Fixes and optimizations in PE/COFF structures

This commit is contained in:
Rafal Kupiec 2022-11-01 19:11:12 +01:00
parent 2d5986b514
commit 72ec6819a6
Signed by: belliash
GPG Key ID: 4E829243E0CFE6B4
2 changed files with 37 additions and 73 deletions

View File

@ -19,6 +19,7 @@
#define PECOFF_IMAGE_OS2_SIGNATURE 0x454E /* NE */ #define PECOFF_IMAGE_OS2_SIGNATURE 0x454E /* NE */
#define PECOFF_IMAGE_OS2LE_SIGNATURE 0x454C /* LE */ #define PECOFF_IMAGE_OS2LE_SIGNATURE 0x454C /* LE */
#define PECOFF_IMAGE_VXD_SIGNATURE 0x454C /* LE */ #define PECOFF_IMAGE_VXD_SIGNATURE 0x454C /* LE */
#define PECOFF_IMAGE_EDOS_SIGNATURE 0x44454550 /* PEED */
#define PECOFF_IMAGE_NT_SIGNATURE 0x00004550 /* PE00 */ #define PECOFF_IMAGE_NT_SIGNATURE 0x00004550 /* PE00 */
#define PECOFF_IMAGE_XT_SIGNATURE 0x54584550 /* PEXT */ #define PECOFF_IMAGE_XT_SIGNATURE 0x54584550 /* PEXT */
@ -95,8 +96,8 @@
#define PECOFF_IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 #define PECOFF_IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
/* PE/COFF image HDR magic */ /* PE/COFF image HDR magic */
#define PECOFF_IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b #define PECOFF_IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10B
#define PECOFF_IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b #define PECOFF_IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20B
#define PECOFF_IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107 #define PECOFF_IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107
/* PE/COFF directory entries */ /* PE/COFF directory entries */
@ -185,6 +186,17 @@
#define PECOFF_IMAGE_SCN_MEM_READ 0x40000000 #define PECOFF_IMAGE_SCN_MEM_READ 0x40000000
#define PECOFF_IMAGE_SCN_MEM_WRITE 0x80000000 #define PECOFF_IMAGE_SCN_MEM_WRITE 0x80000000
/* PE/COFF image representation structure */
typedef struct _PECOFF_IMAGE_CONTEXT
{
PVOID Data;
PVOID BaseAddress;
ULONG NtSignature;
UINT64 FileSize;
UINT ImageSize;
UINT Pages;
} PECOFF_IMAGE_CONTEXT, *PPECOFF_IMAGE_CONTEXT;
/* PE/COFF directory format */ /* PE/COFF directory format */
typedef struct _PECOFF_IMAGE_DATA_DIRECTORY typedef struct _PECOFF_IMAGE_DATA_DIRECTORY
{ {
@ -338,8 +350,8 @@ typedef struct _PECOFF_IMAGE_SECTION_HEADER
ULONG Characteristics; ULONG Characteristics;
} PECOFF_IMAGE_SECTION_HEADER, *PPECOFF_IMAGE_SECTION_HEADER; } PECOFF_IMAGE_SECTION_HEADER, *PPECOFF_IMAGE_SECTION_HEADER;
/* 32-bit PE/COFF image optional header */ /* PE/COFF image optional header */
typedef struct _PECOFF_IMAGE_OPTIONAL_HEADER32 typedef struct _PECOFF_IMAGE_OPTIONAL_HEADER
{ {
USHORT Magic; USHORT Magic;
UCHAR MajorLinkerVersion; UCHAR MajorLinkerVersion;
@ -349,8 +361,15 @@ typedef struct _PECOFF_IMAGE_OPTIONAL_HEADER32
ULONG SizeOfUninitializedData; ULONG SizeOfUninitializedData;
ULONG AddressOfEntryPoint; ULONG AddressOfEntryPoint;
ULONG BaseOfCode; ULONG BaseOfCode;
union
{
struct
{
ULONG BaseOfData; ULONG BaseOfData;
ULONG ImageBase; ULONG ImageBase32;
};
ULONGLONG ImageBase64;
};
ULONG SectionAlignment; ULONG SectionAlignment;
ULONG FileAlignment; ULONG FileAlignment;
USHORT MajorOperatingSystemVersion; USHORT MajorOperatingSystemVersion;
@ -372,42 +391,7 @@ typedef struct _PECOFF_IMAGE_OPTIONAL_HEADER32
ULONG LoaderFlags; ULONG LoaderFlags;
ULONG NumberOfRvaAndSizes; ULONG NumberOfRvaAndSizes;
PECOFF_IMAGE_DATA_DIRECTORY DataDirectory[PECOFF_IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; PECOFF_IMAGE_DATA_DIRECTORY DataDirectory[PECOFF_IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} PECOFF_IMAGE_OPTIONAL_HEADER32, *PPECOFF_IMAGE_OPTIONAL_HEADER32; } PECOFF_IMAGE_OPTIONAL_HEADER, *PPECOFF_IMAGE_OPTIONAL_HEADER;
/* 64-bit PE/COFF image optional header */
typedef struct _PECOFF_IMAGE_OPTIONAL_HEADER64
{
USHORT Magic;
UCHAR MajorLinkerVersion;
UCHAR MinorLinkerVersion;
ULONG SizeOfCode;
ULONG SizeOfInitializedData;
ULONG SizeOfUninitializedData;
ULONG AddressOfEntryPoint;
ULONG BaseOfCode;
ULONGLONG ImageBase;
ULONG SectionAlignment;
ULONG FileAlignment;
USHORT MajorOperatingSystemVersion;
USHORT MinorOperatingSystemVersion;
USHORT MajorImageVersion;
USHORT MinorImageVersion;
USHORT MajorSubsystemVersion;
USHORT MinorSubsystemVersion;
ULONG Win32VersionValue;
ULONG SizeOfImage;
ULONG SizeOfHeaders;
ULONG CheckSum;
USHORT Subsystem;
USHORT DllCharacteristics;
ULONGLONG SizeOfStackReserve;
ULONGLONG SizeOfStackCommit;
ULONGLONG SizeOfHeapReserve;
ULONGLONG SizeOfHeapCommit;
ULONG LoaderFlags;
ULONG NumberOfRvaAndSizes;
PECOFF_IMAGE_DATA_DIRECTORY DataDirectory[PECOFF_IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} PECOFF_IMAGE_OPTIONAL_HEADER64, *PPECOFF_IMAGE_OPTIONAL_HEADER64;
/* PE/COFF ROM optional header */ /* PE/COFF ROM optional header */
typedef struct _PECOFF_IMAGE_ROM_OPTIONAL_HEADER typedef struct _PECOFF_IMAGE_ROM_OPTIONAL_HEADER
@ -427,38 +411,19 @@ typedef struct _PECOFF_IMAGE_ROM_OPTIONAL_HEADER
ULONG GpValue; ULONG GpValue;
} PECOFF_IMAGE_ROM_OPTIONAL_HEADER, *PPECOFF_IMAGE_ROM_OPTIONAL_HEADER; } PECOFF_IMAGE_ROM_OPTIONAL_HEADER, *PPECOFF_IMAGE_ROM_OPTIONAL_HEADER;
/* PE/COFF NT image headers */ /* PE/COFF NT image header */
typedef struct _PECOFF_IMAGE_NT_HEADERS typedef struct _PECOFF_IMAGE_NT_HEADER
{ {
ULONG Signature; ULONG Signature;
PECOFF_IMAGE_FILE_HEADER FileHeader; PECOFF_IMAGE_FILE_HEADER FileHeader;
union PECOFF_IMAGE_OPTIONAL_HEADER OptionalHeader;
{ } PECOFF_IMAGE_NT_HEADER, *PPECOFF_IMAGE_NT_HEADER;
PECOFF_IMAGE_OPTIONAL_HEADER32 OptionalHeader32;
PECOFF_IMAGE_OPTIONAL_HEADER32 OptionalHeader64;
};
} PECOFF_IMAGE_NT_HEADERS, *PPECOFF_IMAGE_NT_HEADERS;
/* 32-bit PE/COFF NT image headers */ /* PE/COFF ROM image header */
typedef struct _PECOFF_IMAGE_NT_HEADERS32 typedef struct _PECOFF_IMAGE_ROM_HEADER {
{
ULONG Signature;
PECOFF_IMAGE_FILE_HEADER FileHeader;
PECOFF_IMAGE_OPTIONAL_HEADER32 OptionalHeader;
} PECOFF_IMAGE_NT_HEADERS32, *PPECOFF_IMAGE_NT_HEADERS32;
/* 64-bit PE/COFF NT image headers */
typedef struct _PECOFF_IMAGE_NT_HEADERS64 {
ULONG Signature;
PECOFF_IMAGE_FILE_HEADER FileHeader;
PECOFF_IMAGE_OPTIONAL_HEADER64 OptionalHeader;
} PECOFF_IMAGE_NT_HEADERS64, *PPECOFF_IMAGE_NT_HEADERS64;
/* PE/COFF ROM image headers */
typedef struct _PECOFF_IMAGE_ROM_HEADERS {
PECOFF_IMAGE_FILE_HEADER FileHeader; PECOFF_IMAGE_FILE_HEADER FileHeader;
PECOFF_IMAGE_ROM_OPTIONAL_HEADER OptionalHeader; PECOFF_IMAGE_ROM_OPTIONAL_HEADER OptionalHeader;
} PECOFF_IMAGE_ROM_HEADERS, *PPECOFF_IMAGE_ROM_HEADERS; } PECOFF_IMAGE_ROM_HEADER, *PPECOFF_IMAGE_ROM_HEADER;
/* PE/COFF based relocation format */ /* PE/COFF based relocation format */
typedef struct _PECOFF_IMAGE_BASE_RELOCATION typedef struct _PECOFF_IMAGE_BASE_RELOCATION

View File

@ -147,6 +147,7 @@ typedef struct _LIST_ENTRY LIST_ENTRY, *PLIST_ENTRY;
typedef struct _LIST_ENTRY32 LIST_ENTRY32, *PLIST_ENTRY32; typedef struct _LIST_ENTRY32 LIST_ENTRY32, *PLIST_ENTRY32;
typedef struct _LIST_ENTRY64 LIST_ENTRY64, *PLIST_ENTRY64; typedef struct _LIST_ENTRY64 LIST_ENTRY64, *PLIST_ENTRY64;
typedef struct _PECOFF_IMAGE_BASE_RELOCATION PECOFF_IMAGE_BASE_RELOCATION, *PPECOFF_IMAGE_BASE_RELOCATION; typedef struct _PECOFF_IMAGE_BASE_RELOCATION PECOFF_IMAGE_BASE_RELOCATION, *PPECOFF_IMAGE_BASE_RELOCATION;
typedef struct _PECOFF_IMAGE_DATA PECOFF_IMAGE_DATA, *PPECOFF_IMAGE_DATA;
typedef struct _PECOFF_IMAGE_DATA_DIRECTORY PECOFF_IMAGE_DATA_DIRECTORY, *PPECOFF_IMAGE_DATA_DIRECTORY; typedef struct _PECOFF_IMAGE_DATA_DIRECTORY PECOFF_IMAGE_DATA_DIRECTORY, *PPECOFF_IMAGE_DATA_DIRECTORY;
typedef struct _PECOFF_IMAGE_DOS_HEADER PECOFF_IMAGE_DOS_HEADER, *PPECOFF_IMAGE_DOS_HEADER; typedef struct _PECOFF_IMAGE_DOS_HEADER PECOFF_IMAGE_DOS_HEADER, *PPECOFF_IMAGE_DOS_HEADER;
typedef struct _PECOFF_IMAGE_EXPORT_DIRECTORY PECOFF_IMAGE_EXPORT_DIRECTORY, *PPECOFF_IMAGE_EXPORT_DIRECTORY; typedef struct _PECOFF_IMAGE_EXPORT_DIRECTORY PECOFF_IMAGE_EXPORT_DIRECTORY, *PPECOFF_IMAGE_EXPORT_DIRECTORY;
@ -155,15 +156,13 @@ typedef struct _PECOFF_IMAGE_IMPORT_DESCRIPTOR PECOFF_IMAGE_IMPORT_DESCRIPTOR, *
typedef struct _PECOFF_IMAGE_LOAD_CONFIG_CODE_INTEGRITY PECOFF_IMAGE_LOAD_CONFIG_CODE_INTEGRITY, *PPECOFF_IMAGE_LOAD_CONFIG_CODE_INTEGRITY; typedef struct _PECOFF_IMAGE_LOAD_CONFIG_CODE_INTEGRITY PECOFF_IMAGE_LOAD_CONFIG_CODE_INTEGRITY, *PPECOFF_IMAGE_LOAD_CONFIG_CODE_INTEGRITY;
typedef struct _PECOFF_IMAGE_LOAD_CONFIG_DIRECTORY32 PECOFF_IMAGE_LOAD_CONFIG_DIRECTORY32, *PPECOFF_IMAGE_LOAD_CONFIG_DIRECTORY32; typedef struct _PECOFF_IMAGE_LOAD_CONFIG_DIRECTORY32 PECOFF_IMAGE_LOAD_CONFIG_DIRECTORY32, *PPECOFF_IMAGE_LOAD_CONFIG_DIRECTORY32;
typedef struct _PECOFF_IMAGE_LOAD_CONFIG_DIRECTORY64 PECOFF_IMAGE_LOAD_CONFIG_DIRECTORY64, *PPECOFF_IMAGE_LOAD_CONFIG_DIRECTORY64; typedef struct _PECOFF_IMAGE_LOAD_CONFIG_DIRECTORY64 PECOFF_IMAGE_LOAD_CONFIG_DIRECTORY64, *PPECOFF_IMAGE_LOAD_CONFIG_DIRECTORY64;
typedef struct _PECOFF_IMAGE_NT_HEADERS32 PECOFF_IMAGE_NT_HEADERS32, *PPECOFF_IMAGE_NT_HEADERS32; typedef struct _PECOFF_IMAGE_NT_HEADER PECOFF_IMAGE_NT_HEADER, *PPECOFF_IMAGE_NT_HEADER;
typedef struct _PECOFF_IMAGE_NT_HEADERS64 PECOFF_IMAGE_NT_HEADERS64, *PPECOFF_IMAGE_NT_HEADERS64; typedef struct _PECOFF_IMAGE_OPTIONAL_HEADER PECOFF_IMAGE_OPTIONAL_HEADER, *PPECOFF_IMAGE_OPTIONAL_HEADER;
typedef struct _PECOFF_IMAGE_OPTIONAL_HEADER32 PECOFF_IMAGE_OPTIONAL_HEADER32, *PPECOFF_IMAGE_OPTIONAL_HEADER32;
typedef struct _PECOFF_IMAGE_OPTIONAL_HEADER64 PECOFF_IMAGE_OPTIONAL_HEADER64, *PPECOFF_IMAGE_OPTIONAL_HEADER64;
typedef struct _PECOFF_IMAGE_OS2_HEADER PECOFF_IMAGE_OS2_HEADER, *PPECOFF_IMAGE_OS2_HEADER; typedef struct _PECOFF_IMAGE_OS2_HEADER PECOFF_IMAGE_OS2_HEADER, *PPECOFF_IMAGE_OS2_HEADER;
typedef struct _PECOFF_IMAGE_RESOURCE_DATA_ENTRY PECOFF_IMAGE_RESOURCE_DATA_ENTRY, *PPECOFF_IMAGE_RESOURCE_DATA_ENTRY; typedef struct _PECOFF_IMAGE_RESOURCE_DATA_ENTRY PECOFF_IMAGE_RESOURCE_DATA_ENTRY, *PPECOFF_IMAGE_RESOURCE_DATA_ENTRY;
typedef struct _PECOFF_IMAGE_RESOURCE_DIRECTORY PECOFF_IMAGE_RESOURCE_DIRECTORY, *PPECOFF_IMAGE_RESOURCE_DIRECTORY; typedef struct _PECOFF_IMAGE_RESOURCE_DIRECTORY PECOFF_IMAGE_RESOURCE_DIRECTORY, *PPECOFF_IMAGE_RESOURCE_DIRECTORY;
typedef struct _PECOFF_IMAGE_RESOURCE_DIRECTORY_ENTRY PECOFF_IMAGE_RESOURCE_DIRECTORY_ENTRY, *PPECOFF_IMAGE_RESOURCE_DIRECTORY_ENTRY; typedef struct _PECOFF_IMAGE_RESOURCE_DIRECTORY_ENTRY PECOFF_IMAGE_RESOURCE_DIRECTORY_ENTRY, *PPECOFF_IMAGE_RESOURCE_DIRECTORY_ENTRY;
typedef struct _PECOFF_IMAGE_ROM_HEADERS PECOFF_IMAGE_ROM_HEADERS, *PPECOFF_IMAGE_ROM_HEADERS; typedef struct _PECOFF_IMAGE_ROM_HEADER PECOFF_IMAGE_ROM_HEADER, *PPECOFF_IMAGE_ROM_HEADER;
typedef struct _PECOFF_IMAGE_ROM_OPTIONAL_HEADER PECOFF_IMAGE_ROM_OPTIONAL_HEADER, *PPECOFF_IMAGE_ROM_OPTIONAL_HEADER; typedef struct _PECOFF_IMAGE_ROM_OPTIONAL_HEADER PECOFF_IMAGE_ROM_OPTIONAL_HEADER, *PPECOFF_IMAGE_ROM_OPTIONAL_HEADER;
typedef struct _PECOFF_IMAGE_SECTION_HEADER PECOFF_IMAGE_SECTION_HEADER, *PPECOFF_IMAGE_SECTION_HEADER; typedef struct _PECOFF_IMAGE_SECTION_HEADER PECOFF_IMAGE_SECTION_HEADER, *PPECOFF_IMAGE_SECTION_HEADER;
typedef struct _PECOFF_IMAGE_VXD_HEADER PECOFF_IMAGE_VXD_HEADER, *PPECOFF_IMAGE_VXD_HEADER; typedef struct _PECOFF_IMAGE_VXD_HEADER PECOFF_IMAGE_VXD_HEADER, *PPECOFF_IMAGE_VXD_HEADER;