1#ifndef _NTIMAGE_
2#define _NTIMAGE_
3
4//
5// Image Formats
6//
7#define IMAGE_DOS_SIGNATURE                 0x5A4D
8#define IMAGE_OS2_SIGNATURE                 0x454E
9#define IMAGE_OS2_SIGNATURE_LE              0x454C
10#define IMAGE_VXD_SIGNATURE                 0x454C
11#define IMAGE_NT_SIGNATURE                  0x00004550
12
13//
14// Image architectures
15//
16#define IMAGE_FILE_MACHINE_AM33       0x1d3
17#define IMAGE_FILE_MACHINE_AMD64      0x8664
18#define IMAGE_FILE_MACHINE_ARM        0x1c0
19#define IMAGE_FILE_MACHINE_ARMV7      0x1c4
20#define IMAGE_FILE_MACHINE_EBC        0xebc
21#define IMAGE_FILE_MACHINE_I386       0x14c
22#define IMAGE_FILE_MACHINE_IA64       0x200
23#define IMAGE_FILE_MACHINE_M32R       0x9041
24#define IMAGE_FILE_MACHINE_MIPS16     0x266
25#define IMAGE_FILE_MACHINE_MIPSFPU    0x366
26#define IMAGE_FILE_MACHINE_MIPSFPU16  0x466
27#define IMAGE_FILE_MACHINE_POWERPC    0x1f0
28#define IMAGE_FILE_MACHINE_POWERPCFP  0x1f1
29#define IMAGE_FILE_MACHINE_R4000      0x166
30#define IMAGE_FILE_MACHINE_SH3        0x1a2
31#define IMAGE_FILE_MACHINE_SH3E       0x01a4
32#define IMAGE_FILE_MACHINE_SH3DSP     0x1a3
33#define IMAGE_FILE_MACHINE_SH4        0x1a6
34#define IMAGE_FILE_MACHINE_SH5        0x1a8
35#define IMAGE_FILE_MACHINE_THUMB      0x1c2
36#define IMAGE_FILE_MACHINE_WCEMIPSV2  0x169
37#define IMAGE_FILE_MACHINE_R3000      0x162
38#define IMAGE_FILE_MACHINE_R10000     0x168
39#define IMAGE_FILE_MACHINE_ALPHA      0x184
40#define IMAGE_FILE_MACHINE_ALPHA64    0x0284
41#define IMAGE_FILE_MACHINE_AXP64      IMAGE_FILE_MACHINE_ALPHA64
42#define IMAGE_FILE_MACHINE_CEE        0xC0EE
43#define IMAGE_FILE_MACHINE_TRICORE    0x0520
44#define IMAGE_FILE_MACHINE_CEF        0x0CEF
45
46
47//
48// DOS Image Header Format
49//
50#include <pshpack2.h>
51typedef struct _IMAGE_DOS_HEADER {
52    USHORT e_magic;
53    USHORT e_cblp;
54    USHORT e_cp;
55    USHORT e_crlc;
56    USHORT e_cparhdr;
57    USHORT e_minalloc;
58    USHORT e_maxalloc;
59    USHORT e_ss;
60    USHORT e_sp;
61    USHORT e_csum;
62    USHORT e_ip;
63    USHORT e_cs;
64    USHORT e_lfarlc;
65    USHORT e_ovno;
66    USHORT e_res[4];
67    USHORT e_oemid;
68    USHORT e_oeminfo;
69    USHORT e_res2[10];
70    LONG e_lfanew;
71} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
72#include <poppack.h>
73
74
75//
76// Export/Import Format
77//
78#include <pshpack4.h>
79typedef struct _IMAGE_EXPORT_DIRECTORY {
80    ULONG Characteristics;
81    ULONG TimeDateStamp;
82    USHORT MajorVersion;
83    USHORT MinorVersion;
84    ULONG Name;
85    ULONG Base;
86    ULONG NumberOfFunctions;
87    ULONG NumberOfNames;
88    ULONG AddressOfFunctions;
89    ULONG AddressOfNames;
90    ULONG AddressOfNameOrdinals;
91} IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
92
93
94//
95// Resource Data Entry Format
96//
97typedef struct _IMAGE_RESOURCE_DATA_ENTRY {
98    ULONG OffsetToData;
99    ULONG Size;
100    ULONG CodePage;
101    ULONG Reserved;
102} IMAGE_RESOURCE_DATA_ENTRY, *PIMAGE_RESOURCE_DATA_ENTRY;
103
104
105//
106// Load Configuration Directory Entry Format
107//
108typedef struct {
109    ULONG   Size;
110    ULONG   TimeDateStamp;
111    USHORT  MajorVersion;
112    USHORT  MinorVersion;
113    ULONG   GlobalFlagsClear;
114    ULONG   GlobalFlagsSet;
115    ULONG   CriticalSectionDefaultTimeout;
116    ULONG   DeCommitFreeBlockThreshold;
117    ULONG   DeCommitTotalFreeThreshold;
118    ULONG   LockPrefixTable;
119    ULONG   MaximumAllocationSize;
120    ULONG   VirtualMemoryThreshold;
121    ULONG   ProcessHeapFlags;
122    ULONG   ProcessAffinityMask;
123    USHORT  CSDVersion;
124    USHORT  Reserved1;
125    ULONG   EditList;
126    ULONG   SecurityCookie;
127    ULONG   SEHandlerTable;
128    ULONG   SEHandlerCount;
129} IMAGE_LOAD_CONFIG_DIRECTORY32, *PIMAGE_LOAD_CONFIG_DIRECTORY32;
130
131typedef struct {
132    ULONG      Size;
133    ULONG      TimeDateStamp;
134    USHORT     MajorVersion;
135    USHORT     MinorVersion;
136    ULONG      GlobalFlagsClear;
137    ULONG      GlobalFlagsSet;
138    ULONG      CriticalSectionDefaultTimeout;
139    ULONGLONG  DeCommitFreeBlockThreshold;
140    ULONGLONG  DeCommitTotalFreeThreshold;
141    ULONGLONG  LockPrefixTable;
142    ULONGLONG  MaximumAllocationSize;
143    ULONGLONG  VirtualMemoryThreshold;
144    ULONGLONG  ProcessAffinityMask;
145    ULONG      ProcessHeapFlags;
146    USHORT     CSDVersion;
147    USHORT     Reserved1;
148    ULONGLONG  EditList;
149    ULONGLONG  SecurityCookie;
150    ULONGLONG  SEHandlerTable;
151    ULONGLONG  SEHandlerCount;
152} IMAGE_LOAD_CONFIG_DIRECTORY64, *PIMAGE_LOAD_CONFIG_DIRECTORY64;
153
154#ifdef _WIN64
155typedef IMAGE_LOAD_CONFIG_DIRECTORY64     IMAGE_LOAD_CONFIG_DIRECTORY;
156typedef PIMAGE_LOAD_CONFIG_DIRECTORY64    PIMAGE_LOAD_CONFIG_DIRECTORY;
157#else
158typedef IMAGE_LOAD_CONFIG_DIRECTORY32     IMAGE_LOAD_CONFIG_DIRECTORY;
159typedef PIMAGE_LOAD_CONFIG_DIRECTORY32    PIMAGE_LOAD_CONFIG_DIRECTORY;
160#endif
161
162
163//
164// Base Relocation Format
165//
166typedef struct _IMAGE_BASE_RELOCATION {
167	ULONG VirtualAddress;
168	ULONG SizeOfBlock;
169} IMAGE_BASE_RELOCATION, *PIMAGE_BASE_RELOCATION;
170
171
172//
173// Resource Format
174//
175typedef struct _IMAGE_RESOURCE_DIRECTORY {
176    ULONG Characteristics;
177    ULONG TimeDateStamp;
178    USHORT MajorVersion;
179    USHORT MinorVersion;
180    USHORT NumberOfNamedEntries;
181    USHORT NumberOfIdEntries;
182} IMAGE_RESOURCE_DIRECTORY, *PIMAGE_RESOURCE_DIRECTORY;
183
184typedef struct _IMAGE_RESOURCE_DIRECTORY_STRING {
185    USHORT Length;
186    CHAR NameString[ANYSIZE_ARRAY];
187} IMAGE_RESOURCE_DIRECTORY_STRING, *PIMAGE_RESOURCE_DIRECTORY_STRING;
188
189
190//
191// Section Header Format
192//
193#define IMAGE_SIZEOF_SHORT_NAME              8
194#define IMAGE_SIZEOF_SECTION_HEADER          40
195
196typedef struct _IMAGE_SECTION_HEADER {
197    UCHAR Name[IMAGE_SIZEOF_SHORT_NAME];
198    union
199    {
200        ULONG PhysicalAddress;
201        ULONG VirtualSize;
202    } Misc;
203    ULONG VirtualAddress;
204    ULONG SizeOfRawData;
205    ULONG PointerToRawData;
206    ULONG PointerToRelocations;
207    ULONG PointerToLinenumbers;
208    USHORT NumberOfRelocations;
209    USHORT NumberOfLinenumbers;
210    ULONG Characteristics;
211} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
212
213//
214// Section Characteristics
215//
216#define IMAGE_SCN_CNT_CODE                   0x00000020
217#define IMAGE_SCN_CNT_INITIALIZED_DATA       0x00000040
218#define IMAGE_SCN_CNT_UNINITIALIZED_DATA     0x00000080
219
220#define IMAGE_SCN_LNK_NRELOC_OVFL            0x01000000
221#define IMAGE_SCN_MEM_DISCARDABLE            0x02000000
222#define IMAGE_SCN_MEM_NOT_CACHED             0x04000000
223#define IMAGE_SCN_MEM_NOT_PAGED              0x08000000
224#define IMAGE_SCN_MEM_SHARED                 0x10000000
225#define IMAGE_SCN_MEM_EXECUTE                0x20000000
226#define IMAGE_SCN_MEM_READ                   0x40000000
227#define IMAGE_SCN_MEM_WRITE                  0x80000000
228
229
230//
231// File Header Format
232//
233#define IMAGE_SIZEOF_FILE_HEADER             20
234
235typedef struct _IMAGE_FILE_HEADER {
236    USHORT Machine;
237    USHORT NumberOfSections;
238    ULONG TimeDateStamp;
239    ULONG PointerToSymbolTable;
240    ULONG NumberOfSymbols;
241    USHORT SizeOfOptionalHeader;
242    USHORT Characteristics;
243} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
244
245//
246// File Characteristics
247//
248#define IMAGE_FILE_RELOCS_STRIPPED           0x0001
249#define IMAGE_FILE_EXECUTABLE_IMAGE          0x0002
250#define IMAGE_FILE_LINE_NUMS_STRIPPED        0x0004
251#define IMAGE_FILE_LOCAL_SYMS_STRIPPED       0x0008
252#define IMAGE_FILE_AGGRESIVE_WS_TRIM         0x0010
253#define IMAGE_FILE_LARGE_ADDRESS_AWARE       0x0020
254#define IMAGE_FILE_BYTES_REVERSED_LO         0x0080
255#define IMAGE_FILE_32BIT_MACHINE             0x0100
256#define IMAGE_FILE_DEBUG_STRIPPED            0x0200
257#define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP   0x0400
258#define IMAGE_FILE_NET_RUN_FROM_SWAP         0x0800
259#define IMAGE_FILE_SYSTEM                    0x1000
260#define IMAGE_FILE_DLL                       0x2000
261#define IMAGE_FILE_UP_SYSTEM_ONLY            0x4000
262#define IMAGE_FILE_BYTES_REVERSED_HI         0x8000
263
264
265//
266// Directory format.
267//
268#define IMAGE_NUMBEROF_DIRECTORY_ENTRIES    16
269
270typedef struct _IMAGE_DATA_DIRECTORY {
271    ULONG   VirtualAddress;
272    ULONG   Size;
273} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
274
275
276//
277// Optional Header Formats
278//
279typedef struct _IMAGE_OPTIONAL_HEADER {
280    USHORT  Magic;
281    UCHAR   MajorLinkerVersion;
282    UCHAR   MinorLinkerVersion;
283    ULONG   SizeOfCode;
284    ULONG   SizeOfInitializedData;
285    ULONG   SizeOfUninitializedData;
286    ULONG   AddressOfEntryPoint;
287    ULONG   BaseOfCode;
288    ULONG   BaseOfData;
289    ULONG   ImageBase;
290    ULONG   SectionAlignment;
291    ULONG   FileAlignment;
292    USHORT  MajorOperatingSystemVersion;
293    USHORT  MinorOperatingSystemVersion;
294    USHORT  MajorImageVersion;
295    USHORT  MinorImageVersion;
296    USHORT  MajorSubsystemVersion;
297    USHORT  MinorSubsystemVersion;
298    ULONG   Win32VersionValue;
299    ULONG   SizeOfImage;
300    ULONG   SizeOfHeaders;
301    ULONG   CheckSum;
302    USHORT  Subsystem;
303    USHORT  DllCharacteristics;
304    ULONG   SizeOfStackReserve;
305    ULONG   SizeOfStackCommit;
306    ULONG   SizeOfHeapReserve;
307    ULONG   SizeOfHeapCommit;
308    ULONG   LoaderFlags;
309    ULONG   NumberOfRvaAndSizes;
310    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
311} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
312
313typedef struct _IMAGE_ROM_OPTIONAL_HEADER {
314    USHORT Magic;
315    UCHAR  MajorLinkerVersion;
316    UCHAR  MinorLinkerVersion;
317    ULONG  SizeOfCode;
318    ULONG  SizeOfInitializedData;
319    ULONG  SizeOfUninitializedData;
320    ULONG  AddressOfEntryPoint;
321    ULONG  BaseOfCode;
322    ULONG  BaseOfData;
323    ULONG  BaseOfBss;
324    ULONG  GprMask;
325    ULONG  CprMask[4];
326    ULONG  GpValue;
327} IMAGE_ROM_OPTIONAL_HEADER, *PIMAGE_ROM_OPTIONAL_HEADER;
328
329typedef struct _IMAGE_OPTIONAL_HEADER64 {
330    USHORT      Magic;
331    UCHAR       MajorLinkerVersion;
332    UCHAR       MinorLinkerVersion;
333    ULONG       SizeOfCode;
334    ULONG       SizeOfInitializedData;
335    ULONG       SizeOfUninitializedData;
336    ULONG       AddressOfEntryPoint;
337    ULONG       BaseOfCode;
338    ULONGLONG   ImageBase;
339    ULONG       SectionAlignment;
340    ULONG       FileAlignment;
341    USHORT      MajorOperatingSystemVersion;
342    USHORT      MinorOperatingSystemVersion;
343    USHORT      MajorImageVersion;
344    USHORT      MinorImageVersion;
345    USHORT      MajorSubsystemVersion;
346    USHORT      MinorSubsystemVersion;
347    ULONG       Win32VersionValue;
348    ULONG       SizeOfImage;
349    ULONG       SizeOfHeaders;
350    ULONG       CheckSum;
351    USHORT      Subsystem;
352    USHORT      DllCharacteristics;
353    ULONGLONG   SizeOfStackReserve;
354    ULONGLONG   SizeOfStackCommit;
355    ULONGLONG   SizeOfHeapReserve;
356    ULONGLONG   SizeOfHeapCommit;
357    ULONG       LoaderFlags;
358    ULONG       NumberOfRvaAndSizes;
359    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
360} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
361
362//
363// Format Identifier Magics
364//
365#define IMAGE_NT_OPTIONAL_HDR32_MAGIC      0x10b
366#define IMAGE_NT_OPTIONAL_HDR64_MAGIC      0x20b
367#define IMAGE_ROM_OPTIONAL_HDR_MAGIC       0x107
368
369
370#ifdef _WIN64
371typedef IMAGE_OPTIONAL_HEADER64             IMAGE_OPTIONAL_HEADER;
372typedef PIMAGE_OPTIONAL_HEADER64            PIMAGE_OPTIONAL_HEADER;
373#define IMAGE_NT_OPTIONAL_HDR_MAGIC         IMAGE_NT_OPTIONAL_HDR64_MAGIC
374#else
375typedef IMAGE_OPTIONAL_HEADER32             IMAGE_OPTIONAL_HEADER;
376typedef PIMAGE_OPTIONAL_HEADER32            PIMAGE_OPTIONAL_HEADER;
377#define IMAGE_NT_OPTIONAL_HDR_MAGIC         IMAGE_NT_OPTIONAL_HDR32_MAGIC
378#endif
379
380
381//
382// Nt Header Formats
383//
384typedef struct _IMAGE_NT_HEADERS64 {
385    ULONG Signature;
386    IMAGE_FILE_HEADER FileHeader;
387    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
388} IMAGE_NT_HEADERS64;
389
390typedef struct _IMAGE_NT_HEADERS {
391    ULONG Signature;
392    IMAGE_FILE_HEADER FileHeader;
393    IMAGE_OPTIONAL_HEADER32 OptionalHeader;
394} IMAGE_NT_HEADERS32;
395
396#ifdef _WIN64
397typedef IMAGE_NT_HEADERS64                  IMAGE_NT_HEADERS;
398#else
399typedef IMAGE_NT_HEADERS32                  IMAGE_NT_HEADERS;
400#endif
401
402#ifndef _NTDDK_
403
404typedef struct _IMAGE_NT_HEADERS *PIMAGE_NT_HEADERS32;
405typedef struct _IMAGE_NT_HEADERS64 *PIMAGE_NT_HEADERS64;
406
407#ifdef _WIN64
408typedef PIMAGE_NT_HEADERS64                 PIMAGE_NT_HEADERS;
409#else
410typedef PIMAGE_NT_HEADERS32                 PIMAGE_NT_HEADERS;
411#endif
412
413#endif /* _NTDDK_ */
414
415//
416// Retreives the first image section header from the Nt Header
417//
418#define IMAGE_FIRST_SECTION( NtHeader ) ((PIMAGE_SECTION_HEADER)        \
419    ((ULONG_PTR)(NtHeader) +                                            \
420     FIELD_OFFSET( IMAGE_NT_HEADERS, OptionalHeader ) +                 \
421     ((NtHeader))->FileHeader.SizeOfOptionalHeader   \
422    ))
423
424//
425// Dll Characteristics
426//
427#define IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA       0x0020
428#define IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE          0x0040
429#define IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY       0x0080
430#define IMAGE_DLLCHARACTERISTICS_NX_COMPAT             0x0100
431#define IMAGE_DLLCHARACTERISTICS_NO_ISOLATION          0x0200
432#define IMAGE_DLLCHARACTERISTICS_NO_SEH                0x0400
433#define IMAGE_DLLCHARACTERISTICS_NO_BIND               0x0800
434#define IMAGE_DLLCHARACTERISTICS_APPCONTAINER          0x1000
435#define IMAGE_DLLCHARACTERISTICS_WDM_DRIVER            0x2000
436#define IMAGE_DLLCHARACTERISTICS_GUARD_CF              0x4000
437#define IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE 0x8000
438
439//
440// Loader Flags
441//
442#define IMAGE_LOADER_FLAGS_COMPLUS       0x00000001
443#define IMAGE_LOADER_FLAGS_SYSTEM_GLOBAL 0x01000000
444
445//
446// Directory Entry Specifiers
447//
448#define IMAGE_DIRECTORY_ENTRY_EXPORT          0
449#define IMAGE_DIRECTORY_ENTRY_IMPORT          1
450#define IMAGE_DIRECTORY_ENTRY_RESOURCE        2
451#define IMAGE_DIRECTORY_ENTRY_EXCEPTION       3
452#define IMAGE_DIRECTORY_ENTRY_SECURITY        4
453#define IMAGE_DIRECTORY_ENTRY_BASERELOC       5
454#define IMAGE_DIRECTORY_ENTRY_DEBUG           6
455#define IMAGE_DIRECTORY_ENTRY_ARCHITECTURE    7
456#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR       8
457#define IMAGE_DIRECTORY_ENTRY_TLS             9
458#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    10
459#define IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT   11
460#define IMAGE_DIRECTORY_ENTRY_IAT            12
461#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT   13
462#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 14
463
464
465//
466// Import Formats
467//
468typedef struct _IMAGE_IMPORT_BY_NAME {
469    USHORT  Hint;
470    UCHAR   Name[1];
471} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;
472
473#include <pshpack8.h>
474typedef struct _IMAGE_THUNK_DATA64 {
475    union {
476        ULONGLONG ForwarderString;
477        ULONGLONG Function;
478        ULONGLONG Ordinal;
479        ULONGLONG AddressOfData;
480    } u1;
481} IMAGE_THUNK_DATA64, *PIMAGE_THUNK_DATA64;
482#include <poppack.h>
483
484typedef struct _IMAGE_THUNK_DATA32 {
485    union {
486        ULONG ForwarderString;
487        ULONG Function;
488        ULONG Ordinal;
489        ULONG AddressOfData;
490    } u1;
491} IMAGE_THUNK_DATA32, *PIMAGE_THUNK_DATA32;
492
493#define IMAGE_ORDINAL_FLAG64 0x8000000000000000ULL
494#define IMAGE_ORDINAL_FLAG32 0x80000000
495#define IMAGE_ORDINAL64(Ordinal) (Ordinal & 0xffff)
496#define IMAGE_ORDINAL32(Ordinal) (Ordinal & 0xffff)
497#define IMAGE_SNAP_BY_ORDINAL64(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG64) != 0)
498#define IMAGE_SNAP_BY_ORDINAL32(Ordinal) ((Ordinal & IMAGE_ORDINAL_FLAG32) != 0)
499
500
501//
502// Thread Local Storage (TLS)
503//
504typedef
505VOID
506(NTAPI *PIMAGE_TLS_CALLBACK) (
507    PVOID DllHandle,
508    ULONG Reason,
509    PVOID Reserved
510);
511
512typedef struct _IMAGE_TLS_DIRECTORY64 {
513    ULONGLONG   StartAddressOfRawData;
514    ULONGLONG   EndAddressOfRawData;
515    ULONGLONG   AddressOfIndex;
516    ULONGLONG   AddressOfCallBacks;
517    ULONG   SizeOfZeroFill;
518    ULONG   Characteristics;
519} IMAGE_TLS_DIRECTORY64, *PIMAGE_TLS_DIRECTORY64;
520
521typedef struct _IMAGE_TLS_DIRECTORY32 {
522    ULONG   StartAddressOfRawData;
523    ULONG   EndAddressOfRawData;
524    ULONG   AddressOfIndex;
525    ULONG   AddressOfCallBacks;
526    ULONG   SizeOfZeroFill;
527    ULONG   Characteristics;
528} IMAGE_TLS_DIRECTORY32, *PIMAGE_TLS_DIRECTORY32;
529
530#ifdef _WIN64
531#define IMAGE_ORDINAL_FLAG              IMAGE_ORDINAL_FLAG64
532#define IMAGE_ORDINAL(Ordinal)          IMAGE_ORDINAL64(Ordinal)
533typedef IMAGE_THUNK_DATA64              IMAGE_THUNK_DATA;
534typedef PIMAGE_THUNK_DATA64             PIMAGE_THUNK_DATA;
535#define IMAGE_SNAP_BY_ORDINAL(Ordinal)  IMAGE_SNAP_BY_ORDINAL64(Ordinal)
536typedef IMAGE_TLS_DIRECTORY64           IMAGE_TLS_DIRECTORY;
537typedef PIMAGE_TLS_DIRECTORY64          PIMAGE_TLS_DIRECTORY;
538#else
539#define IMAGE_ORDINAL_FLAG              IMAGE_ORDINAL_FLAG32
540#define IMAGE_ORDINAL(Ordinal)          IMAGE_ORDINAL32(Ordinal)
541typedef IMAGE_THUNK_DATA32              IMAGE_THUNK_DATA;
542typedef PIMAGE_THUNK_DATA32             PIMAGE_THUNK_DATA;
543#define IMAGE_SNAP_BY_ORDINAL(Ordinal)  IMAGE_SNAP_BY_ORDINAL32(Ordinal)
544typedef IMAGE_TLS_DIRECTORY32           IMAGE_TLS_DIRECTORY;
545typedef PIMAGE_TLS_DIRECTORY32          PIMAGE_TLS_DIRECTORY;
546#endif
547
548typedef struct _IMAGE_IMPORT_DESCRIPTOR {
549    _ANONYMOUS_UNION union {
550        ULONG   Characteristics;
551        ULONG   OriginalFirstThunk;
552    } DUMMYUNIONNAME;
553    ULONG   TimeDateStamp;
554    ULONG   ForwarderChain;
555    ULONG   Name;
556    ULONG   FirstThunk;
557} IMAGE_IMPORT_DESCRIPTOR, *PIMAGE_IMPORT_DESCRIPTOR;
558
559#include <poppack.h>
560
561
562#endif /* _NTIMAGE_ */
563
564