// --- Pre-resolved API function pointers -----------------------------------

// These are needed because TrampolineFunc runs from arbitrary memory and

// has no import table of its own. Each pointer is resolved via

// GetProcAddress before the trampoline is invoked.

decltype(&VirtualProtect) pVirtualProtect;

decltype(&LoadLibraryA) pLoadLibraryA;

decltype(&GetProcAddress) pGetProcAddress;

decltype(&OutputDebugStringA) pOutputDebugStringA;

VOID(WINAPI* pRtlZeroMemory)(PVOID, SIZE_T);

VOID(WINAPI* pRtlMoveMemory)(PVOID, const VOID*, SIZE_T);

// --- Target PE mapping parameters -----------------------------------------

uint8_t* targetBase; // The PE's preferred ImageBase (e.g. 0x00400000)

DWORD imageSize; // SizeOfImage from the NT optional header

DWORD sizeOfHeaders; // SizeOfHeaders -- how many bytes to copy for headers

DWORD entryPointRVA; // AddressOfEntryPoint -- RVA of the original EP

// --- Section table snapshot -----------------------------------------------

// Stores VirtualAddress, SizeOfRawData, and PointerToRawData for each

// section so the trampoline can map them without re-parsing the section

// headers. Fixed-size array of 64 is more than enough for any real PE.

int numSections;

struct {

DWORD virtualAddress;

DWORD sizeOfRawData;

DWORD dataOffset; // PointerToRawData in the raw PE file

} sections[64];

// --- PE raw data (flexible array member, must be last) --------------------

// The entire original PE file is copied here. Because this member has no

// fixed size, sizeof(TrampolineData) gives the offset of the PE data,

// which we use with offsetof() to compute the total allocation size.

uint8_t peDataCopy[];