bytecode_pe.h
Go to the documentation of this file.
00001 /*
00002  *  Copyright (C) 2009 Sourcefire, Inc.
00003  *  All rights reserved.
00004  *
00005  * Redistribution and use in source and binary forms, with or without
00006  * modification, are permitted provided that the following conditions
00007  * are met:
00008  * 1. Redistributions of source code must retain the above copyright
00009  *    notice, this list of conditions and the following disclaimer.
00010  * 2. Redistributions in binary form must reproduce the above copyright
00011  *    notice, this list of conditions and the following disclaimer in the
00012  *    documentation and/or other materials provided with the distribution.
00013  *
00014  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS AS IS'' AND
00015  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
00016  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
00017  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
00018  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
00019  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
00020  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
00021  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
00022  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
00023  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
00024  * SUCH DAMAGE.
00025  */
00026 
00027 #ifndef __PE_H
00028 #define __PE_H
00029 
00033 struct pe_image_file_hdr {
00034     uint32_t Magic;  
00035     uint16_t Machine;
00036     uint16_t NumberOfSections;
00037     uint32_t TimeDateStamp;   
00038     uint32_t PointerToSymbolTable;          
00039     uint32_t NumberOfSymbols;               
00040     uint16_t SizeOfOptionalHeader;          
00041     uint16_t Characteristics;
00042 };
00043 
00046 struct pe_image_data_dir {
00047     uint32_t VirtualAddress;
00048     uint32_t Size;
00049 };
00050 
00053 struct pe_image_optional_hdr32 {
00054     uint16_t Magic;
00055     uint8_t  MajorLinkerVersion;                    
00056     uint8_t  MinorLinkerVersion;                    
00057     uint32_t SizeOfCode;                            
00058     uint32_t SizeOfInitializedData;                 
00059     uint32_t SizeOfUninitializedData;               
00060     uint32_t AddressOfEntryPoint;
00061     uint32_t BaseOfCode;
00062     uint32_t BaseOfData;
00063     uint32_t ImageBase;                             
00064     uint32_t SectionAlignment;                      
00065     uint32_t FileAlignment;                         
00066     uint16_t MajorOperatingSystemVersion;           
00067     uint16_t MinorOperatingSystemVersion;           
00068     uint16_t MajorImageVersion;                     
00069     uint16_t MinorImageVersion;                     
00070     uint16_t MajorSubsystemVersion;
00071     uint16_t MinorSubsystemVersion;
00072     uint32_t Win32VersionValue;                     /*< ? */
00073     uint32_t SizeOfImage;
00074     uint32_t SizeOfHeaders;
00075     uint32_t CheckSum;                              
00076     uint16_t Subsystem;
00077     uint16_t DllCharacteristics;
00078     uint32_t SizeOfStackReserve;
00079     uint32_t SizeOfStackCommit;
00080     uint32_t SizeOfHeapReserve;
00081     uint32_t SizeOfHeapCommit;
00082     uint32_t LoaderFlags;                           /*< ? */
00083     uint32_t NumberOfRvaAndSizes;                   
00084     struct pe_image_data_dir DataDirectory[16];
00085 };
00086 
00089 struct pe_image_optional_hdr64 {
00090     uint16_t Magic;
00091     uint8_t  MajorLinkerVersion;                    
00092     uint8_t  MinorLinkerVersion;                    
00093     uint32_t SizeOfCode;                            
00094     uint32_t SizeOfInitializedData;                 
00095     uint32_t SizeOfUninitializedData;               
00096     uint32_t AddressOfEntryPoint;
00097     uint32_t BaseOfCode;
00098     uint64_t ImageBase;                             
00099     uint32_t SectionAlignment;                      
00100     uint32_t FileAlignment;                         
00101     uint16_t MajorOperatingSystemVersion;           
00102     uint16_t MinorOperatingSystemVersion;           
00103     uint16_t MajorImageVersion;                     
00104     uint16_t MinorImageVersion;                     
00105     uint16_t MajorSubsystemVersion;
00106     uint16_t MinorSubsystemVersion;
00107     uint32_t Win32VersionValue;                     /* ? */
00108     uint32_t SizeOfImage;
00109     uint32_t SizeOfHeaders;
00110     uint32_t CheckSum;                              
00111     uint16_t Subsystem;
00112     uint16_t DllCharacteristics;
00113     uint64_t SizeOfStackReserve;
00114     uint64_t SizeOfStackCommit;
00115     uint64_t SizeOfHeapReserve;
00116     uint64_t SizeOfHeapCommit;
00117     uint32_t LoaderFlags;                           /* ? */
00118     uint32_t NumberOfRvaAndSizes;                   
00119     struct pe_image_data_dir DataDirectory[16];
00120 };
00121 
00124 struct pe_image_section_hdr {
00125     uint8_t Name[8];                        
00126     /*
00127     union {
00128         uint32_t PhysicalAddress;
00129         uint32_t VirtualSize;
00130     } AddrSize;
00131     */
00132     uint32_t VirtualSize;
00133     uint32_t VirtualAddress;
00134     uint32_t SizeOfRawData;                 
00135     uint32_t PointerToRawData;              
00136     uint32_t PointerToRelocations;          
00137     uint32_t PointerToLinenumbers;          
00138     uint16_t NumberOfRelocations;           
00139     uint16_t NumberOfLinenumbers;           
00140     uint32_t Characteristics;
00141 };
00142 
00145 struct cli_pe_hook_data {
00146   uint32_t offset;
00147   uint32_t ep; 
00148   uint16_t nsections;
00149   uint16_t dummy; /* align */
00150   struct pe_image_file_hdr file_hdr;
00151   struct pe_image_optional_hdr32 opt32; 
00152   uint32_t dummy2; /* align */
00153   struct pe_image_optional_hdr64 opt64;
00154   struct pe_image_data_dir dirs[16]; 
00155   uint32_t e_lfanew;
00156   uint32_t overlays;
00157   int32_t overlays_sz;
00158   uint32_t hdr_size;
00159 };
00160 
00161 
00162 
00163 
00164 #endif
 All Data Structures Files Functions Variables Enumerations Enumerator Defines