Option Explicit Option Base 1 'Referencias: win.tlb -> Windows API (ANSI) Enum PE_IMAGE_FILE_TYPE IMAGE_DOS_SIGNATURE = &H5A4D ' MZ IMAGE_OS2_SIGNATURE = &H454E ' NE IMAGE_OS2_SIGNATURE_LE = &H454C ' LE IMAGE_NT_SIGNATURE = &H4550 ' PE IMAGE_FILE_UNKNOWN = &H0 ' Desconocido IMAGE_OPTHDR_SIGNATURE = 267 ' Encabezado opcional PE End Enum Private Const SIZE_OF_NT_SIGNATURE = 4 ' Desplazamiento de 4 bytes. Private Const IMAGE_SIZEOF_DOS_HEADER = 64 ' Tamaño de la estructura IMAGE_DOS_HEADER Private Const IMAGE_SIZEOF_FILE_HEADER = 20 ' Tamaño de la estructura IMAGE_FILE_HEADER Private Const IMAGE_SIZEOF_OPTIONAL_HEADER = 224 ' Tamaño de la estructura IMAGE_OPTIONAL_HEADER ' 'Memoria Reservada para cada proceso: 2147483648 Bytes (2 GB) ' 'Caraceterísticas de las secciones. ' Enum PE_IMAGE_SECTION_CHARS SECTION_CODE = &H20 SECTION_INITIALIZED_DATA = &H40 SECTION_UNITIALIZED_DATA = &H80 SECTION_CANNOT_BE_CACHED = &H4000000 SECTION_NO_PAGEABLE = &H8000000 SECTION_SHARED = &H10000000 SECTION_EXECUTABLE = &H20000000 SECTION_READABLE = &H40000000 SECTION_WRITABLE = &H80000000 End Enum ' 'Tipos de información de depuración. ' Enum PE_DEBUG_INFO_TYPE IMAGE_DEBUG_TYPE_UNKNOWN = 0 IMAGE_DEBUG_TYPE_COFF = 1 IMAGE_DEBUG_TYPE_CODEVIEW = 2 IMAGE_DEBUG_TYPE_FPO = 3 IMAGE_DEBUG_TYPE_MISC = 4 End Enum ' 'Entradas de directorios ' Enum PE_DIRECTORY_ENTRY IMAGE_DIRECTORY_ENTRY_EXPORT = 0 ' Directorio de exportación IMAGE_DIRECTORY_ENTRY_IMPORT = 1 ' Directorio de importación IMAGE_DIRECTORY_ENTRY_RESOURCE = 2 ' Directorio de recursos IMAGE_DIRECTORY_ENTRY_EXEPTION = 3 ' Directorio de exepciones IMAGE_DIRECTORY_ENTRY_CERTIFICATE = 4 ' Directorio de seguridad IMAGE_DIRECTORY_ENTRY_BASERELOC = 5 ' Tabla de base de reagrupaciones IMAGE_DIRECTORY_ENTRY_DEBUG = 6 ' Directorio de depuración IMAGE_DIRECTORY_ENTRY_COPYRIGHT = 7 ' Descripción de cadenas IMAGE_DIRECTORY_ENTRY_GLOBALPTR = 8 ' Valor de la máquina (MIPS GP) IMAGE_DIRECTORY_ENTRY_TLS = 9 ' Directorio del almacén local del subproceso (Thread Local Storage) IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG = 10 ' Directorio de configuración cargada IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT = 11 ' Bound Import Table address and size. IMAGE_DIRECTORY_ENTRY_IAT = 12 ' Import Address Table IMAGE_DIRECTORY_ENTRY_DELAY_DESCRIPTOR = 13 ' Delay Import Descriptor. End Enum Private Const IMAGE_SIZEOF_SHORT_NAME = 8 ' Longitud máxima del nombre de sección. Private Const IMAGE_NUMBEROF_DIRECTORY_ENTRIES = 16 ' Cantidad de directorios de datos. ' 'Tipos de máquinas ' Enum PE_MACHINE_TYPE IMAGE_FILE_MACHINE_UNKNOWN = &H0& ' Contents assumed to be applicable to any machine type. IMAGE_FILE_MACHINE_I386 = &H14C& ' Intel 386 or later, and compatible processors. IMAGE_FILE_MACHINE_R3000 = &H162& IMAGE_FILE_MACHINE_R4000 = &H166& ' MIPS® little endian. IMAGE_FILE_MACHINE_R10000 = &H168& IMAGE_FILE_MACHINE_ALPHA = &H184& ' Alpha AXP™. IMAGE_FILE_MACHINE_M68K = &H268& ' Motorola 68000 series. IMAGE_FILE_MACHINE_POWERPC = &H1F0& ' Power PC, little endian. IMAGE_FILE_MACHINE_SH3 = &H1A2& ' Hitachi SH3 IMAGE_FILE_MACHINE_SH4 = &H1A6& ' Hitachi SH4 IMAGE_FILE_MACHINE_ARM = &H1C0& End Enum ' 'Características (cabecera PE) ' Enum PE_HEADER_CHARS IMAGE_FILE_RELOCS_STRIPPED = &H1 ' Image only. Indicates that the file does not contain base relocations and must therefore be loaded at its preferred base address. If the base address is not available, the loader reports an error. Operating systems running on top of MS-DOS (Win32s®) are generally not able to use the preferred base address and so cannot run these images. However, beginning with version 4.0, Windows will use an application's preferred base address. The default behavior of the linker is to strip base relocations from EXEs. IMAGE_FILE_EXECUTABLE_IMAGE = &H2 ' Image only. Indicates that the image file is valid and can be run. If this flag is not set, it generally indicates a linker error. IMAGE_FILE_LINE_NUMS_STRIPPED = &H4 ' COFF line numbers have been removed. IMAGE_FILE_LOCAL_SYMS_STRIPPED = &H8 ' COFF symbol table entries for local symbols have been removed. IMAGE_FILE_AGGRESSIVE_WS_TRIM = &H10 ' Aggressively trim working set. IMAGE_FILE_LARGE_ADDRESS_AWARE = &H20 ' App can handle > 2gb addresses. IMAGE_FILE_16BIT_MACHINE = &H40 ' Use of this flag is reserved for future use. IMAGE_FILE_BYTES_REVERSED_LO = &H80 ' Little endian: LSB precedes MSB in memory. IMAGE_FILE_32BIT_MACHINE = &H100 ' Machine based on 32-bit-word architecture. IMAGE_FILE_DEBUG_STRIPPED = &H200 ' Debugging information removed from image file. IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP = &H400 ' If image is on removable media, copy and run from swap file. IMAGE_FILE_SYSTEM = &H1000 ' The image file is a system file, not a user program. IMAGE_FILE_DLL = &H2000 ' The image file is a dynamic-link library (DLL). Such files are considered executable files for almost all purposes, although they cannot be directly run. IMAGE_FILE_UP_SYSTEM_ONLY = &H4000 ' File should be run only on a UP machine. IMAGE_FILE_BYTES_REVERSED_HI = &H8000 ' Big endian: MSB precedes LSB in memory. End Enum ' 'Tipo de imagen (según el campo Magic del 'encabezado opcional PE ' Enum PE_IMAGETYPE IMAGE_TYPE_NORMAL = &H10B& IMAGE_TYPE_ROM = &H107& End Enum ' 'Subsistemas ' Enum PE_SUBSYSTEM IMAGE_SUBSYSTEM_UNKNOWN = 0 ' Unknown subsystem. IMAGE_SUBSYSTEM_NATIVE = 1 ' Used for device drivers and native Windows NT processes. IMAGE_SUBSYSTEM_WINDOWS_GUI = 2 ' Image runs in the Windows® graphical user interface (GUI) subsystem. IMAGE_SUBSYSTEM_WINDOWS_CUI = 3 ' Image runs in the Windows character subsystem. IMAGE_SUBSYSTEM_POSIX_CUI = 7 ' Image runs in the Posix character subsystem. IMAGE_SUBSYSTEM_WINDOWS_CE_GUI = 9 ' Image runs in on Windows CE End Enum ' 'Características de las DLL ' Enum PE_DLL_CHARS IMAGE_DLLCHARACTERISTICS_RESERVED1 = &H1 ' Reserved IMAGE_DLLCHARACTERISTICS_RESERVED2 = &H2 ' Reserved IMAGE_DLLCHARACTERISTICS_RESERVED3 = &H4 ' Reserved IMAGE_DLLCHARACTERISTICS_RESERVED4 = &H8 ' Reserved IMAGE_DLLCHARACTERISTICS_WDM_DRIVER = &H2000 ' Driver is a WDM Driver End Enum ' 'Características de las secciones. ' Enum PE_SECTION_CHARS IMAGE_SCN_TYPE_REG = &H0 ' Reserved for future use. IMAGE_SCN_TYPE_DSECT = &H1 ' Reserved for future use. IMAGE_SCN_TYPE_NOLOAD = &H2 ' Reserved for future use. IMAGE_SCN_TYPE_GROUP = &H4 ' Reserved for future use. IMAGE_SCN_TYPE_NO_PAD = &H8 ' Section should not be padded to next boundary. This is obsolete and replaced by IMAGE_SCN_ALIGN_1BYTES. This is valid for object files only. IMAGE_SCN_TYPE_COPY = &H10 ' Reserved for future use. IMAGE_SCN_CNT_CODE = &H20 ' Section contains executable code. IMAGE_SCN_CNT_INITIALIZED_DATA = &H40 ' Section contains initialized data. IMAGE_SCN_CNT_UNINITIALIZED_DATA = &H80 ' Section contains uninitialized data. IMAGE_SCN_LNK_OTHER = &H100 ' Reserved for future use. IMAGE_SCN_LNK_INFO = &H200 ' Section contains comments or other information. The .drectve section has this type. This is valid for object files only. IMAGE_SCN_TYPE_OVER = &H400 ' Reserved for future use. IMAGE_SCN_LNK_REMOVE = &H800 ' Section will not become part of the image. This is valid for object files only. IMAGE_SCN_LNK_COMDAT = &H1000 ' Section contains COMDAT data. See Section 5.5.6, "COMDAT Sections," for more information. This is valid for object files only. IMAGE_SCN_MEM_FARDATA = &H8000 ' Reserved for future use. IMAGE_SCN_MEM_PURGEABLE = &H20000 ' Reserved for future use. IMAGE_SCN_MEM_16BIT = &H20000 ' Reserved for future use. IMAGE_SCN_MEM_LOCKED = &H40000 ' Reserved for future use. IMAGE_SCN_MEM_PRELOAD = &H80000 ' Reserved for future use. IMAGE_SCN_ALIGN_1BYTES = &H100000 ' Align data on a 1 byte boundary. This is valid for object files only. IMAGE_SCN_ALIGN_2BYTES = &H200000 ' Align data on a 2 byte boundary. This is valid for object files only. IMAGE_SCN_ALIGN_4BYTES = &H300000 ' Align data on a 4 byte boundary. This is valid for object files only. IMAGE_SCN_ALIGN_8BYTES = &H400000 ' Align data on a 8 byte boundary. This is valid for object files only. IMAGE_SCN_ALIGN_16BYTES = &H500000 ' Align data on a 16 byte boundary. This is valid for object files only. IMAGE_SCN_ALIGN_32BYTES = &H600000 ' Align data on a 32 byte boundary. This is valid for object files only. IMAGE_SCN_ALIGN_64BYTES = &H700000 ' Align data on a 64 byte boundary. This is valid for object files only. IMAGE_SCN_LNK_OVFL = &H1000000 ' Section contains extended relocations. IMAGE_SCN_MEM_DISCARDABLE = &H2000000 ' Section can be discarded as needed. IMAGE_SCN_MEM_NOT_CACHED = &H4000000 ' Section cannot be cached. IMAGE_SCN_MEM_NOT_PAGED = &H8000000 ' Section is not pageable. IMAGE_SCN_MEM_SHARED = &H10000000 ' Section can be shared in memory. IMAGE_SCN_MEM_EXECUTE = &H20000000 ' Section can be executed as code. IMAGE_SCN_MEM_READ = &H40000000 ' Section can be read. IMAGE_SCN_MEM_WRITE = &H80000000 ' Section can be written to. End Enum ' 'Valores para SectionNumber, de IMAGE_SYM_TABLE_ENTRY ' Private Const IMAGE_SYM_UNDEFINED = 0 ' Symbol record is not yet assigned a section. If the value is 0 this indicates a references to an external symbol defined elsewhere. If the value is non-zero this is a common symbol with a size specified by the value. Private Const IMAGE_SYM_ABSOLUTE = -1 ' The symbol has an absolute (non-relocatable) value and is not an address. Private Const IMAGE_SYM_DEBUG = -2 ' The symbol provides general type or debugging information but does not correspond to a section. Microsoft tools use this setting along with .file records (storage class FILE). ' 'Tipos de símbolos (Public Type de IMAGE_SYM_TABLE_ENTRY) ' Enum PE_SYM_TYPE ' 'Byte Bajo ' IMAGE_SYM_TYPE_NULL = 0 ' No type information or unknown base type. Microsoft tools use this setting. IMAGE_SYM_TYPE_VOID = 1 ' No valid type; used with void pointers and functions. IMAGE_SYM_TYPE_CHAR = 2 ' Character (signed byte). IMAGE_SYM_TYPE_SHORT = 3 ' Two-byte signed integer. IMAGE_SYM_TYPE_INT = 4 ' Natural integer type (normally four bytes in Windows NT). IMAGE_SYM_TYPE_LONG = 5 ' Four-byte signed integer. IMAGE_SYM_TYPE_FLOAT = 6 ' Four-byte floating-point number. IMAGE_SYM_TYPE_DOUBLE = 7 ' Eight-byte floating-point number. IMAGE_SYM_TYPE_STRUCT = 8 ' Structure. IMAGE_SYM_TYPE_UNION = 9 ' Union. IMAGE_SYM_TYPE_ENUM = 10 ' Enumerated type. IMAGE_SYM_TYPE_MOE = 11 ' Member of enumeration (a specific value). IMAGE_SYM_TYPE_BYTE = 12 ' Byte; unsigned one-byte integer. IMAGE_SYM_TYPE_WORD = 13 ' Word; unsigned two-byte integer. IMAGE_SYM_TYPE_UINT = 14 ' Unsigned integer of natural size (normally, four bytes). IMAGE_SYM_TYPE_DWORD = 15 ' Unsigned four-byte integer. ' 'Byte Alto ' IMAGE_SYM_DTYPE_NULL = 0 ' No derived type; the symbol is a simple scalar variable. IMAGE_SYM_DTYPE_POINTER = 1 ' Pointer to base type. IMAGE_SYM_DTYPE_FUNCTION = 2 ' Function returning base type. IMAGE_SYM_DTYPE_ARRAY = 3 ' Array of base type. End Enum ' 'Tipos de definición de los símbolos (StorageClass) ' Enum PE_SYM_CLASS IMAGE_SYM_CLASS_END_OF_FUNCTION = -1 ' (0xFF) Special symbol representing end of function, for debugging purposes. IMAGE_SYM_CLASS_NULL = 0 ' No storage class assigned. IMAGE_SYM_CLASS_AUTOMATIC = 1 ' Automatic (stack) variable. The Value field specifies stack frame offset. IMAGE_SYM_CLASS_EXTERNAL = 2 ' Used by Microsoft tools for external symbols. The Value field indicates the size if the section number is IMAGE_SYM_UNDEFINED (0). If the section number is not 0, then the Value field specifies the offset within the section. IMAGE_SYM_CLASS_STATIC = 3 ' The Value field specifies the offset of the symbol within the section. If the Value is 0, then the symbol represents a section name. IMAGE_SYM_CLASS_REGISTER = 4 ' Register variable. The Value field specifies register number. IMAGE_SYM_CLASS_EXTERNAL_DEF = 5 ' Symbol is defined externally. IMAGE_SYM_CLASS_LABEL = 6 ' Code label defined within the module. The Value field specifies the offset of the symbol within the section. IMAGE_SYM_CLASS_UNDEFINED_LABEL = 7 ' Reference to a code label not defined. IMAGE_SYM_CLASS_MEMBER_OF_STRUCT = 8 ' Structure member. The Value field specifies nth member. IMAGE_SYM_CLASS_ARGUMENT = 9 ' Formal argument (parameter)of a function. The Value field specifies nth argument. IMAGE_SYM_CLASS_STRUCT_TAG = 10 ' Structure tag-name entry. IMAGE_SYM_CLASS_MEMBER_OF_UNION = 11 ' Union member. The Value field specifies nth member. IMAGE_SYM_CLASS_UNION_TAG = 12 ' Union tag-name entry. IMAGE_SYM_CLASS_TYPE_DEFINITION = 13 ' Typedef entry. IMAGE_SYM_CLASS_UNDEFINED_STATIC = 14 ' Static data declaration. IMAGE_SYM_CLASS_ENUM_TAG = 15 ' Enumerated type tagname entry. IMAGE_SYM_CLASS_MEMBER_OF_ENUM = 16 ' Member of enumeration. Value specifies nth member. IMAGE_SYM_CLASS_REGISTER_PARAM = 17 ' Register parameter. IMAGE_SYM_CLASS_BIT_FIELD = 18 ' Bit-field reference. Value specifies nth bit in the bit field. IMAGE_SYM_CLASS_BLOCK = 100 ' A .bb (beginning of block) or .eb (end of block) record. Value is the relocatable address of the code location. IMAGE_SYM_CLASS_FUNCTION = 101 ' Used by Microsoft tools for symbol records that define the extent of a function: begin function (named .bf), end function (.ef), and lines in function (.lf). For .lf records, Value gives the number of source lines in the function. For .ef records, Value gives the size of function code. IMAGE_SYM_CLASS_END_OF_STRUCT = 102 ' End of structure entry. IMAGE_SYM_CLASS_FILE = 103 ' Used by Microsoft tools, as well as traditional COFF format, for the source-file symbol record. The symbol is followed by auxiliary records that name the file. IMAGE_SYM_CLASS_SECTION = 104 ' Definition of a section (Microsoft tools use STATIC storage class instead). IMAGE_SYM_CLASS_WEAK_EXTERNAL = 105 ' Weak external. Microsoft tools use EXTERNAL storage class instead. See Section 5.5.3, "Auxiliary Format 3: Weak Externals," for more information. End Enum ' ' Tipos de Recursos Predefinidos ' Enum PE_RESOURCE_TYPE RT_CURSOR = 1 RT_BITMAP = 2 RT_ICON = 3 RT_MENU = 4 RT_DIALOG = 5 RT_STRING = 6 RT_FONTDIR = 7 RT_FONT = 8 RT_ACCELERATOR = 9 RT_RCDATA = 10 RT_MESSAGETABLE = 11 End Enum ' 'Nombre de los recursos. ' Private Const IDR_CURSOR = "CURSOR" Private Const IDR_BITMAP = "BITMAP" Private Const IDR_ICON = "ICON" Private Const IDR_MENU = "MENU" Private Const IDR_DIALOG = "DIALOG" Private Const IDR_STRING = "STRING" Private Const IDR_FONTDIR = "FONTDIR" Private Const IDR_FONT = "FONT" Private Const IDR_ACCELERATOR = "ACCELERATOR" Private Const IDR_RCDATA = "RCDATA" Private Const IDR_MESSAGETABLE = "MESSAGETABLE" Private Const MAXRESOURCENAME = 13 ' 'GetImportData ' Enum PE_IMPORT_DATA_CLASS IMPORT_DATA_MODULES = 1 IMPORT_DATA_FUNCTIONS = 2 IMPORT_DATA_HINTS = 3 End Enum ' 'Errores generales. ' Enum PE_ERRORS ERROR_BASE = 10000 ERROR_DEFAULT = ERROR_BASE ERROR_INVALID_IMAGE = ERROR_BASE + 1 ERROR_NO_DOS_SIGNATURE_FOUND = ERROR_BASE + 2 ERROR_NO_PE_SIGNATURE_FOUND = ERROR_BASE + 3 ERROR_NO_OPT_SIGNATURE_FOUND = ERROR_BASE + 4 ERROR_INVALID_IMAGE32 = ERROR_BASE + 5 ERROR_FILE_NOT_SPECIFIED = ERROR_BASE + 6 ERROR_IMAGE_NOT_LOADED = ERROR_BASE + 7 ERROR_IMAGE_READONLY = ERROR_BASE + 8 ERROR_SECTION_PRIVATE = ERROR_BASE + 9 ' La sección no fue creada por la clase. ERROR_SECTION_OVERFLOW = ERROR_BASE + 10 ' Se sobrepasaron los límites de la sección. ERROR_PROCESS_STILL_ACTIVE = ERROR_BASE + 11 ' El proceso no se pudo terminar y sigue activo. ERROR_FILE_EXIST = ERROR_BASE + 12 ' El archivo ya existe y no puede ser reemplazado. ERROR_COUNT = 12 End Enum Public Type IMAGE_DOS_HEADER e_magic As Integer ' Caracteres MZ e_cblp As Integer ' Bytes en la última página del archivo file e_cp As Integer ' Páginas in el archive e_crlc As Integer ' Reagrupaciones e_cparhdr As Integer ' Tamaño del encabezado en párrafos e_minalloc As Integer ' Mínimo de párrafos extra que se necesitan e_maxalloc As Integer ' Máximo de párrafos extra que se necesitan e_ss As Integer ' Valor SS inicial (relativo) e_sp As Integer ' Valor SP inicial e_csum As Integer ' Checksum e_ip As Integer ' Valor IP inicial e_cs As Integer ' Valor CS inicial(relativo) e_lfarlc As Integer ' Dirección del archivo de las tablas de reagrupaciones e_ovno As Integer ' Número de cubierta (overlay) e_res(1 To 4) As Integer ' Palabras reservadas e_oemid As Integer ' Identificador OEM (para e_oeminfo) e_oeminfo As Integer ' Información OEM; e_oemid específico e_res2(1 To 10) As Integer ' Palabras reservadas e_lfanew As Long ' Dirección en archivo del nuevo encabezado exe End Type Public Type IMAGE_FILE_HEADER Magic As Long Machine As Integer NumberOfSections As Integer TimeDateStamp As Long PointerToSymbolTable As Long NumberOfSymbols As Long SizeOfOptionalHeader As Integer Characteristics As Integer End Type Type IMAGE_DATA_DIRECTORY VirtualAddress As Long Size As Long End Type Public Type IMAGE_OPTIONAL_HEADER Magic As Integer MajorLinkerVersion As Byte MinorLinkerVersion As Byte SizeOfCode As Long SizeOfInitializedData As Long SizeOfUninitializedData As Long AddressOfEntryPoint As Long BaseOfCode As Long BaseOfData As Long ImageBase As Long SectionAlignment As Long FileAlignment As Long MajorOperatingSystemVersion As Integer MinorOperatingSystemVersion As Integer MajorImageVersion As Integer MinorImageVersion As Integer MajorSubsystemVersion As Integer MinorSubsystemVersion As Integer Reserved1 As Long SizeOfImage As Long SizeOfHeaders As Long CheckSum As Long Subsystem As Integer DllCharacteristics As Integer SizeOfStackReserve As Long SizeOfStackCommit As Long SizeOfHeapReserve As Long SizeOfHeapCommit As Long LoaderFlags As Long NumberOfRvaAndSizes As Long DataDirectory(1 To IMAGE_NUMBEROF_DIRECTORY_ENTRIES) As IMAGE_DATA_DIRECTORY End Type Public Type IMAGE_SECTION_HEADER sName(1 To IMAGE_SIZEOF_SHORT_NAME) As Byte Reserved1 As Long VirtualAddress As Long SizeOfRawData As Long PointerToRawData As Long PointerToRelocations As Integer PointerToLinenumbers As Integer NumberOfRelocations As Integer NumberOfLineNumbers As Integer Reserved2 As Long Characteristics As Long End Type Public Type IMAGE_EXPORT_DIRECTORY Characteristics As Long TimeDateStamp As Long MajorVersion As Integer MinorVersion As Integer NameRVA As Long OrdinalBase As Long NumberOfEntries As Long NumberOfNames As Long ExportAddressTableRVA As Long NamePointerRVA As Long OrdinalTableRVA As Long End Type Public Type IMAGE_EXPORT_ADDRESS_TABLE_ENTRY ExportRVA As Long ForwarderRVA As Long End Type Public Type IMAGE_IMPORT_MODULE_DIRECTORY FunctionNameListRVA As Long TimeDateStamp As Long FowarderChain As Long ModuleNameRVA As Long FunctionAddressListRVA As Long End Type Public Type IMAGE_THUNK_DATA32 ForwarderString As Long Function As Long Ordinal As Long AddressOfData As Long End Type Public Type IMAGE_IMPORT_DESCRIPTOR '=IMAGE_IMPORT_MODULE_DIRECTORY Characteristics As Long OriginalFirstThunk As Long TimeDateStamp As Long ForwarderChain As Long ModuleName As Long FirstThunk As Long End Type Public Type IMAGE_BOUND_IMPORT_DESCRIPTOR TimeDateStamp As Long OffsetModuleName As Integer NumberOfModuleForwarderRefs As Integer End Type Public Type IMAGE_TLS_DIRECTORY32 StartAddressOfRawData As Long EndAddressOfRawData As Long AddressOfIndex As Long AddressOfCallBacks As Long SizeOfZeroFill As Long Characteristics As Long End Type Public Type IMAGE_RESOURCE_DIRECTORY Characteristics As Long TimeDateStamp As Long MajorVersion As Integer MinorVersion As Integer NumberOfNamedEntries As Integer NumberOfIdEntries As Integer End Type Public Type IMAGE_RESOURCE_DIRECTORY_ENTRY NameRVA As Long IntID As Long DataEntryRVA As Long SubdirectoryRVA As Long End Type Public Type IMAGE_RESOURCE_DATA_ENTRY OffsetToData As Long Size As Long CodePage As Long Reserved As Long End Type Public Type IMAGE_RESOURCE_DIR_STRING_U Length As Integer wNameString(1 To 2) As Byte End Type Public Type IMAGE_LOAD_CONFIG_DIRECTORY Characteristics As Long TimeDateStamp As Long MajorVersion As Integer MinorVersion As Integer GlobalFlagsClear As Long GlobalFlagsSet As Long CriticalSectionDefaultTimeout As Long DeCommitFreeBlockThreshold As Long DeCommitTotalFreeThreshold As Long LockPrefixTable As Long MaximumAllocationSize As Long VirtualMemoryThreshold As Long ProcessHeapFlags As Long Reserved(1 To 4) As Long End Type Public Type IMAGE_RUNTIME_FUNCTION_ENTRY BeginAddress As Long EndAddress As Long ExceptionHandler As Long HandlerData As Long PrologEndAddress As Long End Type Public Type IMAGE_SYM_TABLE_ENTRY sName(1 To 8) As Byte Value As Long SectionNumber As Integer Type As Integer StorageClass As Byte NumberOfAuxSymbols As Integer End Type Public Type IMAGE_COFF_SYMBOLS_HEADER NumberOfSymbols As Long LvaToFirstSymbol As Long NumberOfLineNumbers As Long LvaToFirstLinenumber As Long RvaToFirstByteOfCode As Long RvaToLastByteOfCode As Long RvaToFirstByteOfData As Long RvaToLastByteOfData As Long End Type Public Type IMAGE_RELOCATION VirtualAddress As Long RelocCount As Long SymbolTableIndex As Long Type As Integer End Type Public Type IMAGE_BASE_RELOCATION VirtualAddress As Long SizeOfBlock As Long End Type Public Type IMAGE_LINENUMBER SymbolTableIndex As Long VirtualAddress As Long Linenumber As Integer End Type Public Type IMAGE_DEBUG_DIRECTORY Characteristics As Long TimeDateStamp As Long MajorVersion As Integer MinorVersion As Integer Type As Long SizeOfData As Long AddressOfRawData As Long PointerToRawData As Long End Type