Windows

PE header관련 구조체

dool2ly 2015. 10. 17. 22:30

@IMAGE_THUNK DATA

typedef struct _IMAGE_THUNK_DATA32 {

    union {

        DWORD ForwarderString;      // PBYTE 

        DWORD Function;             // 함수주소

        DWORD Ordinal;

        DWORD AddressOfData;        // PIMAGE_IMPORT_BY_NAME

    } u1;

} IMAGE_THUNK_DATA32;

typedef IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32;

typedef PIMAGE_THUNK_DATA32             PIMAGE_THUNK_DATA;



@IMAGE_IMPORT_DESCRIPTOR

typedef struct _IMAGE_IMPORT_DESCRIPTOR {

    union {

        DWORD   Characteristics;            

        DWORD   OriginalFirstThunk;       // INT(Import Name Table) address (RVA)

    };

    DWORD   TimeDateStamp;

    DWORD   ForwarderChain; 

    DWORD   Name;                         // library name string address (RVA)

    DWORD   FirstThunk;                   // IAT(Import Address Table) address (RVA)

} IMAGE_IMPORT_DESCRIPTOR;