ホーム › System.Diagnostics.Debug › IMAGE_NT_HEADERS64

IMAGE_NT_HEADERS64

構造体

サイズx64: 264 バイト / x86: 264 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド	型	サイズ	x64	x86	説明
Signature	DWORD	4	+0	+0	PEシグネチャ("PE\0\0")。
FileHeader	IMAGE_FILE_HEADER	20	+4	+4	COFFファイルヘッダ(IMAGE_FILE_HEADER)。
OptionalHeader	IMAGE_OPTIONAL_HEADER64	240	+24	+24	64ビットオプションヘッダ(IMAGE_OPTIONAL_HEADER64)。

各言語での定義

#include <windows.h>

// IMAGE_FILE_HEADER  (x64 20 / x86 20 バイト)
typedef struct IMAGE_FILE_HEADER {
    IMAGE_FILE_MACHINE Machine;
    WORD NumberOfSections;
    DWORD TimeDateStamp;
    DWORD PointerToSymbolTable;
    DWORD NumberOfSymbols;
    WORD SizeOfOptionalHeader;
    IMAGE_FILE_CHARACTERISTICS Characteristics;
} IMAGE_FILE_HEADER;

// IMAGE_DATA_DIRECTORY  (x64 8 / x86 8 バイト)
typedef struct IMAGE_DATA_DIRECTORY {
    DWORD VirtualAddress;
    DWORD Size;
} IMAGE_DATA_DIRECTORY;

// IMAGE_OPTIONAL_HEADER64  (x64 240 / x86 240 バイト)
#pragma pack(push, 4)
typedef struct IMAGE_OPTIONAL_HEADER64 {
    IMAGE_OPTIONAL_HEADER_MAGIC Magic;
    BYTE MajorLinkerVersion;
    BYTE MinorLinkerVersion;
    DWORD SizeOfCode;
    DWORD SizeOfInitializedData;
    DWORD SizeOfUninitializedData;
    DWORD AddressOfEntryPoint;
    DWORD BaseOfCode;
    ULONGLONG ImageBase;
    DWORD SectionAlignment;
    DWORD FileAlignment;
    WORD MajorOperatingSystemVersion;
    WORD MinorOperatingSystemVersion;
    WORD MajorImageVersion;
    WORD MinorImageVersion;
    WORD MajorSubsystemVersion;
    WORD MinorSubsystemVersion;
    DWORD Win32VersionValue;
    DWORD SizeOfImage;
    DWORD SizeOfHeaders;
    DWORD CheckSum;
    IMAGE_SUBSYSTEM Subsystem;
    IMAGE_DLL_CHARACTERISTICS DllCharacteristics;
    ULONGLONG SizeOfStackReserve;
    ULONGLONG SizeOfStackCommit;
    ULONGLONG SizeOfHeapReserve;
    ULONGLONG SizeOfHeapCommit;
    DWORD LoaderFlags;
    DWORD NumberOfRvaAndSizes;
    IMAGE_DATA_DIRECTORY DataDirectory[16];
} IMAGE_OPTIONAL_HEADER64;
#pragma pack(pop)

// IMAGE_NT_HEADERS64  (x64 264 / x86 264 バイト)
typedef struct IMAGE_NT_HEADERS64 {
    DWORD Signature;
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
} IMAGE_NT_HEADERS64;

using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct IMAGE_FILE_HEADER
{
    public ushort Machine;
    public ushort NumberOfSections;
    public uint TimeDateStamp;
    public uint PointerToSymbolTable;
    public uint NumberOfSymbols;
    public ushort SizeOfOptionalHeader;
    public ushort Characteristics;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct IMAGE_DATA_DIRECTORY
{
    public uint VirtualAddress;
    public uint Size;
}

[StructLayout(LayoutKind.Sequential, Pack = 4, CharSet = CharSet.Unicode)]
public struct IMAGE_OPTIONAL_HEADER64
{
    public ushort Magic;
    public byte MajorLinkerVersion;
    public byte MinorLinkerVersion;
    public uint SizeOfCode;
    public uint SizeOfInitializedData;
    public uint SizeOfUninitializedData;
    public uint AddressOfEntryPoint;
    public uint BaseOfCode;
    public ulong ImageBase;
    public uint SectionAlignment;
    public uint FileAlignment;
    public ushort MajorOperatingSystemVersion;
    public ushort MinorOperatingSystemVersion;
    public ushort MajorImageVersion;
    public ushort MinorImageVersion;
    public ushort MajorSubsystemVersion;
    public ushort MinorSubsystemVersion;
    public uint Win32VersionValue;
    public uint SizeOfImage;
    public uint SizeOfHeaders;
    public uint CheckSum;
    public ushort Subsystem;
    public ushort DllCharacteristics;
    public ulong SizeOfStackReserve;
    public ulong SizeOfStackCommit;
    public ulong SizeOfHeapReserve;
    public ulong SizeOfHeapCommit;
    public uint LoaderFlags;
    public uint NumberOfRvaAndSizes;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] public IMAGE_DATA_DIRECTORY[] DataDirectory;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct IMAGE_NT_HEADERS64
{
    public uint Signature;
    public IMAGE_FILE_HEADER FileHeader;
    public IMAGE_OPTIONAL_HEADER64 OptionalHeader;
}

Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure IMAGE_FILE_HEADER
    Public Machine As UShort
    Public NumberOfSections As UShort
    Public TimeDateStamp As UInteger
    Public PointerToSymbolTable As UInteger
    Public NumberOfSymbols As UInteger
    Public SizeOfOptionalHeader As UShort
    Public Characteristics As UShort
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure IMAGE_DATA_DIRECTORY
    Public VirtualAddress As UInteger
    Public Size As UInteger
End Structure

<StructLayout(LayoutKind.Sequential, Pack:=4, CharSet:=CharSet.Unicode)>
Public Structure IMAGE_OPTIONAL_HEADER64
    Public Magic As UShort
    Public MajorLinkerVersion As Byte
    Public MinorLinkerVersion As Byte
    Public SizeOfCode As UInteger
    Public SizeOfInitializedData As UInteger
    Public SizeOfUninitializedData As UInteger
    Public AddressOfEntryPoint As UInteger
    Public BaseOfCode As UInteger
    Public ImageBase As ULong
    Public SectionAlignment As UInteger
    Public FileAlignment As UInteger
    Public MajorOperatingSystemVersion As UShort
    Public MinorOperatingSystemVersion As UShort
    Public MajorImageVersion As UShort
    Public MinorImageVersion As UShort
    Public MajorSubsystemVersion As UShort
    Public MinorSubsystemVersion As UShort
    Public Win32VersionValue As UInteger
    Public SizeOfImage As UInteger
    Public SizeOfHeaders As UInteger
    Public CheckSum As UInteger
    Public Subsystem As UShort
    Public DllCharacteristics As UShort
    Public SizeOfStackReserve As ULong
    Public SizeOfStackCommit As ULong
    Public SizeOfHeapReserve As ULong
    Public SizeOfHeapCommit As ULong
    Public LoaderFlags As UInteger
    Public NumberOfRvaAndSizes As UInteger
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=16)> Public DataDirectory() As IMAGE_DATA_DIRECTORY
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure IMAGE_NT_HEADERS64
    Public Signature As UInteger
    Public FileHeader As IMAGE_FILE_HEADER
    Public OptionalHeader As IMAGE_OPTIONAL_HEADER64
End Structure

import ctypes
from ctypes import wintypes

class IMAGE_FILE_HEADER(ctypes.Structure):
    _fields_ = [
        ("Machine", ctypes.c_ushort),
        ("NumberOfSections", ctypes.c_ushort),
        ("TimeDateStamp", wintypes.DWORD),
        ("PointerToSymbolTable", wintypes.DWORD),
        ("NumberOfSymbols", wintypes.DWORD),
        ("SizeOfOptionalHeader", ctypes.c_ushort),
        ("Characteristics", ctypes.c_ushort),
    ]

class IMAGE_DATA_DIRECTORY(ctypes.Structure):
    _fields_ = [
        ("VirtualAddress", wintypes.DWORD),
        ("Size", wintypes.DWORD),
    ]

class IMAGE_OPTIONAL_HEADER64(ctypes.Structure):
    _pack_ = 4
    _fields_ = [
        ("Magic", ctypes.c_ushort),
        ("MajorLinkerVersion", ctypes.c_ubyte),
        ("MinorLinkerVersion", ctypes.c_ubyte),
        ("SizeOfCode", wintypes.DWORD),
        ("SizeOfInitializedData", wintypes.DWORD),
        ("SizeOfUninitializedData", wintypes.DWORD),
        ("AddressOfEntryPoint", wintypes.DWORD),
        ("BaseOfCode", wintypes.DWORD),
        ("ImageBase", ctypes.c_ulonglong),
        ("SectionAlignment", wintypes.DWORD),
        ("FileAlignment", wintypes.DWORD),
        ("MajorOperatingSystemVersion", ctypes.c_ushort),
        ("MinorOperatingSystemVersion", ctypes.c_ushort),
        ("MajorImageVersion", ctypes.c_ushort),
        ("MinorImageVersion", ctypes.c_ushort),
        ("MajorSubsystemVersion", ctypes.c_ushort),
        ("MinorSubsystemVersion", ctypes.c_ushort),
        ("Win32VersionValue", wintypes.DWORD),
        ("SizeOfImage", wintypes.DWORD),
        ("SizeOfHeaders", wintypes.DWORD),
        ("CheckSum", wintypes.DWORD),
        ("Subsystem", ctypes.c_ushort),
        ("DllCharacteristics", ctypes.c_ushort),
        ("SizeOfStackReserve", ctypes.c_ulonglong),
        ("SizeOfStackCommit", ctypes.c_ulonglong),
        ("SizeOfHeapReserve", ctypes.c_ulonglong),
        ("SizeOfHeapCommit", ctypes.c_ulonglong),
        ("LoaderFlags", wintypes.DWORD),
        ("NumberOfRvaAndSizes", wintypes.DWORD),
        ("DataDirectory", IMAGE_DATA_DIRECTORY * 16),
    ]

class IMAGE_NT_HEADERS64(ctypes.Structure):
    _fields_ = [
        ("Signature", wintypes.DWORD),
        ("FileHeader", IMAGE_FILE_HEADER),
        ("OptionalHeader", IMAGE_OPTIONAL_HEADER64),
    ]

#[repr(C)]
pub struct IMAGE_FILE_HEADER {
    pub Machine: u16,
    pub NumberOfSections: u16,
    pub TimeDateStamp: u32,
    pub PointerToSymbolTable: u32,
    pub NumberOfSymbols: u32,
    pub SizeOfOptionalHeader: u16,
    pub Characteristics: u16,
}

#[repr(C)]
pub struct IMAGE_DATA_DIRECTORY {
    pub VirtualAddress: u32,
    pub Size: u32,
}

#[repr(C, packed(4))]
pub struct IMAGE_OPTIONAL_HEADER64 {
    pub Magic: u16,
    pub MajorLinkerVersion: u8,
    pub MinorLinkerVersion: u8,
    pub SizeOfCode: u32,
    pub SizeOfInitializedData: u32,
    pub SizeOfUninitializedData: u32,
    pub AddressOfEntryPoint: u32,
    pub BaseOfCode: u32,
    pub ImageBase: u64,
    pub SectionAlignment: u32,
    pub FileAlignment: u32,
    pub MajorOperatingSystemVersion: u16,
    pub MinorOperatingSystemVersion: u16,
    pub MajorImageVersion: u16,
    pub MinorImageVersion: u16,
    pub MajorSubsystemVersion: u16,
    pub MinorSubsystemVersion: u16,
    pub Win32VersionValue: u32,
    pub SizeOfImage: u32,
    pub SizeOfHeaders: u32,
    pub CheckSum: u32,
    pub Subsystem: u16,
    pub DllCharacteristics: u16,
    pub SizeOfStackReserve: u64,
    pub SizeOfStackCommit: u64,
    pub SizeOfHeapReserve: u64,
    pub SizeOfHeapCommit: u64,
    pub LoaderFlags: u32,
    pub NumberOfRvaAndSizes: u32,
    pub DataDirectory: [IMAGE_DATA_DIRECTORY; 16],
}

#[repr(C)]
pub struct IMAGE_NT_HEADERS64 {
    pub Signature: u32,
    pub FileHeader: IMAGE_FILE_HEADER,
    pub OptionalHeader: IMAGE_OPTIONAL_HEADER64,
}

import "golang.org/x/sys/windows"

type IMAGE_FILE_HEADER struct {
	Machine uint16
	NumberOfSections uint16
	TimeDateStamp uint32
	PointerToSymbolTable uint32
	NumberOfSymbols uint32
	SizeOfOptionalHeader uint16
	Characteristics uint16
}

type IMAGE_DATA_DIRECTORY struct {
	VirtualAddress uint32
	Size uint32
}

type IMAGE_OPTIONAL_HEADER64 struct {
	Magic uint16
	MajorLinkerVersion byte
	MinorLinkerVersion byte
	SizeOfCode uint32
	SizeOfInitializedData uint32
	SizeOfUninitializedData uint32
	AddressOfEntryPoint uint32
	BaseOfCode uint32
	ImageBase uint64
	SectionAlignment uint32
	FileAlignment uint32
	MajorOperatingSystemVersion uint16
	MinorOperatingSystemVersion uint16
	MajorImageVersion uint16
	MinorImageVersion uint16
	MajorSubsystemVersion uint16
	MinorSubsystemVersion uint16
	Win32VersionValue uint32
	SizeOfImage uint32
	SizeOfHeaders uint32
	CheckSum uint32
	Subsystem uint16
	DllCharacteristics uint16
	SizeOfStackReserve uint64
	SizeOfStackCommit uint64
	SizeOfHeapReserve uint64
	SizeOfHeapCommit uint64
	LoaderFlags uint32
	NumberOfRvaAndSizes uint32
	DataDirectory [16]IMAGE_DATA_DIRECTORY
}

type IMAGE_NT_HEADERS64 struct {
	Signature uint32
	FileHeader IMAGE_FILE_HEADER
	OptionalHeader IMAGE_OPTIONAL_HEADER64
}

type
  IMAGE_FILE_HEADER = record
    Machine: Word;
    NumberOfSections: Word;
    TimeDateStamp: DWORD;
    PointerToSymbolTable: DWORD;
    NumberOfSymbols: DWORD;
    SizeOfOptionalHeader: Word;
    Characteristics: Word;
  end;

  IMAGE_DATA_DIRECTORY = record
    VirtualAddress: DWORD;
    Size: DWORD;
  end;

  IMAGE_OPTIONAL_HEADER64 = packed record
    Magic: Word;
    MajorLinkerVersion: Byte;
    MinorLinkerVersion: Byte;
    SizeOfCode: DWORD;
    SizeOfInitializedData: DWORD;
    SizeOfUninitializedData: DWORD;
    AddressOfEntryPoint: DWORD;
    BaseOfCode: DWORD;
    ImageBase: UInt64;
    SectionAlignment: DWORD;
    FileAlignment: DWORD;
    MajorOperatingSystemVersion: Word;
    MinorOperatingSystemVersion: Word;
    MajorImageVersion: Word;
    MinorImageVersion: Word;
    MajorSubsystemVersion: Word;
    MinorSubsystemVersion: Word;
    Win32VersionValue: DWORD;
    SizeOfImage: DWORD;
    SizeOfHeaders: DWORD;
    CheckSum: DWORD;
    Subsystem: Word;
    DllCharacteristics: Word;
    SizeOfStackReserve: UInt64;
    SizeOfStackCommit: UInt64;
    SizeOfHeapReserve: UInt64;
    SizeOfHeapCommit: UInt64;
    LoaderFlags: DWORD;
    NumberOfRvaAndSizes: DWORD;
    DataDirectory: array[0..15] of IMAGE_DATA_DIRECTORY;
  end;

  IMAGE_NT_HEADERS64 = record
    Signature: DWORD;
    FileHeader: IMAGE_FILE_HEADER;
    OptionalHeader: IMAGE_OPTIONAL_HEADER64;
  end;

const IMAGE_FILE_HEADER = extern struct {
    Machine: u16,
    NumberOfSections: u16,
    TimeDateStamp: u32,
    PointerToSymbolTable: u32,
    NumberOfSymbols: u32,
    SizeOfOptionalHeader: u16,
    Characteristics: u16,
};

const IMAGE_DATA_DIRECTORY = extern struct {
    VirtualAddress: u32,
    Size: u32,
};

const IMAGE_OPTIONAL_HEADER64 = extern struct {
    Magic: u16,
    MajorLinkerVersion: u8,
    MinorLinkerVersion: u8,
    SizeOfCode: u32,
    SizeOfInitializedData: u32,
    SizeOfUninitializedData: u32,
    AddressOfEntryPoint: u32,
    BaseOfCode: u32,
    ImageBase: u64,
    SectionAlignment: u32,
    FileAlignment: u32,
    MajorOperatingSystemVersion: u16,
    MinorOperatingSystemVersion: u16,
    MajorImageVersion: u16,
    MinorImageVersion: u16,
    MajorSubsystemVersion: u16,
    MinorSubsystemVersion: u16,
    Win32VersionValue: u32,
    SizeOfImage: u32,
    SizeOfHeaders: u32,
    CheckSum: u32,
    Subsystem: u16,
    DllCharacteristics: u16,
    SizeOfStackReserve: u64,
    SizeOfStackCommit: u64,
    SizeOfHeapReserve: u64,
    SizeOfHeapCommit: u64,
    LoaderFlags: u32,
    NumberOfRvaAndSizes: u32,
    DataDirectory: [16]IMAGE_DATA_DIRECTORY,
};

const IMAGE_NT_HEADERS64 = extern struct {
    Signature: u32,
    FileHeader: IMAGE_FILE_HEADER,
    OptionalHeader: IMAGE_OPTIONAL_HEADER64,
};

type
  IMAGE_FILE_HEADER {.bycopy.} = object
    Machine: uint16
    NumberOfSections: uint16
    TimeDateStamp: uint32
    PointerToSymbolTable: uint32
    NumberOfSymbols: uint32
    SizeOfOptionalHeader: uint16
    Characteristics: uint16

  IMAGE_DATA_DIRECTORY {.bycopy.} = object
    VirtualAddress: uint32
    Size: uint32

  IMAGE_OPTIONAL_HEADER64 {.packed.} = object
    Magic: uint16
    MajorLinkerVersion: uint8
    MinorLinkerVersion: uint8
    SizeOfCode: uint32
    SizeOfInitializedData: uint32
    SizeOfUninitializedData: uint32
    AddressOfEntryPoint: uint32
    BaseOfCode: uint32
    ImageBase: uint64
    SectionAlignment: uint32
    FileAlignment: uint32
    MajorOperatingSystemVersion: uint16
    MinorOperatingSystemVersion: uint16
    MajorImageVersion: uint16
    MinorImageVersion: uint16
    MajorSubsystemVersion: uint16
    MinorSubsystemVersion: uint16
    Win32VersionValue: uint32
    SizeOfImage: uint32
    SizeOfHeaders: uint32
    CheckSum: uint32
    Subsystem: uint16
    DllCharacteristics: uint16
    SizeOfStackReserve: uint64
    SizeOfStackCommit: uint64
    SizeOfHeapReserve: uint64
    SizeOfHeapCommit: uint64
    LoaderFlags: uint32
    NumberOfRvaAndSizes: uint32
    DataDirectory: array[16, IMAGE_DATA_DIRECTORY]

  IMAGE_NT_HEADERS64 {.bycopy.} = object
    Signature: uint32
    FileHeader: IMAGE_FILE_HEADER
    OptionalHeader: IMAGE_OPTIONAL_HEADER64

struct IMAGE_FILE_HEADER
{
    ushort Machine;
    ushort NumberOfSections;
    uint TimeDateStamp;
    uint PointerToSymbolTable;
    uint NumberOfSymbols;
    ushort SizeOfOptionalHeader;
    ushort Characteristics;
}

struct IMAGE_DATA_DIRECTORY
{
    uint VirtualAddress;
    uint Size;
}

align(4)
struct IMAGE_OPTIONAL_HEADER64
{
    ushort Magic;
    ubyte MajorLinkerVersion;
    ubyte MinorLinkerVersion;
    uint SizeOfCode;
    uint SizeOfInitializedData;
    uint SizeOfUninitializedData;
    uint AddressOfEntryPoint;
    uint BaseOfCode;
    ulong ImageBase;
    uint SectionAlignment;
    uint FileAlignment;
    ushort MajorOperatingSystemVersion;
    ushort MinorOperatingSystemVersion;
    ushort MajorImageVersion;
    ushort MinorImageVersion;
    ushort MajorSubsystemVersion;
    ushort MinorSubsystemVersion;
    uint Win32VersionValue;
    uint SizeOfImage;
    uint SizeOfHeaders;
    uint CheckSum;
    ushort Subsystem;
    ushort DllCharacteristics;
    ulong SizeOfStackReserve;
    ulong SizeOfStackCommit;
    ulong SizeOfHeapReserve;
    ulong SizeOfHeapCommit;
    uint LoaderFlags;
    uint NumberOfRvaAndSizes;
    IMAGE_DATA_DIRECTORY[16] DataDirectory;
}

struct IMAGE_NT_HEADERS64
{
    uint Signature;
    IMAGE_FILE_HEADER FileHeader;
    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
}

HSP用定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; IMAGE_NT_HEADERS64 サイズ: 264 バイト(x64)
dim st, 66    ; 4byte整数×66(構造体サイズ 264 / 4 切り上げ)
; Signature : DWORD (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; FileHeader : IMAGE_FILE_HEADER (+4, 20byte)  varptr(st)+4 を基点に操作(20byte:入れ子/配列)
; OptionalHeader : IMAGE_OPTIONAL_HEADER64 (+24, 240byte)  varptr(st)+24 を基点に操作(240byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。

; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global IMAGE_FILE_HEADER
    #field short Machine
    #field short NumberOfSections
    #field int TimeDateStamp
    #field int PointerToSymbolTable
    #field int NumberOfSymbols
    #field short SizeOfOptionalHeader
    #field short Characteristics
#endstruct

#defstruct global IMAGE_DATA_DIRECTORY
    #field int VirtualAddress
    #field int Size
#endstruct

#defstruct global IMAGE_OPTIONAL_HEADER64, pack=4
    #field short Magic
    #field byte MajorLinkerVersion
    #field byte MinorLinkerVersion
    #field int SizeOfCode
    #field int SizeOfInitializedData
    #field int SizeOfUninitializedData
    #field int AddressOfEntryPoint
    #field int BaseOfCode
    #field int64 ImageBase
    #field int SectionAlignment
    #field int FileAlignment
    #field short MajorOperatingSystemVersion
    #field short MinorOperatingSystemVersion
    #field short MajorImageVersion
    #field short MinorImageVersion
    #field short MajorSubsystemVersion
    #field short MinorSubsystemVersion
    #field int Win32VersionValue
    #field int SizeOfImage
    #field int SizeOfHeaders
    #field int CheckSum
    #field short Subsystem
    #field short DllCharacteristics
    #field int64 SizeOfStackReserve
    #field int64 SizeOfStackCommit
    #field int64 SizeOfHeapReserve
    #field int64 SizeOfHeapCommit
    #field int LoaderFlags
    #field int NumberOfRvaAndSizes
    #field IMAGE_DATA_DIRECTORY DataDirectory 16
#endstruct

#defstruct global IMAGE_NT_HEADERS64
    #field int Signature
    #field IMAGE_FILE_HEADER FileHeader
    #field IMAGE_OPTIONAL_HEADER64 OptionalHeader
#endstruct

stdim st, IMAGE_NT_HEADERS64        ; NSTRUCT 変数を確保
st->Signature = 100
mes "Signature=" + st->Signature

IMAGE_NT_HEADERS64

フィールド

各言語での定義

HSP用 定義

HSP用定義