-
Notifications
You must be signed in to change notification settings - Fork 5
/
types.go
172 lines (157 loc) · 3.88 KB
/
types.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
package main
import "debug/pe"
type IMAGE_REL_BASED uint16
type baseRelocEntry uint16
//IMAGE_DOS_HEADER type
type IMAGE_DOS_HEADER struct {
E_magic uint16
E_cblp uint16
E_cp uint16
E_crlc uint16
E_cparhdr uint16
E_minalloc uint16
E_maxalloc uint16
E_ss uint16
E_sp uint16
E_csum uint16
E_ip uint16
E_cs uint16
E_lfarlc uint16
E_ovno uint16
E_res [4]uint16
E_oemid uint16
E_oeminfo uint16
E_res2 [10]uint16
E_lfanew int32
}
//IMAGE_NT_HEADERS32 type
type IMAGE_NT_HEADERS struct {
Signature uint32
FileHeader pe.FileHeader
OptionalHeader pe.OptionalHeader32
}
//IMAGE_NT_HEADERS64 type
type IMAGE_NT_HEADERS64 struct {
Signature uint32
FileHeader pe.FileHeader
OptionalHeader pe.OptionalHeader64
}
//IMAGE_BASE_RELOCATION type
type IMAGE_BASE_RELOCATION struct {
VirtualAddress uint32
SizeOfBlock uint32
}
//BASE_RELOCATION_ENTRY bit fields Offset uint16 :12 Type uint16 :4
type BASE_RELOCATION_ENTRY uint16
//GetOffset func
func (r *BASE_RELOCATION_ENTRY) GetOffset() (_offset uint16) {
_offset = uint16(*r) & 0x0fff
return
}
//SetOffset func
func (r *BASE_RELOCATION_ENTRY) SetOffset(_offset uint16) {
*r = *r | BASE_RELOCATION_ENTRY(_offset&0x0fff)
}
//SetType func
func (r *BASE_RELOCATION_ENTRY) SetType(_type uint16) {
*r = *r | BASE_RELOCATION_ENTRY(_type&0xf000)
}
//GetType func
func (r *BASE_RELOCATION_ENTRY) GetType() (_type uint16) {
_type = (uint16(*r) & 0xf000) >> 12
return
}
//m128a struct
type m128a struct {
low uint64
high int64
}
//WOW64_FLOATING_SAVE_AREA struct
type WOW64_FLOATING_SAVE_AREA struct {
ControlWord uint32
StatusWord uint32
TagWord uint32
ErrorOffset uint32
ErrorSelector uint32
DataOffset uint32
DataSelector uint32
RegisterArea [80]byte
Cr0NpxState uint32
}
//WOW64_CONTEXT struct
type WOW64_CONTEXT struct {
ContextFlags uint32
Dr0 uint32
Dr1 uint32
Dr2 uint32
Dr3 uint32
Dr6 uint32
Dr7 uint32
FloatSave WOW64_FLOATING_SAVE_AREA
SegGs uint32
SegFs uint32
SegEs uint32
SegDs uint32
Edi uint32
Esi uint32
Ebx uint32
Edx uint32
Ecx uint32
Eax uint32
Ebp uint32
Eip uint32
SegCs uint32
EFlags uint32
Esp uint32
SegSs uint32
ExtendedRegisters [512]byte
}
//CONTEXT truct
type CONTEXT struct {
p1home uint64
p2home uint64
p3home uint64
p4home uint64
p5home uint64
p6home uint64
contextflags uint32
mxcsr uint32
segcs uint16
segds uint16
seges uint16
segfs uint16
seggs uint16
segss uint16
eflags uint32
dr0 uint64
dr1 uint64
dr2 uint64
dr3 uint64
dr6 uint64
dr7 uint64
rax uint64
rcx uint64
rdx uint64
rbx uint64
rsp uint64
rbp uint64
rsi uint64
rdi uint64
r8 uint64
r9 uint64
r10 uint64
r11 uint64
r12 uint64
r13 uint64
r14 uint64
r15 uint64
rip uint64
anon0 [512]byte
vectorregister [26]m128a
vectorcontrol uint64
debugcontrol uint64
lastbranchtorip uint64
lastbranchfromrip uint64
lastexceptiontorip uint64
lastexceptionfromrip uint64
}