- ('MachineType', ('enum', '<H', '0x%X', {
- 0x0: 'IMAGE_FILE_MACHINE_UNKNOWN',
- 0x1d3: 'IMAGE_FILE_MACHINE_AM33',
- 0x866: 'IMAGE_FILE_MACHINE_AMD64',
- 0x1c0: 'IMAGE_FILE_MACHINE_ARM',
- 0xebc: 'IMAGE_FILE_MACHINE_EBC',
- 0x14c: 'IMAGE_FILE_MACHINE_I386',
- 0x200: 'IMAGE_FILE_MACHINE_IA64',
- 0x904: 'IMAGE_FILE_MACHINE_M32R',
- 0x266: 'IMAGE_FILE_MACHINE_MIPS16',
- 0x366: 'IMAGE_FILE_MACHINE_MIPSFPU',
- 0x466: 'IMAGE_FILE_MACHINE_MIPSFPU16',
- 0x1f0: 'IMAGE_FILE_MACHINE_POWERPC',
- 0x1f1: 'IMAGE_FILE_MACHINE_POWERPCFP',
- 0x166: 'IMAGE_FILE_MACHINE_R4000',
- 0x1a2: 'IMAGE_FILE_MACHINE_SH3',
- 0x1a3: 'IMAGE_FILE_MACHINE_SH3DSP',
- 0x1a6: 'IMAGE_FILE_MACHINE_SH4',
- 0x1a8: 'IMAGE_FILE_MACHINE_SH5',
- 0x1c2: 'IMAGE_FILE_MACHINE_THUMB',
- 0x169: 'IMAGE_FILE_MACHINE_WCEMIPSV2',
- })),
- ('NumberOfSections', ('scalar', '<H', '%d')),
- ('TimeDateStamp', ('scalar', '<L', '%d')),
- ('PointerToSymbolTable', ('scalar', '<L', '0x%0X')),
- ('NumberOfSymbols', ('scalar', '<L', '%d')),
- ('SizeOfOptionalHeader', ('scalar', '<H', '%d')),
- ('Characteristics', ('flags', '<H', '0x%x', [
- (0x0001, 'IMAGE_FILE_RELOCS_STRIPPED', ),
- (0x0002, 'IMAGE_FILE_EXECUTABLE_IMAGE', ),
- (0x0004, 'IMAGE_FILE_LINE_NUMS_STRIPPED', ),
- (0x0008, 'IMAGE_FILE_LOCAL_SYMS_STRIPPED', ),
- (0x0010, 'IMAGE_FILE_AGGRESSIVE_WS_TRIM', ),
- (0x0020, 'IMAGE_FILE_LARGE_ADDRESS_AWARE', ),
- (0x0080, 'IMAGE_FILE_BYTES_REVERSED_LO', ),
- (0x0100, 'IMAGE_FILE_32BIT_MACHINE', ),
- (0x0200, 'IMAGE_FILE_DEBUG_STRIPPED', ),
- (0x0400, 'IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP', ),
- (0x0800, 'IMAGE_FILE_NET_RUN_FROM_SWAP', ),
- (0x1000, 'IMAGE_FILE_SYSTEM', ),
- (0x2000, 'IMAGE_FILE_DLL', ),
- (0x4000, 'IMAGE_FILE_UP_SYSTEM_ONLY', ),
- (0x8000, 'IMAGE_FILE_BYTES_REVERSED_HI', ),
- ])),
- ('Sections', ('array', 'NumberOfSections', ('struct', [
- ('Name', ('scalar', '<8s', secname)),
- ('VirtualSize', ('scalar', '<L', '%d' )),
- ('VirtualAddress', ('scalar', '<L', '%d' )),
- ('SizeOfRawData', ('scalar', '<L', '%d' )),
- ('PointerToRawData', ('scalar', '<L', '0x%X' )),
- ('PointerToRelocations', ('scalar', '<L', '0x%X' )),
- ('PointerToLineNumbers', ('scalar', '<L', '0x%X' )),
- ('NumberOfRelocations', ('scalar', '<H', '%d' )),
- ('NumberOfLineNumbers', ('scalar', '<H', '%d' )),
- ('Charateristics', ('flags', '<L', '0x%X', [
- (0x00000008, 'IMAGE_SCN_TYPE_NO_PAD'),
- (0x00000020, 'IMAGE_SCN_CNT_CODE'),
- (0x00000040, 'IMAGE_SCN_CNT_INITIALIZED_DATA'),
- (0x00000080, 'IMAGE_SCN_CNT_UNINITIALIZED_DATA'),
- (0x00000100, 'IMAGE_SCN_LNK_OTHER'),
- (0x00000200, 'IMAGE_SCN_LNK_INFO'),
- (0x00000800, 'IMAGE_SCN_LNK_REMOVE'),
- (0x00001000, 'IMAGE_SCN_LNK_COMDAT'),
- (0x00008000, 'IMAGE_SCN_GPREL'),
- (0x00020000, 'IMAGE_SCN_MEM_PURGEABLE'),
- (0x00020000, 'IMAGE_SCN_MEM_16BIT'),
- (0x00040000, 'IMAGE_SCN_MEM_LOCKED'),
- (0x00080000, 'IMAGE_SCN_MEM_PRELOAD'),
- (0x00F00000, 'IMAGE_SCN_ALIGN', {
- 0x00100000: 'IMAGE_SCN_ALIGN_1BYTES',
- 0x00200000: 'IMAGE_SCN_ALIGN_2BYTES',
- 0x00300000: 'IMAGE_SCN_ALIGN_4BYTES',
- 0x00400000: 'IMAGE_SCN_ALIGN_8BYTES',
- 0x00500000: 'IMAGE_SCN_ALIGN_16BYTES',
- 0x00600000: 'IMAGE_SCN_ALIGN_32BYTES',
- 0x00700000: 'IMAGE_SCN_ALIGN_64BYTES',
- 0x00800000: 'IMAGE_SCN_ALIGN_128BYTES',
- 0x00900000: 'IMAGE_SCN_ALIGN_256BYTES',
- 0x00A00000: 'IMAGE_SCN_ALIGN_512BYTES',
- 0x00B00000: 'IMAGE_SCN_ALIGN_1024BYTES',
- 0x00C00000: 'IMAGE_SCN_ALIGN_2048BYTES',
- 0x00D00000: 'IMAGE_SCN_ALIGN_4096BYTES',
- 0x00E00000: 'IMAGE_SCN_ALIGN_8192BYTES',
- }),
- (0x01000000, 'IMAGE_SCN_LNK_NRELOC_OVFL'),
- (0x02000000, 'IMAGE_SCN_MEM_DISCARDABLE'),
- (0x04000000, 'IMAGE_SCN_MEM_NOT_CACHED'),
- (0x08000000, 'IMAGE_SCN_MEM_NOT_PAGED'),
- (0x10000000, 'IMAGE_SCN_MEM_SHARED'),
- (0x20000000, 'IMAGE_SCN_MEM_EXECUTE'),
- (0x40000000, 'IMAGE_SCN_MEM_READ'),
- (0x80000000, 'IMAGE_SCN_MEM_WRITE'),
- ])),
- ('SectionData', ('ptr', 'PointerToRawData', ('blob', 'SizeOfRawData'))),
- ('Relocations', ('ptr', 'PointerToRelocations', ('array', 'NumberOfRelocations', ('struct', [
- ('VirtualAddress', ('scalar', '<L', '0x%X')),
- ('SymbolTableIndex', ('scalar', '<L', '%d' )),
- ('Type', ('enum', '<H', '%d', ('MachineType', {
- 0x14c: {
- 0x0000: 'IMAGE_REL_I386_ABSOLUTE',
- 0x0001: 'IMAGE_REL_I386_DIR16',
- 0x0002: 'IMAGE_REL_I386_REL16',
- 0x0006: 'IMAGE_REL_I386_DIR32',
- 0x0007: 'IMAGE_REL_I386_DIR32NB',
- 0x0009: 'IMAGE_REL_I386_SEG12',
- 0x000A: 'IMAGE_REL_I386_SECTION',
- 0x000B: 'IMAGE_REL_I386_SECREL',
- 0x000C: 'IMAGE_REL_I386_TOKEN',
- 0x000D: 'IMAGE_REL_I386_SECREL7',
- 0x0014: 'IMAGE_REL_I386_REL32',
- },
- }))),
- ('SymbolName', ('ptr', '+ PointerToSymbolTable * - SymbolTableIndex 1 18', ('scalar', '<8s', symname)))
- ])))),
- ]))),
- ('Symbols', ('ptr', 'PointerToSymbolTable', ('byte-array', '* NumberOfSymbols 18', ('struct', [
- ('Name', ('scalar', '<8s', symname)),
- ('Value', ('scalar', '<L', '%d' )),
- ('SectionNumber', ('scalar', '<H', '%d' )),
- ('SimpleType', ('enum', '<B', '%d', {
- 0: 'IMAGE_SYM_TYPE_NULL',
- 1: 'IMAGE_SYM_TYPE_VOID',
- 2: 'IMAGE_SYM_TYPE_CHAR',
- 3: 'IMAGE_SYM_TYPE_SHORT',
- 4: 'IMAGE_SYM_TYPE_INT',
- 5: 'IMAGE_SYM_TYPE_LONG',
- 6: 'IMAGE_SYM_TYPE_FLOAT',
- 7: 'IMAGE_SYM_TYPE_DOUBLE',
- 8: 'IMAGE_SYM_TYPE_STRUCT',
- 9: 'IMAGE_SYM_TYPE_UNION',
- 10: 'IMAGE_SYM_TYPE_ENUM',
- 11: 'IMAGE_SYM_TYPE_MOE',
- 12: 'IMAGE_SYM_TYPE_BYTE',
- 13: 'IMAGE_SYM_TYPE_WORD',
- 14: 'IMAGE_SYM_TYPE_UINT',
- 15: 'IMAGE_SYM_TYPE_DWORD',
- })),
- ('ComplexType', ('enum', '<B', '%d', {
- 0: 'IMAGE_SYM_DTYPE_NULL',
- 1: 'IMAGE_SYM_DTYPE_POINTER',
- 2: 'IMAGE_SYM_DTYPE_FUNCTION',
- 3: 'IMAGE_SYM_DTYPE_ARRAY',
- })),
- ('StorageClass', ('enum', '<B', '%d', {
- -1: 'IMAGE_SYM_CLASS_END_OF_FUNCTION',
- 0: 'IMAGE_SYM_CLASS_NULL',
- 1: 'IMAGE_SYM_CLASS_AUTOMATIC',
- 2: 'IMAGE_SYM_CLASS_EXTERNAL',
- 3: 'IMAGE_SYM_CLASS_STATIC',
- 4: 'IMAGE_SYM_CLASS_REGISTER',
- 5: 'IMAGE_SYM_CLASS_EXTERNAL_DEF',
- 6: 'IMAGE_SYM_CLASS_LABEL',
- 7: 'IMAGE_SYM_CLASS_UNDEFINED_LABEL',
- 8: 'IMAGE_SYM_CLASS_MEMBER_OF_STRUCT',
- 9: 'IMAGE_SYM_CLASS_ARGUMENT',
- 10: 'IMAGE_SYM_CLASS_STRUCT_TAG',
- 11: 'IMAGE_SYM_CLASS_MEMBER_OF_UNION',
- 12: 'IMAGE_SYM_CLASS_UNION_TAG',
- 13: 'IMAGE_SYM_CLASS_TYPE_DEFINITION',
- 14: 'IMAGE_SYM_CLASS_UNDEFINED_STATIC',
- 15: 'IMAGE_SYM_CLASS_ENUM_TAG',
- 16: 'IMAGE_SYM_CLASS_MEMBER_OF_ENUM',
- 17: 'IMAGE_SYM_CLASS_REGISTER_PARAM',
- 18: 'IMAGE_SYM_CLASS_BIT_FIELD',
- 100: 'IMAGE_SYM_CLASS_BLOCK',
- 101: 'IMAGE_SYM_CLASS_FUNCTION',
- 102: 'IMAGE_SYM_CLASS_END_OF_STRUCT',
- 103: 'IMAGE_SYM_CLASS_FILE',
- 104: 'IMAGE_SYM_CLASS_SECTION',
- 105: 'IMAGE_SYM_CLASS_WEAK_EXTERNAL',
- 107: 'IMAGE_SYM_CLASS_CLR_TOKEN',
- })),
- ('NumberOfAuxSymbols', ('scalar', '<B', '%d' )),
- ('AuxillaryData', ('blob', '* NumberOfAuxSymbols 18')),
- ])))),
+ ('MachineType', ('enum', '<H', '0x%X', {
+ 0x0: 'IMAGE_FILE_MACHINE_UNKNOWN',
+ 0x1d3: 'IMAGE_FILE_MACHINE_AM33',
+ 0x8664: 'IMAGE_FILE_MACHINE_AMD64',
+ 0x1c0: 'IMAGE_FILE_MACHINE_ARM',
+ 0xebc: 'IMAGE_FILE_MACHINE_EBC',
+ 0x14c: 'IMAGE_FILE_MACHINE_I386',
+ 0x200: 'IMAGE_FILE_MACHINE_IA64',
+ 0x904: 'IMAGE_FILE_MACHINE_M32R',
+ 0x266: 'IMAGE_FILE_MACHINE_MIPS16',
+ 0x366: 'IMAGE_FILE_MACHINE_MIPSFPU',
+ 0x466: 'IMAGE_FILE_MACHINE_MIPSFPU16',
+ 0x1f0: 'IMAGE_FILE_MACHINE_POWERPC',
+ 0x1f1: 'IMAGE_FILE_MACHINE_POWERPCFP',
+ 0x166: 'IMAGE_FILE_MACHINE_R4000',
+ 0x1a2: 'IMAGE_FILE_MACHINE_SH3',
+ 0x1a3: 'IMAGE_FILE_MACHINE_SH3DSP',
+ 0x1a6: 'IMAGE_FILE_MACHINE_SH4',
+ 0x1a8: 'IMAGE_FILE_MACHINE_SH5',
+ 0x1c2: 'IMAGE_FILE_MACHINE_THUMB',
+ 0x169: 'IMAGE_FILE_MACHINE_WCEMIPSV2',
+ })),
+ ('NumberOfSections', ('scalar', '<H', '%d')),
+ ('TimeDateStamp', ('scalar', '<L', '%d')),
+ ('PointerToSymbolTable', ('scalar', '<L', '0x%0X')),
+ ('NumberOfSymbols', ('scalar', '<L', '%d')),
+ ('SizeOfOptionalHeader', ('scalar', '<H', '%d')),
+ ('Characteristics', ('flags', '<H', '0x%x', [
+ (0x0001, 'IMAGE_FILE_RELOCS_STRIPPED', ),
+ (0x0002, 'IMAGE_FILE_EXECUTABLE_IMAGE', ),
+ (0x0004, 'IMAGE_FILE_LINE_NUMS_STRIPPED', ),
+ (0x0008, 'IMAGE_FILE_LOCAL_SYMS_STRIPPED', ),
+ (0x0010, 'IMAGE_FILE_AGGRESSIVE_WS_TRIM', ),
+ (0x0020, 'IMAGE_FILE_LARGE_ADDRESS_AWARE', ),
+ (0x0080, 'IMAGE_FILE_BYTES_REVERSED_LO', ),
+ (0x0100, 'IMAGE_FILE_32BIT_MACHINE', ),
+ (0x0200, 'IMAGE_FILE_DEBUG_STRIPPED', ),
+ (0x0400, 'IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP', ),
+ (0x0800, 'IMAGE_FILE_NET_RUN_FROM_SWAP', ),
+ (0x1000, 'IMAGE_FILE_SYSTEM', ),
+ (0x2000, 'IMAGE_FILE_DLL', ),
+ (0x4000, 'IMAGE_FILE_UP_SYSTEM_ONLY', ),
+ (0x8000, 'IMAGE_FILE_BYTES_REVERSED_HI', ),
+ ])),
+ ('Sections', ('array', '1', 'NumberOfSections', ('struct', [
+ ('Name', ('scalar', '<8s', secname)),
+ ('VirtualSize', ('scalar', '<L', '%d' )),
+ ('VirtualAddress', ('scalar', '<L', '%d' )),
+ ('SizeOfRawData', ('scalar', '<L', '%d' )),
+ ('PointerToRawData', ('scalar', '<L', '0x%X' )),
+ ('PointerToRelocations', ('scalar', '<L', '0x%X' )),
+ ('PointerToLineNumbers', ('scalar', '<L', '0x%X' )),
+ ('NumberOfRelocations', ('scalar', '<H', '%d' )),
+ ('NumberOfLineNumbers', ('scalar', '<H', '%d' )),
+ ('Charateristics', ('flags', '<L', '0x%X', [
+ (0x00000008, 'IMAGE_SCN_TYPE_NO_PAD'),
+ (0x00000020, 'IMAGE_SCN_CNT_CODE'),
+ (0x00000040, 'IMAGE_SCN_CNT_INITIALIZED_DATA'),
+ (0x00000080, 'IMAGE_SCN_CNT_UNINITIALIZED_DATA'),
+ (0x00000100, 'IMAGE_SCN_LNK_OTHER'),
+ (0x00000200, 'IMAGE_SCN_LNK_INFO'),
+ (0x00000800, 'IMAGE_SCN_LNK_REMOVE'),
+ (0x00001000, 'IMAGE_SCN_LNK_COMDAT'),
+ (0x00008000, 'IMAGE_SCN_GPREL'),
+ (0x00020000, 'IMAGE_SCN_MEM_PURGEABLE'),
+ (0x00020000, 'IMAGE_SCN_MEM_16BIT'),
+ (0x00040000, 'IMAGE_SCN_MEM_LOCKED'),
+ (0x00080000, 'IMAGE_SCN_MEM_PRELOAD'),
+ (0x00F00000, 'IMAGE_SCN_ALIGN', {
+ 0x00100000: 'IMAGE_SCN_ALIGN_1BYTES',
+ 0x00200000: 'IMAGE_SCN_ALIGN_2BYTES',
+ 0x00300000: 'IMAGE_SCN_ALIGN_4BYTES',
+ 0x00400000: 'IMAGE_SCN_ALIGN_8BYTES',
+ 0x00500000: 'IMAGE_SCN_ALIGN_16BYTES',
+ 0x00600000: 'IMAGE_SCN_ALIGN_32BYTES',
+ 0x00700000: 'IMAGE_SCN_ALIGN_64BYTES',
+ 0x00800000: 'IMAGE_SCN_ALIGN_128BYTES',
+ 0x00900000: 'IMAGE_SCN_ALIGN_256BYTES',
+ 0x00A00000: 'IMAGE_SCN_ALIGN_512BYTES',
+ 0x00B00000: 'IMAGE_SCN_ALIGN_1024BYTES',
+ 0x00C00000: 'IMAGE_SCN_ALIGN_2048BYTES',
+ 0x00D00000: 'IMAGE_SCN_ALIGN_4096BYTES',
+ 0x00E00000: 'IMAGE_SCN_ALIGN_8192BYTES',
+ }),
+ (0x01000000, 'IMAGE_SCN_LNK_NRELOC_OVFL'),
+ (0x02000000, 'IMAGE_SCN_MEM_DISCARDABLE'),
+ (0x04000000, 'IMAGE_SCN_MEM_NOT_CACHED'),
+ (0x08000000, 'IMAGE_SCN_MEM_NOT_PAGED'),
+ (0x10000000, 'IMAGE_SCN_MEM_SHARED'),
+ (0x20000000, 'IMAGE_SCN_MEM_EXECUTE'),
+ (0x40000000, 'IMAGE_SCN_MEM_READ'),
+ (0x80000000, 'IMAGE_SCN_MEM_WRITE'),
+ ])),
+ ('SectionData', ('ptr', 'PointerToRawData', ('blob', 'SizeOfRawData'))),
+ ('Relocations', ('ptr', 'PointerToRelocations', ('array', '0', 'NumberOfRelocations', ('struct', [
+ ('VirtualAddress', ('scalar', '<L', '0x%X')),
+ ('SymbolTableIndex', ('scalar', '<L', '%d' )),
+ ('Type', ('enum', '<H', '%d', ('MachineType', {
+ 0x14c: {
+ 0x0000: 'IMAGE_REL_I386_ABSOLUTE',
+ 0x0001: 'IMAGE_REL_I386_DIR16',
+ 0x0002: 'IMAGE_REL_I386_REL16',
+ 0x0006: 'IMAGE_REL_I386_DIR32',
+ 0x0007: 'IMAGE_REL_I386_DIR32NB',
+ 0x0009: 'IMAGE_REL_I386_SEG12',
+ 0x000A: 'IMAGE_REL_I386_SECTION',
+ 0x000B: 'IMAGE_REL_I386_SECREL',
+ 0x000C: 'IMAGE_REL_I386_TOKEN',
+ 0x000D: 'IMAGE_REL_I386_SECREL7',
+ 0x0014: 'IMAGE_REL_I386_REL32',
+ },
+ 0x8664: {
+ 0x0000: 'IMAGE_REL_AMD64_ABSOLUTE',
+ 0x0001: 'IMAGE_REL_AMD64_ADDR64',
+ 0x0002: 'IMAGE_REL_AMD64_ADDR32',
+ 0x0003: 'IMAGE_REL_AMD64_ADDR32NB',
+ 0x0004: 'IMAGE_REL_AMD64_REL32',
+ 0x0005: 'IMAGE_REL_AMD64_REL32_1',
+ 0x0006: 'IMAGE_REL_AMD64_REL32_2',
+ 0x0007: 'IMAGE_REL_AMD64_REL32_3',
+ 0x0008: 'IMAGE_REL_AMD64_REL32_4',
+ 0x0009: 'IMAGE_REL_AMD64_REL32_5',
+ 0x000A: 'IMAGE_REL_AMD64_SECTION',
+ 0x000B: 'IMAGE_REL_AMD64_SECREL',
+ 0x000C: 'IMAGE_REL_AMD64_SECREL7',
+ 0x000D: 'IMAGE_REL_AMD64_TOKEN',
+ 0x000E: 'IMAGE_REL_AMD64_SREL32',
+ 0x000F: 'IMAGE_REL_AMD64_PAIR',
+ 0x0010: 'IMAGE_REL_AMD64_SSPAN32',
+ },
+ }))),
+ ('SymbolName', ('ptr', '+ PointerToSymbolTable * SymbolTableIndex 18', ('scalar', '<8s', symname)))
+ ])))),
+ ]))),
+ ('Symbols', ('ptr', 'PointerToSymbolTable', ('byte-array', '18', '* NumberOfSymbols 18', ('struct', [
+ ('Name', ('scalar', '<8s', symname)),
+ ('Value', ('scalar', '<L', '%d' )),
+ ('SectionNumber', ('scalar', '<H', '%d' )),
+ ('_Type', ('scalar', '<H', None )),
+ ('SimpleType', ('enum', '& _Type 15', '%d', {
+ 0: 'IMAGE_SYM_TYPE_NULL',
+ 1: 'IMAGE_SYM_TYPE_VOID',
+ 2: 'IMAGE_SYM_TYPE_CHAR',
+ 3: 'IMAGE_SYM_TYPE_SHORT',
+ 4: 'IMAGE_SYM_TYPE_INT',
+ 5: 'IMAGE_SYM_TYPE_LONG',
+ 6: 'IMAGE_SYM_TYPE_FLOAT',
+ 7: 'IMAGE_SYM_TYPE_DOUBLE',
+ 8: 'IMAGE_SYM_TYPE_STRUCT',
+ 9: 'IMAGE_SYM_TYPE_UNION',
+ 10: 'IMAGE_SYM_TYPE_ENUM',
+ 11: 'IMAGE_SYM_TYPE_MOE',
+ 12: 'IMAGE_SYM_TYPE_BYTE',
+ 13: 'IMAGE_SYM_TYPE_WORD',
+ 14: 'IMAGE_SYM_TYPE_UINT',
+ 15: 'IMAGE_SYM_TYPE_DWORD',
+ })), # (Type & 0xF0) >> 4
+ ('ComplexType', ('enum', '>> & _Type 240 4', '%d', {
+ 0: 'IMAGE_SYM_DTYPE_NULL',
+ 1: 'IMAGE_SYM_DTYPE_POINTER',
+ 2: 'IMAGE_SYM_DTYPE_FUNCTION',
+ 3: 'IMAGE_SYM_DTYPE_ARRAY',
+ })),
+ ('StorageClass', ('enum', '<B', '%d', {
+ -1: 'IMAGE_SYM_CLASS_END_OF_FUNCTION',
+ 0: 'IMAGE_SYM_CLASS_NULL',
+ 1: 'IMAGE_SYM_CLASS_AUTOMATIC',
+ 2: 'IMAGE_SYM_CLASS_EXTERNAL',
+ 3: 'IMAGE_SYM_CLASS_STATIC',
+ 4: 'IMAGE_SYM_CLASS_REGISTER',
+ 5: 'IMAGE_SYM_CLASS_EXTERNAL_DEF',
+ 6: 'IMAGE_SYM_CLASS_LABEL',
+ 7: 'IMAGE_SYM_CLASS_UNDEFINED_LABEL',
+ 8: 'IMAGE_SYM_CLASS_MEMBER_OF_STRUCT',
+ 9: 'IMAGE_SYM_CLASS_ARGUMENT',
+ 10: 'IMAGE_SYM_CLASS_STRUCT_TAG',
+ 11: 'IMAGE_SYM_CLASS_MEMBER_OF_UNION',
+ 12: 'IMAGE_SYM_CLASS_UNION_TAG',
+ 13: 'IMAGE_SYM_CLASS_TYPE_DEFINITION',
+ 14: 'IMAGE_SYM_CLASS_UNDEFINED_STATIC',
+ 15: 'IMAGE_SYM_CLASS_ENUM_TAG',
+ 16: 'IMAGE_SYM_CLASS_MEMBER_OF_ENUM',
+ 17: 'IMAGE_SYM_CLASS_REGISTER_PARAM',
+ 18: 'IMAGE_SYM_CLASS_BIT_FIELD',
+ 100: 'IMAGE_SYM_CLASS_BLOCK',
+ 101: 'IMAGE_SYM_CLASS_FUNCTION',
+ 102: 'IMAGE_SYM_CLASS_END_OF_STRUCT',
+ 103: 'IMAGE_SYM_CLASS_FILE',
+ 104: 'IMAGE_SYM_CLASS_SECTION',
+ 105: 'IMAGE_SYM_CLASS_WEAK_EXTERNAL',
+ 107: 'IMAGE_SYM_CLASS_CLR_TOKEN',
+ })),
+ ('NumberOfAuxSymbols', ('scalar', '<B', '%d' )),
+ ('AuxillaryData', ('blob', '* NumberOfAuxSymbols 18')),
+ ])))),