1#ifndef _NTIMAGE_ 2#define _NTIMAGE_ 3 4// 5// Image Formats 6// 7#define IMAGE_DOS_SIGNATURE 0x5A4D 8#define IMAGE_OS2_SIGNATURE 0x454E 9#define IMAGE_OS2_SIGNATURE_LE 0x454C 10#define IMAGE_VXD_SIGNATURE 0x454C 11#define IMAGE_NT_SIGNATURE 0x00004550 12 13// 14// Image architectures 15// 16#define IMAGE_FILE_MACHINE_AM33 0x1d3 17#define IMAGE_FILE_MACHINE_AMD64 0x8664 18#define IMAGE_FILE_MACHINE_ARM 0x1c0 19#define IMAGE_FILE_MACHINE_ARMV7 0x1c4 20#define IMAGE_FILE_MACHINE_EBC 0xebc 21#define IMAGE_FILE_MACHINE_I386 0x14c 22#define IMAGE_FILE_MACHINE_IA64 0x200 23#define IMAGE_FILE_MACHINE_M32R 0x9041 24#define IMAGE_FILE_MACHINE_MIPS16 0x266 25#define IMAGE_FILE_MACHINE_MIPSFPU 0x366 26#define IMAGE_FILE_MACHINE_MIPSFPU16 0x466 27#define IMAGE_FILE_MACHINE_POWERPC 0x1f0 28#define IMAGE_FILE_MACHINE_POWERPCFP 0x1f1 29#define IMAGE_FILE_MACHINE_R4000 0x166 30#define IMAGE_FILE_MACHINE_SH3 0x1a2 31#define IMAGE_FILE_MACHINE_SH3E 0x01a4 32#define IMAGE_FILE_MACHINE_SH3DSP 0x1a3 33#define IMAGE_FILE_MACHINE_SH4 0x1a6 34#define IMAGE_FILE_MACHINE_SH5 0x1a8 35#define IMAGE_FILE_MACHINE_THUMB 0x1c2 36#define IMAGE_FILE_MACHINE_WCEMIPSV2 0x169 37#define IMAGE_FILE_MACHINE_R3000 0x162 38#define IMAGE_FILE_MACHINE_R10000 0x168 39#define IMAGE_FILE_MACHINE_ALPHA 0x184 40#define IMAGE_FILE_MACHINE_ALPHA64 0x0284 41#define IMAGE_FILE_MACHINE_AXP64 IMAGE_FILE_MACHINE_ALPHA64 42#define IMAGE_FILE_MACHINE_CEE 0xC0EE 43#define IMAGE_FILE_MACHINE_TRICORE 0x0520 44#define IMAGE_FILE_MACHINE_CEF 0x0CEF 45 46 47// 48// DOS Image Header Format 49// 50#include <pshpack2.h> 51typedef struct _IMAGE_DOS_HEADER { 52 USHORT e_magic; 53 USHORT e_cblp; 54 USHORT e_cp; 55 USHORT e_crlc; 56 USHORT e_cparhdr; 57 USHORT e_minalloc; 58 USHORT e_maxalloc; 59 USHORT e_ss; 60 USHORT e_sp; 61 USHORT e_csum; 62 USHORT e_ip; 63 USHORT e_cs; 64 USHORT e_lfarlc; 65 USHORT e_ovno; 66 USHORT e_res[4]; 67 USHORT e_oemid; 68 USHORT e_oeminfo; 69 USHORT e_res2[10]; 70 LONG e_lfanew; 71} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER; 72#include <poppack.h> 73 74 75// 76// Export/Import Format 77// 78#include <pshpack4.h> 79typedef struct _IMAGE_EXPORT_DIRECTORY { 80 ULONG Characteristics; 81 ULONG TimeDateStamp; 82 USHORT MajorVersion; 83 USHORT MinorVersion; 84 ULONG Name; 85 ULONG Base; 86 ULONG NumberOfFunctions; 87 ULONG NumberOfNames; 88 ULONG AddressOfFunctions; 89 ULONG AddressOfNames; 90 ULONG AddressOfNameOrdinals; 91} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY; 92 93 94// 95// Resource Data Entry Format 96// 97typedef struct _IMAGE_RESOURCE_DATA_ENTRY { 98 ULONG OffsetToData; 99 ULONG Size; 100 ULONG CodePage; 101 ULONG Reserved; 102} IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY; 103 104 105// 106// Load Configuration Directory Entry Format 107// 108typedef struct { 109 ULONG Size; 110 ULONG TimeDateStamp; 111 USHORT MajorVersion; 112 USHORT MinorVersion; 113 ULONG GlobalFlagsClear; 114 ULONG GlobalFlagsSet; 115 ULONG CriticalSectionDefaultTimeout; 116 ULONG DeCommitFreeBlockThreshold; 117 ULONG DeCommitTotalFreeThreshold; 118 ULONG LockPrefixTable; 119 ULONG MaximumAllocationSize; 120 ULONG VirtualMemoryThreshold; 121 ULONG ProcessHeapFlags; 122 ULONG ProcessAffinityMask; 123 USHORT CSDVersion; 124 USHORT Reserved1; 125 ULONG EditList; 126 ULONG SecurityCookie; 127 ULONG SEHandlerTable; 128 ULONG SEHandlerCount; 129} IMAGE_LOAD_CONFIG_DIRECTORY32, *PIMAGE_LOAD_CONFIG_DIRECTORY32; 130 131typedef struct { 132 ULONG Size; 133 ULONG TimeDateStamp; 134 USHORT MajorVersion; 135 USHORT MinorVersion; 136 ULONG GlobalFlagsClear; 137 ULONG GlobalFlagsSet; 138 ULONG CriticalSectionDefaultTimeout; 139 ULONGLONG DeCommitFreeBlockThreshold; 140 ULONGLONG DeCommitTotalFreeThreshold; 141 ULONGLONG LockPrefixTable; 142 ULONGLONG MaximumAllocationSize; 143 ULONGLONG VirtualMemoryThreshold; 144 ULONGLONG ProcessAffinityMask; 145 ULONG ProcessHeapFlags; 146 USHORT CSDVersion; 147 USHORT Reserved1; 148 ULONGLONG EditList; 149 ULONGLONG SecurityCookie; 150 ULONGLONG SEHandlerTable; 151 ULONGLONG SEHandlerCount; 152} IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64; 153 154#ifdef _WIN64 155typedef IMAGE_LOAD_CONFIG_DIRECTORY64 IMAGE_LOAD_CONFIG_DIRECTORY; 156typedef PIMAGE_LOAD_CONFIG_DIRECTORY64 PIMAGE_LOAD_CONFIG_DIRECTORY; 157#else 158typedef IMAGE_LOAD_CONFIG_DIRECTORY32 IMAGE_LOAD_CONFIG_DIRECTORY; 159typedef PIMAGE_LOAD_CONFIG_DIRECTORY32 PIMAGE_LOAD_CONFIG_DIRECTORY; 160#endif 161 162 163// 164// Base Relocation Format 165// 166typedef struct _IMAGE_BASE_RELOCATION { 167 ULONG VirtualAddress; 168 ULONG SizeOfBlock; 169} IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION; 170 171 172// 173// Resource Format 174// 175typedef struct _IMAGE_RESOURCE_DIRECTORY { 176 ULONG Characteristics; 177 ULONG TimeDateStamp; 178 USHORT MajorVersion; 179 USHORT MinorVersion; 180 USHORT NumberOfNamedEntries; 181 USHORT NumberOfIdEntries; 182} IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY; 183 184typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING { 185 USHORT Length; 186 CHAR NameString[ANYSIZE_ARRAY]; 187} IMAGE_RESOURCE_DIRECTORY_STRING, *PIMAGE_RESOURCE_DIRECTORY_STRING; 188 189 190// 191// Section Header Format 192// 193#define IMAGE_SIZEOF_SHORT_NAME 8 194#define IMAGE_SIZEOF_SECTION_HEADER 40 195 196typedef struct _IMAGE_SECTION_HEADER { 197 UCHAR Name[IMAGE_SIZEOF_SHORT_NAME]; 198 union 199 { 200 ULONG PhysicalAddress; 201 ULONG VirtualSize; 202 } Misc; 203 ULONG VirtualAddress; 204 ULONG SizeOfRawData; 205 ULONG PointerToRawData; 206 ULONG PointerToRelocations; 207 ULONG PointerToLinenumbers; 208 USHORT NumberOfRelocations; 209 USHORT NumberOfLinenumbers; 210 ULONG Characteristics; 211} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER; 212 213// 214// Section Characteristics 215// 216#define IMAGE_SCN_CNT_CODE 0x00000020 217#define IMAGE_SCN_CNT_INITIALIZED_DATA 0x00000040 218#define IMAGE_SCN_CNT_UNINITIALIZED_DATA 0x00000080 219 220#define IMAGE_SCN_LNK_NRELOC_OVFL 0x01000000 221#define IMAGE_SCN_MEM_DISCARDABLE 0x02000000 222#define IMAGE_SCN_MEM_NOT_CACHED 0x04000000 223#define IMAGE_SCN_MEM_NOT_PAGED 0x08000000 224#define IMAGE_SCN_MEM_SHARED 0x10000000 225#define IMAGE_SCN_MEM_EXECUTE 0x20000000 226#define IMAGE_SCN_MEM_READ 0x40000000 227#define IMAGE_SCN_MEM_WRITE 0x80000000 228 229 230// 231// File Header Format 232// 233#define IMAGE_SIZEOF_FILE_HEADER 20 234 235typedef struct _IMAGE_FILE_HEADER { 236 USHORT Machine; 237 USHORT NumberOfSections; 238 ULONG TimeDateStamp; 239 ULONG PointerToSymbolTable; 240 ULONG NumberOfSymbols; 241 USHORT SizeOfOptionalHeader; 242 USHORT Characteristics; 243} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; 244 245// 246// File Characteristics 247// 248#define IMAGE_FILE_RELOCS_STRIPPED 0x0001 249#define IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 250#define IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 251#define IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 252#define IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010 253#define IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 254#define IMAGE_FILE_BYTES_REVERSED_LO 0x0080 255#define IMAGE_FILE_32BIT_MACHINE 0x0100 256#define IMAGE_FILE_DEBUG_STRIPPED 0x0200 257#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 258#define IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 259#define IMAGE_FILE_SYSTEM 0x1000 260#define IMAGE_FILE_DLL 0x2000 261#define IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 262#define IMAGE_FILE_BYTES_REVERSED_HI 0x8000 263 264 265// 266// Directory format. 267// 268#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16 269 270typedef struct _IMAGE_DATA_DIRECTORY { 271 ULONG VirtualAddress; 272 ULONG Size; 273} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY; 274 275 276// 277// Optional Header Formats 278// 279typedef struct _IMAGE_OPTIONAL_HEADER { 280 USHORT Magic; 281 UCHAR MajorLinkerVersion; 282 UCHAR MinorLinkerVersion; 283 ULONG SizeOfCode; 284 ULONG SizeOfInitializedData; 285 ULONG SizeOfUninitializedData; 286 ULONG AddressOfEntryPoint; 287 ULONG BaseOfCode; 288 ULONG BaseOfData; 289 ULONG ImageBase; 290 ULONG SectionAlignment; 291 ULONG FileAlignment; 292 USHORT MajorOperatingSystemVersion; 293 USHORT MinorOperatingSystemVersion; 294 USHORT MajorImageVersion; 295 USHORT MinorImageVersion; 296 USHORT MajorSubsystemVersion; 297 USHORT MinorSubsystemVersion; 298 ULONG Win32VersionValue; 299 ULONG SizeOfImage; 300 ULONG SizeOfHeaders; 301 ULONG CheckSum; 302 USHORT Subsystem; 303 USHORT DllCharacteristics; 304 ULONG SizeOfStackReserve; 305 ULONG SizeOfStackCommit; 306 ULONG SizeOfHeapReserve; 307 ULONG SizeOfHeapCommit; 308 ULONG LoaderFlags; 309 ULONG NumberOfRvaAndSizes; 310 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; 311} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32; 312 313typedef struct _IMAGE_ROM_OPTIONAL_HEADER { 314 USHORT Magic; 315 UCHAR MajorLinkerVersion; 316 UCHAR MinorLinkerVersion; 317 ULONG SizeOfCode; 318 ULONG SizeOfInitializedData; 319 ULONG SizeOfUninitializedData; 320 ULONG AddressOfEntryPoint; 321 ULONG BaseOfCode; 322 ULONG BaseOfData; 323 ULONG BaseOfBss; 324 ULONG GprMask; 325 ULONG CprMask[4]; 326 ULONG GpValue; 327} IMAGE_ROM_OPTIONAL_HEADER, *PIMAGE_ROM_OPTIONAL_HEADER; 328 329typedef struct _IMAGE_OPTIONAL_HEADER64 { 330 USHORT Magic; 331 UCHAR MajorLinkerVersion; 332 UCHAR MinorLinkerVersion; 333 ULONG SizeOfCode; 334 ULONG SizeOfInitializedData; 335 ULONG SizeOfUninitializedData; 336 ULONG AddressOfEntryPoint; 337 ULONG BaseOfCode; 338 ULONGLONG ImageBase; 339 ULONG SectionAlignment; 340 ULONG FileAlignment; 341 USHORT MajorOperatingSystemVersion; 342 USHORT MinorOperatingSystemVersion; 343 USHORT MajorImageVersion; 344 USHORT MinorImageVersion; 345 USHORT MajorSubsystemVersion; 346 USHORT MinorSubsystemVersion; 347 ULONG Win32VersionValue; 348 ULONG SizeOfImage; 349 ULONG SizeOfHeaders; 350 ULONG CheckSum; 351 USHORT Subsystem; 352 USHORT DllCharacteristics; 353 ULONGLONG SizeOfStackReserve; 354 ULONGLONG SizeOfStackCommit; 355 ULONGLONG SizeOfHeapReserve; 356 ULONGLONG SizeOfHeapCommit; 357 ULONG LoaderFlags; 358 ULONG NumberOfRvaAndSizes; 359 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; 360} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64; 361 362// 363// Format Identifier Magics 364// 365#define IMAGE_NT_OPTIONAL_HDR32_MAGIC 0x10b 366#define IMAGE_NT_OPTIONAL_HDR64_MAGIC 0x20b 367#define IMAGE_ROM_OPTIONAL_HDR_MAGIC 0x107 368 369 370#ifdef _WIN64 371typedef IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER; 372typedef PIMAGE_OPTIONAL_HEADER64 PIMAGE_OPTIONAL_HEADER; 373#define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR64_MAGIC 374#else 375typedef IMAGE_OPTIONAL_HEADER32 IMAGE_OPTIONAL_HEADER; 376typedef PIMAGE_OPTIONAL_HEADER32 PIMAGE_OPTIONAL_HEADER; 377#define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR32_MAGIC 378#endif 379 380 381// 382// Nt Header Formats 383// 384typedef struct _IMAGE_NT_HEADERS64 { 385 ULONG Signature; 386 IMAGE_FILE_HEADER FileHeader; 387 IMAGE_OPTIONAL_HEADER64 OptionalHeader; 388} IMAGE_NT_HEADERS64; 389 390typedef struct _IMAGE_NT_HEADERS { 391 ULONG Signature; 392 IMAGE_FILE_HEADER FileHeader; 393 IMAGE_OPTIONAL_HEADER32 OptionalHeader; 394} IMAGE_NT_HEADERS32; 395 396#ifdef _WIN64 397typedef IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS; 398#else 399typedef IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS; 400#endif 401 402#ifndef _NTDDK_ 403 404typedef struct _IMAGE_NT_HEADERS *PIMAGE_NT_HEADERS32; 405typedef struct _IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64; 406 407#ifdef _WIN64 408typedef PIMAGE_NT_HEADERS64 PIMAGE_NT_HEADERS; 409#else 410typedef PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS; 411#endif 412 413#endif /* _NTDDK_ */ 414 415// 416// Retreives the first image section header from the Nt Header 417// 418#define IMAGE_FIRST_SECTION( NtHeader ) ((PIMAGE_SECTION_HEADER) \ 419 ((ULONG_PTR)(NtHeader) + \ 420 FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) + \ 421 ((NtHeader))->FileHeader.SizeOfOptionalHeader \ 422 )) 423 424// 425// Dll Characteristics 426// 427#define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA 0x0020 428#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE 0x0040 429#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY 0x0080 430#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT 0x0100 431#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION 0x0200 432#define IMAGE_DLLCHARACTERISTICS_NO_SEH 0x0400 433#define IMAGE_DLLCHARACTERISTICS_NO_BIND 0x0800 434#define IMAGE_DLLCHARACTERISTICS_APPCONTAINER 0x1000 435#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER 0x2000 436#define IMAGE_DLLCHARACTERISTICS_GUARD_CF 0x4000 437#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000 438 439// 440// Loader Flags 441// 442#define IMAGE_LOADER_FLAGS_COMPLUS 0x00000001 443#define IMAGE_LOADER_FLAGS_SYSTEM_GLOBAL 0x01000000 444 445// 446// Directory Entry Specifiers 447// 448#define IMAGE_DIRECTORY_ENTRY_EXPORT 0 449#define IMAGE_DIRECTORY_ENTRY_IMPORT 1 450#define IMAGE_DIRECTORY_ENTRY_RESOURCE 2 451#define IMAGE_DIRECTORY_ENTRY_EXCEPTION 3 452#define IMAGE_DIRECTORY_ENTRY_SECURITY 4 453#define IMAGE_DIRECTORY_ENTRY_BASERELOC 5 454#define IMAGE_DIRECTORY_ENTRY_DEBUG 6 455#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE 7 456#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR 8 457#define IMAGE_DIRECTORY_ENTRY_TLS 9 458#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 10 459#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 11 460#define IMAGE_DIRECTORY_ENTRY_IAT 12 461#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13 462#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14 463 464 465// 466// Import Formats 467// 468typedef struct _IMAGE_IMPORT_BY_NAME { 469 USHORT Hint; 470 UCHAR Name[1]; 471} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME; 472 473#include <pshpack8.h> 474typedef struct _IMAGE_THUNK_DATA64 { 475 union { 476 ULONGLONG ForwarderString; 477 ULONGLONG Function; 478 ULONGLONG Ordinal; 479 ULONGLONG AddressOfData; 480 } u1; 481} IMAGE_THUNK_DATA64, *PIMAGE_THUNK_DATA64; 482#include <poppack.h> 483 484typedef struct _IMAGE_THUNK_DATA32 { 485 union { 486 ULONG ForwarderString; 487 ULONG Function; 488 ULONG Ordinal; 489 ULONG AddressOfData; 490 } u1; 491} IMAGE_THUNK_DATA32, *PIMAGE_THUNK_DATA32; 492 493#define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL 494#define IMAGE_ORDINAL_FLAG32 0x80000000 495#define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff) 496#define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff) 497#define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0) 498#define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0) 499 500 501// 502// Thread Local Storage (TLS) 503// 504typedef 505VOID 506(NTAPI *PIMAGE_TLS_CALLBACK) ( 507 PVOID DllHandle, 508 ULONG Reason, 509 PVOID Reserved 510); 511 512typedef struct _IMAGE_TLS_DIRECTORY64 { 513 ULONGLONG StartAddressOfRawData; 514 ULONGLONG EndAddressOfRawData; 515 ULONGLONG AddressOfIndex; 516 ULONGLONG AddressOfCallBacks; 517 ULONG SizeOfZeroFill; 518 ULONG Characteristics; 519} IMAGE_TLS_DIRECTORY64, *PIMAGE_TLS_DIRECTORY64; 520 521typedef struct _IMAGE_TLS_DIRECTORY32 { 522 ULONG StartAddressOfRawData; 523 ULONG EndAddressOfRawData; 524 ULONG AddressOfIndex; 525 ULONG AddressOfCallBacks; 526 ULONG SizeOfZeroFill; 527 ULONG Characteristics; 528} IMAGE_TLS_DIRECTORY32, *PIMAGE_TLS_DIRECTORY32; 529 530#ifdef _WIN64 531#define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG64 532#define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL64(Ordinal) 533typedef IMAGE_THUNK_DATA64 IMAGE_THUNK_DATA; 534typedef PIMAGE_THUNK_DATA64 PIMAGE_THUNK_DATA; 535#define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL64(Ordinal) 536typedef IMAGE_TLS_DIRECTORY64 IMAGE_TLS_DIRECTORY; 537typedef PIMAGE_TLS_DIRECTORY64 PIMAGE_TLS_DIRECTORY; 538#else 539#define IMAGE_ORDINAL_FLAG IMAGE_ORDINAL_FLAG32 540#define IMAGE_ORDINAL(Ordinal) IMAGE_ORDINAL32(Ordinal) 541typedef IMAGE_THUNK_DATA32 IMAGE_THUNK_DATA; 542typedef PIMAGE_THUNK_DATA32 PIMAGE_THUNK_DATA; 543#define IMAGE_SNAP_BY_ORDINAL(Ordinal) IMAGE_SNAP_BY_ORDINAL32(Ordinal) 544typedef IMAGE_TLS_DIRECTORY32 IMAGE_TLS_DIRECTORY; 545typedef PIMAGE_TLS_DIRECTORY32 PIMAGE_TLS_DIRECTORY; 546#endif 547 548typedef struct _IMAGE_IMPORT_DESCRIPTOR { 549 _ANONYMOUS_UNION union { 550 ULONG Characteristics; 551 ULONG OriginalFirstThunk; 552 } DUMMYUNIONNAME; 553 ULONG TimeDateStamp; 554 ULONG ForwarderChain; 555 ULONG Name; 556 ULONG FirstThunk; 557} IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR; 558 559#include <poppack.h> 560 561 562#endif /* _NTIMAGE_ */ 563 564