#ifndef _NTLDR_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)

// Flags for LdrFindResourceEx_U (LdrpSearchResourceSection_U) and (Win8+) LdrResFindResource/LdrResSearchResource
typedef enum _LDR_RESOURCE_QUERY_FLAGS
{
    LDR_RES_SEARCH_PATH_ALT_TYPE             = 0x00000001u,  // Enables 4-key path mode (requires Count==4)
    LDR_RES_SEARCH_PATH_ALLOW_SHORT          = 0x00000002u,  // Permit PathCount < 3 (else PathCount must be 3 or 4)
    LDR_RES_SEARCH_SKIP_MUI                  = 0x00000004u,  // Skip language fallback chain; only match the exact requested language
    LDR_RES_SEARCH_SKIP_CONFIG               = 0x00000008u,  // Bypass type-based MUI detection fast-path; always evaluate via LdrResGetRCConfig
    LDR_RES_SEARCH_MUI_CONFIG_CHECKED        = 0x00000010u,  // MUI configuration already checked (internal)
    LDR_RES_SEARCH_MUI_RECURSIVE             = 0x00000020u,  // Recursive MUI alternate-module search in progress (internal)
    LDR_RES_SEARCH_MUI_STRINGS               = 0x00000040u,  // Enables 4-key path mode for MUI message strings; calls LdrpFindMessageInAlternateModule (requires Count==4)
    LDR_RES_SEARCH_FORCE_MUI                 = 0x00000080u,  // Reserved; behavior not confirmed by code analysis
    LDR_RES_INTERNAL_ALT_RETRY               = 0x01000000u,  // Internal-only; set by loader on alternate resource retry; switches from .mui to .mun extension (callers must not set)

    // Group masks (base flags)
    LDR_RES_SEARCH_PATH_MASK                 = 0x00000043u,  // ALT_TYPE | ALLOW_SHORT | MUI_STRINGS
    LDR_RES_SEARCH_KEY4_MASK                 = (LDR_RES_SEARCH_PATH_ALT_TYPE | LDR_RES_SEARCH_MUI_STRINGS),

    // Win8+ extended flags for LdrResFindResource, LdrpResGetResourceDirectory, LdrResSearchResource
    // (LdrFindResourceEx_U uses LDR_RES_SEARCH_PATH_* and LDR_RES_SEARCH_MUI_* above; it infers load mode from DllHandle LDR_IS_* bits)

    // Search load modes (mutually exclusive; Win8+ only)
    LDR_RES_SEARCH_LOAD_IMAGE                = 0x00000100u,  // DllHandle is a normal loaded image or LDR_IS_IMAGEMAPPING (default; added automatically if no mode specified)
    LDR_RES_SEARCH_LOAD_DATAFILE             = 0x00000200u,  // DllHandle is a memory-mapped datafile; bit 0 (LDR_IS_DATAFILE) is set on the address internally
    LDR_RES_SEARCH_LOAD_MAPPED               = 0x00000400u,  // DllHandle is a file path (PCWSTR) to be raw-mapped; validated via LdrpResValidateFilePath under STRICT
    LDR_RES_SEARCH_LOAD_VIEW                 = 0x00000800u,  // DllHandle is an NT file handle (HANDLE) to be mapped; used directly with LDR_RES_SEARCH_MUI_DEPENDENCY

    // Mapping behavior flags (valid with LDR_RES_SEARCH_LOAD_MAPPED or LDR_RES_SEARCH_LOAD_VIEW)
    LDR_RES_SEARCH_STRICT                    = 0x00001000u,  // Strict PE header validation; fail if mapping size cannot be determined
    LDR_RES_SEARCH_LENIENT                   = 0x00002000u,  // Suppress automatic STRICT; allow search to continue if mapping size fails
    LDR_RES_SEARCH_ALT_FALLBACK              = 0x00004000u,  // Reserved; behavior not confirmed by code analysis (fallback is unconditional)

    // Optimization/Dependency flags
    LDR_RES_SEARCH_MUI_DEPENDENCY            = 0x00008000u,  // Only valid with LDR_RES_SEARCH_LOAD_VIEW and LDR_RES_SEARCH_MUI_CONFIG_CHECKED

    // Size override flags
    LDR_RES_SEARCH_USE_INPUT_SIZE_MAPPED     = 0x00020000u,  // Use *ResourceLength as mapping size; requires LDR_RES_SEARCH_LOAD_MAPPED
    LDR_RES_SEARCH_USE_INPUT_SIZE            = 0x00080000u,  // Use *ResourceLength as mapping size; requires IMAGE or DATAFILE mode

    // Group masks (Win8+ extended flags)
    LDR_RES_SEARCH_LOAD_MODE_MASK            = 0x00000F00u,  // IMAGE | DATAFILE | MAPPED | VIEW
    LDR_RES_SEARCH_BEHAVIOR_MASK             = 0x00003000u,  // STRICT | LENIENT
    LDR_RES_SEARCH_SIZE_OVERRIDE_MASK        = 0x000A0000u,  // USE_INPUT_SIZE | USE_INPUT_SIZE_MAPPED
    LDR_RES_SEARCH_PUBLIC_MASK               = 0x000FFFFFu

} LDR_RESOURCE_QUERY_FLAGS;

#endif
#endif
View code on GitHub