; Image Format

IMAGE_DOS_SIGNATURE                 = 5A4Dh      ; MZ
IMAGE_OS2_SIGNATURE                 = 454Eh      ; NE
IMAGE_OS2_SIGNATURE_LE              = 454Ch      ; LE
IMAGE_VXD_SIGNATURE                 = 454Ch      ; LE
IMAGE_NT_SIGNATURE                  = 00004550h  ; PE00


IMAGE_DOS_HEADER	STRUCT					; DOS .EXE header
	e_magic		WORD		?                     ; Magic number
	e_cblp		WORD		?                      ; Bytes on last page of file
	e_cp			WORD		?                      ; Pages in file
	e_crlc		WORD		?                      ; Relocations
	e_cparhdr		WORD		?                   ; Size of header in paragraphs
	e_minalloc	WORD		?                  ; Minimum extra paragraphs needed
	e_maxalloc	WORD		?                  ; Maximum extra paragraphs needed
	e_ss			WORD		?                     ; Initial (relative) SS value
	e_sp			WORD		?                     ; Initial SP value
	e_csum		WORD		?                      ; Checksum
	e_ip			WORD		?                     ; Initial IP value
	e_cs			WORD		?                      ; Initial (relative) CS value
	e_lfarlc		WORD		?                    ; File address of relocation table
	e_ovno		WORD		?                     ; Overlay number
	e_res		WORD		4	dup(?)            ; Reserved words
	e_oemid		WORD		?                     ; OEM identifier (for e_oeminfo)
	e_oeminfo		WORD		?                      ; OEM information; e_oemid specific
	e_res2		WORD		10	dup(?)            ; Reserved words
	e_lfanew		DWORD     ?                     ; File address of new exe header
IMAGE_DOS_HEADER	ENDS




; File header format.

IMAGE_FILE_HEADER	STRUCT
	FHMachine				WORD		?	
	FHNumberOfSections		WORD		?
	FHTimeDateStamp		DWORD	?
	FHPointerToSymbolTable	DWORD	?
	FHNumberOfSymbols		DWORD	?
	FHSizeOfOptionalHeader	WORD		?
	FHCharacteristics		WORD		?
IMAGE_FILE_HEADER	ENDS
IMAGE_SIZEOF_FILE_HEADER             = 20


IMAGE_FILE_RELOCS_STRIPPED           = 0001h  ; Relocation info stripped from file.
IMAGE_FILE_EXECUTABLE_IMAGE          = 0002h  ; File is executable  (i.e. no unresolved externel references).
IMAGE_FILE_LINE_NUMS_STRIPPED        = 0004h  ; Line nunbers stripped from file.
IMAGE_FILE_LOCAL_SYMS_STRIPPED       = 0008h  ; Local symbols stripped from file.
IMAGE_FILE_AGGRESIVE_WS_TRIM         = 0010h  ; Agressively trim working set
IMAGE_FILE_BYTES_REVERSED_LO         = 0080h  ; Bytes of machine word are reversed.
IMAGE_FILE_32BIT_MACHINE             = 0100h  ; 32 bit word machine.
IMAGE_FILE_DEBUG_STRIPPED            = 0200h  ; Debugging info stripped from file in .DBG file
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP   = 0400h  ; If Image is on removable media, copy and run from the swap file.
IMAGE_FILE_NET_RUN_FROM_SWAP         = 0800h  ; If Image is on Net, copy and run from the swap file.
IMAGE_FILE_SYSTEM                    = 1000h  ; System File.
IMAGE_FILE_DLL                       = 2000h  ; File is a DLL.
IMAGE_FILE_UP_SYSTEM_ONLY            = 4000h  ; File should only be run on a UP machine
IMAGE_FILE_BYTES_REVERSED_HI         = 8000h  ; Bytes of machine word are reversed.

IMAGE_FILE_MACHINE_UNKNOWN           = 0
IMAGE_FILE_MACHINE_I386              = 14ch   ; Intel 386.
IMAGE_FILE_MACHINE_R3000             = 162h   ; MIPS little-endian, = 160 big-endian
IMAGE_FILE_MACHINE_R4000             = 166h   ; MIPS little-endian
IMAGE_FILE_MACHINE_R10000            = 168h   ; MIPS little-endian
IMAGE_FILE_MACHINE_ALPHA             = 184h   ; Alpha_AXP
IMAGE_FILE_MACHINE_POWERPC           = 1F0h   ; IBM PowerPC Little-Endian



; Directory format.

IMAGE_DATA_DIRECTORY	STRUCT
	DDVirtualAddress			DWORD		?
	DDSize					DWORD		?
IMAGE_DATA_DIRECTORY	ENDS

IMAGE_NUMBEROF_DIRECTORY_ENTRIES    = 16



IMAGE_DIRECTORY_ENTRIES	STRUCT

Dir_Export		IMAGE_DATA_DIRECTORY	?	; 0   ; Export Directory
Dir_Import		IMAGE_DATA_DIRECTORY	?	; 1   ; Import Directory
Dir_Resource		IMAGE_DATA_DIRECTORY	?	; 2   ; Resource Directory
Dir_Exception		IMAGE_DATA_DIRECTORY	?	; 3   ; Exception Directory
Dir_Security		IMAGE_DATA_DIRECTORY	?	; 4   ; Security Directory
Dir_BaseReloc		IMAGE_DATA_DIRECTORY	?	; 5   ; Base Relocation Table
Dir_Debug			IMAGE_DATA_DIRECTORY	?	; 6   ; Debug Directory
Dir_Copyright		IMAGE_DATA_DIRECTORY	?	; 7   ; Description String
Dir_GlobalPtr		IMAGE_DATA_DIRECTORY	?	; 8   ; Machine Value (MIPS GP)
Dir_TLS			IMAGE_DATA_DIRECTORY	?	; 9   ; TLS Directory
Dir_LoadConfig		IMAGE_DATA_DIRECTORY	?	; 10  ; Load Configuration Directory
Dir_BoundImport	IMAGE_DATA_DIRECTORY	?	; 11  ; Bound Import Directory in headers
Dir_IAT			IMAGE_DATA_DIRECTORY	?	; 12  ; Import Address Table
Dir_DelayImport	IMAGE_DATA_DIRECTORY	?	; 13	 ; Delay Import 
Dir_COM			IMAGE_DATA_DIRECTORY	?	; 14	 ; COM descriptor 
Dir_15			IMAGE_DATA_DIRECTORY	?	; 15	 ; ?

IMAGE_DIRECTORY_ENTRIES	ENDS




; Optional header format.

IMAGE_OPTIONAL_HEADER	STRUCT

    ; Standard fields.
	OHMagic						WORD				?
	OHMajorLinkerVersion			BYTE				?
	OHMinorLinkerVersion			BYTE				?
	OHSizeOfCode					DWORD			?
	OHSizeOfInitializedData			DWORD			?
	OHSizeOfUninitializedData		DWORD			?
	OHAddressOfEntryPoint			DWORD			?
	OHBaseOfCode					DWORD			?
	OHBaseOfData					DWORD			?

    ; NT additional fields.
	OHImageBase					DWORD			?
	OHSectionAlignment				DWORD			?
	OHFileAlignment				DWORD			?
	OHMajorOperatingSystemVersion	WORD				?
	OHMinorOperatingSystemVersion	WORD				?
	OHMajorImageVersion				WORD				?
	OHMinorImageVersion				WORD				?
	OHMajorSubsystemVersion			WORD				?
	OHMinorSubsystemVersion			WORD				?
	OHWin32VersionValue				DWORD			?
	OHSizeOfImage					DWORD			?
	OHSizeOfHeaders				DWORD			?
	OHCheckSum					DWORD			?
	OHSubsystem					WORD				?
	OHCharacteristics				WORD				?
	OHSizeOfStackReserve			DWORD			?
	OHSizeOfStackCommit				DWORD			?
	OHSizeOfHeapReserve				DWORD			?
	OHSizeOfHeapCommit				DWORD			?
	OHLoaderFlags					DWORD			?
	OHNumberOfRvaAndSizes			DWORD			?
	OHDataDirectory				IMAGE_DIRECTORY_ENTRIES		?
IMAGE_OPTIONAL_HEADER	ENDS


IMAGE_NT_HEADERS	STRUCT
	NTSignature			DWORD				?
	NTFileHeader			IMAGE_FILE_HEADER		?
	NTOptionalHeader		IMAGE_OPTIONAL_HEADER	?
IMAGE_NT_HEADERS	ENDS



; Section header format.

IMAGE_SIZEOF_SHORT_NAME              = 8

IMAGE_SECTION_HEADER	STRUCT
	SHName					db		IMAGE_SIZEOF_SHORT_NAME		dup (?)
	SHVirtualSize				DWORD	?
	SHVirtualAddress			DWORD	?
	SHSizeOfRawData			DWORD	?
	SHPointerToRawData			DWORD	?
	SHPointerToRelocations		DWORD	?
	SHPointerToLinenumbers		DWORD	?
	SHNumberOfRelocations		WORD		?
	SHNumberOfLinenumbers		WORD		?
	SHCharacteristics			DWORD	?
IMAGE_SECTION_HEADER	ENDS

IMAGE_SIZEOF_SECTION_HEADER          = 40



; Section characteristics.

IMAGE_SCN_TYPE_NO_PAD                = 00000008h  ; Reserved.

IMAGE_SCN_CNT_CODE                   = 00000020h  ; Section contains code.
IMAGE_SCN_CNT_INITIALIZED_DATA       = 00000040h  ; Section contains initialized data.
IMAGE_SCN_CNT_UNINITIALIZED_DATA     = 00000080h  ; Section contains uninitialized data.

IMAGE_SCN_LNK_OTHER                  = 00000100h  ; Reserved.
IMAGE_SCN_LNK_INFO                   = 00000200h  ; Section contains comments or some other type of information.
IMAGE_SCN_LNK_REMOVE                 = 00000800h  ; Section contents will not become part of image.
IMAGE_SCN_LNK_COMDAT                 = 00001000h  ; Section contents comdat.


IMAGE_SCN_MEM_FARDATA                = 00008000h
IMAGE_SCN_MEM_PURGEABLE              = 00020000h
IMAGE_SCN_MEM_16BIT                  = 00020000h
IMAGE_SCN_MEM_LOCKED                 = 00040000h
IMAGE_SCN_MEM_PRELOAD                = 00080000h

IMAGE_SCN_ALIGN_1BYTES               = 00100000h  ;
IMAGE_SCN_ALIGN_2BYTES               = 00200000h  ;
IMAGE_SCN_ALIGN_4BYTES               = 00300000h  ;
IMAGE_SCN_ALIGN_8BYTES               = 00400000h  ;
IMAGE_SCN_ALIGN_16BYTES              = 00500000h  ; Default alignment if no others are specified.
IMAGE_SCN_ALIGN_32BYTES              = 00600000h  ;
IMAGE_SCN_ALIGN_64BYTES              = 00700000h  ;

IMAGE_SCN_LNK_NRELOC_OVFL            = 01000000h  ; Section contains extended relocations.
IMAGE_SCN_MEM_DISCARDABLE            = 02000000h  ; Section can be discarded.
IMAGE_SCN_MEM_NOT_CACHED             = 04000000h  ; Section is not cachable.
IMAGE_SCN_MEM_NOT_PAGED              = 08000000h  ; Section is not pageable.
IMAGE_SCN_MEM_SHARED                 = 10000000h  ; Section is shareable.
IMAGE_SCN_MEM_EXECUTE                = 20000000h  ; Section is executable.
IMAGE_SCN_MEM_READ                   = 40000000h  ; Section is readable.
IMAGE_SCN_MEM_WRITE                  = 80000000h  ; Section is writeable.





; ***  DLL support ***

; Export Format

IMAGE_EXPORT_DIRECTORY	STRUCT
	EDCharacteristics			DWORD		?
	EDTimeDateStamp			DWORD		?
	EDMajorVersion				WORD			?
	EDMinorVersion				WORD			?
	EDName					DWORD		?
	EDBase					DWORD		?
	EDNumberOfFunctions			DWORD		?
	EDNumberOfNames			DWORD		?
	EDAddressOfFunctions		DWORD		?
	EDAddressOfNames			DWORD		?
	EDAddressOfNameOrdinals		DWORD		?
IMAGE_EXPORT_DIRECTORY	ENDS


_SECTION_QUERY       = 0001h
_SECTION_MAP_WRITE   = 0002h
_SECTION_MAP_READ    = 0004h
_SECTION_MAP_EXECUTE = 0008h
_SECTION_EXTEND_SIZE = 0010h
;_SECTION_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED + SECTION_QUER + SECTION_MAP_WRITE + SECTION_MAP_READ + SECTION_MAP_EXECUTE + SECTION_EXTEND_SIZE)

PAGE_NOACCESS          = 01h     
PAGE_READONLY          = 02h     
PAGE_READWRITE         = 04h     
PAGE_WRITECOPY         = 08h     
PAGE_EXECUTE           = 10h     
PAGE_EXECUTE_READ      = 20h     
PAGE_EXECUTE_READWRITE = 40h     
PAGE_EXECUTE_WRITECOPY = 80h     
PAGE_GUARD            = 100h     
PAGE_NOCACHE          = 200h     
MEM_COMMIT           = 1000h     
MEM_RESERVE          = 2000h     
MEM_DECOMMIT         = 4000h     
MEM_RELEASE          = 8000h     
MEM_FREE            = 10000h     
MEM_PRIVATE         = 20000h     
MEM_MAPPED          = 40000h    
MEM_RESET           = 80000h     
MEM_TOP_DOWN       = 100000h     
SEC_FILE           = 800000h     
SEC_IMAGE         = 1000000h     
SEC_RESERVE       = 4000000h     
SEC_COMMIT        = 8000000h     
SEC_NOCACHE      = 10000000h     
MEM_IMAGE         = SEC_IMAGE   

