IMAGE_LOAD_CONFIG_DIRECTORY This analyzer enhances the representation and underlying data of the PE LoadConfiguration structure within Ghidra.
IMAGE_LOAD_CONFIG_DIRECTORY64_140011b20 XREF[1]: 1400001c0 ( * ) 140011b20 40 01 00 00 00 00 00 00 00 00 00 00 00 IMAGE_LOAD_CONFIG_DIRECTORY64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 140011b20 40 01 00 00 ddw 140h S i z e XREF[1]: 1400001c0 ( * ) 140011b24 00 00 00 00 ddw 0h T i m e D a t e S t a m p 140011b28 00 00 dw 0h M a j o r V e r s i o n 140011b2a 00 00 dw 0h M i n o r V e r s i o n 140011b2c 00 00 00 00 ddw 0h G l o b a l F l a g s C l e a r 140011b30 00 00 00 00 ddw 0h G l o b a l F l a g s S e t 140011b34 00 00 00 00 ddw 0h C r i t i c a l S e c t i o n D e f a u l t T i m e o u t 140011b38 00 00 00 00 00 00 00 00 dq 0h D e C o m m i t F r e e B l o c k T h r e s h o l d 140011b40 00 00 00 00 00 00 00 00 dq 0h D e C o m m i t T o t a l F r e e T h r e s h o l d 140011b48 00 00 00 00 00 00 00 00 addr 00000000 L o c k P r e f i x T a b l e 140011b50 00 00 00 00 00 00 00 00 dq 0h M a x i m u m A l l o c a t i o n S i z e 140011b58 00 00 00 00 00 00 00 00 dq 0h V i r t u a l M e m o r y T h r e s h o l d 140011b60 00 00 00 00 00 00 00 00 dq 0h P r o c e s s A f f i n i t y M a s k 140011b68 00 00 00 00 ddw 0h P r o c e s s H e a p F l a g s 140011b6c 00 00 dw 0h C s d V e r s i o n 140011b6e 00 00 dw 0h D e p e n d e n t L o a d F l a g s 140011b70 00 00 00 00 00 00 00 00 addr 00000000 E d i t L i s t 140011b78 40 60 01 40 01 00 00 00 addr DAT_140016040 S e c u r i t y C o o k i e = 32h 2 140011b80 00 00 00 00 00 00 00 00 addr 00000000 S E H a n d l e r T a b l e 140011b88 00 00 00 00 00 00 00 00 dq 0h S E H a n d l e r C o u n t 140011b90 70 10 01 40 01 00 00 00 addr PTR__guard_check_icall_140011070 G u a r d C F C C h e c k F u n c t i o n P o i n t e r = 14000b8d8 140011b98 80 10 01 40 01 00 00 00 addr PTR__guard_dispatch_icall_140011080 G u a r d C F D i s p a t c h F u n c t i o n P o i n t e r = 14000e2c0 140011ba0 00 00 00 00 00 00 00 00 addr 00000000 G u a r d C F F u n c t i o n T a b l e 140011ba8 00 00 00 00 00 00 00 00 dq 0h G u a r d C F F u n c t i o n C o u n t 140011bb0 00 01 00 00 IMAGE_GUARD_FLAGS IMAGE_GUARD_CF_INSTRUMENTED G u a r d F l a g s 140011bb4 00 00 00 00 00 00 00 00 00 00 00 00 IMAGE_LOAD_CONFIG_CODE_I C o d e I n t e g r i t y 140011bc0 00 00 00 00 00 00 00 00 addr 00000000 G u a r d A d d r e s s T a k e n I a t E n t r y T a b l e 140011bc8 00 00 00 00 00 00 00 00 dq 0h G u a r d A d d r e s s T a k e n I a t E n t r y C o u n t 140011bd0 00 00 00 00 00 00 00 00 addr 00000000 G u a r d L o n g J u m p T a r g e t T a b l e 140011bd8 00 00 00 00 00 00 00 00 dq 0h G u a r d L o n g J u m p T a r g e t C o u n t 140011be0 00 00 00 00 00 00 00 00 addr 00000000 D y n a m i c V a l u e R e l o c T a b l e 140011be8 f8 11 01 40 01 00 00 00 addr DAT_1400111f8 C H P E M e t a d a t a P o i n t e r = 02h 140011bf0 00 00 00 00 00 00 00 00 addr 00000000 G u a r d R F F a i l u r e R o u t i n e 140011bf8 00 00 00 00 00 00 00 00 addr 00000000 G u a r d R F F a i l u r e R o u t i n e F u n c t i o n P o i n t e r 140011c00 00 00 00 00 ddw 0h D y n a m i c V a l u e R e l o c T a b l e O f f s e t 140011c04 00 00 dw 0h D y n a m i c V a l u e R e l o c T a b l e S e c t i o n 140011c06 00 00 dw 0h R e s e r v ed1 140011c08 00 00 00 00 00 00 00 00 addr 00000000 G u a r d R F V e r i f y S t a c k P o i n t e r F u n c t i o n P o i n 140011c10 00 00 00 00 ddw 0h H o t P a t c h T a b l e O f f s e t 140011c14 00 00 00 00 ddw 0h R e s e r v ed2 140011c18 00 00 00 00 00 00 00 00 dq 0h R e s e r v ed3
IMAGE_LOAD_CONFIG_DIRECTORY64_140011b20 XREF[1]: 1400001c0 ( * ) 140011b20 40 01 00 00 00 00 00 00 00 00 00 00 00 IMAGE_LOAD_CONFIG_DIRECTORY64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 140011b20 40 01 00 00 ddw 140h S i z e XREF[1]: 1400001c0 ( * ) 140011b24 00 00 00 00 ddw 0h T i m e D a t e S t a m p 140011b28 00 00 dw 0h M a j o r V e r s i o n 140011b2a 00 00 dw 0h M i n o r V e r s i o n 140011b2c 00 00 00 00 ddw 0h G l o b a l F l a g s C l e a r 140011b30 00 00 00 00 ddw 0h G l o b a l F l a g s S e t 140011b34 00 00 00 00 ddw 0h C r i t i c a l S e c t i o n D e f a u l t T i m e o u t 140011b38 00 00 00 00 00 00 00 00 dq 0h D e C o m m i t F r e e B l o c k T h r e s h o l d 140011b40 00 00 00 00 00 00 00 00 dq 0h D e C o m m i t T o t a l F r e e T h r e s h o l d 140011b48 00 00 00 00 00 00 00 00 addr 00000000 L o c k P r e f i x T a b l e 140011b50 00 00 00 00 00 00 00 00 dq 0h M a x i m u m A l l o c a t i o n S i z e 140011b58 00 00 00 00 00 00 00 00 dq 0h V i r t u a l M e m o r y T h r e s h o l d 140011b60 00 00 00 00 00 00 00 00 dq 0h P r o c e s s A f f i n i t y M a s k 140011b68 00 00 00 00 ddw 0h P r o c e s s H e a p F l a g s 140011b6c 00 00 dw 0h C S D V e r s i o n 140011b6e 00 00 dw 0h D e p e n d e n t L o a d F l a g s 140011b70 00 00 00 00 00 00 00 00 addr 00000000 E d i t L i s t 140011b78 40 60 01 40 01 00 00 00 addr DAT_140016040 S e c u r i t y C o o k i e = 32h 2 140011b80 00 00 00 00 00 00 00 00 dq * 00000000 S E H a n d l e r T a b l e 140011b88 00 00 00 00 00 00 00 00 dq 0h S E H a n d l e r C o u n t 140011b90 70 10 01 40 01 00 00 00 addr PTR__guard_check_icall_140011070 G u a r d C F C h e c k F u n c t i o n P o i n t e r = 14000b8d8 140011b98 80 10 01 40 01 00 00 00 addr PTR__guard_dispatch_icall_140011080 G u a r d C F D i s p a t c h F u n c t i o n P o i n t e r = 14000e2c0 140011ba0 00 00 00 00 00 00 00 00 ddw * 00000000 G u a r d C F F u n c t i o n T a b l e 140011ba8 00 00 00 00 00 00 00 00 dq 0h G u a r d C F F u n c t i o n C o u n t 140011bb0 00 01 00 00 IMAGE_GUARD_FLAGS IMAGE_GUARD_CF_INSTRUMENTED G u a r d F l a g s 140011bb4 00 00 00 00 00 00 00 00 00 00 00 00 IMAGE_LOAD_CONFIG_CODE_I C o d e I n t e g r i t y 140011bc0 00 00 00 00 00 00 00 00 addr 00000000 G u a r d A d d r e s s T a k e n I a t E n t r y T a b l e 140011bc8 00 00 00 00 00 00 00 00 dq 0h G u a r d A d d r e s s T a k e n I a t E n t r y C o u n t 140011bd0 00 00 00 00 00 00 00 00 addr 00000000 G u a r d L o n g J u m p T a r g e t T a b l e 140011bd8 00 00 00 00 00 00 00 00 dq 0h G u a r d L o n g J u m p T a r g e t C o u n t 140011be0 00 00 00 00 00 00 00 00 addr 00000000 D y n a m i c V a l u e R e l o c T a b l e 140011be8 f8 11 01 40 01 00 00 00 IMAGE_ARM64EC_METADATA_V IMAGE_ARM64EC_METADATA_V2_1400111f8 C H P E M e t a d a t a P o i n t e r 140011bf0 00 00 00 00 00 00 00 00 addr 00000000 G u a r d R F F a i l u r e R o u t i n e 140011bf8 00 00 00 00 00 00 00 00 addr 00000000 G u a r d R F F a i l u r e R o u t i n e F u n c t i o n P o i n t e r 140011c00 00 00 00 00 ibo32 NaP D y n a m i c V a l u e R e l o c T a b l e O f f s e t 140011c04 00 00 dw 0h D y n a m i c V a l u e R e l o c T a b l e S e c t i o n 140011c06 00 00 dw 0h R e s e r v ed2 140011c08 00 00 00 00 00 00 00 00 addr 00000000 G u a r d R F V e r i f y S t a c k P o i n t e r F u n c t i o n P o i n 140011c10 00 00 00 00 ibo32 NaP H o t P a t c h T a b l e O f f s e t 140011c14 00 00 00 00 ddw 0h R e s e r v ed3 140011c18 00 00 00 00 00 00 00 00 addr 00000000 E n c l a v e C o n f i g u r a t i o n P o i n t e r 140011c20 00 00 00 00 00 00 00 00 addr 00000000 V o l a t i l e M e t a d a t a P o i n t e r 140011c28 00 00 00 00 00 00 00 00 addr 00000000 G u a r d E H C o n t i n u a t i o n T a b l e 140011c30 00 00 00 00 00 00 00 00 dq 0h G u a r d E H C o n t i n u a t i o n C o u n t 140011c38 78 10 01 40 01 00 00 00 addr PTR__guard_check_icall_140011078 G u a r d X F G C h e c k F u n c t i o n P o i n t e r = 14000b8d8 140011c40 88 10 01 40 01 00 00 00 addr PTR_LAB_140011088 G u a r d X F G D i s p a t c h F u n c t i o n P o i n t e r = 14000e2e0 140011c48 90 10 01 40 01 00 00 00 addr PTR_LAB_140011090 G u a r d X F G T a b l e D i s p a t c h F u n c t i o n P o i n t e r = 14000e2e0 140011c50 98 10 01 40 01 00 00 00 addr DAT_140011098 C a s t G u a r d O s D e t e r m i n e d F a i l u r e M o d e 140011c58 a0 10 01 40 01 00 00 00 addr PTR_LAB_1400110a0 G u a r d M e m c p y F u n c t i o n P o i n t e r = 14000e080
The layout of this structure – exposed in LIEF through the
interface – evolves frequently across new Windows releases. As of today, Ghidra does not natively recognize many of the newer attributes introduced in recent versions. By running this analyzer, you obtain a more complete and accurate representation of these attributes along with their correct data types.
Beyond the Load Configuration, the analyzer also defines additional structures, such as
, which provide valuable context for analyzing ARM64EC binaries. These definitions make it easier to interpret the purpose of certain functions and pointers, leading to deeper insights during reverse engineering.
DAT_1400111f8 XREF[1]: 140011be8 ( * ) 1400111f8 02 ? ? 02h 1400111f9 00 ? ? 00h 1400111fa 00 ? ? 00h 1400111fb 00 ? ? 00h 1400111fc 00 ? ? 00h 1400111fd 1e ? ? 1Eh 1400111fe 01 ? ? 01h 1400111ff 00 ? ? 00h 140011200 02 ? ? 02h 140011201 00 ? ? 00h 140011202 00 ? ? 00h 140011203 00 ? ? 00h 140011204 b4 ? ? B4h 140011205 1c ? ? 1Ch 140011206 01 ? ? 01h 140011207 00 ? ? 00h 140011208 00 ? ? 00h 140011209 90 ? ? 90h 14001120a 01 ? ? 01h 14001120b 00 ? ? 00h 14001120c 00 ? ? 00h 14001120d 10 ? ? 10h 14001120e 01 ? ? 01h 14001120f 00 ? ? 00h 140011210 08 ? ? 08h 140011211 10 ? ? 10h 140011212 01 ? ? 01h 140011213 00 ? ? 00h 140011214 18 ? ? 18h
IMAGE_ARM64EC_METADATA_V2_1400111f8 XREF[1]: 140011be8 ( * ) 1400111f8 02 00 00 00 00 1e 01 00 02 00 00 00 b4 IMAGE_ARM64EC_METADATA_V2 1c 01 00 00 90 01 00 00 10 01 00 08 10 01 00 18 10 01 00 10 10 01 00 20 10 01 1400111f8 02 00 00 00 00 1e 01 00 02 00 00 00 b4 IMAGE_ARM64EC_METADATA V 1 1c 01 00 00 90 01 00 00 10 01 00 08 10 01 00 18 10 01 00 10 10 01 00 20 10 01 1400111f8 02 00 00 00 ddw 2h V e r s i o n 1400111fc 00 1e 01 00 ibo32 IMAGE_ARM64EC_METADATA_CODE_RANGE_ARRAY_140011e00 C o d e M a p 140011200 02 00 00 00 ddw 2h C o d e M a p C o u n t 140011204 b4 1c 01 00 ibo32 IMAGE_ARM64EC_CODE_RANGE_ENTRY_POINT_ARRAY_140011cb4 C o d e R a n g e s T o E n t r y P o i n t s 140011208 00 90 01 00 ibo32 IMAGE_ARM64EC_METADATA_REDIRECTION_ARRAY_140019000 R e d i r e c t i o n M e t a d a t a 14001120c 00 10 01 00 ibo32 DAT_140011000 _ _ o s _ a r m 6 4 x _ d i s p a t c h _ c a l l _ n o _ r e d i r e c t 140011210 08 10 01 00 ibo32 DAT_140011008 _ _ o s _ a r m 6 4 x _ d i s p a t c h _ r e t 140011214 18 10 01 00 ibo32 DAT_140011018 _ _ o s _ a r m 6 4 x _ d i s p a t c h _ c a l l 140011218 10 10 01 00 ibo32 PTR_DAT_140011010 _ _ o s _ a r m 6 4 x _ d i s p a t c h _ i c a l l 14001121c 20 10 01 00 ibo32 PTR_DAT_140011020 _ _ o s _ a r m 6 4 x _ d i s p a t c h _ i c a l l _ c f g 140011220 00 00 00 00 ibo32 NaP A l t e r n a t e E n t r y P o i n t 140011224 00 50 01 00 ibo32 PTR_DAT_140015000 A u x i l i a r y I A T 140011228 01 00 00 00 ddw 1h C o d e R a n g e s T o E n t r y P o i n t s C o u n t 14001122c 01 00 00 00 ddw 1h R e d i r e c t i o n M e t a d a t a C o u n t 140011230 28 10 01 00 ibo32 DAT_140011028 G e t X 6 4 I n f o r m a t i o n F u n c t i o n P o i n t e r 140011234 30 10 01 00 ibo32 DAT_140011030 S e t X 6 4 I n f o r m a t i o n F u n c t i o n P o i n t e r 140011238 00 70 01 00 ibo32 IMAGE_ARM64_RUNTIME_FUNCTION_UNPACKED_ENTRY_140017000 E x t r a R F E T a b l e 14001123c 38 0d 00 00 ddw D38h E x t r a R F E T a b l e S i z e 140011240 38 10 01 00 ibo32 DAT_140011038 _ _ o s _ a r m 6 4 x _ d i s p a t c h _ f p t r 140011244 48 3e 01 00 ibo32 PTR_DAT_140013e48 A u x i l i a r y I A T C o p y 140011248 00 00 00 00 ibo32 NaP A u x D e l a y l o a d I A T 14001124c 00 00 00 00 ibo32 NaP A u x D e l a y l o a d I A T C o p y 140011250 00 00 00 00 ddw 0h R e s e r v e d B i t F i e l d