// Native userspace PE32+ image-loader declarations. #pragma once #include #include #include #include #include #define NTL_PE_LOAD_FLAG_NONE 0x00000000u typedef KSTATUS (*NTL_PE_IMPORT_RESOLVER)(void* context, SYS_STRING_VIEW moduleName, SYS_STRING_VIEW symbolName, uintptr_t* addressOut); typedef struct NTL_PE_IMAGE { uintptr_t Base; size_t Size; uintptr_t EntryPoint; uint64_t PreferredBase; } NTL_PE_IMAGE; typedef KSTATUS (*NTL_PE_PREPARED_CALLBACK)(void* context, const NTL_PE_IMAGE* image); typedef struct NTL_PE_LOAD_REQUEST { uint32_t Size; SYS_HANDLE ProcessHandle; SYS_HANDLE FileHandle; uint32_t Flags; NTL_PE_IMPORT_RESOLVER ResolveImport; void* ResolveContext; NTL_PE_PREPARED_CALLBACK Prepared; void* PreparedContext; NTL_PE_IMAGE* ImageOut; } NTL_PE_LOAD_REQUEST; #if defined(NTL_SYSCALL_STATIC) #define NTL_SYSCALL_API #elif defined(NTL_SYSCALL_BUILD) #define NTL_SYSCALL_API __declspec(dllexport) #else #define NTL_SYSCALL_API #endif // Reads, validates, materializes, relocates, binds, and protects one AMD64 PE32+ image. // ProcessHandle may be SYS_HANDLE_INVALID to target the current process. Dependency policy // remains entirely in ResolveImport. Prepared runs after relocation and before import binding. NTL_SYSCALL_API KSTATUS NtlLoadPeImage(const NTL_PE_LOAD_REQUEST* request); // Resolves one named export directly from an already-materialized PE image. Forwarders and // ordinal lookups are intentionally unsupported. NTL_SYSCALL_API KSTATUS NtlGetPeExport(uintptr_t imageBase, SYS_STRING_VIEW name, uintptr_t* addressOut); #undef NTL_SYSCALL_API