object/
pe.rs

1//! PE/COFF definitions.
2//!
3//! These definitions are independent of read/write support, although we do implement
4//! some traits useful for those.
5//!
6//! This module is based heavily on "winnt.h" (10.0.17763.0).
7
8#![allow(missing_docs)]
9
10use core::convert::TryInto;
11
12use crate::endian::{I32Bytes, LittleEndian as LE, U16Bytes, U32Bytes, I32, U16, U32, U64};
13use crate::pod::Pod;
14
15/// MZ
16pub const IMAGE_DOS_SIGNATURE: u16 = 0x5A4D;
17/// NE
18pub const IMAGE_OS2_SIGNATURE: u16 = 0x454E;
19/// LE
20pub const IMAGE_OS2_SIGNATURE_LE: u16 = 0x454C;
21/// LE
22pub const IMAGE_VXD_SIGNATURE: u16 = 0x454C;
23/// PE00
24pub const IMAGE_NT_SIGNATURE: u32 = 0x0000_4550;
25
26/// DOS .EXE header
27#[derive(Debug, Clone, Copy)]
28#[repr(C)]
29pub struct ImageDosHeader {
30    /// Magic number
31    pub e_magic: U16<LE>,
32    /// Bytes on last page of file
33    pub e_cblp: U16<LE>,
34    /// Pages in file
35    pub e_cp: U16<LE>,
36    /// Relocations
37    pub e_crlc: U16<LE>,
38    /// Size of header in paragraphs
39    pub e_cparhdr: U16<LE>,
40    /// Minimum extra paragraphs needed
41    pub e_minalloc: U16<LE>,
42    /// Maximum extra paragraphs needed
43    pub e_maxalloc: U16<LE>,
44    /// Initial (relative) SS value
45    pub e_ss: U16<LE>,
46    /// Initial SP value
47    pub e_sp: U16<LE>,
48    /// Checksum
49    pub e_csum: U16<LE>,
50    /// Initial IP value
51    pub e_ip: U16<LE>,
52    /// Initial (relative) CS value
53    pub e_cs: U16<LE>,
54    /// File address of relocation table
55    pub e_lfarlc: U16<LE>,
56    /// Overlay number
57    pub e_ovno: U16<LE>,
58    /// Reserved words
59    pub e_res: [U16<LE>; 4],
60    /// OEM identifier (for e_oeminfo)
61    pub e_oemid: U16<LE>,
62    /// OEM information; e_oemid specific
63    pub e_oeminfo: U16<LE>,
64    /// Reserved words
65    pub e_res2: [U16<LE>; 10],
66    /// File address of new exe header
67    pub e_lfanew: U32<LE>,
68}
69
70/// OS/2 .EXE header
71#[derive(Debug, Clone, Copy)]
72#[repr(C)]
73pub struct ImageOs2Header {
74    /// Magic number
75    pub ne_magic: U16<LE>,
76    /// Version number
77    pub ne_ver: i8,
78    /// Revision number
79    pub ne_rev: i8,
80    /// Offset of Entry Table
81    pub ne_enttab: U16<LE>,
82    /// Number of bytes in Entry Table
83    pub ne_cbenttab: U16<LE>,
84    /// Checksum of whole file
85    pub ne_crc: I32<LE>,
86    /// Flag word
87    pub ne_flags: U16<LE>,
88    /// Automatic data segment number
89    pub ne_autodata: U16<LE>,
90    /// Initial heap allocation
91    pub ne_heap: U16<LE>,
92    /// Initial stack allocation
93    pub ne_stack: U16<LE>,
94    /// Initial CS:IP setting
95    pub ne_csip: I32<LE>,
96    /// Initial SS:SP setting
97    pub ne_sssp: I32<LE>,
98    /// Count of file segments
99    pub ne_cseg: U16<LE>,
100    /// Entries in Module Reference Table
101    pub ne_cmod: U16<LE>,
102    /// Size of non-resident name table
103    pub ne_cbnrestab: U16<LE>,
104    /// Offset of Segment Table
105    pub ne_segtab: U16<LE>,
106    /// Offset of Resource Table
107    pub ne_rsrctab: U16<LE>,
108    /// Offset of resident name table
109    pub ne_restab: U16<LE>,
110    /// Offset of Module Reference Table
111    pub ne_modtab: U16<LE>,
112    /// Offset of Imported Names Table
113    pub ne_imptab: U16<LE>,
114    /// Offset of Non-resident Names Table
115    pub ne_nrestab: I32<LE>,
116    /// Count of movable entries
117    pub ne_cmovent: U16<LE>,
118    /// Segment alignment shift count
119    pub ne_align: U16<LE>,
120    /// Count of resource segments
121    pub ne_cres: U16<LE>,
122    /// Target Operating system
123    pub ne_exetyp: u8,
124    /// Other .EXE flags
125    pub ne_flagsothers: u8,
126    /// offset to return thunks
127    pub ne_pretthunks: U16<LE>,
128    /// offset to segment ref. bytes
129    pub ne_psegrefbytes: U16<LE>,
130    /// Minimum code swap area size
131    pub ne_swaparea: U16<LE>,
132    /// Expected Windows version number
133    pub ne_expver: U16<LE>,
134}
135
136/// Windows VXD header
137#[derive(Debug, Clone, Copy)]
138#[repr(C)]
139pub struct ImageVxdHeader {
140    /// Magic number
141    pub e32_magic: U16<LE>,
142    /// The byte ordering for the VXD
143    pub e32_border: u8,
144    /// The word ordering for the VXD
145    pub e32_worder: u8,
146    /// The EXE format level for now = 0
147    pub e32_level: U32<LE>,
148    /// The CPU type
149    pub e32_cpu: U16<LE>,
150    /// The OS type
151    pub e32_os: U16<LE>,
152    /// Module version
153    pub e32_ver: U32<LE>,
154    /// Module flags
155    pub e32_mflags: U32<LE>,
156    /// Module # pages
157    pub e32_mpages: U32<LE>,
158    /// Object # for instruction pointer
159    pub e32_startobj: U32<LE>,
160    /// Extended instruction pointer
161    pub e32_eip: U32<LE>,
162    /// Object # for stack pointer
163    pub e32_stackobj: U32<LE>,
164    /// Extended stack pointer
165    pub e32_esp: U32<LE>,
166    /// VXD page size
167    pub e32_pagesize: U32<LE>,
168    /// Last page size in VXD
169    pub e32_lastpagesize: U32<LE>,
170    /// Fixup section size
171    pub e32_fixupsize: U32<LE>,
172    /// Fixup section checksum
173    pub e32_fixupsum: U32<LE>,
174    /// Loader section size
175    pub e32_ldrsize: U32<LE>,
176    /// Loader section checksum
177    pub e32_ldrsum: U32<LE>,
178    /// Object table offset
179    pub e32_objtab: U32<LE>,
180    /// Number of objects in module
181    pub e32_objcnt: U32<LE>,
182    /// Object page map offset
183    pub e32_objmap: U32<LE>,
184    /// Object iterated data map offset
185    pub e32_itermap: U32<LE>,
186    /// Offset of Resource Table
187    pub e32_rsrctab: U32<LE>,
188    /// Number of resource entries
189    pub e32_rsrccnt: U32<LE>,
190    /// Offset of resident name table
191    pub e32_restab: U32<LE>,
192    /// Offset of Entry Table
193    pub e32_enttab: U32<LE>,
194    /// Offset of Module Directive Table
195    pub e32_dirtab: U32<LE>,
196    /// Number of module directives
197    pub e32_dircnt: U32<LE>,
198    /// Offset of Fixup Page Table
199    pub e32_fpagetab: U32<LE>,
200    /// Offset of Fixup Record Table
201    pub e32_frectab: U32<LE>,
202    /// Offset of Import Module Name Table
203    pub e32_impmod: U32<LE>,
204    /// Number of entries in Import Module Name Table
205    pub e32_impmodcnt: U32<LE>,
206    /// Offset of Import Procedure Name Table
207    pub e32_impproc: U32<LE>,
208    /// Offset of Per-Page Checksum Table
209    pub e32_pagesum: U32<LE>,
210    /// Offset of Enumerated Data Pages
211    pub e32_datapage: U32<LE>,
212    /// Number of preload pages
213    pub e32_preload: U32<LE>,
214    /// Offset of Non-resident Names Table
215    pub e32_nrestab: U32<LE>,
216    /// Size of Non-resident Name Table
217    pub e32_cbnrestab: U32<LE>,
218    /// Non-resident Name Table Checksum
219    pub e32_nressum: U32<LE>,
220    /// Object # for automatic data object
221    pub e32_autodata: U32<LE>,
222    /// Offset of the debugging information
223    pub e32_debuginfo: U32<LE>,
224    /// The length of the debugging info. in bytes
225    pub e32_debuglen: U32<LE>,
226    /// Number of instance pages in preload section of VXD file
227    pub e32_instpreload: U32<LE>,
228    /// Number of instance pages in demand load section of VXD file
229    pub e32_instdemand: U32<LE>,
230    /// Size of heap - for 16-bit apps
231    pub e32_heapsize: U32<LE>,
232    /// Reserved words
233    pub e32_res3: [u8; 12],
234    pub e32_winresoff: U32<LE>,
235    pub e32_winreslen: U32<LE>,
236    /// Device ID for VxD
237    pub e32_devid: U16<LE>,
238    /// DDK version for VxD
239    pub e32_ddkver: U16<LE>,
240}
241
242/// A PE rich header entry.
243///
244/// Rich headers have no official documentation, but have been heavily
245/// reversed-engineered and documented in the wild, e.g.:
246/// * `http://www.ntcore.com/files/richsign.htm`
247/// * `https://www.researchgate.net/figure/Structure-of-the-Rich-Header_fig1_318145388`
248///
249/// This data is "masked", i.e. XORed with a checksum derived from the file data.
250#[derive(Debug, Clone, Copy)]
251#[repr(C)]
252pub struct MaskedRichHeaderEntry {
253    pub masked_comp_id: U32<LE>,
254    pub masked_count: U32<LE>,
255}
256
257//
258// File header format.
259//
260
261#[derive(Debug, Clone, Copy)]
262#[repr(C)]
263pub struct ImageFileHeader {
264    pub machine: U16<LE>,
265    pub number_of_sections: U16<LE>,
266    pub time_date_stamp: U32<LE>,
267    pub pointer_to_symbol_table: U32<LE>,
268    pub number_of_symbols: U32<LE>,
269    pub size_of_optional_header: U16<LE>,
270    pub characteristics: U16<LE>,
271}
272
273pub const IMAGE_SIZEOF_FILE_HEADER: usize = 20;
274
275/// Relocation info stripped from file.
276pub const IMAGE_FILE_RELOCS_STRIPPED: u16 = 0x0001;
277/// File is executable  (i.e. no unresolved external references).
278pub const IMAGE_FILE_EXECUTABLE_IMAGE: u16 = 0x0002;
279/// Line numbers stripped from file.
280pub const IMAGE_FILE_LINE_NUMS_STRIPPED: u16 = 0x0004;
281/// Local symbols stripped from file.
282pub const IMAGE_FILE_LOCAL_SYMS_STRIPPED: u16 = 0x0008;
283/// Aggressively trim working set
284pub const IMAGE_FILE_AGGRESIVE_WS_TRIM: u16 = 0x0010;
285/// App can handle >2gb addresses
286pub const IMAGE_FILE_LARGE_ADDRESS_AWARE: u16 = 0x0020;
287/// Bytes of machine word are reversed.
288pub const IMAGE_FILE_BYTES_REVERSED_LO: u16 = 0x0080;
289/// 32 bit word machine.
290pub const IMAGE_FILE_32BIT_MACHINE: u16 = 0x0100;
291/// Debugging info stripped from file in .DBG file
292pub const IMAGE_FILE_DEBUG_STRIPPED: u16 = 0x0200;
293/// If Image is on removable media, copy and run from the swap file.
294pub const IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP: u16 = 0x0400;
295/// If Image is on Net, copy and run from the swap file.
296pub const IMAGE_FILE_NET_RUN_FROM_SWAP: u16 = 0x0800;
297/// System File.
298pub const IMAGE_FILE_SYSTEM: u16 = 0x1000;
299/// File is a DLL.
300pub const IMAGE_FILE_DLL: u16 = 0x2000;
301/// File should only be run on a UP machine
302pub const IMAGE_FILE_UP_SYSTEM_ONLY: u16 = 0x4000;
303/// Bytes of machine word are reversed.
304pub const IMAGE_FILE_BYTES_REVERSED_HI: u16 = 0x8000;
305
306pub const IMAGE_FILE_MACHINE_UNKNOWN: u16 = 0;
307/// Useful for indicating we want to interact with the host and not a WoW guest.
308pub const IMAGE_FILE_MACHINE_TARGET_HOST: u16 = 0x0001;
309/// Intel 386.
310pub const IMAGE_FILE_MACHINE_I386: u16 = 0x014c;
311/// MIPS little-endian, 0x160 big-endian
312pub const IMAGE_FILE_MACHINE_R3000: u16 = 0x0162;
313/// MIPS little-endian
314pub const IMAGE_FILE_MACHINE_R4000: u16 = 0x0166;
315/// MIPS little-endian
316pub const IMAGE_FILE_MACHINE_R10000: u16 = 0x0168;
317/// MIPS little-endian WCE v2
318pub const IMAGE_FILE_MACHINE_WCEMIPSV2: u16 = 0x0169;
319/// Alpha_AXP
320pub const IMAGE_FILE_MACHINE_ALPHA: u16 = 0x0184;
321/// SH3 little-endian
322pub const IMAGE_FILE_MACHINE_SH3: u16 = 0x01a2;
323pub const IMAGE_FILE_MACHINE_SH3DSP: u16 = 0x01a3;
324/// SH3E little-endian
325pub const IMAGE_FILE_MACHINE_SH3E: u16 = 0x01a4;
326/// SH4 little-endian
327pub const IMAGE_FILE_MACHINE_SH4: u16 = 0x01a6;
328/// SH5
329pub const IMAGE_FILE_MACHINE_SH5: u16 = 0x01a8;
330/// ARM Little-Endian
331pub const IMAGE_FILE_MACHINE_ARM: u16 = 0x01c0;
332/// ARM Thumb/Thumb-2 Little-Endian
333pub const IMAGE_FILE_MACHINE_THUMB: u16 = 0x01c2;
334/// ARM Thumb-2 Little-Endian
335pub const IMAGE_FILE_MACHINE_ARMNT: u16 = 0x01c4;
336pub const IMAGE_FILE_MACHINE_AM33: u16 = 0x01d3;
337/// IBM PowerPC Little-Endian
338pub const IMAGE_FILE_MACHINE_POWERPC: u16 = 0x01F0;
339pub const IMAGE_FILE_MACHINE_POWERPCFP: u16 = 0x01f1;
340/// Intel 64
341pub const IMAGE_FILE_MACHINE_IA64: u16 = 0x0200;
342/// MIPS
343pub const IMAGE_FILE_MACHINE_MIPS16: u16 = 0x0266;
344/// ALPHA64
345pub const IMAGE_FILE_MACHINE_ALPHA64: u16 = 0x0284;
346/// MIPS
347pub const IMAGE_FILE_MACHINE_MIPSFPU: u16 = 0x0366;
348/// MIPS
349pub const IMAGE_FILE_MACHINE_MIPSFPU16: u16 = 0x0466;
350pub const IMAGE_FILE_MACHINE_AXP64: u16 = IMAGE_FILE_MACHINE_ALPHA64;
351/// Infineon
352pub const IMAGE_FILE_MACHINE_TRICORE: u16 = 0x0520;
353pub const IMAGE_FILE_MACHINE_CEF: u16 = 0x0CEF;
354/// EFI Byte Code
355pub const IMAGE_FILE_MACHINE_EBC: u16 = 0x0EBC;
356/// AMD64 (K8)
357pub const IMAGE_FILE_MACHINE_AMD64: u16 = 0x8664;
358/// M32R little-endian
359pub const IMAGE_FILE_MACHINE_M32R: u16 = 0x9041;
360/// ARM64 Little-Endian
361pub const IMAGE_FILE_MACHINE_ARM64: u16 = 0xAA64;
362/// ARM64EC ("Emulation Compatible")
363pub const IMAGE_FILE_MACHINE_ARM64EC: u16 = 0xA641;
364pub const IMAGE_FILE_MACHINE_CEE: u16 = 0xC0EE;
365/// RISCV32
366pub const IMAGE_FILE_MACHINE_RISCV32: u16 = 0x5032;
367/// RISCV64
368pub const IMAGE_FILE_MACHINE_RISCV64: u16 = 0x5064;
369/// RISCV128
370pub const IMAGE_FILE_MACHINE_RISCV128: u16 = 0x5128;
371/// ARM64X (Mixed ARM64 and ARM64EC)
372pub const IMAGE_FILE_MACHINE_ARM64X: u16 = 0xA64E;
373/// CHPE x86 ("Compiled Hybrid Portable Executable")
374pub const IMAGE_FILE_MACHINE_CHPE_X86: u16 = 0x3A64;
375
376//
377// Directory format.
378//
379
380#[derive(Debug, Clone, Copy)]
381#[repr(C)]
382pub struct ImageDataDirectory {
383    pub virtual_address: U32<LE>,
384    pub size: U32<LE>,
385}
386
387pub const IMAGE_NUMBEROF_DIRECTORY_ENTRIES: usize = 16;
388
389//
390// Optional header format.
391//
392
393#[derive(Debug, Clone, Copy)]
394#[repr(C)]
395pub struct ImageOptionalHeader32 {
396    // Standard fields.
397    pub magic: U16<LE>,
398    pub major_linker_version: u8,
399    pub minor_linker_version: u8,
400    pub size_of_code: U32<LE>,
401    pub size_of_initialized_data: U32<LE>,
402    pub size_of_uninitialized_data: U32<LE>,
403    pub address_of_entry_point: U32<LE>,
404    pub base_of_code: U32<LE>,
405    pub base_of_data: U32<LE>,
406
407    // NT additional fields.
408    pub image_base: U32<LE>,
409    pub section_alignment: U32<LE>,
410    pub file_alignment: U32<LE>,
411    pub major_operating_system_version: U16<LE>,
412    pub minor_operating_system_version: U16<LE>,
413    pub major_image_version: U16<LE>,
414    pub minor_image_version: U16<LE>,
415    pub major_subsystem_version: U16<LE>,
416    pub minor_subsystem_version: U16<LE>,
417    pub win32_version_value: U32<LE>,
418    pub size_of_image: U32<LE>,
419    pub size_of_headers: U32<LE>,
420    pub check_sum: U32<LE>,
421    pub subsystem: U16<LE>,
422    pub dll_characteristics: U16<LE>,
423    pub size_of_stack_reserve: U32<LE>,
424    pub size_of_stack_commit: U32<LE>,
425    pub size_of_heap_reserve: U32<LE>,
426    pub size_of_heap_commit: U32<LE>,
427    pub loader_flags: U32<LE>,
428    pub number_of_rva_and_sizes: U32<LE>,
429    //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
430}
431
432#[derive(Debug, Clone, Copy)]
433#[repr(C)]
434pub struct ImageRomOptionalHeader {
435    pub magic: U16<LE>,
436    pub major_linker_version: u8,
437    pub minor_linker_version: u8,
438    pub size_of_code: U32<LE>,
439    pub size_of_initialized_data: U32<LE>,
440    pub size_of_uninitialized_data: U32<LE>,
441    pub address_of_entry_point: U32<LE>,
442    pub base_of_code: U32<LE>,
443    pub base_of_data: U32<LE>,
444    pub base_of_bss: U32<LE>,
445    pub gpr_mask: U32<LE>,
446    pub cpr_mask: [U32<LE>; 4],
447    pub gp_value: U32<LE>,
448}
449
450#[derive(Debug, Clone, Copy)]
451#[repr(C)]
452pub struct ImageOptionalHeader64 {
453    pub magic: U16<LE>,
454    pub major_linker_version: u8,
455    pub minor_linker_version: u8,
456    pub size_of_code: U32<LE>,
457    pub size_of_initialized_data: U32<LE>,
458    pub size_of_uninitialized_data: U32<LE>,
459    pub address_of_entry_point: U32<LE>,
460    pub base_of_code: U32<LE>,
461    pub image_base: U64<LE>,
462    pub section_alignment: U32<LE>,
463    pub file_alignment: U32<LE>,
464    pub major_operating_system_version: U16<LE>,
465    pub minor_operating_system_version: U16<LE>,
466    pub major_image_version: U16<LE>,
467    pub minor_image_version: U16<LE>,
468    pub major_subsystem_version: U16<LE>,
469    pub minor_subsystem_version: U16<LE>,
470    pub win32_version_value: U32<LE>,
471    pub size_of_image: U32<LE>,
472    pub size_of_headers: U32<LE>,
473    pub check_sum: U32<LE>,
474    pub subsystem: U16<LE>,
475    pub dll_characteristics: U16<LE>,
476    pub size_of_stack_reserve: U64<LE>,
477    pub size_of_stack_commit: U64<LE>,
478    pub size_of_heap_reserve: U64<LE>,
479    pub size_of_heap_commit: U64<LE>,
480    pub loader_flags: U32<LE>,
481    pub number_of_rva_and_sizes: U32<LE>,
482    //pub data_directory: [ImageDataDirectory; IMAGE_NUMBEROF_DIRECTORY_ENTRIES],
483}
484
485pub const IMAGE_NT_OPTIONAL_HDR32_MAGIC: u16 = 0x10b;
486pub const IMAGE_NT_OPTIONAL_HDR64_MAGIC: u16 = 0x20b;
487pub const IMAGE_ROM_OPTIONAL_HDR_MAGIC: u16 = 0x107;
488
489#[derive(Debug, Clone, Copy)]
490#[repr(C)]
491pub struct ImageNtHeaders64 {
492    pub signature: U32<LE>,
493    pub file_header: ImageFileHeader,
494    pub optional_header: ImageOptionalHeader64,
495}
496
497#[derive(Debug, Clone, Copy)]
498#[repr(C)]
499pub struct ImageNtHeaders32 {
500    pub signature: U32<LE>,
501    pub file_header: ImageFileHeader,
502    pub optional_header: ImageOptionalHeader32,
503}
504
505#[derive(Debug, Clone, Copy)]
506#[repr(C)]
507pub struct ImageRomHeaders {
508    pub file_header: ImageFileHeader,
509    pub optional_header: ImageRomOptionalHeader,
510}
511
512// Values for `ImageOptionalHeader*::subsystem`.
513
514/// Unknown subsystem.
515pub const IMAGE_SUBSYSTEM_UNKNOWN: u16 = 0;
516/// Image doesn't require a subsystem.
517pub const IMAGE_SUBSYSTEM_NATIVE: u16 = 1;
518/// Image runs in the Windows GUI subsystem.
519pub const IMAGE_SUBSYSTEM_WINDOWS_GUI: u16 = 2;
520/// Image runs in the Windows character subsystem.
521pub const IMAGE_SUBSYSTEM_WINDOWS_CUI: u16 = 3;
522/// image runs in the OS/2 character subsystem.
523pub const IMAGE_SUBSYSTEM_OS2_CUI: u16 = 5;
524/// image runs in the Posix character subsystem.
525pub const IMAGE_SUBSYSTEM_POSIX_CUI: u16 = 7;
526/// image is a native Win9x driver.
527pub const IMAGE_SUBSYSTEM_NATIVE_WINDOWS: u16 = 8;
528/// Image runs in the Windows CE subsystem.
529pub const IMAGE_SUBSYSTEM_WINDOWS_CE_GUI: u16 = 9;
530pub const IMAGE_SUBSYSTEM_EFI_APPLICATION: u16 = 10;
531pub const IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER: u16 = 11;
532pub const IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER: u16 = 12;
533pub const IMAGE_SUBSYSTEM_EFI_ROM: u16 = 13;
534pub const IMAGE_SUBSYSTEM_XBOX: u16 = 14;
535pub const IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION: u16 = 16;
536pub const IMAGE_SUBSYSTEM_XBOX_CODE_CATALOG: u16 = 17;
537
538// Values for `ImageOptionalHeader*::dll_characteristics`.
539
540//      IMAGE_LIBRARY_PROCESS_INIT            0x0001     // Reserved.
541//      IMAGE_LIBRARY_PROCESS_TERM            0x0002     // Reserved.
542//      IMAGE_LIBRARY_THREAD_INIT             0x0004     // Reserved.
543//      IMAGE_LIBRARY_THREAD_TERM             0x0008     // Reserved.
544/// Image can handle a high entropy 64-bit virtual address space.
545pub const IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA: u16 = 0x0020;
546/// DLL can move.
547pub const IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE: u16 = 0x0040;
548/// Code Integrity Image
549pub const IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY: u16 = 0x0080;
550/// Image is NX compatible
551pub const IMAGE_DLLCHARACTERISTICS_NX_COMPAT: u16 = 0x0100;
552/// Image understands isolation and doesn't want it
553pub const IMAGE_DLLCHARACTERISTICS_NO_ISOLATION: u16 = 0x0200;
554/// Image does not use SEH.  No SE handler may reside in this image
555pub const IMAGE_DLLCHARACTERISTICS_NO_SEH: u16 = 0x0400;
556/// Do not bind this image.
557pub const IMAGE_DLLCHARACTERISTICS_NO_BIND: u16 = 0x0800;
558/// Image should execute in an AppContainer
559pub const IMAGE_DLLCHARACTERISTICS_APPCONTAINER: u16 = 0x1000;
560/// Driver uses WDM model
561pub const IMAGE_DLLCHARACTERISTICS_WDM_DRIVER: u16 = 0x2000;
562/// Image supports Control Flow Guard.
563pub const IMAGE_DLLCHARACTERISTICS_GUARD_CF: u16 = 0x4000;
564pub const IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE: u16 = 0x8000;
565
566// Indices for `ImageOptionalHeader*::data_directory`.
567
568/// Export Directory
569pub const IMAGE_DIRECTORY_ENTRY_EXPORT: usize = 0;
570/// Import Directory
571pub const IMAGE_DIRECTORY_ENTRY_IMPORT: usize = 1;
572/// Resource Directory
573pub const IMAGE_DIRECTORY_ENTRY_RESOURCE: usize = 2;
574/// Exception Directory
575pub const IMAGE_DIRECTORY_ENTRY_EXCEPTION: usize = 3;
576/// Security Directory
577pub const IMAGE_DIRECTORY_ENTRY_SECURITY: usize = 4;
578/// Base Relocation Table
579pub const IMAGE_DIRECTORY_ENTRY_BASERELOC: usize = 5;
580/// Debug Directory
581pub const IMAGE_DIRECTORY_ENTRY_DEBUG: usize = 6;
582//      IMAGE_DIRECTORY_ENTRY_COPYRIGHT       7   // (X86 usage)
583/// Architecture Specific Data
584pub const IMAGE_DIRECTORY_ENTRY_ARCHITECTURE: usize = 7;
585/// RVA of GP
586pub const IMAGE_DIRECTORY_ENTRY_GLOBALPTR: usize = 8;
587/// TLS Directory
588pub const IMAGE_DIRECTORY_ENTRY_TLS: usize = 9;
589/// Load Configuration Directory
590pub const IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG: usize = 10;
591/// Bound Import Directory in headers
592pub const IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT: usize = 11;
593/// Import Address Table
594pub const IMAGE_DIRECTORY_ENTRY_IAT: usize = 12;
595/// Delay Load Import Descriptors
596pub const IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT: usize = 13;
597/// COM Runtime descriptor
598pub const IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR: usize = 14;
599
600#[derive(Debug, Clone, Copy, PartialEq, Eq)]
601#[repr(C)]
602pub struct Guid(pub [u8; 16]);
603
604impl Guid {
605    #[inline]
606    pub fn data1(self) -> U32<LE> {
607        U32::from_bytes(self.0[0..4].try_into().unwrap())
608    }
609
610    #[inline]
611    pub fn data2(self) -> U16<LE> {
612        U16::from_bytes(self.0[4..6].try_into().unwrap())
613    }
614
615    #[inline]
616    pub fn data3(self) -> U16<LE> {
617        U16::from_bytes(self.0[6..8].try_into().unwrap())
618    }
619
620    #[inline]
621    pub fn data4(self) -> [u8; 8] {
622        self.0[8..16].try_into().unwrap()
623    }
624}
625
626pub use Guid as ClsId;
627
628/// Non-COFF Object file header
629#[derive(Debug, Clone, Copy)]
630#[repr(C)]
631pub struct AnonObjectHeader {
632    /// Must be IMAGE_FILE_MACHINE_UNKNOWN
633    pub sig1: U16<LE>,
634    /// Must be 0xffff
635    pub sig2: U16<LE>,
636    /// >= 1 (implies the ClsId field is present)
637    pub version: U16<LE>,
638    pub machine: U16<LE>,
639    pub time_date_stamp: U32<LE>,
640    /// Used to invoke CoCreateInstance
641    pub class_id: ClsId,
642    /// Size of data that follows the header
643    pub size_of_data: U32<LE>,
644}
645
646#[derive(Debug, Clone, Copy)]
647#[repr(C)]
648pub struct AnonObjectHeaderV2 {
649    /// Must be IMAGE_FILE_MACHINE_UNKNOWN
650    pub sig1: U16<LE>,
651    /// Must be 0xffff
652    pub sig2: U16<LE>,
653    /// >= 2 (implies the Flags field is present - otherwise V1)
654    pub version: U16<LE>,
655    pub machine: U16<LE>,
656    pub time_date_stamp: U32<LE>,
657    /// Used to invoke CoCreateInstance
658    pub class_id: ClsId,
659    /// Size of data that follows the header
660    pub size_of_data: U32<LE>,
661    /// 0x1 -> contains metadata
662    pub flags: U32<LE>,
663    /// Size of CLR metadata
664    pub meta_data_size: U32<LE>,
665    /// Offset of CLR metadata
666    pub meta_data_offset: U32<LE>,
667}
668
669/// The required value of `AnonObjectHeaderBigobj::class_id`.
670pub const ANON_OBJECT_HEADER_BIGOBJ_CLASS_ID: ClsId = ClsId([
671    0xC7, 0xA1, 0xBA, 0xD1, 0xEE, 0xBA, 0xA9, 0x4B, 0xAF, 0x20, 0xFA, 0xF6, 0x6A, 0xA4, 0xDC, 0xB8,
672]);
673
674#[derive(Debug, Clone, Copy)]
675#[repr(C)]
676pub struct AnonObjectHeaderBigobj {
677    /* same as ANON_OBJECT_HEADER_V2 */
678    /// Must be IMAGE_FILE_MACHINE_UNKNOWN
679    pub sig1: U16<LE>,
680    /// Must be 0xffff
681    pub sig2: U16<LE>,
682    /// >= 2 (implies the Flags field is present)
683    pub version: U16<LE>,
684    /// Actual machine - IMAGE_FILE_MACHINE_xxx
685    pub machine: U16<LE>,
686    pub time_date_stamp: U32<LE>,
687    /// Must be `ANON_OBJECT_HEADER_BIGOBJ_CLASS_ID`.
688    pub class_id: ClsId,
689    /// Size of data that follows the header
690    pub size_of_data: U32<LE>,
691    /// 0x1 -> contains metadata
692    pub flags: U32<LE>,
693    /// Size of CLR metadata
694    pub meta_data_size: U32<LE>,
695    /// Offset of CLR metadata
696    pub meta_data_offset: U32<LE>,
697
698    /* bigobj specifics */
699    /// extended from WORD
700    pub number_of_sections: U32<LE>,
701    pub pointer_to_symbol_table: U32<LE>,
702    pub number_of_symbols: U32<LE>,
703}
704
705pub const IMAGE_SIZEOF_SHORT_NAME: usize = 8;
706
707//
708// Section header format.
709//
710
711#[derive(Debug, Default, Clone, Copy)]
712#[repr(C)]
713pub struct ImageSectionHeader {
714    pub name: [u8; IMAGE_SIZEOF_SHORT_NAME],
715    pub virtual_size: U32<LE>,
716    pub virtual_address: U32<LE>,
717    pub size_of_raw_data: U32<LE>,
718    pub pointer_to_raw_data: U32<LE>,
719    pub pointer_to_relocations: U32<LE>,
720    pub pointer_to_linenumbers: U32<LE>,
721    pub number_of_relocations: U16<LE>,
722    pub number_of_linenumbers: U16<LE>,
723    pub characteristics: U32<LE>,
724}
725
726pub const IMAGE_SIZEOF_SECTION_HEADER: usize = 40;
727
728// Values for `ImageSectionHeader::characteristics`.
729
730//      IMAGE_SCN_TYPE_REG                   0x00000000  // Reserved.
731//      IMAGE_SCN_TYPE_DSECT                 0x00000001  // Reserved.
732//      IMAGE_SCN_TYPE_NOLOAD                0x00000002  // Reserved.
733//      IMAGE_SCN_TYPE_GROUP                 0x00000004  // Reserved.
734/// Reserved.
735pub const IMAGE_SCN_TYPE_NO_PAD: u32 = 0x0000_0008;
736//      IMAGE_SCN_TYPE_COPY                  0x00000010  // Reserved.
737
738/// Section contains code.
739pub const IMAGE_SCN_CNT_CODE: u32 = 0x0000_0020;
740/// Section contains initialized data.
741pub const IMAGE_SCN_CNT_INITIALIZED_DATA: u32 = 0x0000_0040;
742/// Section contains uninitialized data.
743pub const IMAGE_SCN_CNT_UNINITIALIZED_DATA: u32 = 0x0000_0080;
744
745/// Reserved.
746pub const IMAGE_SCN_LNK_OTHER: u32 = 0x0000_0100;
747/// Section contains comments or some other type of information.
748pub const IMAGE_SCN_LNK_INFO: u32 = 0x0000_0200;
749//      IMAGE_SCN_TYPE_OVER                  0x00000400  // Reserved.
750/// Section contents will not become part of image.
751pub const IMAGE_SCN_LNK_REMOVE: u32 = 0x0000_0800;
752/// Section contents comdat.
753pub const IMAGE_SCN_LNK_COMDAT: u32 = 0x0000_1000;
754//                                           0x00002000  // Reserved.
755//      IMAGE_SCN_MEM_PROTECTED - Obsolete   0x00004000
756/// Reset speculative exceptions handling bits in the TLB entries for this section.
757pub const IMAGE_SCN_NO_DEFER_SPEC_EXC: u32 = 0x0000_4000;
758/// Section content can be accessed relative to GP
759pub const IMAGE_SCN_GPREL: u32 = 0x0000_8000;
760pub const IMAGE_SCN_MEM_FARDATA: u32 = 0x0000_8000;
761//      IMAGE_SCN_MEM_SYSHEAP  - Obsolete    0x00010000
762pub const IMAGE_SCN_MEM_PURGEABLE: u32 = 0x0002_0000;
763pub const IMAGE_SCN_MEM_16BIT: u32 = 0x0002_0000;
764pub const IMAGE_SCN_MEM_LOCKED: u32 = 0x0004_0000;
765pub const IMAGE_SCN_MEM_PRELOAD: u32 = 0x0008_0000;
766
767pub const IMAGE_SCN_ALIGN_1BYTES: u32 = 0x0010_0000;
768pub const IMAGE_SCN_ALIGN_2BYTES: u32 = 0x0020_0000;
769pub const IMAGE_SCN_ALIGN_4BYTES: u32 = 0x0030_0000;
770pub const IMAGE_SCN_ALIGN_8BYTES: u32 = 0x0040_0000;
771/// Default alignment if no others are specified.
772pub const IMAGE_SCN_ALIGN_16BYTES: u32 = 0x0050_0000;
773pub const IMAGE_SCN_ALIGN_32BYTES: u32 = 0x0060_0000;
774pub const IMAGE_SCN_ALIGN_64BYTES: u32 = 0x0070_0000;
775pub const IMAGE_SCN_ALIGN_128BYTES: u32 = 0x0080_0000;
776pub const IMAGE_SCN_ALIGN_256BYTES: u32 = 0x0090_0000;
777pub const IMAGE_SCN_ALIGN_512BYTES: u32 = 0x00A0_0000;
778pub const IMAGE_SCN_ALIGN_1024BYTES: u32 = 0x00B0_0000;
779pub const IMAGE_SCN_ALIGN_2048BYTES: u32 = 0x00C0_0000;
780pub const IMAGE_SCN_ALIGN_4096BYTES: u32 = 0x00D0_0000;
781pub const IMAGE_SCN_ALIGN_8192BYTES: u32 = 0x00E0_0000;
782// Unused                                    0x00F0_0000
783pub const IMAGE_SCN_ALIGN_MASK: u32 = 0x00F0_0000;
784
785/// Section contains extended relocations.
786pub const IMAGE_SCN_LNK_NRELOC_OVFL: u32 = 0x0100_0000;
787/// Section can be discarded.
788pub const IMAGE_SCN_MEM_DISCARDABLE: u32 = 0x0200_0000;
789/// Section is not cacheable.
790pub const IMAGE_SCN_MEM_NOT_CACHED: u32 = 0x0400_0000;
791/// Section is not pageable.
792pub const IMAGE_SCN_MEM_NOT_PAGED: u32 = 0x0800_0000;
793/// Section is shareable.
794pub const IMAGE_SCN_MEM_SHARED: u32 = 0x1000_0000;
795/// Section is executable.
796pub const IMAGE_SCN_MEM_EXECUTE: u32 = 0x2000_0000;
797/// Section is readable.
798pub const IMAGE_SCN_MEM_READ: u32 = 0x4000_0000;
799/// Section is writeable.
800pub const IMAGE_SCN_MEM_WRITE: u32 = 0x8000_0000;
801
802//
803// TLS Characteristic Flags
804//
805/// Tls index is scaled
806pub const IMAGE_SCN_SCALE_INDEX: u32 = 0x0000_0001;
807
808//
809// Symbol format.
810//
811
812// This struct has alignment 1.
813#[derive(Debug, Clone, Copy)]
814#[repr(C)]
815pub struct ImageSymbol {
816    /// If first 4 bytes are 0, then second 4 bytes are offset into string table.
817    pub name: [u8; 8],
818    pub value: U32Bytes<LE>,
819    pub section_number: U16Bytes<LE>,
820    pub typ: U16Bytes<LE>,
821    pub storage_class: u8,
822    pub number_of_aux_symbols: u8,
823}
824
825pub const IMAGE_SIZEOF_SYMBOL: usize = 18;
826
827#[derive(Debug, Clone, Copy)]
828#[repr(C)]
829pub struct ImageSymbolBytes(pub [u8; IMAGE_SIZEOF_SYMBOL]);
830
831// This struct has alignment 1.
832#[derive(Debug, Clone, Copy)]
833#[repr(C)]
834pub struct ImageSymbolEx {
835    /// If first 4 bytes are 0, then second 4 bytes are offset into string table.
836    pub name: [u8; 8],
837    pub value: U32Bytes<LE>,
838    pub section_number: I32Bytes<LE>,
839    pub typ: U16Bytes<LE>,
840    pub storage_class: u8,
841    pub number_of_aux_symbols: u8,
842}
843
844pub const IMAGE_SIZEOF_SYMBOL_EX: usize = 20;
845
846#[derive(Debug, Clone, Copy)]
847#[repr(C)]
848pub struct ImageSymbolExBytes(pub [u8; IMAGE_SIZEOF_SYMBOL_EX]);
849
850// Values for `ImageSymbol::section_number`.
851//
852// Symbols have a section number of the section in which they are
853// defined. Otherwise, section numbers have the following meanings:
854
855/// Symbol is undefined or is common.
856pub const IMAGE_SYM_UNDEFINED: i32 = 0;
857/// Symbol is an absolute value.
858pub const IMAGE_SYM_ABSOLUTE: i32 = -1;
859/// Symbol is a special debug item.
860pub const IMAGE_SYM_DEBUG: i32 = -2;
861/// Values 0xFF00-0xFFFF are special
862pub const IMAGE_SYM_SECTION_MAX: u16 = 0xFEFF;
863pub const IMAGE_SYM_SECTION_MAX_EX: u32 = 0x7fff_ffff;
864
865// Values for `ImageSymbol::typ` (basic component).
866
867/// no type.
868pub const IMAGE_SYM_TYPE_NULL: u16 = 0x0000;
869pub const IMAGE_SYM_TYPE_VOID: u16 = 0x0001;
870/// type character.
871pub const IMAGE_SYM_TYPE_CHAR: u16 = 0x0002;
872/// type short integer.
873pub const IMAGE_SYM_TYPE_SHORT: u16 = 0x0003;
874pub const IMAGE_SYM_TYPE_INT: u16 = 0x0004;
875pub const IMAGE_SYM_TYPE_LONG: u16 = 0x0005;
876pub const IMAGE_SYM_TYPE_FLOAT: u16 = 0x0006;
877pub const IMAGE_SYM_TYPE_DOUBLE: u16 = 0x0007;
878pub const IMAGE_SYM_TYPE_STRUCT: u16 = 0x0008;
879pub const IMAGE_SYM_TYPE_UNION: u16 = 0x0009;
880/// enumeration.
881pub const IMAGE_SYM_TYPE_ENUM: u16 = 0x000A;
882/// member of enumeration.
883pub const IMAGE_SYM_TYPE_MOE: u16 = 0x000B;
884pub const IMAGE_SYM_TYPE_BYTE: u16 = 0x000C;
885pub const IMAGE_SYM_TYPE_WORD: u16 = 0x000D;
886pub const IMAGE_SYM_TYPE_UINT: u16 = 0x000E;
887pub const IMAGE_SYM_TYPE_DWORD: u16 = 0x000F;
888pub const IMAGE_SYM_TYPE_PCODE: u16 = 0x8000;
889
890// Values for `ImageSymbol::typ` (derived component).
891
892/// no derived type.
893pub const IMAGE_SYM_DTYPE_NULL: u16 = 0;
894/// pointer.
895pub const IMAGE_SYM_DTYPE_POINTER: u16 = 1;
896/// function.
897pub const IMAGE_SYM_DTYPE_FUNCTION: u16 = 2;
898/// array.
899pub const IMAGE_SYM_DTYPE_ARRAY: u16 = 3;
900
901// Values for `ImageSymbol::storage_class`.
902pub const IMAGE_SYM_CLASS_END_OF_FUNCTION: u8 = 0xff;
903pub const IMAGE_SYM_CLASS_NULL: u8 = 0x00;
904pub const IMAGE_SYM_CLASS_AUTOMATIC: u8 = 0x01;
905pub const IMAGE_SYM_CLASS_EXTERNAL: u8 = 0x02;
906pub const IMAGE_SYM_CLASS_STATIC: u8 = 0x03;
907pub const IMAGE_SYM_CLASS_REGISTER: u8 = 0x04;
908pub const IMAGE_SYM_CLASS_EXTERNAL_DEF: u8 = 0x05;
909pub const IMAGE_SYM_CLASS_LABEL: u8 = 0x06;
910pub const IMAGE_SYM_CLASS_UNDEFINED_LABEL: u8 = 0x07;
911pub const IMAGE_SYM_CLASS_MEMBER_OF_STRUCT: u8 = 0x08;
912pub const IMAGE_SYM_CLASS_ARGUMENT: u8 = 0x09;
913pub const IMAGE_SYM_CLASS_STRUCT_TAG: u8 = 0x0A;
914pub const IMAGE_SYM_CLASS_MEMBER_OF_UNION: u8 = 0x0B;
915pub const IMAGE_SYM_CLASS_UNION_TAG: u8 = 0x0C;
916pub const IMAGE_SYM_CLASS_TYPE_DEFINITION: u8 = 0x0D;
917pub const IMAGE_SYM_CLASS_UNDEFINED_STATIC: u8 = 0x0E;
918pub const IMAGE_SYM_CLASS_ENUM_TAG: u8 = 0x0F;
919pub const IMAGE_SYM_CLASS_MEMBER_OF_ENUM: u8 = 0x10;
920pub const IMAGE_SYM_CLASS_REGISTER_PARAM: u8 = 0x11;
921pub const IMAGE_SYM_CLASS_BIT_FIELD: u8 = 0x12;
922
923pub const IMAGE_SYM_CLASS_FAR_EXTERNAL: u8 = 0x44;
924
925pub const IMAGE_SYM_CLASS_BLOCK: u8 = 0x64;
926pub const IMAGE_SYM_CLASS_FUNCTION: u8 = 0x65;
927pub const IMAGE_SYM_CLASS_END_OF_STRUCT: u8 = 0x66;
928pub const IMAGE_SYM_CLASS_FILE: u8 = 0x67;
929// new
930pub const IMAGE_SYM_CLASS_SECTION: u8 = 0x68;
931pub const IMAGE_SYM_CLASS_WEAK_EXTERNAL: u8 = 0x69;
932
933pub const IMAGE_SYM_CLASS_CLR_TOKEN: u8 = 0x6B;
934
935// type packing constants
936
937pub const N_BTMASK: u16 = 0x000F;
938pub const N_TMASK: u16 = 0x0030;
939pub const N_TMASK1: u16 = 0x00C0;
940pub const N_TMASK2: u16 = 0x00F0;
941pub const N_BTSHFT: usize = 4;
942pub const N_TSHIFT: usize = 2;
943
944pub const IMAGE_SYM_DTYPE_SHIFT: usize = N_BTSHFT;
945
946//
947// Auxiliary entry format.
948//
949
950// Used for both ImageSymbol and ImageSymbolEx (with padding).
951// This struct has alignment 1.
952#[derive(Debug, Clone, Copy)]
953#[repr(C)]
954pub struct ImageAuxSymbolTokenDef {
955    /// IMAGE_AUX_SYMBOL_TYPE
956    pub aux_type: u8,
957    /// Must be 0
958    pub reserved1: u8,
959    pub symbol_table_index: U32Bytes<LE>,
960    /// Must be 0
961    pub reserved2: [u8; 12],
962}
963
964pub const IMAGE_AUX_SYMBOL_TYPE_TOKEN_DEF: u16 = 1;
965
966/// Auxiliary symbol format 1: function definitions.
967// This struct has alignment 1.
968#[derive(Debug, Clone, Copy)]
969#[repr(C)]
970pub struct ImageAuxSymbolFunction {
971    pub tag_index: U32Bytes<LE>,
972    pub total_size: U32Bytes<LE>,
973    pub pointer_to_linenumber: U32Bytes<LE>,
974    pub pointer_to_next_function: U32Bytes<LE>,
975    pub unused: [u8; 2],
976}
977
978/// Auxiliary symbol format 2: .bf and .ef symbols.
979// This struct has alignment 1.
980#[derive(Debug, Clone, Copy)]
981#[repr(C)]
982pub struct ImageAuxSymbolFunctionBeginEnd {
983    pub unused1: [u8; 4],
984    /// declaration line number
985    pub linenumber: U16Bytes<LE>,
986    pub unused2: [u8; 6],
987    pub pointer_to_next_function: U32Bytes<LE>,
988    pub unused3: [u8; 2],
989}
990
991/// Auxiliary symbol format 3: weak externals.
992///
993/// Used for both `ImageSymbol` and `ImageSymbolEx` (both with padding).
994// This struct has alignment 1.
995#[derive(Debug, Clone, Copy)]
996#[repr(C)]
997pub struct ImageAuxSymbolWeak {
998    /// the weak extern default symbol index
999    pub weak_default_sym_index: U32Bytes<LE>,
1000    pub weak_search_type: U32Bytes<LE>,
1001}
1002
1003/// Auxiliary symbol format 5: sections.
1004///
1005/// Used for both `ImageSymbol` and `ImageSymbolEx` (with padding).
1006// This struct has alignment 1.
1007#[derive(Debug, Clone, Copy)]
1008#[repr(C)]
1009pub struct ImageAuxSymbolSection {
1010    /// section length
1011    pub length: U32Bytes<LE>,
1012    /// number of relocation entries
1013    pub number_of_relocations: U16Bytes<LE>,
1014    /// number of line numbers
1015    pub number_of_linenumbers: U16Bytes<LE>,
1016    /// checksum for communal
1017    pub check_sum: U32Bytes<LE>,
1018    /// section number to associate with
1019    pub number: U16Bytes<LE>,
1020    /// communal selection type
1021    pub selection: u8,
1022    pub reserved: u8,
1023    /// high bits of the section number
1024    pub high_number: U16Bytes<LE>,
1025}
1026
1027// Used for both ImageSymbol and ImageSymbolEx (both with padding).
1028// This struct has alignment 1.
1029#[derive(Debug, Clone, Copy)]
1030#[repr(C)]
1031pub struct ImageAuxSymbolCrc {
1032    pub crc: U32Bytes<LE>,
1033}
1034
1035//
1036// Communal selection types.
1037//
1038
1039pub const IMAGE_COMDAT_SELECT_NODUPLICATES: u8 = 1;
1040pub const IMAGE_COMDAT_SELECT_ANY: u8 = 2;
1041pub const IMAGE_COMDAT_SELECT_SAME_SIZE: u8 = 3;
1042pub const IMAGE_COMDAT_SELECT_EXACT_MATCH: u8 = 4;
1043pub const IMAGE_COMDAT_SELECT_ASSOCIATIVE: u8 = 5;
1044pub const IMAGE_COMDAT_SELECT_LARGEST: u8 = 6;
1045pub const IMAGE_COMDAT_SELECT_NEWEST: u8 = 7;
1046
1047pub const IMAGE_WEAK_EXTERN_SEARCH_NOLIBRARY: u16 = 1;
1048pub const IMAGE_WEAK_EXTERN_SEARCH_LIBRARY: u16 = 2;
1049pub const IMAGE_WEAK_EXTERN_SEARCH_ALIAS: u16 = 3;
1050pub const IMAGE_WEAK_EXTERN_ANTI_DEPENDENCY: u16 = 4;
1051
1052//
1053// Relocation format.
1054//
1055
1056// This struct has alignment 1.
1057#[derive(Debug, Clone, Copy)]
1058#[repr(C)]
1059pub struct ImageRelocation {
1060    /// Also `RelocCount` when IMAGE_SCN_LNK_NRELOC_OVFL is set
1061    pub virtual_address: U32Bytes<LE>,
1062    pub symbol_table_index: U32Bytes<LE>,
1063    pub typ: U16Bytes<LE>,
1064}
1065
1066//
1067// I386 relocation types.
1068//
1069/// Reference is absolute, no relocation is necessary
1070pub const IMAGE_REL_I386_ABSOLUTE: u16 = 0x0000;
1071/// Direct 16-bit reference to the symbols virtual address
1072pub const IMAGE_REL_I386_DIR16: u16 = 0x0001;
1073/// PC-relative 16-bit reference to the symbols virtual address
1074pub const IMAGE_REL_I386_REL16: u16 = 0x0002;
1075/// Direct 32-bit reference to the symbols virtual address
1076pub const IMAGE_REL_I386_DIR32: u16 = 0x0006;
1077/// Direct 32-bit reference to the symbols virtual address, base not included
1078pub const IMAGE_REL_I386_DIR32NB: u16 = 0x0007;
1079/// Direct 16-bit reference to the segment-selector bits of a 32-bit virtual address
1080pub const IMAGE_REL_I386_SEG12: u16 = 0x0009;
1081pub const IMAGE_REL_I386_SECTION: u16 = 0x000A;
1082pub const IMAGE_REL_I386_SECREL: u16 = 0x000B;
1083/// clr token
1084pub const IMAGE_REL_I386_TOKEN: u16 = 0x000C;
1085/// 7 bit offset from base of section containing target
1086pub const IMAGE_REL_I386_SECREL7: u16 = 0x000D;
1087/// PC-relative 32-bit reference to the symbols virtual address
1088pub const IMAGE_REL_I386_REL32: u16 = 0x0014;
1089
1090//
1091// MIPS relocation types.
1092//
1093/// Reference is absolute, no relocation is necessary
1094pub const IMAGE_REL_MIPS_ABSOLUTE: u16 = 0x0000;
1095pub const IMAGE_REL_MIPS_REFHALF: u16 = 0x0001;
1096pub const IMAGE_REL_MIPS_REFWORD: u16 = 0x0002;
1097pub const IMAGE_REL_MIPS_JMPADDR: u16 = 0x0003;
1098pub const IMAGE_REL_MIPS_REFHI: u16 = 0x0004;
1099pub const IMAGE_REL_MIPS_REFLO: u16 = 0x0005;
1100pub const IMAGE_REL_MIPS_GPREL: u16 = 0x0006;
1101pub const IMAGE_REL_MIPS_LITERAL: u16 = 0x0007;
1102pub const IMAGE_REL_MIPS_SECTION: u16 = 0x000A;
1103pub const IMAGE_REL_MIPS_SECREL: u16 = 0x000B;
1104/// Low 16-bit section relative reference (used for >32k TLS)
1105pub const IMAGE_REL_MIPS_SECRELLO: u16 = 0x000C;
1106/// High 16-bit section relative reference (used for >32k TLS)
1107pub const IMAGE_REL_MIPS_SECRELHI: u16 = 0x000D;
1108/// clr token
1109pub const IMAGE_REL_MIPS_TOKEN: u16 = 0x000E;
1110pub const IMAGE_REL_MIPS_JMPADDR16: u16 = 0x0010;
1111pub const IMAGE_REL_MIPS_REFWORDNB: u16 = 0x0022;
1112pub const IMAGE_REL_MIPS_PAIR: u16 = 0x0025;
1113
1114//
1115// Alpha Relocation types.
1116//
1117pub const IMAGE_REL_ALPHA_ABSOLUTE: u16 = 0x0000;
1118pub const IMAGE_REL_ALPHA_REFLONG: u16 = 0x0001;
1119pub const IMAGE_REL_ALPHA_REFQUAD: u16 = 0x0002;
1120pub const IMAGE_REL_ALPHA_GPREL32: u16 = 0x0003;
1121pub const IMAGE_REL_ALPHA_LITERAL: u16 = 0x0004;
1122pub const IMAGE_REL_ALPHA_LITUSE: u16 = 0x0005;
1123pub const IMAGE_REL_ALPHA_GPDISP: u16 = 0x0006;
1124pub const IMAGE_REL_ALPHA_BRADDR: u16 = 0x0007;
1125pub const IMAGE_REL_ALPHA_HINT: u16 = 0x0008;
1126pub const IMAGE_REL_ALPHA_INLINE_REFLONG: u16 = 0x0009;
1127pub const IMAGE_REL_ALPHA_REFHI: u16 = 0x000A;
1128pub const IMAGE_REL_ALPHA_REFLO: u16 = 0x000B;
1129pub const IMAGE_REL_ALPHA_PAIR: u16 = 0x000C;
1130pub const IMAGE_REL_ALPHA_MATCH: u16 = 0x000D;
1131pub const IMAGE_REL_ALPHA_SECTION: u16 = 0x000E;
1132pub const IMAGE_REL_ALPHA_SECREL: u16 = 0x000F;
1133pub const IMAGE_REL_ALPHA_REFLONGNB: u16 = 0x0010;
1134/// Low 16-bit section relative reference
1135pub const IMAGE_REL_ALPHA_SECRELLO: u16 = 0x0011;
1136/// High 16-bit section relative reference
1137pub const IMAGE_REL_ALPHA_SECRELHI: u16 = 0x0012;
1138/// High 16 bits of 48 bit reference
1139pub const IMAGE_REL_ALPHA_REFQ3: u16 = 0x0013;
1140/// Middle 16 bits of 48 bit reference
1141pub const IMAGE_REL_ALPHA_REFQ2: u16 = 0x0014;
1142/// Low 16 bits of 48 bit reference
1143pub const IMAGE_REL_ALPHA_REFQ1: u16 = 0x0015;
1144/// Low 16-bit GP relative reference
1145pub const IMAGE_REL_ALPHA_GPRELLO: u16 = 0x0016;
1146/// High 16-bit GP relative reference
1147pub const IMAGE_REL_ALPHA_GPRELHI: u16 = 0x0017;
1148
1149//
1150// IBM PowerPC relocation types.
1151//
1152/// NOP
1153pub const IMAGE_REL_PPC_ABSOLUTE: u16 = 0x0000;
1154/// 64-bit address
1155pub const IMAGE_REL_PPC_ADDR64: u16 = 0x0001;
1156/// 32-bit address
1157pub const IMAGE_REL_PPC_ADDR32: u16 = 0x0002;
1158/// 26-bit address, shifted left 2 (branch absolute)
1159pub const IMAGE_REL_PPC_ADDR24: u16 = 0x0003;
1160/// 16-bit address
1161pub const IMAGE_REL_PPC_ADDR16: u16 = 0x0004;
1162/// 16-bit address, shifted left 2 (load doubleword)
1163pub const IMAGE_REL_PPC_ADDR14: u16 = 0x0005;
1164/// 26-bit PC-relative offset, shifted left 2 (branch relative)
1165pub const IMAGE_REL_PPC_REL24: u16 = 0x0006;
1166/// 16-bit PC-relative offset, shifted left 2 (br cond relative)
1167pub const IMAGE_REL_PPC_REL14: u16 = 0x0007;
1168/// 16-bit offset from TOC base
1169pub const IMAGE_REL_PPC_TOCREL16: u16 = 0x0008;
1170/// 16-bit offset from TOC base, shifted left 2 (load doubleword)
1171pub const IMAGE_REL_PPC_TOCREL14: u16 = 0x0009;
1172
1173/// 32-bit addr w/o image base
1174pub const IMAGE_REL_PPC_ADDR32NB: u16 = 0x000A;
1175/// va of containing section (as in an image sectionhdr)
1176pub const IMAGE_REL_PPC_SECREL: u16 = 0x000B;
1177/// sectionheader number
1178pub const IMAGE_REL_PPC_SECTION: u16 = 0x000C;
1179/// substitute TOC restore instruction iff symbol is glue code
1180pub const IMAGE_REL_PPC_IFGLUE: u16 = 0x000D;
1181/// symbol is glue code; virtual address is TOC restore instruction
1182pub const IMAGE_REL_PPC_IMGLUE: u16 = 0x000E;
1183/// va of containing section (limited to 16 bits)
1184pub const IMAGE_REL_PPC_SECREL16: u16 = 0x000F;
1185pub const IMAGE_REL_PPC_REFHI: u16 = 0x0010;
1186pub const IMAGE_REL_PPC_REFLO: u16 = 0x0011;
1187pub const IMAGE_REL_PPC_PAIR: u16 = 0x0012;
1188/// Low 16-bit section relative reference (used for >32k TLS)
1189pub const IMAGE_REL_PPC_SECRELLO: u16 = 0x0013;
1190/// High 16-bit section relative reference (used for >32k TLS)
1191pub const IMAGE_REL_PPC_SECRELHI: u16 = 0x0014;
1192pub const IMAGE_REL_PPC_GPREL: u16 = 0x0015;
1193/// clr token
1194pub const IMAGE_REL_PPC_TOKEN: u16 = 0x0016;
1195
1196/// mask to isolate above values in IMAGE_RELOCATION.Type
1197pub const IMAGE_REL_PPC_TYPEMASK: u16 = 0x00FF;
1198
1199// Flag bits in `ImageRelocation::typ`.
1200
1201/// subtract reloc value rather than adding it
1202pub const IMAGE_REL_PPC_NEG: u16 = 0x0100;
1203/// fix branch prediction bit to predict branch taken
1204pub const IMAGE_REL_PPC_BRTAKEN: u16 = 0x0200;
1205/// fix branch prediction bit to predict branch not taken
1206pub const IMAGE_REL_PPC_BRNTAKEN: u16 = 0x0400;
1207/// toc slot defined in file (or, data in toc)
1208pub const IMAGE_REL_PPC_TOCDEFN: u16 = 0x0800;
1209
1210//
1211// Hitachi SH3 relocation types.
1212//
1213/// No relocation
1214pub const IMAGE_REL_SH3_ABSOLUTE: u16 = 0x0000;
1215/// 16 bit direct
1216pub const IMAGE_REL_SH3_DIRECT16: u16 = 0x0001;
1217/// 32 bit direct
1218pub const IMAGE_REL_SH3_DIRECT32: u16 = 0x0002;
1219/// 8 bit direct, -128..255
1220pub const IMAGE_REL_SH3_DIRECT8: u16 = 0x0003;
1221/// 8 bit direct .W (0 ext.)
1222pub const IMAGE_REL_SH3_DIRECT8_WORD: u16 = 0x0004;
1223/// 8 bit direct .L (0 ext.)
1224pub const IMAGE_REL_SH3_DIRECT8_LONG: u16 = 0x0005;
1225/// 4 bit direct (0 ext.)
1226pub const IMAGE_REL_SH3_DIRECT4: u16 = 0x0006;
1227/// 4 bit direct .W (0 ext.)
1228pub const IMAGE_REL_SH3_DIRECT4_WORD: u16 = 0x0007;
1229/// 4 bit direct .L (0 ext.)
1230pub const IMAGE_REL_SH3_DIRECT4_LONG: u16 = 0x0008;
1231/// 8 bit PC relative .W
1232pub const IMAGE_REL_SH3_PCREL8_WORD: u16 = 0x0009;
1233/// 8 bit PC relative .L
1234pub const IMAGE_REL_SH3_PCREL8_LONG: u16 = 0x000A;
1235/// 12 LSB PC relative .W
1236pub const IMAGE_REL_SH3_PCREL12_WORD: u16 = 0x000B;
1237/// Start of EXE section
1238pub const IMAGE_REL_SH3_STARTOF_SECTION: u16 = 0x000C;
1239/// Size of EXE section
1240pub const IMAGE_REL_SH3_SIZEOF_SECTION: u16 = 0x000D;
1241/// Section table index
1242pub const IMAGE_REL_SH3_SECTION: u16 = 0x000E;
1243/// Offset within section
1244pub const IMAGE_REL_SH3_SECREL: u16 = 0x000F;
1245/// 32 bit direct not based
1246pub const IMAGE_REL_SH3_DIRECT32_NB: u16 = 0x0010;
1247/// GP-relative addressing
1248pub const IMAGE_REL_SH3_GPREL4_LONG: u16 = 0x0011;
1249/// clr token
1250pub const IMAGE_REL_SH3_TOKEN: u16 = 0x0012;
1251/// Offset from current instruction in longwords
1252/// if not NOMODE, insert the inverse of the low bit at bit 32 to select PTA/PTB
1253pub const IMAGE_REL_SHM_PCRELPT: u16 = 0x0013;
1254/// Low bits of 32-bit address
1255pub const IMAGE_REL_SHM_REFLO: u16 = 0x0014;
1256/// High bits of 32-bit address
1257pub const IMAGE_REL_SHM_REFHALF: u16 = 0x0015;
1258/// Low bits of relative reference
1259pub const IMAGE_REL_SHM_RELLO: u16 = 0x0016;
1260/// High bits of relative reference
1261pub const IMAGE_REL_SHM_RELHALF: u16 = 0x0017;
1262/// offset operand for relocation
1263pub const IMAGE_REL_SHM_PAIR: u16 = 0x0018;
1264
1265/// relocation ignores section mode
1266pub const IMAGE_REL_SH_NOMODE: u16 = 0x8000;
1267
1268/// No relocation required
1269pub const IMAGE_REL_ARM_ABSOLUTE: u16 = 0x0000;
1270/// 32 bit address
1271pub const IMAGE_REL_ARM_ADDR32: u16 = 0x0001;
1272/// 32 bit address w/o image base
1273pub const IMAGE_REL_ARM_ADDR32NB: u16 = 0x0002;
1274/// 24 bit offset << 2 & sign ext.
1275pub const IMAGE_REL_ARM_BRANCH24: u16 = 0x0003;
1276/// Thumb: 2 11 bit offsets
1277pub const IMAGE_REL_ARM_BRANCH11: u16 = 0x0004;
1278/// clr token
1279pub const IMAGE_REL_ARM_TOKEN: u16 = 0x0005;
1280/// GP-relative addressing (ARM)
1281pub const IMAGE_REL_ARM_GPREL12: u16 = 0x0006;
1282/// GP-relative addressing (Thumb)
1283pub const IMAGE_REL_ARM_GPREL7: u16 = 0x0007;
1284pub const IMAGE_REL_ARM_BLX24: u16 = 0x0008;
1285pub const IMAGE_REL_ARM_BLX11: u16 = 0x0009;
1286/// 32-bit relative address from byte following reloc
1287pub const IMAGE_REL_ARM_REL32: u16 = 0x000A;
1288/// Section table index
1289pub const IMAGE_REL_ARM_SECTION: u16 = 0x000E;
1290/// Offset within section
1291pub const IMAGE_REL_ARM_SECREL: u16 = 0x000F;
1292/// ARM: MOVW/MOVT
1293pub const IMAGE_REL_ARM_MOV32A: u16 = 0x0010;
1294/// ARM: MOVW/MOVT (deprecated)
1295pub const IMAGE_REL_ARM_MOV32: u16 = 0x0010;
1296/// Thumb: MOVW/MOVT
1297pub const IMAGE_REL_ARM_MOV32T: u16 = 0x0011;
1298/// Thumb: MOVW/MOVT (deprecated)
1299pub const IMAGE_REL_THUMB_MOV32: u16 = 0x0011;
1300/// Thumb: 32-bit conditional B
1301pub const IMAGE_REL_ARM_BRANCH20T: u16 = 0x0012;
1302/// Thumb: 32-bit conditional B (deprecated)
1303pub const IMAGE_REL_THUMB_BRANCH20: u16 = 0x0012;
1304/// Thumb: 32-bit B or BL
1305pub const IMAGE_REL_ARM_BRANCH24T: u16 = 0x0014;
1306/// Thumb: 32-bit B or BL (deprecated)
1307pub const IMAGE_REL_THUMB_BRANCH24: u16 = 0x0014;
1308/// Thumb: BLX immediate
1309pub const IMAGE_REL_ARM_BLX23T: u16 = 0x0015;
1310/// Thumb: BLX immediate (deprecated)
1311pub const IMAGE_REL_THUMB_BLX23: u16 = 0x0015;
1312
1313pub const IMAGE_REL_AM_ABSOLUTE: u16 = 0x0000;
1314pub const IMAGE_REL_AM_ADDR32: u16 = 0x0001;
1315pub const IMAGE_REL_AM_ADDR32NB: u16 = 0x0002;
1316pub const IMAGE_REL_AM_CALL32: u16 = 0x0003;
1317pub const IMAGE_REL_AM_FUNCINFO: u16 = 0x0004;
1318pub const IMAGE_REL_AM_REL32_1: u16 = 0x0005;
1319pub const IMAGE_REL_AM_REL32_2: u16 = 0x0006;
1320pub const IMAGE_REL_AM_SECREL: u16 = 0x0007;
1321pub const IMAGE_REL_AM_SECTION: u16 = 0x0008;
1322pub const IMAGE_REL_AM_TOKEN: u16 = 0x0009;
1323
1324//
1325// ARM64 relocations types.
1326//
1327
1328/// No relocation required
1329pub const IMAGE_REL_ARM64_ABSOLUTE: u16 = 0x0000;
1330/// 32 bit address. Review! do we need it?
1331pub const IMAGE_REL_ARM64_ADDR32: u16 = 0x0001;
1332/// 32 bit address w/o image base (RVA: for Data/PData/XData)
1333pub const IMAGE_REL_ARM64_ADDR32NB: u16 = 0x0002;
1334/// 26 bit offset << 2 & sign ext. for B & BL
1335pub const IMAGE_REL_ARM64_BRANCH26: u16 = 0x0003;
1336/// ADRP
1337pub const IMAGE_REL_ARM64_PAGEBASE_REL21: u16 = 0x0004;
1338/// ADR
1339pub const IMAGE_REL_ARM64_REL21: u16 = 0x0005;
1340/// ADD/ADDS (immediate) with zero shift, for page offset
1341pub const IMAGE_REL_ARM64_PAGEOFFSET_12A: u16 = 0x0006;
1342/// LDR (indexed, unsigned immediate), for page offset
1343pub const IMAGE_REL_ARM64_PAGEOFFSET_12L: u16 = 0x0007;
1344/// Offset within section
1345pub const IMAGE_REL_ARM64_SECREL: u16 = 0x0008;
1346/// ADD/ADDS (immediate) with zero shift, for bit 0:11 of section offset
1347pub const IMAGE_REL_ARM64_SECREL_LOW12A: u16 = 0x0009;
1348/// ADD/ADDS (immediate) with zero shift, for bit 12:23 of section offset
1349pub const IMAGE_REL_ARM64_SECREL_HIGH12A: u16 = 0x000A;
1350/// LDR (indexed, unsigned immediate), for bit 0:11 of section offset
1351pub const IMAGE_REL_ARM64_SECREL_LOW12L: u16 = 0x000B;
1352pub const IMAGE_REL_ARM64_TOKEN: u16 = 0x000C;
1353/// Section table index
1354pub const IMAGE_REL_ARM64_SECTION: u16 = 0x000D;
1355/// 64 bit address
1356pub const IMAGE_REL_ARM64_ADDR64: u16 = 0x000E;
1357/// 19 bit offset << 2 & sign ext. for conditional B
1358pub const IMAGE_REL_ARM64_BRANCH19: u16 = 0x000F;
1359/// TBZ/TBNZ
1360pub const IMAGE_REL_ARM64_BRANCH14: u16 = 0x0010;
1361/// 32-bit relative address from byte following reloc
1362pub const IMAGE_REL_ARM64_REL32: u16 = 0x0011;
1363
1364//
1365// x64 relocations
1366//
1367/// Reference is absolute, no relocation is necessary
1368pub const IMAGE_REL_AMD64_ABSOLUTE: u16 = 0x0000;
1369/// 64-bit address (VA).
1370pub const IMAGE_REL_AMD64_ADDR64: u16 = 0x0001;
1371/// 32-bit address (VA).
1372pub const IMAGE_REL_AMD64_ADDR32: u16 = 0x0002;
1373/// 32-bit address w/o image base (RVA).
1374pub const IMAGE_REL_AMD64_ADDR32NB: u16 = 0x0003;
1375/// 32-bit relative address from byte following reloc
1376pub const IMAGE_REL_AMD64_REL32: u16 = 0x0004;
1377/// 32-bit relative address from byte distance 1 from reloc
1378pub const IMAGE_REL_AMD64_REL32_1: u16 = 0x0005;
1379/// 32-bit relative address from byte distance 2 from reloc
1380pub const IMAGE_REL_AMD64_REL32_2: u16 = 0x0006;
1381/// 32-bit relative address from byte distance 3 from reloc
1382pub const IMAGE_REL_AMD64_REL32_3: u16 = 0x0007;
1383/// 32-bit relative address from byte distance 4 from reloc
1384pub const IMAGE_REL_AMD64_REL32_4: u16 = 0x0008;
1385/// 32-bit relative address from byte distance 5 from reloc
1386pub const IMAGE_REL_AMD64_REL32_5: u16 = 0x0009;
1387/// Section index
1388pub const IMAGE_REL_AMD64_SECTION: u16 = 0x000A;
1389/// 32 bit offset from base of section containing target
1390pub const IMAGE_REL_AMD64_SECREL: u16 = 0x000B;
1391/// 7 bit unsigned offset from base of section containing target
1392pub const IMAGE_REL_AMD64_SECREL7: u16 = 0x000C;
1393/// 32 bit metadata token
1394pub const IMAGE_REL_AMD64_TOKEN: u16 = 0x000D;
1395/// 32 bit signed span-dependent value emitted into object
1396pub const IMAGE_REL_AMD64_SREL32: u16 = 0x000E;
1397pub const IMAGE_REL_AMD64_PAIR: u16 = 0x000F;
1398/// 32 bit signed span-dependent value applied at link time
1399pub const IMAGE_REL_AMD64_SSPAN32: u16 = 0x0010;
1400pub const IMAGE_REL_AMD64_EHANDLER: u16 = 0x0011;
1401/// Indirect branch to an import
1402pub const IMAGE_REL_AMD64_IMPORT_BR: u16 = 0x0012;
1403/// Indirect call to an import
1404pub const IMAGE_REL_AMD64_IMPORT_CALL: u16 = 0x0013;
1405/// Indirect branch to a CFG check
1406pub const IMAGE_REL_AMD64_CFG_BR: u16 = 0x0014;
1407/// Indirect branch to a CFG check, with REX.W prefix
1408pub const IMAGE_REL_AMD64_CFG_BR_REX: u16 = 0x0015;
1409/// Indirect call to a CFG check
1410pub const IMAGE_REL_AMD64_CFG_CALL: u16 = 0x0016;
1411/// Indirect branch to a target in RAX (no CFG)
1412pub const IMAGE_REL_AMD64_INDIR_BR: u16 = 0x0017;
1413/// Indirect branch to a target in RAX, with REX.W prefix (no CFG)
1414pub const IMAGE_REL_AMD64_INDIR_BR_REX: u16 = 0x0018;
1415/// Indirect call to a target in RAX (no CFG)
1416pub const IMAGE_REL_AMD64_INDIR_CALL: u16 = 0x0019;
1417/// Indirect branch for a switch table using Reg 0 (RAX)
1418pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_FIRST: u16 = 0x0020;
1419/// Indirect branch for a switch table using Reg 15 (R15)
1420pub const IMAGE_REL_AMD64_INDIR_BR_SWITCHTABLE_LAST: u16 = 0x002F;
1421
1422//
1423// IA64 relocation types.
1424//
1425pub const IMAGE_REL_IA64_ABSOLUTE: u16 = 0x0000;
1426pub const IMAGE_REL_IA64_IMM14: u16 = 0x0001;
1427pub const IMAGE_REL_IA64_IMM22: u16 = 0x0002;
1428pub const IMAGE_REL_IA64_IMM64: u16 = 0x0003;
1429pub const IMAGE_REL_IA64_DIR32: u16 = 0x0004;
1430pub const IMAGE_REL_IA64_DIR64: u16 = 0x0005;
1431pub const IMAGE_REL_IA64_PCREL21B: u16 = 0x0006;
1432pub const IMAGE_REL_IA64_PCREL21M: u16 = 0x0007;
1433pub const IMAGE_REL_IA64_PCREL21F: u16 = 0x0008;
1434pub const IMAGE_REL_IA64_GPREL22: u16 = 0x0009;
1435pub const IMAGE_REL_IA64_LTOFF22: u16 = 0x000A;
1436pub const IMAGE_REL_IA64_SECTION: u16 = 0x000B;
1437pub const IMAGE_REL_IA64_SECREL22: u16 = 0x000C;
1438pub const IMAGE_REL_IA64_SECREL64I: u16 = 0x000D;
1439pub const IMAGE_REL_IA64_SECREL32: u16 = 0x000E;
1440//
1441pub const IMAGE_REL_IA64_DIR32NB: u16 = 0x0010;
1442pub const IMAGE_REL_IA64_SREL14: u16 = 0x0011;
1443pub const IMAGE_REL_IA64_SREL22: u16 = 0x0012;
1444pub const IMAGE_REL_IA64_SREL32: u16 = 0x0013;
1445pub const IMAGE_REL_IA64_UREL32: u16 = 0x0014;
1446/// This is always a BRL and never converted
1447pub const IMAGE_REL_IA64_PCREL60X: u16 = 0x0015;
1448/// If possible, convert to MBB bundle with NOP.B in slot 1
1449pub const IMAGE_REL_IA64_PCREL60B: u16 = 0x0016;
1450/// If possible, convert to MFB bundle with NOP.F in slot 1
1451pub const IMAGE_REL_IA64_PCREL60F: u16 = 0x0017;
1452/// If possible, convert to MIB bundle with NOP.I in slot 1
1453pub const IMAGE_REL_IA64_PCREL60I: u16 = 0x0018;
1454/// If possible, convert to MMB bundle with NOP.M in slot 1
1455pub const IMAGE_REL_IA64_PCREL60M: u16 = 0x0019;
1456pub const IMAGE_REL_IA64_IMMGPREL64: u16 = 0x001A;
1457/// clr token
1458pub const IMAGE_REL_IA64_TOKEN: u16 = 0x001B;
1459pub const IMAGE_REL_IA64_GPREL32: u16 = 0x001C;
1460pub const IMAGE_REL_IA64_ADDEND: u16 = 0x001F;
1461
1462//
1463// CEF relocation types.
1464//
1465/// Reference is absolute, no relocation is necessary
1466pub const IMAGE_REL_CEF_ABSOLUTE: u16 = 0x0000;
1467/// 32-bit address (VA).
1468pub const IMAGE_REL_CEF_ADDR32: u16 = 0x0001;
1469/// 64-bit address (VA).
1470pub const IMAGE_REL_CEF_ADDR64: u16 = 0x0002;
1471/// 32-bit address w/o image base (RVA).
1472pub const IMAGE_REL_CEF_ADDR32NB: u16 = 0x0003;
1473/// Section index
1474pub const IMAGE_REL_CEF_SECTION: u16 = 0x0004;
1475/// 32 bit offset from base of section containing target
1476pub const IMAGE_REL_CEF_SECREL: u16 = 0x0005;
1477/// 32 bit metadata token
1478pub const IMAGE_REL_CEF_TOKEN: u16 = 0x0006;
1479
1480//
1481// clr relocation types.
1482//
1483/// Reference is absolute, no relocation is necessary
1484pub const IMAGE_REL_CEE_ABSOLUTE: u16 = 0x0000;
1485/// 32-bit address (VA).
1486pub const IMAGE_REL_CEE_ADDR32: u16 = 0x0001;
1487/// 64-bit address (VA).
1488pub const IMAGE_REL_CEE_ADDR64: u16 = 0x0002;
1489/// 32-bit address w/o image base (RVA).
1490pub const IMAGE_REL_CEE_ADDR32NB: u16 = 0x0003;
1491/// Section index
1492pub const IMAGE_REL_CEE_SECTION: u16 = 0x0004;
1493/// 32 bit offset from base of section containing target
1494pub const IMAGE_REL_CEE_SECREL: u16 = 0x0005;
1495/// 32 bit metadata token
1496pub const IMAGE_REL_CEE_TOKEN: u16 = 0x0006;
1497
1498/// No relocation required
1499pub const IMAGE_REL_M32R_ABSOLUTE: u16 = 0x0000;
1500/// 32 bit address
1501pub const IMAGE_REL_M32R_ADDR32: u16 = 0x0001;
1502/// 32 bit address w/o image base
1503pub const IMAGE_REL_M32R_ADDR32NB: u16 = 0x0002;
1504/// 24 bit address
1505pub const IMAGE_REL_M32R_ADDR24: u16 = 0x0003;
1506/// GP relative addressing
1507pub const IMAGE_REL_M32R_GPREL16: u16 = 0x0004;
1508/// 24 bit offset << 2 & sign ext.
1509pub const IMAGE_REL_M32R_PCREL24: u16 = 0x0005;
1510/// 16 bit offset << 2 & sign ext.
1511pub const IMAGE_REL_M32R_PCREL16: u16 = 0x0006;
1512/// 8 bit offset << 2 & sign ext.
1513pub const IMAGE_REL_M32R_PCREL8: u16 = 0x0007;
1514/// 16 MSBs
1515pub const IMAGE_REL_M32R_REFHALF: u16 = 0x0008;
1516/// 16 MSBs; adj for LSB sign ext.
1517pub const IMAGE_REL_M32R_REFHI: u16 = 0x0009;
1518/// 16 LSBs
1519pub const IMAGE_REL_M32R_REFLO: u16 = 0x000A;
1520/// Link HI and LO
1521pub const IMAGE_REL_M32R_PAIR: u16 = 0x000B;
1522/// Section table index
1523pub const IMAGE_REL_M32R_SECTION: u16 = 0x000C;
1524/// 32 bit section relative reference
1525pub const IMAGE_REL_M32R_SECREL32: u16 = 0x000D;
1526/// clr token
1527pub const IMAGE_REL_M32R_TOKEN: u16 = 0x000E;
1528
1529/// No relocation required
1530pub const IMAGE_REL_EBC_ABSOLUTE: u16 = 0x0000;
1531/// 32 bit address w/o image base
1532pub const IMAGE_REL_EBC_ADDR32NB: u16 = 0x0001;
1533/// 32-bit relative address from byte following reloc
1534pub const IMAGE_REL_EBC_REL32: u16 = 0x0002;
1535/// Section table index
1536pub const IMAGE_REL_EBC_SECTION: u16 = 0x0003;
1537/// Offset within section
1538pub const IMAGE_REL_EBC_SECREL: u16 = 0x0004;
1539
1540/*
1541// TODO?
1542#define EXT_IMM64(Value, Address, Size, InstPos, ValPos)  /* Intel-IA64-Filler */           \
1543    Value |= (((ULONGLONG)((*(Address) >> InstPos) & (((ULONGLONG)1 << Size) - 1))) << ValPos)  // Intel-IA64-Filler
1544
1545#define INS_IMM64(Value, Address, Size, InstPos, ValPos)  /* Intel-IA64-Filler */\
1546    *(PDWORD)Address = (*(PDWORD)Address & ~(((1 << Size) - 1) << InstPos)) | /* Intel-IA64-Filler */\
1547          ((DWORD)((((ULONGLONG)Value >> ValPos) & (((ULONGLONG)1 << Size) - 1))) << InstPos)  // Intel-IA64-Filler
1548*/
1549
1550/// Intel-IA64-Filler
1551pub const EMARCH_ENC_I17_IMM7B_INST_WORD_X: u16 = 3;
1552/// Intel-IA64-Filler
1553pub const EMARCH_ENC_I17_IMM7B_SIZE_X: u16 = 7;
1554/// Intel-IA64-Filler
1555pub const EMARCH_ENC_I17_IMM7B_INST_WORD_POS_X: u16 = 4;
1556/// Intel-IA64-Filler
1557pub const EMARCH_ENC_I17_IMM7B_VAL_POS_X: u16 = 0;
1558
1559/// Intel-IA64-Filler
1560pub const EMARCH_ENC_I17_IMM9D_INST_WORD_X: u16 = 3;
1561/// Intel-IA64-Filler
1562pub const EMARCH_ENC_I17_IMM9D_SIZE_X: u16 = 9;
1563/// Intel-IA64-Filler
1564pub const EMARCH_ENC_I17_IMM9D_INST_WORD_POS_X: u16 = 18;
1565/// Intel-IA64-Filler
1566pub const EMARCH_ENC_I17_IMM9D_VAL_POS_X: u16 = 7;
1567
1568/// Intel-IA64-Filler
1569pub const EMARCH_ENC_I17_IMM5C_INST_WORD_X: u16 = 3;
1570/// Intel-IA64-Filler
1571pub const EMARCH_ENC_I17_IMM5C_SIZE_X: u16 = 5;
1572/// Intel-IA64-Filler
1573pub const EMARCH_ENC_I17_IMM5C_INST_WORD_POS_X: u16 = 13;
1574/// Intel-IA64-Filler
1575pub const EMARCH_ENC_I17_IMM5C_VAL_POS_X: u16 = 16;
1576
1577/// Intel-IA64-Filler
1578pub const EMARCH_ENC_I17_IC_INST_WORD_X: u16 = 3;
1579/// Intel-IA64-Filler
1580pub const EMARCH_ENC_I17_IC_SIZE_X: u16 = 1;
1581/// Intel-IA64-Filler
1582pub const EMARCH_ENC_I17_IC_INST_WORD_POS_X: u16 = 12;
1583/// Intel-IA64-Filler
1584pub const EMARCH_ENC_I17_IC_VAL_POS_X: u16 = 21;
1585
1586/// Intel-IA64-Filler
1587pub const EMARCH_ENC_I17_IMM41A_INST_WORD_X: u16 = 1;
1588/// Intel-IA64-Filler
1589pub const EMARCH_ENC_I17_IMM41A_SIZE_X: u16 = 10;
1590/// Intel-IA64-Filler
1591pub const EMARCH_ENC_I17_IMM41A_INST_WORD_POS_X: u16 = 14;
1592/// Intel-IA64-Filler
1593pub const EMARCH_ENC_I17_IMM41A_VAL_POS_X: u16 = 22;
1594
1595/// Intel-IA64-Filler
1596pub const EMARCH_ENC_I17_IMM41B_INST_WORD_X: u16 = 1;
1597/// Intel-IA64-Filler
1598pub const EMARCH_ENC_I17_IMM41B_SIZE_X: u16 = 8;
1599/// Intel-IA64-Filler
1600pub const EMARCH_ENC_I17_IMM41B_INST_WORD_POS_X: u16 = 24;
1601/// Intel-IA64-Filler
1602pub const EMARCH_ENC_I17_IMM41B_VAL_POS_X: u16 = 32;
1603
1604/// Intel-IA64-Filler
1605pub const EMARCH_ENC_I17_IMM41C_INST_WORD_X: u16 = 2;
1606/// Intel-IA64-Filler
1607pub const EMARCH_ENC_I17_IMM41C_SIZE_X: u16 = 23;
1608/// Intel-IA64-Filler
1609pub const EMARCH_ENC_I17_IMM41C_INST_WORD_POS_X: u16 = 0;
1610/// Intel-IA64-Filler
1611pub const EMARCH_ENC_I17_IMM41C_VAL_POS_X: u16 = 40;
1612
1613/// Intel-IA64-Filler
1614pub const EMARCH_ENC_I17_SIGN_INST_WORD_X: u16 = 3;
1615/// Intel-IA64-Filler
1616pub const EMARCH_ENC_I17_SIGN_SIZE_X: u16 = 1;
1617/// Intel-IA64-Filler
1618pub const EMARCH_ENC_I17_SIGN_INST_WORD_POS_X: u16 = 27;
1619/// Intel-IA64-Filler
1620pub const EMARCH_ENC_I17_SIGN_VAL_POS_X: u16 = 63;
1621
1622/// Intel-IA64-Filler
1623pub const X3_OPCODE_INST_WORD_X: u16 = 3;
1624/// Intel-IA64-Filler
1625pub const X3_OPCODE_SIZE_X: u16 = 4;
1626/// Intel-IA64-Filler
1627pub const X3_OPCODE_INST_WORD_POS_X: u16 = 28;
1628/// Intel-IA64-Filler
1629pub const X3_OPCODE_SIGN_VAL_POS_X: u16 = 0;
1630
1631/// Intel-IA64-Filler
1632pub const X3_I_INST_WORD_X: u16 = 3;
1633/// Intel-IA64-Filler
1634pub const X3_I_SIZE_X: u16 = 1;
1635/// Intel-IA64-Filler
1636pub const X3_I_INST_WORD_POS_X: u16 = 27;
1637/// Intel-IA64-Filler
1638pub const X3_I_SIGN_VAL_POS_X: u16 = 59;
1639
1640/// Intel-IA64-Filler
1641pub const X3_D_WH_INST_WORD_X: u16 = 3;
1642/// Intel-IA64-Filler
1643pub const X3_D_WH_SIZE_X: u16 = 3;
1644/// Intel-IA64-Filler
1645pub const X3_D_WH_INST_WORD_POS_X: u16 = 24;
1646/// Intel-IA64-Filler
1647pub const X3_D_WH_SIGN_VAL_POS_X: u16 = 0;
1648
1649/// Intel-IA64-Filler
1650pub const X3_IMM20_INST_WORD_X: u16 = 3;
1651/// Intel-IA64-Filler
1652pub const X3_IMM20_SIZE_X: u16 = 20;
1653/// Intel-IA64-Filler
1654pub const X3_IMM20_INST_WORD_POS_X: u16 = 4;
1655/// Intel-IA64-Filler
1656pub const X3_IMM20_SIGN_VAL_POS_X: u16 = 0;
1657
1658/// Intel-IA64-Filler
1659pub const X3_IMM39_1_INST_WORD_X: u16 = 2;
1660/// Intel-IA64-Filler
1661pub const X3_IMM39_1_SIZE_X: u16 = 23;
1662/// Intel-IA64-Filler
1663pub const X3_IMM39_1_INST_WORD_POS_X: u16 = 0;
1664/// Intel-IA64-Filler
1665pub const X3_IMM39_1_SIGN_VAL_POS_X: u16 = 36;
1666
1667/// Intel-IA64-Filler
1668pub const X3_IMM39_2_INST_WORD_X: u16 = 1;
1669/// Intel-IA64-Filler
1670pub const X3_IMM39_2_SIZE_X: u16 = 16;
1671/// Intel-IA64-Filler
1672pub const X3_IMM39_2_INST_WORD_POS_X: u16 = 16;
1673/// Intel-IA64-Filler
1674pub const X3_IMM39_2_SIGN_VAL_POS_X: u16 = 20;
1675
1676/// Intel-IA64-Filler
1677pub const X3_P_INST_WORD_X: u16 = 3;
1678/// Intel-IA64-Filler
1679pub const X3_P_SIZE_X: u16 = 4;
1680/// Intel-IA64-Filler
1681pub const X3_P_INST_WORD_POS_X: u16 = 0;
1682/// Intel-IA64-Filler
1683pub const X3_P_SIGN_VAL_POS_X: u16 = 0;
1684
1685/// Intel-IA64-Filler
1686pub const X3_TMPLT_INST_WORD_X: u16 = 0;
1687/// Intel-IA64-Filler
1688pub const X3_TMPLT_SIZE_X: u16 = 4;
1689/// Intel-IA64-Filler
1690pub const X3_TMPLT_INST_WORD_POS_X: u16 = 0;
1691/// Intel-IA64-Filler
1692pub const X3_TMPLT_SIGN_VAL_POS_X: u16 = 0;
1693
1694/// Intel-IA64-Filler
1695pub const X3_BTYPE_QP_INST_WORD_X: u16 = 2;
1696/// Intel-IA64-Filler
1697pub const X3_BTYPE_QP_SIZE_X: u16 = 9;
1698/// Intel-IA64-Filler
1699pub const X3_BTYPE_QP_INST_WORD_POS_X: u16 = 23;
1700/// Intel-IA64-Filler
1701pub const X3_BTYPE_QP_INST_VAL_POS_X: u16 = 0;
1702
1703/// Intel-IA64-Filler
1704pub const X3_EMPTY_INST_WORD_X: u16 = 1;
1705/// Intel-IA64-Filler
1706pub const X3_EMPTY_SIZE_X: u16 = 2;
1707/// Intel-IA64-Filler
1708pub const X3_EMPTY_INST_WORD_POS_X: u16 = 14;
1709/// Intel-IA64-Filler
1710pub const X3_EMPTY_INST_VAL_POS_X: u16 = 0;
1711
1712//
1713// Line number format.
1714//
1715
1716// This struct has alignment 1.
1717#[derive(Debug, Clone, Copy)]
1718#[repr(C)]
1719pub struct ImageLinenumber {
1720    /// Symbol table index of function name if Linenumber is 0.
1721    /// Otherwise virtual address of line number.
1722    pub symbol_table_index_or_virtual_address: U32Bytes<LE>,
1723    /// Line number.
1724    pub linenumber: U16Bytes<LE>,
1725}
1726
1727//
1728// Based relocation format.
1729//
1730
1731#[derive(Debug, Clone, Copy)]
1732#[repr(C)]
1733pub struct ImageBaseRelocation {
1734    pub virtual_address: U32<LE>,
1735    pub size_of_block: U32<LE>,
1736    //  pub type_offset[1]: U16<LE>,
1737}
1738
1739//
1740// Based relocation types.
1741//
1742
1743pub const IMAGE_REL_BASED_ABSOLUTE: u16 = 0;
1744pub const IMAGE_REL_BASED_HIGH: u16 = 1;
1745pub const IMAGE_REL_BASED_LOW: u16 = 2;
1746pub const IMAGE_REL_BASED_HIGHLOW: u16 = 3;
1747pub const IMAGE_REL_BASED_HIGHADJ: u16 = 4;
1748pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_5: u16 = 5;
1749pub const IMAGE_REL_BASED_RESERVED: u16 = 6;
1750pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_7: u16 = 7;
1751pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_8: u16 = 8;
1752pub const IMAGE_REL_BASED_MACHINE_SPECIFIC_9: u16 = 9;
1753pub const IMAGE_REL_BASED_DIR64: u16 = 10;
1754
1755//
1756// Platform-specific based relocation types.
1757//
1758
1759pub const IMAGE_REL_BASED_IA64_IMM64: u16 = 9;
1760
1761pub const IMAGE_REL_BASED_MIPS_JMPADDR: u16 = 5;
1762pub const IMAGE_REL_BASED_MIPS_JMPADDR16: u16 = 9;
1763
1764pub const IMAGE_REL_BASED_ARM_MOV32: u16 = 5;
1765pub const IMAGE_REL_BASED_THUMB_MOV32: u16 = 7;
1766
1767pub const IMAGE_REL_BASED_RISCV_HIGH20: u16 = 5;
1768pub const IMAGE_REL_BASED_RISCV_LOW12I: u16 = 7;
1769pub const IMAGE_REL_BASED_RISCV_LOW12S: u16 = 8;
1770
1771//
1772// Archive format.
1773//
1774
1775pub const IMAGE_ARCHIVE_START_SIZE: usize = 8;
1776pub const IMAGE_ARCHIVE_START: &[u8; 8] = b"!<arch>\n";
1777pub const IMAGE_ARCHIVE_END: &[u8] = b"`\n";
1778pub const IMAGE_ARCHIVE_PAD: &[u8] = b"\n";
1779pub const IMAGE_ARCHIVE_LINKER_MEMBER: &[u8; 16] = b"/               ";
1780pub const IMAGE_ARCHIVE_LONGNAMES_MEMBER: &[u8; 16] = b"//              ";
1781pub const IMAGE_ARCHIVE_HYBRIDMAP_MEMBER: &[u8; 16] = b"/<HYBRIDMAP>/   ";
1782
1783#[derive(Debug, Clone, Copy)]
1784#[repr(C)]
1785pub struct ImageArchiveMemberHeader {
1786    /// File member name - `/' terminated.
1787    pub name: [u8; 16],
1788    /// File member date - decimal.
1789    pub date: [u8; 12],
1790    /// File member user id - decimal.
1791    pub user_id: [u8; 6],
1792    /// File member group id - decimal.
1793    pub group_id: [u8; 6],
1794    /// File member mode - octal.
1795    pub mode: [u8; 8],
1796    /// File member size - decimal.
1797    pub size: [u8; 10],
1798    /// String to end header.
1799    pub end_header: [u8; 2],
1800}
1801
1802pub const IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR: u16 = 60;
1803
1804//
1805// DLL support.
1806//
1807
1808//
1809// Export Format
1810//
1811
1812#[derive(Debug, Clone, Copy)]
1813#[repr(C)]
1814pub struct ImageExportDirectory {
1815    pub characteristics: U32<LE>,
1816    pub time_date_stamp: U32<LE>,
1817    pub major_version: U16<LE>,
1818    pub minor_version: U16<LE>,
1819    pub name: U32<LE>,
1820    pub base: U32<LE>,
1821    pub number_of_functions: U32<LE>,
1822    pub number_of_names: U32<LE>,
1823    /// RVA from base of image
1824    pub address_of_functions: U32<LE>,
1825    /// RVA from base of image
1826    pub address_of_names: U32<LE>,
1827    /// RVA from base of image
1828    pub address_of_name_ordinals: U32<LE>,
1829}
1830
1831//
1832// Import Format
1833//
1834
1835#[derive(Debug, Clone, Copy)]
1836#[repr(C)]
1837pub struct ImageImportByName {
1838    pub hint: U16<LE>,
1839    //pub name: [i8; 1],
1840}
1841
1842#[derive(Debug, Clone, Copy)]
1843#[repr(C)]
1844pub struct ImageThunkData64(pub U64<LE>);
1845/*
1846    union {
1847/// PBYTE
1848        pub forwarder_string: U64<LE>,
1849/// PDWORD
1850        pub function: U64<LE>,
1851        pub ordinal: U64<LE>,
1852/// PIMAGE_IMPORT_BY_NAME
1853        pub address_of_data: U64<LE>,
1854    } u1;
1855*/
1856
1857#[derive(Debug, Clone, Copy)]
1858#[repr(C)]
1859pub struct ImageThunkData32(pub U32<LE>);
1860/*
1861    union {
1862/// PBYTE
1863        pub forwarder_string: U32<LE>,
1864/// PDWORD
1865        pub function: U32<LE>,
1866        pub ordinal: U32<LE>,
1867/// PIMAGE_IMPORT_BY_NAME
1868        pub address_of_data: U32<LE>,
1869    } u1;
1870}
1871*/
1872
1873pub const IMAGE_ORDINAL_FLAG64: u64 = 0x8000000000000000;
1874pub const IMAGE_ORDINAL_FLAG32: u32 = 0x80000000;
1875
1876/*
1877#define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)
1878#define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)
1879#define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
1880#define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
1881
1882*/
1883
1884//
1885// Thread Local Storage
1886//
1887
1888#[derive(Debug, Clone, Copy)]
1889#[repr(C)]
1890pub struct ImageTlsDirectory64 {
1891    pub start_address_of_raw_data: U64<LE>,
1892    pub end_address_of_raw_data: U64<LE>,
1893    /// PDWORD
1894    pub address_of_index: U64<LE>,
1895    /// PIMAGE_TLS_CALLBACK *;
1896    pub address_of_call_backs: U64<LE>,
1897    pub size_of_zero_fill: U32<LE>,
1898    pub characteristics: U32<LE>,
1899}
1900
1901#[derive(Debug, Clone, Copy)]
1902#[repr(C)]
1903pub struct ImageTlsDirectory32 {
1904    pub start_address_of_raw_data: U32<LE>,
1905    pub end_address_of_raw_data: U32<LE>,
1906    /// PDWORD
1907    pub address_of_index: U32<LE>,
1908    /// PIMAGE_TLS_CALLBACK *
1909    pub address_of_call_backs: U32<LE>,
1910    pub size_of_zero_fill: U32<LE>,
1911    pub characteristics: U32<LE>,
1912}
1913
1914#[derive(Debug, Clone, Copy)]
1915#[repr(C)]
1916pub struct ImageImportDescriptor {
1917    /// RVA to original unbound IAT (`ImageThunkData32`/`ImageThunkData64`)
1918    /// 0 for terminating null import descriptor
1919    pub original_first_thunk: U32Bytes<LE>,
1920    /// 0 if not bound,
1921    /// -1 if bound, and real date\time stamp
1922    ///     in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)
1923    /// O.W. date/time stamp of DLL bound to (Old BIND)
1924    pub time_date_stamp: U32Bytes<LE>,
1925    /// -1 if no forwarders
1926    pub forwarder_chain: U32Bytes<LE>,
1927    pub name: U32Bytes<LE>,
1928    /// RVA to IAT (if bound this IAT has actual addresses)
1929    pub first_thunk: U32Bytes<LE>,
1930}
1931
1932impl ImageImportDescriptor {
1933    /// Tell whether this import descriptor is the null descriptor
1934    /// (used to mark the end of the iterator array in a PE)
1935    pub fn is_null(&self) -> bool {
1936        self.original_first_thunk.get(LE) == 0
1937            && self.time_date_stamp.get(LE) == 0
1938            && self.forwarder_chain.get(LE) == 0
1939            && self.name.get(LE) == 0
1940            && self.first_thunk.get(LE) == 0
1941    }
1942}
1943
1944//
1945// New format import descriptors pointed to by DataDirectory[ IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT ]
1946//
1947
1948#[derive(Debug, Clone, Copy)]
1949#[repr(C)]
1950pub struct ImageBoundImportDescriptor {
1951    pub time_date_stamp: U32<LE>,
1952    pub offset_module_name: U16<LE>,
1953    pub number_of_module_forwarder_refs: U16<LE>,
1954    // Array of zero or more IMAGE_BOUND_FORWARDER_REF follows
1955}
1956
1957#[derive(Debug, Clone, Copy)]
1958#[repr(C)]
1959pub struct ImageBoundForwarderRef {
1960    pub time_date_stamp: U32<LE>,
1961    pub offset_module_name: U16<LE>,
1962    pub reserved: U16<LE>,
1963}
1964
1965#[derive(Debug, Clone, Copy)]
1966#[repr(C)]
1967pub struct ImageDelayloadDescriptor {
1968    pub attributes: U32<LE>,
1969
1970    /// RVA to the name of the target library (NULL-terminate ASCII string)
1971    pub dll_name_rva: U32<LE>,
1972    /// RVA to the HMODULE caching location (PHMODULE)
1973    pub module_handle_rva: U32<LE>,
1974    /// RVA to the start of the IAT (PIMAGE_THUNK_DATA)
1975    pub import_address_table_rva: U32<LE>,
1976    /// RVA to the start of the name table (PIMAGE_THUNK_DATA::AddressOfData)
1977    pub import_name_table_rva: U32<LE>,
1978    /// RVA to an optional bound IAT
1979    pub bound_import_address_table_rva: U32<LE>,
1980    /// RVA to an optional unload info table
1981    pub unload_information_table_rva: U32<LE>,
1982    /// 0 if not bound, otherwise, date/time of the target DLL
1983    pub time_date_stamp: U32<LE>,
1984}
1985
1986impl ImageDelayloadDescriptor {
1987    /// Tell whether this delay-load import descriptor is the null descriptor
1988    /// (used to mark the end of the iterator array in a PE)
1989    pub fn is_null(&self) -> bool {
1990        self.attributes.get(LE) == 0
1991            && self.dll_name_rva.get(LE) == 0
1992            && self.module_handle_rva.get(LE) == 0
1993            && self.import_address_table_rva.get(LE) == 0
1994            && self.import_name_table_rva.get(LE) == 0
1995            && self.bound_import_address_table_rva.get(LE) == 0
1996            && self.unload_information_table_rva.get(LE) == 0
1997            && self.time_date_stamp.get(LE) == 0
1998    }
1999}
2000
2001/// Delay load version 2 flag for `ImageDelayloadDescriptor::attributes`.
2002pub const IMAGE_DELAYLOAD_RVA_BASED: u32 = 0x8000_0000;
2003
2004//
2005// Resource Format.
2006//
2007
2008//
2009// Resource directory consists of two counts, following by a variable length
2010// array of directory entries.  The first count is the number of entries at
2011// beginning of the array that have actual names associated with each entry.
2012// The entries are in ascending order, case insensitive strings.  The second
2013// count is the number of entries that immediately follow the named entries.
2014// This second count identifies the number of entries that have 16-bit integer
2015// Ids as their name.  These entries are also sorted in ascending order.
2016//
2017// This structure allows fast lookup by either name or number, but for any
2018// given resource entry only one form of lookup is supported, not both.
2019// This is consistent with the syntax of the .RC file and the .RES file.
2020//
2021
2022#[derive(Debug, Clone, Copy)]
2023#[repr(C)]
2024pub struct ImageResourceDirectory {
2025    pub characteristics: U32<LE>,
2026    pub time_date_stamp: U32<LE>,
2027    pub major_version: U16<LE>,
2028    pub minor_version: U16<LE>,
2029    pub number_of_named_entries: U16<LE>,
2030    pub number_of_id_entries: U16<LE>,
2031}
2032
2033pub const IMAGE_RESOURCE_NAME_IS_STRING: u32 = 0x8000_0000;
2034pub const IMAGE_RESOURCE_DATA_IS_DIRECTORY: u32 = 0x8000_0000;
2035//
2036// Each directory contains the 32-bit Name of the entry and an offset,
2037// relative to the beginning of the resource directory of the data associated
2038// with this directory entry.  If the name of the entry is an actual text
2039// string instead of an integer Id, then the high order bit of the name field
2040// is set to one and the low order 31-bits are an offset, relative to the
2041// beginning of the resource directory of the string, which is of type
2042// IMAGE_RESOURCE_DIRECTORY_STRING.  Otherwise the high bit is clear and the
2043// low-order 16-bits are the integer Id that identify this resource directory
2044// entry. If the directory entry is yet another resource directory (i.e. a
2045// subdirectory), then the high order bit of the offset field will be
2046// set to indicate this.  Otherwise the high bit is clear and the offset
2047// field points to a resource data entry.
2048//
2049
2050#[derive(Debug, Clone, Copy)]
2051#[repr(C)]
2052pub struct ImageResourceDirectoryEntry {
2053    pub name_or_id: U32<LE>,
2054    pub offset_to_data_or_directory: U32<LE>,
2055}
2056
2057//
2058// For resource directory entries that have actual string names, the Name
2059// field of the directory entry points to an object of the following type.
2060// All of these string objects are stored together after the last resource
2061// directory entry and before the first resource data object.  This minimizes
2062// the impact of these variable length objects on the alignment of the fixed
2063// size directory entry objects.
2064//
2065
2066#[derive(Debug, Clone, Copy)]
2067#[repr(C)]
2068pub struct ImageResourceDirectoryString {
2069    pub length: U16<LE>,
2070    //pub name_string: [i8; 1],
2071}
2072
2073#[derive(Debug, Clone, Copy)]
2074#[repr(C)]
2075pub struct ImageResourceDirStringU {
2076    pub length: U16<LE>,
2077    //pub name_string: [U16<LE>; 1],
2078}
2079
2080//
2081// Each resource data entry describes a leaf node in the resource directory
2082// tree.  It contains an offset, relative to the beginning of the resource
2083// directory of the data for the resource, a size field that gives the number
2084// of bytes of data at that offset, a CodePage that should be used when
2085// decoding code point values within the resource data.  Typically for new
2086// applications the code page would be the unicode code page.
2087//
2088
2089#[derive(Debug, Clone, Copy)]
2090#[repr(C)]
2091pub struct ImageResourceDataEntry {
2092    /// RVA of the data.
2093    pub offset_to_data: U32<LE>,
2094    pub size: U32<LE>,
2095    pub code_page: U32<LE>,
2096    pub reserved: U32<LE>,
2097}
2098
2099// Resource type: https://docs.microsoft.com/en-us/windows/win32/menurc/resource-types
2100
2101/// ID for: Hardware-dependent cursor resource.
2102pub const RT_CURSOR: u16 = 1;
2103/// ID for: Bitmap resource.
2104pub const RT_BITMAP: u16 = 2;
2105/// ID for: Hardware-dependent icon resource.
2106pub const RT_ICON: u16 = 3;
2107/// ID for: Menu resource.
2108pub const RT_MENU: u16 = 4;
2109/// ID for: Dialog box.
2110pub const RT_DIALOG: u16 = 5;
2111/// ID for: String-table entry.
2112pub const RT_STRING: u16 = 6;
2113/// ID for: Font directory resource.
2114pub const RT_FONTDIR: u16 = 7;
2115/// ID for: Font resource.
2116pub const RT_FONT: u16 = 8;
2117/// ID for: Accelerator table.
2118pub const RT_ACCELERATOR: u16 = 9;
2119/// ID for: Application-defined resource (raw data).
2120pub const RT_RCDATA: u16 = 10;
2121/// ID for: Message-table entry.
2122pub const RT_MESSAGETABLE: u16 = 11;
2123/// ID for: Hardware-independent cursor resource.
2124pub const RT_GROUP_CURSOR: u16 = 12;
2125/// ID for: Hardware-independent icon resource.
2126pub const RT_GROUP_ICON: u16 = 14;
2127/// ID for: Version resource.
2128pub const RT_VERSION: u16 = 16;
2129/// ID for: Allows a resource editing tool to associate a string with an .rc file.
2130pub const RT_DLGINCLUDE: u16 = 17;
2131/// ID for: Plug and Play resource.
2132pub const RT_PLUGPLAY: u16 = 19;
2133/// ID for: VXD.
2134pub const RT_VXD: u16 = 20;
2135/// ID for: Animated cursor.
2136pub const RT_ANICURSOR: u16 = 21;
2137/// ID for: Animated icon.
2138pub const RT_ANIICON: u16 = 22;
2139/// ID for: HTML resource.
2140pub const RT_HTML: u16 = 23;
2141/// ID for: Side-by-Side Assembly Manifest.
2142pub const RT_MANIFEST: u16 = 24;
2143
2144//
2145// Code Integrity in loadconfig (CI)
2146//
2147
2148#[derive(Debug, Clone, Copy)]
2149#[repr(C)]
2150pub struct ImageLoadConfigCodeIntegrity {
2151    /// Flags to indicate if CI information is available, etc.
2152    pub flags: U16<LE>,
2153    /// 0xFFFF means not available
2154    pub catalog: U16<LE>,
2155    pub catalog_offset: U32<LE>,
2156    /// Additional bitmask to be defined later
2157    pub reserved: U32<LE>,
2158}
2159
2160//
2161// Dynamic value relocation table in loadconfig
2162//
2163
2164#[derive(Debug, Clone, Copy)]
2165#[repr(C)]
2166pub struct ImageDynamicRelocationTable {
2167    pub version: U32<LE>,
2168    pub size: U32<LE>,
2169    // DynamicRelocations: [ImageDynamicRelocation; 0],
2170}
2171
2172//
2173// Dynamic value relocation entries following IMAGE_DYNAMIC_RELOCATION_TABLE
2174//
2175
2176#[derive(Debug, Clone, Copy)]
2177#[repr(C)]
2178pub struct ImageDynamicRelocation32 {
2179    pub symbol: U32<LE>,
2180    pub base_reloc_size: U32<LE>,
2181    // BaseRelocations: [ImageBaseRelocation; 0],
2182}
2183
2184#[derive(Debug, Clone, Copy)]
2185#[repr(C)]
2186pub struct ImageDynamicRelocation64 {
2187    pub symbol: U64<LE>,
2188    pub base_reloc_size: U32<LE>,
2189    // BaseRelocations: [ImageBaseRelocation; 0],
2190}
2191
2192#[derive(Debug, Clone, Copy)]
2193#[repr(C)]
2194pub struct ImageDynamicRelocation32V2 {
2195    pub header_size: U32<LE>,
2196    pub fixup_info_size: U32<LE>,
2197    pub symbol: U32<LE>,
2198    pub symbol_group: U32<LE>,
2199    pub flags: U32<LE>,
2200    // ...     variable length header fields
2201    // pub     fixup_info: [u8; fixup_info_size]
2202}
2203
2204#[derive(Debug, Clone, Copy)]
2205#[repr(C)]
2206pub struct ImageDynamicRelocation64V2 {
2207    pub header_size: U32<LE>,
2208    pub fixup_info_size: U32<LE>,
2209    pub symbol: U64<LE>,
2210    pub symbol_group: U32<LE>,
2211    pub flags: U32<LE>,
2212    // ...     variable length header fields
2213    // pub     fixup_info[u8; fixup_info_size]
2214}
2215
2216//
2217// Defined symbolic dynamic relocation entries.
2218//
2219
2220pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_PROLOGUE: u32 = 0x0000_0001;
2221pub const IMAGE_DYNAMIC_RELOCATION_GUARD_RF_EPILOGUE: u32 = 0x0000_0002;
2222pub const IMAGE_DYNAMIC_RELOCATION_GUARD_IMPORT_CONTROL_TRANSFER: u32 = 0x0000_0003;
2223pub const IMAGE_DYNAMIC_RELOCATION_GUARD_INDIR_CONTROL_TRANSFER: u32 = 0x0000_0004;
2224pub const IMAGE_DYNAMIC_RELOCATION_GUARD_SWITCHTABLE_BRANCH: u32 = 0x0000_0005;
2225
2226// This struct has alignment 1.
2227#[derive(Debug, Clone, Copy)]
2228#[repr(C)]
2229pub struct ImagePrologueDynamicRelocationHeader {
2230    pub prologue_byte_count: u8,
2231    // pub prologue_bytes: [u8; prologue_byte_count],
2232}
2233
2234// This struct has alignment 1.
2235#[derive(Debug, Clone, Copy)]
2236#[repr(C)]
2237pub struct ImageEpilogueDynamicRelocationHeader {
2238    pub epilogue_count: U32Bytes<LE>,
2239    pub epilogue_byte_count: u8,
2240    pub branch_descriptor_element_size: u8,
2241    pub branch_descriptor_count: U16Bytes<LE>,
2242    // pub branch_descriptors[...],
2243    // pub branch_descriptor_bit_map[...],
2244}
2245
2246/*
2247// TODO? bitfields
2248// TODO: unaligned?
2249#[derive(Debug, Clone, Copy)]
2250#[repr(C)]
2251pub struct ImageImportControlTransferDynamicRelocation {
2252    DWORD       PageRelativeOffset : 12;
2253    DWORD       IndirectCall       : 1;
2254    DWORD       IATIndex           : 19;
2255}
2256
2257// TODO: unaligned?
2258#[derive(Debug, Clone, Copy)]
2259#[repr(C)]
2260pub struct ImageIndirControlTransferDynamicRelocation {
2261    WORD        PageRelativeOffset : 12;
2262    WORD        IndirectCall       : 1;
2263    WORD        RexWPrefix         : 1;
2264    WORD        CfgCheck           : 1;
2265    WORD        Reserved           : 1;
2266}
2267
2268// TODO: unaligned?
2269#[derive(Debug, Clone, Copy)]
2270#[repr(C)]
2271pub struct ImageSwitchtableBranchDynamicRelocation {
2272    WORD        PageRelativeOffset : 12;
2273    WORD        RegisterNumber     : 4;
2274}
2275*/
2276
2277//
2278// Load Configuration Directory Entry
2279//
2280
2281#[derive(Debug, Clone, Copy)]
2282#[repr(C)]
2283pub struct ImageLoadConfigDirectory32 {
2284    pub size: U32<LE>,
2285    pub time_date_stamp: U32<LE>,
2286    pub major_version: U16<LE>,
2287    pub minor_version: U16<LE>,
2288    pub global_flags_clear: U32<LE>,
2289    pub global_flags_set: U32<LE>,
2290    pub critical_section_default_timeout: U32<LE>,
2291    pub de_commit_free_block_threshold: U32<LE>,
2292    pub de_commit_total_free_threshold: U32<LE>,
2293    /// VA
2294    pub lock_prefix_table: U32<LE>,
2295    pub maximum_allocation_size: U32<LE>,
2296    pub virtual_memory_threshold: U32<LE>,
2297    pub process_heap_flags: U32<LE>,
2298    pub process_affinity_mask: U32<LE>,
2299    pub csd_version: U16<LE>,
2300    pub dependent_load_flags: U16<LE>,
2301    /// VA
2302    pub edit_list: U32<LE>,
2303    /// VA
2304    pub security_cookie: U32<LE>,
2305    /// VA
2306    pub sehandler_table: U32<LE>,
2307    pub sehandler_count: U32<LE>,
2308    /// VA
2309    pub guard_cf_check_function_pointer: U32<LE>,
2310    /// VA
2311    pub guard_cf_dispatch_function_pointer: U32<LE>,
2312    /// VA
2313    pub guard_cf_function_table: U32<LE>,
2314    pub guard_cf_function_count: U32<LE>,
2315    pub guard_flags: U32<LE>,
2316    pub code_integrity: ImageLoadConfigCodeIntegrity,
2317    /// VA
2318    pub guard_address_taken_iat_entry_table: U32<LE>,
2319    pub guard_address_taken_iat_entry_count: U32<LE>,
2320    /// VA
2321    pub guard_long_jump_target_table: U32<LE>,
2322    pub guard_long_jump_target_count: U32<LE>,
2323    /// VA
2324    pub dynamic_value_reloc_table: U32<LE>,
2325    pub chpe_metadata_pointer: U32<LE>,
2326    /// VA
2327    pub guard_rf_failure_routine: U32<LE>,
2328    /// VA
2329    pub guard_rf_failure_routine_function_pointer: U32<LE>,
2330    pub dynamic_value_reloc_table_offset: U32<LE>,
2331    pub dynamic_value_reloc_table_section: U16<LE>,
2332    pub reserved2: U16<LE>,
2333    /// VA
2334    pub guard_rf_verify_stack_pointer_function_pointer: U32<LE>,
2335    pub hot_patch_table_offset: U32<LE>,
2336    pub reserved3: U32<LE>,
2337    /// VA
2338    pub enclave_configuration_pointer: U32<LE>,
2339    /// VA
2340    pub volatile_metadata_pointer: U32<LE>,
2341}
2342
2343#[derive(Debug, Clone, Copy)]
2344#[repr(C)]
2345pub struct ImageLoadConfigDirectory64 {
2346    pub size: U32<LE>,
2347    pub time_date_stamp: U32<LE>,
2348    pub major_version: U16<LE>,
2349    pub minor_version: U16<LE>,
2350    pub global_flags_clear: U32<LE>,
2351    pub global_flags_set: U32<LE>,
2352    pub critical_section_default_timeout: U32<LE>,
2353    pub de_commit_free_block_threshold: U64<LE>,
2354    pub de_commit_total_free_threshold: U64<LE>,
2355    /// VA
2356    pub lock_prefix_table: U64<LE>,
2357    pub maximum_allocation_size: U64<LE>,
2358    pub virtual_memory_threshold: U64<LE>,
2359    pub process_affinity_mask: U64<LE>,
2360    pub process_heap_flags: U32<LE>,
2361    pub csd_version: U16<LE>,
2362    pub dependent_load_flags: U16<LE>,
2363    /// VA
2364    pub edit_list: U64<LE>,
2365    /// VA
2366    pub security_cookie: U64<LE>,
2367    /// VA
2368    pub sehandler_table: U64<LE>,
2369    pub sehandler_count: U64<LE>,
2370    /// VA
2371    pub guard_cf_check_function_pointer: U64<LE>,
2372    /// VA
2373    pub guard_cf_dispatch_function_pointer: U64<LE>,
2374    /// VA
2375    pub guard_cf_function_table: U64<LE>,
2376    pub guard_cf_function_count: U64<LE>,
2377    pub guard_flags: U32<LE>,
2378    pub code_integrity: ImageLoadConfigCodeIntegrity,
2379    /// VA
2380    pub guard_address_taken_iat_entry_table: U64<LE>,
2381    pub guard_address_taken_iat_entry_count: U64<LE>,
2382    /// VA
2383    pub guard_long_jump_target_table: U64<LE>,
2384    pub guard_long_jump_target_count: U64<LE>,
2385    /// VA
2386    pub dynamic_value_reloc_table: U64<LE>,
2387    /// VA
2388    pub chpe_metadata_pointer: U64<LE>,
2389    /// VA
2390    pub guard_rf_failure_routine: U64<LE>,
2391    /// VA
2392    pub guard_rf_failure_routine_function_pointer: U64<LE>,
2393    pub dynamic_value_reloc_table_offset: U32<LE>,
2394    pub dynamic_value_reloc_table_section: U16<LE>,
2395    pub reserved2: U16<LE>,
2396    /// VA
2397    pub guard_rf_verify_stack_pointer_function_pointer: U64<LE>,
2398    pub hot_patch_table_offset: U32<LE>,
2399    pub reserved3: U32<LE>,
2400    /// VA
2401    pub enclave_configuration_pointer: U64<LE>,
2402    /// VA
2403    pub volatile_metadata_pointer: U64<LE>,
2404}
2405
2406#[derive(Debug, Clone, Copy)]
2407#[repr(C)]
2408pub struct ImageHotPatchInfo {
2409    pub version: U32<LE>,
2410    pub size: U32<LE>,
2411    pub sequence_number: U32<LE>,
2412    pub base_image_list: U32<LE>,
2413    pub base_image_count: U32<LE>,
2414    /// Version 2 and later
2415    pub buffer_offset: U32<LE>,
2416    /// Version 3 and later
2417    pub extra_patch_size: U32<LE>,
2418}
2419
2420#[derive(Debug, Clone, Copy)]
2421#[repr(C)]
2422pub struct ImageHotPatchBase {
2423    pub sequence_number: U32<LE>,
2424    pub flags: U32<LE>,
2425    pub original_time_date_stamp: U32<LE>,
2426    pub original_check_sum: U32<LE>,
2427    pub code_integrity_info: U32<LE>,
2428    pub code_integrity_size: U32<LE>,
2429    pub patch_table: U32<LE>,
2430    /// Version 2 and later
2431    pub buffer_offset: U32<LE>,
2432}
2433
2434#[derive(Debug, Clone, Copy)]
2435#[repr(C)]
2436pub struct ImageHotPatchHashes {
2437    pub sha256: [u8; 32],
2438    pub sha1: [u8; 20],
2439}
2440
2441pub const IMAGE_HOT_PATCH_BASE_OBLIGATORY: u32 = 0x0000_0001;
2442pub const IMAGE_HOT_PATCH_BASE_CAN_ROLL_BACK: u32 = 0x0000_0002;
2443
2444pub const IMAGE_HOT_PATCH_CHUNK_INVERSE: u32 = 0x8000_0000;
2445pub const IMAGE_HOT_PATCH_CHUNK_OBLIGATORY: u32 = 0x4000_0000;
2446pub const IMAGE_HOT_PATCH_CHUNK_RESERVED: u32 = 0x3FF0_3000;
2447pub const IMAGE_HOT_PATCH_CHUNK_TYPE: u32 = 0x000F_C000;
2448pub const IMAGE_HOT_PATCH_CHUNK_SOURCE_RVA: u32 = 0x0000_8000;
2449pub const IMAGE_HOT_PATCH_CHUNK_TARGET_RVA: u32 = 0x0000_4000;
2450pub const IMAGE_HOT_PATCH_CHUNK_SIZE: u32 = 0x0000_0FFF;
2451
2452pub const IMAGE_HOT_PATCH_NONE: u32 = 0x0000_0000;
2453pub const IMAGE_HOT_PATCH_FUNCTION: u32 = 0x0001_C000;
2454pub const IMAGE_HOT_PATCH_ABSOLUTE: u32 = 0x0002_C000;
2455pub const IMAGE_HOT_PATCH_REL32: u32 = 0x0003_C000;
2456pub const IMAGE_HOT_PATCH_CALL_TARGET: u32 = 0x0004_4000;
2457pub const IMAGE_HOT_PATCH_INDIRECT: u32 = 0x0005_C000;
2458pub const IMAGE_HOT_PATCH_NO_CALL_TARGET: u32 = 0x0006_4000;
2459pub const IMAGE_HOT_PATCH_DYNAMIC_VALUE: u32 = 0x0007_8000;
2460
2461/// Module performs control flow integrity checks using system-supplied support
2462pub const IMAGE_GUARD_CF_INSTRUMENTED: u32 = 0x0000_0100;
2463/// Module performs control flow and write integrity checks
2464pub const IMAGE_GUARD_CFW_INSTRUMENTED: u32 = 0x0000_0200;
2465/// Module contains valid control flow target metadata
2466pub const IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT: u32 = 0x0000_0400;
2467/// Module does not make use of the /GS security cookie
2468pub const IMAGE_GUARD_SECURITY_COOKIE_UNUSED: u32 = 0x0000_0800;
2469/// Module supports read only delay load IAT
2470pub const IMAGE_GUARD_PROTECT_DELAYLOAD_IAT: u32 = 0x0000_1000;
2471/// Delayload import table in its own .didat section (with nothing else in it) that can be freely reprotected
2472pub const IMAGE_GUARD_DELAYLOAD_IAT_IN_ITS_OWN_SECTION: u32 = 0x0000_2000;
2473/// Module contains suppressed export information.
2474///
2475/// This also infers that the address taken taken IAT table is also present in the load config.
2476pub const IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT: u32 = 0x0000_4000;
2477/// Module enables suppression of exports
2478pub const IMAGE_GUARD_CF_ENABLE_EXPORT_SUPPRESSION: u32 = 0x0000_8000;
2479/// Module contains longjmp target information
2480pub const IMAGE_GUARD_CF_LONGJUMP_TABLE_PRESENT: u32 = 0x0001_0000;
2481/// Module contains return flow instrumentation and metadata
2482pub const IMAGE_GUARD_RF_INSTRUMENTED: u32 = 0x0002_0000;
2483/// Module requests that the OS enable return flow protection
2484pub const IMAGE_GUARD_RF_ENABLE: u32 = 0x0004_0000;
2485/// Module requests that the OS enable return flow protection in strict mode
2486pub const IMAGE_GUARD_RF_STRICT: u32 = 0x0008_0000;
2487/// Module was built with retpoline support
2488pub const IMAGE_GUARD_RETPOLINE_PRESENT: u32 = 0x0010_0000;
2489
2490/// Stride of Guard CF function table encoded in these bits (additional count of bytes per element)
2491pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_MASK: u32 = 0xF000_0000;
2492/// Shift to right-justify Guard CF function table stride
2493pub const IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_SHIFT: u32 = 28;
2494
2495//
2496// GFIDS table entry flags.
2497//
2498
2499/// The containing GFID entry is suppressed
2500pub const IMAGE_GUARD_FLAG_FID_SUPPRESSED: u16 = 0x01;
2501/// The containing GFID entry is export suppressed
2502pub const IMAGE_GUARD_FLAG_EXPORT_SUPPRESSED: u16 = 0x02;
2503
2504//
2505// WIN CE Exception table format
2506//
2507
2508//
2509// Function table entry format.  Function table is pointed to by the
2510// IMAGE_DIRECTORY_ENTRY_EXCEPTION directory entry.
2511//
2512
2513/*
2514// TODO? bitfields
2515#[derive(Debug, Clone, Copy)]
2516#[repr(C)]
2517pub struct ImageCeRuntimeFunctionEntry {
2518    pub func_start: U32<LE>,
2519    DWORD PrologLen : 8;
2520    DWORD FuncLen : 22;
2521    DWORD ThirtyTwoBit : 1;
2522    DWORD ExceptionFlag : 1;
2523}
2524*/
2525
2526#[derive(Debug, Clone, Copy)]
2527#[repr(C)]
2528pub struct ImageArmRuntimeFunctionEntry {
2529    pub begin_address: U32<LE>,
2530    pub unwind_data: U32<LE>,
2531}
2532
2533#[derive(Debug, Clone, Copy)]
2534#[repr(C)]
2535pub struct ImageArm64RuntimeFunctionEntry {
2536    pub begin_address: U32<LE>,
2537    pub unwind_data: U32<LE>,
2538}
2539
2540#[derive(Debug, Clone, Copy)]
2541#[repr(C)]
2542pub struct ImageAlpha64RuntimeFunctionEntry {
2543    pub begin_address: U64<LE>,
2544    pub end_address: U64<LE>,
2545    pub exception_handler: U64<LE>,
2546    pub handler_data: U64<LE>,
2547    pub prolog_end_address: U64<LE>,
2548}
2549
2550#[derive(Debug, Clone, Copy)]
2551#[repr(C)]
2552pub struct ImageAlphaRuntimeFunctionEntry {
2553    pub begin_address: U32<LE>,
2554    pub end_address: U32<LE>,
2555    pub exception_handler: U32<LE>,
2556    pub handler_data: U32<LE>,
2557    pub prolog_end_address: U32<LE>,
2558}
2559
2560#[derive(Debug, Clone, Copy)]
2561#[repr(C)]
2562pub struct ImageRuntimeFunctionEntry {
2563    pub begin_address: U32<LE>,
2564    pub end_address: U32<LE>,
2565    pub unwind_info_address_or_data: U32<LE>,
2566}
2567
2568//
2569// Software enclave information
2570//
2571
2572pub const IMAGE_ENCLAVE_LONG_ID_LENGTH: usize = 32;
2573pub const IMAGE_ENCLAVE_SHORT_ID_LENGTH: usize = 16;
2574
2575#[derive(Debug, Clone, Copy)]
2576#[repr(C)]
2577pub struct ImageEnclaveConfig32 {
2578    pub size: U32<LE>,
2579    pub minimum_required_config_size: U32<LE>,
2580    pub policy_flags: U32<LE>,
2581    pub number_of_imports: U32<LE>,
2582    pub import_list: U32<LE>,
2583    pub import_entry_size: U32<LE>,
2584    pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2585    pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2586    pub image_version: U32<LE>,
2587    pub security_version: U32<LE>,
2588    pub enclave_size: U32<LE>,
2589    pub number_of_threads: U32<LE>,
2590    pub enclave_flags: U32<LE>,
2591}
2592
2593#[derive(Debug, Clone, Copy)]
2594#[repr(C)]
2595pub struct ImageEnclaveConfig64 {
2596    pub size: U32<LE>,
2597    pub minimum_required_config_size: U32<LE>,
2598    pub policy_flags: U32<LE>,
2599    pub number_of_imports: U32<LE>,
2600    pub import_list: U32<LE>,
2601    pub import_entry_size: U32<LE>,
2602    pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2603    pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2604    pub image_version: U32<LE>,
2605    pub security_version: U32<LE>,
2606    pub enclave_size: U64<LE>,
2607    pub number_of_threads: U32<LE>,
2608    pub enclave_flags: U32<LE>,
2609}
2610
2611//pub const IMAGE_ENCLAVE_MINIMUM_CONFIG_SIZE: usize = FIELD_OFFSET(IMAGE_ENCLAVE_CONFIG, EnclaveFlags);
2612
2613pub const IMAGE_ENCLAVE_POLICY_DEBUGGABLE: u32 = 0x0000_0001;
2614
2615pub const IMAGE_ENCLAVE_FLAG_PRIMARY_IMAGE: u32 = 0x0000_0001;
2616
2617#[derive(Debug, Clone, Copy)]
2618#[repr(C)]
2619pub struct ImageEnclaveImport {
2620    pub match_type: U32<LE>,
2621    pub minimum_security_version: U32<LE>,
2622    pub unique_or_author_id: [u8; IMAGE_ENCLAVE_LONG_ID_LENGTH],
2623    pub family_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2624    pub image_id: [u8; IMAGE_ENCLAVE_SHORT_ID_LENGTH],
2625    pub import_name: U32<LE>,
2626    pub reserved: U32<LE>,
2627}
2628
2629pub const IMAGE_ENCLAVE_IMPORT_MATCH_NONE: u32 = 0x0000_0000;
2630pub const IMAGE_ENCLAVE_IMPORT_MATCH_UNIQUE_ID: u32 = 0x0000_0001;
2631pub const IMAGE_ENCLAVE_IMPORT_MATCH_AUTHOR_ID: u32 = 0x0000_0002;
2632pub const IMAGE_ENCLAVE_IMPORT_MATCH_FAMILY_ID: u32 = 0x0000_0003;
2633pub const IMAGE_ENCLAVE_IMPORT_MATCH_IMAGE_ID: u32 = 0x0000_0004;
2634
2635//
2636// Debug Format
2637//
2638
2639#[derive(Debug, Clone, Copy)]
2640#[repr(C)]
2641pub struct ImageDebugDirectory {
2642    pub characteristics: U32<LE>,
2643    pub time_date_stamp: U32<LE>,
2644    pub major_version: U16<LE>,
2645    pub minor_version: U16<LE>,
2646    pub typ: U32<LE>,
2647    pub size_of_data: U32<LE>,
2648    pub address_of_raw_data: U32<LE>,
2649    pub pointer_to_raw_data: U32<LE>,
2650}
2651
2652pub const IMAGE_DEBUG_TYPE_UNKNOWN: u32 = 0;
2653pub const IMAGE_DEBUG_TYPE_COFF: u32 = 1;
2654pub const IMAGE_DEBUG_TYPE_CODEVIEW: u32 = 2;
2655pub const IMAGE_DEBUG_TYPE_FPO: u32 = 3;
2656pub const IMAGE_DEBUG_TYPE_MISC: u32 = 4;
2657pub const IMAGE_DEBUG_TYPE_EXCEPTION: u32 = 5;
2658pub const IMAGE_DEBUG_TYPE_FIXUP: u32 = 6;
2659pub const IMAGE_DEBUG_TYPE_OMAP_TO_SRC: u32 = 7;
2660pub const IMAGE_DEBUG_TYPE_OMAP_FROM_SRC: u32 = 8;
2661pub const IMAGE_DEBUG_TYPE_BORLAND: u32 = 9;
2662pub const IMAGE_DEBUG_TYPE_RESERVED10: u32 = 10;
2663pub const IMAGE_DEBUG_TYPE_CLSID: u32 = 11;
2664pub const IMAGE_DEBUG_TYPE_VC_FEATURE: u32 = 12;
2665pub const IMAGE_DEBUG_TYPE_POGO: u32 = 13;
2666pub const IMAGE_DEBUG_TYPE_ILTCG: u32 = 14;
2667pub const IMAGE_DEBUG_TYPE_MPX: u32 = 15;
2668pub const IMAGE_DEBUG_TYPE_REPRO: u32 = 16;
2669
2670#[derive(Debug, Clone, Copy)]
2671#[repr(C)]
2672pub struct ImageCoffSymbolsHeader {
2673    pub number_of_symbols: U32<LE>,
2674    pub lva_to_first_symbol: U32<LE>,
2675    pub number_of_linenumbers: U32<LE>,
2676    pub lva_to_first_linenumber: U32<LE>,
2677    pub rva_to_first_byte_of_code: U32<LE>,
2678    pub rva_to_last_byte_of_code: U32<LE>,
2679    pub rva_to_first_byte_of_data: U32<LE>,
2680    pub rva_to_last_byte_of_data: U32<LE>,
2681}
2682
2683pub const FRAME_FPO: u16 = 0;
2684pub const FRAME_TRAP: u16 = 1;
2685pub const FRAME_TSS: u16 = 2;
2686pub const FRAME_NONFPO: u16 = 3;
2687
2688/*
2689// TODO? bitfields
2690#[derive(Debug, Clone, Copy)]
2691#[repr(C)]
2692pub struct FpoData {
2693/// offset 1st byte of function code
2694    pub ul_off_start: U32<LE>,
2695/// # bytes in function
2696    pub cb_proc_size: U32<LE>,
2697/// # bytes in locals/4
2698    pub cdw_locals: U32<LE>,
2699/// # bytes in params/4
2700    pub cdw_params: U16<LE>,
2701/// # bytes in prolog
2702    WORD        cbProlog : 8;
2703/// # regs saved
2704    WORD        cbRegs   : 3;
2705/// TRUE if SEH in func
2706    WORD        fHasSEH  : 1;
2707/// TRUE if EBP has been allocated
2708    WORD        fUseBP   : 1;
2709/// reserved for future use
2710    WORD        reserved : 1;
2711/// frame type
2712    WORD        cbFrame  : 2;
2713}
2714pub const SIZEOF_RFPO_DATA: usize = 16;
2715*/
2716
2717pub const IMAGE_DEBUG_MISC_EXENAME: u16 = 1;
2718
2719#[derive(Debug, Clone, Copy)]
2720#[repr(C)]
2721pub struct ImageDebugMisc {
2722    /// type of misc data, see defines
2723    pub data_type: U32<LE>,
2724    /// total length of record, rounded to four byte multiple.
2725    pub length: U32<LE>,
2726    /// TRUE if data is unicode string
2727    pub unicode: u8,
2728    pub reserved: [u8; 3],
2729    // Actual data
2730    //pub data: [u8; 1],
2731}
2732
2733//
2734// Function table extracted from MIPS/ALPHA/IA64 images.  Does not contain
2735// information needed only for runtime support.  Just those fields for
2736// each entry needed by a debugger.
2737//
2738
2739#[derive(Debug, Clone, Copy)]
2740#[repr(C)]
2741pub struct ImageFunctionEntry {
2742    pub starting_address: U32<LE>,
2743    pub ending_address: U32<LE>,
2744    pub end_of_prologue: U32<LE>,
2745}
2746
2747#[derive(Debug, Clone, Copy)]
2748#[repr(C)]
2749pub struct ImageFunctionEntry64 {
2750    pub starting_address: U64<LE>,
2751    pub ending_address: U64<LE>,
2752    pub end_of_prologue_or_unwind_info_address: U64<LE>,
2753}
2754
2755//
2756// Debugging information can be stripped from an image file and placed
2757// in a separate .DBG file, whose file name part is the same as the
2758// image file name part (e.g. symbols for CMD.EXE could be stripped
2759// and placed in CMD.DBG).  This is indicated by the IMAGE_FILE_DEBUG_STRIPPED
2760// flag in the Characteristics field of the file header.  The beginning of
2761// the .DBG file contains the following structure which captures certain
2762// information from the image file.  This allows a debug to proceed even if
2763// the original image file is not accessible.  This header is followed by
2764// zero of more IMAGE_SECTION_HEADER structures, followed by zero or more
2765// IMAGE_DEBUG_DIRECTORY structures.  The latter structures and those in
2766// the image file contain file offsets relative to the beginning of the
2767// .DBG file.
2768//
2769// If symbols have been stripped from an image, the IMAGE_DEBUG_MISC structure
2770// is left in the image file, but not mapped.  This allows a debugger to
2771// compute the name of the .DBG file, from the name of the image in the
2772// IMAGE_DEBUG_MISC structure.
2773//
2774
2775#[derive(Debug, Clone, Copy)]
2776#[repr(C)]
2777pub struct ImageSeparateDebugHeader {
2778    pub signature: U16<LE>,
2779    pub flags: U16<LE>,
2780    pub machine: U16<LE>,
2781    pub characteristics: U16<LE>,
2782    pub time_date_stamp: U32<LE>,
2783    pub check_sum: U32<LE>,
2784    pub image_base: U32<LE>,
2785    pub size_of_image: U32<LE>,
2786    pub number_of_sections: U32<LE>,
2787    pub exported_names_size: U32<LE>,
2788    pub debug_directory_size: U32<LE>,
2789    pub section_alignment: U32<LE>,
2790    pub reserved: [U32<LE>; 2],
2791}
2792
2793#[derive(Debug, Clone, Copy)]
2794#[repr(C)]
2795pub struct NonPagedDebugInfo {
2796    pub signature: U16<LE>,
2797    pub flags: U16<LE>,
2798    pub size: U32<LE>,
2799    pub machine: U16<LE>,
2800    pub characteristics: U16<LE>,
2801    pub time_date_stamp: U32<LE>,
2802    pub check_sum: U32<LE>,
2803    pub size_of_image: U32<LE>,
2804    pub image_base: U64<LE>,
2805    //debug_directory_size
2806    //ImageDebugDirectory
2807}
2808
2809pub const IMAGE_SEPARATE_DEBUG_SIGNATURE: u16 = 0x4944;
2810pub const NON_PAGED_DEBUG_SIGNATURE: u16 = 0x494E;
2811
2812pub const IMAGE_SEPARATE_DEBUG_FLAGS_MASK: u16 = 0x8000;
2813/// when DBG was updated, the old checksum didn't match.
2814pub const IMAGE_SEPARATE_DEBUG_MISMATCH: u16 = 0x8000;
2815
2816//
2817//  The .arch section is made up of headers, each describing an amask position/value
2818//  pointing to an array of IMAGE_ARCHITECTURE_ENTRY's.  Each "array" (both the header
2819//  and entry arrays) are terminiated by a quadword of 0xffffffffL.
2820//
2821//  NOTE: There may be quadwords of 0 sprinkled around and must be skipped.
2822//
2823
2824/*
2825// TODO? bitfields
2826#[derive(Debug, Clone, Copy)]
2827#[repr(C)]
2828pub struct ImageArchitectureHeader {
2829    /// 1 -> code section depends on mask bit
2830    /// 0 -> new instruction depends on mask bit
2831    unsigned int AmaskValue: 1;
2832    /// MBZ
2833    int :7;
2834    /// Amask bit in question for this fixup
2835    unsigned int AmaskShift: 8;
2836    /// MBZ
2837    int :16;
2838    /// RVA into .arch section to array of ARCHITECTURE_ENTRY's
2839    pub first_entry_rva: U32<LE>,
2840}
2841*/
2842
2843#[derive(Debug, Clone, Copy)]
2844#[repr(C)]
2845pub struct ImageArchitectureEntry {
2846    /// RVA of instruction to fixup
2847    pub fixup_inst_rva: U32<LE>,
2848    /// fixup instruction (see alphaops.h)
2849    pub new_inst: U32<LE>,
2850}
2851
2852// The following structure defines the new import object.  Note the values of the first two fields,
2853// which must be set as stated in order to differentiate old and new import members.
2854// Following this structure, the linker emits two null-terminated strings used to recreate the
2855// import at the time of use.  The first string is the import's name, the second is the dll's name.
2856
2857pub const IMPORT_OBJECT_HDR_SIG2: u16 = 0xffff;
2858
2859#[derive(Debug, Clone, Copy)]
2860#[repr(C)]
2861pub struct ImportObjectHeader {
2862    /// Must be IMAGE_FILE_MACHINE_UNKNOWN
2863    pub sig1: U16<LE>,
2864    /// Must be IMPORT_OBJECT_HDR_SIG2.
2865    pub sig2: U16<LE>,
2866    pub version: U16<LE>,
2867    pub machine: U16<LE>,
2868    /// Time/date stamp
2869    pub time_date_stamp: U32<LE>,
2870    /// particularly useful for incremental links
2871    pub size_of_data: U32<LE>,
2872
2873    /// if grf & IMPORT_OBJECT_ORDINAL
2874    pub ordinal_or_hint: U16<LE>,
2875
2876    // WORD    Type : 2;
2877    // WORD    NameType : 3;
2878    // WORD    Reserved : 11;
2879    pub name_type: U16<LE>,
2880}
2881
2882pub const IMPORT_OBJECT_TYPE_MASK: u16 = 0b11;
2883pub const IMPORT_OBJECT_TYPE_SHIFT: u16 = 0;
2884pub const IMPORT_OBJECT_CODE: u16 = 0;
2885pub const IMPORT_OBJECT_DATA: u16 = 1;
2886pub const IMPORT_OBJECT_CONST: u16 = 2;
2887
2888pub const IMPORT_OBJECT_NAME_MASK: u16 = 0b111;
2889pub const IMPORT_OBJECT_NAME_SHIFT: u16 = 2;
2890/// Import by ordinal
2891pub const IMPORT_OBJECT_ORDINAL: u16 = 0;
2892/// Import name == public symbol name.
2893pub const IMPORT_OBJECT_NAME: u16 = 1;
2894/// Import name == public symbol name skipping leading ?, @, or optionally _.
2895pub const IMPORT_OBJECT_NAME_NO_PREFIX: u16 = 2;
2896/// Import name == public symbol name skipping leading ?, @, or optionally _ and truncating at first @.
2897pub const IMPORT_OBJECT_NAME_UNDECORATE: u16 = 3;
2898/// Import name == a name is explicitly provided after the DLL name.
2899pub const IMPORT_OBJECT_NAME_EXPORTAS: u16 = 4;
2900
2901// COM+ Header entry point flags.
2902pub const COMIMAGE_FLAGS_ILONLY: u32 = 0x0000_0001;
2903pub const COMIMAGE_FLAGS_32BITREQUIRED: u32 = 0x0000_0002;
2904pub const COMIMAGE_FLAGS_IL_LIBRARY: u32 = 0x0000_0004;
2905pub const COMIMAGE_FLAGS_STRONGNAMESIGNED: u32 = 0x0000_0008;
2906pub const COMIMAGE_FLAGS_NATIVE_ENTRYPOINT: u32 = 0x0000_0010;
2907pub const COMIMAGE_FLAGS_TRACKDEBUGDATA: u32 = 0x0001_0000;
2908pub const COMIMAGE_FLAGS_32BITPREFERRED: u32 = 0x0002_0000;
2909
2910// Version flags for image.
2911pub const COR_VERSION_MAJOR_V2: u16 = 2;
2912pub const COR_VERSION_MAJOR: u16 = COR_VERSION_MAJOR_V2;
2913pub const COR_VERSION_MINOR: u16 = 5;
2914pub const COR_DELETED_NAME_LENGTH: usize = 8;
2915pub const COR_VTABLEGAP_NAME_LENGTH: usize = 8;
2916
2917// Maximum size of a NativeType descriptor.
2918pub const NATIVE_TYPE_MAX_CB: u16 = 1;
2919pub const COR_ILMETHOD_SECT_SMALL_MAX_DATASIZE: u16 = 0xFF;
2920
2921// Consts for the MIH FLAGS
2922pub const IMAGE_COR_MIH_METHODRVA: u16 = 0x01;
2923pub const IMAGE_COR_MIH_EHRVA: u16 = 0x02;
2924pub const IMAGE_COR_MIH_BASICBLOCK: u16 = 0x08;
2925
2926// V-table constants
2927/// V-table slots are 32-bits in size.
2928pub const COR_VTABLE_32BIT: u16 = 0x01;
2929/// V-table slots are 64-bits in size.
2930pub const COR_VTABLE_64BIT: u16 = 0x02;
2931/// If set, transition from unmanaged.
2932pub const COR_VTABLE_FROM_UNMANAGED: u16 = 0x04;
2933/// If set, transition from unmanaged with keeping the current appdomain.
2934pub const COR_VTABLE_FROM_UNMANAGED_RETAIN_APPDOMAIN: u16 = 0x08;
2935/// Call most derived method described by
2936pub const COR_VTABLE_CALL_MOST_DERIVED: u16 = 0x10;
2937
2938// EATJ constants
2939/// Size of a jump thunk reserved range.
2940pub const IMAGE_COR_EATJ_THUNK_SIZE: usize = 32;
2941
2942// Max name lengths
2943pub const MAX_CLASS_NAME: usize = 1024;
2944pub const MAX_PACKAGE_NAME: usize = 1024;
2945
2946// CLR 2.0 header structure.
2947#[derive(Debug, Clone, Copy)]
2948#[repr(C)]
2949pub struct ImageCor20Header {
2950    // Header versioning
2951    pub cb: U32<LE>,
2952    pub major_runtime_version: U16<LE>,
2953    pub minor_runtime_version: U16<LE>,
2954
2955    // Symbol table and startup information
2956    pub meta_data: ImageDataDirectory,
2957    pub flags: U32<LE>,
2958
2959    // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is not set, EntryPointToken represents a managed entrypoint.
2960    // If COMIMAGE_FLAGS_NATIVE_ENTRYPOINT is set, EntryPointRVA represents an RVA to a native entrypoint.
2961    pub entry_point_token_or_rva: U32<LE>,
2962
2963    // Binding information
2964    pub resources: ImageDataDirectory,
2965    pub strong_name_signature: ImageDataDirectory,
2966
2967    // Regular fixup and binding information
2968    pub code_manager_table: ImageDataDirectory,
2969    pub vtable_fixups: ImageDataDirectory,
2970    pub export_address_table_jumps: ImageDataDirectory,
2971
2972    // Precompiled image info (internal use only - set to zero)
2973    pub managed_native_header: ImageDataDirectory,
2974}
2975
2976unsafe_impl_pod!(
2977    ImageDosHeader,
2978    ImageOs2Header,
2979    ImageVxdHeader,
2980    ImageFileHeader,
2981    ImageDataDirectory,
2982    ImageOptionalHeader32,
2983    ImageRomOptionalHeader,
2984    ImageOptionalHeader64,
2985    ImageNtHeaders64,
2986    ImageNtHeaders32,
2987    ImageRomHeaders,
2988    Guid,
2989    AnonObjectHeader,
2990    AnonObjectHeaderV2,
2991    AnonObjectHeaderBigobj,
2992    ImageSectionHeader,
2993    ImageSymbol,
2994    ImageSymbolBytes,
2995    ImageSymbolEx,
2996    ImageSymbolExBytes,
2997    ImageAuxSymbolTokenDef,
2998    ImageAuxSymbolFunction,
2999    ImageAuxSymbolFunctionBeginEnd,
3000    ImageAuxSymbolWeak,
3001    ImageAuxSymbolSection,
3002    ImageAuxSymbolCrc,
3003    ImageRelocation,
3004    ImageLinenumber,
3005    ImageBaseRelocation,
3006    ImageArchiveMemberHeader,
3007    ImageExportDirectory,
3008    ImageImportByName,
3009    ImageThunkData64,
3010    ImageThunkData32,
3011    ImageTlsDirectory64,
3012    ImageTlsDirectory32,
3013    ImageImportDescriptor,
3014    ImageBoundImportDescriptor,
3015    ImageBoundForwarderRef,
3016    ImageDelayloadDescriptor,
3017    ImageResourceDirectory,
3018    ImageResourceDirectoryEntry,
3019    ImageResourceDirectoryString,
3020    ImageResourceDirStringU,
3021    ImageResourceDataEntry,
3022    ImageLoadConfigCodeIntegrity,
3023    ImageDynamicRelocationTable,
3024    ImageDynamicRelocation32,
3025    ImageDynamicRelocation64,
3026    ImageDynamicRelocation32V2,
3027    ImageDynamicRelocation64V2,
3028    ImagePrologueDynamicRelocationHeader,
3029    ImageEpilogueDynamicRelocationHeader,
3030    //ImageImportControlTransferDynamicRelocation,
3031    //ImageIndirControlTransferDynamicRelocation,
3032    //ImageSwitchtableBranchDynamicRelocation,
3033    ImageLoadConfigDirectory32,
3034    ImageLoadConfigDirectory64,
3035    ImageHotPatchInfo,
3036    ImageHotPatchBase,
3037    ImageHotPatchHashes,
3038    //ImageCeRuntimeFunctionEntry,
3039    ImageArmRuntimeFunctionEntry,
3040    ImageArm64RuntimeFunctionEntry,
3041    ImageAlpha64RuntimeFunctionEntry,
3042    ImageAlphaRuntimeFunctionEntry,
3043    ImageRuntimeFunctionEntry,
3044    ImageEnclaveConfig32,
3045    ImageEnclaveConfig64,
3046    ImageEnclaveImport,
3047    ImageDebugDirectory,
3048    ImageCoffSymbolsHeader,
3049    //FpoData,
3050    ImageDebugMisc,
3051    ImageFunctionEntry,
3052    ImageFunctionEntry64,
3053    ImageSeparateDebugHeader,
3054    NonPagedDebugInfo,
3055    //ImageArchitectureHeader,
3056    ImageArchitectureEntry,
3057    ImportObjectHeader,
3058    ImageCor20Header,
3059    MaskedRichHeaderEntry,
3060);