Delphi-Quellcode:
PIMAGE_DOS_HEADER = ^IMAGE_DOS_HEADER;
IMAGE_DOS_HEADER =
record // DOS .EXE header
e_magic : WORD;
// Magic number { MZ for exe }
e_cblp : WORD;
// Bytes on last page of file
e_cp : WORD;
// Pages in file
e_crlc : WORD;
// Relocations
e_cparhdr : WORD;
// Size of header in paragraphs
e_minalloc : WORD;
// Minimum extra paragraphs needed
e_maxalloc : WORD;
// Maximum extra paragraphs needed
e_ss : WORD;
// Initial (relative) SS value
e_sp : WORD;
// Initial SP value
e_csum : WORD;
// Checksum
e_ip : WORD;
// Initial IP value
e_cs : WORD;
// Initial (relative) CS value
e_lfarlc : WORD;
// File address of relocation table
e_ovno : WORD;
// Overlay number
e_res :
array[0..3]
of WORD;
// Reserved words
e_oemid : WORD;
// OEM identifier (for e_oeminfo)
e_oeminfo : WORD;
// OEM information; e_oemid specific
e_res2 :
array[0..9]
of WORD;
// Reserved words
e_lfanew : Longint;
// File address of new exe header
end;
PIMAGE_FILE_HEADER = ^IMAGE_FILE_HEADER;
IMAGE_FILE_HEADER =
record
Machine : WORD;
NumberOfSections : WORD;
TimeDateStamp : DWORD;
PointerToSymbolTable : DWORD;
NumberOfSymbols : DWORD;
SizeOfOptionalHeader : WORD;
Characteristics : WORD;
end;
TLocation =
record
case DWORD
of
0: (PhysicalAddress: DWORD);
1: (VirtualSize: DWORD);
end;
IMAGE_SECTION_HEADER =
record
Name :
array[0..IMAGE_SIZEOF_SHORT_NAME-1]
of BYTE;
Misc : TLocation;
VirtualAddress : DWORD;
SizeOfRawData : DWORD;
PointerToRawData : DWORD;
PointerToRelocations: DWORD;
PointerToLinenumbers: DWORD;
NumberOfRelocations : WORD;
NumberOfLinenumbers : WORD;
Characteristics : DWORD;
end;
PIMAGE_DATA_DIRECTORY = ^IMAGE_DATA_DIRECTORY;
IMAGE_DATA_DIRECTORY =
record
VirtualAddress: DWORD;
Size: DWORD;
end;
PIMAGE_BASE_RELOCATION = ^IMAGE_BASE_RELOCATION;
IMAGE_BASE_RELOCATION =
record
VirtualAddress: DWORD;
SizeOfBlock: DWORD;
end;
PIMAGE_OPTIONAL_HEADER32 = ^IMAGE_OPTIONAL_HEADER32;
IMAGE_OPTIONAL_HEADER32 =
record
//
// Standard fields.
//
Magic : WORD;
MajorLinkerVersion : BYTE;
MinorLinkerVersion : BYTE;
SizeOfCode : DWORD;
SizeOfInitializedData : DWORD;
SizeOfUninitializedData : DWORD;
AddressOfEntryPoint : DWORD;
BaseOfCode : DWORD;
BaseOfData : DWORD;
//
// NT additional fields.
//
ImageBase : DWORD;
SectionAlignment : DWORD;
FileAlignment : DWORD;
MajorOperatingSystemVersion : WORD;
MinorOperatingSystemVersion : WORD;
MajorImageVersion : WORD;
MinorImageVersion : WORD;
MajorSubsystemVersion : WORD;
MinorSubsystemVersion : WORD;
Win32VersionValue : DWORD;
SizeOfImage : DWORD;
SizeOfHeaders : DWORD;
CheckSum : DWORD;
Subsystem : WORD;
DllCharacteristics : WORD;
SizeOfStackReserve : DWORD;
SizeOfStackCommit : DWORD;
SizeOfHeapReserve : DWORD;
SizeOfHeapCommit : DWORD;
LoaderFlags : DWORD;
NumberOfRvaAndSizes : DWORD;
DataDirectory :
array[0..IMAGE_NUMBEROF_DIRECTORY_ENTRIES-1]
of IMAGE_DATA_DIRECTORY;
end;
PIMAGE_NT_HEADERS32 = ^IMAGE_NT_HEADERS32;
IMAGE_NT_HEADERS32 =
record
Signature : DWORD;
FileHeader : IMAGE_FILE_HEADER;
OptionalHeader : IMAGE_OPTIONAL_HEADER32;
end;
TThunkCharacterisics =
record
case DWORD
of
0: (Characteristics : DWORD);
{ 0 for terminating null import descriptor }
1: (OriginalFirstThunk: DWORD);
{ RVA to original unbound IAT (PIMAGE_THUNK_DATA) }
end;
PIMAGE_IMPORT_DESCRIPTOR = ^IMAGE_IMPORT_DESCRIPTOR;
IMAGE_IMPORT_DESCRIPTOR =
record
Thunk : TThunkCharacterisics;
TimeDateStamp : DWORD;
{ 0 if not bound, }
{ -1 if bound, and real date\time stamp }
{ in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) }
{ O.W. date/time stamp of DLL bound to (Old BIND) }
ForwarderChain : DWORD;
{ -1 if no forwarders }
Name : DWORD;
FirstThunk : DWORD;
{ RVA to IAT (if bound this IAT has actual addresses) }
end;
TCode =
record
case LongWord
of
0 : (Offset,Segment: Word);
1 : (LinearAddr: LongWord);
end;
PIMAGE_EXPORT_DIRECTORY = ^IMAGE_EXPORT_DIRECTORY;
IMAGE_EXPORT_DIRECTORY =
record
Characteristics : DWORD;
TimeDateStamp : DWORD;
MajorVersion : WORD;
MinorVersion : WORD;
Name : DWORD;
Base : DWORD;
NumberOfFunctions : DWORD;
NumberOfNames : PDWORD;
AddressOfFunctions : PDWORD;
{ RVA from base of image }
AddressOfNames : PDWORD;
{ RVA from base of image }
AddressOfNameOrdinals : PDWORD;
{ RVA from base of image }
end;