image_load_config_directory64 SAFESEH Inspection Table

Image_load_config_directory64

typedef struct {
DWORD Size;
DWORD TimeDateStamp;
WORD MajorVersion;
WORD minorversion;
DWORD globalflagsclear;
DWORD Globalflagsset;
DWORD criticalsectiondefaulttimeout;
ULONGLONG Decommitfreeblockthreshold;
ULONGLONG Decommittotalfreethreshold;
ULONGLONG lockprefixtable;
ULONGLONG Maximumallocationsize;
ULONGLONG Virtualmemorythreshold;
ULONGLONG Processaffinitymask;
DWORD Processheapflags;
WORD csdversion;
WORD Reserved1;
ULONGLONG Editlist;
ULONGLONG Securitycookie; Match Security Cookie
ULONGLONG sehandlertable; SEH Table Address Collection first address
ULONGLONG Sehandlercount; SEH Table Statistics
} image_load_config_directory64, *pimage_load_config_directory64;

_image_optional_header-Image_data_directory A structure in the Data directory (image_load_config_directory), The member of the struct sehandlertable is a pointer to the address list of a legitimate SEH handler, and the member Sehandlercount is the number. The image_load_config_directory structure only exists if the/SAFESEH option is set, so it can be used to determine if the PE file has the/SAFESEH link option added. The offset of this structure in PE is specified by the 11th item of the PE additional header image_data_directory array

image_load_config_directory64 SAFESEH Inspection Table