typedef struct { DWORD Signature; //00 'PE' // IMAGE_FILE_HEADER FileHeader; WORD Machine; //04 WORD NumberOfSections; //06 DWORD TimeDateStamp; //08 DWORD PointerToSymbolTable; //0c DWORD NumberOfSymbols; //10 WORD SizeOfOptionalHeader; //14 WORD Characteristics; //16 // IMAGE_OPTIONAL_HEADER OptionalHeader; WORD Magic; //+18 BYTE MajorLinkerVersion; //+1a BYTE MinorLinkerVersion; DWORD SizeOfCode; //+1c DWORD SizeOfInitializedData; //+20 DWORD SizeOfUninitializedData; DWORD AddressOfEntryPoint; DWORD BaseOfCode; //+2c DWORD BaseOfData; //+30 DWORD ImageBase; //+34 DWORD SectionAlignment; DWORD FileAlignment; WORD MajorOperatingSystemVersion; //+40 WORD MinorOperatingSystemVersion; WORD MajorImageVersion; WORD MinorImageVersion; WORD MajorSubsystemVersion; //+48 WORD MinorSubsystemVersion; DWORD Win32VersionValue; //+4c DWORD SizeOfImage; //+50 DWORD SizeOfHeaders; DWORD CheckSum; //+58 WORD Subsystem; //+5c WORD DllCharacteristics; DWORD SizeOfStackReserve; //+60 DWORD SizeOfStackCommit; DWORD SizeOfHeapReserve; DWORD SizeOfHeapCommit; DWORD LoaderFlags; //+70 DWORD NumberOfRvaAndSizes; //+74 // IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; DWORD EXPORT_VirtualAddress; //+78 DWORD EXPORT_Size; //+7c DWORD IMPORT_VirtualAddress; //+80 DWORD IMPORT_Size; //+84 DWORD RESORC_VirtualAddress; //+88 DWORD RESORC_Size; //+8c DWORD EXCEPT_VirtualAddress; //+90 DWORD EXCEPT_Size; //+94 DWORD SECURT_VirtualAddress; //+98 DWORD SECURT_Size; //+9c DWORD RELOC_VirtualAddress; //+a0 DWORD RELOC_Size; //+a4 DWORD DEBUG_VirtualAddress; //+a8 DWORD DEBUG_Size; //+ac } myPE,*PmyPE; // // Section header format. // /* #define IMAGE_SIZEOF_SHORT_NAME 8 typedef struct _IMAGE_SECTION_HEADER { BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; union { DWORD PhysicalAddress; DWORD VirtualSize; } Misc; DWORD VirtualAddress; DWORD SizeOfRawData; DWORD PointerToRawData; DWORD PointerToRelocations; DWORD PointerToLinenumbers; WORD NumberOfRelocations; WORD NumberOfLinenumbers; DWORD Characteristics; } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER; #define IMAGE_SIZEOF_SECTION_HEADER 40 */ #define my_FIRST_SECTION( ntheader ) ((PIMAGE_SECTION_HEADER) \ ((DWORD)ntheader + 0x18 + \ ntheader->SizeOfOptionalHeader \ )) // // Export Format // /* typedef struct _IMAGE_EXPORT_DIRECTORY { DWORD Characteristics; //00 DWORD TimeDateStamp; //04 WORD MajorVersion; //08 WORD MinorVersion; //0a DWORD Name; //0c DWORD Base; //10 DWORD NumberOfFunctions; //14 DWORD NumberOfNames; //18 PDWORD *AddressOfFunctions;//1c PDWORD *AddressOfNames; //20 PWORD *AddressOfNameOrdinals;//24 } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY; */