x86 / ntoskrnl

_IMAGE_HEADER

← first 1 build latest →

incomplete derived from kernel debugger

struct _IMAGE_HEADER {
unsigned long SignatureBytes;/* 0x0 4 */
unsigned char Endian;/* 0x4 1 */
unsigned char Reserved1;/* 0x5 1 */
unsigned short CPUType;/* 0x6 2 */
unsigned short OSType;/* 0x8 2 */
unsigned short SubSystem;/* 0xa 2 */
unsigned short OSMajor;/* 0xc 2 */
unsigned short OSMinor;/* 0xe 2 */
unsigned short LinkerMajor;/* 0x10 2 */
unsigned short LinkerMinor;/* 0x12 2 */
unsigned short UserMajor;/* 0x14 2 */
unsigned short UserMinor;/* 0x16 2 */
unsigned long ModuleFlags;/* 0x18 4 */
unsigned long Reserved2;/* 0x1c 4 */
unsigned long FileCheckSum;/* 0x20 4 */
unsigned long EntryPointRVA;/* 0x24 4 */
unsigned long ImageBase;/* 0x28 4 */
unsigned long ImageSize;/* 0x2c 4 */
unsigned long HeaderSize;/* 0x30 4 */
unsigned long FileAlign;/* 0x34 4 */
unsigned long PageSize;/* 0x38 4 */
unsigned long TimeStamp;/* 0x3c 4 */
/* ── cacheline 1 boundary (64 bytes) ── */
unsigned long StackReserve;/* 0x40 4 */
unsigned long StackCommit;/* 0x44 4 */
unsigned long HeapReserve;/* 0x48 4 */
unsigned long HeapCommit;/* 0x4c 4 */
unsigned long NumberOfObjects;/* 0x50 4 */
unsigned long ObjectTableRVA;/* 0x54 4 */
unsigned long NumberOfDirectives;/* 0x58 4 */
unsigned long DirectiveTableRVA;/* 0x5c 4 */
unsigned long Reserved3;/* 0x60 4 */
unsigned long Reserved4;/* 0x64 4 */
unsigned long Reserved5;/* 0x68 4 */
unsigned long NumberOfSpecialRVAs;/* 0x6c 4 */
};
/* computed: October 1991 pre-release CD, SETUP/DBUGDISK/I386KD.EXE CodeView 3 types (compiled 1-byte packed for its 16-bit host), laid out with natural 32-bit alignment; _KPCR agrees with NT 3.1's offsets on every shared member */
size 168 (0xa8)35 members0 holespadding 03 cachelines