277 lines
16 KiB
Plaintext
277 lines
16 KiB
Plaintext
; ******************************************************************************************************
|
|
; FILE:WINNT.INC DATE: MARCH 10, 1999
|
|
; FUNCTION: WIN32 SYSTEM RELATED STRUCTURES AND EQUATES
|
|
; AUTHOR: SEAN M. KESSLER (CONVERTED FROM WINNT.H)
|
|
;*******************************************************************************************************
|
|
|
|
; section characteristics macros
|
|
ISCODE MACRO pImageSectionHeader
|
|
mov eax,[pImageSectionHeader]
|
|
and [IMAGESECTIONHEADER PTR[eax]].SECTIONHEADER@@Characteristics,IMAGE_SCN_CNT_CODE
|
|
ENDM
|
|
|
|
ISDATA MACRO pImageSectionHeader
|
|
LOCAL @@End
|
|
ISINITDATA pImageSectionHeader
|
|
jne @@End
|
|
ISUINITDATA pImageSectionHeader
|
|
@@End:
|
|
ENDM
|
|
|
|
ISINITDATA MACRO pImageSectionHeader
|
|
mov eax,[pImageSectionHeader]
|
|
and [IMAGESECTIONHEADER PTR[eax]].SECTIONHEADER@@Characteristics,IMAGE_SCN_CNT_INITIALIZED_DATA
|
|
ENDM
|
|
|
|
ISUINITDATA MACRO pImageSectionHeader
|
|
mov eax,[pImageSectionHeader]
|
|
and [IMAGESECTIONHEADER PTR[eax]].SECTIONHEADER@@Characteristics,IMAGE_SCN_CNT_UNINITIALIZED_DATA
|
|
ENDM
|
|
|
|
ISEXECUTABLE MACRO pImageSectionHeader
|
|
mov eax[pImageSectionHeader]
|
|
and [IMAGESECTIONHEADER PTR[eax]].SECTIONHEADER@@Characteristics,IMAGE_SCN_CNT_MEM_EXECUTE
|
|
ENDM
|
|
|
|
ISREADABLE MACRO pImageSectionHeader
|
|
mov eax,[pImageSectionHeader]
|
|
and [IMAGESECTIONHEADER PTR[eax]].SECTIONHEADER@@Characteristics,IMAGE_SCN_MEM_READ
|
|
ENDM
|
|
|
|
ISWRITEABLE MACRO pImageSectionHeader
|
|
mov eax,[pImageSectionHeader]
|
|
and [IMAGESECTIONHEADER PTR[eax]].SECTIONHEADER@@Characteristics,IMAGE_SCN_MEM_WRITE
|
|
ENDM
|
|
|
|
IMAGEDOSHEADER STRUC ; DOS .EXE header
|
|
PIMAGEDOSHEADER TYPEDEF NEAR PTR IMAGEDOSHEADER
|
|
DOSHEADER@@e_magic DW ? ; magic number
|
|
DOSHEADER@@e_cblp DW ? ; bytes on last page of file
|
|
DOSHEADER@@e_cp DW ? ; pages in file
|
|
DOSHEADER@@e_crlc DW ? ; relocations
|
|
DOSHEADER@@e_cparhdr DW ? ; size of header in paragraphs
|
|
DOSHEADER@@e_minalloc DW ? ; minimum extra paragraphs needed
|
|
DOSHEADER@@e_maxalloc DW ? ; maximum extra paragraphs needed
|
|
DOSHEADER@@e_ss DW ? ; initial (relative) ss value
|
|
DOSHEADER@@e_sp DW ? ; initial sp value
|
|
DOSHEADER@@e_csum DW ? ; checksum
|
|
DOSHEADER@@e_ip DW ? ; initial ip value
|
|
DOSHEADER@@e_cs DW ? ; initial relative cs value
|
|
DOSHEADER@@e_lfarlc DW ? ; file address of relocation table
|
|
DOSHEADER@@e_ovno DW ? ; overlay number
|
|
DOSHEADER@@e_res DW 04H DUP(?) ; reserved words
|
|
DOSHEADER@@e_oemid DW ? ; oem identifier (for e_oeminfo)
|
|
DOSHEADER@@e_oeminfo DW ? ; oem information (e_oemid specific)
|
|
DOSHEADER@@e_res2 DW 0AH DUP(?) ; reserved words
|
|
DOSHEADER@@e_lfanew DD ? ; file address of new exe header
|
|
IMAGEDOSHEADER ENDS
|
|
|
|
IMAGEFILEHEADER STRUC
|
|
PIMAGEFILEHEADER TYPEDEF FAR PTR IMAGEFILEHEADER
|
|
FILEHEADER@@Machine DW ? ; required architecture, 0x14C=80386
|
|
FILEHEADER@@NumberOfSections DW ? ; count of sections in file
|
|
FILEHEADER@@TimeDateStamp DD ? ; number of seconds after Dec 31,1969 at 4:00 p.m.
|
|
FILEHEADER@@PointerToSymbolTable DD ? ; pointer to COFF symbol table
|
|
FILEHEADER@@NumberOfSymbols DD ? ; number of COFF symbols
|
|
FILEHEADER@@SizeOfOptionalHeader DW ? ; size of optional header that follows
|
|
FILEHEADER@@Characteristics DW ? ; 0001h=no relocations, 0002h=EXE, 2000h=DLL
|
|
IMAGEFILEHEADER ENDS
|
|
|
|
IMAGEDATADIRECTORY STRUC
|
|
PIMAGEDATADIRECTORY TYPEDEF FAR PTR IMAGEDATADIRECTORY
|
|
DATADIRECTORY@@VirtualAddress DD ? ; location of relevent quantity
|
|
DATADIRECTORY@@Size DD ? ; size of the relevent quantity
|
|
IMAGEDATADIRECTORY ENDS
|
|
|
|
IMAGE_NUMBEROF_DIRECTORY_ENTRIES EQU 10h
|
|
|
|
IMAGEOPTIONALHEADER STRUC
|
|
PIMAGEOPTIONALHEADER TYPEDEF FAR PTR IMAGEOPTIONALHEADER
|
|
OPTIONALHEADER@@Magic DW ? ; always 010Bh
|
|
OPTIONALHEADER@@MajorLinkerVersion DB ? ; major linker version of linker that produced file
|
|
OPTIONALHEADER@@MinorLinkerVersion DB ? ; minor linker version of linker that produced file
|
|
OPTIONALHEADER@@SizeOfCode DD ? ; combined size of all code sections
|
|
OPTIONALHEADER@@SizeOfInitializedData DD ? ; combined size of all initialized data sections
|
|
OPTIONALHEADER@@SizeOfUnitializedData DD ? ; combined size of all unitialized data sections
|
|
OPTIONALHEADER@@AddressOfEntryPoint DD ? ; RVA where code begins execution
|
|
OPTIONALHEADER@@BaseOfCode DD ? ; RVA where files code sections begin
|
|
OPTIONALHEADER@@BaseOfData DD ? ; RVA where files data sections begin
|
|
OPTIONALHEADER@@ImageBase DD ? ; preferred address to load this image
|
|
OPTIONALHEADER@@SectionAlignment DD ? ; alignment of sections in memory
|
|
OPTIONALHEADER@@FileAlignment DD ? ; alignment of sections in the file
|
|
OPTIONALHEADER@@MajorOperatingSystemVersion DW ? ; minimum version of operating system required
|
|
OPTIONALHEADER@@MinorOperatingSystemVersion DW ? ; minor version number of above
|
|
OPTIONALHEADER@@MajorImageVersion DW ? ; user defineable field
|
|
OPTIONALHEADER@@MinorImageVersion DW ? ; user defineable field
|
|
OPTIONALHEADER@@MajorSubsystemVersion DW ? ; minimum subsystem version to run exe
|
|
OPTIONALHEADER@@MinorSubsystemVersion DW ? ; minimum subsystem version
|
|
OPTIONALHEADER@@Win32VersionValue DD ? ; always zero
|
|
OPTIONALHEADER@@SizeOfImage DD ? ; total size of the image, rounded up
|
|
OPTIONALHEADER@@SizeOfHeaders DD ? ; size of PE header and section table
|
|
OPTIONALHEADER@@CheckSum DD ? ; 0, except for trusted services
|
|
OPTIONALHEADER@@Subsystem DW ? ; 1=native,2=wingui,3=console,5=OS/2,7=Posix
|
|
OPTIONALHEADER@@DllCharacteristics DW ? ; 1=callonload,2=callendthrd,4=callinithtrd,6=calldllexit
|
|
OPTIONALHEADER@@SizeOfStackReserve DD ? ; amount of memory to reserve for stack
|
|
OPTIONALHEADER@@SizeOfStackCommit DD ? ; amount of committed memory for stack
|
|
OPTIONALHEADER@@SizeOfHeapReserve DD ? ; amount of memory to reserve for heap
|
|
OPTIONALHEADER@@SizeOfHeapCommit DD ? ; amount of committed memory for heap
|
|
OPTIONALHEADER@@LoaderFlags DD ? ; unknown purpose
|
|
OPTIONALHEADER@@NumberOfRvaAndSizes DD ? ; number of entries in the data directory
|
|
OPTIONALHEADER@@DataDirectory IMAGEDATADIRECTORY IMAGE_NUMBEROF_DIRECTORY_ENTRIES DUP(<?,?>)
|
|
IMAGEOPTIONALHEADER ENDS
|
|
|
|
IMAGE_SIZEOF_FILE_HEADER EQU 0014h
|
|
IMAGE_FILE_RELOCS_STRIPPED EQU 0001h ; Relocation info stripped from file.
|
|
IMAGE_FILE_EXECUTABLE_IMAGE EQU 0002h ; File is executable (i.e. no unresolved externel references).
|
|
IMAGE_FILE_LINE_NUMS_STRIPPED EQU 0004h ; Line nunbers stripped from file.
|
|
IMAGE_FILE_LOCAL_SYMS_STRIPPED EQU 0008h ; Local symbols stripped from file.
|
|
IMAGE_FILE_AGGRESIVE_WS_TRIM EQU 0010h ; Agressively trim working set
|
|
IMAGE_FILE_BYTES_REVERSED_LO EQU 0080h ; Bytes of machine word are reversed.
|
|
IMAGE_FILE_32BIT_MACHINE EQU 0100h ; 32 bit word machine.
|
|
IMAGE_FILE_DEBUG_STRIPPED EQU 0200h ; Debugging info stripped from file in .DBG file
|
|
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP EQU 0400h ; If Image is on removable media, copy and run from the swap file.
|
|
IMAGE_FILE_NET_RUN_FROM_SWAP EQU 0800h ; If Image is on Net, copy and run from the swap file.
|
|
IMAGE_FILE_SYSTEM EQU 1000h ; System File.
|
|
IMAGE_FILE_DLL EQU 2000h ; File is a DLL.
|
|
IMAGE_FILE_UP_SYSTEM_ONLY EQU 4000h ; File should only be run on a UP machine
|
|
IMAGE_FILE_BYTES_REVERSED_HI EQU 8000h ; Bytes of machine word are reversed.
|
|
IMAGE_FILE_MACHINE_UNKNOWN EQU 0000h
|
|
IMAGE_FILE_MACHINE_I386 EQU 014ch ; Intel 386.
|
|
IMAGE_FILE_MACHINE_R3000 EQU 0162h ; MIPS little-endian, 0x160 big-endian
|
|
IMAGE_FILE_MACHINE_R4000 EQU 0166h ; MIPS little-endian
|
|
IMAGE_FILE_MACHINE_R10000 EQU 0168h ; MIPS little-endian
|
|
IMAGE_FILE_MACHINE_ALPHA EQU 0184h ; Alpha_AXP
|
|
IMAGE_FILE_MACHINE_POWERPC EQU 01F0h ; IBM PowerPC Little-Endian
|
|
|
|
; subsystem
|
|
IMAGE_SUBSYSTEM_UNKNOWN EQU 0000h ; Unknown subsystem.
|
|
IMAGE_SUBSYSTEM_NATIVE EQU 0001h ; Image doesn't require a subsystem.
|
|
IMAGE_SUBSYSTEM_WINDOWS_GUI EQU 0002h ; Image runs in the Windows GUI subsystem.
|
|
IMAGE_SUBSYSTEM_WINDOWS_CUI EQU 0003h ; Image runs in the Windows character subsystem.
|
|
IMAGE_SUBSYSTEM_OS2_CUI EQU 0005h ; image runs in the OS/2 character subsystem.
|
|
IMAGE_SUBSYSTEM_POSIX_CUI EQU 0007h ; image runs in the Posix character subsystem.
|
|
IMAGE_SUBSYSTEM_RESERVED8 EQU 0008h ; image runs in the 8 subsystem.
|
|
|
|
; directory entries
|
|
IMAGE_DIRECTORY_ENTRY_EXPORT EQU 0000h ; Export Directory
|
|
IMAGE_DIRECTORY_ENTRY_IMPORT EQU 0001h ; Import Directory
|
|
IMAGE_DIRECTORY_ENTRY_RESOURCE EQU 0002h ; Resource Directory
|
|
IMAGE_DIRECTORY_ENTRY_EXCEPTION EQU 0003h ; Exception Directory
|
|
IMAGE_DIRECTORY_ENTRY_SECURITY EQU 0004h ; Security Directory
|
|
IMAGE_DIRECTORY_ENTRY_BASERELOC EQU 0005h ; Base Relocation Table
|
|
IMAGE_DIRECTORY_ENTRY_DEBUG EQU 0006h ; Debug Directory
|
|
IMAGE_DIRECTORY_ENTRY_COPYRIGHT EQU 0007h ; Description String
|
|
IMAGE_DIRECTORY_ENTRY_GLOBALPTR EQU 0008h ; Machine Value (MIPS GP)
|
|
IMAGE_DIRECTORY_ENTRY_TLS EQU 0009h ; TLS Directory
|
|
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG EQU 000Ah ; Load Configuration Directory
|
|
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT EQU 000Bh ; Bound Import Directory in headers
|
|
IMAGE_DIRECTORY_ENTRY_IAT EQU 000Ch ; Import Address Table
|
|
|
|
IMAGE_NUMBEROF_DIRECTORY_ENTRIES EQU 0010h
|
|
|
|
IMAGE_DOS_SIGNATURE EQU 5A4Dh ; MZ header signature
|
|
IMAGE_PE_SIGNATURE EQU 4550h ; PE signature
|
|
|
|
; image section header equates
|
|
IMAGE_SIZEOF_SHORT_NAME EQU 0008h
|
|
IMAGE_SIZEOF_SECTION_HEADER EQU 0040h
|
|
|
|
IMAGESECTIONHEADER STRUC
|
|
PIMAGESECTIONHEADER TYPEDEF NEAR PTR IMAGESECTIONHEADER
|
|
SECTIONHEADER@@Name DB IMAGE_SIZEOF_SHORT_NAME DUP(?)
|
|
SECTIONHEADER@@VirtualSize DD ? ; VirtualSize=PhysicalAddress
|
|
SECTIONHEADER@@VirtualAddress DD ?
|
|
SECTIONHEADER@@SizeOfRawData DD ?
|
|
SECTIONHEADER@@PointerToRawData DD ?
|
|
SECTIONHEADER@@PointerToRelocations DD ?
|
|
SECTIONHEADER@@PointerToLineNumbers DD ?
|
|
SECTIONHEADER@@NumberOfRelocations DW ?
|
|
SECTIONHEADER@@NumberOfLineNumbers DW ?
|
|
SECTIONHEADER@@Characteristics DD ?
|
|
IMAGESECTIONHEADER ENDS
|
|
|
|
IMAGE_SCN_TYPE_NO_PAD EQU 00000008h ; Reserved.
|
|
IMAGE_SCN_CNT_CODE EQU 00000020h ; Section contains code.
|
|
IMAGE_SCN_CNT_INITIALIZED_DATA EQU 00000040h ; Section contains initialized data.
|
|
IMAGE_SCN_CNT_UNINITIALIZED_DATA EQU 00000080h ; Section contains uninitialized data.
|
|
IMAGE_SCN_LNK_OTHER EQU 00000100h ; Reserved.
|
|
IMAGE_SCN_LNK_INFO EQU 00000200h ; Section contains comments or some other type of information.
|
|
IMAGE_SCN_LNK_REMOVE EQU 00000800h ; Section contents will not become part of image.
|
|
IMAGE_SCN_LNK_COMDAT EQU 00001000h ; Section contents comdat.
|
|
IMAGE_SCN_MEM_FARDATA EQU 00008000h
|
|
IMAGE_SCN_MEM_PURGEABLE EQU 00020000h
|
|
IMAGE_SCN_MEM_16BIT EQU 00020000h
|
|
IMAGE_SCN_MEM_LOCKED EQU 00040000h
|
|
IMAGE_SCN_MEM_PRELOAD EQU 00080000h
|
|
IMAGE_SCN_ALIGN_1BYTES EQU 00100000h ;
|
|
IMAGE_SCN_ALIGN_2BYTES EQU 00200000h ;
|
|
IMAGE_SCN_ALIGN_4BYTES EQU 00300000h ;
|
|
IMAGE_SCN_ALIGN_8BYTES EQU 00400000h ;
|
|
IMAGE_SCN_ALIGN_16BYTES EQU 00500000h ; Default alignment if no others are specified.
|
|
IMAGE_SCN_ALIGN_32BYTES EQU 00600000h ;
|
|
IMAGE_SCN_ALIGN_64BYTES EQU 00700000h ;
|
|
IMAGE_SCN_LNK_NRELOC_OVFL EQU 01000000h ; Section contains extended relocations.
|
|
IMAGE_SCN_MEM_DISCARDABLE EQU 02000000h ; Section can be discarded.
|
|
IMAGE_SCN_MEM_NOT_CACHED EQU 04000000h ; Section is not cachable.
|
|
IMAGE_SCN_MEM_NOT_PAGED EQU 08000000h ; Section is not pageable.
|
|
IMAGE_SCN_MEM_SHARED EQU 10000000h ; Section is shareable.
|
|
IMAGE_SCN_MEM_EXECUTE EQU 20000000h ; Section is executable.
|
|
IMAGE_SCN_MEM_READ EQU 40000000h ; Section is readable.
|
|
IMAGE_SCN_MEM_WRITE EQU 80000000h ; Section is writeable.
|
|
|
|
IMAGE_SCN_SCALE_INDEX EQU 00000001h ; Tls index is scaled
|
|
IMAGE_SCN_MEM_FARDATA EQU 00008000h
|
|
IMAGE_SCN_MEM_PURGEABLE EQU 00020000h
|
|
IMAGE_SCN_MEM_16BIT EQU 00020000h
|
|
IMAGE_SCN_MEM_LOCKED EQU 00040000h
|
|
IMAGE_SCN_MEM_PRELOAD EQU 00080000h
|
|
IMAGE_SCN_ALIGN_1BYTES EQU 00100000h
|
|
IMAGE_SCN_ALIGN_2BYTES EQU 00200000h
|
|
IMAGE_SCN_ALIGN_4BYTES EQU 00300000h
|
|
IMAGE_SCN_ALIGN_8BYTES EQU 00400000h
|
|
IMAGE_SCN_ALIGN_16BYTES EQU 00500000h ; Default alignment if no others are specified.
|
|
IMAGE_SCN_ALIGN_32BYTES EQU 00600000h
|
|
IMAGE_SCN_ALIGN_64BYTES EQU 00700000h
|
|
IMAGE_SCN_LNK_NRELOC_OVFL EQU 01000000h ; Section contains extended relocations.
|
|
IMAGE_SCN_MEM_DISCARDABLE EQU 02000000h ; Section can be discarded.
|
|
IMAGE_SCN_MEM_NOT_CACHED EQU 04000000h ; Section is not cachable.
|
|
IMAGE_SCN_MEM_NOT_PAGED EQU 08000000h ; Section is not pageable.
|
|
IMAGE_SCN_MEM_SHARED EQU 10000000h ; Section is shareable.
|
|
IMAGE_SCN_MEM_EXECUTE EQU 20000000h ; Section is executable.
|
|
IMAGE_SCN_MEM_READ EQU 40000000h ; Section is readable.
|
|
IMAGE_SCN_MEM_WRITE EQU 80000000h ; Section is writeable.
|
|
IMAGE_SCN_SCALE_INDEX EQU 00000001h ; Tls index is scaled
|
|
|
|
IMAGE_SCN_TYPE_NO_PAD EQU 00000008h ; Reserved.
|
|
IMAGE_SCN_CNT_CODE EQU 00000020h ; Section contains code.
|
|
IMAGE_SCN_CNT_INITIALIZED_DATA EQU 00000040h ; Section contains initialized data.
|
|
IMAGE_SCN_CNT_UNINITIALIZED_DATA EQU 00000080h ; Section contains uninitialized data.
|
|
IMAGE_SCN_LNK_OTHER EQU 00000100h ; Reserved.
|
|
IMAGE_SCN_LNK_INFO EQU 00000200h ; Section contains comments or some other type of information.
|
|
IMAGE_SCN_LNK_REMOVE EQU 00000800h ; Section contents will not become part of image.
|
|
IMAGE_SCN_LNK_COMDAT EQU 00001000h ; Section contents comdat.
|
|
IMAGE_SCN_MEM_FARDATA EQU 00008000h
|
|
IMAGE_SCN_MEM_PURGEABLE EQU 00020000h
|
|
IMAGE_SCN_MEM_16BIT EQU 00020000h
|
|
IMAGE_SCN_MEM_LOCKED EQU 00040000h
|
|
IMAGE_SCN_MEM_PRELOAD EQU 00080000h
|
|
IMAGE_SCN_ALIGN_1BYTES EQU 00100000h ;
|
|
IMAGE_SCN_ALIGN_2BYTES EQU 00200000h ;
|
|
IMAGE_SCN_ALIGN_4BYTES EQU 00300000h ;
|
|
IMAGE_SCN_ALIGN_8BYTES EQU 00400000h ;
|
|
IMAGE_SCN_ALIGN_16BYTES EQU 00500000h ; Default alignment if no others are specified.
|
|
IMAGE_SCN_ALIGN_32BYTES EQU 00600000h ;
|
|
IMAGE_SCN_ALIGN_64BYTES EQU 00700000h ;
|
|
IMAGE_SCN_LNK_NRELOC_OVFL EQU 01000000h ; Section contains extended relocations.
|
|
IMAGE_SCN_MEM_DISCARDABLE EQU 02000000h ; Section can be discarded.
|
|
IMAGE_SCN_MEM_NOT_CACHED EQU 04000000h ; Section is not cachable.
|
|
IMAGE_SCN_MEM_NOT_PAGED EQU 08000000h ; Section is not pageable.
|
|
IMAGE_SCN_MEM_SHARED EQU 10000000h ; Section is shareable.
|
|
IMAGE_SCN_MEM_EXECUTE EQU 20000000h ; Section is executable.
|
|
IMAGE_SCN_MEM_READ EQU 40000000h ; Section is readable.
|
|
IMAGE_SCN_MEM_WRITE EQU 80000000h ; Section is writeable.
|
|
|
|
|
|
|
|
|