/* * Process Hacker * * Descriptions from the PE/COFF specification v8 from Microsoft. */ using System; using System.Collections.Generic; using System.Text; namespace ProcessHacker.PE { /// /// The type of image data. /// public enum ImageDataType { /// /// The export table. /// ExportTable = 0, /// /// The import table. /// ImportTable, /// /// The resource table. /// ResourceTable, /// /// The exception table. /// ExceptionTable, /// /// The attribute certificate table. /// CertificateTable, /// /// The base relocation table. /// BaseRelocationTable, /// /// The debug data. /// Debug, /// /// Reserved, must be zero. /// Architecture, /// /// The RVA of the value to be stored in the global pointer register. /// GlobalPtr, /// /// The thread local storage (TLS) table. /// TLSTable, /// /// The load configuration table. /// LoadConfigTable, /// /// The bound import table. /// BoundImport, /// /// The import address table. /// IAT, /// /// The delay import descriptor. /// DelayImportDescriptor, /// /// The CLR runtime header. /// CLRRuntimeHeader, /// /// Reserved, must be zero. /// Reserved } /// /// Represents a data directory containing the address and size of a table /// or string in the image. /// public struct ImageData { /// /// The relative virtual address (RVA) of the table. /// public uint VirtualAddress; /// /// The size, in bytes, of the table. /// public uint Size; } }