00001 /* 00002 * Copyright (C) 2009 Sourcefire, Inc. 00003 * All rights reserved. 00004 * 00005 * Redistribution and use in source and binary forms, with or without 00006 * modification, are permitted provided that the following conditions 00007 * are met: 00008 * 1. Redistributions of source code must retain the above copyright 00009 * notice, this list of conditions and the following disclaimer. 00010 * 2. Redistributions in binary form must reproduce the above copyright 00011 * notice, this list of conditions and the following disclaimer in the 00012 * documentation and/or other materials provided with the distribution. 00013 * 00014 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS AS IS'' AND 00015 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 00016 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 00017 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 00018 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 00019 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 00020 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 00021 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 00022 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 00023 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 00024 * SUCH DAMAGE. 00025 */ 00026 00027 #ifndef __PE_H 00028 #define __PE_H 00029 00033 struct pe_image_file_hdr { 00034 uint32_t Magic; 00035 uint16_t Machine; 00036 uint16_t NumberOfSections; 00037 uint32_t TimeDateStamp; 00038 uint32_t PointerToSymbolTable; 00039 uint32_t NumberOfSymbols; 00040 uint16_t SizeOfOptionalHeader; 00041 uint16_t Characteristics; 00042 }; 00043 00046 struct pe_image_data_dir { 00047 uint32_t VirtualAddress; 00048 uint32_t Size; 00049 }; 00050 00053 struct pe_image_optional_hdr32 { 00054 uint16_t Magic; 00055 uint8_t MajorLinkerVersion; 00056 uint8_t MinorLinkerVersion; 00057 uint32_t SizeOfCode; 00058 uint32_t SizeOfInitializedData; 00059 uint32_t SizeOfUninitializedData; 00060 uint32_t AddressOfEntryPoint; 00061 uint32_t BaseOfCode; 00062 uint32_t BaseOfData; 00063 uint32_t ImageBase; 00064 uint32_t SectionAlignment; 00065 uint32_t FileAlignment; 00066 uint16_t MajorOperatingSystemVersion; 00067 uint16_t MinorOperatingSystemVersion; 00068 uint16_t MajorImageVersion; 00069 uint16_t MinorImageVersion; 00070 uint16_t MajorSubsystemVersion; 00071 uint16_t MinorSubsystemVersion; 00072 uint32_t Win32VersionValue; /*< ? */ 00073 uint32_t SizeOfImage; 00074 uint32_t SizeOfHeaders; 00075 uint32_t CheckSum; 00076 uint16_t Subsystem; 00077 uint16_t DllCharacteristics; 00078 uint32_t SizeOfStackReserve; 00079 uint32_t SizeOfStackCommit; 00080 uint32_t SizeOfHeapReserve; 00081 uint32_t SizeOfHeapCommit; 00082 uint32_t LoaderFlags; /*< ? */ 00083 uint32_t NumberOfRvaAndSizes; 00084 struct pe_image_data_dir DataDirectory[16]; 00085 }; 00086 00089 struct pe_image_optional_hdr64 { 00090 uint16_t Magic; 00091 uint8_t MajorLinkerVersion; 00092 uint8_t MinorLinkerVersion; 00093 uint32_t SizeOfCode; 00094 uint32_t SizeOfInitializedData; 00095 uint32_t SizeOfUninitializedData; 00096 uint32_t AddressOfEntryPoint; 00097 uint32_t BaseOfCode; 00098 uint64_t ImageBase; 00099 uint32_t SectionAlignment; 00100 uint32_t FileAlignment; 00101 uint16_t MajorOperatingSystemVersion; 00102 uint16_t MinorOperatingSystemVersion; 00103 uint16_t MajorImageVersion; 00104 uint16_t MinorImageVersion; 00105 uint16_t MajorSubsystemVersion; 00106 uint16_t MinorSubsystemVersion; 00107 uint32_t Win32VersionValue; /* ? */ 00108 uint32_t SizeOfImage; 00109 uint32_t SizeOfHeaders; 00110 uint32_t CheckSum; 00111 uint16_t Subsystem; 00112 uint16_t DllCharacteristics; 00113 uint64_t SizeOfStackReserve; 00114 uint64_t SizeOfStackCommit; 00115 uint64_t SizeOfHeapReserve; 00116 uint64_t SizeOfHeapCommit; 00117 uint32_t LoaderFlags; /* ? */ 00118 uint32_t NumberOfRvaAndSizes; 00119 struct pe_image_data_dir DataDirectory[16]; 00120 }; 00121 00124 struct pe_image_section_hdr { 00125 uint8_t Name[8]; 00126 /* 00127 union { 00128 uint32_t PhysicalAddress; 00129 uint32_t VirtualSize; 00130 } AddrSize; 00131 */ 00132 uint32_t VirtualSize; 00133 uint32_t VirtualAddress; 00134 uint32_t SizeOfRawData; 00135 uint32_t PointerToRawData; 00136 uint32_t PointerToRelocations; 00137 uint32_t PointerToLinenumbers; 00138 uint16_t NumberOfRelocations; 00139 uint16_t NumberOfLinenumbers; 00140 uint32_t Characteristics; 00141 }; 00142 00145 struct cli_pe_hook_data { 00146 uint32_t offset; 00147 uint32_t ep; 00148 uint16_t nsections; 00149 uint16_t dummy; /* align */ 00150 struct pe_image_file_hdr file_hdr; 00151 struct pe_image_optional_hdr32 opt32; 00152 uint32_t dummy2; /* align */ 00153 struct pe_image_optional_hdr64 opt64; 00154 struct pe_image_data_dir dirs[16]; 00155 uint32_t e_lfanew; 00156 uint32_t overlays; 00157 int32_t overlays_sz; 00158 uint32_t hdr_size; 00159 }; 00160 00161 00162 00163 00164 #endif