use super::types::*; use bitflags::bitflags; #[repr(C)] pub struct ImageDosHeader { pub e_magic: u16, // Magic number 固定值 0x5A4D pub e_cblp: u16, pub e_cp: u16, pub e_crlc: u16, pub e_cparhdr: u16, pub e_minalloc: u16, pub e_maxalloc: u16, pub e_ss: u16, pub e_sp: u16, pub e_csum: u16, pub e_ip: u16, pub e_cs: u16, pub e_lfarlc: u16, pub e_ovno: u16, pub e_res: [u16; 4], pub e_oemid: u16, pub e_oeminfo: u16, pub e_res2: [u16; 10], pub e_lfanew: Offset, // File address of new exe header nt头的偏移 } #[repr(C)] pub struct ImageNTHeaders32 { pub signature: u32, pub file_header: ImageFileHeader, pub optional_header: ImageOptionalHeader32, } #[repr(C)] pub struct ImageFileHeader { pub machine: u16, pub number_of_sections: u16, pub time_date_stamp: u32, pub pointer_to_symbol_table: Offset, pub number_of_symbols: u32, pub size_of_optional_header: u16, pub characteristics: FileCharacteristics, } bitflags! { #[repr(C)] pub struct FileCharacteristics: u16 { const RELOCS_STRIPPED = 0x0001; const EXECUTABLE_IMAGE = 0x0002; const LINE_NUMS_STRIPPED = 0x0004; const LOCAL_SYMS_STRIPPED = 0x0008; const AGGRESSIVE_WS_TRIM = 0x0010; const LARGE_ADDRESS_AWARE = 0x0020; const BYTES_REVERSED_LO = 0x0080; const MACHINE_32BIT = 0x0100; const DEBUG_STRIPPED = 0x0200; const REMOVABLE_RUN_FROM_SWAP = 0x0400; const NET_RUN_FROM_SWAP = 0x0800; const SYSTEM = 0x1000; const DLL = 0x2000; const UP_SYSTEM_ONLY = 0x4000; const BYTES_REVERSED_HI = 0x8000; } #[repr(C)] pub struct DLLCharacteristics: u16 { const RESERVED1 = 0x0001; const RESERVED2 = 0x0002; const RESERVED4 = 0x0004; const RESERVED8 = 0x0008; const HIGH_ENTROPY_VA = 0x0020; const DYNAMIC_BASE = 0x0040; const FORCE_INTEGRITY = 0x0080; const NX_COMPAT = 0x0100; const NO_ISOLATION = 0x0200; const NO_SEH = 0x0400; const NO_BIND = 0x0800; const APPCONTAINER = 0x1000; const WDM_DRIVER = 0x2000; const GUARD_CF = 0x4000; const TERMINAL_SERVER_AWARE = 0x8000; } } #[repr(C)] pub struct ImageOptionalHeader32 { pub magic: u16, pub major_linker_version: u8, pub minor_linker_version: u8, pub size_of_code: u32, pub size_of_initialized_data: u32, pub size_of_uninitialized_data: u32, pub address_of_entry_point: RVA, pub base_of_code: RVA, pub base_of_data: RVA, pub image_base: u32, pub section_alignment: u32, pub file_alignment: u32, pub major_operating_system_version: u16, pub minor_operating_system_version: u16, pub major_image_version: u16, pub minor_image_version: u16, pub major_subsystem_version: u16, pub minor_subsystem_version: u16, pub win32_version_value: u32, pub size_of_image: u32, pub size_of_headers: u32, pub checksum: u32, pub subsystem: u16, pub dll_characteristics: DLLCharacteristics, pub size_of_stack_reserve: u32, pub size_of_stack_commit: u32, pub size_of_heap_reserve: u32, pub size_of_heap_commit: u32, pub loader_flags: u32, pub number_of_rva_and_sizes: u32, }