Option Explicit
Option Base 1
'Referencias: win.tlb -> Windows API (ANSI)
Enum PE_IMAGE_FILE_TYPE
IMAGE_DOS_SIGNATURE = &H5A4D ' MZ
IMAGE_OS2_SIGNATURE = &H454E ' NE
IMAGE_OS2_SIGNATURE_LE = &H454C ' LE
IMAGE_NT_SIGNATURE = &H4550 ' PE
IMAGE_FILE_UNKNOWN = &H0 ' Desconocido
IMAGE_OPTHDR_SIGNATURE = 267 ' Encabezado opcional PE
End Enum
Private Const SIZE_OF_NT_SIGNATURE = 4 ' Desplazamiento de 4 bytes.
Private Const IMAGE_SIZEOF_DOS_HEADER = 64 ' Tamaño de la estructura IMAGE_DOS_HEADER
Private Const IMAGE_SIZEOF_FILE_HEADER = 20 ' Tamaño de la estructura IMAGE_FILE_HEADER
Private Const IMAGE_SIZEOF_OPTIONAL_HEADER = 224 ' Tamaño de la estructura IMAGE_OPTIONAL_HEADER
'
'Memoria Reservada para cada proceso: 2147483648 Bytes (2 GB)
'
'Caraceterísticas de las secciones.
'
Enum PE_IMAGE_SECTION_CHARS
SECTION_CODE = &H20
SECTION_INITIALIZED_DATA = &H40
SECTION_UNITIALIZED_DATA = &H80
SECTION_CANNOT_BE_CACHED = &H4000000
SECTION_NO_PAGEABLE = &H8000000
SECTION_SHARED = &H10000000
SECTION_EXECUTABLE = &H20000000
SECTION_READABLE = &H40000000
SECTION_WRITABLE = &H80000000
End Enum
'
'Tipos de información de depuración.
'
Enum PE_DEBUG_INFO_TYPE
IMAGE_DEBUG_TYPE_UNKNOWN = 0
IMAGE_DEBUG_TYPE_COFF = 1
IMAGE_DEBUG_TYPE_CODEVIEW = 2
IMAGE_DEBUG_TYPE_FPO = 3
IMAGE_DEBUG_TYPE_MISC = 4
End Enum
'
'Entradas de directorios
'
Enum PE_DIRECTORY_ENTRY
IMAGE_DIRECTORY_ENTRY_EXPORT = 0 ' Directorio de exportación
IMAGE_DIRECTORY_ENTRY_IMPORT = 1 ' Directorio de importación
IMAGE_DIRECTORY_ENTRY_RESOURCE = 2 ' Directorio de recursos
IMAGE_DIRECTORY_ENTRY_EXEPTION = 3 ' Directorio de exepciones
IMAGE_DIRECTORY_ENTRY_CERTIFICATE = 4 ' Directorio de seguridad
IMAGE_DIRECTORY_ENTRY_BASERELOC = 5 ' Tabla de base de reagrupaciones
IMAGE_DIRECTORY_ENTRY_DEBUG = 6 ' Directorio de depuración
IMAGE_DIRECTORY_ENTRY_COPYRIGHT = 7 ' Descripción de cadenas
IMAGE_DIRECTORY_ENTRY_GLOBALPTR = 8 ' Valor de la máquina (MIPS GP)
IMAGE_DIRECTORY_ENTRY_TLS = 9 ' Directorio del almacén local del subproceso (Thread Local Storage)
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG = 10 ' Directorio de configuración cargada
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT = 11 ' Bound Import Table address and size.
IMAGE_DIRECTORY_ENTRY_IAT = 12 ' Import Address Table
IMAGE_DIRECTORY_ENTRY_DELAY_DESCRIPTOR = 13 ' Delay Import Descriptor.
End Enum
Private Const IMAGE_SIZEOF_SHORT_NAME = 8 ' Longitud máxima del nombre de sección.
Private Const IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16 ' Cantidad de directorios de datos.
'
'Tipos de máquinas
'
Enum PE_MACHINE_TYPE
IMAGE_FILE_MACHINE_UNKNOWN = &H0& ' Contents assumed to be applicable to any machine type.
IMAGE_FILE_MACHINE_I386 = &H14C& ' Intel 386 or later, and compatible processors.
IMAGE_FILE_MACHINE_R3000 = &H162&
IMAGE_FILE_MACHINE_R4000 = &H166& ' MIPS® little endian.
IMAGE_FILE_MACHINE_R10000 = &H168&
IMAGE_FILE_MACHINE_ALPHA = &H184& ' Alpha AXP.
IMAGE_FILE_MACHINE_M68K = &H268& ' Motorola 68000 series.
IMAGE_FILE_MACHINE_POWERPC = &H1F0& ' Power PC, little endian.
IMAGE_FILE_MACHINE_SH3 = &H1A2& ' Hitachi SH3
IMAGE_FILE_MACHINE_SH4 = &H1A6& ' Hitachi SH4
IMAGE_FILE_MACHINE_ARM = &H1C0&
End Enum
'
'Características (cabecera PE)
'
Enum PE_HEADER_CHARS
IMAGE_FILE_RELOCS_STRIPPED = &H1 ' Image only. Indicates that the file does not contain base relocations and must therefore be loaded at its preferred base address. If the base address is not available, the loader reports an error. Operating systems running on top of MS-DOS (Win32s®) are generally not able to use the preferred base address and so cannot run these images. However, beginning with version 4.0, Windows will use an application's preferred base address. The default behavior of the linker is to strip base relocations from EXEs.
IMAGE_FILE_EXECUTABLE_IMAGE = &H2 ' Image only. Indicates that the image file is valid and can be run. If this flag is not set, it generally indicates a linker error.
IMAGE_FILE_LINE_NUMS_STRIPPED = &H4 ' COFF line numbers have been removed.
IMAGE_FILE_LOCAL_SYMS_STRIPPED = &H8 ' COFF symbol table entries for local symbols have been removed.
IMAGE_FILE_AGGRESSIVE_WS_TRIM = &H10 ' Aggressively trim working set.
IMAGE_FILE_LARGE_ADDRESS_AWARE = &H20 ' App can handle > 2gb addresses.
IMAGE_FILE_16BIT_MACHINE = &H40 ' Use of this flag is reserved for future use.
IMAGE_FILE_BYTES_REVERSED_LO = &H80 ' Little endian: LSB precedes MSB in memory.
IMAGE_FILE_32BIT_MACHINE = &H100 ' Machine based on 32-bit-word architecture.
IMAGE_FILE_DEBUG_STRIPPED = &H200 ' Debugging information removed from image file.
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP = &H400 ' If image is on removable media, copy and run from swap file.
IMAGE_FILE_SYSTEM = &H1000 ' The image file is a system file, not a user program.
IMAGE_FILE_DLL = &H2000 ' The image file is a dynamic-link library (DLL). Such files are considered executable files for almost all purposes, although they cannot be directly run.
IMAGE_FILE_UP_SYSTEM_ONLY = &H4000 ' File should be run only on a UP machine.
IMAGE_FILE_BYTES_REVERSED_HI = &H8000 ' Big endian: MSB precedes LSB in memory.
End Enum
'
'Tipo de imagen (según el campo Magic del
'encabezado opcional PE
'
Enum PE_IMAGETYPE
IMAGE_TYPE_NORMAL = &H10B&
IMAGE_TYPE_ROM = &H107&
End Enum
'
'Subsistemas
'
Enum PE_SUBSYSTEM
IMAGE_SUBSYSTEM_UNKNOWN = 0 ' Unknown subsystem.
IMAGE_SUBSYSTEM_NATIVE = 1 ' Used for device drivers and native Windows NT processes.
IMAGE_SUBSYSTEM_WINDOWS_GUI = 2 ' Image runs in the Windows® graphical user interface (GUI) subsystem.
IMAGE_SUBSYSTEM_WINDOWS_CUI = 3 ' Image runs in the Windows character subsystem.
IMAGE_SUBSYSTEM_POSIX_CUI = 7 ' Image runs in the Posix character subsystem.
IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 9 ' Image runs in on Windows CE
End Enum
'
'Características de las DLL
'
Enum PE_DLL_CHARS
IMAGE_DLLCHARACTERISTICS_RESERVED1 = &H1 ' Reserved
IMAGE_DLLCHARACTERISTICS_RESERVED2 = &H2 ' Reserved
IMAGE_DLLCHARACTERISTICS_RESERVED3 = &H4 ' Reserved
IMAGE_DLLCHARACTERISTICS_RESERVED4 = &H8 ' Reserved
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = &H2000 ' Driver is a WDM Driver
End Enum
'
'Características de las secciones.
'
Enum PE_SECTION_CHARS
IMAGE_SCN_TYPE_REG = &H0 ' Reserved for future use.
IMAGE_SCN_TYPE_DSECT = &H1 ' Reserved for future use.
IMAGE_SCN_TYPE_NOLOAD = &H2 ' Reserved for future use.
IMAGE_SCN_TYPE_GROUP = &H4 ' Reserved for future use.
IMAGE_SCN_TYPE_NO_PAD = &H8 ' Section should not be padded to next boundary. This is obsolete and replaced by IMAGE_SCN_ALIGN_1BYTES. This is valid for object files only.
IMAGE_SCN_TYPE_COPY = &H10 ' Reserved for future use.
IMAGE_SCN_CNT_CODE = &H20 ' Section contains executable code.
IMAGE_SCN_CNT_INITIALIZED_DATA = &H40 ' Section contains initialized data.
IMAGE_SCN_CNT_UNINITIALIZED_DATA = &H80 ' Section contains uninitialized data.
IMAGE_SCN_LNK_OTHER = &H100 ' Reserved for future use.
IMAGE_SCN_LNK_INFO = &H200 ' Section contains comments or other information. The .drectve section has this type. This is valid for object files only.
IMAGE_SCN_TYPE_OVER = &H400 ' Reserved for future use.
IMAGE_SCN_LNK_REMOVE = &H800 ' Section will not become part of the image. This is valid for object files only.
IMAGE_SCN_LNK_COMDAT = &H1000 ' Section contains COMDAT data. See Section 5.5.6, "COMDAT Sections," for more information. This is valid for object files only.
IMAGE_SCN_MEM_FARDATA = &H8000 ' Reserved for future use.
IMAGE_SCN_MEM_PURGEABLE = &H20000 ' Reserved for future use.
IMAGE_SCN_MEM_16BIT = &H20000 ' Reserved for future use.
IMAGE_SCN_MEM_LOCKED = &H40000 ' Reserved for future use.
IMAGE_SCN_MEM_PRELOAD = &H80000 ' Reserved for future use.
IMAGE_SCN_ALIGN_1BYTES = &H100000 ' Align data on a 1 byte boundary. This is valid for object files only.
IMAGE_SCN_ALIGN_2BYTES = &H200000 ' Align data on a 2 byte boundary. This is valid for object files only.
IMAGE_SCN_ALIGN_4BYTES = &H300000 ' Align data on a 4 byte boundary. This is valid for object files only.
IMAGE_SCN_ALIGN_8BYTES = &H400000 ' Align data on a 8 byte boundary. This is valid for object files only.
IMAGE_SCN_ALIGN_16BYTES = &H500000 ' Align data on a 16 byte boundary. This is valid for object files only.
IMAGE_SCN_ALIGN_32BYTES = &H600000 ' Align data on a 32 byte boundary. This is valid for object files only.
IMAGE_SCN_ALIGN_64BYTES = &H700000 ' Align data on a 64 byte boundary. This is valid for object files only.
IMAGE_SCN_LNK_OVFL = &H1000000 ' Section contains extended relocations.
IMAGE_SCN_MEM_DISCARDABLE = &H2000000 ' Section can be discarded as needed.
IMAGE_SCN_MEM_NOT_CACHED = &H4000000 ' Section cannot be cached.
IMAGE_SCN_MEM_NOT_PAGED = &H8000000 ' Section is not pageable.
IMAGE_SCN_MEM_SHARED = &H10000000 ' Section can be shared in memory.
IMAGE_SCN_MEM_EXECUTE = &H20000000 ' Section can be executed as code.
IMAGE_SCN_MEM_READ = &H40000000 ' Section can be read.
IMAGE_SCN_MEM_WRITE = &H80000000 ' Section can be written to.
End Enum
'
'Valores para SectionNumber, de IMAGE_SYM_TABLE_ENTRY
'
Private Const IMAGE_SYM_UNDEFINED = 0 ' Symbol record is not yet assigned a section. If the value is 0 this indicates a references to an external symbol defined elsewhere. If the value is non-zero this is a common symbol with a size specified by the value.
Private Const IMAGE_SYM_ABSOLUTE = -1 ' The symbol has an absolute (non-relocatable) value and is not an address.
Private Const IMAGE_SYM_DEBUG = -2 ' The symbol provides general type or debugging information but does not correspond to a section. Microsoft tools use this setting along with .file records (storage class FILE).
'
'Tipos de símbolos (Public Type de IMAGE_SYM_TABLE_ENTRY)
'
Enum PE_SYM_TYPE
'
'Byte Bajo
'
IMAGE_SYM_TYPE_NULL = 0 ' No type information or unknown base type. Microsoft tools use this setting.
IMAGE_SYM_TYPE_VOID = 1 ' No valid type; used with void pointers and functions.
IMAGE_SYM_TYPE_CHAR = 2 ' Character (signed byte).
IMAGE_SYM_TYPE_SHORT = 3 ' Two-byte signed integer.
IMAGE_SYM_TYPE_INT = 4 ' Natural integer type (normally four bytes in Windows NT).
IMAGE_SYM_TYPE_LONG = 5 ' Four-byte signed integer.
IMAGE_SYM_TYPE_FLOAT = 6 ' Four-byte floating-point number.
IMAGE_SYM_TYPE_DOUBLE = 7 ' Eight-byte floating-point number.
IMAGE_SYM_TYPE_STRUCT = 8 ' Structure.
IMAGE_SYM_TYPE_UNION = 9 ' Union.
IMAGE_SYM_TYPE_ENUM = 10 ' Enumerated type.
IMAGE_SYM_TYPE_MOE = 11 ' Member of enumeration (a specific value).
IMAGE_SYM_TYPE_BYTE = 12 ' Byte; unsigned one-byte integer.
IMAGE_SYM_TYPE_WORD = 13 ' Word; unsigned two-byte integer.
IMAGE_SYM_TYPE_UINT = 14 ' Unsigned integer of natural size (normally, four bytes).
IMAGE_SYM_TYPE_DWORD = 15 ' Unsigned four-byte integer.
'
'Byte Alto
'
IMAGE_SYM_DTYPE_NULL = 0 ' No derived type; the symbol is a simple scalar variable.
IMAGE_SYM_DTYPE_POINTER = 1 ' Pointer to base type.
IMAGE_SYM_DTYPE_FUNCTION = 2 ' Function returning base type.
IMAGE_SYM_DTYPE_ARRAY = 3 ' Array of base type.
End Enum
'
'Tipos de definición de los símbolos (StorageClass)
'
Enum PE_SYM_CLASS
IMAGE_SYM_CLASS_END_OF_FUNCTION = -1 ' (0xFF) Special symbol representing end of function, for debugging purposes.
IMAGE_SYM_CLASS_NULL = 0 ' No storage class assigned.
IMAGE_SYM_CLASS_AUTOMATIC = 1 ' Automatic (stack) variable. The Value field specifies stack frame offset.
IMAGE_SYM_CLASS_EXTERNAL = 2 ' Used by Microsoft tools for external symbols. The Value field indicates the size if the section number is IMAGE_SYM_UNDEFINED (0). If the section number is not 0, then the Value field specifies the offset within the section.
IMAGE_SYM_CLASS_STATIC = 3 ' The Value field specifies the offset of the symbol within the section. If the Value is 0, then the symbol represents a section name.
IMAGE_SYM_CLASS_REGISTER = 4 ' Register variable. The Value field specifies register number.
IMAGE_SYM_CLASS_EXTERNAL_DEF = 5 ' Symbol is defined externally.
IMAGE_SYM_CLASS_LABEL = 6 ' Code label defined within the module. The Value field specifies the offset of the symbol within the section.
IMAGE_SYM_CLASS_UNDEFINED_LABEL = 7 ' Reference to a code label not defined.
IMAGE_SYM_CLASS_MEMBER_OF_STRUCT = 8 ' Structure member. The Value field specifies nth member.
IMAGE_SYM_CLASS_ARGUMENT = 9 ' Formal argument (parameter)of a function. The Value field specifies nth argument.
IMAGE_SYM_CLASS_STRUCT_TAG = 10 ' Structure tag-name entry.
IMAGE_SYM_CLASS_MEMBER_OF_UNION = 11 ' Union member. The Value field specifies nth member.
IMAGE_SYM_CLASS_UNION_TAG = 12 ' Union tag-name entry.
IMAGE_SYM_CLASS_TYPE_DEFINITION = 13 ' Typedef entry.
IMAGE_SYM_CLASS_UNDEFINED_STATIC = 14 ' Static data declaration.
IMAGE_SYM_CLASS_ENUM_TAG = 15 ' Enumerated type tagname entry.
IMAGE_SYM_CLASS_MEMBER_OF_ENUM = 16 ' Member of enumeration. Value specifies nth member.
IMAGE_SYM_CLASS_REGISTER_PARAM = 17 ' Register parameter.
IMAGE_SYM_CLASS_BIT_FIELD = 18 ' Bit-field reference. Value specifies nth bit in the bit field.
IMAGE_SYM_CLASS_BLOCK = 100 ' A .bb (beginning of block) or .eb (end of block) record. Value is the relocatable address of the code location.
IMAGE_SYM_CLASS_FUNCTION = 101 ' Used by Microsoft tools for symbol records that define the extent of a function: begin function (named .bf), end function (.ef), and lines in function (.lf). For .lf records, Value gives the number of source lines in the function. For .ef records, Value gives the size of function code.
IMAGE_SYM_CLASS_END_OF_STRUCT = 102 ' End of structure entry.
IMAGE_SYM_CLASS_FILE = 103 ' Used by Microsoft tools, as well as traditional COFF format, for the source-file symbol record. The symbol is followed by auxiliary records that name the file.
IMAGE_SYM_CLASS_SECTION = 104 ' Definition of a section (Microsoft tools use STATIC storage class instead).
IMAGE_SYM_CLASS_WEAK_EXTERNAL = 105 ' Weak external. Microsoft tools use EXTERNAL storage class instead. See Section 5.5.3, "Auxiliary Format 3: Weak Externals," for more information.
End Enum
'
' Tipos de Recursos Predefinidos
'
Enum PE_RESOURCE_TYPE
RT_CURSOR = 1
RT_BITMAP = 2
RT_ICON = 3
RT_MENU = 4
RT_DIALOG = 5
RT_STRING = 6
RT_FONTDIR = 7
RT_FONT = 8
RT_ACCELERATOR = 9
RT_RCDATA = 10
RT_MESSAGETABLE = 11
End Enum
'
'Nombre de los recursos.
'
Private Const IDR_CURSOR = "CURSOR"
Private Const IDR_BITMAP = "BITMAP"
Private Const IDR_ICON = "ICON"
Private Const IDR_MENU = "MENU"
Private Const IDR_DIALOG = "DIALOG"
Private Const IDR_STRING = "STRING"
Private Const IDR_FONTDIR = "FONTDIR"
Private Const IDR_FONT = "FONT"
Private Const IDR_ACCELERATOR = "ACCELERATOR"
Private Const IDR_RCDATA = "RCDATA"
Private Const IDR_MESSAGETABLE = "MESSAGETABLE"
Private Const MAXRESOURCENAME = 13
'
'GetImportData
'
Enum PE_IMPORT_DATA_CLASS
IMPORT_DATA_MODULES = 1
IMPORT_DATA_FUNCTIONS = 2
IMPORT_DATA_HINTS = 3
End Enum
'
'Errores generales.
'
Enum PE_ERRORS
ERROR_BASE = 10000
ERROR_DEFAULT = ERROR_BASE
ERROR_INVALID_IMAGE = ERROR_BASE + 1
ERROR_NO_DOS_SIGNATURE_FOUND = ERROR_BASE + 2
ERROR_NO_PE_SIGNATURE_FOUND = ERROR_BASE + 3
ERROR_NO_OPT_SIGNATURE_FOUND = ERROR_BASE + 4
ERROR_INVALID_IMAGE32 = ERROR_BASE + 5
ERROR_FILE_NOT_SPECIFIED = ERROR_BASE + 6
ERROR_IMAGE_NOT_LOADED = ERROR_BASE + 7
ERROR_IMAGE_READONLY = ERROR_BASE + 8
ERROR_SECTION_PRIVATE = ERROR_BASE + 9 ' La sección no fue creada por la clase.
ERROR_SECTION_OVERFLOW = ERROR_BASE + 10 ' Se sobrepasaron los límites de la sección.
ERROR_PROCESS_STILL_ACTIVE = ERROR_BASE + 11 ' El proceso no se pudo terminar y sigue activo.
ERROR_FILE_EXIST = ERROR_BASE + 12 ' El archivo ya existe y no puede ser reemplazado.
ERROR_COUNT = 12
End Enum
Public Type IMAGE_DOS_HEADER
e_magic As Integer ' Caracteres MZ
e_cblp As Integer ' Bytes en la última página del archivo file
e_cp As Integer ' Páginas in el archive
e_crlc As Integer ' Reagrupaciones
e_cparhdr As Integer ' Tamaño del encabezado en párrafos
e_minalloc As Integer ' Mínimo de párrafos extra que se necesitan
e_maxalloc As Integer ' Máximo de párrafos extra que se necesitan
e_ss As Integer ' Valor SS inicial (relativo)
e_sp As Integer ' Valor SP inicial
e_csum As Integer ' Checksum
e_ip As Integer ' Valor IP inicial
e_cs As Integer ' Valor CS inicial(relativo)
e_lfarlc As Integer ' Dirección del archivo de las tablas de reagrupaciones
e_ovno As Integer ' Número de cubierta (overlay)
e_res(1 To 4) As Integer ' Palabras reservadas
e_oemid As Integer ' Identificador OEM (para e_oeminfo)
e_oeminfo As Integer ' Información OEM; e_oemid específico
e_res2(1 To 10) As Integer ' Palabras reservadas
e_lfanew As Long ' Dirección en archivo del nuevo encabezado exe
End Type
Public Type IMAGE_FILE_HEADER
Magic As Long
Machine As Integer
NumberOfSections As Integer
TimeDateStamp As Long
PointerToSymbolTable As Long
NumberOfSymbols As Long
SizeOfOptionalHeader As Integer
Characteristics As Integer
End Type
Type IMAGE_DATA_DIRECTORY
VirtualAddress As Long
Size As Long
End Type
Public Type IMAGE_OPTIONAL_HEADER
Magic As Integer
MajorLinkerVersion As Byte
MinorLinkerVersion As Byte
SizeOfCode As Long
SizeOfInitializedData As Long
SizeOfUninitializedData As Long
AddressOfEntryPoint As Long
BaseOfCode As Long
BaseOfData As Long
ImageBase As Long
SectionAlignment As Long
FileAlignment As Long
MajorOperatingSystemVersion As Integer
MinorOperatingSystemVersion As Integer
MajorImageVersion As Integer
MinorImageVersion As Integer
MajorSubsystemVersion As Integer
MinorSubsystemVersion As Integer
Reserved1 As Long
SizeOfImage As Long
SizeOfHeaders As Long
CheckSum As Long
Subsystem As Integer
DllCharacteristics As Integer
SizeOfStackReserve As Long
SizeOfStackCommit As Long
SizeOfHeapReserve As Long
SizeOfHeapCommit As Long
LoaderFlags As Long
NumberOfRvaAndSizes As Long
DataDirectory(1 To IMAGE_NUMBEROF_DIRECTORY_ENTRIES) As IMAGE_DATA_DIRECTORY
End Type
Public Type IMAGE_SECTION_HEADER
sName(1 To IMAGE_SIZEOF_SHORT_NAME) As Byte
Reserved1 As Long
VirtualAddress As Long
SizeOfRawData As Long
PointerToRawData As Long
PointerToRelocations As Integer
PointerToLinenumbers As Integer
NumberOfRelocations As Integer
NumberOfLineNumbers As Integer
Reserved2 As Long
Characteristics As Long
End Type
Public Type IMAGE_EXPORT_DIRECTORY
Characteristics As Long
TimeDateStamp As Long
MajorVersion As Integer
MinorVersion As Integer
NameRVA As Long
OrdinalBase As Long
NumberOfEntries As Long
NumberOfNames As Long
ExportAddressTableRVA As Long
NamePointerRVA As Long
OrdinalTableRVA As Long
End Type
Public Type IMAGE_EXPORT_ADDRESS_TABLE_ENTRY
ExportRVA As Long
ForwarderRVA As Long
End Type
Public Type IMAGE_IMPORT_MODULE_DIRECTORY
FunctionNameListRVA As Long
TimeDateStamp As Long
FowarderChain As Long
ModuleNameRVA As Long
FunctionAddressListRVA As Long
End Type
Public Type IMAGE_THUNK_DATA32
ForwarderString As Long
Function As Long
Ordinal As Long
AddressOfData As Long
End Type
Public Type IMAGE_IMPORT_DESCRIPTOR
'=IMAGE_IMPORT_MODULE_DIRECTORY
Characteristics As Long
OriginalFirstThunk As Long
TimeDateStamp As Long
ForwarderChain As Long
ModuleName As Long
FirstThunk As Long
End Type
Public Type IMAGE_BOUND_IMPORT_DESCRIPTOR
TimeDateStamp As Long
OffsetModuleName As Integer
NumberOfModuleForwarderRefs As Integer
End Type
Public Type IMAGE_TLS_DIRECTORY32
StartAddressOfRawData As Long
EndAddressOfRawData As Long
AddressOfIndex As Long
AddressOfCallBacks As Long
SizeOfZeroFill As Long
Characteristics As Long
End Type
Public Type IMAGE_RESOURCE_DIRECTORY
Characteristics As Long
TimeDateStamp As Long
MajorVersion As Integer
MinorVersion As Integer
NumberOfNamedEntries As Integer
NumberOfIdEntries As Integer
End Type
Public Type IMAGE_RESOURCE_DIRECTORY_ENTRY
NameRVA As Long
IntID As Long
DataEntryRVA As Long
SubdirectoryRVA As Long
End Type
Public Type IMAGE_RESOURCE_DATA_ENTRY
OffsetToData As Long
Size As Long
CodePage As Long
Reserved As Long
End Type
Public Type IMAGE_RESOURCE_DIR_STRING_U
Length As Integer
wNameString(1 To 2) As Byte
End Type
Public Type IMAGE_LOAD_CONFIG_DIRECTORY
Characteristics As Long
TimeDateStamp As Long
MajorVersion As Integer
MinorVersion As Integer
GlobalFlagsClear As Long
GlobalFlagsSet As Long
CriticalSectionDefaultTimeout As Long
DeCommitFreeBlockThreshold As Long
DeCommitTotalFreeThreshold As Long
LockPrefixTable As Long
MaximumAllocationSize As Long
VirtualMemoryThreshold As Long
ProcessHeapFlags As Long
Reserved(1 To 4) As Long
End Type
Public Type IMAGE_RUNTIME_FUNCTION_ENTRY
BeginAddress As Long
EndAddress As Long
ExceptionHandler As Long
HandlerData As Long
PrologEndAddress As Long
End Type
Public Type IMAGE_SYM_TABLE_ENTRY
sName(1 To 8) As Byte
Value As Long
SectionNumber As Integer
Type As Integer
StorageClass As Byte
NumberOfAuxSymbols As Integer
End Type
Public Type IMAGE_COFF_SYMBOLS_HEADER
NumberOfSymbols As Long
LvaToFirstSymbol As Long
NumberOfLineNumbers As Long
LvaToFirstLinenumber As Long
RvaToFirstByteOfCode As Long
RvaToLastByteOfCode As Long
RvaToFirstByteOfData As Long
RvaToLastByteOfData As Long
End Type
Public Type IMAGE_RELOCATION
VirtualAddress As Long
RelocCount As Long
SymbolTableIndex As Long
Type As Integer
End Type
Public Type IMAGE_BASE_RELOCATION
VirtualAddress As Long
SizeOfBlock As Long
End Type
Public Type IMAGE_LINENUMBER
SymbolTableIndex As Long
VirtualAddress As Long
Linenumber As Integer
End Type
Public Type IMAGE_DEBUG_DIRECTORY
Characteristics As Long
TimeDateStamp As Long
MajorVersion As Integer
MinorVersion As Integer
Type As Long
SizeOfData As Long
AddressOfRawData As Long
PointerToRawData As Long
End Type