SymFindExecutableImage

// dbghelp.dll  (ANSI / -A)
#include <windows.h>

HANDLE SymFindExecutableImage(
    HANDLE hProcess,
    LPCSTR FileName,
    LPSTR ImageFilePath,
    PFIND_EXE_FILE_CALLBACK Callback,
    void* CallerData
);

<DllImport("dbghelp.dll", CharSet:=CharSet.Ansi, SetLastError:=True, ExactSpelling:=True)>
Public Shared Function SymFindExecutableImage(
    hProcess As IntPtr,   ' HANDLE
    <MarshalAs(UnmanagedType.LPStr)> FileName As String,   ' LPCSTR
    <MarshalAs(UnmanagedType.LPStr)> ImageFilePath As System.Text.StringBuilder,   ' LPSTR out
    Callback As IntPtr,   ' PFIND_EXE_FILE_CALLBACK
    CallerData As IntPtr   ' void*
) As IntPtr
End Function

' hProcess : HANDLE
' FileName : LPCSTR
' ImageFilePath : LPSTR out
' Callback : PFIND_EXE_FILE_CALLBACK
' CallerData : void*
Declare PtrSafe Function SymFindExecutableImage Lib "dbghelp" ( _
    ByVal hProcess As LongPtr, _
    ByVal FileName As String, _
    ByVal ImageFilePath As String, _
    ByVal Callback As LongPtr, _
    ByVal CallerData As LongPtr) As LongPtr
' VBA7前提(PtrSafe)。32bit Office では LongPtr→Long。Integer=16bit / Long=32bit / LongLong=64bit。

import ctypes
from ctypes import wintypes

SymFindExecutableImage = ctypes.windll.dbghelp.SymFindExecutableImage
SymFindExecutableImage.restype = ctypes.c_void_p
SymFindExecutableImage.argtypes = [
    wintypes.HANDLE,  # hProcess : HANDLE
    wintypes.LPCSTR,  # FileName : LPCSTR
    wintypes.LPSTR,  # ImageFilePath : LPSTR out
    ctypes.c_void_p,  # Callback : PFIND_EXE_FILE_CALLBACK
    ctypes.POINTER(None),  # CallerData : void*
]
# GetLastError: use ctypes.GetLastError() (or ctypes.WinDLL(use_last_error=True))

require 'fiddle'
require 'fiddle/import'

lib = Fiddle.dlopen('dbghelp.dll')
SymFindExecutableImage = Fiddle::Function.new(
  lib['SymFindExecutableImage'],
  [
    Fiddle::TYPE_VOIDP,  # hProcess : HANDLE
    Fiddle::TYPE_VOIDP,  # FileName : LPCSTR
    Fiddle::TYPE_VOIDP,  # ImageFilePath : LPSTR out
    Fiddle::TYPE_VOIDP,  # Callback : PFIND_EXE_FILE_CALLBACK
    Fiddle::TYPE_VOIDP,  # CallerData : void*
  ],
  Fiddle::TYPE_VOIDP)

#[link(name = "dbghelp")]
extern "system" {
    fn SymFindExecutableImage(
        hProcess: *mut core::ffi::c_void,  // HANDLE
        FileName: *const u8,  // LPCSTR
        ImageFilePath: *mut u8,  // LPSTR out
        Callback: *const core::ffi::c_void,  // PFIND_EXE_FILE_CALLBACK
        CallerData: *mut ()  // void*
    ) -> *mut core::ffi::c_void;
}
// crates: windows-sys provides ready-made bindings for this API.

$sig = @"
[DllImport("dbghelp.dll", CharSet = CharSet.Ansi, SetLastError = true)]
public static extern IntPtr SymFindExecutableImage(IntPtr hProcess, [MarshalAs(UnmanagedType.LPStr)] string FileName, [MarshalAs(UnmanagedType.LPStr)] System.Text.StringBuilder ImageFilePath, IntPtr Callback, IntPtr CallerData);
"@
$api = Add-Type -MemberDefinition $sig -Name 'dbghelp_SymFindExecutableImage' -Namespace Win32 -PassThru
# $api::SymFindExecutableImage(hProcess, FileName, ImageFilePath, Callback, CallerData)

#uselib "dbghelp.dll"
#func global SymFindExecutableImage "SymFindExecutableImage" sptr, sptr, sptr, sptr, sptr
; SymFindExecutableImage hProcess, FileName, varptr(ImageFilePath), Callback, CallerData   ; 戻り値は stat
; hProcess : HANDLE -> "sptr"
; FileName : LPCSTR -> "sptr"
; ImageFilePath : LPSTR out -> "sptr"
; Callback : PFIND_EXE_FILE_CALLBACK -> "sptr"
; CallerData : void* -> "sptr"
; ※HSP3.7は #func のため戻り値はシステム変数 stat に格納されます。

#uselib "dbghelp.dll"
#cfunc global SymFindExecutableImage "SymFindExecutableImage" sptr, str, var, sptr, sptr
; res = SymFindExecutableImage(hProcess, FileName, ImageFilePath, Callback, CallerData)
; hProcess : HANDLE -> "sptr"
; FileName : LPCSTR -> "str"
; ImageFilePath : LPSTR out -> "var"
; Callback : PFIND_EXE_FILE_CALLBACK -> "sptr"
; CallerData : void* -> "sptr"
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。

; HANDLE SymFindExecutableImage(HANDLE hProcess, LPCSTR FileName, LPSTR ImageFilePath, PFIND_EXE_FILE_CALLBACK Callback, void* CallerData)
#uselib "dbghelp.dll"
#cfunc global SymFindExecutableImage "SymFindExecutableImage" intptr, str, var, intptr, intptr
; res = SymFindExecutableImage(hProcess, FileName, ImageFilePath, Callback, CallerData)
; hProcess : HANDLE -> "intptr"
; FileName : LPCSTR -> "str"
; ImageFilePath : LPSTR out -> "var"
; Callback : PFIND_EXE_FILE_CALLBACK -> "intptr"
; CallerData : void* -> "intptr"
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。

import (
	"golang.org/x/sys/windows"
	"unsafe"
)

var (
	dbghelp = windows.NewLazySystemDLL("dbghelp.dll")
	procSymFindExecutableImage = dbghelp.NewProc("SymFindExecutableImage")
)

// hProcess (HANDLE), FileName (LPCSTR), ImageFilePath (LPSTR out), Callback (PFIND_EXE_FILE_CALLBACK), CallerData (void*)
r1, _, err := procSymFindExecutableImage.Call(
	uintptr(hProcess),
	uintptr(unsafe.Pointer(windows.BytePtrFromString(FileName))),
	uintptr(ImageFilePath),
	uintptr(Callback),
	uintptr(CallerData),
)
_ = err  // syscall.Errno (valid when the call sets last-error)
_ = r1   // HANDLE

function SymFindExecutableImage(
  hProcess: THandle;   // HANDLE
  FileName: PAnsiChar;   // LPCSTR
  ImageFilePath: PAnsiChar;   // LPSTR out
  Callback: Pointer;   // PFIND_EXE_FILE_CALLBACK
  CallerData: Pointer   // void*
): THandle; stdcall;
  external 'dbghelp.dll' name 'SymFindExecutableImage';

result := DllCall("dbghelp\SymFindExecutableImage"
    , "Ptr", hProcess   ; HANDLE
    , "AStr", FileName   ; LPCSTR
    , "Ptr", ImageFilePath   ; LPSTR out
    , "Ptr", Callback   ; PFIND_EXE_FILE_CALLBACK
    , "Ptr", CallerData   ; void*
    , "Ptr")   ; return: HANDLE

●SymFindExecutableImage(hProcess, FileName, ImageFilePath, Callback, CallerData) = DLL("dbghelp.dll", "void* SymFindExecutableImage(void*, char*, char*, void*, void*)")
# 呼び出し: SymFindExecutableImage(hProcess, FileName, ImageFilePath, Callback, CallerData)
# hProcess : HANDLE -> "void*"
# FileName : LPCSTR -> "char*"
# ImageFilePath : LPSTR out -> "char*"
# Callback : PFIND_EXE_FILE_CALLBACK -> "void*"
# CallerData : void* -> "void*"
# なでしこ1は32bit・ANSI(Shift_JIS)。文字列=char*(ANSI)、ポインタ/ハンドル=void*(4byte)。