object/
pe.rs

1//! PE/COFF definitions.
2//!
3//! These definitions are independent of read/write support, although we do implement
4//! some traits useful for those.
5//!
6//! This module is based heavily on "winnt.h" (10.0.17763.0).
7
8#![allow(missing_docs)]
9
10use core::convert::TryInto;
11
12use crate::endian::{LittleEndian as LE, I32, U16, U32, U64};
13use crate::pod::Pod;
14
15/// MZ
16pub const IMAGE_DOS_SIGNATURE: u16 = 0x5A4D;
17/// NE
18pub const IMAGE_OS2_SIGNATURE: u16 = 0x454E;
19/// LE
20pub const IMAGE_OS2_SIGNATURE_LE: u16 = 0x454C;
21/// LE
22pub const IMAGE_VXD_SIGNATURE: u16 = 0x454C;
23/// PE00
24pub const IMAGE_NT_SIGNATURE: u32 = 0x0000_4550;
25
26/// DOS .EXE header
27#[derive(Debug, Clone, Copy)]
28#[repr(C)]
29pub struct ImageDosHeader {
30    /// Magic number
31    pub e_magic: U16<LE>,
32    /// Bytes on last page of file
33    pub e_cblp: U16<LE>,
34    /// Pages in file
35    pub e_cp: U16<LE>,
36    /// Relocations
37    pub e_crlc: U16<LE>,
38    /// Size of header in paragraphs
39    pub e_cparhdr: U16<LE>,
40    /// Minimum extra paragraphs needed
41    pub e_minalloc: U16<LE>,
42    /// Maximum extra paragraphs needed
43    pub e_maxalloc: U16<LE>,
44    /// Initial (relative) SS value
45    pub e_ss: U16<LE>,
46    /// Initial SP value
47    pub e_sp: U16<LE>,
48    /// Checksum
49    pub e_csum: U16<LE>,
50    /// Initial IP value
51    pub e_ip: U16<LE>,
52    /// Initial (relative) CS value
53    pub e_cs: U16<LE>,
54    /// File address of relocation table
55    pub e_lfarlc: U16<LE>,
56    /// Overlay number
57    pub e_ovno: U16<LE>,
58    /// Reserved words
59    pub e_res: [U16<LE>; 4],
60    /// OEM identifier (for e_oeminfo)
61    pub e_oemid: U16<LE>,
62    /// OEM information; e_oemid specific
63    pub e_oeminfo: U16<LE>,
64    /// Reserved words
65    pub e_res2: [U16<LE>; 10],
66    /// File address of new exe header
67    pub e_lfanew: U32<LE>,
68}
69
70/// OS/2 .EXE header
71#[derive(Debug, Clone, Copy)]
72#[repr(C)]
73pub struct ImageOs2Header {
74    /// Magic number
75    pub ne_magic: U16<LE>,
76    /// Version number
77    pub ne_ver: i8,
78    /// Revision number
79    pub ne_rev: i8,
80    /// Offset of Entry Table
81    pub ne_enttab: U16<LE>,
82    /// Number of bytes in Entry Table
83    pub ne_cbenttab: U16<LE>,
84    /// Checksum of whole file
85    pub ne_crc: I32<LE>,
86    /// Flag word
87    pub ne_flags: U16<LE>,
88    /// Automatic data segment number
89    pub ne_autodata: U16<LE>,
90    /// Initial heap allocation
91    pub ne_heap: U16<LE>,
92    /// Initial stack allocation
93    pub ne_stack: U16<LE>,
94    /// Initial CS:IP setting
95    pub ne_csip: I32<LE>,
96    /// Initial SS:SP setting
97    pub ne_sssp: I32<LE>,
98    /// Count of file segments
99    pub ne_cseg: U16<LE>,
100    /// Entries in Module Reference Table
101    pub ne_cmod: U16<LE>,
102    /// Size of non-resident name table
103    pub ne_cbnrestab: U16<LE>,
104    /// Offset of Segment Table
105    pub ne_segtab: U16<LE>,
106    /// Offset of Resource Table
107    pub ne_rsrctab: U16<LE>,
108    /// Offset of resident name table
109    pub ne_restab: U16<LE>,
110    /// Offset of Module Reference Table
111    pub ne_modtab: U16<LE>,
112    /// Offset of Imported Names Table
113    pub ne_imptab: U16<LE>,
114    /// Offset of Non-resident Names Table
115    pub ne_nrestab: I32<LE>,
116    /// Count of movable entries
117    pub ne_cmovent: U16<LE>,
118    /// Segment alignment shift count
119    pub ne_align: U16<LE>,
120    /// Count of resource segments
121    pub ne_cres: U16<LE>,
122    /// Target Operating system
123    pub ne_exetyp: u8,
124    /// Other .EXE flags
125    pub ne_flagsothers: u8,
126    /// offset to return thunks
127    pub ne_pretthunks: U16<LE>,
128    /// offset to segment ref. bytes
129    pub ne_psegrefbytes: U16<LE>,
130    /// Minimum code swap area size
131    pub ne_swaparea: U16<LE>,
132    /// Expected Windows version number
133    pub ne_expver: U16<LE>,
134}
135
136/// Windows VXD header
137#[derive(Debug, Clone, Copy)]
138#[repr(C)]
139pub struct ImageVxdHeader {
140    /// Magic number
141    pub e32_magic: U16<LE>,
142    /// The byte ordering for the VXD
143    pub e32_border: u8,
144    /// The word ordering for the VXD
145    pub e32_worder: u8,
146    /// The EXE format level for now = 0
147    pub e32_level: U32<LE>,
148    /// The CPU type
149    pub e32_cpu: U16<LE>,
150    /// The OS type
151    pub e32_os: U16<LE>,
152    /// Module version
153    pub e32_ver: U32<LE>,
154    /// Module flags
155    pub e32_mflags: U32<LE>,
156    /// Module # pages
157    pub e32_mpages: U32<LE>,
158    /// Object # for instruction pointer
159    pub e32_startobj: U32<LE>,
160    /// Extended instruction pointer
161    pub e32_eip: U32<LE>,
162    /// Object # for stack pointer
163    pub e32_stackobj: U32<LE>,
164    /// Extended stack pointer
165    pub e32_esp: U32<LE>,
166    /// VXD page size
167    pub e32_pagesize: U32<LE>,
168    /// Last page size in VXD
169    pub e32_lastpagesize: U32<LE>,
170    /// Fixup section size
171    pub e32_fixupsize: U32<LE>,
172    /// Fixup section checksum
173    pub e32_fixupsum: U32<LE>,
174    /// Loader section size
175    pub e32_ldrsize: U32<LE>,
176    /// Loader section checksum
177    pub e32_ldrsum: U32<LE>,
178    /// Object table offset
179    pub e32_objtab: U32<LE>,
180    /// Number of objects in module
181    pub e32_objcnt: U32<LE>,
182    /// Object page map offset
183    pub e32_objmap: U32<LE>,
184    /// Object iterated data map offset
185    pub e32_itermap: U32<LE>,
186    /// Offset of Resource Table
187    pub e32_rsrctab: U32<LE>,
188    /// Number of resource entries
189    pub e32_rsrccnt: U32<LE>,
190    /// Offset of resident name table
191    pub e32_restab: U32<LE>,
192    /// Offset of Entry Table
193    pub e32_enttab: U32<LE>,
194    /// Offset of Module Directive Table
195    pub e32_dirtab: U32<LE>,
196    /// Number of module directives
197    pub e32_dircnt: U32<LE>,
198    /// Offset of Fixup Page Table
199    pub e32_fpagetab: U32<LE>,
200    /// Offset of Fixup Record Table
201    pub e32_frectab: U32<LE>,
202    /// Offset of Import Module Name Table
203    pub e32_impmod: U32<LE>,
204    /// Number of entries in Import Module Name Table
205    pub e32_impmodcnt: U32<LE>,
206    /// Offset of Import Procedure Name Table
207    pub e32_impproc: U32<LE>,
208    /// Offset of Per-Page Checksum Table
209    pub e32_pagesum: U32<LE>,
210    /// Offset of Enumerated Data Pages
211    pub e32_datapage: U32<LE>,
212    /// Number of preload pages
213    pub e32_preload: U32<LE>,
214    /// Offset of Non-resident Names Table
215    pub e32_nrestab: U32<LE>,
216    /// Size of Non-resident Name Table
217    pub e32_cbnrestab: U32<LE>,
218    /// Non-resident Name Table Checksum
219    pub e32_nressum: U32<LE>,
220    /// Object # for automatic data object
221    pub e32_autodata: U32<LE>,
222    /// Offset of the debugging information
223    pub e32_debuginfo: U32<LE>,
224    /// The length of the debugging info. in bytes
225    pub e32_debuglen: U32<LE>,
226    /// Number of instance pages in preload section of VXD file
227    pub e32_instpreload: U32<LE>,
228    /// Number of instance pages in demand load section of VXD file
229    pub e32_instdemand: U32<LE>,
230    /// Size of heap - for 16-bit apps
231    pub e32_heapsize: U32<LE>,
232    /// Reserved words
233    pub e32_res3: [u8; 12],
234    pub e32_winresoff: U32<LE>,
235    pub e32_winreslen: U32<LE>,
236    /// Device ID for VxD
237    pub e32_devid: U16<LE>,
238    /// DDK version for VxD
239    pub e32_ddkver: U16<LE>,
240}
241
242/// A PE rich header entry.
243///
244/// Rich headers have no official documentation, but have been heavily
245/// reversed-engineered and documented in the wild, e.g.:
246/// * `http://www.ntcore.com/files/richsign.htm`
247/// * `https://www.researchgate.net/figure/Structure-of-the-Rich-Header_fig1_318145388`
248///
249/// This data is "masked", i.e. XORed with a checksum derived from the file data.
250#[derive(Debug, Clone, Copy)]
251#[repr(C)]
252pub struct MaskedRichHeaderEntry {
253    pub masked_comp_id: U32<LE>,
254    pub masked_count: U32<LE>,
255}
256
257//
258// File header format.
259//
260
261#[derive(Debug, Clone, Copy)]
262#[repr(C)]
263pub struct ImageFileHeader {
264    pub machine: U16<LE>,
265    pub number_of_sections: U16<LE>,
266    pub time_date_stamp: U32<LE>,
267    pub pointer_to_symbol_table: U32<LE>,
268    pub number_of_symbols: U32<LE>,
269    pub size_of_optional_header: U16<LE>,
270    pub characteristics: U16<LE>,
271}
272
273pub const IMAGE_SIZEOF_FILE_HEADER: usize = 20;
274
275/// Relocation info stripped from file.
276pub const IMAGE_FILE_RELOCS_STRIPPED: u16 = 0x0001;
277/// File is executable  (i.e. no unresolved external references).
278pub const IMAGE_FILE_EXECUTABLE_IMAGE: u16 = 0x0002;
279/// Line numbers stripped from file.
280pub const IMAGE_FILE_LINE_NUMS_STRIPPED: u16 = 0x0004;
281/// Local symbols stripped from file.
282pub const IMAGE_FILE_LOCAL_SYMS_STRIPPED: u16 = 0x0008;
283/// Aggressively trim working set
284pub const IMAGE_FILE_AGGRESIVE_WS_TRIM: u16 = 0x0010;
285/// App can handle >2gb addresses
286pub const IMAGE_FILE_LARGE_ADDRESS_AWARE: u16 = 0x0020;
287/// Bytes of machine word are reversed.
288pub const IMAGE_FILE_BYTES_REVERSED_LO: u16 = 0x0080;
289/// 32 bit word machine.
290pub const IMAGE_FILE_32BIT_MACHINE: u16 = 0x0100;
291/// Debugging info stripped from file in .DBG file
292pub const IMAGE_FILE_DEBUG_STRIPPED: u16 = 0x0200;
293/// If Image is on removable media, copy and run from the swap file.
294pub const IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP: u16 = 0x0400;
295/// If Image is on Net, copy and run from the swap file.
296pub const IMAGE_FILE_NET_RUN_FROM_SWAP: u16 = 0x0800;
297/// System File.
298pub const IMAGE_FILE_SYSTEM: u16 = 0x1000;
299/// File is a DLL.
300pub const IMAGE_FILE_DLL: u16 = 0x2000;
301/// File should only be run on a UP machine
302pub const IMAGE_FILE_UP_SYSTEM_ONLY: u16 = 0x4000;
303/// Bytes of machine word are reversed.
304pub const IMAGE_FILE_BYTES_REVERSED_HI: u16 = 0x8000;
305
306pub const IMAGE_FILE_MACHINE_UNKNOWN: u16 = 0;
307/// Useful for indicating we want to interact with the host and not a WoW guest.
308pub const IMAGE_FILE_MACHINE_TARGET_HOST: u16 = 0x0001;
309/// Intel 386.
310pub const IMAGE_FILE_MACHINE_I386: u16 = 0x014c;
311/// MIPS little-endian, 0x160 big-endian
312pub const IMAGE_FILE_MACHINE_R3000: u16 = 0x0162;
313/// MIPS little-endian
314pub const IMAGE_FILE_MACHINE_R4000: u16 = 0x0166;
315/// MIPS little-endian
316pub const IMAGE_FILE_MACHINE_R10000: u16 = 0x0168;
317/// MIPS little-endian WCE v2
318pub const IMAGE_FILE_MACHINE_WCEMIPSV2: u16 = 0x0169;
319/// Alpha_AXP
320pub const IMAGE_FILE_MACHINE_ALPHA: u16 = 0x0184;
321/// SH3 little-endian
322pub const IMAGE_FILE_MACHINE_SH3: u16 = 0x01a2;
323pub const IMAGE_FILE_MACHINE_SH3DSP: u16 = 0x01a3;
324/// SH3E little-endian
325pub const IMAGE_FILE_MACHINE_SH3E: u16 = 0x01a4;
326/// SH4 little-endian
327pub const IMAGE_FILE_MACHINE_SH4: u16 = 0x01a6;
328/// SH5
329pub const IMAGE_FILE_MACHINE_SH5: u16 = 0x01a8;
330/// ARM Little-Endian
331pub const IMAGE_FILE_MACHINE_ARM: u16 = 0x01c0;
332/// ARM Thumb/Thumb-2 Little-Endian
333pub const IMAGE_FILE_MACHINE_THUMB: u16 = 0x01c2;
334/// ARM Thumb-2 Little-Endian
335pub const IMAGE_FILE_MACHINE_ARMNT: u16 = 0x01c4;
336pub const IMAGE_FILE_MACHINE_AM33: u16 = 0x01d3;
337/// IBM PowerPC Little-Endian
338pub const IMAGE_FILE_MACHINE_POWERPC: u16 = 0x01F0;
339pub const IMAGE_FILE_MACHINE_POWERPCFP: u16 = 0x01f1;
340/// IBM PowerPC Big-Endian
341pub const IMAGE_FILE_MACHINE_POWERPCBE: u16 = 0x01f2;
342/// Intel 64
343pub const IMAGE_FILE_MACHINE_IA64: u16 = 0x0200;
344/// MIPS
345pub const IMAGE_FILE_MACHINE_MIPS16: u16 = 0x0266;
346/// ALPHA64
347pub const IMAGE_FILE_MACHINE_ALPHA64: u16 = 0x0284;
348/// MIPS
349pub const IMAGE_FILE_MACHINE_MIPSFPU: u16 = 0x0366;
350/// MIPS
351pub const IMAGE_FILE_MACHINE_MIPSFPU16: u16 = 0x0466;
352pub const IMAGE_FILE_MACHINE_AXP64: u16 = IMAGE_FILE_MACHINE_ALPHA64;
353/// Infineon
354pub const IMAGE_FILE_MACHINE_TRICORE: u16 = 0x0520;
355pub const IMAGE_FILE_MACHINE_CEF: u16 = 0x0CEF;
356/// EFI Byte Code
357pub const IMAGE_FILE_MACHINE_EBC: u16 = 0x0EBC;
358/// AMD64 (K8)
359pub const IMAGE_FILE_MACHINE_AMD64: u16 = 0x8664;
360/// M32R little-endian
361pub const IMAGE_FILE_MACHINE_M32R: u16 = 0x9041;
362/// ARM64 Little-Endian
363pub const IMAGE_FILE_MACHINE_ARM64: u16 = 0xAA64;
364/// ARM64EC ("Emulation Compatible")
365pub const IMAGE_FILE_MACHINE_ARM64EC: u16 = 0xA641;
366pub const IMAGE_FILE_MACHINE_CEE: u16 = 0xC0EE;
367/// RISCV32
368pub const IMAGE_FILE_MACHINE_RISCV32: u16 = 0x5032;
369/// RISCV64
370pub const IMAGE_FILE_MACHINE_RISCV64: u16 = 0x5064;
371/// RISCV128
372pub const IMAGE_FILE_MACHINE_RISCV128: u16 = 0x5128;
373/// ARM64X (Mixed ARM64 and ARM64EC)
374pub const IMAGE_FILE_MACHINE_ARM64X: u16 = 0xA64E;
375/// CHPE x86 ("Compiled Hybrid Portable Executable")
376pub const IMAGE_FILE_MACHINE_CHPE_X86: u16 = 0x3A64;
377
378//
379// Directory format.
380//
381
382#[derive(Debug, Clone, Copy)]
383#[repr(C)]
384pub struct ImageDataDirectory {
385    pub virtual_address: U32<LE>,
386    pub size: U32<LE>,
387}
388
389pub const IMAGE_NUMBEROF_DIRECTORY_ENTRIES: usize = 16;
390
391//
392// Optional header format.
393//
394
395#[derive(Debug, Clone, Copy)]
396#[repr(C)]
397pub struct ImageOptionalHeader32 {
398    // Standard fields.
399    pub magic: U16<LE>,
400    pub major_linker_version: u8,
401    pub minor_linker_version: u8,
402    pub size_of_code: U32<LE>,
403    pub size_of_initialized_data: U32<LE>,
404    pub size_of_uninitialized_data: U32<LE>,
405    pub address_of_entry_point: U32<LE>,
406    pub base_of_code: U32<LE>,
407    pub base_of_data: U32<LE>,
408
409    // NT additional fields.
410    pub image_base: U32<LE>,
411    pub section_alignment: U32<LE>,
412    pub file_alignment: U32<LE>,
413    pub major_operating_system_version: U16<LE>,
414    pub minor_operating_system_version: U16<LE>,
415    pub major_image_version: U16<LE>,
416    pub minor_image_version: U16<LE>,
417    pub major_subsystem_version: U16<LE>,
418    pub minor_subsystem_version: U16<LE>,
419    pub win32_version_value: U32<LE>,
420    pub size_of_image: U32<LE>,
421    pub size_of_headers: U32<LE>,
422    pub check_sum: U32<LE>,
423    pub subsystem: U16<LE>,
424    pub dll_characteristics: U16<LE>,
425    pub size_of_stack_reserve: U32<LE>,
426    pub size_of_stack_commit: U32<LE>,
427    pub size_of_heap_reserve: U32<LE>,
428    pub size_of_heap_commit: U32<LE>,
429    pub loader_flags: U32<LE>,
430    pub number_of_rva_and_sizes: U32<LE>,
431    //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
432}
433
434#[derive(Debug, Clone, Copy)]
435#[repr(C)]
436pub struct ImageRomOptionalHeader {
437    pub magic: U16<LE>,
438    pub major_linker_version: u8,
439    pub minor_linker_version: u8,
440    pub size_of_code: U32<LE>,
441    pub size_of_initialized_data: U32<LE>,
442    pub size_of_uninitialized_data: U32<LE>,
443    pub address_of_entry_point: U32<LE>,
444    pub base_of_code: U32<LE>,
445    pub base_of_data: U32<LE>,
446    pub base_of_bss: U32<LE>,
447    pub gpr_mask: U32<LE>,
448    pub cpr_mask: [U32<LE>; 4],
449    pub gp_value: U32<LE>,
450}
451
452#[derive(Debug, Clone, Copy)]
453#[repr(C)]
454pub struct ImageOptionalHeader64 {
455    pub magic: U16<LE>,
456    pub major_linker_version: u8,
457    pub minor_linker_version: u8,
458    pub size_of_code: U32<LE>,
459    pub size_of_initialized_data: U32<LE>,
460    pub size_of_uninitialized_data: U32<LE>,
461    pub address_of_entry_point: U32<LE>,
462    pub base_of_code: U32<LE>,
463    pub image_base: U64<LE>,
464    pub section_alignment: U32<LE>,
465    pub file_alignment: U32<LE>,
466    pub major_operating_system_version: U16<LE>,
467    pub minor_operating_system_version: U16<LE>,
468    pub major_image_version: U16<LE>,
469    pub minor_image_version: U16<LE>,
470    pub major_subsystem_version: U16<LE>,
471    pub minor_subsystem_version: U16<LE>,
472    pub win32_version_value: U32<LE>,
473    pub size_of_image: U32<LE>,
474    pub size_of_headers: U32<LE>,
475    pub check_sum: U32<LE>,
476    pub subsystem: U16<LE>,
477    pub dll_characteristics: U16<LE>,
478    pub size_of_stack_reserve: U64<LE>,
479    pub size_of_stack_commit: U64<LE>,
480    pub size_of_heap_reserve: U64<LE>,
481    pub size_of_heap_commit: U64<LE>,
482    pub loader_flags: U32<LE>,
483    pub number_of_rva_and_sizes: U32<LE>,
484    //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
485}
486
487pub const IMAGE_NT_OPTIONAL_HDR32_MAGIC: u16 = 0x10b;
488pub const IMAGE_NT_OPTIONAL_HDR64_MAGIC: u16 = 0x20b;
489pub const IMAGE_ROM_OPTIONAL_HDR_MAGIC: u16 = 0x107;
490
491#[derive(Debug, Clone, Copy)]
492#[repr(C)]
493pub struct ImageNtHeaders64 {
494    pub signature: U32<LE>,
495    pub file_header: ImageFileHeader,
496    pub optional_header: ImageOptionalHeader64,
497}
498
499#[derive(Debug, Clone, Copy)]
500#[repr(C)]
501pub struct ImageNtHeaders32 {
502    pub signature: U32<LE>,
503    pub file_header: ImageFileHeader,
504    pub optional_header: ImageOptionalHeader32,
505}
506
507#[derive(Debug, Clone, Copy)]
508#[repr(C)]
509pub struct ImageRomHeaders {
510    pub file_header: ImageFileHeader,
511    pub optional_header: ImageRomOptionalHeader,
512}
513
514// Values for `ImageOptionalHeader*::subsystem`.
515
516/// Unknown subsystem.
517pub const IMAGE_SUBSYSTEM_UNKNOWN: u16 = 0;
518/// Image doesn't require a subsystem.
519pub const IMAGE_SUBSYSTEM_NATIVE: u16 = 1;
520/// Image runs in the Windows GUI subsystem.
521pub const IMAGE_SUBSYSTEM_WINDOWS_GUI: u16 = 2;
522/// Image runs in the Windows character subsystem.
523pub const IMAGE_SUBSYSTEM_WINDOWS_CUI: u16 = 3;
524/// image runs in the OS/2 character subsystem.
525pub const IMAGE_SUBSYSTEM_OS2_CUI: u16 = 5;
526/// image runs in the Posix character subsystem.
527pub const IMAGE_SUBSYSTEM_POSIX_CUI: u16 = 7;
528/// image is a native Win9x driver.
529pub const IMAGE_SUBSYSTEM_NATIVE_WINDOWS: u16 = 8;
530/// Image runs in the Windows CE subsystem.
531pub const IMAGE_SUBSYSTEM_WINDOWS_CE_GUI: u16 = 9;
532pub const IMAGE_SUBSYSTEM_EFI_APPLICATION: u16 = 10;
533pub const IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER: u16 = 11;
534pub const IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER: u16 = 12;
535pub const IMAGE_SUBSYSTEM_EFI_ROM: u16 = 13;
536pub const IMAGE_SUBSYSTEM_XBOX: u16 = 14;
537pub const IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION: u16 = 16;
538pub const IMAGE_SUBSYSTEM_XBOX_CODE_CATALOG: u16 = 17;
539
540// Values for `ImageOptionalHeader*::dll_characteristics`.
541
542//      IMAGE_LIBRARY_PROCESS_INIT            0x0001     // Reserved.
543//      IMAGE_LIBRARY_PROCESS_TERM            0x0002     // Reserved.
544//      IMAGE_LIBRARY_THREAD_INIT             0x0004     // Reserved.
545//      IMAGE_LIBRARY_THREAD_TERM             0x0008     // Reserved.
546/// Image can handle a high entropy 64-bit virtual address space.
547pub const IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA: u16 = 0x0020;
548/// DLL can move.
549pub const IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE: u16 = 0x0040;
550/// Code Integrity Image
551pub const IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY: u16 = 0x0080;
552/// Image is NX compatible
553pub const IMAGE_DLLCHARACTERISTICS_NX_COMPAT: u16 = 0x0100;
554/// Image understands isolation and doesn't want it
555pub const IMAGE_DLLCHARACTERISTICS_NO_ISOLATION: u16 = 0x0200;
556/// Image does not use SEH.  No SE handler may reside in this image
557pub const IMAGE_DLLCHARACTERISTICS_NO_SEH: u16 = 0x0400;
558/// Do not bind this image.
559pub const IMAGE_DLLCHARACTERISTICS_NO_BIND: u16 = 0x0800;
560/// Image should execute in an AppContainer
561pub const IMAGE_DLLCHARACTERISTICS_APPCONTAINER: u16 = 0x1000;
562/// Driver uses WDM model
563pub const IMAGE_DLLCHARACTERISTICS_WDM_DRIVER: u16 = 0x2000;
564/// Image supports Control Flow Guard.
565pub const IMAGE_DLLCHARACTERISTICS_GUARD_CF: u16 = 0x4000;
566pub const IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE: u16 = 0x8000;
567
568// Indices for `ImageOptionalHeader*::data_directory`.
569
570/// Export Directory
571pub const IMAGE_DIRECTORY_ENTRY_EXPORT: usize = 0;
572/// Import Directory
573pub const IMAGE_DIRECTORY_ENTRY_IMPORT: usize = 1;
574/// Resource Directory
575pub const IMAGE_DIRECTORY_ENTRY_RESOURCE: usize = 2;
576/// Exception Directory
577pub const IMAGE_DIRECTORY_ENTRY_EXCEPTION: usize = 3;
578/// Security Directory
579pub const IMAGE_DIRECTORY_ENTRY_SECURITY: usize = 4;
580/// Base Relocation Table
581pub const IMAGE_DIRECTORY_ENTRY_BASERELOC: usize = 5;
582/// Debug Directory
583pub const IMAGE_DIRECTORY_ENTRY_DEBUG: usize = 6;
584//      IMAGE_DIRECTORY_ENTRY_COPYRIGHT       7   // (X86 usage)
585/// Architecture Specific Data
586pub const IMAGE_DIRECTORY_ENTRY_ARCHITECTURE: usize = 7;
587/// RVA of GP
588pub const IMAGE_DIRECTORY_ENTRY_GLOBALPTR: usize = 8;
589/// TLS Directory
590pub const IMAGE_DIRECTORY_ENTRY_TLS: usize = 9;
591/// Load Configuration Directory
592pub const IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG: usize = 10;
593/// Bound Import Directory in headers
594pub const IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT: usize = 11;
595/// Import Address Table
596pub const IMAGE_DIRECTORY_ENTRY_IAT: usize = 12;
597/// Delay Load Import Descriptors
598pub const IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT: usize = 13;
599/// COM Runtime descriptor
600pub const IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR: usize = 14;
601
602#[derive(Debug, Clone, Copy, PartialEq, Eq)]
603#[repr(C)]
604pub struct Guid(pub [u8; 16]);
605
606impl Guid {
607    #[inline]
608    pub fn data1(self) -> U32<LE> {
609        U32::from_bytes(self.0[0..4].try_into().unwrap())
610    }
611
612    #[inline]
613    pub fn data2(self) -> U16<LE> {
614        U16::from_bytes(self.0[4..6].try_into().unwrap())
615    }
616
617    #[inline]
618    pub fn data3(self) -> U16<LE> {
619        U16::from_bytes(self.0[6..8].try_into().unwrap())
620    }
621
622    #[inline]
623    pub fn data4(self) -> [u8; 8] {
624        self.0[8..16].try_into().unwrap()
625    }
626}
627
628pub use Guid as ClsId;
629
630/// Non-COFF Object file header
631#[derive(Debug, Clone, Copy)]
632#[repr(C)]
633pub struct AnonObjectHeader {
634    /// Must be IMAGE_FILE_MACHINE_UNKNOWN
635    pub sig1: U16<LE>,
636    /// Must be 0xffff
637    pub sig2: U16<LE>,
638    /// >= 1 (implies the ClsId field is present)
639    pub version: U16<LE>,
640    pub machine: U16<LE>,
641    pub time_date_stamp: U32<LE>,
642    /// Used to invoke CoCreateInstance
643    pub class_id: ClsId,
644    /// Size of data that follows the header
645    pub size_of_data: U32<LE>,
646}
647
648#[derive(Debug, Clone, Copy)]
649#[repr(C)]
650pub struct AnonObjectHeaderV2 {
651    /// Must be IMAGE_FILE_MACHINE_UNKNOWN
652    pub sig1: U16<LE>,
653    /// Must be 0xffff
654    pub sig2: U16<LE>,
655    /// >= 2 (implies the Flags field is present - otherwise V1)
656    pub version: U16<LE>,
657    pub machine: U16<LE>,
658    pub time_date_stamp: U32<LE>,
659    /// Used to invoke CoCreateInstance
660    pub class_id: ClsId,
661    /// Size of data that follows the header
662    pub size_of_data: U32<LE>,
663    /// 0x1 -> contains metadata
664    pub flags: U32<LE>,
665    /// Size of CLR metadata
666    pub meta_data_size: U32<LE>,
667    /// Offset of CLR metadata
668    pub meta_data_offset: U32<LE>,
669}
670
671/// The required value of `AnonObjectHeaderBigobj::class_id`.
672pub const ANON_OBJECT_HEADER_BIGOBJ_CLASS_ID: ClsId = ClsId([
673    0xC7, 0xA1, 0xBA, 0xD1, 0xEE, 0xBA, 0xA9, 0x4B, 0xAF, 0x20, 0xFA, 0xF6, 0x6A, 0xA4, 0xDC, 0xB8,
674]);
675
676#[derive(Debug, Clone, Copy)]
677#[repr(C)]
678pub struct AnonObjectHeaderBigobj {
679    /* same as ANON_OBJECT_HEADER_V2 */
680    /// Must be IMAGE_FILE_MACHINE_UNKNOWN
681    pub sig1: U16<LE>,
682    /// Must be 0xffff
683    pub sig2: U16<LE>,
684    /// >= 2 (implies the Flags field is present)
685    pub version: U16<LE>,
686    /// Actual machine - IMAGE_FILE_MACHINE_xxx
687    pub machine: U16<LE>,
688    pub time_date_stamp: U32<LE>,
689    /// Must be `ANON_OBJECT_HEADER_BIGOBJ_CLASS_ID`.
690    pub class_id: ClsId,
691    /// Size of data that follows the header
692    pub size_of_data: U32<LE>,
693    /// 0x1 -> contains metadata
694    pub flags: U32<LE>,
695    /// Size of CLR metadata
696    pub meta_data_size: U32<LE>,
697    /// Offset of CLR metadata
698    pub meta_data_offset: U32<LE>,
699
700    /* bigobj specifics */
701    /// extended from WORD
702    pub number_of_sections: U32<LE>,
703    pub pointer_to_symbol_table: U32<LE>,
704    pub number_of_symbols: U32<LE>,
705}
706
707pub const IMAGE_SIZEOF_SHORT_NAME: usize = 8;
708
709//
710// Section header format.
711//
712
713#[derive(Debug, Default, Clone, Copy)]
714#[repr(C)]
715pub struct ImageSectionHeader {
716    pub name: [u8; IMAGE_SIZEOF_SHORT_NAME],
717    pub virtual_size: U32<LE>,
718    pub virtual_address: U32<LE>,
719    pub size_of_raw_data: U32<LE>,
720    pub pointer_to_raw_data: U32<LE>,
721    pub pointer_to_relocations: U32<LE>,
722    pub pointer_to_linenumbers: U32<LE>,
723    pub number_of_relocations: U16<LE>,
724    pub number_of_linenumbers: U16<LE>,
725    pub characteristics: U32<LE>,
726}
727
728pub const IMAGE_SIZEOF_SECTION_HEADER: usize = 40;
729
730// Values for `ImageSectionHeader::characteristics`.
731
732//      IMAGE_SCN_TYPE_REG                   0x00000000  // Reserved.
733//      IMAGE_SCN_TYPE_DSECT                 0x00000001  // Reserved.
734//      IMAGE_SCN_TYPE_NOLOAD                0x00000002  // Reserved.
735//      IMAGE_SCN_TYPE_GROUP                 0x00000004  // Reserved.
736/// Reserved.
737pub const IMAGE_SCN_TYPE_NO_PAD: u32 = 0x0000_0008;
738//      IMAGE_SCN_TYPE_COPY                  0x00000010  // Reserved.
739
740/// Section contains code.
741pub const IMAGE_SCN_CNT_CODE: u32 = 0x0000_0020;
742/// Section contains initialized data.
743pub const IMAGE_SCN_CNT_INITIALIZED_DATA: u32 = 0x0000_0040;
744/// Section contains uninitialized data.
745pub const IMAGE_SCN_CNT_UNINITIALIZED_DATA: u32 = 0x0000_0080;
746
747/// Reserved.
748pub const IMAGE_SCN_LNK_OTHER: u32 = 0x0000_0100;
749/// Section contains comments or some other type of information.
750pub const IMAGE_SCN_LNK_INFO: u32 = 0x0000_0200;
751//      IMAGE_SCN_TYPE_OVER                  0x00000400  // Reserved.
752/// Section contents will not become part of image.
753pub const IMAGE_SCN_LNK_REMOVE: u32 = 0x0000_0800;
754/// Section contents comdat.
755pub const IMAGE_SCN_LNK_COMDAT: u32 = 0x0000_1000;
756//                                           0x00002000  // Reserved.
757//      IMAGE_SCN_MEM_PROTECTED - Obsolete   0x00004000
758/// Reset speculative exceptions handling bits in the TLB entries for this section.
759pub const IMAGE_SCN_NO_DEFER_SPEC_EXC: u32 = 0x0000_4000;
760/// Section content can be accessed relative to GP
761pub const IMAGE_SCN_GPREL: u32 = 0x0000_8000;
762pub const IMAGE_SCN_MEM_FARDATA: u32 = 0x0000_8000;
763//      IMAGE_SCN_MEM_SYSHEAP  - Obsolete    0x00010000
764pub const IMAGE_SCN_MEM_PURGEABLE: u32 = 0x0002_0000;
765pub const IMAGE_SCN_MEM_16BIT: u32 = 0x0002_0000;
766pub const IMAGE_SCN_MEM_LOCKED: u32 = 0x0004_0000;
767pub const IMAGE_SCN_MEM_PRELOAD: u32 = 0x0008_0000;
768
769pub const IMAGE_SCN_ALIGN_1BYTES: u32 = 0x0010_0000;
770pub const IMAGE_SCN_ALIGN_2BYTES: u32 = 0x0020_0000;
771pub const IMAGE_SCN_ALIGN_4BYTES: u32 = 0x0030_0000;
772pub const IMAGE_SCN_ALIGN_8BYTES: u32 = 0x0040_0000;
773/// Default alignment if no others are specified.
774pub const IMAGE_SCN_ALIGN_16BYTES: u32 = 0x0050_0000;
775pub const IMAGE_SCN_ALIGN_32BYTES: u32 = 0x0060_0000;
776pub const IMAGE_SCN_ALIGN_64BYTES: u32 = 0x0070_0000;
777pub const IMAGE_SCN_ALIGN_128BYTES: u32 = 0x0080_0000;
778pub const IMAGE_SCN_ALIGN_256BYTES: u32 = 0x0090_0000;
779pub const IMAGE_SCN_ALIGN_512BYTES: u32 = 0x00A0_0000;
780pub const IMAGE_SCN_ALIGN_1024BYTES: u32 = 0x00B0_0000;
781pub const IMAGE_SCN_ALIGN_2048BYTES: u32 = 0x00C0_0000;
782pub const IMAGE_SCN_ALIGN_4096BYTES: u32 = 0x00D0_0000;
783pub const IMAGE_SCN_ALIGN_8192BYTES: u32 = 0x00E0_0000;
784// Unused                                    0x00F0_0000
785pub const IMAGE_SCN_ALIGN_MASK: u32 = 0x00F0_0000;
786
787/// Section contains extended relocations.
788pub const IMAGE_SCN_LNK_NRELOC_OVFL: u32 = 0x0100_0000;
789/// Section can be discarded.
790pub const IMAGE_SCN_MEM_DISCARDABLE: u32 = 0x0200_0000;
791/// Section is not cacheable.
792pub const IMAGE_SCN_MEM_NOT_CACHED: u32 = 0x0400_0000;
793/// Section is not pageable.
794pub const IMAGE_SCN_MEM_NOT_PAGED: u32 = 0x0800_0000;
795/// Section is shareable.
796pub const IMAGE_SCN_MEM_SHARED: u32 = 0x1000_0000;
797/// Section is executable.
798pub const IMAGE_SCN_MEM_EXECUTE: u32 = 0x2000_0000;
799/// Section is readable.
800pub const IMAGE_SCN_MEM_READ: u32 = 0x4000_0000;
801/// Section is writeable.
802pub const IMAGE_SCN_MEM_WRITE: u32 = 0x8000_0000;
803
804//
805// TLS Characteristic Flags
806//
807/// Tls index is scaled
808pub const IMAGE_SCN_SCALE_INDEX: u32 = 0x0000_0001;
809
810//
811// Symbol format.
812//
813
814#[derive(Debug, Clone, Copy)]
815#[repr(C)]
816pub struct ImageSymbol {
817    /// If first 4 bytes are 0, then second 4 bytes are offset into string table.
818    pub name: [u8; 8],
819    pub value: U32<LE>,
820    pub section_number: U16<LE>,
821    pub typ: U16<LE>,
822    pub storage_class: u8,
823    pub number_of_aux_symbols: u8,
824}
825
826pub const IMAGE_SIZEOF_SYMBOL: usize = 18;
827
828#[derive(Debug, Clone, Copy)]
829#[repr(C)]
830pub struct ImageSymbolBytes(pub [u8; IMAGE_SIZEOF_SYMBOL]);
831
832#[derive(Debug, Clone, Copy)]
833#[repr(C)]
834pub struct ImageSymbolEx {
835    /// If first 4 bytes are 0, then second 4 bytes are offset into string table.
836    pub name: [u8; 8],
837    pub value: U32<LE>,
838    pub section_number: I32<LE>,
839    pub typ: U16<LE>,
840    pub storage_class: u8,
841    pub number_of_aux_symbols: u8,
842}
843
844pub const IMAGE_SIZEOF_SYMBOL_EX: usize = 20;
845
846#[derive(Debug, Clone, Copy)]
847#[repr(C)]
848pub struct ImageSymbolExBytes(pub [u8; IMAGE_SIZEOF_SYMBOL_EX]);
849
850// Values for `ImageSymbol::section_number`.
851//
852// Symbols have a section number of the section in which they are
853// defined. Otherwise, section numbers have the following meanings:
854
855/// Symbol is undefined or is common.
856pub const IMAGE_SYM_UNDEFINED: i32 = 0;
857/// Symbol is an absolute value.
858pub const IMAGE_SYM_ABSOLUTE: i32 = -1;
859/// Symbol is a special debug item.
860pub const IMAGE_SYM_DEBUG: i32 = -2;
861/// Values 0xFF00-0xFFFF are special
862pub const IMAGE_SYM_SECTION_MAX: u16 = 0xFEFF;
863pub const IMAGE_SYM_SECTION_MAX_EX: u32 = 0x7fff_ffff;
864
865// Values for `ImageSymbol::typ` (basic component).
866
867/// no type.
868pub const IMAGE_SYM_TYPE_NULL: u16 = 0x0000;
869pub const IMAGE_SYM_TYPE_VOID: u16 = 0x0001;
870/// type character.
871pub const IMAGE_SYM_TYPE_CHAR: u16 = 0x0002;
872/// type short integer.
873pub const IMAGE_SYM_TYPE_SHORT: u16 = 0x0003;
874pub const IMAGE_SYM_TYPE_INT: u16 = 0x0004;
875pub const IMAGE_SYM_TYPE_LONG: u16 = 0x0005;
876pub const IMAGE_SYM_TYPE_FLOAT: u16 = 0x0006;
877pub const IMAGE_SYM_TYPE_DOUBLE: u16 = 0x0007;
878pub const IMAGE_SYM_TYPE_STRUCT: u16 = 0x0008;
879pub const IMAGE_SYM_TYPE_UNION: u16 = 0x0009;
880/// enumeration.
881pub const IMAGE_SYM_TYPE_ENUM: u16 = 0x000A;
882/// member of enumeration.
883pub const IMAGE_SYM_TYPE_MOE: u16 = 0x000B;
884pub const IMAGE_SYM_TYPE_BYTE: u16 = 0x000C;
885pub const IMAGE_SYM_TYPE_WORD: u16 = 0x000D;
886pub const IMAGE_SYM_TYPE_UINT: u16 = 0x000E;
887pub const IMAGE_SYM_TYPE_DWORD: u16 = 0x000F;
888pub const IMAGE_SYM_TYPE_PCODE: u16 = 0x8000;
889
890// Values for `ImageSymbol::typ` (derived component).
891
892/// no derived type.
893pub const IMAGE_SYM_DTYPE_NULL: u16 = 0;
894/// pointer.
895pub const IMAGE_SYM_DTYPE_POINTER: u16 = 1;
896/// function.
897pub const IMAGE_SYM_DTYPE_FUNCTION: u16 = 2;
898/// array.
899pub const IMAGE_SYM_DTYPE_ARRAY: u16 = 3;
900
901// Values for `ImageSymbol::storage_class`.
902pub const IMAGE_SYM_CLASS_END_OF_FUNCTION: u8 = 0xff;
903pub const IMAGE_SYM_CLASS_NULL: u8 = 0x00;
904pub const IMAGE_SYM_CLASS_AUTOMATIC: u8 = 0x01;
905pub const IMAGE_SYM_CLASS_EXTERNAL: u8 = 0x02;
906pub const IMAGE_SYM_CLASS_STATIC: u8 = 0x03;
907pub const IMAGE_SYM_CLASS_REGISTER: u8 = 0x04;
908pub const IMAGE_SYM_CLASS_EXTERNAL_DEF: u8 = 0x05;
909pub const IMAGE_SYM_CLASS_LABEL: u8 = 0x06;
910pub const IMAGE_SYM_CLASS_UNDEFINED_LABEL: u8 = 0x07;
911pub const IMAGE_SYM_CLASS_MEMBER_OF_STRUCT: u8 = 0x08;
912pub const IMAGE_SYM_CLASS_ARGUMENT: u8 = 0x09;
913pub const IMAGE_SYM_CLASS_STRUCT_TAG: u8 = 0x0A;
914pub const IMAGE_SYM_CLASS_MEMBER_OF_UNION: u8 = 0x0B;
915pub const IMAGE_SYM_CLASS_UNION_TAG: u8 = 0x0C;
916pub const IMAGE_SYM_CLASS_TYPE_DEFINITION: u8 = 0x0D;
917pub const IMAGE_SYM_CLASS_UNDEFINED_STATIC: u8 = 0x0E;
918pub const IMAGE_SYM_CLASS_ENUM_TAG: u8 = 0x0F;
919pub const IMAGE_SYM_CLASS_MEMBER_OF_ENUM: u8 = 0x10;
920pub const IMAGE_SYM_CLASS_REGISTER_PARAM: u8 = 0x11;
921pub const IMAGE_SYM_CLASS_BIT_FIELD: u8 = 0x12;
922
923pub const IMAGE_SYM_CLASS_FAR_EXTERNAL: u8 = 0x44;
924
925pub const IMAGE_SYM_CLASS_BLOCK: u8 = 0x64;
926pub const IMAGE_SYM_CLASS_FUNCTION: u8 = 0x65;
927pub const IMAGE_SYM_CLASS_END_OF_STRUCT: u8 = 0x66;
928pub const IMAGE_SYM_CLASS_FILE: u8 = 0x67;
929// new
930pub const IMAGE_SYM_CLASS_SECTION: u8 = 0x68;
931pub const IMAGE_SYM_CLASS_WEAK_EXTERNAL: u8 = 0x69;
932
933pub const IMAGE_SYM_CLASS_CLR_TOKEN: u8 = 0x6B;
934
935// type packing constants
936
937pub const N_BTMASK: u16 = 0x000F;
938pub const N_TMASK: u16 = 0x0030;
939pub const N_TMASK1: u16 = 0x00C0;
940pub const N_TMASK2: u16 = 0x00F0;
941pub const N_BTSHFT: usize = 4;
942pub const N_TSHIFT: usize = 2;
943
944pub const IMAGE_SYM_DTYPE_SHIFT: usize = N_BTSHFT;
945
946//
947// Auxiliary entry format.
948//
949
950// Used for both ImageSymbol and ImageSymbolEx (with padding).
951#[derive(Debug, Clone, Copy)]
952#[repr(C)]
953pub struct ImageAuxSymbolTokenDef {
954    /// IMAGE_AUX_SYMBOL_TYPE
955    pub aux_type: u8,
956    /// Must be 0
957    pub reserved1: u8,
958    pub symbol_table_index: U32<LE>,
959    /// Must be 0
960    pub reserved2: [u8; 12],
961}
962
963pub const IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF: u16 = 1;
964
965/// Auxiliary symbol format 1: function definitions.
966#[derive(Debug, Clone, Copy)]
967#[repr(C)]
968pub struct ImageAuxSymbolFunction {
969    pub tag_index: U32<LE>,
970    pub total_size: U32<LE>,
971    pub pointer_to_linenumber: U32<LE>,
972    pub pointer_to_next_function: U32<LE>,
973    pub unused: [u8; 2],
974}
975
976/// Auxiliary symbol format 2: .bf and .ef symbols.
977// This struct has alignment 1.
978#[derive(Debug, Clone, Copy)]
979#[repr(C)]
980pub struct ImageAuxSymbolFunctionBeginEnd {
981    pub unused1: [u8; 4],
982    /// declaration line number
983    pub linenumber: U16<LE>,
984    pub unused2: [u8; 6],
985    pub pointer_to_next_function: U32<LE>,
986    pub unused3: [u8; 2],
987}
988
989/// Auxiliary symbol format 3: weak externals.
990///
991/// Used for both `ImageSymbol` and `ImageSymbolEx` (both with padding).
992// This struct has alignment 1.
993#[derive(Debug, Clone, Copy)]
994#[repr(C)]
995pub struct ImageAuxSymbolWeak {
996    /// the weak extern default symbol index
997    pub weak_default_sym_index: U32<LE>,
998    pub weak_search_type: U32<LE>,
999}
1000
1001/// Auxiliary symbol format 5: sections.
1002///
1003/// Used for both `ImageSymbol` and `ImageSymbolEx` (with padding).
1004// This struct has alignment 1.
1005#[derive(Debug, Clone, Copy)]
1006#[repr(C)]
1007pub struct ImageAuxSymbolSection {
1008    /// section length
1009    pub length: U32<LE>,
1010    /// number of relocation entries
1011    pub number_of_relocations: U16<LE>,
1012    /// number of line numbers
1013    pub number_of_linenumbers: U16<LE>,
1014    /// checksum for communal
1015    pub check_sum: U32<LE>,
1016    /// section number to associate with
1017    pub number: U16<LE>,
1018    /// communal selection type
1019    pub selection: u8,
1020    pub reserved: u8,
1021    /// high bits of the section number
1022    pub high_number: U16<LE>,
1023}
1024
1025// Used for both ImageSymbol and ImageSymbolEx (both with padding).
1026// This struct has alignment 1.
1027#[derive(Debug, Clone, Copy)]
1028#[repr(C)]
1029pub struct ImageAuxSymbolCrc {
1030    pub crc: U32<LE>,
1031}
1032
1033//
1034// Communal selection types.
1035//
1036
1037pub const IMAGE_COMDAT_SELECT_NODUPLICATES: u8 = 1;
1038pub const IMAGE_COMDAT_SELECT_ANY: u8 = 2;
1039pub const IMAGE_COMDAT_SELECT_SAME_SIZE: u8 = 3;
1040pub const IMAGE_COMDAT_SELECT_EXACT_MATCH: u8 = 4;
1041pub const IMAGE_COMDAT_SELECT_ASSOCIATIVE: u8 = 5;
1042pub const IMAGE_COMDAT_SELECT_LARGEST: u8 = 6;
1043pub const IMAGE_COMDAT_SELECT_NEWEST: u8 = 7;
1044
1045pub const IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY: u32 = 1;
1046pub const IMAGE_WEAK_EXTERN_SEARCH_LIBRARY: u32 = 2;
1047pub const IMAGE_WEAK_EXTERN_SEARCH_ALIAS: u32 = 3;
1048pub const IMAGE_WEAK_EXTERN_ANTI_DEPENDENCY: u32 = 4;
1049
1050//
1051// Relocation format.
1052//
1053
1054// This struct has alignment 1.
1055#[derive(Debug, Clone, Copy)]
1056#[repr(C)]
1057pub struct ImageRelocation {
1058    /// Also `RelocCount` when IMAGE_SCN_LNK_NRELOC_OVFL is set
1059    pub virtual_address: U32<LE>,
1060    pub symbol_table_index: U32<LE>,
1061    pub typ: U16<LE>,
1062}
1063
1064//
1065// I386 relocation types.
1066//
1067/// Reference is absolute, no relocation is necessary
1068pub const IMAGE_REL_I386_ABSOLUTE: u16 = 0x0000;
1069/// Direct 16-bit reference to the symbols virtual address
1070pub const IMAGE_REL_I386_DIR16: u16 = 0x0001;
1071/// PC-relative 16-bit reference to the symbols virtual address
1072pub const IMAGE_REL_I386_REL16: u16 = 0x0002;
1073/// Direct 32-bit reference to the symbols virtual address
1074pub const IMAGE_REL_I386_DIR32: u16 = 0x0006;
1075/// Direct 32-bit reference to the symbols virtual address, base not included
1076pub const IMAGE_REL_I386_DIR32NB: u16 = 0x0007;
1077/// Direct 16-bit reference to the segment-selector bits of a 32-bit virtual address
1078pub const IMAGE_REL_I386_SEG12: u16 = 0x0009;
1079pub const IMAGE_REL_I386_SECTION: u16 = 0x000A;
1080pub const IMAGE_REL_I386_SECREL: u16 = 0x000B;
1081/// clr token
1082pub const IMAGE_REL_I386_TOKEN: u16 = 0x000C;
1083/// 7 bit offset from base of section containing target
1084pub const IMAGE_REL_I386_SECREL7: u16 = 0x000D;
1085/// PC-relative 32-bit reference to the symbols virtual address
1086pub const IMAGE_REL_I386_REL32: u16 = 0x0014;
1087
1088//
1089// MIPS relocation types.
1090//
1091/// Reference is absolute, no relocation is necessary
1092pub const IMAGE_REL_MIPS_ABSOLUTE: u16 = 0x0000;
1093pub const IMAGE_REL_MIPS_REFHALF: u16 = 0x0001;
1094pub const IMAGE_REL_MIPS_REFWORD: u16 = 0x0002;
1095pub const IMAGE_REL_MIPS_JMPADDR: u16 = 0x0003;
1096pub const IMAGE_REL_MIPS_REFHI: u16 = 0x0004;
1097pub const IMAGE_REL_MIPS_REFLO: u16 = 0x0005;
1098pub const IMAGE_REL_MIPS_GPREL: u16 = 0x0006;
1099pub const IMAGE_REL_MIPS_LITERAL: u16 = 0x0007;
1100pub const IMAGE_REL_MIPS_SECTION: u16 = 0x000A;
1101pub const IMAGE_REL_MIPS_SECREL: u16 = 0x000B;
1102/// Low 16-bit section relative reference (used for >32k TLS)
1103pub const IMAGE_REL_MIPS_SECRELLO: u16 = 0x000C;
1104/// High 16-bit section relative reference (used for >32k TLS)
1105pub const IMAGE_REL_MIPS_SECRELHI: u16 = 0x000D;
1106/// clr token
1107pub const IMAGE_REL_MIPS_TOKEN: u16 = 0x000E;
1108pub const IMAGE_REL_MIPS_JMPADDR16: u16 = 0x0010;
1109pub const IMAGE_REL_MIPS_REFWORDNB: u16 = 0x0022;
1110pub const IMAGE_REL_MIPS_PAIR: u16 = 0x0025;
1111
1112//
1113// Alpha Relocation types.
1114//
1115pub const IMAGE_REL_ALPHA_ABSOLUTE: u16 = 0x0000;
1116pub const IMAGE_REL_ALPHA_REFLONG: u16 = 0x0001;
1117pub const IMAGE_REL_ALPHA_REFQUAD: u16 = 0x0002;
1118pub const IMAGE_REL_ALPHA_GPREL32: u16 = 0x0003;
1119pub const IMAGE_REL_ALPHA_LITERAL: u16 = 0x0004;
1120pub const IMAGE_REL_ALPHA_LITUSE: u16 = 0x0005;
1121pub const IMAGE_REL_ALPHA_GPDISP: u16 = 0x0006;
1122pub const IMAGE_REL_ALPHA_BRADDR: u16 = 0x0007;
1123pub const IMAGE_REL_ALPHA_HINT: u16 = 0x0008;
1124pub const IMAGE_REL_ALPHA_INLINE_REFLONG: u16 = 0x0009;
1125pub const IMAGE_REL_ALPHA_REFHI: u16 = 0x000A;
1126pub const IMAGE_REL_ALPHA_REFLO: u16 = 0x000B;
1127pub const IMAGE_REL_ALPHA_PAIR: u16 = 0x000C;
1128pub const IMAGE_REL_ALPHA_MATCH: u16 = 0x000D;
1129pub const IMAGE_REL_ALPHA_SECTION: u16 = 0x000E;
1130pub const IMAGE_REL_ALPHA_SECREL: u16 = 0x000F;
1131pub const IMAGE_REL_ALPHA_REFLONGNB: u16 = 0x0010;
1132/// Low 16-bit section relative reference
1133pub const IMAGE_REL_ALPHA_SECRELLO: u16 = 0x0011;
1134/// High 16-bit section relative reference
1135pub const IMAGE_REL_ALPHA_SECRELHI: u16 = 0x0012;
1136/// High 16 bits of 48 bit reference
1137pub const IMAGE_REL_ALPHA_REFQ3: u16 = 0x0013;
1138/// Middle 16 bits of 48 bit reference
1139pub const IMAGE_REL_ALPHA_REFQ2: u16 = 0x0014;
1140/// Low 16 bits of 48 bit reference
1141pub const IMAGE_REL_ALPHA_REFQ1: u16 = 0x0015;
1142/// Low 16-bit GP relative reference
1143pub const IMAGE_REL_ALPHA_GPRELLO: u16 = 0x0016;
1144/// High 16-bit GP relative reference
1145pub const IMAGE_REL_ALPHA_GPRELHI: u16 = 0x0017;
1146
1147//
1148// IBM PowerPC relocation types.
1149//
1150/// NOP
1151pub const IMAGE_REL_PPC_ABSOLUTE: u16 = 0x0000;
1152/// 64-bit address
1153pub const IMAGE_REL_PPC_ADDR64: u16 = 0x0001;
1154/// 32-bit address
1155pub const IMAGE_REL_PPC_ADDR32: u16 = 0x0002;
1156/// 26-bit address, shifted left 2 (branch absolute)
1157pub const IMAGE_REL_PPC_ADDR24: u16 = 0x0003;
1158/// 16-bit address
1159pub const IMAGE_REL_PPC_ADDR16: u16 = 0x0004;
1160/// 16-bit address, shifted left 2 (load doubleword)
1161pub const IMAGE_REL_PPC_ADDR14: u16 = 0x0005;
1162/// 26-bit PC-relative offset, shifted left 2 (branch relative)
1163pub const IMAGE_REL_PPC_REL24: u16 = 0x0006;
1164/// 16-bit PC-relative offset, shifted left 2 (br cond relative)
1165pub const IMAGE_REL_PPC_REL14: u16 = 0x0007;
1166/// 16-bit offset from TOC base
1167pub const IMAGE_REL_PPC_TOCREL16: u16 = 0x0008;
1168/// 16-bit offset from TOC base, shifted left 2 (load doubleword)
1169pub const IMAGE_REL_PPC_TOCREL14: u16 = 0x0009;
1170
1171/// 32-bit addr w/o image base
1172pub const IMAGE_REL_PPC_ADDR32NB: u16 = 0x000A;
1173/// va of containing section (as in an image sectionhdr)
1174pub const IMAGE_REL_PPC_SECREL: u16 = 0x000B;
1175/// sectionheader number
1176pub const IMAGE_REL_PPC_SECTION: u16 = 0x000C;
1177/// substitute TOC restore instruction iff symbol is glue code
1178pub const IMAGE_REL_PPC_IFGLUE: u16 = 0x000D;
1179/// symbol is glue code; virtual address is TOC restore instruction
1180pub const IMAGE_REL_PPC_IMGLUE: u16 = 0x000E;
1181/// va of containing section (limited to 16 bits)
1182pub const IMAGE_REL_PPC_SECREL16: u16 = 0x000F;
1183pub const IMAGE_REL_PPC_REFHI: u16 = 0x0010;
1184pub const IMAGE_REL_PPC_REFLO: u16 = 0x0011;
1185pub const IMAGE_REL_PPC_PAIR: u16 = 0x0012;
1186/// Low 16-bit section relative reference (used for >32k TLS)
1187pub const IMAGE_REL_PPC_SECRELLO: u16 = 0x0013;
1188/// High 16-bit section relative reference (used for >32k TLS)
1189pub const IMAGE_REL_PPC_SECRELHI: u16 = 0x0014;
1190pub const IMAGE_REL_PPC_GPREL: u16 = 0x0015;
1191/// clr token
1192pub const IMAGE_REL_PPC_TOKEN: u16 = 0x0016;
1193
1194/// mask to isolate above values in IMAGE_RELOCATION.Type
1195pub const IMAGE_REL_PPC_TYPEMASK: u16 = 0x00FF;
1196
1197// Flag bits in `ImageRelocation::typ`.
1198
1199/// subtract reloc value rather than adding it
1200pub const IMAGE_REL_PPC_NEG: u16 = 0x0100;
1201/// fix branch prediction bit to predict branch taken
1202pub const IMAGE_REL_PPC_BRTAKEN: u16 = 0x0200;
1203/// fix branch prediction bit to predict branch not taken
1204pub const IMAGE_REL_PPC_BRNTAKEN: u16 = 0x0400;
1205/// toc slot defined in file (or, data in toc)
1206pub const IMAGE_REL_PPC_TOCDEFN: u16 = 0x0800;
1207
1208//
1209// Hitachi SH3 relocation types.
1210//
1211/// No relocation
1212pub const IMAGE_REL_SH3_ABSOLUTE: u16 = 0x0000;
1213/// 16 bit direct
1214pub const IMAGE_REL_SH3_DIRECT16: u16 = 0x0001;
1215/// 32 bit direct
1216pub const IMAGE_REL_SH3_DIRECT32: u16 = 0x0002;
1217/// 8 bit direct, -128..255
1218pub const IMAGE_REL_SH3_DIRECT8: u16 = 0x0003;
1219/// 8 bit direct .W (0 ext.)
1220pub const IMAGE_REL_SH3_DIRECT8_WORD: u16 = 0x0004;
1221/// 8 bit direct .L (0 ext.)
1222pub const IMAGE_REL_SH3_DIRECT8_LONG: u16 = 0x0005;
1223/// 4 bit direct (0 ext.)
1224pub const IMAGE_REL_SH3_DIRECT4: u16 = 0x0006;
1225/// 4 bit direct .W (0 ext.)
1226pub const IMAGE_REL_SH3_DIRECT4_WORD: u16 = 0x0007;
1227/// 4 bit direct .L (0 ext.)
1228pub const IMAGE_REL_SH3_DIRECT4_LONG: u16 = 0x0008;
1229/// 8 bit PC relative .W
1230pub const IMAGE_REL_SH3_PCREL8_WORD: u16 = 0x0009;
1231/// 8 bit PC relative .L
1232pub const IMAGE_REL_SH3_PCREL8_LONG: u16 = 0x000A;
1233/// 12 LSB PC relative .W
1234pub const IMAGE_REL_SH3_PCREL12_WORD: u16 = 0x000B;
1235/// Start of EXE section
1236pub const IMAGE_REL_SH3_STARTOF_SECTION: u16 = 0x000C;
1237/// Size of EXE section
1238pub const IMAGE_REL_SH3_SIZEOF_SECTION: u16 = 0x000D;
1239/// Section table index
1240pub const IMAGE_REL_SH3_SECTION: u16 = 0x000E;
1241/// Offset within section
1242pub const IMAGE_REL_SH3_SECREL: u16 = 0x000F;
1243/// 32 bit direct not based
1244pub const IMAGE_REL_SH3_DIRECT32_NB: u16 = 0x0010;
1245/// GP-relative addressing
1246pub const IMAGE_REL_SH3_GPREL4_LONG: u16 = 0x0011;
1247/// clr token
1248pub const IMAGE_REL_SH3_TOKEN: u16 = 0x0012;
1249/// Offset from current instruction in longwords
1250/// if not NOMODE, insert the inverse of the low bit at bit 32 to select PTA/PTB
1251pub const IMAGE_REL_SHM_PCRELPT: u16 = 0x0013;
1252/// Low bits of 32-bit address
1253pub const IMAGE_REL_SHM_REFLO: u16 = 0x0014;
1254/// High bits of 32-bit address
1255pub const IMAGE_REL_SHM_REFHALF: u16 = 0x0015;
1256/// Low bits of relative reference
1257pub const IMAGE_REL_SHM_RELLO: u16 = 0x0016;
1258/// High bits of relative reference
1259pub const IMAGE_REL_SHM_RELHALF: u16 = 0x0017;
1260/// offset operand for relocation
1261pub const IMAGE_REL_SHM_PAIR: u16 = 0x0018;
1262
1263/// relocation ignores section mode
1264pub const IMAGE_REL_SH_NOMODE: u16 = 0x8000;
1265
1266/// No relocation required
1267pub const IMAGE_REL_ARM_ABSOLUTE: u16 = 0x0000;
1268/// 32 bit address
1269pub const IMAGE_REL_ARM_ADDR32: u16 = 0x0001;
1270/// 32 bit address w/o image base
1271pub const IMAGE_REL_ARM_ADDR32NB: u16 = 0x0002;
1272/// 24 bit offset << 2 & sign ext.
1273pub const IMAGE_REL_ARM_BRANCH24: u16 = 0x0003;
1274/// Thumb: 2 11 bit offsets
1275pub const IMAGE_REL_ARM_BRANCH11: u16 = 0x0004;
1276/// clr token
1277pub const IMAGE_REL_ARM_TOKEN: u16 = 0x0005;
1278/// GP-relative addressing (ARM)
1279pub const IMAGE_REL_ARM_GPREL12: u16 = 0x0006;
1280/// GP-relative addressing (Thumb)
1281pub const IMAGE_REL_ARM_GPREL7: u16 = 0x0007;
1282pub const IMAGE_REL_ARM_BLX24: u16 = 0x0008;
1283pub const IMAGE_REL_ARM_BLX11: u16 = 0x0009;
1284/// 32-bit relative address from byte following reloc
1285pub const IMAGE_REL_ARM_REL32: u16 = 0x000A;
1286/// Section table index
1287pub const IMAGE_REL_ARM_SECTION: u16 = 0x000E;
1288/// Offset within section
1289pub const IMAGE_REL_ARM_SECREL: u16 = 0x000F;
1290/// ARM: MOVW/MOVT
1291pub const IMAGE_REL_ARM_MOV32A: u16 = 0x0010;
1292/// ARM: MOVW/MOVT (deprecated)
1293pub const IMAGE_REL_ARM_MOV32: u16 = 0x0010;
1294/// Thumb: MOVW/MOVT
1295pub const IMAGE_REL_ARM_MOV32T: u16 = 0x0011;
1296/// Thumb: MOVW/MOVT (deprecated)
1297pub const IMAGE_REL_THUMB_MOV32: u16 = 0x0011;
1298/// Thumb: 32-bit conditional B
1299pub const IMAGE_REL_ARM_BRANCH20T: u16 = 0x0012;
1300/// Thumb: 32-bit conditional B (deprecated)
1301pub const IMAGE_REL_THUMB_BRANCH20: u16 = 0x0012;
1302/// Thumb: 32-bit B or BL
1303pub const IMAGE_REL_ARM_BRANCH24T: u16 = 0x0014;
1304/// Thumb: 32-bit B or BL (deprecated)
1305pub const IMAGE_REL_THUMB_BRANCH24: u16 = 0x0014;
1306/// Thumb: BLX immediate
1307pub const IMAGE_REL_ARM_BLX23T: u16 = 0x0015;
1308/// Thumb: BLX immediate (deprecated)
1309pub const IMAGE_REL_THUMB_BLX23: u16 = 0x0015;
1310
1311pub const IMAGE_REL_AM_ABSOLUTE: u16 = 0x0000;
1312pub const IMAGE_REL_AM_ADDR32: u16 = 0x0001;
1313pub const IMAGE_REL_AM_ADDR32NB: u16 = 0x0002;
1314pub const IMAGE_REL_AM_CALL32: u16 = 0x0003;
1315pub const IMAGE_REL_AM_FUNCINFO: u16 = 0x0004;
1316pub const IMAGE_REL_AM_REL32_1: u16 = 0x0005;
1317pub const IMAGE_REL_AM_REL32_2: u16 = 0x0006;
1318pub const IMAGE_REL_AM_SECREL: u16 = 0x0007;
1319pub const IMAGE_REL_AM_SECTION: u16 = 0x0008;
1320pub const IMAGE_REL_AM_TOKEN: u16 = 0x0009;
1321
1322//
1323// ARM64 relocations types.
1324//
1325
1326/// No relocation required
1327pub const IMAGE_REL_ARM64_ABSOLUTE: u16 = 0x0000;
1328/// 32 bit address. Review! do we need it?
1329pub const IMAGE_REL_ARM64_ADDR32: u16 = 0x0001;
1330/// 32 bit address w/o image base (RVA: for Data/PData/XData)
1331pub const IMAGE_REL_ARM64_ADDR32NB: u16 = 0x0002;
1332/// 26 bit offset << 2 & sign ext. for B & BL
1333pub const IMAGE_REL_ARM64_BRANCH26: u16 = 0x0003;
1334/// ADRP
1335pub const IMAGE_REL_ARM64_PAGEBASE_REL21: u16 = 0x0004;
1336/// ADR
1337pub const IMAGE_REL_ARM64_REL21: u16 = 0x0005;
1338/// ADD/ADDS (immediate) with zero shift, for page offset
1339pub const IMAGE_REL_ARM64_PAGEOFFSET_12A: u16 = 0x0006;
1340/// LDR (indexed, unsigned immediate), for page offset
1341pub const IMAGE_REL_ARM64_PAGEOFFSET_12L: u16 = 0x0007;
1342/// Offset within section
1343pub const IMAGE_REL_ARM64_SECREL: u16 = 0x0008;
1344/// ADD/ADDS (immediate) with zero shift, for bit 0:11 of section offset
1345pub const IMAGE_REL_ARM64_SECREL_LOW12A: u16 = 0x0009;
1346/// ADD/ADDS (immediate) with zero shift, for bit 12:23 of section offset
1347pub const IMAGE_REL_ARM64_SECREL_HIGH12A: u16 = 0x000A;
1348/// LDR (indexed, unsigned immediate), for bit 0:11 of section offset
1349pub const IMAGE_REL_ARM64_SECREL_LOW12L: u16 = 0x000B;
1350pub const IMAGE_REL_ARM64_TOKEN: u16 = 0x000C;
1351/// Section table index
1352pub const IMAGE_REL_ARM64_SECTION: u16 = 0x000D;
1353/// 64 bit address
1354pub const IMAGE_REL_ARM64_ADDR64: u16 = 0x000E;
1355/// 19 bit offset << 2 & sign ext. for conditional B
1356pub const IMAGE_REL_ARM64_BRANCH19: u16 = 0x000F;
1357/// TBZ/TBNZ
1358pub const IMAGE_REL_ARM64_BRANCH14: u16 = 0x0010;
1359/// 32-bit relative address from byte following reloc
1360pub const IMAGE_REL_ARM64_REL32: u16 = 0x0011;
1361
1362//
1363// x64 relocations
1364//
1365/// Reference is absolute, no relocation is necessary
1366pub const IMAGE_REL_AMD64_ABSOLUTE: u16 = 0x0000;
1367/// 64-bit address (VA).
1368pub const IMAGE_REL_AMD64_ADDR64: u16 = 0x0001;
1369/// 32-bit address (VA).
1370pub const IMAGE_REL_AMD64_ADDR32: u16 = 0x0002;
1371/// 32-bit address w/o image base (RVA).
1372pub const IMAGE_REL_AMD64_ADDR32NB: u16 = 0x0003;
1373/// 32-bit relative address from byte following reloc
1374pub const IMAGE_REL_AMD64_REL32: u16 = 0x0004;
1375/// 32-bit relative address from byte distance 1 from reloc
1376pub const IMAGE_REL_AMD64_REL32_1: u16 = 0x0005;
1377/// 32-bit relative address from byte distance 2 from reloc
1378pub const IMAGE_REL_AMD64_REL32_2: u16 = 0x0006;
1379/// 32-bit relative address from byte distance 3 from reloc
1380pub const IMAGE_REL_AMD64_REL32_3: u16 = 0x0007;
1381/// 32-bit relative address from byte distance 4 from reloc
1382pub const IMAGE_REL_AMD64_REL32_4: u16 = 0x0008;
1383/// 32-bit relative address from byte distance 5 from reloc
1384pub const IMAGE_REL_AMD64_REL32_5: u16 = 0x0009;
1385/// Section index
1386pub const IMAGE_REL_AMD64_SECTION: u16 = 0x000A;
1387/// 32 bit offset from base of section containing target
1388pub const IMAGE_REL_AMD64_SECREL: u16 = 0x000B;
1389/// 7 bit unsigned offset from base of section containing target
1390pub const IMAGE_REL_AMD64_SECREL7: u16 = 0x000C;
1391/// 32 bit metadata token
1392pub const IMAGE_REL_AMD64_TOKEN: u16 = 0x000D;
1393/// 32 bit signed span-dependent value emitted into object
1394pub const IMAGE_REL_AMD64_SREL32: u16 = 0x000E;
1395pub const IMAGE_REL_AMD64_PAIR: u16 = 0x000F;
1396/// 32 bit signed span-dependent value applied at link time
1397pub const IMAGE_REL_AMD64_SSPAN32: u16 = 0x0010;
1398pub const IMAGE_REL_AMD64_EHANDLER: u16 = 0x0011;
1399/// Indirect branch to an import
1400pub const IMAGE_REL_AMD64_IMPORT_BR: u16 = 0x0012;
1401/// Indirect call to an import
1402pub const IMAGE_REL_AMD64_IMPORT_CALL: u16 = 0x0013;
1403/// Indirect branch to a CFG check
1404pub const IMAGE_REL_AMD64_CFG_BR: u16 = 0x0014;
1405/// Indirect branch to a CFG check, with REX.W prefix
1406pub const IMAGE_REL_AMD64_CFG_BR_REX: u16 = 0x0015;
1407/// Indirect call to a CFG check
1408pub const IMAGE_REL_AMD64_CFG_CALL: u16 = 0x0016;
1409/// Indirect branch to a target in RAX (no CFG)
1410pub const IMAGE_REL_AMD64_INDIR_BR: u16 = 0x0017;
1411/// Indirect branch to a target in RAX, with REX.W prefix (no CFG)
1412pub const IMAGE_REL_AMD64_INDIR_BR_REX: u16 = 0x0018;
1413/// Indirect call to a target in RAX (no CFG)
1414pub const IMAGE_REL_AMD64_INDIR_CALL: u16 = 0x0019;
1415/// Indirect branch for a switch table using Reg 0 (RAX)
1416pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_FIRST: u16 = 0x0020;
1417/// Indirect branch for a switch table using Reg 15 (R15)
1418pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_LAST: u16 = 0x002F;
1419
1420//
1421// IA64 relocation types.
1422//
1423pub const IMAGE_REL_IA64_ABSOLUTE: u16 = 0x0000;
1424pub const IMAGE_REL_IA64_IMM14: u16 = 0x0001;
1425pub const IMAGE_REL_IA64_IMM22: u16 = 0x0002;
1426pub const IMAGE_REL_IA64_IMM64: u16 = 0x0003;
1427pub const IMAGE_REL_IA64_DIR32: u16 = 0x0004;
1428pub const IMAGE_REL_IA64_DIR64: u16 = 0x0005;
1429pub const IMAGE_REL_IA64_PCREL21B: u16 = 0x0006;
1430pub const IMAGE_REL_IA64_PCREL21M: u16 = 0x0007;
1431pub const IMAGE_REL_IA64_PCREL21F: u16 = 0x0008;
1432pub const IMAGE_REL_IA64_GPREL22: u16 = 0x0009;
1433pub const IMAGE_REL_IA64_LTOFF22: u16 = 0x000A;
1434pub const IMAGE_REL_IA64_SECTION: u16 = 0x000B;
1435pub const IMAGE_REL_IA64_SECREL22: u16 = 0x000C;
1436pub const IMAGE_REL_IA64_SECREL64I: u16 = 0x000D;
1437pub const IMAGE_REL_IA64_SECREL32: u16 = 0x000E;
1438//
1439pub const IMAGE_REL_IA64_DIR32NB: u16 = 0x0010;
1440pub const IMAGE_REL_IA64_SREL14: u16 = 0x0011;
1441pub const IMAGE_REL_IA64_SREL22: u16 = 0x0012;
1442pub const IMAGE_REL_IA64_SREL32: u16 = 0x0013;
1443pub const IMAGE_REL_IA64_UREL32: u16 = 0x0014;
1444/// This is always a BRL and never converted
1445pub const IMAGE_REL_IA64_PCREL60X: u16 = 0x0015;
1446/// If possible, convert to MBB bundle with NOP.B in slot 1
1447pub const IMAGE_REL_IA64_PCREL60B: u16 = 0x0016;
1448/// If possible, convert to MFB bundle with NOP.F in slot 1
1449pub const IMAGE_REL_IA64_PCREL60F: u16 = 0x0017;
1450/// If possible, convert to MIB bundle with NOP.I in slot 1
1451pub const IMAGE_REL_IA64_PCREL60I: u16 = 0x0018;
1452/// If possible, convert to MMB bundle with NOP.M in slot 1
1453pub const IMAGE_REL_IA64_PCREL60M: u16 = 0x0019;
1454pub const IMAGE_REL_IA64_IMMGPREL64: u16 = 0x001A;
1455/// clr token
1456pub const IMAGE_REL_IA64_TOKEN: u16 = 0x001B;
1457pub const IMAGE_REL_IA64_GPREL32: u16 = 0x001C;
1458pub const IMAGE_REL_IA64_ADDEND: u16 = 0x001F;
1459
1460//
1461// CEF relocation types.
1462//
1463/// Reference is absolute, no relocation is necessary
1464pub const IMAGE_REL_CEF_ABSOLUTE: u16 = 0x0000;
1465/// 32-bit address (VA).
1466pub const IMAGE_REL_CEF_ADDR32: u16 = 0x0001;
1467/// 64-bit address (VA).
1468pub const IMAGE_REL_CEF_ADDR64: u16 = 0x0002;
1469/// 32-bit address w/o image base (RVA).
1470pub const IMAGE_REL_CEF_ADDR32NB: u16 = 0x0003;
1471/// Section index
1472pub const IMAGE_REL_CEF_SECTION: u16 = 0x0004;
1473/// 32 bit offset from base of section containing target
1474pub const IMAGE_REL_CEF_SECREL: u16 = 0x0005;
1475/// 32 bit metadata token
1476pub const IMAGE_REL_CEF_TOKEN: u16 = 0x0006;
1477
1478//
1479// clr relocation types.
1480//
1481/// Reference is absolute, no relocation is necessary
1482pub const IMAGE_REL_CEE_ABSOLUTE: u16 = 0x0000;
1483/// 32-bit address (VA).
1484pub const IMAGE_REL_CEE_ADDR32: u16 = 0x0001;
1485/// 64-bit address (VA).
1486pub const IMAGE_REL_CEE_ADDR64: u16 = 0x0002;
1487/// 32-bit address w/o image base (RVA).
1488pub const IMAGE_REL_CEE_ADDR32NB: u16 = 0x0003;
1489/// Section index
1490pub const IMAGE_REL_CEE_SECTION: u16 = 0x0004;
1491/// 32 bit offset from base of section containing target
1492pub const IMAGE_REL_CEE_SECREL: u16 = 0x0005;
1493/// 32 bit metadata token
1494pub const IMAGE_REL_CEE_TOKEN: u16 = 0x0006;
1495
1496/// No relocation required
1497pub const IMAGE_REL_M32R_ABSOLUTE: u16 = 0x0000;
1498/// 32 bit address
1499pub const IMAGE_REL_M32R_ADDR32: u16 = 0x0001;
1500/// 32 bit address w/o image base
1501pub const IMAGE_REL_M32R_ADDR32NB: u16 = 0x0002;
1502/// 24 bit address
1503pub const IMAGE_REL_M32R_ADDR24: u16 = 0x0003;
1504/// GP relative addressing
1505pub const IMAGE_REL_M32R_GPREL16: u16 = 0x0004;
1506/// 24 bit offset << 2 & sign ext.
1507pub const IMAGE_REL_M32R_PCREL24: u16 = 0x0005;
1508/// 16 bit offset << 2 & sign ext.
1509pub const IMAGE_REL_M32R_PCREL16: u16 = 0x0006;
1510/// 8 bit offset << 2 & sign ext.
1511pub const IMAGE_REL_M32R_PCREL8: u16 = 0x0007;
1512/// 16 MSBs
1513pub const IMAGE_REL_M32R_REFHALF: u16 = 0x0008;
1514/// 16 MSBs; adj for LSB sign ext.
1515pub const IMAGE_REL_M32R_REFHI: u16 = 0x0009;
1516/// 16 LSBs
1517pub const IMAGE_REL_M32R_REFLO: u16 = 0x000A;
1518/// Link HI and LO
1519pub const IMAGE_REL_M32R_PAIR: u16 = 0x000B;
1520/// Section table index
1521pub const IMAGE_REL_M32R_SECTION: u16 = 0x000C;
1522/// 32 bit section relative reference
1523pub const IMAGE_REL_M32R_SECREL32: u16 = 0x000D;
1524/// clr token
1525pub const IMAGE_REL_M32R_TOKEN: u16 = 0x000E;
1526
1527/// No relocation required
1528pub const IMAGE_REL_EBC_ABSOLUTE: u16 = 0x0000;
1529/// 32 bit address w/o image base
1530pub const IMAGE_REL_EBC_ADDR32NB: u16 = 0x0001;
1531/// 32-bit relative address from byte following reloc
1532pub const IMAGE_REL_EBC_REL32: u16 = 0x0002;
1533/// Section table index
1534pub const IMAGE_REL_EBC_SECTION: u16 = 0x0003;
1535/// Offset within section
1536pub const IMAGE_REL_EBC_SECREL: u16 = 0x0004;
1537
1538/*
1539// TODO?
1540#define EXT_IMM64(Value, Address, Size, InstPos, ValPos)  /* Intel-IA64-Filler */           \
1541    Value |= (((ULONGLONG)((*(Address) >> InstPos) & (((ULONGLONG)1 << Size) - 1))) << ValPos)  // Intel-IA64-Filler
1542
1543#define INS_IMM64(Value, Address, Size, InstPos, ValPos)  /* Intel-IA64-Filler */\
1544    *(PDWORD)Address = (*(PDWORD)Address & ~(((1 << Size) - 1) << InstPos)) | /* Intel-IA64-Filler */\
1545          ((DWORD)((((ULONGLONG)Value >> ValPos) & (((ULONGLONG)1 << Size) - 1))) << InstPos)  // Intel-IA64-Filler
1546*/
1547
1548/// Intel-IA64-Filler
1549pub const EMARCH_ENC_I17_IMM7B_INST_WORD_X: u16 = 3;
1550/// Intel-IA64-Filler
1551pub const EMARCH_ENC_I17_IMM7B_SIZE_X: u16 = 7;
1552/// Intel-IA64-Filler
1553pub const EMARCH_ENC_I17_IMM7B_INST_WORD_POS_X: u16 = 4;
1554/// Intel-IA64-Filler
1555pub const EMARCH_ENC_I17_IMM7B_VAL_POS_X: u16 = 0;
1556
1557/// Intel-IA64-Filler
1558pub const EMARCH_ENC_I17_IMM9D_INST_WORD_X: u16 = 3;
1559/// Intel-IA64-Filler
1560pub const EMARCH_ENC_I17_IMM9D_SIZE_X: u16 = 9;
1561/// Intel-IA64-Filler
1562pub const EMARCH_ENC_I17_IMM9D_INST_WORD_POS_X: u16 = 18;
1563/// Intel-IA64-Filler
1564pub const EMARCH_ENC_I17_IMM9D_VAL_POS_X: u16 = 7;
1565
1566/// Intel-IA64-Filler
1567pub const EMARCH_ENC_I17_IMM5C_INST_WORD_X: u16 = 3;
1568/// Intel-IA64-Filler
1569pub const EMARCH_ENC_I17_IMM5C_SIZE_X: u16 = 5;
1570/// Intel-IA64-Filler
1571pub const EMARCH_ENC_I17_IMM5C_INST_WORD_POS_X: u16 = 13;
1572/// Intel-IA64-Filler
1573pub const EMARCH_ENC_I17_IMM5C_VAL_POS_X: u16 = 16;
1574
1575/// Intel-IA64-Filler
1576pub const EMARCH_ENC_I17_IC_INST_WORD_X: u16 = 3;
1577/// Intel-IA64-Filler
1578pub const EMARCH_ENC_I17_IC_SIZE_X: u16 = 1;
1579/// Intel-IA64-Filler
1580pub const EMARCH_ENC_I17_IC_INST_WORD_POS_X: u16 = 12;
1581/// Intel-IA64-Filler
1582pub const EMARCH_ENC_I17_IC_VAL_POS_X: u16 = 21;
1583
1584/// Intel-IA64-Filler
1585pub const EMARCH_ENC_I17_IMM41A_INST_WORD_X: u16 = 1;
1586/// Intel-IA64-Filler
1587pub const EMARCH_ENC_I17_IMM41A_SIZE_X: u16 = 10;
1588/// Intel-IA64-Filler
1589pub const EMARCH_ENC_I17_IMM41A_INST_WORD_POS_X: u16 = 14;
1590/// Intel-IA64-Filler
1591pub const EMARCH_ENC_I17_IMM41A_VAL_POS_X: u16 = 22;
1592
1593/// Intel-IA64-Filler
1594pub const EMARCH_ENC_I17_IMM41B_INST_WORD_X: u16 = 1;
1595/// Intel-IA64-Filler
1596pub const EMARCH_ENC_I17_IMM41B_SIZE_X: u16 = 8;
1597/// Intel-IA64-Filler
1598pub const EMARCH_ENC_I17_IMM41B_INST_WORD_POS_X: u16 = 24;
1599/// Intel-IA64-Filler
1600pub const EMARCH_ENC_I17_IMM41B_VAL_POS_X: u16 = 32;
1601
1602/// Intel-IA64-Filler
1603pub const EMARCH_ENC_I17_IMM41C_INST_WORD_X: u16 = 2;
1604/// Intel-IA64-Filler
1605pub const EMARCH_ENC_I17_IMM41C_SIZE_X: u16 = 23;
1606/// Intel-IA64-Filler
1607pub const EMARCH_ENC_I17_IMM41C_INST_WORD_POS_X: u16 = 0;
1608/// Intel-IA64-Filler
1609pub const EMARCH_ENC_I17_IMM41C_VAL_POS_X: u16 = 40;
1610
1611/// Intel-IA64-Filler
1612pub const EMARCH_ENC_I17_SIGN_INST_WORD_X: u16 = 3;
1613/// Intel-IA64-Filler
1614pub const EMARCH_ENC_I17_SIGN_SIZE_X: u16 = 1;
1615/// Intel-IA64-Filler
1616pub const EMARCH_ENC_I17_SIGN_INST_WORD_POS_X: u16 = 27;
1617/// Intel-IA64-Filler
1618pub const EMARCH_ENC_I17_SIGN_VAL_POS_X: u16 = 63;
1619
1620/// Intel-IA64-Filler
1621pub const X3_OPCODE_INST_WORD_X: u16 = 3;
1622/// Intel-IA64-Filler
1623pub const X3_OPCODE_SIZE_X: u16 = 4;
1624/// Intel-IA64-Filler
1625pub const X3_OPCODE_INST_WORD_POS_X: u16 = 28;
1626/// Intel-IA64-Filler
1627pub const X3_OPCODE_SIGN_VAL_POS_X: u16 = 0;
1628
1629/// Intel-IA64-Filler
1630pub const X3_I_INST_WORD_X: u16 = 3;
1631/// Intel-IA64-Filler
1632pub const X3_I_SIZE_X: u16 = 1;
1633/// Intel-IA64-Filler
1634pub const X3_I_INST_WORD_POS_X: u16 = 27;
1635/// Intel-IA64-Filler
1636pub const X3_I_SIGN_VAL_POS_X: u16 = 59;
1637
1638/// Intel-IA64-Filler
1639pub const X3_D_WH_INST_WORD_X: u16 = 3;
1640/// Intel-IA64-Filler
1641pub const X3_D_WH_SIZE_X: u16 = 3;
1642/// Intel-IA64-Filler
1643pub const X3_D_WH_INST_WORD_POS_X: u16 = 24;
1644/// Intel-IA64-Filler
1645pub const X3_D_WH_SIGN_VAL_POS_X: u16 = 0;
1646
1647/// Intel-IA64-Filler
1648pub const X3_IMM20_INST_WORD_X: u16 = 3;
1649/// Intel-IA64-Filler
1650pub const X3_IMM20_SIZE_X: u16 = 20;
1651/// Intel-IA64-Filler
1652pub const X3_IMM20_INST_WORD_POS_X: u16 = 4;
1653/// Intel-IA64-Filler
1654pub const X3_IMM20_SIGN_VAL_POS_X: u16 = 0;
1655
1656/// Intel-IA64-Filler
1657pub const X3_IMM39_1_INST_WORD_X: u16 = 2;
1658/// Intel-IA64-Filler
1659pub const X3_IMM39_1_SIZE_X: u16 = 23;
1660/// Intel-IA64-Filler
1661pub const X3_IMM39_1_INST_WORD_POS_X: u16 = 0;
1662/// Intel-IA64-Filler
1663pub const X3_IMM39_1_SIGN_VAL_POS_X: u16 = 36;
1664
1665/// Intel-IA64-Filler
1666pub const X3_IMM39_2_INST_WORD_X: u16 = 1;
1667/// Intel-IA64-Filler
1668pub const X3_IMM39_2_SIZE_X: u16 = 16;
1669/// Intel-IA64-Filler
1670pub const X3_IMM39_2_INST_WORD_POS_X: u16 = 16;
1671/// Intel-IA64-Filler
1672pub const X3_IMM39_2_SIGN_VAL_POS_X: u16 = 20;
1673
1674/// Intel-IA64-Filler
1675pub const X3_P_INST_WORD_X: u16 = 3;
1676/// Intel-IA64-Filler
1677pub const X3_P_SIZE_X: u16 = 4;
1678/// Intel-IA64-Filler
1679pub const X3_P_INST_WORD_POS_X: u16 = 0;
1680/// Intel-IA64-Filler
1681pub const X3_P_SIGN_VAL_POS_X: u16 = 0;
1682
1683/// Intel-IA64-Filler
1684pub const X3_TMPLT_INST_WORD_X: u16 = 0;
1685/// Intel-IA64-Filler
1686pub const X3_TMPLT_SIZE_X: u16 = 4;
1687/// Intel-IA64-Filler
1688pub const X3_TMPLT_INST_WORD_POS_X: u16 = 0;
1689/// Intel-IA64-Filler
1690pub const X3_TMPLT_SIGN_VAL_POS_X: u16 = 0;
1691
1692/// Intel-IA64-Filler
1693pub const X3_BTYPE_QP_INST_WORD_X: u16 = 2;
1694/// Intel-IA64-Filler
1695pub const X3_BTYPE_QP_SIZE_X: u16 = 9;
1696/// Intel-IA64-Filler
1697pub const X3_BTYPE_QP_INST_WORD_POS_X: u16 = 23;
1698/// Intel-IA64-Filler
1699pub const X3_BTYPE_QP_INST_VAL_POS_X: u16 = 0;
1700
1701/// Intel-IA64-Filler
1702pub const X3_EMPTY_INST_WORD_X: u16 = 1;
1703/// Intel-IA64-Filler
1704pub const X3_EMPTY_SIZE_X: u16 = 2;
1705/// Intel-IA64-Filler
1706pub const X3_EMPTY_INST_WORD_POS_X: u16 = 14;
1707/// Intel-IA64-Filler
1708pub const X3_EMPTY_INST_VAL_POS_X: u16 = 0;
1709
1710//
1711// Line number format.
1712//
1713
1714// This struct has alignment 1.
1715#[derive(Debug, Clone, Copy)]
1716#[repr(C)]
1717pub struct ImageLinenumber {
1718    /// Symbol table index of function name if Linenumber is 0.
1719    /// Otherwise virtual address of line number.
1720    pub symbol_table_index_or_virtual_address: U32<LE>,
1721    /// Line number.
1722    pub linenumber: U16<LE>,
1723}
1724
1725//
1726// Based relocation format.
1727//
1728
1729#[derive(Debug, Clone, Copy)]
1730#[repr(C)]
1731pub struct ImageBaseRelocation {
1732    pub virtual_address: U32<LE>,
1733    pub size_of_block: U32<LE>,
1734    //  pub type_offset[1]: U16<LE>,
1735}
1736
1737//
1738// Based relocation types.
1739//
1740
1741pub const IMAGE_REL_BASED_ABSOLUTE: u16 = 0;
1742pub const IMAGE_REL_BASED_HIGH: u16 = 1;
1743pub const IMAGE_REL_BASED_LOW: u16 = 2;
1744pub const IMAGE_REL_BASED_HIGHLOW: u16 = 3;
1745pub const IMAGE_REL_BASED_HIGHADJ: u16 = 4;
1746pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_5: u16 = 5;
1747pub const IMAGE_REL_BASED_RESERVED: u16 = 6;
1748pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_7: u16 = 7;
1749pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_8: u16 = 8;
1750pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_9: u16 = 9;
1751pub const IMAGE_REL_BASED_DIR64: u16 = 10;
1752
1753//
1754// Platform-specific based relocation types.
1755//
1756
1757pub const IMAGE_REL_BASED_IA64_IMM64: u16 = 9;
1758
1759pub const IMAGE_REL_BASED_MIPS_JMPADDR: u16 = 5;
1760pub const IMAGE_REL_BASED_MIPS_JMPADDR16: u16 = 9;
1761
1762pub const IMAGE_REL_BASED_ARM_MOV32: u16 = 5;
1763pub const IMAGE_REL_BASED_THUMB_MOV32: u16 = 7;
1764
1765pub const IMAGE_REL_BASED_RISCV_HIGH20: u16 = 5;
1766pub const IMAGE_REL_BASED_RISCV_LOW12I: u16 = 7;
1767pub const IMAGE_REL_BASED_RISCV_LOW12S: u16 = 8;
1768
1769//
1770// Archive format.
1771//
1772
1773pub const IMAGE_ARCHIVE_START_SIZE: usize = 8;
1774pub const IMAGE_ARCHIVE_START: &[u8; 8] = b"!<arch>\n";
1775pub const IMAGE_ARCHIVE_END: &[u8] = b"`\n";
1776pub const IMAGE_ARCHIVE_PAD: &[u8] = b"\n";
1777pub const IMAGE_ARCHIVE_LINKER_MEMBER: &[u8; 16] = b"/               ";
1778pub const IMAGE_ARCHIVE_LONGNAMES_MEMBER: &[u8; 16] = b"//              ";
1779pub const IMAGE_ARCHIVE_HYBRIDMAP_MEMBER: &[u8; 16] = b"/<HYBRIDMAP>/   ";
1780
1781#[derive(Debug, Clone, Copy)]
1782#[repr(C)]
1783pub struct ImageArchiveMemberHeader {
1784    /// File member name - `/' terminated.
1785    pub name: [u8; 16],
1786    /// File member date - decimal.
1787    pub date: [u8; 12],
1788    /// File member user id - decimal.
1789    pub user_id: [u8; 6],
1790    /// File member group id - decimal.
1791    pub group_id: [u8; 6],
1792    /// File member mode - octal.
1793    pub mode: [u8; 8],
1794    /// File member size - decimal.
1795    pub size: [u8; 10],
1796    /// String to end header.
1797    pub end_header: [u8; 2],
1798}
1799
1800pub const IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR: u16 = 60;
1801
1802//
1803// DLL support.
1804//
1805
1806//
1807// Export Format
1808//
1809
1810#[derive(Debug, Clone, Copy)]
1811#[repr(C)]
1812pub struct ImageExportDirectory {
1813    pub characteristics: U32<LE>,
1814    pub time_date_stamp: U32<LE>,
1815    pub major_version: U16<LE>,
1816    pub minor_version: U16<LE>,
1817    pub name: U32<LE>,
1818    pub base: U32<LE>,
1819    pub number_of_functions: U32<LE>,
1820    pub number_of_names: U32<LE>,
1821    /// RVA from base of image
1822    pub address_of_functions: U32<LE>,
1823    /// RVA from base of image
1824    pub address_of_names: U32<LE>,
1825    /// RVA from base of image
1826    pub address_of_name_ordinals: U32<LE>,
1827}
1828
1829//
1830// Import Format
1831//
1832
1833#[derive(Debug, Clone, Copy)]
1834#[repr(C)]
1835pub struct ImageImportByName {
1836    pub hint: U16<LE>,
1837    //pub name: [i8; 1],
1838}
1839
1840#[derive(Debug, Clone, Copy)]
1841#[repr(C)]
1842pub struct ImageThunkData64(pub U64<LE>);
1843/*
1844    union {
1845/// PBYTE
1846        pub forwarder_string: U64<LE>,
1847/// PDWORD
1848        pub function: U64<LE>,
1849        pub ordinal: U64<LE>,
1850/// PIMAGE_IMPORT_BY_NAME
1851        pub address_of_data: U64<LE>,
1852    } u1;
1853*/
1854
1855#[derive(Debug, Clone, Copy)]
1856#[repr(C)]
1857pub struct ImageThunkData32(pub U32<LE>);
1858/*
1859    union {
1860/// PBYTE
1861        pub forwarder_string: U32<LE>,
1862/// PDWORD
1863        pub function: U32<LE>,
1864        pub ordinal: U32<LE>,
1865/// PIMAGE_IMPORT_BY_NAME
1866        pub address_of_data: U32<LE>,
1867    } u1;
1868}
1869*/
1870
1871pub const IMAGE_ORDINAL_FLAG64: u64 = 0x8000000000000000;
1872pub const IMAGE_ORDINAL_FLAG32: u32 = 0x80000000;
1873
1874/*
1875#define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)
1876#define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)
1877#define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
1878#define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
1879
1880*/
1881
1882//
1883// Thread Local Storage
1884//
1885
1886#[derive(Debug, Clone, Copy)]
1887#[repr(C)]
1888pub struct ImageTlsDirectory64 {
1889    pub start_address_of_raw_data: U64<LE>,
1890    pub end_address_of_raw_data: U64<LE>,
1891    /// PDWORD
1892    pub address_of_index: U64<LE>,
1893    /// PIMAGE_TLS_CALLBACK *;
1894    pub address_of_call_backs: U64<LE>,
1895    pub size_of_zero_fill: U32<LE>,
1896    pub characteristics: U32<LE>,
1897}
1898
1899#[derive(Debug, Clone, Copy)]
1900#[repr(C)]
1901pub struct ImageTlsDirectory32 {
1902    pub start_address_of_raw_data: U32<LE>,
1903    pub end_address_of_raw_data: U32<LE>,
1904    /// PDWORD
1905    pub address_of_index: U32<LE>,
1906    /// PIMAGE_TLS_CALLBACK *
1907    pub address_of_call_backs: U32<LE>,
1908    pub size_of_zero_fill: U32<LE>,
1909    pub characteristics: U32<LE>,
1910}
1911
1912#[derive(Debug, Clone, Copy)]
1913#[repr(C)]
1914pub struct ImageImportDescriptor {
1915    /// RVA to original unbound IAT (`ImageThunkData32`/`ImageThunkData64`)
1916    /// 0 for terminating null import descriptor
1917    pub original_first_thunk: U32<LE>,
1918    /// 0 if not bound,
1919    /// -1 if bound, and real date\time stamp
1920    ///     in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
1921    /// O.W. date/time stamp of DLL bound to (Old BIND)
1922    pub time_date_stamp: U32<LE>,
1923    /// -1 if no forwarders
1924    pub forwarder_chain: U32<LE>,
1925    pub name: U32<LE>,
1926    /// RVA to IAT (if bound this IAT has actual addresses)
1927    pub first_thunk: U32<LE>,
1928}
1929
1930impl ImageImportDescriptor {
1931    /// Tell whether this import descriptor is the null descriptor
1932    /// (used to mark the end of the iterator array in a PE)
1933    pub fn is_null(&self) -> bool {
1934        self.original_first_thunk.get(LE) == 0
1935            && self.time_date_stamp.get(LE) == 0
1936            && self.forwarder_chain.get(LE) == 0
1937            && self.name.get(LE) == 0
1938            && self.first_thunk.get(LE) == 0
1939    }
1940}
1941
1942//
1943// New format import descriptors pointed to by DataDirectory[ IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT ]
1944//
1945
1946#[derive(Debug, Clone, Copy)]
1947#[repr(C)]
1948pub struct ImageBoundImportDescriptor {
1949    pub time_date_stamp: U32<LE>,
1950    pub offset_module_name: U16<LE>,
1951    pub number_of_module_forwarder_refs: U16<LE>,
1952    // Array of zero or more IMAGE_BOUND_FORWARDER_REF follows
1953}
1954
1955#[derive(Debug, Clone, Copy)]
1956#[repr(C)]
1957pub struct ImageBoundForwarderRef {
1958    pub time_date_stamp: U32<LE>,
1959    pub offset_module_name: U16<LE>,
1960    pub reserved: U16<LE>,
1961}
1962
1963#[derive(Debug, Clone, Copy)]
1964#[repr(C)]
1965pub struct ImageDelayloadDescriptor {
1966    pub attributes: U32<LE>,
1967
1968    /// RVA to the name of the target library (NULL-terminate ASCII string)
1969    pub dll_name_rva: U32<LE>,
1970    /// RVA to the HMODULE caching location (PHMODULE)
1971    pub module_handle_rva: U32<LE>,
1972    /// RVA to the start of the IAT (PIMAGE_THUNK_DATA)
1973    pub import_address_table_rva: U32<LE>,
1974    /// RVA to the start of the name table (PIMAGE_THUNK_DATA::AddressOfData)
1975    pub import_name_table_rva: U32<LE>,
1976    /// RVA to an optional bound IAT
1977    pub bound_import_address_table_rva: U32<LE>,
1978    /// RVA to an optional unload info table
1979    pub unload_information_table_rva: U32<LE>,
1980    /// 0 if not bound, otherwise, date/time of the target DLL
1981    pub time_date_stamp: U32<LE>,
1982}
1983
1984impl ImageDelayloadDescriptor {
1985    /// Tell whether this delay-load import descriptor is the null descriptor
1986    /// (used to mark the end of the iterator array in a PE)
1987    pub fn is_null(&self) -> bool {
1988        self.attributes.get(LE) == 0
1989            && self.dll_name_rva.get(LE) == 0
1990            && self.module_handle_rva.get(LE) == 0
1991            && self.import_address_table_rva.get(LE) == 0
1992            && self.import_name_table_rva.get(LE) == 0
1993            && self.bound_import_address_table_rva.get(LE) == 0
1994            && self.unload_information_table_rva.get(LE) == 0
1995            && self.time_date_stamp.get(LE) == 0
1996    }
1997}
1998
1999/// Delay load version 2 flag for `ImageDelayloadDescriptor::attributes`.
2000pub const IMAGE_DELAYLOAD_RVA_BASED: u32 = 0x8000_0000;
2001
2002//
2003// Resource Format.
2004//
2005
2006//
2007// Resource directory consists of two counts, following by a variable length
2008// array of directory entries.  The first count is the number of entries at
2009// beginning of the array that have actual names associated with each entry.
2010// The entries are in ascending order, case insensitive strings.  The second
2011// count is the number of entries that immediately follow the named entries.
2012// This second count identifies the number of entries that have 16-bit integer
2013// Ids as their name.  These entries are also sorted in ascending order.
2014//
2015// This structure allows fast lookup by either name or number, but for any
2016// given resource entry only one form of lookup is supported, not both.
2017// This is consistent with the syntax of the .RC file and the .RES file.
2018//
2019
2020#[derive(Debug, Clone, Copy)]
2021#[repr(C)]
2022pub struct ImageResourceDirectory {
2023    pub characteristics: U32<LE>,
2024    pub time_date_stamp: U32<LE>,
2025    pub major_version: U16<LE>,
2026    pub minor_version: U16<LE>,
2027    pub number_of_named_entries: U16<LE>,
2028    pub number_of_id_entries: U16<LE>,
2029}
2030
2031pub const IMAGE_RESOURCE_NAME_IS_STRING: u32 = 0x8000_0000;
2032pub const IMAGE_RESOURCE_DATA_IS_DIRECTORY: u32 = 0x8000_0000;
2033//
2034// Each directory contains the 32-bit Name of the entry and an offset,
2035// relative to the beginning of the resource directory of the data associated
2036// with this directory entry.  If the name of the entry is an actual text
2037// string instead of an integer Id, then the high order bit of the name field
2038// is set to one and the low order 31-bits are an offset, relative to the
2039// beginning of the resource directory of the string, which is of type
2040// IMAGE_RESOURCE_DIRECTORY_STRING.  Otherwise the high bit is clear and the
2041// low-order 16-bits are the integer Id that identify this resource directory
2042// entry. If the directory entry is yet another resource directory (i.e. a
2043// subdirectory), then the high order bit of the offset field will be
2044// set to indicate this.  Otherwise the high bit is clear and the offset
2045// field points to a resource data entry.
2046//
2047
2048#[derive(Debug, Clone, Copy)]
2049#[repr(C)]
2050pub struct ImageResourceDirectoryEntry {
2051    pub name_or_id: U32<LE>,
2052    pub offset_to_data_or_directory: U32<LE>,
2053}
2054
2055//
2056// For resource directory entries that have actual string names, the Name
2057// field of the directory entry points to an object of the following type.
2058// All of these string objects are stored together after the last resource
2059// directory entry and before the first resource data object.  This minimizes
2060// the impact of these variable length objects on the alignment of the fixed
2061// size directory entry objects.
2062//
2063
2064#[derive(Debug, Clone, Copy)]
2065#[repr(C)]
2066pub struct ImageResourceDirectoryString {
2067    pub length: U16<LE>,
2068    //pub name_string: [i8; 1],
2069}
2070
2071#[derive(Debug, Clone, Copy)]
2072#[repr(C)]
2073pub struct ImageResourceDirStringU {
2074    pub length: U16<LE>,
2075    //pub name_string: [U16<LE>; 1],
2076}
2077
2078//
2079// Each resource data entry describes a leaf node in the resource directory
2080// tree.  It contains an offset, relative to the beginning of the resource
2081// directory of the data for the resource, a size field that gives the number
2082// of bytes of data at that offset, a CodePage that should be used when
2083// decoding code point values within the resource data.  Typically for new
2084// applications the code page would be the unicode code page.
2085//
2086
2087#[derive(Debug, Clone, Copy)]
2088#[repr(C)]
2089pub struct ImageResourceDataEntry {
2090    /// RVA of the data.
2091    pub offset_to_data: U32<LE>,
2092    pub size: U32<LE>,
2093    pub code_page: U32<LE>,
2094    pub reserved: U32<LE>,
2095}
2096
2097// Resource type: https://docs.microsoft.com/en-us/windows/win32/menurc/resource-types
2098
2099/// ID for: Hardware-dependent cursor resource.
2100pub const RT_CURSOR: u16 = 1;
2101/// ID for: Bitmap resource.
2102pub const RT_BITMAP: u16 = 2;
2103/// ID for: Hardware-dependent icon resource.
2104pub const RT_ICON: u16 = 3;
2105/// ID for: Menu resource.
2106pub const RT_MENU: u16 = 4;
2107/// ID for: Dialog box.
2108pub const RT_DIALOG: u16 = 5;
2109/// ID for: String-table entry.
2110pub const RT_STRING: u16 = 6;
2111/// ID for: Font directory resource.
2112pub const RT_FONTDIR: u16 = 7;
2113/// ID for: Font resource.
2114pub const RT_FONT: u16 = 8;
2115/// ID for: Accelerator table.
2116pub const RT_ACCELERATOR: u16 = 9;
2117/// ID for: Application-defined resource (raw data).
2118pub const RT_RCDATA: u16 = 10;
2119/// ID for: Message-table entry.
2120pub const RT_MESSAGETABLE: u16 = 11;
2121/// ID for: Hardware-independent cursor resource.
2122pub const RT_GROUP_CURSOR: u16 = 12;
2123/// ID for: Hardware-independent icon resource.
2124pub const RT_GROUP_ICON: u16 = 14;
2125/// ID for: Version resource.
2126pub const RT_VERSION: u16 = 16;
2127/// ID for: Allows a resource editing tool to associate a string with an .rc file.
2128pub const RT_DLGINCLUDE: u16 = 17;
2129/// ID for: Plug and Play resource.
2130pub const RT_PLUGPLAY: u16 = 19;
2131/// ID for: VXD.
2132pub const RT_VXD: u16 = 20;
2133/// ID for: Animated cursor.
2134pub const RT_ANICURSOR: u16 = 21;
2135/// ID for: Animated icon.
2136pub const RT_ANIICON: u16 = 22;
2137/// ID for: HTML resource.
2138pub const RT_HTML: u16 = 23;
2139/// ID for: Side-by-Side Assembly Manifest.
2140pub const RT_MANIFEST: u16 = 24;
2141
2142//
2143// Code Integrity in loadconfig (CI)
2144//
2145
2146#[derive(Debug, Clone, Copy)]
2147#[repr(C)]
2148pub struct ImageLoadConfigCodeIntegrity {
2149    /// Flags to indicate if CI information is available, etc.
2150    pub flags: U16<LE>,
2151    /// 0xFFFF means not available
2152    pub catalog: U16<LE>,
2153    pub catalog_offset: U32<LE>,
2154    /// Additional bitmask to be defined later
2155    pub reserved: U32<LE>,
2156}
2157
2158//
2159// Dynamic value relocation table in loadconfig
2160//
2161
2162#[derive(Debug, Clone, Copy)]
2163#[repr(C)]
2164pub struct ImageDynamicRelocationTable {
2165    pub version: U32<LE>,
2166    pub size: U32<LE>,
2167    // DynamicRelocations: [ImageDynamicRelocation; 0],
2168}
2169
2170//
2171// Dynamic value relocation entries following IMAGE_DYNAMIC_RELOCATION_TABLE
2172//
2173
2174#[derive(Debug, Clone, Copy)]
2175#[repr(C)]
2176pub struct ImageDynamicRelocation32 {
2177    pub symbol: U32<LE>,
2178    pub base_reloc_size: U32<LE>,
2179    // BaseRelocations: [ImageBaseRelocation; 0],
2180}
2181
2182#[derive(Debug, Clone, Copy)]
2183#[repr(C)]
2184pub struct ImageDynamicRelocation64 {
2185    pub symbol: U64<LE>,
2186    pub base_reloc_size: U32<LE>,
2187    // BaseRelocations: [ImageBaseRelocation; 0],
2188}
2189
2190#[derive(Debug, Clone, Copy)]
2191#[repr(C)]
2192pub struct ImageDynamicRelocation32V2 {
2193    pub header_size: U32<LE>,
2194    pub fixup_info_size: U32<LE>,
2195    pub symbol: U32<LE>,
2196    pub symbol_group: U32<LE>,
2197    pub flags: U32<LE>,
2198    // ...     variable length header fields
2199    // pub     fixup_info: [u8; fixup_info_size]
2200}
2201
2202#[derive(Debug, Clone, Copy)]
2203#[repr(C)]
2204pub struct ImageDynamicRelocation64V2 {
2205    pub header_size: U32<LE>,
2206    pub fixup_info_size: U32<LE>,
2207    pub symbol: U64<LE>,
2208    pub symbol_group: U32<LE>,
2209    pub flags: U32<LE>,
2210    // ...     variable length header fields
2211    // pub     fixup_info[u8; fixup_info_size]
2212}
2213
2214//
2215// Defined symbolic dynamic relocation entries.
2216//
2217
2218pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE: u32 = 0x0000_0001;
2219pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE: u32 = 0x0000_0002;
2220pub const IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER: u32 = 0x0000_0003;
2221pub const IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER: u32 = 0x0000_0004;
2222pub const IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH: u32 = 0x0000_0005;
2223
2224// This struct has alignment 1.
2225#[derive(Debug, Clone, Copy)]
2226#[repr(C)]
2227pub struct ImagePrologueDynamicRelocationHeader {
2228    pub prologue_byte_count: u8,
2229    // pub prologue_bytes: [u8; prologue_byte_count],
2230}
2231
2232// This struct has alignment 1.
2233#[derive(Debug, Clone, Copy)]
2234#[repr(C)]
2235pub struct ImageEpilogueDynamicRelocationHeader {
2236    pub epilogue_count: U32<LE>,
2237    pub epilogue_byte_count: u8,
2238    pub branch_descriptor_element_size: u8,
2239    pub branch_descriptor_count: U16<LE>,
2240    // pub branch_descriptors[...],
2241    // pub branch_descriptor_bit_map[...],
2242}
2243
2244/*
2245// TODO? bitfields
2246// TODO: unaligned?
2247#[derive(Debug, Clone, Copy)]
2248#[repr(C)]
2249pub struct ImageImportControlTransferDynamicRelocation {
2250    DWORD       PageRelativeOffset : 12;
2251    DWORD       IndirectCall       : 1;
2252    DWORD       IATIndex           : 19;
2253}
2254
2255// TODO: unaligned?
2256#[derive(Debug, Clone, Copy)]
2257#[repr(C)]
2258pub struct ImageIndirControlTransferDynamicRelocation {
2259    WORD        PageRelativeOffset : 12;
2260    WORD        IndirectCall       : 1;
2261    WORD        RexWPrefix         : 1;
2262    WORD        CfgCheck           : 1;
2263    WORD        Reserved           : 1;
2264}
2265
2266// TODO: unaligned?
2267#[derive(Debug, Clone, Copy)]
2268#[repr(C)]
2269pub struct ImageSwitchtableBranchDynamicRelocation {
2270    WORD        PageRelativeOffset : 12;
2271    WORD        RegisterNumber     : 4;
2272}
2273*/
2274
2275//
2276// Load Configuration Directory Entry
2277//
2278
2279#[derive(Debug, Clone, Copy)]
2280#[repr(C)]
2281pub struct ImageLoadConfigDirectory32 {
2282    pub size: U32<LE>,
2283    pub time_date_stamp: U32<LE>,
2284    pub major_version: U16<LE>,
2285    pub minor_version: U16<LE>,
2286    pub global_flags_clear: U32<LE>,
2287    pub global_flags_set: U32<LE>,
2288    pub critical_section_default_timeout: U32<LE>,
2289    pub de_commit_free_block_threshold: U32<LE>,
2290    pub de_commit_total_free_threshold: U32<LE>,
2291    /// VA
2292    pub lock_prefix_table: U32<LE>,
2293    pub maximum_allocation_size: U32<LE>,
2294    pub virtual_memory_threshold: U32<LE>,
2295    pub process_heap_flags: U32<LE>,
2296    pub process_affinity_mask: U32<LE>,
2297    pub csd_version: U16<LE>,
2298    pub dependent_load_flags: U16<LE>,
2299    /// VA
2300    pub edit_list: U32<LE>,
2301    /// VA
2302    pub security_cookie: U32<LE>,
2303    /// VA
2304    pub sehandler_table: U32<LE>,
2305    pub sehandler_count: U32<LE>,
2306    /// VA
2307    pub guard_cf_check_function_pointer: U32<LE>,
2308    /// VA
2309    pub guard_cf_dispatch_function_pointer: U32<LE>,
2310    /// VA
2311    pub guard_cf_function_table: U32<LE>,
2312    pub guard_cf_function_count: U32<LE>,
2313    pub guard_flags: U32<LE>,
2314    pub code_integrity: ImageLoadConfigCodeIntegrity,
2315    /// VA
2316    pub guard_address_taken_iat_entry_table: U32<LE>,
2317    pub guard_address_taken_iat_entry_count: U32<LE>,
2318    /// VA
2319    pub guard_long_jump_target_table: U32<LE>,
2320    pub guard_long_jump_target_count: U32<LE>,
2321    /// VA
2322    pub dynamic_value_reloc_table: U32<LE>,
2323    pub chpe_metadata_pointer: U32<LE>,
2324    /// VA
2325    pub guard_rf_failure_routine: U32<LE>,
2326    /// VA
2327    pub guard_rf_failure_routine_function_pointer: U32<LE>,
2328    pub dynamic_value_reloc_table_offset: U32<LE>,
2329    pub dynamic_value_reloc_table_section: U16<LE>,
2330    pub reserved2: U16<LE>,
2331    /// VA
2332    pub guard_rf_verify_stack_pointer_function_pointer: U32<LE>,
2333    pub hot_patch_table_offset: U32<LE>,
2334    pub reserved3: U32<LE>,
2335    /// VA
2336    pub enclave_configuration_pointer: U32<LE>,
2337    /// VA
2338    pub volatile_metadata_pointer: U32<LE>,
2339}
2340
2341#[derive(Debug, Clone, Copy)]
2342#[repr(C)]
2343pub struct ImageLoadConfigDirectory64 {
2344    pub size: U32<LE>,
2345    pub time_date_stamp: U32<LE>,
2346    pub major_version: U16<LE>,
2347    pub minor_version: U16<LE>,
2348    pub global_flags_clear: U32<LE>,
2349    pub global_flags_set: U32<LE>,
2350    pub critical_section_default_timeout: U32<LE>,
2351    pub de_commit_free_block_threshold: U64<LE>,
2352    pub de_commit_total_free_threshold: U64<LE>,
2353    /// VA
2354    pub lock_prefix_table: U64<LE>,
2355    pub maximum_allocation_size: U64<LE>,
2356    pub virtual_memory_threshold: U64<LE>,
2357    pub process_affinity_mask: U64<LE>,
2358    pub process_heap_flags: U32<LE>,
2359    pub csd_version: U16<LE>,
2360    pub dependent_load_flags: U16<LE>,
2361    /// VA
2362    pub edit_list: U64<LE>,
2363    /// VA
2364    pub security_cookie: U64<LE>,
2365    /// VA
2366    pub sehandler_table: U64<LE>,
2367    pub sehandler_count: U64<LE>,
2368    /// VA
2369    pub guard_cf_check_function_pointer: U64<LE>,
2370    /// VA
2371    pub guard_cf_dispatch_function_pointer: U64<LE>,
2372    /// VA
2373    pub guard_cf_function_table: U64<LE>,
2374    pub guard_cf_function_count: U64<LE>,
2375    pub guard_flags: U32<LE>,
2376    pub code_integrity: ImageLoadConfigCodeIntegrity,
2377    /// VA
2378    pub guard_address_taken_iat_entry_table: U64<LE>,
2379    pub guard_address_taken_iat_entry_count: U64<LE>,
2380    /// VA
2381    pub guard_long_jump_target_table: U64<LE>,
2382    pub guard_long_jump_target_count: U64<LE>,
2383    /// VA
2384    pub dynamic_value_reloc_table: U64<LE>,
2385    /// VA
2386    pub chpe_metadata_pointer: U64<LE>,
2387    /// VA
2388    pub guard_rf_failure_routine: U64<LE>,
2389    /// VA
2390    pub guard_rf_failure_routine_function_pointer: U64<LE>,
2391    pub dynamic_value_reloc_table_offset: U32<LE>,
2392    pub dynamic_value_reloc_table_section: U16<LE>,
2393    pub reserved2: U16<LE>,
2394    /// VA
2395    pub guard_rf_verify_stack_pointer_function_pointer: U64<LE>,
2396    pub hot_patch_table_offset: U32<LE>,
2397    pub reserved3: U32<LE>,
2398    /// VA
2399    pub enclave_configuration_pointer: U64<LE>,
2400    /// VA
2401    pub volatile_metadata_pointer: U64<LE>,
2402}
2403
2404#[derive(Debug, Clone, Copy)]
2405#[repr(C)]
2406pub struct ImageHotPatchInfo {
2407    pub version: U32<LE>,
2408    pub size: U32<LE>,
2409    pub sequence_number: U32<LE>,
2410    pub base_image_list: U32<LE>,
2411    pub base_image_count: U32<LE>,
2412    /// Version 2 and later
2413    pub buffer_offset: U32<LE>,
2414    /// Version 3 and later
2415    pub extra_patch_size: U32<LE>,
2416}
2417
2418#[derive(Debug, Clone, Copy)]
2419#[repr(C)]
2420pub struct ImageHotPatchBase {
2421    pub sequence_number: U32<LE>,
2422    pub flags: U32<LE>,
2423    pub original_time_date_stamp: U32<LE>,
2424    pub original_check_sum: U32<LE>,
2425    pub code_integrity_info: U32<LE>,
2426    pub code_integrity_size: U32<LE>,
2427    pub patch_table: U32<LE>,
2428    /// Version 2 and later
2429    pub buffer_offset: U32<LE>,
2430}
2431
2432#[derive(Debug, Clone, Copy)]
2433#[repr(C)]
2434pub struct ImageHotPatchHashes {
2435    pub sha256: [u8; 32],
2436    pub sha1: [u8; 20],
2437}
2438
2439pub const IMAGE_HOT_PATCH_BASE_OBLIGATORY: u32 = 0x0000_0001;
2440pub const IMAGE_HOT_PATCH_BASE_CAN_ROLL_BACK: u32 = 0x0000_0002;
2441
2442pub const IMAGE_HOT_PATCH_CHUNK_INVERSE: u32 = 0x8000_0000;
2443pub const IMAGE_HOT_PATCH_CHUNK_OBLIGATORY: u32 = 0x4000_0000;
2444pub const IMAGE_HOT_PATCH_CHUNK_RESERVED: u32 = 0x3FF0_3000;
2445pub const IMAGE_HOT_PATCH_CHUNK_TYPE: u32 = 0x000F_C000;
2446pub const IMAGE_HOT_PATCH_CHUNK_SOURCE_RVA: u32 = 0x0000_8000;
2447pub const IMAGE_HOT_PATCH_CHUNK_TARGET_RVA: u32 = 0x0000_4000;
2448pub const IMAGE_HOT_PATCH_CHUNK_SIZE: u32 = 0x0000_0FFF;
2449
2450pub const IMAGE_HOT_PATCH_NONE: u32 = 0x0000_0000;
2451pub const IMAGE_HOT_PATCH_FUNCTION: u32 = 0x0001_C000;
2452pub const IMAGE_HOT_PATCH_ABSOLUTE: u32 = 0x0002_C000;
2453pub const IMAGE_HOT_PATCH_REL32: u32 = 0x0003_C000;
2454pub const IMAGE_HOT_PATCH_CALL_TARGET: u32 = 0x0004_4000;
2455pub const IMAGE_HOT_PATCH_INDIRECT: u32 = 0x0005_C000;
2456pub const IMAGE_HOT_PATCH_NO_CALL_TARGET: u32 = 0x0006_4000;
2457pub const IMAGE_HOT_PATCH_DYNAMIC_VALUE: u32 = 0x0007_8000;
2458
2459/// Module performs control flow integrity checks using system-supplied support
2460pub const IMAGE_GUARD_CF_INSTRUMENTED: u32 = 0x0000_0100;
2461/// Module performs control flow and write integrity checks
2462pub const IMAGE_GUARD_CFW_INSTRUMENTED: u32 = 0x0000_0200;
2463/// Module contains valid control flow target metadata
2464pub const IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT: u32 = 0x0000_0400;
2465/// Module does not make use of the /GS security cookie
2466pub const IMAGE_GUARD_SECURITY_COOKIE_UNUSED: u32 = 0x0000_0800;
2467/// Module supports read only delay load IAT
2468pub const IMAGE_GUARD_PROTECT_DELAYLOAD_IAT: u32 = 0x0000_1000;
2469/// Delayload import table in its own .didat section (with nothing else in it) that can be freely reprotected
2470pub const IMAGE_GUARD_DELAYLOAD_IAT_IN_ITS_OWN_SECTION: u32 = 0x0000_2000;
2471/// Module contains suppressed export information.
2472///
2473/// This also infers that the address taken taken IAT table is also present in the load config.
2474pub const IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT: u32 = 0x0000_4000;
2475/// Module enables suppression of exports
2476pub const IMAGE_GUARD_CF_ENABLE_EXPORT_SUPPRESSION: u32 = 0x0000_8000;
2477/// Module contains longjmp target information
2478pub const IMAGE_GUARD_CF_LONGJUMP_TABLE_PRESENT: u32 = 0x0001_0000;
2479/// Module contains return flow instrumentation and metadata
2480pub const IMAGE_GUARD_RF_INSTRUMENTED: u32 = 0x0002_0000;
2481/// Module requests that the OS enable return flow protection
2482pub const IMAGE_GUARD_RF_ENABLE: u32 = 0x0004_0000;
2483/// Module requests that the OS enable return flow protection in strict mode
2484pub const IMAGE_GUARD_RF_STRICT: u32 = 0x0008_0000;
2485/// Module was built with retpoline support
2486pub const IMAGE_GUARD_RETPOLINE_PRESENT: u32 = 0x0010_0000;
2487
2488/// Stride of Guard CF function table encoded in these bits (additional count of bytes per element)
2489pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_MASK: u32 = 0xF000_0000;
2490/// Shift to right-justify Guard CF function table stride
2491pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_SHIFT: u32 = 28;
2492
2493//
2494// GFIDS table entry flags.
2495//
2496
2497/// The containing GFID entry is suppressed
2498pub const IMAGE_GUARD_FLAG_FID_SUPPRESSED: u16 = 0x01;
2499/// The containing GFID entry is export suppressed
2500pub const IMAGE_GUARD_FLAG_EXPORT_SUPPRESSED: u16 = 0x02;
2501
2502//
2503// WIN CE Exception table format
2504//
2505
2506//
2507// Function table entry format.  Function table is pointed to by the
2508// IMAGE_DIRECTORY_ENTRY_EXCEPTION directory entry.
2509//
2510
2511/*
2512// TODO? bitfields
2513#[derive(Debug, Clone, Copy)]
2514#[repr(C)]
2515pub struct ImageCeRuntimeFunctionEntry {
2516    pub func_start: U32<LE>,
2517    DWORD PrologLen : 8;
2518    DWORD FuncLen : 22;
2519    DWORD ThirtyTwoBit : 1;
2520    DWORD ExceptionFlag : 1;
2521}
2522*/
2523
2524#[derive(Debug, Clone, Copy)]
2525#[repr(C)]
2526pub struct ImageArmRuntimeFunctionEntry {
2527    pub begin_address: U32<LE>,
2528    pub unwind_data: U32<LE>,
2529}
2530
2531#[derive(Debug, Clone, Copy)]
2532#[repr(C)]
2533pub struct ImageArm64RuntimeFunctionEntry {
2534    pub begin_address: U32<LE>,
2535    pub unwind_data: U32<LE>,
2536}
2537
2538#[derive(Debug, Clone, Copy)]
2539#[repr(C)]
2540pub struct ImageAlpha64RuntimeFunctionEntry {
2541    pub begin_address: U64<LE>,
2542    pub end_address: U64<LE>,
2543    pub exception_handler: U64<LE>,
2544    pub handler_data: U64<LE>,
2545    pub prolog_end_address: U64<LE>,
2546}
2547
2548#[derive(Debug, Clone, Copy)]
2549#[repr(C)]
2550pub struct ImageAlphaRuntimeFunctionEntry {
2551    pub begin_address: U32<LE>,
2552    pub end_address: U32<LE>,
2553    pub exception_handler: U32<LE>,
2554    pub handler_data: U32<LE>,
2555    pub prolog_end_address: U32<LE>,
2556}
2557
2558#[derive(Debug, Clone, Copy)]
2559#[repr(C)]
2560pub struct ImageRuntimeFunctionEntry {
2561    pub begin_address: U32<LE>,
2562    pub end_address: U32<LE>,
2563    pub unwind_info_address_or_data: U32<LE>,
2564}
2565
2566//
2567// Software enclave information
2568//
2569
2570pub const IMAGE_ENCLAVE_LONG_ID_LENGTH: usize = 32;
2571pub const IMAGE_ENCLAVE_SHORT_ID_LENGTH: usize = 16;
2572
2573#[derive(Debug, Clone, Copy)]
2574#[repr(C)]
2575pub struct ImageEnclaveConfig32 {
2576    pub size: U32<LE>,
2577    pub minimum_required_config_size: U32<LE>,
2578    pub policy_flags: U32<LE>,
2579    pub number_of_imports: U32<LE>,
2580    pub import_list: U32<LE>,
2581    pub import_entry_size: U32<LE>,
2582    pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2583    pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2584    pub image_version: U32<LE>,
2585    pub security_version: U32<LE>,
2586    pub enclave_size: U32<LE>,
2587    pub number_of_threads: U32<LE>,
2588    pub enclave_flags: U32<LE>,
2589}
2590
2591#[derive(Debug, Clone, Copy)]
2592#[repr(C)]
2593pub struct ImageEnclaveConfig64 {
2594    pub size: U32<LE>,
2595    pub minimum_required_config_size: U32<LE>,
2596    pub policy_flags: U32<LE>,
2597    pub number_of_imports: U32<LE>,
2598    pub import_list: U32<LE>,
2599    pub import_entry_size: U32<LE>,
2600    pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2601    pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2602    pub image_version: U32<LE>,
2603    pub security_version: U32<LE>,
2604    pub enclave_size: U64<LE>,
2605    pub number_of_threads: U32<LE>,
2606    pub enclave_flags: U32<LE>,
2607}
2608
2609//pub const IMAGE_ENCLAVE_MINIMUM_CONFIG_SIZE: usize = FIELD_OFFSET(IMAGE_ENCLAVE_CONFIG, EnclaveFlags);
2610
2611pub const IMAGE_ENCLAVE_POLICY_DEBUGGABLE: u32 = 0x0000_0001;
2612
2613pub const IMAGE_ENCLAVE_FLAG_PRIMARY_IMAGE: u32 = 0x0000_0001;
2614
2615#[derive(Debug, Clone, Copy)]
2616#[repr(C)]
2617pub struct ImageEnclaveImport {
2618    pub match_type: U32<LE>,
2619    pub minimum_security_version: U32<LE>,
2620    pub unique_or_author_id: [u8; IMAGE_ENCLAVE_LONG_ID_LENGTH],
2621    pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2622    pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2623    pub import_name: U32<LE>,
2624    pub reserved: U32<LE>,
2625}
2626
2627pub const IMAGE_ENCLAVE_IMPORT_MATCH_NONE: u32 = 0x0000_0000;
2628pub const IMAGE_ENCLAVE_IMPORT_MATCH_UNIQUE_ID: u32 = 0x0000_0001;
2629pub const IMAGE_ENCLAVE_IMPORT_MATCH_AUTHOR_ID: u32 = 0x0000_0002;
2630pub const IMAGE_ENCLAVE_IMPORT_MATCH_FAMILY_ID: u32 = 0x0000_0003;
2631pub const IMAGE_ENCLAVE_IMPORT_MATCH_IMAGE_ID: u32 = 0x0000_0004;
2632
2633//
2634// Debug Format
2635//
2636
2637#[derive(Debug, Clone, Copy)]
2638#[repr(C)]
2639pub struct ImageDebugDirectory {
2640    pub characteristics: U32<LE>,
2641    pub time_date_stamp: U32<LE>,
2642    pub major_version: U16<LE>,
2643    pub minor_version: U16<LE>,
2644    pub typ: U32<LE>,
2645    pub size_of_data: U32<LE>,
2646    pub address_of_raw_data: U32<LE>,
2647    pub pointer_to_raw_data: U32<LE>,
2648}
2649
2650pub const IMAGE_DEBUG_TYPE_UNKNOWN: u32 = 0;
2651pub const IMAGE_DEBUG_TYPE_COFF: u32 = 1;
2652pub const IMAGE_DEBUG_TYPE_CODEVIEW: u32 = 2;
2653pub const IMAGE_DEBUG_TYPE_FPO: u32 = 3;
2654pub const IMAGE_DEBUG_TYPE_MISC: u32 = 4;
2655pub const IMAGE_DEBUG_TYPE_EXCEPTION: u32 = 5;
2656pub const IMAGE_DEBUG_TYPE_FIXUP: u32 = 6;
2657pub const IMAGE_DEBUG_TYPE_OMAP_TO_SRC: u32 = 7;
2658pub const IMAGE_DEBUG_TYPE_OMAP_FROM_SRC: u32 = 8;
2659pub const IMAGE_DEBUG_TYPE_BORLAND: u32 = 9;
2660pub const IMAGE_DEBUG_TYPE_RESERVED10: u32 = 10;
2661pub const IMAGE_DEBUG_TYPE_CLSID: u32 = 11;
2662pub const IMAGE_DEBUG_TYPE_VC_FEATURE: u32 = 12;
2663pub const IMAGE_DEBUG_TYPE_POGO: u32 = 13;
2664pub const IMAGE_DEBUG_TYPE_ILTCG: u32 = 14;
2665pub const IMAGE_DEBUG_TYPE_MPX: u32 = 15;
2666pub const IMAGE_DEBUG_TYPE_REPRO: u32 = 16;
2667
2668#[derive(Debug, Clone, Copy)]
2669#[repr(C)]
2670pub struct ImageCoffSymbolsHeader {
2671    pub number_of_symbols: U32<LE>,
2672    pub lva_to_first_symbol: U32<LE>,
2673    pub number_of_linenumbers: U32<LE>,
2674    pub lva_to_first_linenumber: U32<LE>,
2675    pub rva_to_first_byte_of_code: U32<LE>,
2676    pub rva_to_last_byte_of_code: U32<LE>,
2677    pub rva_to_first_byte_of_data: U32<LE>,
2678    pub rva_to_last_byte_of_data: U32<LE>,
2679}
2680
2681pub const FRAME_FPO: u16 = 0;
2682pub const FRAME_TRAP: u16 = 1;
2683pub const FRAME_TSS: u16 = 2;
2684pub const FRAME_NONFPO: u16 = 3;
2685
2686/*
2687// TODO? bitfields
2688#[derive(Debug, Clone, Copy)]
2689#[repr(C)]
2690pub struct FpoData {
2691/// offset 1st byte of function code
2692    pub ul_off_start: U32<LE>,
2693/// # bytes in function
2694    pub cb_proc_size: U32<LE>,
2695/// # bytes in locals/4
2696    pub cdw_locals: U32<LE>,
2697/// # bytes in params/4
2698    pub cdw_params: U16<LE>,
2699/// # bytes in prolog
2700    WORD        cbProlog : 8;
2701/// # regs saved
2702    WORD        cbRegs   : 3;
2703/// TRUE if SEH in func
2704    WORD        fHasSEH  : 1;
2705/// TRUE if EBP has been allocated
2706    WORD        fUseBP   : 1;
2707/// reserved for future use
2708    WORD        reserved : 1;
2709/// frame type
2710    WORD        cbFrame  : 2;
2711}
2712pub const SIZEOF_RFPO_DATA: usize = 16;
2713*/
2714
2715pub const IMAGE_DEBUG_MISC_EXENAME: u16 = 1;
2716
2717#[derive(Debug, Clone, Copy)]
2718#[repr(C)]
2719pub struct ImageDebugMisc {
2720    /// type of misc data, see defines
2721    pub data_type: U32<LE>,
2722    /// total length of record, rounded to four byte multiple.
2723    pub length: U32<LE>,
2724    /// TRUE if data is unicode string
2725    pub unicode: u8,
2726    pub reserved: [u8; 3],
2727    // Actual data
2728    //pub data: [u8; 1],
2729}
2730
2731//
2732// Function table extracted from MIPS/ALPHA/IA64 images.  Does not contain
2733// information needed only for runtime support.  Just those fields for
2734// each entry needed by a debugger.
2735//
2736
2737#[derive(Debug, Clone, Copy)]
2738#[repr(C)]
2739pub struct ImageFunctionEntry {
2740    pub starting_address: U32<LE>,
2741    pub ending_address: U32<LE>,
2742    pub end_of_prologue: U32<LE>,
2743}
2744
2745#[derive(Debug, Clone, Copy)]
2746#[repr(C)]
2747pub struct ImageFunctionEntry64 {
2748    pub starting_address: U64<LE>,
2749    pub ending_address: U64<LE>,
2750    pub end_of_prologue_or_unwind_info_address: U64<LE>,
2751}
2752
2753//
2754// Debugging information can be stripped from an image file and placed
2755// in a separate .DBG file, whose file name part is the same as the
2756// image file name part (e.g. symbols for CMD.EXE could be stripped
2757// and placed in CMD.DBG).  This is indicated by the IMAGE_FILE_DEBUG_STRIPPED
2758// flag in the Characteristics field of the file header.  The beginning of
2759// the .DBG file contains the following structure which captures certain
2760// information from the image file.  This allows a debug to proceed even if
2761// the original image file is not accessible.  This header is followed by
2762// zero of more IMAGE_SECTION_HEADER structures, followed by zero or more
2763// IMAGE_DEBUG_DIRECTORY structures.  The latter structures and those in
2764// the image file contain file offsets relative to the beginning of the
2765// .DBG file.
2766//
2767// If symbols have been stripped from an image, the IMAGE_DEBUG_MISC structure
2768// is left in the image file, but not mapped.  This allows a debugger to
2769// compute the name of the .DBG file, from the name of the image in the
2770// IMAGE_DEBUG_MISC structure.
2771//
2772
2773#[derive(Debug, Clone, Copy)]
2774#[repr(C)]
2775pub struct ImageSeparateDebugHeader {
2776    pub signature: U16<LE>,
2777    pub flags: U16<LE>,
2778    pub machine: U16<LE>,
2779    pub characteristics: U16<LE>,
2780    pub time_date_stamp: U32<LE>,
2781    pub check_sum: U32<LE>,
2782    pub image_base: U32<LE>,
2783    pub size_of_image: U32<LE>,
2784    pub number_of_sections: U32<LE>,
2785    pub exported_names_size: U32<LE>,
2786    pub debug_directory_size: U32<LE>,
2787    pub section_alignment: U32<LE>,
2788    pub reserved: [U32<LE>; 2],
2789}
2790
2791#[derive(Debug, Clone, Copy)]
2792#[repr(C)]
2793pub struct NonPagedDebugInfo {
2794    pub signature: U16<LE>,
2795    pub flags: U16<LE>,
2796    pub size: U32<LE>,
2797    pub machine: U16<LE>,
2798    pub characteristics: U16<LE>,
2799    pub time_date_stamp: U32<LE>,
2800    pub check_sum: U32<LE>,
2801    pub size_of_image: U32<LE>,
2802    pub image_base: U64<LE>,
2803    //debug_directory_size
2804    //ImageDebugDirectory
2805}
2806
2807pub const IMAGE_SEPARATE_DEBUG_SIGNATURE: u16 = 0x4944;
2808pub const NON_PAGED_DEBUG_SIGNATURE: u16 = 0x494E;
2809
2810pub const IMAGE_SEPARATE_DEBUG_FLAGS_MASK: u16 = 0x8000;
2811/// when DBG was updated, the old checksum didn't match.
2812pub const IMAGE_SEPARATE_DEBUG_MISMATCH: u16 = 0x8000;
2813
2814//
2815//  The .arch section is made up of headers, each describing an amask position/value
2816//  pointing to an array of IMAGE_ARCHITECTURE_ENTRY's.  Each "array" (both the header
2817//  and entry arrays) are terminiated by a quadword of 0xffffffffL.
2818//
2819//  NOTE: There may be quadwords of 0 sprinkled around and must be skipped.
2820//
2821
2822/*
2823// TODO? bitfields
2824#[derive(Debug, Clone, Copy)]
2825#[repr(C)]
2826pub struct ImageArchitectureHeader {
2827    /// 1 -> code section depends on mask bit
2828    /// 0 -> new instruction depends on mask bit
2829    unsigned int AmaskValue: 1;
2830    /// MBZ
2831    int :7;
2832    /// Amask bit in question for this fixup
2833    unsigned int AmaskShift: 8;
2834    /// MBZ
2835    int :16;
2836    /// RVA into .arch section to array of ARCHITECTURE_ENTRY's
2837    pub first_entry_rva: U32<LE>,
2838}
2839*/
2840
2841#[derive(Debug, Clone, Copy)]
2842#[repr(C)]
2843pub struct ImageArchitectureEntry {
2844    /// RVA of instruction to fixup
2845    pub fixup_inst_rva: U32<LE>,
2846    /// fixup instruction (see alphaops.h)
2847    pub new_inst: U32<LE>,
2848}
2849
2850// The following structure defines the new import object.  Note the values of the first two fields,
2851// which must be set as stated in order to differentiate old and new import members.
2852// Following this structure, the linker emits two null-terminated strings used to recreate the
2853// import at the time of use.  The first string is the import's name, the second is the dll's name.
2854
2855pub const IMPORT_OBJECT_HDR_SIG2: u16 = 0xffff;
2856
2857#[derive(Debug, Clone, Copy)]
2858#[repr(C)]
2859pub struct ImportObjectHeader {
2860    /// Must be IMAGE_FILE_MACHINE_UNKNOWN
2861    pub sig1: U16<LE>,
2862    /// Must be IMPORT_OBJECT_HDR_SIG2.
2863    pub sig2: U16<LE>,
2864    pub version: U16<LE>,
2865    pub machine: U16<LE>,
2866    /// Time/date stamp
2867    pub time_date_stamp: U32<LE>,
2868    /// particularly useful for incremental links
2869    pub size_of_data: U32<LE>,
2870
2871    /// if grf & IMPORT_OBJECT_ORDINAL
2872    pub ordinal_or_hint: U16<LE>,
2873
2874    // WORD    Type : 2;
2875    // WORD    NameType : 3;
2876    // WORD    Reserved : 11;
2877    pub name_type: U16<LE>,
2878}
2879
2880pub const IMPORT_OBJECT_TYPE_MASK: u16 = 0b11;
2881pub const IMPORT_OBJECT_TYPE_SHIFT: u16 = 0;
2882pub const IMPORT_OBJECT_CODE: u16 = 0;
2883pub const IMPORT_OBJECT_DATA: u16 = 1;
2884pub const IMPORT_OBJECT_CONST: u16 = 2;
2885
2886pub const IMPORT_OBJECT_NAME_MASK: u16 = 0b111;
2887pub const IMPORT_OBJECT_NAME_SHIFT: u16 = 2;
2888/// Import by ordinal
2889pub const IMPORT_OBJECT_ORDINAL: u16 = 0;
2890/// Import name == public symbol name.
2891pub const IMPORT_OBJECT_NAME: u16 = 1;
2892/// Import name == public symbol name skipping leading ?, @, or optionally _.
2893pub const IMPORT_OBJECT_NAME_NO_PREFIX: u16 = 2;
2894/// Import name == public symbol name skipping leading ?, @, or optionally _ and truncating at first @.
2895pub const IMPORT_OBJECT_NAME_UNDECORATE: u16 = 3;
2896/// Import name == a name is explicitly provided after the DLL name.
2897pub const IMPORT_OBJECT_NAME_EXPORTAS: u16 = 4;
2898
2899// COM+ Header entry point flags.
2900pub const COMIMAGE_FLAGS_ILONLY: u32 = 0x0000_0001;
2901pub const COMIMAGE_FLAGS_32BITREQUIRED: u32 = 0x0000_0002;
2902pub const COMIMAGE_FLAGS_IL_LIBRARY: u32 = 0x0000_0004;
2903pub const COMIMAGE_FLAGS_STRONGNAMESIGNED: u32 = 0x0000_0008;
2904pub const COMIMAGE_FLAGS_NATIVE_ENTRYPOINT: u32 = 0x0000_0010;
2905pub const COMIMAGE_FLAGS_TRACKDEBUGDATA: u32 = 0x0001_0000;
2906pub const COMIMAGE_FLAGS_32BITPREFERRED: u32 = 0x0002_0000;
2907
2908// Version flags for image.
2909pub const COR_VERSION_MAJOR_V2: u16 = 2;
2910pub const COR_VERSION_MAJOR: u16 = COR_VERSION_MAJOR_V2;
2911pub const COR_VERSION_MINOR: u16 = 5;
2912pub const COR_DELETED_NAME_LENGTH: usize = 8;
2913pub const COR_VTABLEGAP_NAME_LENGTH: usize = 8;
2914
2915// Maximum size of a NativeType descriptor.
2916pub const NATIVE_TYPE_MAX_CB: u16 = 1;
2917pub const COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE: u16 = 0xFF;
2918
2919// Consts for the MIH FLAGS
2920pub const IMAGE_COR_MIH_METHODRVA: u16 = 0x01;
2921pub const IMAGE_COR_MIH_EHRVA: u16 = 0x02;
2922pub const IMAGE_COR_MIH_BASICBLOCK: u16 = 0x08;
2923
2924// V-table constants
2925/// V-table slots are 32-bits in size.
2926pub const COR_VTABLE_32BIT: u16 = 0x01;
2927/// V-table slots are 64-bits in size.
2928pub const COR_VTABLE_64BIT: u16 = 0x02;
2929/// If set, transition from unmanaged.
2930pub const COR_VTABLE_FROM_UNMANAGED: u16 = 0x04;
2931/// If set, transition from unmanaged with keeping the current appdomain.
2932pub const COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN: u16 = 0x08;
2933/// Call most derived method described by
2934pub const COR_VTABLE_CALL_MOST_DERIVED: u16 = 0x10;
2935
2936// EATJ constants
2937/// Size of a jump thunk reserved range.
2938pub const IMAGE_COR_EATJ_THUNK_SIZE: usize = 32;
2939
2940// Max name lengths
2941pub const MAX_CLASS_NAME: usize = 1024;
2942pub const MAX_PACKAGE_NAME: usize = 1024;
2943
2944// CLR 2.0 header structure.
2945#[derive(Debug, Clone, Copy)]
2946#[repr(C)]
2947pub struct ImageCor20Header {
2948    // Header versioning
2949    pub cb: U32<LE>,
2950    pub major_runtime_version: U16<LE>,
2951    pub minor_runtime_version: U16<LE>,
2952
2953    // Symbol table and startup information
2954    pub meta_data: ImageDataDirectory,
2955    pub flags: U32<LE>,
2956
2957    // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is not set, EntryPointToken represents a managed entrypoint.
2958    // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is set, EntryPointRVA represents an RVA to a native entrypoint.
2959    pub entry_point_token_or_rva: U32<LE>,
2960
2961    // Binding information
2962    pub resources: ImageDataDirectory,
2963    pub strong_name_signature: ImageDataDirectory,
2964
2965    // Regular fixup and binding information
2966    pub code_manager_table: ImageDataDirectory,
2967    pub vtable_fixups: ImageDataDirectory,
2968    pub export_address_table_jumps: ImageDataDirectory,
2969
2970    // Precompiled image info (internal use only - set to zero)
2971    pub managed_native_header: ImageDataDirectory,
2972}
2973
2974unsafe_impl_pod!(
2975    ImageDosHeader,
2976    ImageOs2Header,
2977    ImageVxdHeader,
2978    ImageFileHeader,
2979    ImageDataDirectory,
2980    ImageOptionalHeader32,
2981    ImageRomOptionalHeader,
2982    ImageOptionalHeader64,
2983    ImageNtHeaders64,
2984    ImageNtHeaders32,
2985    ImageRomHeaders,
2986    Guid,
2987    AnonObjectHeader,
2988    AnonObjectHeaderV2,
2989    AnonObjectHeaderBigobj,
2990    ImageSectionHeader,
2991    ImageSymbol,
2992    ImageSymbolBytes,
2993    ImageSymbolEx,
2994    ImageSymbolExBytes,
2995    ImageAuxSymbolTokenDef,
2996    ImageAuxSymbolFunction,
2997    ImageAuxSymbolFunctionBeginEnd,
2998    ImageAuxSymbolWeak,
2999    ImageAuxSymbolSection,
3000    ImageAuxSymbolCrc,
3001    ImageRelocation,
3002    ImageLinenumber,
3003    ImageBaseRelocation,
3004    ImageArchiveMemberHeader,
3005    ImageExportDirectory,
3006    ImageImportByName,
3007    ImageThunkData64,
3008    ImageThunkData32,
3009    ImageTlsDirectory64,
3010    ImageTlsDirectory32,
3011    ImageImportDescriptor,
3012    ImageBoundImportDescriptor,
3013    ImageBoundForwarderRef,
3014    ImageDelayloadDescriptor,
3015    ImageResourceDirectory,
3016    ImageResourceDirectoryEntry,
3017    ImageResourceDirectoryString,
3018    ImageResourceDirStringU,
3019    ImageResourceDataEntry,
3020    ImageLoadConfigCodeIntegrity,
3021    ImageDynamicRelocationTable,
3022    ImageDynamicRelocation32,
3023    ImageDynamicRelocation64,
3024    ImageDynamicRelocation32V2,
3025    ImageDynamicRelocation64V2,
3026    ImagePrologueDynamicRelocationHeader,
3027    ImageEpilogueDynamicRelocationHeader,
3028    //ImageImportControlTransferDynamicRelocation,
3029    //ImageIndirControlTransferDynamicRelocation,
3030    //ImageSwitchtableBranchDynamicRelocation,
3031    ImageLoadConfigDirectory32,
3032    ImageLoadConfigDirectory64,
3033    ImageHotPatchInfo,
3034    ImageHotPatchBase,
3035    ImageHotPatchHashes,
3036    //ImageCeRuntimeFunctionEntry,
3037    ImageArmRuntimeFunctionEntry,
3038    ImageArm64RuntimeFunctionEntry,
3039    ImageAlpha64RuntimeFunctionEntry,
3040    ImageAlphaRuntimeFunctionEntry,
3041    ImageRuntimeFunctionEntry,
3042    ImageEnclaveConfig32,
3043    ImageEnclaveConfig64,
3044    ImageEnclaveImport,
3045    ImageDebugDirectory,
3046    ImageCoffSymbolsHeader,
3047    //FpoData,
3048    ImageDebugMisc,
3049    ImageFunctionEntry,
3050    ImageFunctionEntry64,
3051    ImageSeparateDebugHeader,
3052    NonPagedDebugInfo,
3053    //ImageArchitectureHeader,
3054    ImageArchitectureEntry,
3055    ImportObjectHeader,
3056    ImageCor20Header,
3057    MaskedRichHeaderEntry,
3058);
object/pe.rs

object/
pe.rs
