将位段定义成结构体,所有的字段名都要大写,不然会报错(14版本),不知道是不是bug.
typedef struct
{
WORD IMAGE_LIBRARY_PROCESS_INIT :1 <comment="0x0001 Reserved">;
WORD IMAGE_LIBRARY_PROCESS_TERM :1 <comment="0x0002 Reserved">;
WORD IMAGE_LIBRARY_THREAD_INIT :1 <comment="0x0004 Reserved">;
WORD IMAGE_LIBRARY_THREAD_TERM :1 <comment="0x0008 Reserved">;
WORD :1 <comment="0x0010",hidden=true>;
WORD IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA :1 <comment="0x0020">;
WORD IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE :1 <comment="0x0040">;
WORD IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY :1 <comment="0x0080">;
WORD IMAGE_DLLCHARACTERISTICS_NX_COMPAT :1 <comment="0x0100">;
WORD IMAGE_DLLCHARACTERISTICS_NO_ISOLATION :1 <comment="0x0200">;
WORD IMAGE_DLLCHARACTERISTICS_NO_SEH :1 <comment="0x0400">;
WORD IMAGE_DLLCHARACTERISTICS_NO_BIND :1 <comment="0x0800">;
WORD :1 <comment="0x1000",hidden=true>;
WORD IMAGE_DLLCHARACTERISTICS_WDM_DRIVER :1 <comment="0x2000">;
WORD :1 <comment="0x4000",hidden=true>;
WORD IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE :1 <comment="0x8000">;
} DLL_CHARACTERISTICS <comment="WORD", read=ReadDllCharacteristics>;
typedef struct
{
OPTIONAL_MAGIC Magic <format=hex>;
BYTE MajorLinkerVersion;
BYTE MinorLinkerVersion;
DWORD SizeOfCode <format=hex>;
DWORD SizeOfInitializedData;
DWORD SizeOfUninitializedData;
DWORD AddressOfEntryPoint <format=hex,comment=CommentRVA2FOA,fgcolor=cPurple>;
DWORD BaseOfCode <format=hex,comment=CommentRVA2FOA>;
DWORD BaseOfData <format=hex,comment=CommentRVA2FOA>;
DWORD ImageBase <format=hex>;
DWORD SectionAlignment <format=hex>;
DWORD FileAlignment <format=hex>;
WORD MajorOperatingSystemVersion;
WORD MinorOperatingSystemVersion;
WORD MajorImageVersion;
WORD MinorImageVersion;
WORD MajorSubsystemVersion;
WORD MinorSubsystemVersion;
DWORD Win32VersionValue;
DWORD SizeOfImage <format=hex>;
DWORD SizeOfHeaders <format=hex>;
DWORD CheckSum <format=hex>;
IMAGE_SUBSYSTEM Subsystem;
DLL_CHARACTERISTICS DllCharacteristics;
DWORD SizeOfStackReserve <format=hex>;
DWORD SizeOfStackCommit <format=hex>;
DWORD SizeOfHeapReserve <format=hex>;
DWORD SizeOfHeapCommit <format=hex>;
DWORD LoaderFlags;
DWORD NumberOfRvaAndSizes;
IMAGE_DATA_DIRECTORY_ARRAY DataDirArray;
} IMAGE_OPTIONAL_HEADER32;