1 #ifndef _NTIMAGE_ 2 #define _NTIMAGE_ 3 4 // 5 // Image Formats 6 // 7 #define IMAGE_DOS_SIGNATURE 0x5A4D 8 #define IMAGE_OS2_SIGNATURE 0x454E 9 #define IMAGE_OS2_SIGNATURE_LE 0x454C 10 #define IMAGE_VXD_SIGNATURE 0x454C 11 #define IMAGE_NT_SIGNATURE 0x00004550 12 13 // 14 // Image architectures 15 // 16 #define IMAGE_FILE_MACHINE_AM33 0x1d3 17 #define IMAGE_FILE_MACHINE_AMD64 0x8664 18 #define IMAGE_FILE_MACHINE_ARM 0x1c0 19 #define IMAGE_FILE_MACHINE_ARMV7 0x1c4 20 #define IMAGE_FILE_MACHINE_EBC 0xebc 21 #define IMAGE_FILE_MACHINE_I386 0x14c 22 #define IMAGE_FILE_MACHINE_IA64 0x200 23 #define IMAGE_FILE_MACHINE_M32R 0x9041 24 #define IMAGE_FILE_MACHINE_MIPS16 0x266 25 #define IMAGE_FILE_MACHINE_MIPSFPU 0x366 26 #define IMAGE_FILE_MACHINE_MIPSFPU16 0x466 27 #define IMAGE_FILE_MACHINE_POWERPC 0x1f0 28 #define IMAGE_FILE_MACHINE_POWERPCFP 0x1f1 29 #define IMAGE_FILE_MACHINE_R4000 0x166 30 #define IMAGE_FILE_MACHINE_SH3 0x1a2 31 #define IMAGE_FILE_MACHINE_SH3E 0x01a4 32 #define IMAGE_FILE_MACHINE_SH3DSP 0x1a3 33 #define IMAGE_FILE_MACHINE_SH4 0x1a6 34 #define IMAGE_FILE_MACHINE_SH5 0x1a8 35 #define IMAGE_FILE_MACHINE_THUMB 0x1c2 36 #define IMAGE_FILE_MACHINE_WCEMIPSV2 0x169 37 #define IMAGE_FILE_MACHINE_R3000 0x162 38 #define IMAGE_FILE_MACHINE_R10000 0x168 39 #define IMAGE_FILE_MACHINE_ALPHA 0x184 40 #define IMAGE_FILE_MACHINE_ALPHA64 0x0284 41 #define IMAGE_FILE_MACHINE_AXP64 IMAGE_FILE_MACHINE_ALPHA64 42 #define IMAGE_FILE_MACHINE_CEE 0xC0EE 43 #define IMAGE_FILE_MACHINE_TRICORE 0x0520 44 #define IMAGE_FILE_MACHINE_CEF 0x0CEF 45 46 47 // 48 // DOS Image Header Format 49 // 50 #include <pshpack2.h> 51 typedef struct _IMAGE_DOS_HEADER { 52 USHORT e_magic; 53 USHORT e_cblp; 54 USHORT e_cp; 55 USHORT e_crlc; 56 USHORT e_cparhdr; 57 USHORT e_minalloc; 58 USHORT e_maxalloc; 59 USHORT e_ss; 60 USHORT e_sp; 61 USHORT e_csum; 62 USHORT e_ip; 63 USHORT e_cs; 64 USHORT e_lfarlc; 65 USHORT e_ovno; 66 USHORT e_res[4]; 67 USHORT e_oemid; 68 USHORT e_oeminfo; 69 USHORT e_res2[10]; 70 LONG e_lfanew; 71 } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER; 72 #include <poppack.h> 73 74 75 // 76 // Export/Import Format 77 // 78 #include <pshpack4.h> 79 typedef struct _IMAGE_EXPORT_DIRECTORY { 80 ULONG Characteristics; 81 ULONG TimeDateStamp; 82 USHORT MajorVersion; 83 USHORT MinorVersion; 84 ULONG Name; 85 ULONG Base; 86 ULONG NumberOfFunctions; 87 ULONG NumberOfNames; 88 ULONG AddressOfFunctions; 89 ULONG AddressOfNames; 90 ULONG AddressOfNameOrdinals; 91 } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY; 92 93 94 // 95 // Resource Data Entry Format 96 // 97 typedef struct _IMAGE_RESOURCE_DATA_ENTRY { 98 ULONG OffsetToData; 99 ULONG Size; 100 ULONG CodePage; 101 ULONG Reserved; 102 } IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY; 103 104 105 // 106 // Load Configuration Directory Entry Format 107 // 108 typedef struct { 109 ULONG Size; 110 ULONG TimeDateStamp; 111 USHORT MajorVersion; 112 USHORT MinorVersion; 113 ULONG GlobalFlagsClear; 114 ULONG GlobalFlagsSet; 115 ULONG CriticalSectionDefaultTimeout; 116 ULONG DeCommitFreeBlockThreshold; 117 ULONG DeCommitTotalFreeThreshold; 118 ULONG LockPrefixTable; 119 ULONG MaximumAllocationSize; 120 ULONG VirtualMemoryThreshold; 121 ULONG ProcessHeapFlags; 122 ULONG ProcessAffinityMask; 123 USHORT CSDVersion; 124 USHORT Reserved1; 125 ULONG EditList; 126 ULONG SecurityCookie; 127 ULONG SEHandlerTable; 128 ULONG SEHandlerCount; 129 } IMAGE_LOAD_CONFIG_DIRECTORY32, *PIMAGE_LOAD_CONFIG_DIRECTORY32; 130 131 typedef struct { 132 ULONG Size; 133 ULONG TimeDateStamp; 134 USHORT MajorVersion; 135 USHORT MinorVersion; 136 ULONG GlobalFlagsClear; 137 ULONG GlobalFlagsSet; 138 ULONG CriticalSectionDefaultTimeout; 139 ULONGLONG DeCommitFreeBlockThreshold; 140 ULONGLONG DeCommitTotalFreeThreshold; 141 ULONGLONG LockPrefixTable; 142 ULONGLONG MaximumAllocationSize; 143 ULONGLONG VirtualMemoryThreshold; 144 ULONGLONG ProcessAffinityMask; 145 ULONG ProcessHeapFlags; 146 USHORT CSDVersion; 147 USHORT Reserved1; 148 ULONGLONG EditList; 149 ULONGLONG SecurityCookie; 150 ULONGLONG SEHandlerTable; 151 ULONGLONG SEHandlerCount; 152 } IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64; 153 154 #ifdef _WIN64 155 typedef IMAGE_LOAD_CONFIG_DIRECTORY64 IMAGE_LOAD_CONFIG_DIRECTORY; 156 typedef PIMAGE_LOAD_CONFIG_DIRECTORY64 PIMAGE_LOAD_CONFIG_DIRECTORY; 157 #else 158 typedef IMAGE_LOAD_CONFIG_DIRECTORY32 IMAGE_LOAD_CONFIG_DIRECTORY; 159 typedef PIMAGE_LOAD_CONFIG_DIRECTORY32 PIMAGE_LOAD_CONFIG_DIRECTORY; 160 #endif 161 162 163 // 164 // Base Relocation Format 165 // 166 typedef struct _IMAGE_BASE_RELOCATION { 167 ULONG VirtualAddress; 168 ULONG SizeOfBlock; 169 } IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION; 170 171 172 // 173 // Resource Format 174 // 175 typedef struct _IMAGE_RESOURCE_DIRECTORY { 176 ULONG Characteristics; 177 ULONG TimeDateStamp; 178 USHORT MajorVersion; 179 USHORT MinorVersion; 180 USHORT NumberOfNamedEntries; 181 USHORT NumberOfIdEntries; 182 } IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY; 183 184 typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING { 185 USHORT Length; 186 CHAR NameString[ANYSIZE_ARRAY]; 187 } IMAGE_RESOURCE_DIRECTORY_STRING, *PIMAGE_RESOURCE_DIRECTORY_STRING; 188 189 190 // 191 // Section Header Format 192 // 193 #define IMAGE_SIZEOF_SHORT_NAME 8 194 #define IMAGE_SIZEOF_SECTION_HEADER 40 195 196 typedef struct _IMAGE_SECTION_HEADER { 197 UCHAR Name[IMAGE_SIZEOF_SHORT_NAME]; 198 union 199 { 200 ULONG PhysicalAddress; 201 ULONG VirtualSize; 202 } Misc; 203 ULONG VirtualAddress; 204 ULONG SizeOfRawData; 205 ULONG PointerToRawData; 206 ULONG PointerToRelocations; 207 ULONG PointerToLinenumbers; 208 USHORT NumberOfRelocations; 209 USHORT NumberOfLinenumbers; 210 ULONG Characteristics; 211 } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER; 212 213 // 214 // Section Characteristics 215 // 216 #define IMAGE_SCN_CNT_CODE 0x00000020 217 #define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040 218 #define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 219 220 #define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000 221 #define IMAGE_SCN_MEM_DISCARDABLE 0x02000000 222 #define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 223 #define IMAGE_SCN_MEM_NOT_PAGED 0x08000000 224 #define IMAGE_SCN_MEM_SHARED 0x10000000 225 #define IMAGE_SCN_MEM_EXECUTE 0x20000000 226 #define IMAGE_SCN_MEM_READ 0x40000000 227 #define IMAGE_SCN_MEM_WRITE 0x80000000 228 229 230 // 231 // File Header Format 232 // 233 #define IMAGE_SIZEOF_FILE_HEADER 20 234 235 typedef struct _IMAGE_FILE_HEADER { 236 USHORT Machine; 237 USHORT NumberOfSections; 238 ULONG TimeDateStamp; 239 ULONG PointerToSymbolTable; 240 ULONG NumberOfSymbols; 241 USHORT SizeOfOptionalHeader; 242 USHORT Characteristics; 243 } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; 244 245 // 246 // File Characteristics 247 // 248 #define IMAGE_FILE_RELOCS_STRIPPED 0x0001 249 #define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 250 #define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 251 #define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 252 #define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010 253 #define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 254 #define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 255 #define IMAGE_FILE_32BIT_MACHINE 0x0100 256 #define IMAGE_FILE_DEBUG_STRIPPED 0x0200 257 #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 258 #define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 259 #define IMAGE_FILE_SYSTEM 0x1000 260 #define IMAGE_FILE_DLL 0x2000 261 #define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 262 #define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 263 264 265 // 266 // Directory format. 267 // 268 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 269 270 typedef struct _IMAGE_DATA_DIRECTORY { 271 ULONG VirtualAddress; 272 ULONG Size; 273 } IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY; 274 275 276 // 277 // Optional Header Formats 278 // 279 typedef struct _IMAGE_OPTIONAL_HEADER { 280 USHORT Magic; 281 UCHAR MajorLinkerVersion; 282 UCHAR MinorLinkerVersion; 283 ULONG SizeOfCode; 284 ULONG SizeOfInitializedData; 285 ULONG SizeOfUninitializedData; 286 ULONG AddressOfEntryPoint; 287 ULONG BaseOfCode; 288 ULONG BaseOfData; 289 ULONG ImageBase; 290 ULONG SectionAlignment; 291 ULONG FileAlignment; 292 USHORT MajorOperatingSystemVersion; 293 USHORT MinorOperatingSystemVersion; 294 USHORT MajorImageVersion; 295 USHORT MinorImageVersion; 296 USHORT MajorSubsystemVersion; 297 USHORT MinorSubsystemVersion; 298 ULONG Win32VersionValue; 299 ULONG SizeOfImage; 300 ULONG SizeOfHeaders; 301 ULONG CheckSum; 302 USHORT Subsystem; 303 USHORT DllCharacteristics; 304 ULONG SizeOfStackReserve; 305 ULONG SizeOfStackCommit; 306 ULONG SizeOfHeapReserve; 307 ULONG SizeOfHeapCommit; 308 ULONG LoaderFlags; 309 ULONG NumberOfRvaAndSizes; 310 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; 311 } IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32; 312 313 typedef struct _IMAGE_ROM_OPTIONAL_HEADER { 314 USHORT Magic; 315 UCHAR MajorLinkerVersion; 316 UCHAR MinorLinkerVersion; 317 ULONG SizeOfCode; 318 ULONG SizeOfInitializedData; 319 ULONG SizeOfUninitializedData; 320 ULONG AddressOfEntryPoint; 321 ULONG BaseOfCode; 322 ULONG BaseOfData; 323 ULONG BaseOfBss; 324 ULONG GprMask; 325 ULONG CprMask[4]; 326 ULONG GpValue; 327 } IMAGE_ROM_OPTIONAL_HEADER, *PIMAGE_ROM_OPTIONAL_HEADER; 328 329 typedef struct _IMAGE_OPTIONAL_HEADER64 { 330 USHORT Magic; 331 UCHAR MajorLinkerVersion; 332 UCHAR MinorLinkerVersion; 333 ULONG SizeOfCode; 334 ULONG SizeOfInitializedData; 335 ULONG SizeOfUninitializedData; 336 ULONG AddressOfEntryPoint; 337 ULONG BaseOfCode; 338 ULONGLONG ImageBase; 339 ULONG SectionAlignment; 340 ULONG FileAlignment; 341 USHORT MajorOperatingSystemVersion; 342 USHORT MinorOperatingSystemVersion; 343 USHORT MajorImageVersion; 344 USHORT MinorImageVersion; 345 USHORT MajorSubsystemVersion; 346 USHORT MinorSubsystemVersion; 347 ULONG Win32VersionValue; 348 ULONG SizeOfImage; 349 ULONG SizeOfHeaders; 350 ULONG CheckSum; 351 USHORT Subsystem; 352 USHORT DllCharacteristics; 353 ULONGLONG SizeOfStackReserve; 354 ULONGLONG SizeOfStackCommit; 355 ULONGLONG SizeOfHeapReserve; 356 ULONGLONG SizeOfHeapCommit; 357 ULONG LoaderFlags; 358 ULONG NumberOfRvaAndSizes; 359 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; 360 } IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64; 361 362 // 363 // Format Identifier Magics 364 // 365 #define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b 366 #define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b 367 #define IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107 368 369 370 #ifdef _WIN64 371 typedef IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER; 372 typedef PIMAGE_OPTIONAL_HEADER64 PIMAGE_OPTIONAL_HEADER; 373 #define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR64_MAGIC 374 #else 375 typedef IMAGE_OPTIONAL_HEADER32 IMAGE_OPTIONAL_HEADER; 376 typedef PIMAGE_OPTIONAL_HEADER32 PIMAGE_OPTIONAL_HEADER; 377 #define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR32_MAGIC 378 #endif 379 380 381 // 382 // Nt Header Formats 383 // 384 typedef struct _IMAGE_NT_HEADERS64 { 385 ULONG Signature; 386 IMAGE_FILE_HEADER FileHeader; 387 IMAGE_OPTIONAL_HEADER64 OptionalHeader; 388 } IMAGE_NT_HEADERS64; 389 390 typedef struct _IMAGE_NT_HEADERS { 391 ULONG Signature; 392 IMAGE_FILE_HEADER FileHeader; 393 IMAGE_OPTIONAL_HEADER32 OptionalHeader; 394 } IMAGE_NT_HEADERS32; 395 396 #ifdef _WIN64 397 typedef IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS; 398 #else 399 typedef IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS; 400 #endif 401 402 #ifndef _NTDDK_ 403 404 typedef struct _IMAGE_NT_HEADERS *PIMAGE_NT_HEADERS32; 405 typedef struct _IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64; 406 407 #ifdef _WIN64 408 typedef PIMAGE_NT_HEADERS64 PIMAGE_NT_HEADERS; 409 #else 410 typedef PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS; 411 #endif 412 413 #endif /* _NTDDK_ */ 414 415 // 416 // Retreives the first image section header from the Nt Header 417 // 418 #define IMAGE_FIRST_SECTION( NtHeader ) ((PIMAGE_SECTION_HEADER) \ 419 ((ULONG_PTR)(NtHeader) + \ 420 FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) + \ 421 ((NtHeader))->FileHeader.SizeOfOptionalHeader \ 422 )) 423 424 // 425 // Dll Characteristics 426 // 427 #define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA 0x0020 428 #define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040 429 #define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY 0x0080 430 #define IMAGE_DLLCHARACTERISTICS_NX_COMPAT 0x0100 431 #define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200 432 #define IMAGE_DLLCHARACTERISTICS_NO_SEH 0x0400 433 #define IMAGE_DLLCHARACTERISTICS_NO_BIND 0x0800 434 #define IMAGE_DLLCHARACTERISTICS_APPCONTAINER 0x1000 435 #define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER 0x2000 436 #define IMAGE_DLLCHARACTERISTICS_GUARD_CF 0x4000 437 #define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000 438 439 // 440 // Loader Flags 441 // 442 #define IMAGE_LOADER_FLAGS_COMPLUS 0x00000001 443 #define IMAGE_LOADER_FLAGS_SYSTEM_GLOBAL 0x01000000 444 445 // 446 // Directory Entry Specifiers 447 // 448 #define IMAGE_DIRECTORY_ENTRY_EXPORT 0 449 #define IMAGE_DIRECTORY_ENTRY_IMPORT 1 450 #define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 451 #define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 452 #define IMAGE_DIRECTORY_ENTRY_SECURITY 4 453 #define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 454 #define IMAGE_DIRECTORY_ENTRY_DEBUG 6 455 #define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7 456 #define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 457 #define IMAGE_DIRECTORY_ENTRY_TLS 9 458 #define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 459 #define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 460 #define IMAGE_DIRECTORY_ENTRY_IAT 12 461 #define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13 462 #define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 463 464 465 // 466 // Import Formats 467 // 468 typedef struct _IMAGE_IMPORT_BY_NAME { 469 USHORT Hint; 470 UCHAR Name[1]; 471 } IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME; 472 473 #include <pshpack8.h> 474 typedef struct _IMAGE_THUNK_DATA64 { 475 union { 476 ULONGLONG ForwarderString; 477 ULONGLONG Function; 478 ULONGLONG Ordinal; 479 ULONGLONG AddressOfData; 480 } u1; 481 } IMAGE_THUNK_DATA64, *PIMAGE_THUNK_DATA64; 482 #include <poppack.h> 483 484 typedef struct _IMAGE_THUNK_DATA32 { 485 union { 486 ULONG ForwarderString; 487 ULONG Function; 488 ULONG Ordinal; 489 ULONG AddressOfData; 490 } u1; 491 } IMAGE_THUNK_DATA32, *PIMAGE_THUNK_DATA32; 492 493 #define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL 494 #define IMAGE_ORDINAL_FLAG32 0x80000000 495 #define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff) 496 #define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff) 497 #define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0) 498 #define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0) 499 500 501 // 502 // Thread Local Storage (TLS) 503 // 504 typedef 505 VOID 506 (NTAPI *PIMAGE_TLS_CALLBACK) ( 507 PVOID DllHandle, 508 ULONG Reason, 509 PVOID Reserved 510 ); 511 512 typedef struct _IMAGE_TLS_DIRECTORY64 { 513 ULONGLONG StartAddressOfRawData; 514 ULONGLONG EndAddressOfRawData; 515 ULONGLONG AddressOfIndex; 516 ULONGLONG AddressOfCallBacks; 517 ULONG SizeOfZeroFill; 518 ULONG Characteristics; 519 } IMAGE_TLS_DIRECTORY64, *PIMAGE_TLS_DIRECTORY64; 520 521 typedef struct _IMAGE_TLS_DIRECTORY32 { 522 ULONG StartAddressOfRawData; 523 ULONG EndAddressOfRawData; 524 ULONG AddressOfIndex; 525 ULONG AddressOfCallBacks; 526 ULONG SizeOfZeroFill; 527 ULONG Characteristics; 528 } IMAGE_TLS_DIRECTORY32, *PIMAGE_TLS_DIRECTORY32; 529 530 #ifdef _WIN64 531 #define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG64 532 #define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL64(Ordinal) 533 typedef IMAGE_THUNK_DATA64 IMAGE_THUNK_DATA; 534 typedef PIMAGE_THUNK_DATA64 PIMAGE_THUNK_DATA; 535 #define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL64(Ordinal) 536 typedef IMAGE_TLS_DIRECTORY64 IMAGE_TLS_DIRECTORY; 537 typedef PIMAGE_TLS_DIRECTORY64 PIMAGE_TLS_DIRECTORY; 538 #else 539 #define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG32 540 #define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL32(Ordinal) 541 typedef IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA; 542 typedef PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA; 543 #define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL32(Ordinal) 544 typedef IMAGE_TLS_DIRECTORY32 IMAGE_TLS_DIRECTORY; 545 typedef PIMAGE_TLS_DIRECTORY32 PIMAGE_TLS_DIRECTORY; 546 #endif 547 548 typedef struct _IMAGE_IMPORT_DESCRIPTOR { 549 _ANONYMOUS_UNION union { 550 ULONG Characteristics; 551 ULONG OriginalFirstThunk; 552 } DUMMYUNIONNAME; 553 ULONG TimeDateStamp; 554 ULONG ForwarderChain; 555 ULONG Name; 556 ULONG FirstThunk; 557 } IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR; 558 559 #include <poppack.h> 560 561 562 #endif /* _NTIMAGE_ */ 563 564