Expand description
Image structures as defined by Windows.
No attempt is made to abstract over endianness.
Sources:
- winnt.h, ctrl-f
IMAGE_DOS_HEADER - ImageHlp Structures
- Peering Inside the PE: A Tour of the Win32 Portable Executable File Format
Structs§
- FPO_
DATA - GUID
- IMAGE_
BASE_ RELOCATION - IMAGE_
DATA_ DIRECTORY - IMAGE_
DEBUG_ CV_ INFO_ PDB20 - IMAGE_
DEBUG_ CV_ INFO_ PDB70 - IMAGE_
DEBUG_ DIRECTORY - IMAGE_
DEBUG_ MISC - IMAGE_
DEBUG_ VC_ FEATURE - IMAGE_
DOS_ HEADER - IMAGE_
DYNAMIC_ RELOCATIO N32 - IMAGE_
DYNAMIC_ RELOCATIO N64 - IMAGE_
DYNAMIC_ RELOCATION_ TABLE - IMAGE_
EXPORT_ DIRECTORY - IMAGE_
FILE_ HEADER - IMAGE_
GUARDC F32 - IMAGE_
GUARDC F64 - IMAGE_
IMPORT_ DESCRIPTOR - IMAGE_
LOAD_ CONFIG_ CODE_ INTEGRITY - IMAGE_
LOAD_ CONFIG_ DIRECTOR Y32 - IMAGE_
LOAD_ CONFIG_ DIRECTOR Y64 - IMAGE_
NT_ HEADER S32 - IMAGE_
NT_ HEADER S64 - IMAGE_
OPTIONAL_ HEADE R32 - IMAGE_
OPTIONAL_ HEADE R64 - IMAGE_
RESOURCE_ DATA_ ENTRY - IMAGE_
RESOURCE_ DIRECTORY - IMAGE_
RESOURCE_ DIRECTORY_ ENTRY - IMAGE_
SECTION_ HEADER - IMAGE_
TLS_ DIRECTOR Y32 - IMAGE_
TLS_ DIRECTOR Y64 - IMAGE_
VERSION - RUNTIME_
FUNCTION - SCOPE_
RECORD - SCOPE_
TABLE - UNWIND_
CODE - UNWIND_
INFO - VS_
FIXEDFILEINFO - VS_
VERSION - WIN_
CERTIFICATE
Constants§
- FRAME_
FPO - FRAME_
TRAP - FRAME_
TSS - IMAGE_
DEBUG_ MISC_ EXENAME - IMAGE_
DEBUG_ TYPE_ BORLAND - IMAGE_
DEBUG_ TYPE_ CLSID - IMAGE_
DEBUG_ TYPE_ CODEVIEW - IMAGE_
DEBUG_ TYPE_ COFF - IMAGE_
DEBUG_ TYPE_ EXCEPTION - IMAGE_
DEBUG_ TYPE_ FIXUP - IMAGE_
DEBUG_ TYPE_ FPO - IMAGE_
DEBUG_ TYPE_ ILTCG - IMAGE_
DEBUG_ TYPE_ MISC - IMAGE_
DEBUG_ TYPE_ MPX - IMAGE_
DEBUG_ TYPE_ OMAP_ FROM_ SRC - IMAGE_
DEBUG_ TYPE_ OMAP_ TO_ SRC - IMAGE_
DEBUG_ TYPE_ POGO - IMAGE_
DEBUG_ TYPE_ REPRO - IMAGE_
DEBUG_ TYPE_ RESERVE D10 - IMAGE_
DEBUG_ TYPE_ UNKNOWN - IMAGE_
DEBUG_ TYPE_ VC_ FEATURE - IMAGE_
DIRECTORY_ ENTRY_ ARCHITECTURE - IMAGE_
DIRECTORY_ ENTRY_ BASERELOC - IMAGE_
DIRECTORY_ ENTRY_ BOUND_ IMPORT - IMAGE_
DIRECTORY_ ENTRY_ COM_ DESCRIPTOR - IMAGE_
DIRECTORY_ ENTRY_ DEBUG - IMAGE_
DIRECTORY_ ENTRY_ DELAY_ IMPORT - IMAGE_
DIRECTORY_ ENTRY_ EXCEPTION - IMAGE_
DIRECTORY_ ENTRY_ EXPORT - IMAGE_
DIRECTORY_ ENTRY_ GLOBALPTR - IMAGE_
DIRECTORY_ ENTRY_ IAT - IMAGE_
DIRECTORY_ ENTRY_ IMPORT - IMAGE_
DIRECTORY_ ENTRY_ LOAD_ CONFIG - IMAGE_
DIRECTORY_ ENTRY_ RESOURCE - IMAGE_
DIRECTORY_ ENTRY_ SECURITY - IMAGE_
DIRECTORY_ ENTRY_ TLS - IMAGE_
DLLCHARACTERISTICS_ APPCONTAINER - IMAGE_
DLLCHARACTERISTICS_ DYNAMIC_ BASE - IMAGE_
DLLCHARACTERISTICS_ FORCE_ INTEGRITY - IMAGE_
DLLCHARACTERISTICS_ GUARD_ CF - IMAGE_
DLLCHARACTERISTICS_ HIGH_ ENTROPY_ VA - IMAGE_
DLLCHARACTERISTICS_ NO_ BIND - IMAGE_
DLLCHARACTERISTICS_ NO_ ISOLATION - IMAGE_
DLLCHARACTERISTICS_ NO_ SEH - IMAGE_
DLLCHARACTERISTICS_ NX_ COMPAT - IMAGE_
DLLCHARACTERISTICS_ TERMINAL_ SERVER_ AWARE - IMAGE_
DLLCHARACTERISTICS_ WDM_ DRIVER - IMAGE_
DOS_ SIGNATURE - IMAGE_
DYNAMIC_ RELOCATION_ GUARD_ RF_ EPILOGUE - IMAGE_
DYNAMIC_ RELOCATION_ GUARD_ RF_ PROLOGUE - IMAGE_
FILE_ 32BIT_ MACHINE - IMAGE_
FILE_ AGGRESIVE_ WS_ TRIM - IMAGE_
FILE_ BYTES_ REVERSED_ HI - IMAGE_
FILE_ BYTES_ REVERSED_ LO - IMAGE_
FILE_ DEBUG_ STRIPPED - IMAGE_
FILE_ DLL - IMAGE_
FILE_ EXECUTABLE_ IMAGE - IMAGE_
FILE_ LARGE_ ADDRESS_ AWARE - IMAGE_
FILE_ LINE_ NUMS_ STRIPPED - IMAGE_
FILE_ LOCAL_ SYMS_ STRIPPED - IMAGE_
FILE_ MACHINE_ AMD64 - IMAGE_
FILE_ MACHINE_ I386 - IMAGE_
FILE_ MACHINE_ IA64 - IMAGE_
FILE_ NET_ RUN_ FROM_ SWAP - IMAGE_
FILE_ RELOCS_ STRIPPED - IMAGE_
FILE_ REMOVABLE_ RUN_ FROM_ SWAP - IMAGE_
FILE_ SYSTEM - IMAGE_
FILE_ UP_ SYSTEM_ ONLY - IMAGE_
GUARD_ CFW_ INSTRUMENTED - IMAGE_
GUARD_ CF_ ENABLE_ EXPORT_ SUPPRESSION - IMAGE_
GUARD_ CF_ EXPORT_ SUPPRESSION_ INFO_ PRESENT - IMAGE_
GUARD_ CF_ FUNCTION_ TABLE_ PRESENT - IMAGE_
GUARD_ CF_ FUNCTION_ TABLE_ SIZE_ MASK - IMAGE_
GUARD_ CF_ FUNCTION_ TABLE_ SIZE_ SHIFT - IMAGE_
GUARD_ CF_ INSTRUMENTED - IMAGE_
GUARD_ CF_ LONGJUMP_ TABLE_ PRESENT - IMAGE_
GUARD_ DELAYLOAD_ IAT_ IN_ ITS_ OWN_ SECTION - IMAGE_
GUARD_ PROTECT_ DELAYLOAD_ IAT - IMAGE_
GUARD_ RF_ ENABLE - IMAGE_
GUARD_ RF_ INSTRUMENTED - IMAGE_
GUARD_ RF_ STRICT - IMAGE_
GUARD_ SECURITY_ COOKIE_ UNUSED - IMAGE_
NT_ HEADERS_ SIGNATURE - IMAGE_
NT_ OPTIONAL_ HDR32_ MAGIC - IMAGE_
NT_ OPTIONAL_ HDR64_ MAGIC - IMAGE_
NUMBEROF_ DIRECTORY_ ENTRIES - IMAGE_
ORDINAL_ FLAG32 - IMAGE_
ORDINAL_ FLAG64 - IMAGE_
REL_ BASED_ ABSOLUTE - IMAGE_
REL_ BASED_ ARM_ MOV32 - IMAGE_
REL_ BASED_ DIR64 - IMAGE_
REL_ BASED_ HIGH - IMAGE_
REL_ BASED_ HIGHADJ - IMAGE_
REL_ BASED_ HIGHLOW - IMAGE_
REL_ BASED_ IA64IM M64 - IMAGE_
REL_ BASED_ LOW - IMAGE_
REL_ BASED_ MACHINE_ SPECIFIC_ 5 - IMAGE_
REL_ BASED_ MACHINE_ SPECIFIC_ 7 - IMAGE_
REL_ BASED_ MACHINE_ SPECIFIC_ 8 - IMAGE_
REL_ BASED_ MACHINE_ SPECIFIC_ 9 - IMAGE_
REL_ BASED_ MIPSJMPADDR - IMAGE_
REL_ BASED_ MIPSJMPADD R16 - IMAGE_
REL_ BASED_ RESERVED - IMAGE_
REL_ BASED_ THUMB_ MOV32 - IMAGE_
ROM_ OPTIONAL_ HDR_ MAGIC - IMAGE_
SCN_ ALIGN_ 1BYTES - IMAGE_
SCN_ ALIGN_ 2BYTES - IMAGE_
SCN_ ALIGN_ 4BYTES - IMAGE_
SCN_ ALIGN_ 8BYTES - IMAGE_
SCN_ ALIGN_ 16BYTES - IMAGE_
SCN_ ALIGN_ 32BYTES - IMAGE_
SCN_ ALIGN_ 64BYTES - IMAGE_
SCN_ ALIGN_ 128BYTES - IMAGE_
SCN_ ALIGN_ 256BYTES - IMAGE_
SCN_ ALIGN_ 512BYTES - IMAGE_
SCN_ ALIGN_ 1024BYTES - IMAGE_
SCN_ ALIGN_ 2048BYTES - IMAGE_
SCN_ ALIGN_ 4096BYTES - IMAGE_
SCN_ ALIGN_ 8192BYTES - IMAGE_
SCN_ CNT_ CODE - IMAGE_
SCN_ CNT_ INITIALIZED_ DATA - IMAGE_
SCN_ CNT_ UNINITIALIZED_ DATA - IMAGE_
SCN_ GPREL - IMAGE_
SCN_ LNK_ COMDAT - IMAGE_
SCN_ LNK_ INFO - IMAGE_
SCN_ LNK_ NRELOC_ OVFL - IMAGE_
SCN_ LNK_ OTHER - IMAGE_
SCN_ LNK_ REMOVE - IMAGE_
SCN_ MEM_ DISCARDABLE - IMAGE_
SCN_ MEM_ EXECUTE - IMAGE_
SCN_ MEM_ LOCKED - IMAGE_
SCN_ MEM_ NOT_ CACHED - IMAGE_
SCN_ MEM_ NOT_ PAGED - IMAGE_
SCN_ MEM_ PRELOAD - IMAGE_
SCN_ MEM_ PURGEABLE - IMAGE_
SCN_ MEM_ READ - IMAGE_
SCN_ MEM_ SHARED - IMAGE_
SCN_ MEM_ WRITE - IMAGE_
SCN_ NO_ DEFER_ SPEC_ EXC - IMAGE_
SCN_ TYPE_ NO_ PAD - IMAGE_
SIZEOF_ SHORT_ NAME - IMAGE_
SUBSYSTEM_ EFI_ APPLICATION - IMAGE_
SUBSYSTEM_ EFI_ BOOT_ SERVICE_ DRIVER - IMAGE_
SUBSYSTEM_ EFI_ ROM - IMAGE_
SUBSYSTEM_ EFI_ RUNTIME_ DRIVER - IMAGE_
SUBSYSTEM_ NATIVE - IMAGE_
SUBSYSTEM_ NATIVE_ WINDOWS - IMAGE_
SUBSYSTEM_ OS2_ CUI - IMAGE_
SUBSYSTEM_ POSIX_ CUI - IMAGE_
SUBSYSTEM_ UNKNOWN - IMAGE_
SUBSYSTEM_ WINDOWS_ BOOT_ APPLICATION - IMAGE_
SUBSYSTEM_ WINDOWS_ CE_ GUI - IMAGE_
SUBSYSTEM_ WINDOWS_ CUI - IMAGE_
SUBSYSTEM_ WINDOWS_ GUI - IMAGE_
SUBSYSTEM_ XBOX - RT_
ACCELERATOR - RT_
ANICURSOR - RT_
ANIICON - RT_
BITMAP - RT_
CURSOR - RT_
DIALOG - RT_
DLGINCLUDE - RT_FONT
- RT_
FONTDIR - RT_
GROUP_ CURSOR - RT_
GROUP_ ICON - RT_HTML
- RT_ICON
- RT_
MANIFEST - RT_MENU
- RT_
MESSAGETABLE - RT_
PLUGPLAY - RT_
RCDATA - RT_
STRING - RT_
VERSION - RT_VXD
- UNW_
FLAG_ CHAININFO - UNW_
FLAG_ EHANDLER - UNW_
FLAG_ FHANDLER - UNW_
FLAG_ NHANDLER - UNW_
FLAG_ UHANDLER - UWOP_
ALLOC_ LARGE - UWOP_
ALLOC_ SMALL - UWOP_
PUSH_ MACHFRAME - UWOP_
PUSH_ NONVOL - UWOP_
SAVE_ NONVOL - UWOP_
SAVE_ NONVOL_ FAR - UWOP_
SAVE_ XMM128 - UWOP_
SAVE_ XMM128_ FAR - UWOP_
SET_ FPREG - VS_
FIXEDFILEINFO_ SIGNATURE - WIN_
CERT_ REVISION_ 1_ 0 - WIN_
CERT_ TYPE_ PKCS1_ SIGN - WIN_
CERT_ TYPE_ PKCS_ SIGNED_ DATA - WIN_
CERT_ TYPE_ RESERVED_ 1 - WIN_
CERT_ TYPE_ X509
Functions§
- image_
base - Gets the base address of the module this code is linked with.