namespace BurnOutSharp.Models.PortableExecutable { /// /// The data directory entry for a pre-reserved SEH load configuration /// structure must specify a particular size of the load configuration /// structure because the operating system loader always expects it to /// be a certain value. In that regard, the size is really only a /// version check. For compatibility with Windows XP and earlier versions /// of Windows, the size must be 64 for x86 images. /// /// public class LoadConfigurationDirectory { /// /// Flags that indicate attributes of the file, currently unused. /// public uint Characteristics; /// /// Date and time stamp value. The value is represented in the number of /// seconds that have elapsed since midnight (00:00:00), January 1, 1970, /// Universal Coordinated Time, according to the system clock. The time /// stamp can be printed by using the C runtime (CRT) time function. /// public uint TimeDateStamp; /// /// Major version number. /// public ushort MajorVersion; /// /// Minor version number. /// public ushort MinorVersion; /// /// The global loader flags to clear for this process as the loader starts /// the process. /// public uint GlobalFlagsClear; /// /// The global loader flags to set for this process as the loader starts /// the process. /// public uint GlobalFlagsSet; /// /// The default timeout value to use for this process's critical sections /// that are abandoned. /// public uint CriticalSectionDefaultTimeout; #region DeCommitFreeBlockThreshold /// /// Memory that must be freed before it is returned to the system, in bytes. /// public uint DeCommitFreeBlockThreshold_PE32; /// /// Memory that must be freed before it is returned to the system, in bytes. /// public ulong DeCommitFreeBlockThreshold_PE32Plus; #endregion #region DeCommitTotalFreeThreshold /// /// Total amount of free memory, in bytes. /// public uint DeCommitTotalFreeThreshold_PE32; /// /// Total amount of free memory, in bytes. /// public ulong DeCommitTotalFreeThreshold_PE32Plus; #endregion #region LockPrefixTable /// /// [x86 only] The VA of a list of addresses where the LOCK prefix is used so /// that they can be replaced with NOP on single processor machines. /// public uint LockPrefixTable_PE32; /// /// [x86 only] The VA of a list of addresses where the LOCK prefix is used so /// that they can be replaced with NOP on single processor machines. /// public ulong LockPrefixTable_PE32Plus; #endregion #region MaximumAllocationSize /// /// Maximum allocation size, in bytes. /// public uint MaximumAllocationSize_PE32; /// /// Maximum allocation size, in bytes. /// public ulong MaximumAllocationSize_PE32Plus; #endregion #region VirtualMemoryThreshold /// /// Maximum virtual memory size, in bytes. /// public uint VirtualMemoryThreshold_PE32; /// /// Maximum virtual memory size, in bytes. /// public ulong VirtualMemoryThreshold_PE32Plus; #endregion #region ProcessAffinityMask /// /// Setting this field to a non-zero value is equivalent to calling /// SetProcessAffinityMask with this value during process startup (.exe only) /// public uint ProcessAffinityMask_PE32; /// /// Setting this field to a non-zero value is equivalent to calling /// SetProcessAffinityMask with this value during process startup (.exe only) /// public ulong ProcessAffinityMask_PE32Plus; #endregion /// /// Process heap flags that correspond to the first argument of the /// HeapCreate function. These flags apply to the process heap that /// is created during process startup. /// public uint ProcessHeapFlags; /// /// The service pack version identifier. /// public ushort CSDVersion; /// /// Must be zero. /// public ushort Reserved; #region EditList /// /// Reserved for use by the system. /// public uint EditList_PE32; /// /// Reserved for use by the system. /// public ulong EditList_PE32Plus; #endregion #region SecurityCookie /// /// A pointer to a cookie that is used by Visual C++ or GS implementation. /// public uint SecurityCookie_PE32; /// /// A pointer to a cookie that is used by Visual C++ or GS implementation. /// public ulong SecurityCookie_PE32Plus; #endregion #region SEHandlerTable /// /// [x86 only] The VA of the sorted table of RVAs of each valid, unique /// SE handler in the image. /// public uint SEHandlerTable_PE32; /// /// [x86 only] The VA of the sorted table of RVAs of each valid, unique /// SE handler in the image. /// public ulong SEHandlerTable_PE32Plus; #endregion #region SEHandlerCount /// /// [x86 only] The count of unique handlers in the table. /// public uint SEHandlerCount_PE32; /// /// [x86 only] The count of unique handlers in the table. /// public ulong SEHandlerCount_PE32Plus; #endregion #region GuardCFCheckFunctionPointer /// /// The VA where Control Flow Guard check-function pointer is stored. /// public uint GuardCFCheckFunctionPointer_PE32; /// /// The VA where Control Flow Guard check-function pointer is stored. /// public ulong GuardCFCheckFunctionPointer_PE32Plus; #endregion #region GuardCFDispatchFunctionPointer /// /// The VA where Control Flow Guard dispatch-function pointer is stored. /// public uint GuardCFDispatchFunctionPointer_PE32; /// /// The VA where Control Flow Guard dispatch-function pointer is stored. /// public ulong GuardCFDispatchFunctionPointer_PE32Plus; #endregion #region GuardCFFunctionTable /// /// The VA of the sorted table of RVAs of each Control Flow Guard /// function in the image. /// public uint GuardCFFunctionTable_PE32; /// /// The VA of the sorted table of RVAs of each Control Flow Guard /// function in the image. /// public ulong GuardCFFunctionTable_PE32Plus; #endregion #region GuardCFFunctionCount /// /// The count of unique RVAs in the above table. /// public uint GuardCFFunctionCount_PE32; /// /// The count of unique RVAs in the above table. /// public ulong GuardCFFunctionCount_PE32Plus; #endregion /// /// Control Flow Guard related flags. /// public GuardFlags GuardFlags; /// /// Code integrity information. /// /// 12 bytes public byte[] CodeIntegrity; #region GuardAddressTakenIatEntryTable /// /// The VA where Control Flow Guard address taken IAT table is stored. /// public uint GuardAddressTakenIatEntryTable_PE32; /// /// The VA where Control Flow Guard address taken IAT table is stored. /// public ulong GuardAddressTakenIatEntryTable_PE32Plus; #endregion #region GuardAddressTakenIatEntryCount /// /// The count of unique RVAs in the above table. /// public uint GuardAddressTakenIatEntryCount_PE32; /// /// The count of unique RVAs in the above table. /// public ulong GuardAddressTakenIatEntryCount_PE32Plus; #endregion #region GuardLongJumpTargetTable /// /// The VA where Control Flow Guard long jump target table is stored. /// public uint GuardLongJumpTargetTable_PE32; /// /// The VA where Control Flow Guard long jump target table is stored. /// public ulong GuardLongJumpTargetTable_PE32Plus; #endregion #region GuardLongJumpTargetCount /// /// The count of unique RVAs in the above table. /// public uint GuardLongJumpTargetCount_PE32; /// /// The count of unique RVAs in the above table. /// public ulong GuardLongJumpTargetCount_PE32Plus; #endregion } }