using System;
namespace BinaryObjectScanner.Models.PortableExecutable
{
[Flags]
public enum AcceleratorTableFlags : ushort
{
///
/// The accelerator key is a virtual-key code. If this flag is not specified,
/// the accelerator key is assumed to specify an ASCII character code.
///
FVIRTKEY = 0x01,
///
/// A menu item on the menu bar is not highlighted when an accelerator is used.
/// This attribute is obsolete and retained only for backward compatibility with
/// resource files designed for 16-bit Windows.
///
FNOINVERT = 0x02,
///
/// The accelerator is activated only if the user presses the SHIFT key. This flag
/// applies only to virtual keys.
///
FSHIFT = 0x04,
///
/// The accelerator is activated only if the user presses the CTRL key. This flag
/// applies only to virtual keys.
///
FCONTROL = 0x08,
///
/// The accelerator is activated only if the user presses the ALT key. This flag
/// applies only to virtual keys.
///
FALT = 0x10,
///
/// The entry is last in an accelerator table.
///
LastEntry = 0x80,
}
public enum BaseRelocationTypes : uint
{
///
/// The base relocation is skipped. This type can be used to pad a block.
///
IMAGE_REL_BASED_ABSOLUTE = 0,
///
/// The base relocation adds the high 16 bits of the difference to the 16-bit
/// field at offset. The 16-bit field represents the high value of a 32-bit word.
///
IMAGE_REL_BASED_HIGH = 1,
///
/// The base relocation adds the low 16 bits of the difference to the 16-bit
/// field at offset. The 16-bit field represents the low half of a 32-bit word.
///
IMAGE_REL_BASED_LOW = 2,
///
/// The base relocation applies all 32 bits of the difference to the 32-bit
/// field at offset.
///
IMAGE_REL_BASED_HIGHLOW = 3,
///
/// The base relocation adds the high 16 bits of the difference to the 16-bit
/// field at offset. The 16-bit field represents the high value of a 32-bit word.
/// The low 16 bits of the 32-bit value are stored in the 16-bit word that follows
/// this base relocation. This means that this base relocation occupies two slots.
///
IMAGE_REL_BASED_HIGHADJ = 4,
///
/// The relocation interpretation is dependent on the machine type.
/// When the machine type is MIPS, the base relocation applies to a MIPS jump
/// instruction.
///
IMAGE_REL_BASED_MIPS_JMPADDR = 5,
///
/// This relocation is meaningful only when the machine type is ARM or Thumb.
/// The base relocation applies the 32-bit address of a symbol across a consecutive
/// MOVW/MOVT instruction pair.
///
IMAGE_REL_BASED_ARM_MOV32 = 5,
///
/// This relocation is only meaningful when the machine type is RISC-V. The base
/// relocation applies to the high 20 bits of a 32-bit absolute address.
///
IMAGE_REL_BASED_RISCV_HIGH20 = 5,
///
/// Reserved, must be zero.
///
RESERVED6 = 6,
///
/// This relocation is meaningful only when the machine type is Thumb. The base
/// relocation applies the 32-bit address of a symbol to a consecutive MOVW/MOVT
/// instruction pair.
///
IMAGE_REL_BASED_THUMB_MOV32 = 7,
///
/// This relocation is only meaningful when the machine type is RISC-V. The base
/// relocation applies to the low 12 bits of a 32-bit absolute address formed in
/// RISC-V I-type instruction format.
///
IMAGE_REL_BASED_RISCV_LOW12I = 7,
///
/// This relocation is only meaningful when the machine type is RISC-V. The base
/// relocation applies to the low 12 bits of a 32-bit absolute address formed in
/// RISC-V S-type instruction format.
///
IMAGE_REL_BASED_RISCV_LOW12S = 8,
///
/// This relocation is only meaningful when the machine type is LoongArch 32-bit.
/// The base relocation applies to a 32-bit absolute address formed in two
/// consecutive instructions.
///
IMAGE_REL_BASED_LOONGARCH32_MARK_LA = 8,
///
/// This relocation is only meaningful when the machine type is LoongArch 64-bit.
/// The base relocation applies to a 64-bit absolute address formed in four
/// consecutive instructions.
///
IMAGE_REL_BASED_LOONGARCH64_MARK_LA = 8,
///
/// The relocation is only meaningful when the machine type is MIPS. The base
/// relocation applies to a MIPS16 jump instruction.
///
IMAGE_REL_BASED_MIPS_JMPADDR16 = 9,
///
/// The base relocation applies the difference to the 64-bit field at offset.
///
IMAGE_REL_BASED_DIR64 = 10,
}
public enum CallbackReason : ushort
{
///
/// A new process has started, including the first thread.
///
DLL_PROCESS_ATTACH = 1,
///
/// A new thread has been created. This notification sent for
/// all but the first thread.
///
DLL_THREAD_ATTACH = 2,
///
/// A thread is about to be terminated. This notification sent
/// for all but the first thread.
///
DLL_THREAD_DETACH = 3,
///
/// A process is about to terminate, including the original thread.
///
DLL_PROCESS_DETACH = 0,
}
[Flags]
public enum Characteristics : ushort
{
///
/// Image only, Windows CE, and Microsoft Windows NT and later.
/// This indicates that the file does not contain base relocations
/// and must therefore be loaded at its preferred base address.
/// If the base address is not available, the loader reports an
/// error. The default behavior of the linker is to strip base
/// relocations from executable (EXE) files.
///
IMAGE_FILE_RELOCS_STRIPPED = 0x0001,
///
/// Image only. This indicates that the image file is valid and
/// can be run. If this flag is not set, it indicates a linker error.
///
IMAGE_FILE_EXECUTABLE_IMAGE = 0x0002,
///
/// COFF line numbers have been removed. This flag is deprecated
/// and should be zero.
///
IMAGE_FILE_LINE_NUMS_STRIPPED = 0x0004,
///
/// COFF symbol table entries for local symbols have been removed.
/// This flag is deprecated and should be zero.
///
IMAGE_FILE_LOCAL_SYMS_STRIPPED = 0x0008,
///
/// Obsolete. Aggressively trim working set. This flag is deprecated
/// for Windows 2000 and later and must be zero.
///
IMAGE_FILE_AGGRESSIVE_WS_TRIM = 0x0010,
///
/// Application can handle > 2-GB addresses.
///
IMAGE_FILE_LARGE_ADDRESS_AWARE = 0x0020,
///
/// This flag is reserved for future use.
///
RESERVED = 0x0040,
///
/// Little endian: the least significant bit (LSB) precedes the most
/// significant bit (MSB) in memory. This flag is deprecated and
/// should be zero.
///
IMAGE_FILE_BYTES_REVERSED_LO = 0x0080,
///
/// Machine is based on a 32-bit-word architecture.
///
IMAGE_FILE_32BIT_MACHINE = 0x0100,
///
/// Debugging information is removed from the image file.
///
IMAGE_FILE_DEBUG_STRIPPED = 0x0200,
///
/// If the image is on removable media, fully load it and
/// copy it to the swap file.
///
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP = 0x0400,
///
/// If the image is on network media, fully load it and copy
/// it to the swap file.
///
IMAGE_FILE_NET_RUN_FROM_SWAP = 0x0800,
///
/// The image file is a system file, not a user program.
///
IMAGE_FILE_SYSTEM = 0x1000,
///
/// The image file is a dynamic-link library (DLL). Such files
/// are considered executable files for almost all purposes,
/// although they cannot be directly run.
///
IMAGE_FILE_DLL = 0x2000,
///
/// The file should be run only on a uniprocessor machine.
///
IMAGE_FILE_UP_SYSTEM_ONLY = 0x4000,
///
/// Big endian: the MSB precedes the LSB in memory. This flag
/// is deprecated and should be zero.
///
IMAGE_FILE_BYTES_REVERSED_HI = 0x8000,
}
public enum COMDATSelect : byte
{
///
/// If this symbol is already defined, the linker issues a "multiply
/// defined symbol" error.
///
IMAGE_COMDAT_SELECT_NODUPLICATES = 0x01,
///
/// Any section that defines the same COMDAT symbol can be linked;
/// the rest are removed.
///
IMAGE_COMDAT_SELECT_ANY = 0x02,
///
/// The linker chooses an arbitrary section among the definitions
/// for this symbol. If all definitions are not the same size, a
/// "multiply defined symbol" error is issued.
///
IMAGE_COMDAT_SELECT_SAME_SIZE = 0x03,
///
/// The linker chooses an arbitrary section among the definitions
/// for this symbol. If all definitions do not match exactly, a
/// "multiply defined symbol" error is issued.
///
IMAGE_COMDAT_SELECT_EXACT_MATCH = 0x04,
///
/// The section is linked if a certain other COMDAT section is linked.
/// This other section is indicated by the Number field of the
/// auxiliary symbol record for the section definition. This setting
/// is useful for definitions that have components in multiple sections
/// (for example, code in one and data in another), but where all must
/// be linked or discarded as a set. The other section this section is
/// associated with must be a COMDAT section, which can be another
/// associative COMDAT section. An associative COMDAT section's section
/// association chain can't form a loop. The section association chain
/// must eventually come to a COMDAT section that doesn't have
/// IMAGE_COMDAT_SELECT_ASSOCIATIVE set.
///
IMAGE_COMDAT_SELECT_ASSOCIATIVE = 0x05,
///
/// The linker chooses the largest definition from among all of the
/// definitions for this symbol. If multiple definitions have this size,
/// the choice between them is arbitrary.
///
IMAGE_COMDAT_SELECT_LARGEST = 0x06,
}
public enum DebugType : uint
{
///
/// An unknown value that is ignored by all tools.
///
IMAGE_DEBUG_TYPE_UNKNOWN = 0,
///
/// The COFF debug information (line numbers, symbol table, and string table).
/// This type of debug information is also pointed to by fields in the file
/// headers.
///
IMAGE_DEBUG_TYPE_COFF = 1,
///
/// The Visual C++ debug information.
///
IMAGE_DEBUG_TYPE_CODEVIEW = 2,
///
/// The frame pointer omission (FPO) information. This information tells the
/// debugger how to interpret nonstandard stack frames, which use the EBP
/// register for a purpose other than as a frame pointer.
///
IMAGE_DEBUG_TYPE_FPO = 3,
///
/// The location of DBG file.
///
IMAGE_DEBUG_TYPE_MISC = 4,
///
/// A copy of .pdata section.
///
IMAGE_DEBUG_TYPE_EXCEPTION = 5,
///
/// Reserved.
///
IMAGE_DEBUG_TYPE_FIXUP = 6,
///
/// The mapping from an RVA in image to an RVA in source image.
///
IMAGE_DEBUG_TYPE_OMAP_TO_SRC = 7,
///
/// The mapping from an RVA in source image to an RVA in image.
///
IMAGE_DEBUG_TYPE_OMAP_FROM_SRC = 8,
///
/// Reserved for Borland.
///
IMAGE_DEBUG_TYPE_BORLAND = 9,
///
/// Reserved.
///
IMAGE_DEBUG_TYPE_RESERVED10 = 10,
///
/// Reserved.
///
IMAGE_DEBUG_TYPE_CLSID = 11,
///
/// PE determinism or reproducibility.
///
IMAGE_DEBUG_TYPE_REPRO = 16,
///
/// Extended DLL characteristics bits.
///
IMAGE_DEBUG_TYPE_EX_DLLCHARACTERISTICS = 20,
}
public enum DialogItemTemplateOrdinal : ushort
{
Button = 0x0080,
Edit = 0x0081,
Static = 0x0082,
ListBox = 0x0083,
ScrollBar = 0x0084,
ComboBox = 0x0085,
}
[Flags]
public enum DllCharacteristics : ushort
{
///
/// Reserved, must be zero.
///
RESERVED0 = 0x0001,
///
/// Reserved, must be zero.
///
RESERVED1 = 0x0002,
///
/// Reserved, must be zero.
///
RESERVED2 = 0x0004,
///
/// Reserved, must be zero.
///
RESERVED3 = 0x0008,
///
/// Image can handle a high entropy 64-bit virtual address space.
///
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA = 0x0020,
///
/// DLL can be relocated at load time.
///
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE = 0x0040,
///
/// Code Integrity checks are enforced.
///
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY = 0x0080,
///
/// Image is NX compatible.
///
IMAGE_DLLCHARACTERISTICS_NX_COMPAT = 0x0100,
///
/// Isolation aware, but do not isolate the image.
///
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION = 0x0200,
///
/// Does not use structured exception (SE) handling.
/// No SE handler may be called in this image.
///
IMAGE_DLLCHARACTERISTICS_NO_SEH = 0x0400,
///
/// Do not bind the image.
///
IMAGE_DLLCHARACTERISTICS_NO_BIND = 0x0800,
///
/// Image must execute in an AppContainer.
///
IMAGE_DLLCHARACTERISTICS_APPCONTAINER = 0x1000,
///
/// A WDM driver.
///
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = 0x2000,
///
/// Image supports Control Flow Guard.
///
IMAGE_DLLCHARACTERISTICS_GUARD_CF = 0x4000,
///
/// Terminal Server aware.
///
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE = 0x8000,
}
[Flags]
public enum ExtendedDllCharacteristics : ushort
{
///
/// Image is CET compatible.
///
IMAGE_DLLCHARACTERISTICS_EX_CET_COMPAT = 0x0001,
}
[Flags]
public enum ExtendedWindowStyles : uint
{
///
/// The window has generic left-aligned properties. This is the default.
///
WS_EX_LEFT = 0x00000000,
///
/// The window text is displayed using left-to-right reading-order properties.
/// This is the default.
///
WS_EX_LTRREADING = 0x00000000,
///
/// The vertical scroll bar (if present) is to the right of the client area.
/// This is the default.
///
WS_EX_RIGHTSCROLLBAR = 0x00000000,
///
/// The window has a double border; the window can, optionally, be created with
/// a title bar by specifying the WS_CAPTION style in the dwStyle parameter.
///
WS_EX_DLGMODALFRAME = 0x00000001,
///
/// The child window created with this style does not send the WM_PARENTNOTIFY
/// message to its parent window when it is created or destroyed.
///
WS_EX_NOPARENTNOTIFY = 0x00000004,
///
/// The window should be placed above all non-topmost windows and should stay above them,
/// even when the window is deactivated. To add or remove this style, use the
/// SetWindowPos function.
///
WS_EX_TOPMOST = 0x00000008,
///
/// The window accepts drag-drop files.
///
WS_EX_ACCEPTFILES = 0x00000010,
///
/// The window should not be painted until siblings beneath the window (that were created
/// by the same thread) have been painted. The window appears transparent because the bits
/// of underlying sibling windows have already been painted.
///
/// To achieve transparency without these restrictions, use the SetWindowRgn function.
///
WS_EX_TRANSPARENT = 0x00000020,
///
/// The window is a MDI child window.
///
WS_EX_MDICHILD = 0x00000040,
///
/// The window is intended to be used as a floating toolbar. A tool window has a title
/// bar that is shorter than a normal title bar, and the window title is drawn using a
/// smaller font. A tool window does not appear in the taskbar or in the dialog that
/// appears when the user presses ALT+TAB. If a tool window has a system menu, its icon
/// is not displayed on the title bar. However, you can display the system menu by
/// right-clicking or by typing ALT+SPACE.
///
WS_EX_TOOLWINDOW = 0x00000080,
///
/// The window has a border with a raised edge.
///
WS_EX_WINDOWEDGE = 0x00000100,
///
/// The window has a border with a sunken edge.
///
WS_EX_CLIENTEDGE = 0x00000200,
///
/// The title bar of the window includes a question mark. When the user clicks
/// the question mark, the cursor changes to a question mark with a pointer. If
/// the user then clicks a child window, the child receives a WM_HELP message.
/// The child window should pass the message to the parent window procedure,
/// which should call the WinHelp function using the HELP_WM_HELP command. The
/// Help application displays a pop-up window that typically contains help for
/// the child window.
///
/// WS_EX_CONTEXTHELP cannot be used with the WS_MAXIMIZEBOX or WS_MINIMIZEBOX
/// styles.
///
WS_EX_CONTEXTHELP = 0x00000400,
///
/// The window has generic "right-aligned" properties. This depends on the window class.
/// This style has an effect only if the shell language is Hebrew, Arabic, or another
/// language that supports reading-order alignment; otherwise, the style is ignored.
///
/// Using the WS_EX_RIGHT style for static or edit controls has the same effect as using
/// the SS_RIGHT or ES_RIGHT style, respectively. Using this style with button controls
/// has the same effect as using BS_RIGHT and BS_RIGHTBUTTON styles.
///
WS_EX_RIGHT = 0x00001000,
///
/// If the shell language is Hebrew, Arabic, or another language that supports reading-order
/// alignment, the window text is displayed using right-to-left reading-order properties.
/// For other languages, the style is ignored.
///
WS_EX_RTLREADING = 0x00002000,
///
/// If the shell language is Hebrew, Arabic, or another language that supports
/// reading order alignment, the vertical scroll bar (if present) is to the left
/// of the client area. For other languages, the style is ignored.
///
WS_EX_LEFTSCROLLBAR = 0x00004000,
///
/// The window itself contains child windows that should take part in dialog box
/// navigation. If this style is specified, the dialog manager recurses into
/// children of this window when performing navigation operations such as handling
/// the TAB key, an arrow key, or a keyboard mnemonic.
///
WS_EX_CONTROLPARENT = 0x00010000,
///
/// The window has a three-dimensional border style intended to be used for items that do
/// not accept user input.
///
WS_EX_STATICEDGE = 0x00020000,
///
/// Forces a top-level window onto the taskbar when the window is visible.
///
WS_EX_APPWINDOW = 0x00040000,
///
/// The window is a layered window. This style cannot be used if the window has a
/// class style of either CS_OWNDC or CS_CLASSDC.
///
/// Windows 8: The WS_EX_LAYERED style is supported for top-level windows and child
/// windows. Previous Windows versions support WS_EX_LAYERED only for top-level windows.
///
WS_EX_LAYERED = 0x00080000,
///
/// The window does not pass its window layout to its child windows.
///
WS_EX_NOINHERITLAYOUT = 0x00100000,
///
/// The window does not render to a redirection surface. This is for windows that do not
/// have visible content or that use mechanisms other than surfaces to provide their visual.
///
WS_EX_NOREDIRECTIONBITMAP = 0x00200000,
///
/// If the shell language is Hebrew, Arabic, or another language that supports reading
/// order alignment, the horizontal origin of the window is on the right edge.
/// Increasing horizontal values advance to the left.
///
WS_EX_LAYOUTRTL = 0x00400000,
///
/// Paints all descendants of a window in bottom-to-top painting order using
/// double-buffering. Bottom-to-top painting order allows a descendent window
/// to have translucency (alpha) and transparency (color-key) effects, but only
/// if the descendent window also has the WS_EX_TRANSPARENT bit set.
/// Double-buffering allows the window and its descendents to be painted without
/// flicker. This cannot be used if the window has a class style of either
/// CS_OWNDC or CS_CLASSDC.
///
/// Windows 2000: This style is not supported.
///
WS_EX_COMPOSITED = 0x02000000,
///
/// A top-level window created with this style does not become the foreground window when
/// the user clicks it. The system does not bring this window to the foreground when the
/// user minimizes or closes the foreground window.
///
/// The window should not be activated through programmatic access or via keyboard
/// navigation by accessible technology, such as Narrator.
///
/// To activate the window, use the SetActiveWindow or SetForegroundWindow function.
///
/// The window does not appear on the taskbar by default. To force the window to appear on
/// the taskbar, use the WS_EX_APPWINDOW style.
///
WS_EX_NOACTIVATE = 0x08000000,
///
/// The window is an overlapped window.
///
WS_EX_OVERLAPPEDWINDOW = WS_EX_WINDOWEDGE | WS_EX_CLIENTEDGE,
///
/// The window is palette window, which is a modeless dialog box that presents an array of
/// commands.
///
WS_EX_PALETTEWINDOW = WS_EX_WINDOWEDGE | WS_EX_TOOLWINDOW | WS_EX_TOPMOST,
}
public enum FixedFileInfoFileSubtype : uint
{
///
/// The driver type is unknown by the system.
/// The font type is unknown by the system.
///
VFT2_UNKNOWN = 0x00000000,
#region VFT_DRV
///
/// The file contains a printer driver.
///
VFT2_DRV_PRINTER = 0x00000001,
///
/// The file contains a keyboard driver.
///
VFT2_DRV_KEYBOARD = 0x00000002,
///
/// The file contains a language driver.
///
VFT2_DRV_LANGUAGE = 0x00000003,
///
/// The file contains a display driver.
///
VFT2_DRV_DISPLAY = 0x00000004,
///
/// The file contains a mouse driver.
///
VFT2_DRV_MOUSE = 0x00000005,
///
/// The file contains a network driver.
///
VFT2_DRV_NETWORK = 0x00000006,
///
/// The file contains a system driver.
///
VFT2_DRV_SYSTEM = 0x00000007,
///
/// The file contains an installable driver.
///
VFT2_DRV_INSTALLABLE = 0x00000008,
///
/// The file contains a sound driver.
///
VFT2_DRV_SOUND = 0x00000009,
///
/// The file contains a communications driver.
///
VFT2_DRV_COMM = 0x0000000A,
///
/// The file contains a versioned printer driver.
///
VFT2_DRV_VERSIONED_PRINTER = 0x0000000C,
#endregion
#region VFT_FONT
///
/// The file contains a raster font.
///
VFT2_FONT_RASTER = 0x00000001,
///
/// The file contains a vector font.
///
VFT2_FONT_VECTOR = 0x00000002,
///
/// The file contains a TrueType font.
///
VFT2_FONT_TRUETYPE = 0x00000003,
#endregion
}
public enum FixedFileInfoFileType : uint
{
///
/// The file type is unknown to the system.
///
VFT_UNKNOWN = 0x00000000,
///
/// The file contains an application.
///
VFT_APP = 0x00000001,
///
/// The file contains a DLL.
///
VFT_DLL = 0x00000002,
///
/// The file contains a device driver. If FileType is VFT_DRV, FileSubtype
/// contains a more specific description of the driver.
///
VFT_DRV = 0x00000003,
///
/// The file contains a font. If FileType is VFT_FONT, FileSubtype contains
/// a more specific description of the font file.
///
VFT_FONT = 0x00000004,
///
/// The file contains a virtual device.
///
VFT_VXD = 0x00000005,
///
/// The file contains a static-link library.
///
VFT_STATIC_LIB = 0x00000007,
}
[Flags]
public enum FixedFileInfoFlags : uint
{
///
/// The file contains debugging information or is compiled with debugging
/// features enabled.
///
VS_FF_DEBUG = 0x00000001,
///
/// The file is a development version, not a commercially released product.
///
VS_FF_PRERELEASE = 0x00000002,
///
/// The file has been modified and is not identical to the original shipping
/// file of the same version number.
///
VS_FF_PATCHED = 0x00000004,
///
/// The file was not built using standard release procedures. If this flag is
/// set, the StringFileInfo structure should contain a PrivateBuild entry.
///
VS_FF_PRIVATEBUILD = 0x00000008,
///
/// The file's version structure was created dynamically; therefore, some
/// of the members in this structure may be empty or incorrect. This flag
/// should never be set in a file's VS_VERSIONINFO data.
///
VS_FF_INFOINFERRED = 0x00000010,
///
/// The file was built by the original company using standard release
/// procedures but is a variation of the normal file of the same version number.
/// If this flag is set, the StringFileInfo structure should contain a SpecialBuild
/// entry.
///
VS_FF_SPECIALBUILD = 0x00000020,
}
[Flags]
public enum FixedFileInfoOS : uint
{
///
/// The operating system for which the file was designed is
/// unknown to the system.
///
VOS_UNKNOWN = 0x00000000,
///
/// The file was designed for 16-bit Windows.
///
VOS__WINDOWS16 = 0x00000001,
///
/// The file was designed for 16-bit Presentation Manager.
///
VOS__PM16 = 0x00000002,
///
/// The file was designed for 32-bit Presentation Manager.
///
VOS__PM32 = 0x00000003,
///
/// The file was designed for 32-bit Windows.
///
VOS__WINDOWS32 = 0x00000004,
///
/// The file was designed for MS-DOS.
///
VOS_DOS = 0x00010000,
///
/// The file was designed for 16-bit OS/2.
///
VOS_OS216 = 0x00020000,
///
/// The file was designed for 32-bit OS/2.
///
VOS_OS232 = 0x00030000,
///
/// The file was designed for Windows NT.
///
VOS_NT = 0x00040000,
}
[Flags]
public enum GuardFlags : uint
{
///
/// Module performs control flow integrity checks using
/// system-supplied support.
///
IMAGE_GUARD_CF_INSTRUMENTED = 0x00000100,
///
/// Module performs control flow and write integrity checks.
///
IMAGE_GUARD_CFW_INSTRUMENTED = 0x00000200,
///
/// Module contains valid control flow target metadata.
///
IMAGE_GUARD_CF_FUNCTION_TABLE_PRESENT = 0x00000400,
///
/// Module does not make use of the /GS security cookie.
///
IMAGE_GUARD_SECURITY_COOKIE_UNUSED = 0x00000800,
///
/// Module supports read only delay load IAT.
///
IMAGE_GUARD_PROTECT_DELAYLOAD_IAT = 0x00001000,
///
/// Delayload import table in its own .didat section (with
/// nothing else in it) that can be freely reprotected.
///
IMAGE_GUARD_DELAYLOAD_IAT_IN_ITS_OWN_SECTION = 0x00002000,
///
/// Module contains suppressed export information. This also
/// infers that the address taken IAT table is also present
/// in the load config.
///
IMAGE_GUARD_CF_EXPORT_SUPPRESSION_INFO_PRESENT = 0x00004000,
///
/// Module enables suppression of exports.
///
IMAGE_GUARD_CF_ENABLE_EXPORT_SUPPRESSION = 0x00008000,
///
/// Module contains longjmp target information.
///
IMAGE_GUARD_CF_LONGJUMP_TABLE_PRESENT = 0x00010000,
///
/// Mask for the subfield that contains the stride of Control
/// Flow Guard function table entries (that is, the additional
/// count of bytes per table entry).
///
IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_MASK = 0xF0000000,
///
/// Additionally, the Windows SDK winnt.h header defines this
/// macro for the amount of bits to right-shift the GuardFlags
/// value to right-justify the Control Flow Guard function table
/// stride:
///
IMAGE_GUARD_CF_FUNCTION_TABLE_SIZE_SHIFT = 28,
}
public enum ImportType : ushort
{
///
/// Executable code.
///
IMPORT_CODE = 0,
///
/// Data.
///
IMPORT_DATA = 1,
///
/// Specified as CONST in the .def file.
///
IMPORT_CONST = 2,
}
// Actually 3 bits
public enum ImportNameType : ushort
{
///
/// The import is by ordinal. This indicates that the value in the
/// Ordinal/Hint field of the import header is the import's ordinal.
/// If this constant is not specified, then the Ordinal/Hint field
/// should always be interpreted as the import's hint.
///
IMPORT_ORDINAL = 0,
///
/// The import name is identical to the public symbol name.
///
IMPORT_NAME = 1,
///
/// The import name is the public symbol name, but skipping the leading
/// ?, @, or optionally _.
///
IMPORT_NAME_NOPREFIX = 2,
///
/// The import name is the public symbol name, but skipping the leading
/// ?, @, or optionally _, and truncating at the first @.
///
IMPORT_NAME_UNDECORATE = 3,
}
public enum MachineType : ushort
{
///
/// The content of this field is assumed to be applicable to any machine type
///
IMAGE_FILE_MACHINE_UNKNOWN = 0x0000,
///
/// Matsushita AM33
///
IMAGE_FILE_MACHINE_AM33 = 0x01D3,
///
/// x64
///
IMAGE_FILE_MACHINE_AMD64 = 0x8664,
///
/// ARM little endian
///
IMAGE_FILE_MACHINE_ARM = 0x01C0,
///
/// ARM64 little endian
///
IMAGE_FILE_MACHINE_ARM64 = 0xAA64,
///
/// ARM Thumb-2 little endian
///
IMAGE_FILE_MACHINE_ARMNT = 0x01C4,
///
/// EFI byte code
///
IMAGE_FILE_MACHINE_EBC = 0x0EBC,
///
/// Intel 386 or later processors and compatible processors
///
IMAGE_FILE_MACHINE_I386 = 0x014C,
///
/// Intel Itanium processor family
///
IMAGE_FILE_MACHINE_IA64 = 0x0200,
///
/// LoongArch 32-bit processor family
///
IMAGE_FILE_MACHINE_LOONGARCH32 = 0x6232,
///
/// LoongArch 64-bit processor family
///
IMAGE_FILE_MACHINE_LOONGARCH64 = 0x6264,
///
/// Mitsubishi M32R little endian
///
IMAGE_FILE_MACHINE_M32R = 0x9041,
///
/// MIPS16
///
IMAGE_FILE_MACHINE_MIPS16 = 0x0266,
///
/// MIPS with FPU
///
IMAGE_FILE_MACHINE_MIPSFPU = 0x0366,
///
/// MIPS16 with FPU
///
IMAGE_FILE_MACHINE_MIPSFPU16 = 0x0466,
///
/// Power PC little endian
///
IMAGE_FILE_MACHINE_POWERPC = 0x01F0,
///
/// Power PC with floating point support
///
IMAGE_FILE_MACHINE_POWERPCFP = 0x01F1,
///
/// MIPS little endian
///
IMAGE_FILE_MACHINE_R4000 = 0x0166,
///
/// RISC-V 32-bit address space
///
IMAGE_FILE_MACHINE_RISCV32 = 0x5032,
///
/// RISC-V 64-bit address space
///
IMAGE_FILE_MACHINE_RISCV64 = 0x5064,
///
/// RISC-V 128-bit address space
///
IMAGE_FILE_MACHINE_RISCV128 = 0x5128,
///
/// Hitachi SH3
///
IMAGE_FILE_MACHINE_SH3 = 0x01A2,
///
/// Hitachi SH3 DSP
///
IMAGE_FILE_MACHINE_SH3DSP = 0x01A3,
///
/// Hitachi SH4
///
IMAGE_FILE_MACHINE_SH4 = 0x01A6,
///
/// Hitachi SH5
///
IMAGE_FILE_MACHINE_SH5 = 0x01A8,
///
/// Thumb
///
IMAGE_FILE_MACHINE_THUMB = 0x01C2,
///
/// MIPS little-endian WCE v2
///
IMAGE_FILE_MACHINE_WCEMIPSV2 = 0x0169,
}
[Flags]
public enum MemoryFlags : ushort
{
// TODO: Validate the ~ statements
MOVEABLE = 0x0010,
FIXED = 0xFFEF, // ~MOVEABLE
PURE = 0x0020,
IMPURE = 0xFFDF, // ~PURE
PRELOAD = 0x0040,
LOADONCALL = 0xFFBF, // ~PRELOAD
DISCARDABLE = 0x1000,
}
[Flags]
public enum MenuFlags : uint
{
MF_INSERT = 0x00000000,
MF_CHANGE = 0x00000080,
MF_APPEND = 0x00000100,
MF_DELETE = 0x00000200,
MF_REMOVE = 0x00001000,
MF_BYCOMMAND = 0x00000000,
MF_BYPOSITION = 0x00000400,
MF_SEPARATOR = 0x00000800,
MF_ENABLED = 0x00000000,
MF_GRAYED = 0x00000001,
MF_DISABLED = 0x00000002,
MF_UNCHECKED = 0x00000000,
MF_CHECKED = 0x00000008,
MF_USECHECKBITMAPS = 0x00000200,
MF_STRING = 0x00000000,
MF_BITMAP = 0x00000004,
MF_OWNERDRAW = 0x00000100,
MF_POPUP = 0x00000010,
MF_MENUBARBREAK = 0x00000020,
MF_MENUBREAK = 0x00000040,
MF_UNHILITE = 0x00000000,
MF_HILITE = 0x00000080,
MF_DEFAULT = 0x00001000,
MF_SYSMENU = 0x00002000,
MF_HELP = 0x00004000,
MF_RIGHTJUSTIFY = 0x00004000,
MF_MOUSESELECT = 0x00008000,
MF_END = 0x00000080,
MFT_STRING = MF_STRING,
MFT_BITMAP = MF_BITMAP,
MFT_MENUBARBREAK = MF_MENUBARBREAK,
MFT_MENUBREAK = MF_MENUBREAK,
MFT_OWNERDRAW = MF_OWNERDRAW,
MFT_RADIOCHECK = 0x00000200,
MFT_SEPARATOR = MF_SEPARATOR,
MFT_RIGHTORDER = 0x00002000,
MFT_RIGHTJUSTIFY = MF_RIGHTJUSTIFY,
MFS_GRAYED = 0x00000003,
MFS_DISABLED = MFS_GRAYED,
MFS_CHECKED = MF_CHECKED,
MFS_HILITE = MF_HILITE,
MFS_ENABLED = MF_ENABLED,
MFS_UNCHECKED = MF_UNCHECKED,
MFS_UNHILITE = MF_UNHILITE,
MFS_DEFAULT = MF_DEFAULT,
}
public enum OptionalHeaderMagicNumber : ushort
{
ROMImage = 0x0107,
PE32 = 0x010B,
PE32Plus = 0x020B,
}
public enum RelocationType : ushort
{
#region x64 Processors
///
/// The relocation is ignored.
///
IMAGE_REL_AMD64_ABSOLUTE = 0x0000,
///
/// The 64-bit VA of the relocation target.
///
IMAGE_REL_AMD64_ADDR64 = 0x0001,
///
/// The 32-bit VA of the relocation target.
///
IMAGE_REL_AMD64_ADDR32 = 0x0002,
///
/// The 32-bit address without an image base (RVA).
///
IMAGE_REL_AMD64_ADDR32NB = 0x0003,
///
/// The 32-bit relative address from the byte following the relocation.
///
IMAGE_REL_AMD64_REL32 = 0x0004,
///
/// The 32-bit address relative to byte distance 1 from the relocation.
///
IMAGE_REL_AMD64_REL32_1 = 0x0005,
///
/// The 32-bit address relative to byte distance 2 from the relocation.
///
IMAGE_REL_AMD64_REL32_2 = 0x0006,
///
/// The 32-bit address relative to byte distance 3 from the relocation.
///
IMAGE_REL_AMD64_REL32_3 = 0x0007,
///
/// The 32-bit address relative to byte distance 4 from the relocation.
///
IMAGE_REL_AMD64_REL32_4 = 0x0008,
///
/// The 32-bit address relative to byte distance 5 from the relocation.
///
IMAGE_REL_AMD64_REL32_5 = 0x0009,
///
/// The 16-bit section index of the section that contains the target.
/// This is used to support debugging information.
///
IMAGE_REL_AMD64_SECTION = 0x000A,
///
/// The 32-bit offset of the target from the beginning of its section.
/// This is used to support debugging information and static thread
/// local storage.
///
IMAGE_REL_AMD64_SECREL = 0x000B,
///
/// A 7-bit unsigned offset from the base of the section that contains
/// the target.
///
IMAGE_REL_AMD64_SECREL7 = 0x000C,
///
/// CLR tokens.
///
IMAGE_REL_AMD64_TOKEN = 0x000D,
///
/// A 32-bit signed span-dependent value emitted into the object.
///
IMAGE_REL_AMD64_SREL32 = 0x000E,
///
/// A pair that must immediately follow every span-dependent value.
///
IMAGE_REL_AMD64_PAIR = 0x000F,
///
/// A 32-bit signed span-dependent value that is applied at link time.
///
IMAGE_REL_AMD64_SSPAN32 = 0x0010,
#endregion
#region ARM Processors
///
/// The relocation is ignored.
///
IMAGE_REL_ARM_ABSOLUTE = 0x0000,
///
/// The 32-bit VA of the target.
///
IMAGE_REL_ARM_ADDR32 = 0x0001,
///
/// The 32-bit RVA of the target.
///
IMAGE_REL_ARM_ADDR32NB = 0x0002,
///
/// The 24-bit relative displacement to the target.
///
IMAGE_REL_ARM_BRANCH24 = 0x0003,
///
/// The reference to a subroutine call. The reference
/// consists of two 16-bit instructions with 11-bit offsets.
///
IMAGE_REL_ARM_BRANCH11 = 0x0004,
///
/// The 32-bit relative address from the byte following the relocation.
///
IMAGE_REL_ARM_REL32 = 0x000A,
///
/// The 16-bit section index of the section that contains the target.
/// This is used to support debugging information.
///
IMAGE_REL_ARM_SECTION = 0x000E,
///
/// The 32-bit offset of the target from the beginning of its section.
/// This is used to support debugging information and static thread
/// local storage.
///
IMAGE_REL_ARM_SECREL = 0x000F,
///
/// The 32-bit VA of the target.This relocation is applied using a MOVW
/// instruction for the low 16 bits followed by a MOVT for the high 16 bits.
///
IMAGE_REL_ARM_MOV32 = 0x0010,
///
/// The 32-bit VA of the target.This relocation is applied using a MOVW
/// instruction for the low 16 bits followed by a MOVT for the high 16 bits.
///
IMAGE_REL_THUMB_MOV32 = 0x0011,
///
/// The instruction is fixed up with the 21 - bit relative displacement to
/// the 2-byte aligned target. The least significant bit of the displacement
/// is always zero and is not stored. This relocation corresponds to a
/// Thumb-2 32-bit conditional B instruction.
///
IMAGE_REL_THUMB_BRANCH20 = 0x0012,
Unused = 0x0013,
///
/// The instruction is fixed up with the 25-bit relative displacement to
/// the 2-byte aligned target. The least significant bit of the displacement
/// is zero and is not stored. This relocation corresponds to a Thumb-2 B
/// instruction.
///
IMAGE_REL_THUMB_BRANCH24 = 0x0014,
///
/// The instruction is fixed up with the 25-bit relative displacement to
/// the 4-byte aligned target. The low 2 bits of the displacement are zero
/// and are not stored. This relocation corresponds to a Thumb-2 BLX instruction.
///
IMAGE_REL_THUMB_BLX23 = 0x0015,
///
/// The relocation is valid only when it immediately follows a ARM_REFHI or
/// THUMB_REFHI. Its SymbolTableIndex contains a displacement and not an index
/// into the symbol table.
///
IMAGE_REL_ARM_PAIR = 0x0016,
#endregion
#region ARM64 Processors
///
/// The relocation is ignored.
///
IMAGE_REL_ARM64_ABSOLUTE = 0x0000,
///
/// The 32-bit VA of the target.
///
IMAGE_REL_ARM64_ADDR32 = 0x0001,
///
/// The 32-bit RVA of the target.
///
IMAGE_REL_ARM64_ADDR32NB = 0x0002,
///
/// The 26-bit relative displacement to the target, for B and BL instructions.
///
IMAGE_REL_ARM64_BRANCH26 = 0x0003,
///
/// The page base of the target, for ADRP instruction.
///
IMAGE_REL_ARM64_PAGEBASE_REL21 = 0x0004,
///
/// The 12-bit relative displacement to the target, for instruction ADR
///
IMAGE_REL_ARM64_REL21 = 0x0005,
///
/// The 12-bit page offset of the target, for instructions ADD/ADDS (immediate)
/// with zero shift.
///
IMAGE_REL_ARM64_PAGEOFFSET_12A = 0x0006,
///
/// The 12-bit page offset of the target, for instruction LDR (indexed,
/// unsigned immediate).
///
IMAGE_REL_ARM64_PAGEOFFSET_12L = 0x0007,
///
/// The 32-bit offset of the target from the beginning of its section.
/// This is used to support debugging information and static thread local storage.
///
IMAGE_REL_ARM64_SECREL = 0x0008,
///
/// Bit 0:11 of section offset of the target, for instructions ADD/ADDS(immediate)
/// with zero shift.
///
IMAGE_REL_ARM64_SECREL_LOW12A = 0x0009,
///
/// Bit 12:23 of section offset of the target, for instructions ADD/ADDS(immediate)
/// with zero shift.
///
IMAGE_REL_ARM64_SECREL_HIGH12A = 0x000A,
///
/// Bit 0:11 of section offset of the target, for instruction LDR(indexed,
/// unsigned immediate).
///
IMAGE_REL_ARM64_SECREL_LOW12L = 0x000B,
///
/// CLR token.
///
IMAGE_REL_ARM64_TOKEN = 0x000C,
///
/// The 16-bit section index of the section that contains the target.
/// This is used to support debugging information.
///
IMAGE_REL_ARM64_SECTION = 0x000D,
///
/// The 64-bit VA of the relocation target.
///
IMAGE_REL_ARM64_ADDR64 = 0x000E,
///
/// The 19-bit offset to the relocation target, for conditional B instruction.
///
IMAGE_REL_ARM64_BRANCH19 = 0x000F,
///
/// The 14-bit offset to the relocation target, for instructions TBZ and TBNZ.
///
IMAGE_REL_ARM64_BRANCH14 = 0x0010,
///
/// The 32-bit relative address from the byte following the relocation.
///
IMAGE_REL_ARM64_REL32 = 0x0011,
#endregion
#region Hitachi SuperH Processors
///
/// The relocation is ignored.
///
IMAGE_REL_SH3_ABSOLUTE = 0x0000,
///
/// A reference to the 16-bit location that contains the VA of
/// the target symbol.
///
IMAGE_REL_SH3_DIRECT16 = 0x0001,
///
/// The 32-bit VA of the target symbol.
///
IMAGE_REL_SH3_DIRECT32 = 0x0002,
///
/// A reference to the 8-bit location that contains the VA of
/// the target symbol.
///
IMAGE_REL_SH3_DIRECT8 = 0x0003,
///
/// A reference to the 8-bit instruction that contains the
/// effective 16-bit VA of the target symbol.
///
IMAGE_REL_SH3_DIRECT8_WORD = 0x0004,
///
/// A reference to the 8-bit instruction that contains the
/// effective 32-bit VA of the target symbol.
///
IMAGE_REL_SH3_DIRECT8_LONG = 0x0005,
///
/// A reference to the 8-bit location whose low 4 bits contain
/// the VA of the target symbol.
///
IMAGE_REL_SH3_DIRECT4 = 0x0006,
///
/// A reference to the 8-bit instruction whose low 4 bits contain
/// the effective 16-bit VA of the target symbol.
///
IMAGE_REL_SH3_DIRECT4_WORD = 0x0007,
///
/// A reference to the 8-bit instruction whose low 4 bits contain
/// the effective 32-bit VA of the target symbol.
///
IMAGE_REL_SH3_DIRECT4_LONG = 0x0008,
///
/// A reference to the 8-bit instruction that contains the
/// effective 16-bit relative offset of the target symbol.
///
IMAGE_REL_SH3_PCREL8_WORD = 0x0009,
///
/// A reference to the 8-bit instruction that contains the
/// effective 32-bit relative offset of the target symbol.
///
IMAGE_REL_SH3_PCREL8_LONG = 0x000A,
///
/// A reference to the 16-bit instruction whose low 12 bits contain
/// the effective 16-bit relative offset of the target symbol.
///
IMAGE_REL_SH3_PCREL12_WORD = 0x000B,
///
/// A reference to a 32-bit location that is the VA of the
/// section that contains the target symbol.
///
IMAGE_REL_SH3_STARTOF_SECTION = 0x000C,
///
/// A reference to the 32-bit location that is the size of the
/// section that contains the target symbol.
///
IMAGE_REL_SH3_SIZEOF_SECTION = 0x000D,
///
/// The 16-bit section index of the section that contains the target.
/// This is used to support debugging information.
///
IMAGE_REL_SH3_SECTION = 0x000E,
///
/// The 32-bit offset of the target from the beginning of its section.
/// This is used to support debugging information and static thread
/// local storage.
///
IMAGE_REL_SH3_SECREL = 0x000F,
///
/// The 32-bit RVA of the target symbol.
///
IMAGE_REL_SH3_DIRECT32_NB = 0x0010,
///
/// GP relative.
///
IMAGE_REL_SH3_GPREL4_LONG = 0x0011,
///
/// CLR token.
///
IMAGE_REL_SH3_TOKEN = 0x0012,
///
/// The offset from the current instruction in longwords. If the NOMODE
/// bit is not set, insert the inverse of the low bit at bit 32 to
/// select PTA or PTB.
///
IMAGE_REL_SHM_PCRELPT = 0x0013,
///
/// The low 16 bits of the 32-bit address.
///
IMAGE_REL_SHM_REFLO = 0x0014,
///
/// The high 16 bits of the 32-bit address.
///
IMAGE_REL_SHM_REFHALF = 0x0015,
///
/// The low 16 bits of the relative address.
///
IMAGE_REL_SHM_RELLO = 0x0016,
///
/// The high 16 bits of the relative address.
///
IMAGE_REL_SHM_RELHALF = 0x0017,
///
/// The relocation is valid only when it immediately follows a REFHALF,
/// RELHALF, or RELLO relocation. The SymbolTableIndex field of the
/// relocation contains a displacement and not an index into the symbol table.
///
IMAGE_REL_SHM_PAIR = 0x0018,
///
/// The relocation ignores section mode.
///
IMAGE_REL_SHM_NOMODE = 0x8000,
#endregion
#region IBM PowerPC Processors
///
/// The relocation is ignored.
///
IMAGE_REL_PPC_ABSOLUTE = 0x0000,
///
/// The 64-bit VA of the target.
///
IMAGE_REL_PPC_ADDR64 = 0x0001,
///
/// The 32-bit VA of the target.
///
IMAGE_REL_PPC_ADDR32 = 0x0002,
///
/// The low 24 bits of the VA of the target. This is valid only when
/// the target symbol is absolute and can be sign-extended to its
/// original value.
///
IMAGE_REL_PPC_ADDR24 = 0x0003,
///
/// The low 16 bits of the target's VA.
///
IMAGE_REL_PPC_ADDR16 = 0x0004,
///
/// The low 14 bits of the target's VA. This is valid only when the
/// target symbol is absolute and can be sign-extended to its original
/// value.
///
IMAGE_REL_PPC_ADDR14 = 0x0005,
///
/// A 24-bit PC-relative offset to the symbol's location.
///
IMAGE_REL_PPC_REL24 = 0x0006,
///
/// A 14-bit PC-relative offset to the symbol's location.
///
IMAGE_REL_PPC_REL14 = 0x0007,
///
/// The 32-bit RVA of the target.
///
IMAGE_REL_PPC_ADDR32NB = 0x000A,
///
/// The 32-bit offset of the target from the beginning of its section.
/// This is used to support debugging information and static thread
/// local storage.
///
IMAGE_REL_PPC_SECREL = 0x000B,
///
/// The 16-bit section index of the section that contains the target.
/// This is used to support debugging information.
///
IMAGE_REL_PPC_SECTION = 0x000C,
///
/// The 16-bit offset of the target from the beginning of its section.
/// This is used to support debugging information and static thread
/// local storage.
///
IMAGE_REL_PPC_SECREL16 = 0x000F,
///
/// The high 16 bits of the target's 32-bit VA. This is used for the
/// first instruction in a two-instruction sequence that loads a full
/// address. This relocation must be immediately followed by a PAIR
/// relocation whose SymbolTableIndex contains a signed 16-bit
/// displacement that is added to the upper 16 bits that was taken
/// from the location that is being relocated.
///
IMAGE_REL_PPC_REFHI = 0x0010,
///
/// The low 16 bits of the target's VA.
///
IMAGE_REL_PPC_REFLO = 0x0011,
///
/// A relocation that is valid only when it immediately follows a REFHI
/// or SECRELHI relocation. Its SymbolTableIndex contains a displacement
/// and not an index into the symbol table.
///
IMAGE_REL_PPC_PAIR = 0x0012,
///
/// The low 16 bits of the 32-bit offset of the target from the beginning
/// of its section.
///
IMAGE_REL_PPC_SECRELLO = 0x0013,
///
/// The 16-bit signed displacement of the target relative to the GP register.
///
IMAGE_REL_PPC_GPREL = 0x0015,
///
/// The CLR token.
///
IMAGE_REL_PPC_TOKEN = 0x0016,
#endregion
#region Intel 386 Processors
///
/// The relocation is ignored.
///
IMAGE_REL_I386_ABSOLUTE = 0x0000,
///
/// Not supported.
///
IMAGE_REL_I386_DIR16 = 0x0001,
///
/// Not supported.
///
IMAGE_REL_I386_REL16 = 0x0002,
///
/// The target's 32-bit VA.
///
IMAGE_REL_I386_DIR32 = 0x0006,
///
/// The target's 32-bit RVA.
///
IMAGE_REL_I386_DIR32NB = 0x0007,
///
/// Not supported.
///
IMAGE_REL_I386_SEG12 = 0x0009,
///
/// The 16-bit section index of the section that contains the target.
/// This is used to support debugging information.
///
IMAGE_REL_I386_SECTION = 0x000A,
///
/// The 32-bit offset of the target from the beginning of its section.
/// This is used to support debugging information and static thread
/// local storage.
///
IMAGE_REL_I386_SECREL = 0x000B,
///
/// The CLR token.
///
IMAGE_REL_I386_TOKEN = 0x000C,
///
/// A 7-bit offset from the base of the section that contains the target.
///
IMAGE_REL_I386_SECREL7 = 0x000D,
///
/// The 32-bit relative displacement to the target.This supports the x86 relative branch and call instructions.
///
IMAGE_REL_I386_REL32 = 0x0014,
#endregion
#region Intel Itanium Processor Family (IPF)
///
/// The relocation is ignored.
///
IMAGE_REL_IA64_ABSOLUTE = 0x0000,
///
/// The instruction relocation can be followed by an ADDEND relocation whose value is
/// added to the target address before it is inserted into the specified slot in the
/// IMM14 bundle. The relocation target must be absolute or the image must be fixed.
///
IMAGE_REL_IA64_IMM14 = 0x0001,
///
/// The instruction relocation can be followed by an ADDEND relocation whose value is
/// added to the target address before it is inserted into the specified slot in the
/// IMM22 bundle. The relocation target must be absolute or the image must be fixed.
///
IMAGE_REL_IA64_IMM22 = 0x0002,
///
/// The slot number of this relocation must be one (1). The relocation can be followed
/// by an ADDEND relocation whose value is added to the target address before it is
/// stored in all three slots of the IMM64 bundle.
///
IMAGE_REL_IA64_IMM64 = 0x0003,
///
/// The target's 32-bit VA. This is supported only for /LARGEADDRESSAWARE:NO images.
///
IMAGE_REL_IA64_DIR32 = 0x0004,
///
/// The target's 64-bit VA.
///
IMAGE_REL_IA64_DIR64 = 0x0005,
///
/// The instruction is fixed up with the 25-bit relative displacement to the 16-bit
/// aligned target. The low 4 bits of the displacement are zero and are not stored.
///
IMAGE_REL_IA64_PCREL21B = 0x0006,
///
/// The instruction is fixed up with the 25-bit relative displacement to the 16-bit
/// aligned target. The low 4 bits of the displacement, which are zero, are not stored.
///
IMAGE_REL_IA64_PCREL21M = 0x0007,
///
/// The LSBs of this relocation's offset must contain the slot number whereas the rest
/// is the bundle address. The bundle is fixed up with the 25-bit relative displacement
/// to the 16-bit aligned target. The low 4 bits of the displacement are zero and are
/// not stored.
///
IMAGE_REL_IA64_PCREL21F = 0x0008,
///
/// The instruction relocation can be followed by an ADDEND relocation whose value is
/// added to the target address and then a 22-bit GP-relative offset that is calculated
/// and applied to the GPREL22 bundle.
///
IMAGE_REL_IA64_GPREL22 = 0x0009,
///
/// The instruction is fixed up with the 22-bit GP-relative offset to the target symbol's
/// literal table entry. The linker creates this literal table entry based on this
/// relocation and the ADDEND relocation that might follow.
///
IMAGE_REL_IA64_LTOFF22 = 0x000A,
///
/// The 16-bit section index of the section contains the target. This is used to support
/// debugging information.
///
IMAGE_REL_IA64_SECTION = 0x000B,
///
/// The instruction is fixed up with the 22-bit offset of the target from the beginning of
/// its section.This relocation can be followed immediately by an ADDEND relocation,
/// whose Value field contains the 32-bit unsigned offset of the target from the beginning
/// of the section.
///
IMAGE_REL_IA64_SECREL22 = 0x000C,
///
/// The slot number for this relocation must be one (1). The instruction is fixed up with
/// the 64-bit offset of the target from the beginning of its section. This relocation can
/// be followed immediately by an ADDEND relocation whose Value field contains the 32-bit
/// unsigned offset of the target from the beginning of the section.
///
IMAGE_REL_IA64_SECREL64I = 0x000D,
///
/// The address of data to be fixed up with the 32-bit offset of the target from the beginning
/// of its section.
///
IMAGE_REL_IA64_SECREL32 = 0x000E,
///
/// The target's 32-bit RVA.
///
IMAGE_REL_IA64_DIR32NB = 0x0010,
///
/// This is applied to a signed 14-bit immediate that contains the difference between two
/// relocatable targets. This is a declarative field for the linker that indicates that the
/// compiler has already emitted this value.
///
IMAGE_REL_IA64_SREL14 = 0x0011,
///
/// This is applied to a signed 22-bit immediate that contains the difference between two
/// relocatable targets. This is a declarative field for the linker that indicates that the
/// compiler has already emitted this value.
///
IMAGE_REL_IA64_SREL22 = 0x0012,
///
/// This is applied to a signed 32-bit immediate that contains the difference between two
/// relocatable values.This is a declarative field for the linker that indicates that the
/// compiler has already emitted this value.
///
IMAGE_REL_IA64_SREL32 = 0x0013,
///
/// This is applied to an unsigned 32-bit immediate that contains the difference between
/// two relocatable values. This is a declarative field for the linker that indicates that
/// the compiler has already emitted this value.
///
IMAGE_REL_IA64_UREL32 = 0x0014,
///
/// A 60-bit PC-relative fixup that always stays as a BRL instruction of an MLX bundle.
///
IMAGE_REL_IA64_PCREL60X = 0x0015,
///
/// A 60-bit PC-relative fixup. If the target displacement fits in a signed 25-bit field,
/// convert the entire bundle to an MBB bundle with NOP. B in slot 1 and a 25-bit BR
/// instruction (with the 4 lowest bits all zero and dropped) in slot 2.
///
IMAGE_REL_IA64_PCREL60B = 0x0016,
///
/// A 60-bit PC-relative fixup. If the target displacement fits in a signed 25-bit field,
/// convert the entire bundle to an MFB bundle with NOP. F in slot 1 and a 25-bit
/// (4 lowest bits all zero and dropped) BR instruction in slot 2.
///
IMAGE_REL_IA64_PCREL60F = 0x0017,
///
/// A 60-bit PC-relative fixup. If the target displacement fits in a signed 25-bit field,
/// convert the entire bundle to an MIB bundle with NOP. I in slot 1 and a 25-bit
/// (4 lowest bits all zero and dropped) BR instruction in slot 2.
///
IMAGE_REL_IA64_PCREL60I = 0x0018,
///
/// A 60-bit PC-relative fixup. If the target displacement fits in a signed 25-bit field,
/// convert the entire bundle to an MMB bundle with NOP. M in slot 1 and a 25-bit
/// (4 lowest bits all zero and dropped) BR instruction in slot 2.
///
IMAGE_REL_IA64_PCREL60M = 0x0019,
///
/// A 64-bit GP-relative fixup.
///
IMAGE_REL_IA64_IMMGPREL64 = 0x001a,
///
/// A CLR token.
///
IMAGE_REL_IA64_TOKEN = 0x001b,
///
/// A 32-bit GP-relative fixup.
///
IMAGE_REL_IA64_GPREL32 = 0x001c,
///
/// The relocation is valid only when it immediately follows one of the following relocations:
/// IMM14, IMM22, IMM64, GPREL22, LTOFF22, LTOFF64, SECREL22, SECREL64I, or SECREL32.
/// Its value contains the addend to apply to instructions within a bundle, not for data.
///
IMAGE_REL_IA64_ADDEND = 0x001F,
#endregion
#region MIPS Processors
///
/// The relocation is ignored.
///
IMAGE_REL_MIPS_ABSOLUTE = 0x0000,
///
/// The high 16 bits of the target's 32-bit VA.
///
IMAGE_REL_MIPS_REFHALF = 0x0001,
///
/// The target's 32-bit VA.
///
IMAGE_REL_MIPS_REFWORD = 0x0002,
///
/// The low 26 bits of the target's VA. This supports the MIPS J and JAL instructions.
///
IMAGE_REL_MIPS_JMPADDR = 0x0003,
///
/// The high 16 bits of the target's 32-bit VA. This is used for the first instruction in a
/// two-instruction sequence that loads a full address. This relocation must be immediately
/// followed by a PAIR relocation whose SymbolTableIndex contains a signed 16-bit displacement
/// that is added to the upper 16 bits that are taken from the location that is being relocated.
///
IMAGE_REL_MIPS_REFHI = 0x0004,
///
/// The low 16 bits of the target's VA.
///
IMAGE_REL_MIPS_REFLO = 0x0005,
///
/// A 16-bit signed displacement of the target relative to the GP register.
///
IMAGE_REL_MIPS_GPREL = 0x0006,
///
/// The same as IMAGE_REL_MIPS_GPREL.
///
IMAGE_REL_MIPS_LITERAL = 0x0007,
///
/// The 16-bit section index of the section contains the target.
/// This is used to support debugging information.
///
IMAGE_REL_MIPS_SECTION = 0x000A,
///
/// The 32-bit offset of the target from the beginning of its section.
/// This is used to support debugging information and static thread local storage.
///
IMAGE_REL_MIPS_SECREL = 0x000B,
///
/// The low 16 bits of the 32-bit offset of the target from the beginning of its section.
///
IMAGE_REL_MIPS_SECRELLO = 0x000C,
///
/// The high 16 bits of the 32-bit offset of the target from the beginning of its section.
/// An IMAGE_REL_MIPS_PAIR relocation must immediately follow this one. The SymbolTableIndex
/// of the PAIR relocation contains a signed 16-bit displacement that is added to the upper
/// 16 bits that are taken from the location that is being relocated.
///
IMAGE_REL_MIPS_SECRELHI = 0x000D,
///
/// The low 26 bits of the target's VA. This supports the MIPS16 JAL instruction.
///
IMAGE_REL_MIPS_JMPADDR16 = 0x0010,
///
/// The target's 32-bit RVA.
///
IMAGE_REL_MIPS_REFWORDNB = 0x0022,
///
/// The relocation is valid only when it immediately follows a REFHI or SECRELHI relocation.
/// Its SymbolTableIndex contains a displacement and not an index into the symbol table.
///
IMAGE_REL_MIPS_PAIR = 0x0025,
#endregion
#region Mitsubishi M32R
///
/// The relocation is ignored.
///
IMAGE_REL_M32R_ABSOLUTE = 0x0000,
///
/// The target's 32-bit VA.
///
IMAGE_REL_M32R_ADDR32 = 0x0001,
///
/// The target's 32-bit RVA.
///
IMAGE_REL_M32R_ADDR32NB = 0x0002,
///
/// The target's 24-bit VA.
///
IMAGE_REL_M32R_ADDR24 = 0x0003,
///
/// The target's 16-bit offset from the GP register.
///
IMAGE_REL_M32R_GPREL16 = 0x0004,
///
/// The target's 24-bit offset from the program counter (PC), shifted left by
/// 2 bits and sign-extended
///
IMAGE_REL_M32R_PCREL24 = 0x0005,
///
/// The target's 16-bit offset from the PC, shifted left by 2 bits and
/// sign-extended
///
IMAGE_REL_M32R_PCREL16 = 0x0006,
///
/// The target's 8-bit offset from the PC, shifted left by 2 bits and
/// sign-extended
///
IMAGE_REL_M32R_PCREL8 = 0x0007,
///
/// The 16 MSBs of the target VA.
///
IMAGE_REL_M32R_REFHALF = 0x0008,
///
/// The 16 MSBs of the target VA, adjusted for LSB sign extension. This is used for
/// the first instruction in a two-instruction sequence that loads a full 32-bit address.
/// This relocation must be immediately followed by a PAIR relocation whose SymbolTableIndex
/// contains a signed 16-bit displacement that is added to the upper 16 bits that are
/// taken from the location that is being relocated.
///
IMAGE_REL_M32R_REFHI = 0x0009,
///
/// The 16 LSBs of the target VA.
///
IMAGE_REL_M32R_REFLO = 0x000A,
///
/// The relocation must follow the REFHI relocation.Its SymbolTableIndex contains a displacement
/// and not an index into the symbol table.
///
IMAGE_REL_M32R_PAIR = 0x000B,
///
/// The 16-bit section index of the section that contains the target. This is used to support
/// debugging information.
///
IMAGE_REL_M32R_SECTION = 0x000C,
///
/// The 32-bit offset of the target from the beginning of its section.This is used to support
/// debugging information and static thread local storage.
///
IMAGE_REL_M32R_SECREL = 0x000D,
///
/// The CLR token.
///
IMAGE_REL_M32R_TOKEN = 0x000E,
#endregion
}
public enum ResourceType : uint
{
RT_NEWRESOURCE = 0x2000,
RT_ERROR = 0x7FFF,
///
/// Hardware-dependent cursor resource.
///
RT_CURSOR = 1,
///
/// Bitmap resource.
///
RT_BITMAP = 2,
///
/// Hardware-dependent icon resource.
///
RT_ICON = 3,
///
/// Menu resource.
///
RT_MENU = 4,
///
/// Dialog box.
///
RT_DIALOG = 5,
///
/// String-table entry.
///
RT_STRING = 6,
///
/// Font directory resource.
///
RT_FONTDIR = 7,
///
/// Font resource.
///
RT_FONT = 8,
///
/// Accelerator table.
///
RT_ACCELERATOR = 9,
///
/// Application-defined resource (raw data).
///
RT_RCDATA = 10,
///
/// Message-table entry.
///
RT_MESSAGETABLE = 11,
///
/// Hardware-independent cursor resource.
///
RT_GROUP_CURSOR = RT_CURSOR + 11,
///
/// Hardware-independent icon resource.
///
RT_GROUP_ICON = RT_ICON + 11,
///
/// Version resource.
///
RT_VERSION = 16,
///
/// Allows a resource editing tool to associate a string with an .rc file.
/// Typically, the string is the name of the header file that provides symbolic
/// names. The resource compiler parses the string but otherwise ignores the
/// value. For example, `1 DLGINCLUDE "MyFile.h"`
///
RT_DLGINCLUDE = 17,
///
/// Plug and Play resource.
///
RT_PLUGPLAY = 19,
///
/// VXD.
///
RT_VXD = 20,
///
/// Animated cursor.
///
RT_ANICURSOR = 21,
///
/// Animated icon.
///
RT_ANIICON = 22,
///
/// HTML resource.
///
RT_HTML = 23,
///
/// Side-by-Side Assembly Manifest.
///
RT_MANIFEST = 24,
RT_NEWBITMAP = (RT_BITMAP | RT_NEWRESOURCE),
RT_NEWMENU = (RT_MENU | RT_NEWRESOURCE),
RT_NEWDIALOG = (RT_DIALOG | RT_NEWRESOURCE),
}
[Flags]
public enum SectionFlags : uint
{
///
/// Reserved for future use.
///
RESERVED0 = 0x00000001,
///
/// Reserved for future use.
///
RESERVED1 = 0x00000002,
///
/// Reserved for future use.
///
RESERVED2 = 0x00000004,
///
/// The section should not be padded to the next boundary.
/// This flag is obsolete and is replaced by IMAGE_SCN_ALIGN_1BYTES.
/// This is valid only for object files.
///
IMAGE_SCN_TYPE_NO_PAD = 0x00000008,
///
/// Reserved for future use.
///
RESERVED4 = 0x00000010,
///
/// The section contains executable code.
///
IMAGE_SCN_CNT_CODE = 0x00000020,
///
/// The section contains initialized data.
///
IMAGE_SCN_CNT_INITIALIZED_DATA = 0x00000040,
///
/// The section contains uninitialized data.
///
IMAGE_SCN_CNT_UNINITIALIZED_DATA = 0x00000080,
///
/// Reserved for future use.
///
IMAGE_SCN_LNK_OTHER = 0x00000100,
///
/// The section contains comments or other information. The .drectve
/// section has this type. This is valid for object files only.
///
IMAGE_SCN_LNK_INFO = 0x00000200,
///
/// Reserved for future use.
///
RESERVED10 = 0x00000400,
///
/// The section will not become part of the image. This is valid
/// only for object files.
///
IMAGE_SCN_LNK_REMOVE = 0x00000800,
///
/// The section contains COMDAT data. For more information, see COMDAT Sections
/// (Object Only). This is valid only for object files.
///
IMAGE_SCN_LNK_COMDAT = 0x00001000,
///
/// The section contains data referenced through the global pointer (GP).
///
IMAGE_SCN_GPREL = 0x00008000,
///
/// Reserved for future use.
///
IMAGE_SCN_MEM_PURGEABLE = 0x00010000,
///
/// Reserved for future use.
///
IMAGE_SCN_MEM_16BIT = 0x00020000,
///
/// Reserved for future use.
///
IMAGE_SCN_MEM_LOCKED = 0x00040000,
///
/// Reserved for future use.
///
IMAGE_SCN_MEM_PRELOAD = 0x00080000,
///
/// Align data on a 1-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_1BYTES = 0x00100000,
///
/// Align data on a 2-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_2BYTES = 0x00200000,
///
/// Align data on a 4-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_4BYTES = 0x00300000,
///
/// Align data on an 8-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_8BYTES = 0x00400000,
///
/// Align data on a 16-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_16BYTES = 0x00500000,
///
/// Align data on a 32-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_32BYTES = 0x00600000,
///
/// Align data on a 64-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_64BYTES = 0x00700000,
///
/// Align data on a 128-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_128BYTES = 0x00800000,
///
/// Align data on a 256-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_256BYTES = 0x00900000,
///
/// Align data on a 512-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_512BYTES = 0x00A00000,
///
/// Align data on a 1024-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_1024BYTES = 0x00B00000,
///
/// Align data on a 2048-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_2048BYTES = 0x00C00000,
///
/// Align data on a 4096-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_4096BYTES = 0x00D00000,
///
/// Align data on an 8192-byte boundary. Valid only for object files.
///
IMAGE_SCN_ALIGN_8192BYTES = 0x00E00000,
///
/// The section contains extended relocations.
///
IMAGE_SCN_LNK_NRELOC_OVFL = 0x01000000,
///
/// The section can be discarded as needed.
///
IMAGE_SCN_MEM_DISCARDABLE = 0x02000000,
///
/// The section cannot be cached.
///
IMAGE_SCN_MEM_NOT_CACHED = 0x04000000,
///
/// The section is not pageable.
///
IMAGE_SCN_MEM_NOT_PAGED = 0x08000000,
///
/// The section can be shared in memory.
///
IMAGE_SCN_MEM_SHARED = 0x10000000,
///
/// The section can be executed as code.
///
IMAGE_SCN_MEM_EXECUTE = 0x20000000,
///
/// The section can be read.
///
IMAGE_SCN_MEM_READ = 0x40000000,
///
/// The section can be written to.
///
IMAGE_SCN_MEM_WRITE = 0x80000000,
}
public enum SectionNumber
{
///
/// The symbol record is not yet assigned a section. A value of
/// zero indicates that a reference to an external symbol is
/// defined elsewhere. A value of non-zero is a common symbol
/// with a size that is specified by the value.
///
IMAGE_SYM_UNDEFINED = 0,
///
/// The symbol has an absolute (non-relocatable) value and
/// is not an address.
///
IMAGE_SYM_ABSOLUTE = -1,
///
/// The symbol provides general type or debugging information
/// but does not correspond to a section. Microsoft tools use
/// this setting along with .file records (storage class FILE).
///
IMAGE_SYM_DEBUG = -2,
}
public enum StorageClass : byte
{
///
/// A special symbol that represents the end of function, for debugging purposes.
///
IMAGE_SYM_CLASS_END_OF_FUNCTION = 0xFF,
///
/// No assigned storage class.
///
IMAGE_SYM_CLASS_NULL = 0x00,
///
/// The automatic (stack) variable.The Value field specifies the stack frame offset.
///
IMAGE_SYM_CLASS_AUTOMATIC = 0x01,
///
/// A value that Microsoft tools use for external symbols. The Value field indicates
/// the size if the section number is IMAGE_SYM_UNDEFINED (0). If the section number
/// is not zero, then the Value field specifies the offset within the section.
///
IMAGE_SYM_CLASS_EXTERNAL = 0x02,
///
/// The offset of the symbol within the section. If the Value field is zero, then
/// the symbol represents a section name.
///
IMAGE_SYM_CLASS_STATIC = 0x03,
///
/// A register variable.The Value field specifies the register number.
///
IMAGE_SYM_CLASS_REGISTER = 0x04,
///
/// A symbol that is defined externally.
///
IMAGE_SYM_CLASS_EXTERNAL_DEF = 0x05,
///
/// A code label that is defined within the module. The Value field specifies the
/// offset of the symbol within the section.
///
IMAGE_SYM_CLASS_LABEL = 0x06,
///
/// A reference to a code label that is not defined.
///
IMAGE_SYM_CLASS_UNDEFINED_LABEL = 0x07,
///
/// The structure member. The Value field specifies the n th member.
///
IMAGE_SYM_CLASS_MEMBER_OF_STRUCT = 0x08,
///
/// A formal argument (parameter) of a function. The Value field specifies the
/// n th argument.
///
IMAGE_SYM_CLASS_ARGUMENT = 0x09,
///
/// The structure tag-name entry.
///
IMAGE_SYM_CLASS_STRUCT_TAG = 0x0A,
///
/// A union member. The Value field specifies the n th member.
///
IMAGE_SYM_CLASS_MEMBER_OF_UNION = 0x0B,
///
/// The Union tag-name entry.
///
IMAGE_SYM_CLASS_UNION_TAG = 0x0C,
///
/// A Typedef entry.
///
IMAGE_SYM_CLASS_TYPE_DEFINITION = 0x0D,
///
/// A static data declaration.
///
IMAGE_SYM_CLASS_UNDEFINED_STATIC = 0x0E,
///
/// An enumerated type tagname entry.
///
IMAGE_SYM_CLASS_ENUM_TAG = 0x0F,
///
/// A member of an enumeration. The Value field specifies the
/// n th member.
///
IMAGE_SYM_CLASS_MEMBER_OF_ENUM = 0x10,
///
/// A register parameter.
///
IMAGE_SYM_CLASS_REGISTER_PARAM = 0x11,
///
/// A bit-field reference. The Value field specifies the
/// n th bit in the bit field.
///
IMAGE_SYM_CLASS_BIT_FIELD = 0x12,
///
/// A .bb (beginning of block) or .eb (end of block) record.
/// The Value field is the relocatable address of the code location.
///
IMAGE_SYM_CLASS_BLOCK = 0x64,
///
/// A value that Microsoft tools use for symbol records that define the extent
/// of a function: begin function (.bf ), end function (.ef), and lines in
/// function (.lf). For .lf records, the Value field gives the number of source
/// lines in the function. For .ef records, the Value field gives the size of
/// the function code.
///
IMAGE_SYM_CLASS_FUNCTION = 0x65,
///
/// An end-of-structure entry.
///
IMAGE_SYM_CLASS_END_OF_STRUCT = 0x66,
///
/// A value that Microsoft tools, as well as traditional COFF format, use for the
/// source-file symbol record. The symbol is followed by auxiliary records that
/// name the file.
///
IMAGE_SYM_CLASS_FILE = 0x67,
///
/// A definition of a section (Microsoft tools use STATIC storage class instead).
///
IMAGE_SYM_CLASS_SECTION = 0x68,
///
/// A weak external.For more information, see Auxiliary Format 3: Weak Externals.
///
IMAGE_SYM_CLASS_WEAK_EXTERNAL = 0x69,
///
/// A CLR token symbol. The name is an ASCII string that consists of the hexadecimal
/// value of the token. For more information, see CLR Token Definition (Object Only).
///
IMAGE_SYM_CLASS_CLR_TOKEN = 0x6A,
}
public enum SymbolType : ushort
{
///
/// No type information or unknown base type. Microsoft tools use this setting
///
IMAGE_SYM_TYPE_NULL = 0x00,
///
/// No valid type; used with void pointers and functions
///
IMAGE_SYM_TYPE_VOID = 0x01,
///
/// A character (signed byte)
///
IMAGE_SYM_TYPE_CHAR = 0x02,
///
/// A 2-byte signed integer
///
IMAGE_SYM_TYPE_SHORT = 0x03,
///
/// A natural integer type (normally 4 bytes in Windows)
///
IMAGE_SYM_TYPE_INT = 0x04,
///
/// A 4-byte signed integer
///
IMAGE_SYM_TYPE_LONG = 0x05,
///
/// A 4-byte floating-point number
///
IMAGE_SYM_TYPE_FLOAT = 0x06,
///
/// An 8-byte floating-point number
///
IMAGE_SYM_TYPE_DOUBLE = 0x07,
///
/// A structure
///
IMAGE_SYM_TYPE_STRUCT = 0x08,
///
/// A union
///
IMAGE_SYM_TYPE_UNION = 0x09,
///
/// An enumerated type
///
IMAGE_SYM_TYPE_ENUM = 0x0A,
///
/// A member of enumeration (a specific value)
///
IMAGE_SYM_TYPE_MOE = 0x0B,
///
/// A byte; unsigned 1-byte integer
///
IMAGE_SYM_TYPE_BYTE = 0x0C,
///
/// A word; unsigned 2-byte integer
///
IMAGE_SYM_TYPE_WORD = 0x0D,
///
/// An unsigned integer of natural size (normally, 4 bytes)
///
IMAGE_SYM_TYPE_UINT = 0x0E,
///
/// An unsigned 4-byte integer
///
IMAGE_SYM_TYPE_DWORD = 0x0F,
///
/// A function pointer
///
IMAGE_SYM_TYPE_FUNC = 0x20,
}
public enum SymbolDerivedType : byte
{
///
/// No derived type; the symbol is a simple scalar variable.
///
IMAGE_SYM_DTYPE_NULL = 0x00,
///
/// The symbol is a pointer to base type.
///
IMAGE_SYM_DTYPE_POINTER = 0x01,
///
/// The symbol is a function that returns a base type.
///
IMAGE_SYM_DTYPE_FUNCTION = 0x02,
///
/// The symbol is an array of base type.
///
IMAGE_SYM_DTYPE_ARRAY = 0x03,
}
public enum VersionResourceType : ushort
{
BinaryData = 0,
TextData = 1,
}
[Flags]
public enum WindowStyles : uint
{
#region Standard Styles
///
/// The window is an overlapped window. An overlapped window has a title
/// bar and a border. Same as the WS_TILED style.
///
WS_OVERLAPPED = 0x00000000,
///
/// The window is an overlapped window. An overlapped window has a title bar
/// and a border. Same as the WS_OVERLAPPED style.
///
WS_TILED = 0x00000000,
///
/// The window has a maximize button. Cannot be combined with the
/// WS_EX_CONTEXTHELP style. The WS_SYSMENU style must also be specified.
///
WS_MAXIMIZEBOX = 0x00010000,
///
/// The window is a control that can receive the keyboard focus when the user
/// presses the TAB key. Pressing the TAB key changes the keyboard focus to
/// the next control with the WS_TABSTOP style.
///
/// You can turn this style on and off to change dialog box navigation. To
/// change this style after a window has been created, use the SetWindowLong
/// function. For user-created windows and modeless dialogs to work with tab
/// stops, alter the message loop to call the IsDialogMessage function.
///
WS_TABSTOP = 0x00010000,
///
/// The window has a minimize button. Cannot be combined with the
/// WS_EX_CONTEXTHELP style. The WS_SYSMENU style must also be specified.
///
WS_MINIMIZEBOX = 0x00020000,
///
/// The window is the first control of a group of controls. The group consists
/// of this first control and all controls defined after it, up to the next
/// control with the WS_GROUP style. The first control in each group usually
/// has the WS_TABSTOP style so that the user can move from group to group.
/// The user can subsequently change the keyboard focus from one control in
/// the group to the next control in the group by using the direction keys.
///
/// You can turn this style on and off to change dialog box navigation. To
/// change this style after a window has been created, use the SetWindowLong
/// function.
///
WS_GROUP = 0x00020000,
///
/// The window has a sizing border. Same as the WS_THICKFRAME style.
///
WS_SIZEBOX = 0x00040000,
///
/// The window has a sizing border. Same as the WS_SIZEBOX style.
///
WS_THICKFRAME = 0x00040000,
///
/// The window has a window menu on its title bar. The WS_CAPTION style must
/// also be specified.
///
WS_SYSMENU = 0x00080000,
///
/// The window has a horizontal scroll bar.
///
WS_HSCROLL = 0x00100000,
///
/// The window has a vertical scroll bar.
///
WS_VSCROLL = 0x00200000,
///
/// The window has a border of a style typically used with dialog boxes. A
/// window with this style cannot have a title bar.
///
WS_DLGFRAME = 0x00400000,
///
/// The window has a thin-line border
///
WS_BORDER = 0x00800000,
///
/// The window has a title bar
///
WS_CAPTION = 0x00C00000,
///
/// The window is initially maximized.
///
WS_MAXIMIZE = 0x01000000,
///
/// Excludes the area occupied by child windows when drawing occurs within the
/// parent window. This style is used when creating the parent window.
///
WS_CLIPCHILDREN = 0x02000000,
///
/// Clips child windows relative to each other; that is, when a particular child
/// window receives a WM_PAINT message, the WS_CLIPSIBLINGS style clips all other
/// overlapping child windows out of the region of the child window to be updated.
/// If WS_CLIPSIBLINGS is not specified and child windows overlap, it is possible,
/// when drawing within the client area of a child window, to draw within the
/// client area of a neighboring child window.
///
WS_CLIPSIBLINGS = 0x04000000,
///
/// The window is initially disabled. A disabled window cannot receive input from
/// the user. To change this after a window has been created, use the EnableWindow
/// function.
///
WS_DISABLED = 0x08000000,
///
/// The window is initially visible.
/// This style can be turned on and off by using the ShowWindow or SetWindowPos
/// function.
///
WS_VISIBLE = 0x10000000,
///
/// The window is initially minimized. Same as the WS_MINIMIZE style.
///
WS_ICONIC = 0x20000000,
///
/// The window is initially minimized. Same as the WS_ICONIC style.
///
WS_MINIMIZE = 0x20000000,
///
/// The window is a child window. A window with this style cannot have a menu
/// bar. This style cannot be used with the WS_POPUP style.
///
WS_CHILD = 0x40000000,
///
/// Same as the WS_CHILD style.
///
WS_CHILDWINDOW = 0x40000000,
///
/// The window is a pop-up window. This style cannot be used with the WS_CHILD style.
///
WS_POPUP = 0x80000000,
///
/// The window is an overlapped window. Same as the WS_TILEDWINDOW style.
///
WS_OVERLAPPEDWINDOW = WS_OVERLAPPED | WS_CAPTION | WS_SYSMENU | WS_THICKFRAME | WS_MINIMIZEBOX | WS_MAXIMIZEBOX,
///
/// The window is a pop-up window. The WS_CAPTION and WS_POPUPWINDOW styles must be
/// combined to make the window menu visible.
///
WS_POPUPWINDOW = WS_POPUP | WS_BORDER | WS_SYSMENU,
///
/// The window is an overlapped window. Same as the WS_OVERLAPPEDWINDOW style.
///
WS_TILEDWINDOW = WS_OVERLAPPED | WS_CAPTION | WS_SYSMENU | WS_THICKFRAME | WS_MINIMIZEBOX | WS_MAXIMIZEBOX,
#endregion
#region Common Control Styles
///
/// Causes the control to position itself at the top of the parent window's
/// client area and sets the width to be the same as the parent window's width.
/// Toolbars have this style by default.
///
CCS_TOP = 0x00000001,
///
/// Causes the control to resize and move itself horizontally, but not vertically,
/// in response to a WM_SIZE message. If CCS_NORESIZE is used, this style does not
/// apply. Header windows have this style by default.
///
CCS_NOMOVEY = 0x00000002,
///
/// Causes the control to position itself at the bottom of the parent window's
/// client area and sets the width to be the same as the parent window's width.
/// Status windows have this style by default.
///
CCS_BOTTOM = 0x00000003,
///
/// Prevents the control from using the default width and height when setting its
/// initial size or a new size. Instead, the control uses the width and height
/// specified in the request for creation or sizing.
///
CCS_NORESIZE = 0x00000004,
///
/// Prevents the control from automatically moving to the top or bottom of the parent
/// window. Instead, the control keeps its position within the parent window despite
/// changes to the size of the parent. If CCS_TOP or CCS_BOTTOM is also used, the
/// height is adjusted to the default, but the position and width remain unchanged.
///
CCS_NOPARENTALIGN = 0x00000008,
///
/// Enables a toolbar's built-in customization features, which let the user to drag a
/// button to a new position or to remove a button by dragging it off the toolbar.
/// In addition, the user can double-click the toolbar to display the Customize Toolbar
/// dialog box, which enables the user to add, delete, and rearrange toolbar buttons.
///
CCS_ADJUSTABLE = 0x00000020,
///
/// Prevents a two-pixel highlight from being drawn at the top of the control.
///
CCS_NODIVIDER = 0x00000040,
///
/// Version 4.70. Causes the control to be displayed vertically.
///
CCS_VERT = 0x00000080,
///
/// Version 4.70. Causes the control to be displayed vertically on the left side of the
/// parent window.
///
CCS_LEFT = CCS_VERT | CCS_TOP,
///
/// Version 4.70. Causes the control to be displayed vertically on the right side of the
/// parent window.
///
CCS_RIGHT = CCS_VERT | CCS_BOTTOM,
///
/// Version 4.70. Causes the control to resize and move itself vertically, but not
/// horizontally, in response to a WM_SIZE message. If CCS_NORESIZE is used, this style
/// does not apply.
///
CCS_NOMOVEX = CCS_VERT | CCS_NOMOVEY,
#endregion
#region Dialog Box Styles
///
/// Indicates that the coordinates of the dialog box are screen coordinates.
/// If this style is not specified, the coordinates are client coordinates.
///
DS_ABSALIGN = 0x00000001,
///
/// This style is obsolete and is included for compatibility with 16-bit versions
/// of Windows. If you specify this style, the system creates the dialog box with
/// the WS_EX_TOPMOST style. This style does not prevent the user from accessing
/// other windows on the desktop.
///
/// Do not combine this style with the DS_CONTROL style.
///
DS_SYSMODAL = 0x00000002,
///
/// Obsolete. The system automatically applies the three-dimensional look to dialog
/// boxes created by applications.
///
DS_3DLOOK = 0x00000004,
///
/// Causes the dialog box to use the SYSTEM_FIXED_FONT instead of the default
/// SYSTEM_FONT. This is a monospace font compatible with the System font in 16-bit
/// versions of Windows earlier than 3.0.
///
DS_FIXEDSYS = 0x00000008,
///
/// Creates the dialog box even if errors occur for example, if a child window cannot
/// be created or if the system cannot create a special data segment for an edit control.
///
DS_NOFAILCREATE = 0x00000010,
///
/// Applies to 16-bit applications only. This style directs edit controls in the
/// dialog box to allocate memory from the application's data segment. Otherwise,
/// edit controls allocate storage from a global memory object.
///
DS_LOCALEDIT = 0x00000020,
///
/// Indicates that the header of the dialog box template (either standard or extended)
/// contains additional data specifying the font to use for text in the client area
/// and controls of the dialog box. If possible, the system selects a font according
/// to the specified font data. The system passes a handle to the font to the dialog
/// box and to each control by sending them the WM_SETFONT message. For descriptions
/// of the format of this font data, see DLGTEMPLATE and DLGTEMPLATEEX.
///
/// If neither DS_SETFONT nor DS_SHELLFONT is specified, the dialog box template does
/// not include the font data.
///
DS_SETFONT = 0x00000040,
///
/// Creates a dialog box with a modal dialog-box frame that can be combined with a
/// title bar and window menu by specifying the WS_CAPTION and WS_SYSMENU styles.
///
DS_MODALFRAME = 0x00000080,
///
/// Suppresses WM_ENTERIDLE messages that the system would otherwise send to the owner
/// of the dialog box while the dialog box is displayed.
///
DS_NOIDLEMSG = 0x00000100,
///
/// Causes the system to use the SetForegroundWindow function to bring the dialog box
/// to the foreground. This style is useful for modal dialog boxes that require immediate
/// attention from the user regardless of whether the owner window is the foreground
/// window.
///
/// The system restricts which processes can set the foreground window. For more
/// information, see Foreground and Background Windows.
///
DS_SETFOREGROUND = 0x00000200,
///
/// Creates a dialog box that works well as a child window of another dialog box, much like
/// a page in a property sheet. This style allows the user to tab among the control windows
/// of a child dialog box, use its accelerator keys, and so on.
///
DS_CONTROL = 0x00000400,
///
/// Centers the dialog box in the working area of the monitor that contains the owner window.
/// If no owner window is specified, the dialog box is centered in the working area of a
/// monitor determined by the system. The working area is the area not obscured by the taskbar
/// or any appbars.
///
DS_CENTER = 0x00000800,
///
/// Centers the dialog box on the mouse cursor.
///
DS_CENTERMOUSE = 0x00001000,
///
/// Includes a question mark in the title bar of the dialog box. When the user clicks the
/// question mark, the cursor changes to a question mark with a pointer. If the user then clicks
/// a control in the dialog box, the control receives a WM_HELP message. The control should pass
/// the message to the dialog box procedure, which should call the function using the
/// HELP_WM_HELP command. The help application displays a pop-up window that typically contains
/// help for the control.
///
/// Note that DS_CONTEXTHELP is only a placeholder. When the dialog box is created, the system
/// checks for DS_CONTEXTHELP and, if it is there, adds WS_EX_CONTEXTHELP to the extended style
/// of the dialog box. WS_EX_CONTEXTHELP cannot be used with the WS_MAXIMIZEBOX or WS_MINIMIZEBOX
/// styles.
///
DS_CONTEXTHELP = 0x00002000,
///
/// Windows CE Version 5.0 and later
///
DS_USEPIXELS = 0x00008000,
///
/// Indicates that the dialog box should use the system font. The typeface member of the extended
/// dialog box template must be set to MS Shell Dlg. Otherwise, this style has no effect. It is
/// also recommended that you use the DIALOGEX Resource, rather than the DIALOG Resource. For
/// more information, see Dialog Box Fonts.
///
/// The system selects a font using the font data specified in the pointsize, weight, and italic
/// members. The system passes a handle to the font to the dialog box and to each control by
/// sending them the WM_SETFONT message. For descriptions of the format of this font data, see
/// DLGTEMPLATEEX.
///
/// If neither DS_SHELLFONT nor DS_SETFONT is specified, the extended dialog box template does
/// not include the font data.
///
DS_SHELLFONT = DS_SETFONT | DS_FIXEDSYS,
#endregion
}
public enum WindowsCertificateRevision : ushort
{
///
/// Version 1, legacy version of the Win_Certificate structure. It is supported
/// only for purposes of verifying legacy Authenticode signatures
///
WIN_CERT_REVISION_1_0 = 0x0100,
///
/// Version 2 is the current version of the Win_Certificate structure.
///
WIN_CERT_REVISION_2_0 = 0x0200,
}
public enum WindowsCertificateType : ushort
{
///
/// bCertificate contains an X.509 Certificate
///
///
/// Not Supported
///
WIN_CERT_TYPE_X509 = 0x0001,
///
/// bCertificate contains a PKCS#7 SignedData structure
///
WIN_CERT_TYPE_PKCS_SIGNED_DATA = 0x0002,
///
/// Reserved
///
WIN_CERT_TYPE_RESERVED_1 = 0x0003,
///
/// Terminal Server Protocol Stack Certificate signing
///
///
/// Not Supported
///
WIN_CERT_TYPE_TS_STACK_SIGNED = 0x0004,
}
public enum WindowsSubsystem : ushort
{
///
/// An unknown subsystem
///
IMAGE_SUBSYSTEM_UNKNOWN = 0x0000,
///
/// Device drivers and native Windows processes
///
IMAGE_SUBSYSTEM_NATIVE = 0x0001,
///
/// The Windows graphical user interface (GUI) subsystem
///
IMAGE_SUBSYSTEM_WINDOWS_GUI = 0x0002,
///
/// The Windows character subsystem
///
IMAGE_SUBSYSTEM_WINDOWS_CUI = 0x0003,
///
/// The OS/2 character subsystem
///
IMAGE_SUBSYSTEM_OS2_CUI = 0x0005,
///
/// The Posix character subsystem
///
IMAGE_SUBSYSTEM_POSIX_CUI = 0x0007,
///
/// Native Win9x driver
///
IMAGE_SUBSYSTEM_NATIVE_WINDOWS = 0x0008,
///
/// Windows CE
///
IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 0x0009,
///
/// An Extensible Firmware Interface (EFI) application
///
IMAGE_SUBSYSTEM_EFI_APPLICATION = 0x000A,
///
/// An EFI driver with boot services
///
IMAGE_SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER = 0x000B,
///
/// An EFI driver with run-time services
///
IMAGE_SUBSYSTEM_EFI_RUNTIME_DRIVER = 0x000C,
///
/// An EFI ROM image
///
IMAGE_SUBSYSTEM_EFI_ROM = 0x000D,
///
/// XBOX
///
IMAGE_SUBSYSTEM_XBOX = 0x000E,
///
/// Windows boot application.
///
IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION = 0x0010,
}
}