WM (Windows): supports komorebi detection

src/common/windows/nt.h

@@ -278,3 +278,54 @@ typedef struct _CURDIR
 } CURDIR, *PCURDIR;
 
 PIMAGE_NT_HEADERS NTAPI RtlImageNtHeader(IN PVOID BaseOfImage);
+
+/**
+ * The SECTION_IMAGE_INFORMATION structure contains detailed information about an image section.
+ */
+typedef struct _SECTION_IMAGE_INFORMATION
+{
+    PVOID TransferAddress;          // The address of the image entry point function.
+    ULONG ZeroBits;                 // The number of high-order address bits that must be zero in the image base address.
+    SIZE_T MaximumStackSize;        // The maximum stack size of threads from the PE file header.
+    SIZE_T CommittedStackSize;      // The initial stack size of threads from the PE file header.
+    ULONG SubSystemType;            // The image subsystem from the PE file header (e.g., Windows GUI, Windows CUI, POSIX).
+    union
+    {
+        struct
+        {
+            USHORT SubSystemMinorVersion;
+            USHORT SubSystemMajorVersion;
+        };
+        ULONG SubSystemVersion;
+    };
+    union
+    {
+        struct
+        {
+            USHORT MajorOperatingSystemVersion;
+            USHORT MinorOperatingSystemVersion;
+        };
+        ULONG OperatingSystemVersion;
+    };
+    USHORT ImageCharacteristics;    // The image characteristics from the PE file header.
+    USHORT DllCharacteristics;      // The DLL characteristics flags (e.g., ASLR, NX compatibility).
+    USHORT Machine;                 // The image architecture (e.g., x86, x64, ARM).
+    BOOLEAN ImageContainsCode;      // The image contains native executable code.
+    union
+    {
+        UCHAR ImageFlags;
+        struct
+        {
+            UCHAR ComPlusNativeReady : 1;           // The image contains precompiled .NET assembly generated by NGEN (Native Image Generator).
+            UCHAR ComPlusILOnly : 1;                // the image contains only Microsoft Intermediate Language (IL) assembly.
+            UCHAR ImageDynamicallyRelocated : 1;    // The image was mapped using a random base address rather than the preferred base address.
+            UCHAR ImageMappedFlat : 1;              // The image was mapped using a single contiguous region, rather than separate regions for each section.
+            UCHAR BaseBelow4gb : 1;                 // The image was mapped using a base address below the 4 GB boundary.
+            UCHAR ComPlusPrefer32bit : 1;           // The image prefers to run as a 32-bit process, even on a 64-bit system.
+            UCHAR Reserved : 2;
+        };
+    };
+    ULONG LoaderFlags;               // Reserved by ntdll.dll for the Windows loader.
+    ULONG ImageFileSize;             // The size of the image, in bytes, including all headers.
+    ULONG CheckSum;                  // The image file checksum, from the PE optional header.
+} SECTION_IMAGE_INFORMATION, *PSECTION_IMAGE_INFORMATION;