114 lines
3.5 KiB
Rust
114 lines
3.5 KiB
Rust
use super::types::*;
|
|
use bitflags::bitflags;
|
|
#[repr(C)]
|
|
pub struct ImageDosHeader {
|
|
pub e_magic: u16, // Magic number 固定值 0x5A4D
|
|
pub e_cblp: u16,
|
|
pub e_cp: u16,
|
|
pub e_crlc: u16,
|
|
pub e_cparhdr: u16,
|
|
pub e_minalloc: u16,
|
|
pub e_maxalloc: u16,
|
|
pub e_ss: u16,
|
|
pub e_sp: u16,
|
|
pub e_csum: u16,
|
|
pub e_ip: u16,
|
|
pub e_cs: u16,
|
|
pub e_lfarlc: u16,
|
|
pub e_ovno: u16,
|
|
pub e_res: [u16; 4],
|
|
pub e_oemid: u16,
|
|
pub e_oeminfo: u16,
|
|
pub e_res2: [u16; 10],
|
|
pub e_lfanew: Offset, // File address of new exe header nt头的偏移
|
|
}
|
|
|
|
#[repr(C)]
|
|
pub struct ImageNTHeaders32 {
|
|
pub signature: u32,
|
|
pub file_header: ImageFileHeader,
|
|
pub optional_header: ImageOptionalHeader32,
|
|
}
|
|
|
|
#[repr(C)]
|
|
pub struct ImageFileHeader {
|
|
pub machine: u16,
|
|
pub number_of_sections: u16,
|
|
pub time_date_stamp: u32,
|
|
pub pointer_to_symbol_table: Offset,
|
|
pub number_of_symbols: u32,
|
|
pub size_of_optional_header: u16,
|
|
pub characteristics: FileCharacteristics,
|
|
}
|
|
bitflags! {
|
|
#[repr(C)]
|
|
pub struct FileCharacteristics: u16 {
|
|
const RELOCS_STRIPPED = 0x0001;
|
|
const EXECUTABLE_IMAGE = 0x0002;
|
|
const LINE_NUMS_STRIPPED = 0x0004;
|
|
const LOCAL_SYMS_STRIPPED = 0x0008;
|
|
const AGGRESSIVE_WS_TRIM = 0x0010;
|
|
const LARGE_ADDRESS_AWARE = 0x0020;
|
|
const BYTES_REVERSED_LO = 0x0080;
|
|
const MACHINE_32BIT = 0x0100;
|
|
const DEBUG_STRIPPED = 0x0200;
|
|
const REMOVABLE_RUN_FROM_SWAP = 0x0400;
|
|
const NET_RUN_FROM_SWAP = 0x0800;
|
|
const SYSTEM = 0x1000;
|
|
const DLL = 0x2000;
|
|
const UP_SYSTEM_ONLY = 0x4000;
|
|
const BYTES_REVERSED_HI = 0x8000;
|
|
}
|
|
#[repr(C)]
|
|
pub struct DLLCharacteristics: u16 {
|
|
const RESERVED1 = 0x0001;
|
|
const RESERVED2 = 0x0002;
|
|
const RESERVED4 = 0x0004;
|
|
const RESERVED8 = 0x0008;
|
|
const HIGH_ENTROPY_VA = 0x0020;
|
|
const DYNAMIC_BASE = 0x0040;
|
|
const FORCE_INTEGRITY = 0x0080;
|
|
const NX_COMPAT = 0x0100;
|
|
const NO_ISOLATION = 0x0200;
|
|
const NO_SEH = 0x0400;
|
|
const NO_BIND = 0x0800;
|
|
const APPCONTAINER = 0x1000;
|
|
const WDM_DRIVER = 0x2000;
|
|
const GUARD_CF = 0x4000;
|
|
const TERMINAL_SERVER_AWARE = 0x8000;
|
|
}
|
|
}
|
|
#[repr(C)]
|
|
pub struct ImageOptionalHeader32 {
|
|
pub magic: u16,
|
|
pub major_linker_version: u8,
|
|
pub minor_linker_version: u8,
|
|
pub size_of_code: u32,
|
|
pub size_of_initialized_data: u32,
|
|
pub size_of_uninitialized_data: u32,
|
|
pub address_of_entry_point: RVA,
|
|
pub base_of_code: RVA,
|
|
pub base_of_data: RVA,
|
|
pub image_base: u32,
|
|
pub section_alignment: u32,
|
|
pub file_alignment: u32,
|
|
pub major_operating_system_version: u16,
|
|
pub minor_operating_system_version: u16,
|
|
pub major_image_version: u16,
|
|
pub minor_image_version: u16,
|
|
pub major_subsystem_version: u16,
|
|
pub minor_subsystem_version: u16,
|
|
pub win32_version_value: u32,
|
|
pub size_of_image: u32,
|
|
pub size_of_headers: u32,
|
|
pub checksum: u32,
|
|
pub subsystem: u16,
|
|
pub dll_characteristics: DLLCharacteristics,
|
|
pub size_of_stack_reserve: u32,
|
|
pub size_of_stack_commit: u32,
|
|
pub size_of_heap_reserve: u32,
|
|
pub size_of_heap_commit: u32,
|
|
pub loader_flags: u32,
|
|
pub number_of_rva_and_sizes: u32,
|
|
}
|