Documentation
¶
Index ¶
- Constants
- type API_SET_NAMESPACE
- type CURDIR
- type IMAGE_DATA_DIRECTORY
- type IMAGE_DOS_HEADER
- type IMAGE_EXPORT_DIRECTORY
- type IMAGE_FILE_HEADER
- type IMAGE_NT_HEADERS
- type IMAGE_OPTIONAL_HEADER
- type LDRP_CSLIST
- type LDR_DATA_TABLE_ENTRY
- type LDR_DDAG_NODE
- type LDR_SERVICE_TAG_RECORD
- type LIST_ENTRY
- type PEB
- type PEB_LDR_DATA
- type RTL_BALANCED_NODE
- type RTL_DRIVER_LETTER_CURDIR
- type RTL_USER_PROCESS_PARAMETERS
- type SINGLE_LIST_ENTRY
Constants ¶
View Source
const ( IMAGE_DIRECTORY_ENTRY_EXPORT = 0 IMAGE_DIRECTORY_ENTRY_IMPORT = 1 IMAGE_DIRECTORY_ENTRY_EXCEPTION = 3 IMAGE_DIRECTORY_ENTRY_BASERELOC = 5 IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT = 13 IMAGE_DIRECTORY_ENTRY_TLS = 9 )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type API_SET_NAMESPACE ¶
type IMAGE_DATA_DIRECTORY ¶
type IMAGE_DOS_HEADER ¶
type IMAGE_DOS_HEADER struct {
E_magic uint16
E_cblp uint16
E_cp uint16
E_crlc uint16
E_cparhdr uint16
E_minalloc uint16
E_maxalloc uint16
E_ss uint16
E_sp uint16
E_csum uint16
E_ip uint16
E_cs uint16
E_lfarlc uint16
E_ovno uint16
E_res [4]uint16
E_oemid uint16
E_oeminfo uint16
E_res2 [10]uint16
E_lfanew uint32
}
type IMAGE_EXPORT_DIRECTORY ¶
type IMAGE_FILE_HEADER ¶
type IMAGE_NT_HEADERS ¶
type IMAGE_NT_HEADERS struct {
Signature uint32
FileHeader IMAGE_FILE_HEADER
OptionalHeader IMAGE_OPTIONAL_HEADER
}
type IMAGE_OPTIONAL_HEADER ¶
type IMAGE_OPTIONAL_HEADER struct {
Magic uint16
MajorLinkerVersion uint8
MinorLinkerVersion uint8
SizeOfCode uint32
SizeOfInitializedData uint32
SizeOfUninitializedData uint32
AddressOfEntryPoint uint32
BaseOfCode uint32
ImageBase uintptr
SectionAlignment uint32
FileAlignment uint32
MajorOperatingSystemVersion uint16
MinorOperatingSystemVersion uint16
MajorImageVersion uint16
MinorImageVersion uint16
MajorSubsystemVersion uint16
MinorSubsystemVersion uint16
Win32VersionValue uint32
SizeOfImage uint32
SizeOfHeaders uint32
CheckSum uint32
Subsystem uint16
DllCharacteristics uint16
SizeOfStackReserve uint64
SizeOfStackCommit uint64
SizeOfHeapReserve uint64
SizeOfHeapCommit uint64
LoaderFlags uint32
NumberOfRvaAndSizes uint32
DataDirectory [16]IMAGE_DATA_DIRECTORY
}
type LDRP_CSLIST ¶
type LDRP_CSLIST struct {
Tail *SINGLE_LIST_ENTRY
}
type LDR_DATA_TABLE_ENTRY ¶
type LDR_DATA_TABLE_ENTRY struct {
InLoadOrderLinks LIST_ENTRY
InMemoryOrderLinks LIST_ENTRY
InInitializationOrderLinks LIST_ENTRY
/* Union1:
union
{
LIST_ENTRY InInitializationOrderLinks;
LIST_ENTRY InProgressLinks;
};
*/
DllBase uintptr
EntryPoint uintptr
SizeOfImage uint32
FullDllName windows.NTUnicodeString
BaseDllName windows.NTUnicodeString
Flags uint32
/* Flags:
union
{
UCHAR FlagGroup[4];
ULONG Flags;
struct
{
ULONG PackagedBinary : 1;
ULONG MarkedForRemoval : 1;
ULONG ImageDll : 1;
ULONG LoadNotificationsSent : 1;
ULONG TelemetryEntryProcessed : 1;
ULONG ProcessStaticImport : 1;
ULONG InLegacyLists : 1;
ULONG InIndexes : 1;
ULONG ShimDll : 1;
ULONG InExceptionTable : 1;
ULONG ReservedFlags1 : 2;
ULONG LoadInProgress : 1;
ULONG LoadConfigProcessed : 1;
ULONG EntryProcessed : 1;
ULONG ProtectDelayLoad : 1;
ULONG ReservedFlags3 : 2;
ULONG DontCallForThreads : 1;
ULONG ProcessAttachCalled : 1;
ULONG ProcessAttachFailed : 1;
ULONG CorDeferredValidate : 1;
ULONG CorImage : 1;
ULONG DontRelocate : 1;
ULONG CorILOnly : 1;
ULONG ChpeImage : 1;
ULONG ReservedFlags5 : 2;
ULONG Redirected : 1;
ULONG ReservedFlags6 : 2;
ULONG CompatDatabaseProcessed : 1;
};
};
*/
ObsoleteLoadCount uint16
TlsIndex uint16
HashLinks LIST_ENTRY
TimeDateStamp uint32
EntryPointActivationContext uintptr // *ACTIVATION_CONTEXT
Lock uintptr
DdagNode *LDR_DDAG_NODE
NodeModuleLink LIST_ENTRY
LoadContext uintptr // _LDRP_LOAD_CONTEXT *
ParentDllBase uintptr
SwitchBackContext uintptr
BaseAddressIndexNode RTL_BALANCED_NODE
MappingInfoIndexNode RTL_BALANCED_NODE
OriginalBase uintptr
LoadTime int64
BaseNameHashValue uint32
LoadReason uint32
ImplicitPathOptions uint32
ReferenceCount uint32
DependentLoadFlags uint32
SigningLevel byte
}
type LDR_DDAG_NODE ¶
type LDR_DDAG_NODE struct {
Modules LIST_ENTRY
ServiceTagList *LDR_SERVICE_TAG_RECORD
LoadCount uint32
LoadWhileUnloadingCount uint32
LowestLink uint32
RemovalLink SINGLE_LIST_ENTRY
/* Union1:
union {
LDRP_CSLIST Dependencies;
SINGLE_LIST_ENTRY RemovalLink;
};
*/
IncomingDependencies LDRP_CSLIST
State int
CondenseLink LIST_ENTRY
PreorderNumber uint32
}
type LDR_SERVICE_TAG_RECORD ¶
type LDR_SERVICE_TAG_RECORD struct {
Next *LDR_SERVICE_TAG_RECORD
ServiceTag uint32
}
type LIST_ENTRY ¶
type LIST_ENTRY struct {
Flink *LIST_ENTRY
Blink *LIST_ENTRY
}
type PEB ¶
type PEB struct {
InheritedAddressSpace byte
ReadImageFileExecOptions byte
BeingDebugged byte
BitField byte
/* BitField:
union
{
BOOLEAN BitField;
struct
{
BOOLEAN ImageUsesLargePages : 1;
BOOLEAN IsProtectedProcess : 1;
BOOLEAN IsImageDynamicallyRelocated : 1;
BOOLEAN SkipPatchingUser32Forwarders : 1;
BOOLEAN IsPackagedProcess : 1;
BOOLEAN IsAppContainer : 1;
BOOLEAN IsProtectedProcessLight : 1;
BOOLEAN IsLongPathAwareProcess : 1;
};
};
*/
Mutant uintptr
ImageBaseAddress uintptr
Ldr *PEB_LDR_DATA
ProcessParameters *RTL_USER_PROCESS_PARAMETERS
SubSystemData uintptr
ProcessHeap uintptr
FastPebLock uintptr // RTL_CRITICAL_SECTION*
AtlThunkSListPtr uintptr // SLIST_HEADER*
IFEOKey uintptr
CrossProcessFlags uint32
/* CrossProcessFlags:
union
{
ULONG CrossProcessFlags;
struct
{
ULONG ProcessInJob : 1;
ULONG ProcessInitializing : 1;
ULONG ProcessUsingVEH : 1;
ULONG ProcessUsingVCH : 1;
ULONG ProcessUsingFTH : 1;
ULONG ProcessPreviouslyThrottled : 1;
ULONG ProcessCurrentlyThrottled : 1;
ULONG ProcessImagesHotPatched : 1; // REDSTONE5
ULONG ReservedBits0 : 24;
};
};
*/
Data uintptr
/* Data:
union
{
PVOID KernelCallbackTable;
PVOID UserSharedInfoPtr;
};
*/
SystemReserved uint32
AtlThunkSListPtr32 uint32
ApiSetMap *API_SET_NAMESPACE // API_SET_NAMESPACE*
TlsExpansionCounter uint32
TlsBitmap uintptr // PRTL_BITMAP
TlsBitmapBits [2]uint32
ReadOnlyStaticServerData uintptr
AnsiCodePageData uintptr // CPTABLEINFO*
OemCodePageData uintptr // CPTABLEINFO*
UnicodeCaseTable uintptr // NLSTABLEINFO*
NumberOfProcessors uint32
NtGlobalFlag uint32
CriticalSectionTimeout uint64
HeapSegmentReserve uint64
HeapSegmentCommit uint64
HeapDeCommitTotalFreeThreshold uint64
HeapDeCommitFreeBlockThreshold uint64
NumberOfHeaps uint32
MaximumNumberOfHeaps uint32
ProcessHeaps uintptr // HEAP**
ProcessStarterHelper uintptr
GdiDCAttributeList uint32
LoaderLock uintptr // RTL_CRITICAL_SECTION*
OSMajorVersion uint32
OSMinorVersion uint32
OSBuildNumber uint16
OSCSDVersion uint16
OSPlatformId uint32
ImageSubsystem uint32
ImageSubsystemMajorVersion uint32
ImageSubsystemMinorVersion uint32
ActiveProcessAffinityMask uint64
GdiHandleBuffer [60]uint32
PostProcessInitRoutine uintptr
TlsExpansionBitmap uintptr
TlsExpansionBitmapBits [32]uint32
SessionId uint32
AppCompatFlags uint64
AppCompatFlagsUser uint64
ShimData uintptr
AppCompatInfo uintptr // APPCOMPAT_EXE_DATA
CSDVersion windows.NTUnicodeString
ActivationContextData uintptr // ACTIVATION_CONTEXT_DATA
ProcessAssemblyStorageMap uintptr // ASSEMBLY_STORAGE_MAP
SystemDefaultActivationContext uintptr // ACTIVATION_CONTEXT_DATA
SystemAssemblyStorageMap uintptr // ASSEMBLY_STORAGE_MAP
MinimumStackCommit uint64
SparePointers [4]uintptr // 19H1 (previously FlsCallback to FlsHighIndex)
SpareUlongs [5]uint32 // 19H1
/*
PVOID* FlsCallback;
LIST_ENTRY FlsListHead;
PVOID FlsBitmap;
ULONG FlsBitmapBits[FLS_MAXIMUM_AVAILABLE / (sizeof(ULONG) * 8)];
ULONG FlsHighIndex;
*/
WerRegistrationData uintptr
WerShipAssertPtr uintptr
Unused uintptr
ImageHeaderHash uintptr
TracingFlags uint32
/* TracingFlags:
union
{
ULONG TracingFlags;
struct
{
ULONG HeapTracingEnabled : 1;
ULONG CritSecTracingEnabled : 1;
ULONG LibLoaderTracingEnabled : 1;
ULONG SpareTracingBits : 29;
};
};
*/
TppWorkerpListLock uintptr // RTL_CRITICAL_SECTION*
TppWorkerpList *LIST_ENTRY
WaitOnAddressHashTable [128]uintptr
TelemetryCoverageHeader uintptr // REDSTONE3
CloudFileFlags uint32
CloudFileDiagInfo uint32 // REDSTONE4
PlaceholderCompatibilityMode uint8
PlaceholderCompatibilityModeReserved [7]uint8
LeapSecondData uintptr // REDSTONE5
LeapSecondFlags uint32
/* LeapSecondFlags:
union
{
ULONG LeapSecondFlags;
struct
{
ULONG SixtySecondEnabled : 1;
ULONG Reserved : 31;
};
};
*/
NtGlobalFlag2 uint32
}
type PEB_LDR_DATA ¶
type PEB_LDR_DATA struct {
Length uint32
Initialized uint8
SsHandle uintptr
InLoadOrderModuleList LIST_ENTRY
InMemoryOrderModuleList LIST_ENTRY
InInitializationOrderModuleList LIST_ENTRY
EntryInProgress uintptr
ShutdownInProgress uint8
ShutdownThreadId uintptr
}
type RTL_BALANCED_NODE ¶
type RTL_BALANCED_NODE struct {
Left *RTL_BALANCED_NODE
Right *RTL_BALANCED_NODE
/* Children:
union
{
struct _RTL_BALANCED_NODE* Children[2]; //0x0
struct
{
struct _RTL_BALANCED_NODE* Left; //0x0
struct _RTL_BALANCED_NODE* Right; //0x8
};
}
*/
Data uintptr
}
type RTL_USER_PROCESS_PARAMETERS ¶
type RTL_USER_PROCESS_PARAMETERS struct {
MaximumLength uint32
Length uint32
Flags uint32
DebugFlags uint32
ConsoleHandle windows.Handle
ConsoleFlags uint32
StandardInput windows.Handle
StandardOutput windows.Handle
StandardError windows.Handle
CurrentDirectory CURDIR
DllPath windows.NTUnicodeString
ImagePathName windows.NTUnicodeString
CommandLine windows.NTUnicodeString
Environment uintptr
StartingX uint32
StartingY uint32
CountX uint32
CountY uint32
CountCharsX uint32
CountCharsY uint32
FillAttribute uint32
WindowFlags uint32
ShowWindowFlags uint32
WindowTitle windows.NTUnicodeString
DesktopInfo windows.NTUnicodeString
ShellInfo windows.NTUnicodeString
RuntimeData windows.NTUnicodeString
CurrentDirectories [32]RTL_DRIVER_LETTER_CURDIR
EnvironmentSize uintptr
EnvironmentVersion uintptr
PackageDependencyData uintptr
ProcessGroUpId uint32
LoaderThreads uint32
RedirectionDllName windows.NTUnicodeString
HeapPartitionName windows.NTUnicodeString
DefaultThreadpoolCpuSetMasks uintptr
DefaultThreadpoolCpuSetMaskCount uint32
}
type SINGLE_LIST_ENTRY ¶
type SINGLE_LIST_ENTRY struct {
Next *SINGLE_LIST_ENTRY
}
Click to show internal directories.
Click to hide internal directories.