Win32 API 日本語リファレンス
ホーム › System.Diagnostics.Debug › IMAGE_FILE_HEADER

IMAGE_FILE_HEADER

構造体
📘 Microsoft Learn (日本語) · English
サイズx64: 20 バイト / x86: 20 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド型サイズx64x86説明
MachineIMAGE_FILE_MACHINE2+0+0対象マシンアーキテクチャを示すIMAGE_FILE_MACHINE値。
NumberOfSectionsWORD2+2+2セクション数。
TimeDateStampDWORD4+4+4ファイル作成日時(UNIXエポック秒)。
PointerToSymbolTableDWORD4+8+8COFFシンボルテーブルへのファイルオフセット。0は無し。
NumberOfSymbolsDWORD4+12+12シンボルテーブル内のエントリ数。
SizeOfOptionalHeaderWORD2+16+16オプションヘッダのバイトサイズ。
CharacteristicsIMAGE_FILE_CHARACTERISTICS2+18+18イメージ特性を示すIMAGE_FILE_CHARACTERISTICSフラグ。

各言語での定義

#include <windows.h>

// IMAGE_FILE_HEADER  (x64 20 / x86 20 バイト)
typedef struct IMAGE_FILE_HEADER {
    IMAGE_FILE_MACHINE Machine;
    WORD NumberOfSections;
    DWORD TimeDateStamp;
    DWORD PointerToSymbolTable;
    DWORD NumberOfSymbols;
    WORD SizeOfOptionalHeader;
    IMAGE_FILE_CHARACTERISTICS Characteristics;
} IMAGE_FILE_HEADER;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct IMAGE_FILE_HEADER
{
    public ushort Machine;
    public ushort NumberOfSections;
    public uint TimeDateStamp;
    public uint PointerToSymbolTable;
    public uint NumberOfSymbols;
    public ushort SizeOfOptionalHeader;
    public ushort Characteristics;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure IMAGE_FILE_HEADER
    Public Machine As UShort
    Public NumberOfSections As UShort
    Public TimeDateStamp As UInteger
    Public PointerToSymbolTable As UInteger
    Public NumberOfSymbols As UInteger
    Public SizeOfOptionalHeader As UShort
    Public Characteristics As UShort
End Structure
import ctypes
from ctypes import wintypes

class IMAGE_FILE_HEADER(ctypes.Structure):
    _fields_ = [
        ("Machine", ctypes.c_ushort),
        ("NumberOfSections", ctypes.c_ushort),
        ("TimeDateStamp", wintypes.DWORD),
        ("PointerToSymbolTable", wintypes.DWORD),
        ("NumberOfSymbols", wintypes.DWORD),
        ("SizeOfOptionalHeader", ctypes.c_ushort),
        ("Characteristics", ctypes.c_ushort),
    ]
#[repr(C)]
pub struct IMAGE_FILE_HEADER {
    pub Machine: u16,
    pub NumberOfSections: u16,
    pub TimeDateStamp: u32,
    pub PointerToSymbolTable: u32,
    pub NumberOfSymbols: u32,
    pub SizeOfOptionalHeader: u16,
    pub Characteristics: u16,
}
import "golang.org/x/sys/windows"

type IMAGE_FILE_HEADER struct {
	Machine uint16
	NumberOfSections uint16
	TimeDateStamp uint32
	PointerToSymbolTable uint32
	NumberOfSymbols uint32
	SizeOfOptionalHeader uint16
	Characteristics uint16
}
type
  IMAGE_FILE_HEADER = record
    Machine: Word;
    NumberOfSections: Word;
    TimeDateStamp: DWORD;
    PointerToSymbolTable: DWORD;
    NumberOfSymbols: DWORD;
    SizeOfOptionalHeader: Word;
    Characteristics: Word;
  end;
const IMAGE_FILE_HEADER = extern struct {
    Machine: u16,
    NumberOfSections: u16,
    TimeDateStamp: u32,
    PointerToSymbolTable: u32,
    NumberOfSymbols: u32,
    SizeOfOptionalHeader: u16,
    Characteristics: u16,
};
type
  IMAGE_FILE_HEADER {.bycopy.} = object
    Machine: uint16
    NumberOfSections: uint16
    TimeDateStamp: uint32
    PointerToSymbolTable: uint32
    NumberOfSymbols: uint32
    SizeOfOptionalHeader: uint16
    Characteristics: uint16
struct IMAGE_FILE_HEADER
{
    ushort Machine;
    ushort NumberOfSections;
    uint TimeDateStamp;
    uint PointerToSymbolTable;
    uint NumberOfSymbols;
    ushort SizeOfOptionalHeader;
    ushort Characteristics;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; IMAGE_FILE_HEADER サイズ: 20 バイト(x64)
dim st, 5    ; 4byte整数×5(構造体サイズ 20 / 4 切り上げ)
; Machine : IMAGE_FILE_MACHINE (+0, 2byte)  wpoke st,0,値  /  値 = wpeek(st,0)
; NumberOfSections : WORD (+2, 2byte)  wpoke st,2,値  /  値 = wpeek(st,2)
; TimeDateStamp : DWORD (+4, 4byte)  st.1 = 値  /  値 = st.1   (lpoke/lpeek も可)
; PointerToSymbolTable : DWORD (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; NumberOfSymbols : DWORD (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; SizeOfOptionalHeader : WORD (+16, 2byte)  wpoke st,16,値  /  値 = wpeek(st,16)
; Characteristics : IMAGE_FILE_CHARACTERISTICS (+18, 2byte)  wpoke st,18,値  /  値 = wpeek(st,18)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
#defstruct global IMAGE_FILE_HEADER
    #field short Machine
    #field short NumberOfSections
    #field int TimeDateStamp
    #field int PointerToSymbolTable
    #field int NumberOfSymbols
    #field short SizeOfOptionalHeader
    #field short Characteristics
#endstruct

stdim st, IMAGE_FILE_HEADER        ; NSTRUCT 変数を確保
st->Machine = 100
mes "Machine=" + st->Machine