Structs§
- Load
Config Code Integrity - Represents the code integrity configuration used in load configuration.
- Load
Config Data - Represents a PE load config directory data.
- Load
Config Directory - Represents the 32/64-bit Load Configuration directory structure of a PE file.
Constants§
- DONT_
RESOLVE_ DLL_ REFERENCES - Indicate that the system does not resolve DLL references for the loaded module.
- IMAGE_
GUARD_ CASTGUARD_ PRESENT - Indicate that the module has CastGuard instrumentation present.
- IMAGE_
GUARD_ CFW_ INSTRUMENTED - Indicate that the module performs control flow and write integrity checks.
- IMAGE_
GUARD_ CF_ ENABLE_ EXPORT_ SUPPRESSION - Indicate that the module enables suppression of exports.
- IMAGE_
GUARD_ CF_ EXPORT_ SUPPRESSION_ INFO_ PRESENT - Indicate that the module contains suppressed export information and the address-taken IAT table is present.
- IMAGE_
GUARD_ CF_ FUNCTION_ TABLE_ PRESENT - Indicate that the module contains valid control flow target metadata.
- IMAGE_
GUARD_ CF_ INSTRUMENTED - Indicate that the module performs control flow integrity checks using system-supplied support.
- IMAGE_
GUARD_ CF_ LONGJUMP_ TABLE_ PRESENT - Indicate that the module contains longjmp target information.
- IMAGE_
GUARD_ DELAYLOAD_ IAT_ IN_ ITS_ OWN_ SECTION - Indicate that the delay-load import table is in its own .didat section that can be freely reprotected.
- IMAGE_
GUARD_ EH_ CONTINUATION_ TABLE_ PRESENT - Indicate that the module contains EH continuation target information.
- IMAGE_
GUARD_ MEMCPY_ PRESENT - Indicate that the module has Guarded Memcpy instrumentation present.
- IMAGE_
GUARD_ PROTECT_ DELAYLOAD_ IAT - Indicate that the module supports read-only delay load IAT.
- IMAGE_
GUARD_ RETPOLINE_ PRESENT - Indicate that the module was built with retpoline support.
- IMAGE_
GUARD_ RF_ ENABLE - Indicate that the module requests the OS to enable return flow protection.
- IMAGE_
GUARD_ RF_ INSTRUMENTED - Indicate that the module contains return flow instrumentation and metadata.
- IMAGE_
GUARD_ RF_ STRICT - Indicate that the module requests the OS to enable return flow protection in strict mode.
- IMAGE_
GUARD_ SECURITY_ COOKIE_ UNUSED - Indicate that the module does not make use of the /GS security cookie.
- IMAGE_
GUARD_ XFG_ ENABLED - Indicate that the module was built with XFG (Cross Function Guard), now deprecated.
- LOAD_
IGNORE_ CODE_ AUTHZ_ LEVEL - Indicate that the system ignores the code authorization level.
- LOAD_
LIBRARY_ AS_ DATAFILE - Indicate that the DLL is loaded as a data file.
- LOAD_
LIBRARY_ AS_ DATAFILE_ EXCLUSIVE - Indicate that the DLL is loaded as a data file and cannot be loaded again as an executable.
- LOAD_
LIBRARY_ AS_ IMAGE_ RESOURCE - Indicate that the DLL is loaded as an image resource.
- LOAD_
LIBRARY_ OS_ INTEGRITY_ CONTINUITY - Indicate that the system uses OS integrity continuity policies when loading the DLL.
- LOAD_
LIBRARY_ REQUIRE_ SIGNED_ TARGET - Indicate that the DLL target must be signed.
- LOAD_
LIBRARY_ SAFE_ CURRENT_ DIRS - Indicate that the current directory is searched only when it is safe to do so.
- LOAD_
LIBRARY_ SEARCH_ APPLICATION_ DIR - Indicate that the system searches the application directory.
- LOAD_
LIBRARY_ SEARCH_ DEFAULT_ DIRS - Indicate that the system uses the default DLL search directories.
- LOAD_
LIBRARY_ SEARCH_ DLL_ LOAD_ DIR - Indicate that the system searches the directory that contains the DLL being loaded.
- LOAD_
LIBRARY_ SEARCH_ SYSTE M32 - Indicate that the system searches the System32 directory.
- LOAD_
LIBRARY_ SEARCH_ SYSTE M32_ NO_ FORWARDER - Indicate that the system searches System32 without resolving forwarded exports.
- LOAD_
LIBRARY_ SEARCH_ USER_ DIRS - Indicate that the system searches directories added with
AddDllDirectory. - LOAD_
PACKAGED_ LIBRARY - Indicate that the DLL is loaded as a packaged library.
- LOAD_
WITH_ ALTERED_ SEARCH_ PATH - Indicate that the DLL is loaded with an altered search path.