using System; namespace BinaryObjectScanner.Models.LinearExecutable { [Flags] public enum BundleType : byte { /// /// Unused Entry. /// UnusedEntry = 0x00, /// /// 16-bit Entry. /// SixteenBitEntry = 0x01, /// /// 286 Call Gate Entry. /// TwoEightySixCallGateEntry = 0x02, /// /// 32-bit Entry. /// ThirtyTwoBitEntry = 0x03, /// /// Forwarder Entry. /// ForwarderEntry = 0x04, /// /// Parameter Typing Information Present. /// /// /// This bit signifies that additional information is contained in the /// linear EXE module and will be used in the future for parameter type checking. /// ParameterTypingInformationPresent = 0x80, } public enum ByteOrder : byte { /// /// little-endian /// LE = 0x00, /// /// big-endian /// /// non-zero BE = 0x01, } public enum CPUType : ushort { /// /// Intel 80286 or upwardly compatible /// Intel80286 = 0x01, /// /// Intel 80386 or upwardly compatible /// Intel80386 = 0x02, /// /// Intel 80486 or upwardly compatible /// Intel80486 = 0x03, /// /// Intel 80586 or upwardly compatible /// Intel80586 = 0x04, /// /// Intel i860 (N10) or compatible /// Inteli860 = 0x20, /// /// Intel "N11" or compatible /// IntelN11 = 0x21, /// /// MIPS Mark I (R2000, R3000) or compatible /// MIPSMarkI = 0x40, /// /// MIPS Mark II ( R6000 ) or compatible /// MIPSMarkII = 0x41, /// /// MIPS Mark III ( R4000 ) or compatible /// MIPSMarkIII = 0x42, } public enum DebugFormatType : byte { /// /// 32-bit CodeView debugger format. /// CodeView32Bit = 0x00, /// /// AIX debugger format. /// AIXDebugger = 0x01, /// /// 16-bit CodeView debugger format. /// CodeView16Bit = 0x02, /// /// 32-bit OS/2 PM debugger (IBM) format. /// OS2PM32Bit = 0x04, } public enum DirectiveNumber : ushort { /// /// Resident Flag Mask. /// /// /// Directive numbers with this bit set indicate that the directive data /// is in the resident area and will be kept resident in memory when the /// module is loaded. /// ResidentFlagMask = 0x8000, /// /// Verify Record Directive. (Verify record is a resident table.) /// VerifyRecordDirective = 0x8001, /// /// Language Information Directive. (This is a non-resident table.) /// LanguageInformationDirective = 0x0002, /// /// Co-Processor Required Support Table. /// CoProcessorRequiredSupportTable = 0x0003, /// /// Thread State Initialization Directive. /// ThreadStateInitializationDirective = 0x0004, // Additional directives can be added as needed in the future, as long as // they do not overlap previously defined directive numbers. } [Flags] public enum EntryFlags : byte { /// /// Exported entry flag. /// ExportedEntry = 0x01, /// /// Parameter word count mask. /// ParameterWordCountMask = 0xF8, } [Flags] public enum FixupRecordSourceType : byte { /// /// Source mask. /// SourceMask = 0x0F, /// /// Byte fixup (8-bits). /// ByteFixup = 0x00, /// /// (undefined). /// Undefined1 = 0x01, /// /// 16-bit Selector fixup (16-bits). /// SixteenBitSelectorFixup = 0x02, /// /// 16:16 Pointer fixup (32-bits). /// SixteenSixteenPointerFixup = 0x03, /// /// (undefined). /// Undefined4 = 0x04, /// /// 16-bit Offset fixup (16-bits). /// SixteenBitOffsetFixup = 0x05, /// /// 16:32 Pointer fixup (48-bits). /// SixteenThirtyTwoPointerFixup = 0x06, /// /// 32-bit Offset fixup (32-bits). /// ThirtyTwoBitOffsetFixup = 0x07, /// /// 32-bit Self-relative offset fixup (32-bits). /// ThirtyTwoBitSelfRelativeOffsetFixup = 0x08, /// /// Fixup to Alias Flag. /// /// /// When the 'Fixup to Alias' Flag is set, the source fixup refers to /// the 16:16 alias for the object. This is only valid for source types /// of 2, 3, and 6. For fixups such as this, the linker and loader will /// be required to perform additional checks such as ensuring that the /// target offset for this fixup is less than 64K. /// FixupToAliasFlag = 0x10, /// /// Source List Flag. /// /// /// When the 'Source List' Flag is set, the SRCOFF field is compressed /// to a byte and contains the number of source offsets, and a list of source /// offsets follows the end of fixup record (after the optional additive value). /// SourceListFlag = 0x20, } [Flags] public enum FixupRecordTargetFlags : byte { /// /// Fixup target type mask. /// FixupTargetTypeMask = 0x03, /// /// Internal reference. /// InternalReference = 0x00, /// /// Imported reference by ordinal. /// ImportedReferenceByOrdinal = 0x01, /// /// Imported reference by name. /// ImportedReferenceByName = 0x02, /// /// Internal reference via entry table. /// InternalReferenceViaEntryTable = 0x03, /// /// Additive Fixup Flag. /// /// /// When set, an additive value trails the fixup record (before the optional /// source offset list). /// AdditiveFixupFlag = 0x04, /// /// Reserved. Must be zero. /// Reserved = 0x08, /// /// 32-bit Target Offset Flag. /// /// /// When set, the target offset is 32-bits, otherwise it is 16-bits. /// ThirtyTwoBitTargetOffsetFlag = 0x10, /// /// 32-bit Additive Fixup Flag. /// /// When set, the additive value is 32-bits, otherwise it is 16-bits. /// ThirtyTwoBitAdditiveFixupFlag = 0x20, /// /// 16-bit Object Number/Module Ordinal Flag. /// /// /// When set, the object number or module ordinal number is 16-bits, /// otherwise it is 8-bits. /// SixteenBitObjectNumberModuleOrdinalFlag = 0x40, /// /// 8-bit Ordinal Flag. /// /// /// When set, the ordinal number is 8-bits, otherwise it is 16-bits. /// EightBitOrdinalFlag = 0x80, } [Flags] public enum ForwarderFlags : byte { /// /// Import by ordinal. /// ImportByOrdinal = 0x01, /// /// Reserved for future use; should be zero. /// Reserved = 0xF7, } [Flags] public enum ModuleFlags : uint { /// /// Reserved for system use. /// Reserved0 = 0x00000001, /// /// Reserved for system use. /// Reserved1 = 0x00000002, /// /// Per-Process Library Initialization. /// /// /// The setting of this bit requires the EIP Object # and EIP fields /// to have valid values. If the EIP Object # and EIP fields are /// valid and this bit is NOT set, then Global Library Initialization /// is assumed. Setting this bit for an EXE file is invalid. /// Initialization = 0x00000004, /// /// Reserved for system use. /// Reserved3 = 0x00000008, /// /// Internal fixups for the module have been applied. /// /// /// The setting of this bit in a Linear Executable Module indicates that /// each object of the module has a preferred load address specified in /// the Object Table Reloc Base Addr. If the module's objects can not be /// loaded at these preferred addresses, then the relocation records that /// have been retained in the file data will be applied. /// InternalFixupsApplied = 0x00000010, /// /// External fixups for the module have been applied. /// ExternalFixupsApplied = 0x00000020, /// /// Reserved for system use. /// Reserved6 = 0x00000040, /// /// Reserved for system use. /// Reserved7 = 0x00000080, /// /// Incompatible with PM windowing. /// IncompatibleWithPMWindowing = 0x00000100, /// /// Incompatible with PM windowing. /// CompatibleWithPMWindowing = 0x00000200, /// /// Uses PM windowing API. /// UsesPMWindowing = 0x00000300, /// /// Reserved for system use. /// Reserved10 = 0x00000400, /// /// Reserved for system use. /// Reserved11 = 0x00000800, /// /// Reserved for system use. /// Reserved12 = 0x00001000, /// /// Module is not loadable. /// /// /// When the 'Module is not loadable' flag is set, it indicates that /// either errors were detected at link time or that the module is /// being incrementally linked and therefore can't be loaded. /// ModuleNotLoadable = 0x00002000, /// /// Reserved for system use. /// Reserved14 = 0x00004000, /// /// Module type mask. /// ModuleTypeMask = 0x00038000, /// /// Program module. /// /// /// A module can not contain dynamic links to other modules that have /// the 'program module' type. /// ProgramModule = 0x00000000, /// /// Library module. /// LibraryModule = 0x00008000, /// /// Protected Memory Library module. /// ProtectedMemoryLibraryModule = 0x00018000, /// /// Physical Device Driver module. /// PhysicalDeviceDriverModule = 0x00020000, /// /// Virtual Device Driver module. /// VirtualDeviceDriverModule = 0x00028000, /// /// Per-process Library Termination. /// /// /// The setting of this bit requires the EIP Object # and EIP fields /// to have valid values. If the EIP Object # and EIP fields are /// valid and this bit is NOT set, then Global Library Termination /// is assumed. Setting this bit for an EXE file is invalid. /// PerProcessLibraryTermination = 0x40000000, } [Flags] public enum ObjectFlags : ushort { /// /// Readable Object. /// ReadableObject = 0x0001, /// /// Writable Object. /// WritableObject = 0x0002, /// /// Executable Object. /// ExecutableObject = 0x0004, // The readable, writable and executable flags provide support for all possible // protections. In systems where all of these protections are not supported, // the loader will be responsible for making the appropriate protection match // for the system. /// /// Resource Object. /// ResourceObject = 0x0008, /// /// Discardable Object. /// DiscardableObject = 0x0010, /// /// Object is Shared. /// Shared = 0x0020, /// /// Object has Preload Pages. /// HasPreloadPages = 0x0040, /// /// Object has Invalid Pages. /// HasInvalidPages = 0x0080, /// /// Object has Zero Filled Pages. /// HasZeroFilledPages = 0x0100, /// /// Object is Resident (valid for VDDs, PDDs only). /// Resident = 0x0200, /// /// Object is Resident & Contiguous (VDDs, PDDs only). /// ResidentAndContiguous = 0x0300, /// /// Object is Resident & 'long-lockable' (VDDs, PDDs only). /// ResidentAndLongLockable = 0x0400, /// /// Reserved for system use. /// Reserved = 0x0800, /// /// 16:16 Alias Required (80x86 Specific). /// AliasRequired = 0x1000, /// /// Big/Default Bit Setting (80x86 Specific). /// BitSetting = 0x2000, // The 'big/default' bit, for data segments, controls the setting of the // Big bit in the segment descriptor. (The Big bit, or B-bit, determines // whether ESP or SP is used as the stack pointer.) For code segments, // this bit controls the setting of the Default bit in the segment // descriptor. (The Default bit, or D-bit, determines whether the default // word size is 32-bits or 16-bits. It also affects the interpretation of // the instruction stream.) /// /// Object is conforming for code (80x86 Specific). /// Conforming = 0x4000, /// /// Object I/O privilege level (80x86 Specific). Only used for 16:16 Alias Objects. /// PrivilegeLevel = 0x8000, } [Flags] public enum ObjectPageFlags : ushort { /// /// Legal Physical Page in the module (Offset from Preload Page Section). /// LegalPhysicalPage = 0x0000, /// /// Iterated Data Page (Offset from Iterated Data Pages Section). /// IteratedDataPage = 0x0001, /// /// Invalid Page (zero). /// InvalidPage = 0x0002, /// /// Zero Filled Page (zero). /// ZeroFilledPage = 0x0003, /// /// Range of Pages. /// RangeOfPages = 0x0004, } public enum OperatingSystem : ushort { /// /// Unknown (any "new-format" OS) /// Unknown = 0x00, /// /// OS/2 (default) /// OS2 = 0x01, /// /// Windows /// Windows = 0x02, /// /// DOS 4.x /// DOS4x = 0x03, /// /// Windows 386 /// Windows386 = 0x04, } public enum ResourceTableEntryType : uint { /// /// "BTMP" - Bitmap /// BTMP = 0x504d5442, /// /// "EMSG" - Error message string /// EMSG = 0x47534d45, /// /// "FONT" - Fonts /// FONT = 0x544e4f46, } public enum WordOrder : byte { /// /// little-endian /// LE = 0x00, /// /// big-endian /// /// non-zero BE = 0x01, } }