Delphi-Quellcode:
PIMAGE_DOS_HEADER = ^IMAGE_DOS_HEADER;
IMAGE_DOS_HEADER =
record // DOS .EXE header
e_magic :
WORD;
// Magic number { MZ for exe }
e_cblp :
WORD;
// Bytes on last page of file
e_cp :
WORD;
// Pages in file
e_crlc :
WORD;
// Relocations
e_cparhdr :
WORD;
// Size of header in paragraphs
e_minalloc :
WORD;
// Minimum extra paragraphs needed
e_maxalloc :
WORD;
// Maximum extra paragraphs needed
e_ss :
WORD;
// Initial (relative) SS value
e_sp :
WORD;
// Initial SP value
e_csum :
WORD;
// Checksum
e_ip :
WORD;
// Initial IP value
e_cs :
WORD;
// Initial (relative) CS value
e_lfarlc :
WORD;
// File address of relocation table
e_ovno :
WORD;
// Overlay number
e_res :
array[0..3]
of WORD;
// Reserved words
e_oemid :
WORD;
// OEM identifier (for e_oeminfo)
e_oeminfo :
WORD;
// OEM information; e_oemid specific
e_res2 :
array[0..9]
of WORD;
// Reserved words
e_lfanew : Longint;
// File address of new exe header
end;
PIMAGE_FILE_HEADER = ^IMAGE_FILE_HEADER;
IMAGE_FILE_HEADER =
record
Machine :
WORD;
NumberOfSections :
WORD;
TimeDateStamp : DWORD;
PointerToSymbolTable : DWORD;
NumberOfSymbols : DWORD;
SizeOfOptionalHeader :
WORD;
Characteristics :
WORD;
end;
TLocation =
record
case DWORD
of
0: (PhysicalAddress: DWORD);
1: (VirtualSize: DWORD);
end;
IMAGE_SECTION_HEADER =
record
Name :
array[0..IMAGE_SIZEOF_SHORT_NAME-1]
of BYTE;
Misc : TLocation;
VirtualAddress : DWORD;
SizeOfRawData : DWORD;
PointerToRawData : DWORD;
PointerToRelocations: DWORD;
PointerToLinenumbers: DWORD;
NumberOfRelocations :
WORD;
NumberOfLinenumbers :
WORD;
Characteristics : DWORD;
end;
PIMAGE_DATA_DIRECTORY = ^IMAGE_DATA_DIRECTORY;
IMAGE_DATA_DIRECTORY =
record
VirtualAddress: DWORD;
Size: DWORD;
end;
PIMAGE_BASE_RELOCATION = ^IMAGE_BASE_RELOCATION;
IMAGE_BASE_RELOCATION =
record
VirtualAddress: DWORD;
SizeOfBlock: DWORD;
end;
PIMAGE_OPTIONAL_HEADER32 = ^IMAGE_OPTIONAL_HEADER32;
IMAGE_OPTIONAL_HEADER32 =
record
//
// Standard fields.
//
Magic :
WORD;
MajorLinkerVersion : BYTE;
MinorLinkerVersion : BYTE;
SizeOfCode : DWORD;
SizeOfInitializedData : DWORD;
SizeOfUninitializedData : DWORD;
AddressOfEntryPoint : DWORD;
BaseOfCode : DWORD;
BaseOfData : DWORD;
//
// NT additional fields.
//
ImageBase : DWORD;
SectionAlignment : DWORD;
FileAlignment : DWORD;
MajorOperatingSystemVersion :
WORD;
MinorOperatingSystemVersion :
WORD;
MajorImageVersion :
WORD;
MinorImageVersion :
WORD;
MajorSubsystemVersion :
WORD;
MinorSubsystemVersion :
WORD;
Win32VersionValue : DWORD;
SizeOfImage : DWORD;
SizeOfHeaders : DWORD;
CheckSum : DWORD;
Subsystem :
WORD;
DllCharacteristics :
WORD;
SizeOfStackReserve : DWORD;
SizeOfStackCommit : DWORD;
SizeOfHeapReserve : DWORD;
SizeOfHeapCommit : DWORD;
LoaderFlags : DWORD;
NumberOfRvaAndSizes : DWORD;
DataDirectory :
array[0..IMAGE_NUMBEROF_DIRECTORY_ENTRIES-1]
of IMAGE_DATA_DIRECTORY;
end;
PIMAGE_NT_HEADERS32 = ^IMAGE_NT_HEADERS32;
IMAGE_NT_HEADERS32 =
record
Signature : DWORD;
FileHeader : IMAGE_FILE_HEADER;
OptionalHeader : IMAGE_OPTIONAL_HEADER32;
end;
TThunkCharacterisics =
record
case DWORD
of
0: (Characteristics : DWORD);
{ 0 for terminating null import descriptor }
1: (OriginalFirstThunk: DWORD);
{ RVA to original unbound IAT (PIMAGE_THUNK_DATA) }
end;
PIMAGE_IMPORT_DESCRIPTOR = ^IMAGE_IMPORT_DESCRIPTOR;
IMAGE_IMPORT_DESCRIPTOR =
record
Thunk : TThunkCharacterisics;
TimeDateStamp : DWORD;
{ 0 if not bound, }
{ -1 if bound, and real date\time stamp }
{ in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND) }
{ O.W. date/time stamp of DLL bound to (Old BIND) }
ForwarderChain : DWORD;
{ -1 if no forwarders }
Name : DWORD;
FirstThunk : DWORD;
{ RVA to IAT (if bound this IAT has actual addresses) }
end;
TCode =
record
case LongWord
of
0 : (Offset,Segment:
Word);
1 : (LinearAddr: LongWord);
end;
PIMAGE_EXPORT_DIRECTORY = ^IMAGE_EXPORT_DIRECTORY;
IMAGE_EXPORT_DIRECTORY =
record
Characteristics : DWORD;
TimeDateStamp : DWORD;
MajorVersion :
WORD;
MinorVersion :
WORD;
Name : DWORD;
Base : DWORD;
NumberOfFunctions : DWORD;
NumberOfNames : PDWORD;
AddressOfFunctions : PDWORD;
{ RVA from base of image }
AddressOfNames : PDWORD;
{ RVA from base of image }
AddressOfNameOrdinals : PDWORD;
{ RVA from base of image }
end;