Add support for the Win10 SDK to the PE reader

syzygy/pe/pe_structs.h

Index: syzygy/pe/pe_structs.h
diff --git a/syzygy/pe/pe_structs.h b/syzygy/pe/pe_structs.h
index 0fe86226ad9ba850688bada0372abb50e5323ea0..9ecfc2b6df7c7394415c1863d766172367f2e8f4 100644
--- a/syzygy/pe/pe_structs.h
+++ b/syzygy/pe/pe_structs.h
@@ -21,8 +21,18 @@
 
 namespace pe {
 
+// Redefinition of the IMAGE_LOAD_CONFIG_CODE_INTEGRITY structure. This
+// corresponds to the structure as encountered in the version 10.0+ of the
+// Windows SDK.
+struct IMAGE_LOAD_CONFIG_CODE_INTEGRITY {
+  WORD Flags;
+  WORD Catalog;
+  DWORD CatalogOffset;
+  DWORD Reserved;
+};
+
 // Redefinition of the IMAGE_LOAD_CONFIG_DIRECTORY structure. This corresponds
-// to the structure as encountered in the version 8.1 of the Windows SDK.
+// to the structure as encountered in the version 10.0.14393 of the Windows SDK.
 struct LoadConfigDirectory {
   // Fields available in v8.0+ of the Windows SDK.
   DWORD   Size;
@@ -52,15 +62,34 @@ struct LoadConfigDirectory {
   DWORD   GuardCFFunctionTable;           // VA
   DWORD   GuardCFFunctionCount;
   DWORD   GuardFlags;
+
+  // Fields available in v10.0+ of the Windows SDK.
+  IMAGE_LOAD_CONFIG_CODE_INTEGRITY CodeIntegrity;
+  DWORD GuardAddressTakenIatEntryTable;  // VA
+  DWORD GuardAddressTakenIatEntryCount;
+  DWORD GuardLongJumpTargetTable;  // VA
+  DWORD GuardLongJumpTargetCount;
+  DWORD DynamicValueRelocTable;  // VA
+  DWORD HybridMetadataPointer;
 };
 
-// An enum mapping the size of a given IMAGE_LOAD_CONFIG_DIRECTORY structure to
-// the corresponding version of the Windows SDK.
+// An enum mapping the size of a given IMAGE_LOAD_CONFIG_DIRECTORY structure
+// to the corresponding version of the Windows SDK.
 enum LoadConfigDirectoryVersion {
   kLoadConfigDirectorySizeUnknown = 0,
+  // Corresponds to the version 8.0 of the Windows SDK.
   kLoadConfigDirectorySize80 =
       offsetof(LoadConfigDirectory, GuardCFCheckFunctionPointer),
-  kLoadConfigDirectorySize81 = sizeof(LoadConfigDirectory),
+  // Corresponds to the version 8.1+ of the Windows SDK or to the version 10
+  // with the code integrity feature disabled.
+  kLoadConfigDirectorySizeNoCodeIntegrity =

[chrisha, 2017/03/23 21:29:29]

I'd prefer two identical enums:

kLoadConfigDirectorySize81:
kLoadConfigDirectorySize100NoCodeIntegrity:

[Sébastien Marchand, 2017/03/24 13:19:52]

Done.

+      offsetof(LoadConfigDirectory, CodeIntegrity),
+  // Corresponds to the version 10.0+ of the Windows SDK with the CFG feature
+  // disabled.
+  kLoadConfigDirectorySizeNoCFG =

[chrisha, 2017/03/23 21:29:30]

And kLoadConfigDirectorySize100NoCFG

This is more self-documenting.

[Sébastien Marchand, 2017/03/24 13:19:52]

Done.

+      offsetof(LoadConfigDirectory, GuardAddressTakenIatEntryTable),
+  // Corresponds to the full version 10.0 of the Windows SDK.
+  kLoadConfigDirectorySize100 = sizeof(LoadConfigDirectory),
 };
 
 };  // namespace pe