1
typedef struct _IMAGE_DOS_HEADER {      // DOS .EXE header
2
    WORD   e_magic;                     // Magic number
3
    WORD   e_cblp;                      // Bytes on last page of file
4
    WORD   e_cp;                        // Pages in file
5
    WORD   e_crlc;                      // Relocations
6
    WORD   e_cparhdr;                   // Size of header in paragraphs
7
    WORD   e_minalloc;                  // Minimum extra paragraphs needed
8
    WORD   e_maxalloc;                  // Maximum extra paragraphs needed
9
    WORD   e_ss;                        // Initial (relative) SS value
10
    WORD   e_sp;                        // Initial SP value
11
    WORD   e_csum;                      // Checksum
12
    WORD   e_ip;                        // Initial IP value
13
    WORD   e_cs;                        // Initial (relative) CS value
14
    WORD   e_lfarlc;                    // File address of relocation table
15
    WORD   e_ovno;                      // Overlay number
16
    WORD   e_res[4];                    // Reserved words
17
    WORD   e_oemid;                     // OEM identifier (for e_oeminfo)
18
    WORD   e_oeminfo;                   // OEM information; e_oemid specific
19
    WORD   e_res2[10];                  // Reserved words
20
    LONG   e_lfanew;                    // File address of new exe header
21
  } IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;

1
typedef struct _IMAGE_NT_HEADERS64 {
2
    DWORD Signature;
3
    IMAGE_FILE_HEADER FileHeader;
4
    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
5
} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;

1
typedef struct _IMAGE_FILE_HEADER {
2
    WORD    Machine;
3
    WORD    NumberOfSections;
4
    DWORD   TimeDateStamp;
5
    DWORD   PointerToSymbolTable;
6
    DWORD   NumberOfSymbols;
7
    WORD    SizeOfOptionalHeader;
8
    WORD    Characteristics;
9
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;

1
typedef struct _IMAGE_OPTIONAL_HEADER64 {
2
    WORD        Magic;
3
    BYTE        MajorLinkerVersion;
4
    BYTE        MinorLinkerVersion;
5
    DWORD       SizeOfCode;
6
    DWORD       SizeOfInitializedData;
7
    DWORD       SizeOfUninitializedData;
8
    DWORD       AddressOfEntryPoint;
9
    DWORD       BaseOfCode;
10
    ULONGLONG   ImageBase;
11
    DWORD       SectionAlignment;
12
    DWORD       FileAlignment;
13
    WORD        MajorOperatingSystemVersion;
14
    WORD        MinorOperatingSystemVersion;
15
    WORD        MajorImageVersion;
16
    WORD        MinorImageVersion;
17
    WORD        MajorSubsystemVersion;
18
    WORD        MinorSubsystemVersion;
19
    DWORD       Win32VersionValue;
20
    DWORD       SizeOfImage;
21
    DWORD       SizeOfHeaders;
22
    DWORD       CheckSum;
23
    WORD        Subsystem;
24
    WORD        DllCharacteristics;
25
    ULONGLONG   SizeOfStackReserve;
26
    ULONGLONG   SizeOfStackCommit;
27
    ULONGLONG   SizeOfHeapReserve;
28
    ULONGLONG   SizeOfHeapCommit;
29
    DWORD       LoaderFlags;
30
    DWORD       NumberOfRvaAndSizes;
31
    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
32
} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;

1
#define IMAGE_SIZEOF_SHORT_NAME              8
2

3
typedef struct _IMAGE_SECTION_HEADER {
4
    BYTE    Name[IMAGE_SIZEOF_SHORT_NAME];
5
    union {
6
            DWORD   PhysicalAddress;
7
            DWORD   VirtualSize;
8
    } Misc;
9
    DWORD   VirtualAddress;
10
    DWORD   SizeOfRawData;
11
    DWORD   PointerToRawData;
12
    DWORD   PointerToRelocations;
13
    DWORD   PointerToLinenumbers;
14
    WORD    NumberOfRelocations;
15
    WORD    NumberOfLinenumbers;
16
    DWORD   Characteristics;
17
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;