh_heapsizer; 201839529caSEd Maste uint64_t oh_heapsizec; 202839529caSEd Maste uint32_t oh_ldrflags; 203839529caSEd Maste uint32_t oh_ndatadir; 204839529caSEd Maste } PE_OptHdr; 205839529caSEd Maste 206839529caSEd Maste /* 207839529caSEd Maste * Optional Header: Data Directories. 208839529caSEd Maste */ 209839529caSEd Maste 210839529caSEd Maste #define PE_DD_EXPORT 0 211839529caSEd Maste #define PE_DD_IMPORT 1 212839529caSEd Maste #define PE_DD_RESROUCE 2 213839529caSEd Maste #define PE_DD_EXCEPTION 3 214839529caSEd Maste #define PE_DD_CERTIFICATE 4 215839529caSEd Maste #define PE_DD_BASERELOC 5 216839529caSEd Maste #define PE_DD_DEBUG 6 217839529caSEd Maste #define PE_DD_ARCH 7 218839529caSEd Maste #define PE_DD_GLOBALPTR 8 219839529caSEd Maste #define PE_DD_TLS 9 220839529caSEd Maste #define PE_DD_LOADCONFIG 10 221839529caSEd Maste #define PE_DD_BOUNDIMPORT 11 222839529caSEd Maste #define PE_DD_IAT 12 223839529caSEd Maste #define PE_DD_DELAYIMPORT 13 224839529caSEd Maste #define PE_DD_CLRRUNTIME 14 225839529caSEd Maste #define PE_DD_RESERVED 15 226839529caSEd Maste #define PE_DD_MAX 16 227839529caSEd Maste 228839529caSEd Maste typedef struct _PE_DataDirEntry { 229839529caSEd Maste uint32_t de_addr; 230839529caSEd Maste uint32_t de_size; 231839529caSEd Maste } PE_DataDirEntry; 232839529caSEd Maste 233839529caSEd Maste typedef struct _PE_DataDir { 234839529caSEd Maste PE_DataDirEntry dd_e[PE_DD_MAX]; 235839529caSEd Maste uint32_t dd_total; 236839529caSEd Maste } PE_DataDir; 237839529caSEd Maste 238839529caSEd Maste /* 239839529caSEd Maste * Section Headers: Section flags. 240839529caSEd Maste */ 241839529caSEd Maste 242839529caSEd Maste #define IMAGE_SCN_TYPE_NO_PAD 0x00000008 243839529caSEd Maste #define IMAGE_SCN_CNT_CODE 0x00000020 244839529caSEd Maste #define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040 245839529caSEd Maste #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 246839529caSEd Maste #define IMAGE_SCN_LNK_OTHER 0x00000100 247839529caSEd Maste #define IMAGE_SCN_LNK_INFO 0x00000200 248839529caSEd Maste #define IMAGE_SCN_LNK_REMOVE 0x00000800 249839529caSEd Maste #define IMAGE_SCN_LNK_COMDAT 0x00001000 250839529caSEd Maste #define IMAGE_SCN_GPREL 0x00008000 251839529caSEd Maste #define IMAGE_SCN_MEM_PURGEABLE 0x00020000 252839529caSEd Maste #define IMAGE_SCN_MEM_16BIT 0x00020000 253839529caSEd Maste #define IMAGE_SCN_MEM_LOCKED 0x00040000 254839529caSEd Maste #define IMAGE_SCN_MEM_PRELOAD 0x00080000 255839529caSEd Maste #define IMAGE_SCN_ALIGN_1BYTES 0x00100000 256839529caSEd Maste #define IMAGE_SCN_ALIGN_2BYTES 0x00200000 257839529caSEd Maste #define IMAGE_SCN_ALIGN_4BYTES 0x00300000 258839529caSEd Maste #define IMAGE_SCN_ALIGN_8BYTES 0x00400000 259839529caSEd Maste #define IMAGE_SCN_ALIGN_16BYTES 0x00500000 260839529caSEd Maste #define IMAGE_SCN_ALIGN_32BYTES 0x00600000 261839529caSEd Maste #define IMAGE_SCN_ALIGN_64BYTES 0x00700000 262839529caSEd Maste #define IMAGE_SCN_ALIGN_128BYTES 0x00800000 263839529caSEd Maste #define IMAGE_SCN_ALIGN_256BYTES 0x00900000 264839529caSEd Maste #define IMAGE_SCN_ALIGN_512BYTES 0x00A00000 265839529caSEd Maste #define IMAGE_SCN_ALIGN_1024BYTES 0x00B00000 266839529caSEd Maste #define IMAGE_SCN_ALIGN_2048BYTES 0x00C00000 267839529caSEd Maste #define IMAGE_SCN_ALIGN_4096BYTES 0x00D00000 268839529caSEd Maste #define IMAGE_SCN_ALIGN_8192BYTES 0x00E00000 269839529caSEd Maste #define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000 270839529caSEd Maste #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000 271839529caSEd Maste #define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 272839529caSEd Maste #define IMAGE_SCN_MEM_NOT_PAGED 0x08000000 273839529caSEd Maste #define IMAGE_SCN_MEM_SHARED 0x10000000 274839529caSEd Maste #define IMAGE_SCN_MEM_EXECUTE 0x20000000 275839529caSEd Maste #define IMAGE_SCN_MEM_READ 0x40000000 276839529caSEd Maste #define IMAGE_SCN_MEM_WRITE 0x80000000 277839529caSEd Maste 278839529caSEd Maste /* 279839529caSEd Maste * Section Headers. 280839529caSEd Maste */ 281839529caSEd Maste 282839529caSEd Maste typedef struct _PE_SecHdr { 283839529caSEd Maste char sh_name[8]; 284839529caSEd Maste uint32_t sh_virtsize; 285839529caSEd Maste uint32_t sh_addr; 286839529caSEd Maste uint32_t sh_rawsize; 287839529caSEd Maste uint32_t sh_rawptr; 288839529caSEd Maste uint32_t sh_relocptr; 289839529caSEd Maste uint32_t sh_lineptr; 290839529caSEd Maste uint16_t sh_nreloc; 291839529caSEd Maste uint16_t sh_nline; 292839529caSEd Maste uint32_t sh_char; 293839529caSEd Maste } PE_SecHdr; 294839529caSEd Maste 295839529caSEd Maste #endif /* !_PE_H_ */ 296