// 1. IMAGE_DOS_HEADER — DOS MZ magic + e_lfanew offset. // 2. IMAGE_FILE_HEADER — section count, machine type, timestamps. // 3. IMAGE_DATA_DIRECTORY — export/import/etc directory RVAs. // 4. IMAGE_OPTIONAL_HEADER64 — SizeOfImage@56 (not 36 — that bit us for hours). // 5. IMAGE_SECTION_HEADER — .text, .data, .rdata layout per section. // 6. IMAGE_EXPORT_DIRECTORY — name/function/ordinal tables for PE export parsing. // 7. IMAGE_NT_HEADERS64 — signature + file_header + optional_header (the NT header triad). pub const IMAGE_DOS_HEADER = extern struct { e_magic: u16, e_cblp: u16, e_cp: u16, e_crlc: u16, e_cparhdr: u16, e_minalloc: u16, e_maxalloc: u16, e_ss: u16, e_sp: u16, e_csum: u16, e_ip: u16, e_cs: u16, e_lfarlc: u16, e_ovno: u16, e_res: [4]u16, e_oemid: u16, e_oeminfo: u16, e_res2: [10]u16, e_lfanew: i32, }; pub const IMAGE_FILE_HEADER = extern struct { Machine: u16, NumberOfSections: u16, TimeDateStamp: u32, PointerToSymbolTable: u32, NumberOfSymbols: u32, SizeOfOptionalHeader: u16, Characteristics: u16, }; pub const IMAGE_DATA_DIRECTORY = extern struct { VirtualAddress: u32, Size: u32, }; pub const IMAGE_OPTIONAL_HEADER64 = extern struct { Magic: u16, MajorLinkerVersion: u8, MinorLinkerVersion: u8, SizeOfCode: u32, SizeOfInitializedData: u32, SizeOfUninitializedData: u32, AddressOfEntryPoint: u32, BaseOfCode: u32, ImageBase: u64, SectionAlignment: u32, FileAlignment: u32, MajorOperatingSystemVersion: u16, MinorOperatingSystemVersion: u16, MajorImageVersion: u16, MinorImageVersion: u16, MajorSubsystemVersion: u16, MinorSubsystemVersion: u16, Win32VersionValue: u32, SizeOfImage: u32, SizeOfHeaders: u32, CheckSum: u32, Subsystem: u16, DllCharacteristics: u16, SizeOfStackReserve: u64, SizeOfStackCommit: u64, SizeOfHeapReserve: u64, SizeOfHeapCommit: u64, LoaderFlags: u32, NumberOfRvaAndSizes: u32, DataDirectory: [16]IMAGE_DATA_DIRECTORY, }; pub const IMAGE_SECTION_HEADER = extern struct { Name: [8]u8, VirtualSize: u32, VirtualAddress: u32, SizeOfRawData: u32, PointerToRawData: u32, PointerToRelocations: u32, PointerToLinenumbers: u32, NumberOfRelocations: u16, NumberOfLinenumbers: u16, Characteristics: u32, }; pub const IMAGE_EXPORT_DIRECTORY = extern struct { Characteristics: u32, TimeDateStamp: u32, MajorVersion: u16, MinorVersion: u16, Name: u32, Base: u32, NumberOfFunctions: u32, NumberOfNames: u32, AddressOfFunctions: u32, AddressOfNames: u32, AddressOfNameOrdinals: u32, }; pub const IMAGE_NT_HEADERS64 = extern struct { Signature: u32, FileHeader: IMAGE_FILE_HEADER, OptionalHeader: IMAGE_OPTIONAL_HEADER64, };