github.com/saferwall/pe@v1.5.2/pe.go (about) 1 // Copyright 2018 Saferwall. All rights reserved. 2 // Use of this source code is governed by Apache v2 license 3 // license that can be found in the LICENSE file. 4 5 package pe 6 7 // Image executable types 8 const ( 9 10 // The DOS MZ executable format is the executable file format used 11 // for .EXE files in DOS. 12 ImageDOSSignature = 0x5A4D // MZ 13 ImageDOSZMSignature = 0x4D5A // ZM 14 15 // The New Executable (abbreviated NE or NewEXE) is a 16-bit .exe file 16 // format, a successor to the DOS MZ executable format. It was used in 17 // Windows 1.0–3.x, multitasking MS-DOS 4.0, OS/2 1.x, and the OS/2 subset 18 // of Windows NT up to version 5.0 (Windows 2000). A NE is also called a 19 // segmented executable. 20 ImageOS2Signature = 0x454E 21 22 // Linear Executable is an executable file format in the EXE family. 23 // It was used by 32-bit OS/2, by some DOS extenders, and by Microsoft 24 // Windows VxD files. It is an extension of MS-DOS EXE, and a successor 25 // to NE (New Executable). 26 ImageOS2LESignature = 0x454C 27 28 // There are two main varieties of LE executables: 29 // LX (32-bit), and LE (mixed 16/32-bit). 30 ImageVXDSignature = 0x584C 31 32 // Terse Executables have a 'VZ' signature. 33 ImageTESignature = 0x5A56 34 35 // The Portable Executable (PE) format is a file format for executables, 36 // object code, DLLs and others used in 32-bit and 64-bit versions of 37 // Windows operating systems. 38 ImageNTSignature = 0x00004550 // PE00 39 ) 40 41 // Optional Header magic 42 const ( 43 ImageNtOptionalHeader32Magic = 0x10b 44 ImageNtOptionalHeader64Magic = 0x20b 45 ImageROMOptionalHeaderMagic = 0x10 46 ) 47 48 // Image file machine types 49 const ( 50 ImageFileMachineUnknown = ImageFileHeaderMachineType(0x0) // The contents of this field are assumed to be applicable to any machine type 51 ImageFileMachineAM33 = ImageFileHeaderMachineType(0x1d3) // Matsushita AM33 52 ImageFileMachineAMD64 = ImageFileHeaderMachineType(0x8664) // x64 53 ImageFileMachineARM = ImageFileHeaderMachineType(0x1c0) // ARM little endian 54 ImageFileMachineARM64 = ImageFileHeaderMachineType(0xaa64) // ARM64 little endian 55 ImageFileMachineARMNT = ImageFileHeaderMachineType(0x1c4) // ARM Thumb-2 little endian 56 ImageFileMachineEBC = ImageFileHeaderMachineType(0xebc) // EFI byte code 57 ImageFileMachineI386 = ImageFileHeaderMachineType(0x14c) // Intel 386 or later processors and compatible processors 58 ImageFileMachineIA64 = ImageFileHeaderMachineType(0x200) // Intel Itanium processor family 59 ImageFileMachineM32R = ImageFileHeaderMachineType(0x9041) // Mitsubishi M32R little endian 60 ImageFileMachineMIPS16 = ImageFileHeaderMachineType(0x266) // MIPS16 61 ImageFileMachineMIPSFPU = ImageFileHeaderMachineType(0x366) // MIPS with FPU 62 ImageFileMachineMIPSFPU16 = ImageFileHeaderMachineType(0x466) // MIPS16 with FPU 63 ImageFileMachinePowerPC = ImageFileHeaderMachineType(0x1f0) // Power PC little endian 64 ImageFileMachinePowerPCFP = ImageFileHeaderMachineType(0x1f1) // Power PC with floating point support 65 ImageFileMachineR4000 = ImageFileHeaderMachineType(0x166) // MIPS little endian 66 ImageFileMachineRISCV32 = ImageFileHeaderMachineType(0x5032) // RISC-V 32-bit address space 67 ImageFileMachineRISCV64 = ImageFileHeaderMachineType(0x5064) // RISC-V 64-bit address space 68 ImageFileMachineRISCV128 = ImageFileHeaderMachineType(0x5128) // RISC-V 128-bit address space 69 ImageFileMachineSH3 = ImageFileHeaderMachineType(0x1a2) // Hitachi SH3 70 ImageFileMachineSH3DSP = ImageFileHeaderMachineType(0x1a3) // Hitachi SH3 DSP 71 ImageFileMachineSH4 = ImageFileHeaderMachineType(0x1a6) // Hitachi SH4 72 ImageFileMachineSH5 = ImageFileHeaderMachineType(0x1a8) // Hitachi SH5 73 ImageFileMachineTHUMB = ImageFileHeaderMachineType(0x1c2) // Thumb 74 ImageFileMachineWCEMIPSv2 = ImageFileHeaderMachineType(0x169) // MIPS little-endian WCE v2 75 ) 76 77 // The Characteristics field contains flags that indicate attributes of the object or image file. 78 const ( 79 // Image file only. This flag indicates that the file contains no base 80 // relocations and must be loaded at its preferred base address. In the 81 // case of base address conflict, the OS loader reports an error. This flag 82 // should not be set for managed PE files. 83 ImageFileRelocsStripped = 0x0001 84 85 // Flag indicates that the file is an image file (EXE or DLL). This flag 86 // should be set for managed PE files. If it is not set, this generally 87 // indicates a linker error (i.e. no unresolved external references). 88 ImageFileExecutableImage = 0x0002 89 90 // COFF line numbers have been removed. This flag should be set for managed 91 // PE files because they do not use the debug information embedded in the 92 // PE file itself. Instead, the debug information is saved in accompanying 93 // program database (PDB) files. 94 ImageFileLineNumsStripped = 0x0004 95 96 // COFF symbol table entries for local symbols have been removed. This flag 97 // should be set for managed PE files, for the reason given in the preceding 98 // entry. 99 ImageFileLocalSymsStripped = 0x0008 100 101 // Aggressively trim the working set. 102 ImageFileAggressiveWSTrim = 0x0010 103 104 // Application can handle addresses beyond the 2GB range. This flag should 105 // not be set for pure-IL managed PE files of versions 1.0 and 1.1 but can 106 // be set for v2.0+ files. 107 ImageFileLargeAddressAware = 0x0020 108 109 // Little endian. 110 ImageFileBytesReservedLow = 0x0080 111 112 // Machine is based on 32-bit architecture. This flag is usually set by 113 // the current versions of code generators producing managed PE files. 114 // Version 2.0 and newer, however, can produce 64-bit specific images, 115 // which don’t have this flag set. 116 ImageFile32BitMachine = 0x0100 117 118 // Debug information has been removed from the image file. 119 ImageFileDebugStripped = 0x0200 120 121 // If the image file is on removable media, copy and run it from the swap 122 // file. 123 ImageFileRemovableRunFromSwap = 0x0400 124 125 // If the image file is on a network, copy and run it from the swap file. 126 ImageFileNetRunFromSwap = 0x0800 127 128 // The image file is a system file (for example, a device driver). This flag 129 ImageFileSystem = 0x1000 130 131 // The image file is a DLL rather than an EXE. It cannot be directly run. 132 ImageFileDLL = 0x2000 133 134 // The image file should be run on a uniprocessor machine only. 135 ImageFileUpSystemOnly = 0x4000 136 137 // Big endian. 138 ImageFileBytesReservedHigh = 0x8000 139 ) 140 141 // Subsystem values of an OptionalHeader. 142 const ( 143 ImageSubsystemUnknown = 0 // An unknown subsystem. 144 ImageSubsystemNative = 1 // Device drivers and native Windows processes 145 ImageSubsystemWindowsGUI = 2 // The Windows graphical user interface (GUI) subsystem. 146 ImageSubsystemWindowsCUI = 3 // The Windows character subsystem 147 ImageSubsystemOS2CUI = 5 // The OS/2 character subsystem. 148 ImageSubsystemPosixCUI = 7 // The Posix character subsystem. 149 ImageSubsystemNativeWindows = 8 // Native Win9x driver 150 ImageSubsystemWindowsCEGUI = 9 // Windows CE 151 ImageSubsystemEFIApplication = 10 // An Extensible Firmware Interface (EFI) application 152 ImageSubsystemEFIBootServiceDriver = 11 // An EFI driver with boot services 153 ImageSubsystemEFIRuntimeDriver = 12 // An EFI driver with run-time services 154 ImageSubsystemEFIRom = 13 // An EFI ROM image . 155 ImageSubsystemXBOX = 14 // XBOX. 156 ImageSubsystemWindowsBootApplication = 16 // Windows boot application. 157 ) 158 159 // DllCharacteristics values of an OptionalHeader 160 const ( 161 ImageDllCharacteristicsReserved1 = 0x0001 // Reserved, must be zero. 162 ImageDllCharacteristicsReserved2 = 0x0002 // Reserved, must be zero. 163 ImageDllCharacteristicsReserved4 = 0x0004 // Reserved, must be zero. 164 ImageDllCharacteristicsReserved8 = 0x0008 // Reserved, must be zero. 165 ImageDllCharacteristicsHighEntropyVA = 0x0020 // Image can handle a high entropy 64-bit virtual address space 166 ImageDllCharacteristicsDynamicBase = 0x0040 // DLL can be relocated at load time. 167 ImageDllCharacteristicsForceIntegrity = 0x0080 // Code Integrity checks are enforced. 168 ImageDllCharacteristicsNXCompact = 0x0100 // Image is NX compatible. 169 ImageDllCharacteristicsNoIsolation = 0x0200 // Isolation aware, but do not isolate the image. 170 ImageDllCharacteristicsNoSEH = 0x0400 // Does not use structured exception (SE) handling. No SE handler may be called in this image. 171 ImageDllCharacteristicsNoBind = 0x0800 // Do not bind the image. 172 ImageDllCharacteristicsAppContainer = 0x1000 // Image must execute in an AppContainer 173 ImageDllCharacteristicsWdmDriver = 0x2000 // A WDM driver. 174 ImageDllCharacteristicsGuardCF = 0x4000 // Image supports Control Flow Guard. 175 ImageDllCharacteristicsTerminalServiceAware = 0x8000 // Terminal Server aware. 176 177 ) 178 179 // ImageDirectoryEntry represents an entry inside the data directories. 180 type ImageDirectoryEntry int 181 182 // DataDirectory entries of an OptionalHeader 183 const ( 184 ImageDirectoryEntryExport ImageDirectoryEntry = iota // Export Table 185 ImageDirectoryEntryImport // Import Table 186 ImageDirectoryEntryResource // Resource Table 187 ImageDirectoryEntryException // Exception Table 188 ImageDirectoryEntryCertificate // Certificate Directory 189 ImageDirectoryEntryBaseReloc // Base Relocation Table 190 ImageDirectoryEntryDebug // Debug 191 ImageDirectoryEntryArchitecture // Architecture Specific Data 192 ImageDirectoryEntryGlobalPtr // The RVA of the value to be stored in the global pointer register. 193 ImageDirectoryEntryTLS // The thread local storage (TLS) table 194 ImageDirectoryEntryLoadConfig // The load configuration table 195 ImageDirectoryEntryBoundImport // The bound import table 196 ImageDirectoryEntryIAT // Import Address Table 197 ImageDirectoryEntryDelayImport // Delay Import Descriptor 198 ImageDirectoryEntryCLR // CLR Runtime Header 199 ImageDirectoryEntryReserved // Must be zero 200 ImageNumberOfDirectoryEntries // Tables count. 201 ) 202 203 // FileInfo represents the PE file information struct. 204 type FileInfo struct { 205 Is32 bool 206 Is64 bool 207 HasDOSHdr bool 208 HasRichHdr bool 209 HasCOFF bool 210 HasNTHdr bool 211 HasSections bool 212 HasExport bool 213 HasImport bool 214 HasResource bool 215 HasException bool 216 HasCertificate bool 217 HasReloc bool 218 HasDebug bool 219 HasArchitect bool 220 HasGlobalPtr bool 221 HasTLS bool 222 HasLoadCFG bool 223 HasBoundImp bool 224 HasIAT bool 225 HasDelayImp bool 226 HasCLR bool 227 HasOverlay bool 228 IsSigned bool 229 }