/* $Revision: 1.2 $ */ #ifndef _LCC_IMGEHLP_ #pragma pack(push,1) #define _LCC_IMGEHLP_ #define CHECKSUM_SUCCESS 0 #define CHECKSUM_OPEN_FAILURE 1 #define CHECKSUM_MAP_FAILURE 2 #define CHECKSUM_MAPVIEW_FAILURE 3 #define CHECKSUM_UNICODE_FAILURE 4 #define SPLITSYM_REMOVE_PRIVATE 1 #define SPLITSYM_EXTRACT_ALL 2 #define IMAGEAPI __stdcall PIMAGE_NT_HEADERS IMAGEAPI CheckSumMappedFile(LPVOID,DWORD,LPDWORD,LPDWORD); DWORD IMAGEAPI MapFileAndCheckSumA(LPSTR,LPDWORD,LPDWORD); DWORD IMAGEAPI MapFileAndCheckSumW(LPWSTR,LPDWORD,LPDWORD); #ifdef UNICODE #define MapFileAndCheckSum MapFileAndCheckSumW #else #define MapFileAndCheckSum MapFileAndCheckSumA #endif // !UNICODE BOOL IMAGEAPI TouchFileTimes(HANDLE,LPSYSTEMTIME); BOOL IMAGEAPI SplitSymbols(LPSTR,LPSTR,LPSTR,DWORD); HANDLE IMAGEAPI FindDebugInfoFile(LPSTR,LPSTR,LPSTR); HANDLE IMAGEAPI FindExecutableImage(LPSTR,LPSTR,LPSTR); BOOL IMAGEAPI UpdateDebugInfoFile(LPSTR,LPSTR,LPSTR,PIMAGE_NT_HEADERS); BOOL IMAGEAPI UpdateDebugInfoFileEx(LPSTR,LPSTR,LPSTR,PIMAGE_NT_HEADERS,DWORD); BOOL IMAGEAPI BindImage(LPSTR,LPSTR,LPSTR); typedef enum _STATUS { BindOutOfMemory, BindRvaToVaFailed, BindNoRoomInImage, BindImportModuleFailed, BindImportProcedureFailed, BindImportModule, BindImportProcedure, BindForwarder, BindForwarderNOT, BindImageModified, BindExpandFileHeaders, BindImageComplete, BindMismatchedSymbols, BindSymbolsNotUpdated } IMAGEHLP_STATUS_REASON; typedef BOOL (_stdcall *PIMAGEHLP_STATUS_ROUTINE)(IMAGEHLP_STATUS_REASON, LPSTR,LPSTR,ULONG,ULONG); BOOL IMAGEAPI BindImageEx(DWORD,LPSTR,LPSTR,LPSTR,PIMAGEHLP_STATUS_ROUTINE); #define BIND_NO_BOUND_IMPORTS 1 #define BIND_NO_UPDATE 2 #define BIND_ALL_IMAGES 4 BOOL IMAGEAPI ReBaseImage(LPSTR,LPSTR,BOOL,BOOL,BOOL,ULONG,ULONG *,ULONG *, ULONG *,ULONG *,ULONG); #define IMAGE_SEPARATION (64*1024) typedef struct _LoadedImage { LPSTR ModuleName; HANDLE hFile; PUCHAR MappedAddress; PIMAGE_NT_HEADERS FileHeader; PIMAGE_SECTION_HEADER LastRvaSection; ULONG NumberOfSections; PIMAGE_SECTION_HEADER Sections; ULONG Characteristics; BOOLEAN fSystemImage; BOOLEAN fDOSImage; LIST_ENTRY Links; ULONG SizeOfImage; } LOADED_IMAGE, *PLOADED_IMAGE; PLOADED_IMAGE IMAGEAPI ImageLoad(LPSTR,LPSTR); BOOL ImageUnload(PLOADED_IMAGE); PIMAGE_NT_HEADERS IMAGEAPI ImageNtHeader(PVOID); PVOID IMAGEAPI ImageDirectoryEntryToData(PVOID,BOOLEAN,USHORT,PULONG); PIMAGE_SECTION_HEADER IMAGEAPI ImageRvaToSection(PIMAGE_NT_HEADERS,PVOID,ULONG); PVOID IMAGEAPI ImageRvaToVa(PIMAGE_NT_HEADERS,PVOID,ULONG,PIMAGE_SECTION_HEADER *); BOOL IMAGEAPI MapAndLoad(LPSTR,LPSTR,PLOADED_IMAGE,BOOL,BOOL); BOOL IMAGEAPI GetImageConfigInformation(PLOADED_IMAGE,PIMAGE_LOAD_CONFIG_DIRECTORY); DWORD IMAGEAPI GetImageUnusedHeaderBytes(PLOADED_IMAGE,LPDWORD); BOOL IMAGEAPI SetImageConfigInformation(PLOADED_IMAGE,PIMAGE_LOAD_CONFIG_DIRECTORY); VOID IMAGEAPI UnMapAndLoad(PLOADED_IMAGE); typedef struct _dbg { LIST_ENTRY List; DWORD Size; PVOID MappedBase; USHORT Machine; USHORT Characteristics; DWORD CheckSum; DWORD ImageBase; DWORD SizeOfImage; DWORD NumberOfSections; PIMAGE_SECTION_HEADER Sections; DWORD ExportedNamesSize; LPSTR ExportedNames; DWORD NumberOfFunctionTableEntries; PIMAGE_FUNCTION_ENTRY FunctionTableEntries; DWORD LowestFunctionStartingAddress; DWORD HighestFunctionEndingAddress; DWORD NumberOfFpoTableEntries; PFPO_DATA FpoTableEntries; DWORD SizeOfCoffSymbols; PIMAGE_COFF_SYMBOLS_HEADER CoffSymbols; DWORD SizeOfCodeViewSymbols; PVOID CodeViewSymbols; LPSTR ImageFilePath; LPSTR ImageFileName; LPSTR DebugFilePath; DWORD TimeDateStamp; BOOL RomImage; PIMAGE_DEBUG_DIRECTORY DebugDirectory; DWORD NumberOfDebugDirectories; DWORD Reserved[ 3 ]; } IMAGE_DEBUG_INFORMATION, *PIMAGE_DEBUG_INFORMATION; PIMAGE_DEBUG_INFORMATION IMAGEAPI MapDebugInformation(HANDLE,LPSTR,LPSTR,DWORD); BOOL IMAGEAPI UnmapDebugInformation(PIMAGE_DEBUG_INFORMATION); HANDLE IMAGEAPI FindExecutableImage(LPSTR,LPSTR,LPSTR); BOOL IMAGEAPI SearchTreeForFile(LPSTR,LPSTR,LPSTR); BOOL IMAGEAPI MakeSureDirectoryPathExists(LPSTR); #define UNDNAME_COMPLETE 0 #define UNDNAME_NO_LEADING_UNDERSCORES 1 #define UNDNAME_NO_MS_KEYWORDS 2 #define UNDNAME_NO_FUNCTION_RETURNS 4 #define UNDNAME_NO_ALLOCATION_MODEL 8 #define UNDNAME_NO_ALLOCATION_LANGUAGE 16 #define UNDNAME_NO_MS_THISTYPE 32 #define UNDNAME_NO_CV_THISTYPE 64 #define UNDNAME_NO_THISTYPE 0x60 #define UNDNAME_NO_ACCESS_SPECIFIERS 0x80 #define UNDNAME_NO_THROW_SIGNATURES 0x100 #define UNDNAME_NO_MEMBER_TYPE 0x200 #define UNDNAME_NO_RETURN_UDT_MODEL 0x400 #define UNDNAME_32_BIT_DECODE 0x800 #define UNDNAME_NAME_ONLY 0x1000 #define UNDNAME_NO_ARGUMENTS 0x2000 #define UNDNAME_NO_SPECIAL_SYMS 0x4000 DWORD IMAGEAPI WINAPI UnDecorateSymbolName(LPSTR,LPSTR,DWORD,DWORD); typedef enum { AddrMode1616, AddrMode1632, AddrModeReal, AddrModeFlat } ADDRESS_MODE; typedef struct _ADDRESS { DWORD Offset; WORD Segment; ADDRESS_MODE Mode; } ADDRESS, *LPADDRESS; typedef struct _KD { DWORD Thread; DWORD ThCallbackStack; DWORD NextCallback; DWORD FramePointer; DWORD KiCallUserMode; DWORD KeUserCallbackDispatcher; } KDHELP, *PKDHELP; typedef struct _STACKFRAME { ADDRESS AddrPC; ADDRESS AddrReturn; ADDRESS AddrFrame; ADDRESS AddrStack; LPVOID FuncTableEntry; DWORD Params[4]; BOOL Far; BOOL Virtual; DWORD Reserved[3]; KDHELP KdHelp; } STACKFRAME, *LPSTACKFRAME; typedef BOOL (_stdcall *PREAD_PROCESS_MEMORY_ROUTINE)(HANDLE,LPCVOID,LPVOID,DWORD,LPDWORD); typedef LPVOID (_stdcall *PFUNCTION_TABLE_ACCESS_ROUTINE)(HANDLE,DWORD); typedef DWORD (_stdcall *PGET_MODULE_BASE_ROUTINE)(HANDLE,DWORD); typedef DWORD (_stdcall *PTRANSLATE_ADDRESS_ROUTINE)(HANDLE,HANDLE,LPADDRESS); BOOL IMAGEAPI StackWalk(DWORD,HANDLE,HANDLE,LPSTACKFRAME,LPVOID,PREAD_PROCESS_MEMORY_ROUTINE, PFUNCTION_TABLE_ACCESS_ROUTINE,PGET_MODULE_BASE_ROUTINE,PTRANSLATE_ADDRESS_ROUTINE); #define API_VERSION_NUMBER 4 typedef struct _VERSION { USHORT MajorVersion; USHORT MinorVersion; USHORT Revision; USHORT Reserved; } API_VERSION, *LPAPI_VERSION; LPAPI_VERSION ImagehlpApiVersion(VOID); LPAPI_VERSION ImagehlpApiVersionEx(LPAPI_VERSION); DWORD IMAGEAPI GetTimestampForLoadedLibrary(HMODULE); BOOL IMAGEAPI RemovePrivateCvSymbolic(PCHAR,PCHAR *,ULONG *); VOID IMAGEAPI RemoveRelocations(PCHAR); typedef BOOL (CALLBACK *PSYM_ENUMMODULES_CALLBACK)(LPSTR,ULONG,PVOID); typedef BOOL (CALLBACK *PSYM_ENUMSYMBOLS_CALLBACK)(LPSTR,ULONG,ULONG,PVOID); typedef BOOL (CALLBACK *PENUMLOADED_MODULES_CALLBACK)(LPSTR,ULONG,ULONG,PVOID); typedef BOOL (CALLBACK *PSYMBOL_REGISTERED_CALLBACK)(HANDLE,ULONG,PVOID,PVOID); #define SYMF_OMAP_GENERATED 1 #define SYMF_OMAP_MODIFIED 2 typedef enum { SymNone, SymCoff, SymCv, SymPdb, SymExport, SymDeferred, SymSym } SYM_TYPE; typedef struct _IMSYMBOL { DWORD SizeOfStruct; DWORD Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; typedef struct _IMAGEHLP_MODULE { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD ImageSize; DWORD TimeDateStamp; DWORD CheckSum; DWORD NumSyms; SYM_TYPE SymType; CHAR ModuleName[32]; CHAR ImageName[256]; CHAR LoadedImageName[256]; } IMAGEHLP_MODULE, *PIMAGEHLP_MODULE; #define CBA_DEFERRED_SYMBOL_LOAD_START 1 #define CBA_DEFERRED_SYMBOL_LOAD_COMPLETE 2 #define CBA_DEFERRED_SYMBOL_LOAD_FAILURE 3 #define CBA_SYMBOLS_UNLOADED 4 #define CBA_DUPLICATE_SYMBOL 5 typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD CheckSum; DWORD TimeDateStamp; CHAR FileName[MAX_PATH]; } IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD; typedef struct _IMAGEHLP_DUPLICATE_SYMBOL { DWORD SizeOfStruct; DWORD NumberOfDups; PIMAGEHLP_SYMBOL Symbol; ULONG SelectedSymbol; } IMAGEHLP_DUPLICATE_SYMBOL, *PIMAGEHLP_DUPLICATE_SYMBOL; #define SYMOPT_CASE_INSENSITIVE 1 #define SYMOPT_UNDNAME 2 #define SYMOPT_DEFERRED_LOADS 4 #define SYMOPT_NO_CPP 8 DWORD IMAGEAPI SymSetOptions(DWORD); DWORD IMAGEAPI SymGetOptions(VOID); BOOL IMAGEAPI SymCleanup(HANDLE); BOOL IMAGEAPI SymEnumerateModules(HANDLE,PSYM_ENUMMODULES_CALLBACK,PVOID); BOOL IMAGEAPI SymEnumerateSymbols(HANDLE,DWORD,PSYM_ENUMSYMBOLS_CALLBACK,PVOID); BOOL IMAGEAPI EnumerateLoadedModules(HANDLE,PENUMLOADED_MODULES_CALLBACK,PVOID); LPVOID IMAGEAPI SymFunctionTableAccess(HANDLE,DWORD); BOOL IMAGEAPI SymGetModuleInfo(HANDLE,DWORD,PIMAGEHLP_MODULE); DWORD IMAGEAPI SymGetModuleBase(HANDLE,DWORD); BOOL IMAGEAPI SymGetSymFromAddr(HANDLE,DWORD,PDWORD,PIMAGEHLP_SYMBOL); BOOL IMAGEAPI SymGetSymFromName(HANDLE,LPSTR,PIMAGEHLP_SYMBOL); BOOL IMAGEAPI SymGetSymNext(HANDLE,PIMAGEHLP_SYMBOL); BOOL IMAGEAPI SymGetSymPrev(HANDLE,PIMAGEHLP_SYMBOL); BOOL IMAGEAPI SymInitialize(HANDLE,LPSTR,BOOL); BOOL IMAGEAPI SymGetSearchPath(HANDLE,LPSTR,DWORD); BOOL IMAGEAPI SymSetSearchPath(HANDLE,LPSTR); DWORD IMAGEAPI SymLoadModule(HANDLE,HANDLE,PSTR,PSTR,DWORD,DWORD); BOOL IMAGEAPI SymUnloadModule(HANDLE,DWORD); BOOL IMAGEAPI SymUnDName(PIMAGEHLP_SYMBOL,LPSTR,DWORD); BOOL IMAGEAPI SymRegisterCallback(HANDLE,PSYMBOL_REGISTERED_CALLBACK,PVOID); #define CERT_PE_IMAGE_DIGEST_DEBUG_INFO 1 #define CERT_PE_IMAGE_DIGEST_RESOURCES 2 #define CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO 4 #define CERT_SECTION_TYPE_ANY 0xFF typedef PVOID DIGEST_HANDLE; typedef BOOL (WINAPI *DIGEST_FUNCTION)(DIGEST_HANDLE,PBYTE,DWORD); BOOL IMAGEAPI ImageGetDigestStream(HANDLE,DWORD,DIGEST_FUNCTION,DIGEST_HANDLE); BOOL IMAGEAPI ImageAddCertificate(HANDLE,LPWIN_CERTIFICATE,LPDWORD); BOOL IMAGEAPI ImageRemoveCertificate(HANDLE,DWORD); BOOL IMAGEAPI ImageEnumerateCertificates(HANDLE,WORD,LPDWORD,LPDWORD,...); BOOL IMAGEAPI ImageGetCertificateData(HANDLE,DWORD,LPWIN_CERTIFICATE,PDWORD); BOOL IMAGEAPI ImageGetCertificateHeader(HANDLE,DWORD,LPWIN_CERTIFICATE); #pragma pack(pop) #endif