#ifndef _NTMMAPI_H

/**
 * The MEMORY_IMAGE_EXTENSION_INFORMATION structure describes an optional image extension
 * containing additional metadata or features (for example, CFG/SCP related extensions).
 * Initialize ExtensionType and Flags before querying. On x64,
 * type 0 is supported, type 1 returns STATUS_NOT_SUPPORTED, and other types
 * return STATUS_INVALID_PARAMETER. ExtensionImageBaseRva is relative to the image base.
 */
typedef struct _MEMORY_IMAGE_EXTENSION_INFORMATION
{
    MEMORY_IMAGE_EXTENSION_TYPE ExtensionType; // Type of the image extension (MEMORY_IMAGE_EXTENSION_TYPE).
    ULONG Flags;                              // Must be zero on x64.
    PVOID ExtensionImageBaseRva;               // Relative virtual address of the extension image base.
    SIZE_T ExtensionSize;                      // Size, in bytes, of the extension region.
} MEMORY_IMAGE_EXTENSION_INFORMATION, *PMEMORY_IMAGE_EXTENSION_INFORMATION;

#endif
View code on GitHub