All Data Structures Files Functions Variables Enumerations Enumerator Macros Groups
bytecode_pe.h
Go to the documentation of this file.
1 /*
2  * Copyright (C) 2009-2013 Sourcefire, Inc.
3  * Copyright (C) 2014 Cisco Systems, Inc. and/or its affiliates.
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  * notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  * notice, this list of conditions and the following disclaimer in the
13  * documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS AS IS'' AND
16  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
19  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25  * SUCH DAMAGE.
26  */
27 
28 #ifndef __PE_H
29 #define __PE_H
30 
37  uint32_t Magic;
38  uint16_t Machine;
39  uint16_t NumberOfSections;
40  uint32_t TimeDateStamp;
42  uint32_t NumberOfSymbols;
44  uint16_t Characteristics;
45 };
46 
52  uint32_t VirtualAddress;
53  uint32_t Size;
54 };
55 
61  uint16_t Magic;
64  uint32_t SizeOfCode;
67  uint32_t AddressOfEntryPoint;
68  uint32_t BaseOfCode;
69  uint32_t BaseOfData;
70  uint32_t ImageBase;
71  uint32_t SectionAlignment;
72  uint32_t FileAlignment;
75  uint16_t MajorImageVersion;
76  uint16_t MinorImageVersion;
77  uint16_t MajorSubsystemVersion;
78  uint16_t MinorSubsystemVersion;
79  uint32_t Win32VersionValue; /*< ? */
80  uint32_t SizeOfImage;
81  uint32_t SizeOfHeaders;
82  uint32_t CheckSum;
83  uint16_t Subsystem;
84  uint16_t DllCharacteristics;
85  uint32_t SizeOfStackReserve;
86  uint32_t SizeOfStackCommit;
87  uint32_t SizeOfHeapReserve;
88  uint32_t SizeOfHeapCommit;
89  uint32_t LoaderFlags; /*< ? */
91  struct pe_image_data_dir DataDirectory[16];
92 };
93 
99  uint16_t Magic;
102  uint32_t SizeOfCode;
105  uint32_t AddressOfEntryPoint;
106  uint32_t BaseOfCode;
107  uint64_t ImageBase;
108  uint32_t SectionAlignment;
109  uint32_t FileAlignment;
112  uint16_t MajorImageVersion;
113  uint16_t MinorImageVersion;
114  uint16_t MajorSubsystemVersion;
115  uint16_t MinorSubsystemVersion;
116  uint32_t Win32VersionValue; /* ? */
117  uint32_t SizeOfImage;
118  uint32_t SizeOfHeaders;
119  uint32_t CheckSum;
120  uint16_t Subsystem;
121  uint16_t DllCharacteristics;
122  uint64_t SizeOfStackReserve;
123  uint64_t SizeOfStackCommit;
124  uint64_t SizeOfHeapReserve;
125  uint64_t SizeOfHeapCommit;
126  uint32_t LoaderFlags; /* ? */
128  struct pe_image_data_dir DataDirectory[16];
129 };
130 
136  uint8_t Name[8];
137  /*
138  union {
139  uint32_t PhysicalAddress;
140  uint32_t VirtualSize;
141  } AddrSize;
142  */
143  uint32_t VirtualSize;
144  uint32_t VirtualAddress;
145  uint32_t SizeOfRawData;
146  uint32_t PointerToRawData;
151  uint32_t Characteristics;
152 };
153 
159  uint32_t offset;
160  uint32_t ep;
161  uint16_t nsections;
162  uint16_t dummy; /* align */
165  uint32_t dummy2; /* align */
167  struct pe_image_data_dir dirs[16];
168  uint32_t e_lfanew;
169  uint32_t overlays;
170  int32_t overlays_sz;
171  uint32_t hdr_size;
172 };
173 
174 
175 
176 
177 #endif
uint32_t PointerToSymbolTable
Definition: bytecode_pe.h:41
uint32_t SectionAlignment
Definition: bytecode_pe.h:108
uint16_t MajorOperatingSystemVersion
Definition: bytecode_pe.h:73
int32_t overlays_sz
Definition: bytecode_pe.h:170
uint16_t nsections
Definition: bytecode_pe.h:161
struct pe_image_optional_hdr64 opt64
Definition: bytecode_pe.h:166
uint32_t SectionAlignment
Definition: bytecode_pe.h:71
Definition: bytecode_pe.h:98
uint32_t SizeOfUninitializedData
Definition: bytecode_pe.h:104
uint16_t MinorOperatingSystemVersion
Definition: bytecode_pe.h:111
uint32_t SizeOfUninitializedData
Definition: bytecode_pe.h:66
uint32_t overlays
Definition: bytecode_pe.h:169
Definition: bytecode_pe.h:36
uint32_t PointerToLinenumbers
Definition: bytecode_pe.h:148
uint32_t NumberOfSymbols
Definition: bytecode_pe.h:42
struct pe_image_optional_hdr32 opt32
Definition: bytecode_pe.h:164
uint16_t MajorOperatingSystemVersion
Definition: bytecode_pe.h:110
uint32_t CheckSum
Definition: bytecode_pe.h:119
Definition: bytecode_pe.h:135
uint32_t ep
Definition: bytecode_pe.h:160
uint8_t MinorLinkerVersion
Definition: bytecode_pe.h:63
uint32_t NumberOfRvaAndSizes
Definition: bytecode_pe.h:127
uint16_t NumberOfSections
Definition: bytecode_pe.h:39
uint32_t SizeOfInitializedData
Definition: bytecode_pe.h:65
uint32_t NumberOfRvaAndSizes
Definition: bytecode_pe.h:90
uint32_t CheckSum
Definition: bytecode_pe.h:82
uint16_t NumberOfRelocations
Definition: bytecode_pe.h:149
uint8_t MajorLinkerVersion
Definition: bytecode_pe.h:100
Definition: bytecode_pe.h:51
Definition: bytecode_pe.h:158
uint32_t Magic
Definition: bytecode_pe.h:37
uint8_t MinorLinkerVersion
Definition: bytecode_pe.h:101
uint32_t TimeDateStamp
Definition: bytecode_pe.h:40
struct pe_image_data_dir dirs[16]
Definition: bytecode_pe.h:167
uint16_t MajorImageVersion
Definition: bytecode_pe.h:75
uint8_t Name[8]
Definition: bytecode_pe.h:136
uint16_t SizeOfOptionalHeader
Definition: bytecode_pe.h:43
uint16_t NumberOfLinenumbers
Definition: bytecode_pe.h:150
uint16_t MinorOperatingSystemVersion
Definition: bytecode_pe.h:74
uint32_t SizeOfRawData
Definition: bytecode_pe.h:145
uint16_t MajorImageVersion
Definition: bytecode_pe.h:112
uint16_t Machine
Definition: bytecode_pe.h:38
uint8_t MajorLinkerVersion
Definition: bytecode_pe.h:62
uint32_t PointerToRelocations
Definition: bytecode_pe.h:147
uint32_t SizeOfCode
Definition: bytecode_pe.h:64
uint16_t MinorImageVersion
Definition: bytecode_pe.h:113
uint32_t FileAlignment
Definition: bytecode_pe.h:109
struct pe_image_file_hdr file_hdr
Definition: bytecode_pe.h:163
uint32_t FileAlignment
Definition: bytecode_pe.h:72
uint32_t ImageBase
Definition: bytecode_pe.h:70
Definition: bytecode_pe.h:60
uint32_t SizeOfInitializedData
Definition: bytecode_pe.h:103
uint64_t ImageBase
Definition: bytecode_pe.h:107
uint32_t e_lfanew
Definition: bytecode_pe.h:168
uint32_t SizeOfCode
Definition: bytecode_pe.h:102
uint16_t MinorImageVersion
Definition: bytecode_pe.h:76
uint32_t hdr_size
Definition: bytecode_pe.h:171
uint32_t PointerToRawData
Definition: bytecode_pe.h:146