Win32 API 日本語リファレンス
ホーム › System.Diagnostics.Etw › QueryTraceProcessingHandle

QueryTraceProcessingHandle

関数
トレース処理ハンドルに関する情報を照会する。
DLLADVAPI32.dll呼出規約winapi対応OSWindows 10 以降
📘 Microsoft Learn (日本語) · English

シグネチャ

// ADVAPI32.dll
#include <windows.h>

WIN32_ERROR QueryTraceProcessingHandle(
    PROCESSTRACE_HANDLE ProcessingHandle,
    ETW_PROCESS_HANDLE_INFO_TYPE InformationClass,
    void* InBuffer,   // optional
    DWORD InBufferSize,
    void* OutBuffer,   // optional
    DWORD OutBufferSize,
    DWORD* ReturnLength
);

パラメーター

名前型方向説明
ProcessingHandlePROCESSTRACE_HANDLEinデータの照会元となる、OpenTrace で作成された有効なハンドルです。
InformationClassETW_PROCESS_HANDLE_INFO_TYPEinハンドルに対して行う操作の種類を指定する ETW_PROCESS_HANDLE_INFO_TYPE 値です。
InBuffervoid*inoptional将来の使用のために予約されています。null でもかまいません。
InBufferSizeDWORDinInBuffer のサイズ (バイト単位) です。
OutBuffervoid*outoptional出力データを受け取るために呼び出し元が用意するバッファーです。
OutBufferSizeDWORDinOutBuffer のサイズ (バイト単位) です。
ReturnLengthDWORD*inoutAPI が OutBuffer に書き込んだデータのサイズ (バイト単位) です。可変長の返り値に使用されます。

戻り値の型: WIN32_ERROR

公式ドキュメント

次の関数によって開かれた ETW トレース処理セッションに関する情報を取得します。

戻り値

関数が成功した場合、戻り値は ERROR_SUCCESS です。

関数が失敗した場合、戻り値は システムエラーコード のいずれかになります。

出典・ライセンス: 上記「公式ドキュメント」の内容は Microsoft の Win32 API ドキュメント(MicrosoftDocs/sdk-api)を日本語に翻訳・改変したものです。© Microsoft Corporation. CC BY 4.0 で提供。
Microsoft 公式リファレンス: 英語 (en-us) · 日本語 (ja-jp) · 原文ソース (GitHub)

各言語での呼び出し定義

// ADVAPI32.dll
#include <windows.h>

WIN32_ERROR QueryTraceProcessingHandle(
    PROCESSTRACE_HANDLE ProcessingHandle,
    ETW_PROCESS_HANDLE_INFO_TYPE InformationClass,
    void* InBuffer,   // optional
    DWORD InBufferSize,
    void* OutBuffer,   // optional
    DWORD OutBufferSize,
    DWORD* ReturnLength
);
[DllImport("ADVAPI32.dll", ExactSpelling = true)]
static extern uint QueryTraceProcessingHandle(
    PROCESSTRACE_HANDLE ProcessingHandle,   // PROCESSTRACE_HANDLE
    int InformationClass,   // ETW_PROCESS_HANDLE_INFO_TYPE
    IntPtr InBuffer,   // void* optional
    uint InBufferSize,   // DWORD
    IntPtr OutBuffer,   // void* optional, out
    uint OutBufferSize,   // DWORD
    ref uint ReturnLength   // DWORD* in/out
);
<DllImport("ADVAPI32.dll", ExactSpelling:=True)>
Public Shared Function QueryTraceProcessingHandle(
    ProcessingHandle As PROCESSTRACE_HANDLE,   ' PROCESSTRACE_HANDLE
    InformationClass As Integer,   ' ETW_PROCESS_HANDLE_INFO_TYPE
    InBuffer As IntPtr,   ' void* optional
    InBufferSize As UInteger,   ' DWORD
    OutBuffer As IntPtr,   ' void* optional, out
    OutBufferSize As UInteger,   ' DWORD
    ByRef ReturnLength As UInteger   ' DWORD* in/out
) As UInteger
End Function
' ProcessingHandle : PROCESSTRACE_HANDLE
' InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE
' InBuffer : void* optional
' InBufferSize : DWORD
' OutBuffer : void* optional, out
' OutBufferSize : DWORD
' ReturnLength : DWORD* in/out
Declare PtrSafe Function QueryTraceProcessingHandle Lib "advapi32" ( _
    ByVal ProcessingHandle As LongPtr, _
    ByVal InformationClass As Long, _
    ByVal InBuffer As LongPtr, _
    ByVal InBufferSize As Long, _
    ByVal OutBuffer As LongPtr, _
    ByVal OutBufferSize As Long, _
    ByRef ReturnLength As Long) As Long
' VBA7前提(PtrSafe)。32bit Office では LongPtr→Long。Integer=16bit / Long=32bit / LongLong=64bit。
import ctypes
from ctypes import wintypes

QueryTraceProcessingHandle = ctypes.windll.advapi32.QueryTraceProcessingHandle
QueryTraceProcessingHandle.restype = wintypes.DWORD
QueryTraceProcessingHandle.argtypes = [
    PROCESSTRACE_HANDLE,  # ProcessingHandle : PROCESSTRACE_HANDLE
    ctypes.c_int,  # InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE
    ctypes.POINTER(None),  # InBuffer : void* optional
    wintypes.DWORD,  # InBufferSize : DWORD
    ctypes.POINTER(None),  # OutBuffer : void* optional, out
    wintypes.DWORD,  # OutBufferSize : DWORD
    ctypes.POINTER(wintypes.DWORD),  # ReturnLength : DWORD* in/out
]
require 'fiddle'
require 'fiddle/import'

lib = Fiddle.dlopen('ADVAPI32.dll')
QueryTraceProcessingHandle = Fiddle::Function.new(
  lib['QueryTraceProcessingHandle'],
  [
    Fiddle::TYPE_VOIDP,  # ProcessingHandle : PROCESSTRACE_HANDLE
    Fiddle::TYPE_INT,  # InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE
    Fiddle::TYPE_VOIDP,  # InBuffer : void* optional
    -Fiddle::TYPE_INT,  # InBufferSize : DWORD
    Fiddle::TYPE_VOIDP,  # OutBuffer : void* optional, out
    -Fiddle::TYPE_INT,  # OutBufferSize : DWORD
    Fiddle::TYPE_VOIDP,  # ReturnLength : DWORD* in/out
  ],
  -Fiddle::TYPE_INT)
#[link(name = "advapi32")]
extern "system" {
    fn QueryTraceProcessingHandle(
        ProcessingHandle: PROCESSTRACE_HANDLE,  // PROCESSTRACE_HANDLE
        InformationClass: i32,  // ETW_PROCESS_HANDLE_INFO_TYPE
        InBuffer: *mut (),  // void* optional
        InBufferSize: u32,  // DWORD
        OutBuffer: *mut (),  // void* optional, out
        OutBufferSize: u32,  // DWORD
        ReturnLength: *mut u32  // DWORD* in/out
    ) -> u32;
}
// crates: windows-sys provides ready-made bindings for this API.
$sig = @"
[DllImport("ADVAPI32.dll")]
public static extern uint QueryTraceProcessingHandle(PROCESSTRACE_HANDLE ProcessingHandle, int InformationClass, IntPtr InBuffer, uint InBufferSize, IntPtr OutBuffer, uint OutBufferSize, ref uint ReturnLength);
"@
$api = Add-Type -MemberDefinition $sig -Name 'ADVAPI32_QueryTraceProcessingHandle' -Namespace Win32 -PassThru
# $api::QueryTraceProcessingHandle(ProcessingHandle, InformationClass, InBuffer, InBufferSize, OutBuffer, OutBufferSize, ReturnLength)
#uselib "ADVAPI32.dll"
#func global QueryTraceProcessingHandle "QueryTraceProcessingHandle" sptr, sptr, sptr, sptr, sptr, sptr, sptr
; QueryTraceProcessingHandle ProcessingHandle, InformationClass, InBuffer, InBufferSize, OutBuffer, OutBufferSize, varptr(ReturnLength)   ; 戻り値は stat
; ProcessingHandle : PROCESSTRACE_HANDLE -> "sptr"
; InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE -> "sptr"
; InBuffer : void* optional -> "sptr"
; InBufferSize : DWORD -> "sptr"
; OutBuffer : void* optional, out -> "sptr"
; OutBufferSize : DWORD -> "sptr"
; ReturnLength : DWORD* in/out -> "sptr"
; ※値渡し構造体は直接渡せません。intにパック、または var で構造体変数を渡してください。
; ※HSP3.7は #func のため戻り値はシステム変数 stat に格納されます。
出力引数: 
#uselib "ADVAPI32.dll"
#cfunc global QueryTraceProcessingHandle "QueryTraceProcessingHandle" int, int, sptr, int, sptr, int, var
; res = QueryTraceProcessingHandle(ProcessingHandle, InformationClass, InBuffer, InBufferSize, OutBuffer, OutBufferSize, ReturnLength)
; ProcessingHandle : PROCESSTRACE_HANDLE -> "int"
; InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE -> "int"
; InBuffer : void* optional -> "sptr"
; InBufferSize : DWORD -> "int"
; OutBuffer : void* optional, out -> "sptr"
; OutBufferSize : DWORD -> "int"
; ReturnLength : DWORD* in/out -> "var"
; ※値渡し構造体は直接渡せません。intにパック、または var で構造体変数を渡してください。
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。
出力引数: 
; WIN32_ERROR QueryTraceProcessingHandle(PROCESSTRACE_HANDLE ProcessingHandle, ETW_PROCESS_HANDLE_INFO_TYPE InformationClass, void* InBuffer, DWORD InBufferSize, void* OutBuffer, DWORD OutBufferSize, DWORD* ReturnLength)
#uselib "ADVAPI32.dll"
#cfunc global QueryTraceProcessingHandle "QueryTraceProcessingHandle" int, int, intptr, int, intptr, int, var
; res = QueryTraceProcessingHandle(ProcessingHandle, InformationClass, InBuffer, InBufferSize, OutBuffer, OutBufferSize, ReturnLength)
; ProcessingHandle : PROCESSTRACE_HANDLE -> "int"
; InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE -> "int"
; InBuffer : void* optional -> "intptr"
; InBufferSize : DWORD -> "int"
; OutBuffer : void* optional, out -> "intptr"
; OutBufferSize : DWORD -> "int"
; ReturnLength : DWORD* in/out -> "var"
; ※値渡し構造体は直接渡せません。intにパック、または var で構造体変数を渡してください。
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。
import (
	"golang.org/x/sys/windows"
	"unsafe"
)

var (
	advapi32 = windows.NewLazySystemDLL("ADVAPI32.dll")
	procQueryTraceProcessingHandle = advapi32.NewProc("QueryTraceProcessingHandle")
)

// ProcessingHandle (PROCESSTRACE_HANDLE), InformationClass (ETW_PROCESS_HANDLE_INFO_TYPE), InBuffer (void* optional), InBufferSize (DWORD), OutBuffer (void* optional, out), OutBufferSize (DWORD), ReturnLength (DWORD* in/out)
r1, _, err := procQueryTraceProcessingHandle.Call(
	uintptr(ProcessingHandle),
	uintptr(InformationClass),
	uintptr(InBuffer),
	uintptr(InBufferSize),
	uintptr(OutBuffer),
	uintptr(OutBufferSize),
	uintptr(ReturnLength),
)
_ = err  // syscall.Errno (valid when the call sets last-error)
_ = r1   // WIN32_ERROR
function QueryTraceProcessingHandle(
  ProcessingHandle: PROCESSTRACE_HANDLE;   // PROCESSTRACE_HANDLE
  InformationClass: Integer;   // ETW_PROCESS_HANDLE_INFO_TYPE
  InBuffer: Pointer;   // void* optional
  InBufferSize: DWORD;   // DWORD
  OutBuffer: Pointer;   // void* optional, out
  OutBufferSize: DWORD;   // DWORD
  ReturnLength: Pointer   // DWORD* in/out
): DWORD; stdcall;
  external 'ADVAPI32.dll' name 'QueryTraceProcessingHandle';
result := DllCall("ADVAPI32\QueryTraceProcessingHandle"
    , "Ptr", ProcessingHandle   ; PROCESSTRACE_HANDLE
    , "Int", InformationClass   ; ETW_PROCESS_HANDLE_INFO_TYPE
    , "Ptr", InBuffer   ; void* optional
    , "UInt", InBufferSize   ; DWORD
    , "Ptr", OutBuffer   ; void* optional, out
    , "UInt", OutBufferSize   ; DWORD
    , "Ptr", ReturnLength   ; DWORD* in/out
    , "UInt")   ; return: WIN32_ERROR
●QueryTraceProcessingHandle(ProcessingHandle, InformationClass, InBuffer, InBufferSize, OutBuffer, OutBufferSize, ReturnLength) = DLL("ADVAPI32.dll", "dword QueryTraceProcessingHandle(void*, int, void*, dword, void*, dword, void*)")
# 呼び出し: QueryTraceProcessingHandle(ProcessingHandle, InformationClass, InBuffer, InBufferSize, OutBuffer, OutBufferSize, ReturnLength)
# ProcessingHandle : PROCESSTRACE_HANDLE -> "void*"
# InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE -> "int"
# InBuffer : void* optional -> "void*"
# InBufferSize : DWORD -> "dword"
# OutBuffer : void* optional, out -> "void*"
# OutBufferSize : DWORD -> "dword"
# ReturnLength : DWORD* in/out -> "void*"
# なでしこ1は32bit・ANSI(Shift_JIS)。文字列=char*(ANSI)、ポインタ/ハンドル=void*(4byte)。
const std = @import("std");

extern "advapi32" fn QueryTraceProcessingHandle(
    ProcessingHandle: PROCESSTRACE_HANDLE, // PROCESSTRACE_HANDLE
    InformationClass: i32, // ETW_PROCESS_HANDLE_INFO_TYPE
    InBuffer: ?*anyopaque, // void* optional
    InBufferSize: u32, // DWORD
    OutBuffer: ?*anyopaque, // void* optional, out
    OutBufferSize: u32, // DWORD
    ReturnLength: [*c]u32 // DWORD* in/out
) callconv(std.os.windows.WINAPI) u32;
proc QueryTraceProcessingHandle(
    ProcessingHandle: PROCESSTRACE_HANDLE,  # PROCESSTRACE_HANDLE
    InformationClass: int32,  # ETW_PROCESS_HANDLE_INFO_TYPE
    InBuffer: pointer,  # void* optional
    InBufferSize: uint32,  # DWORD
    OutBuffer: pointer,  # void* optional, out
    OutBufferSize: uint32,  # DWORD
    ReturnLength: ptr uint32  # DWORD* in/out
): uint32 {.importc: "QueryTraceProcessingHandle", stdcall, dynlib: "ADVAPI32.dll".}
pragma(lib, "advapi32");
extern(Windows)
uint QueryTraceProcessingHandle(
    PROCESSTRACE_HANDLE ProcessingHandle,   // PROCESSTRACE_HANDLE
    int InformationClass,   // ETW_PROCESS_HANDLE_INFO_TYPE
    void* InBuffer,   // void* optional
    uint InBufferSize,   // DWORD
    void* OutBuffer,   // void* optional, out
    uint OutBufferSize,   // DWORD
    uint* ReturnLength   // DWORD* in/out
);
ccall((:QueryTraceProcessingHandle, "ADVAPI32.dll"), stdcall, UInt32,
      (PROCESSTRACE_HANDLE, Int32, Ptr{Cvoid}, UInt32, Ptr{Cvoid}, UInt32, Ptr{UInt32}),
      ProcessingHandle, InformationClass, InBuffer, InBufferSize, OutBuffer, OutBufferSize, ReturnLength)
# ProcessingHandle : PROCESSTRACE_HANDLE -> PROCESSTRACE_HANDLE
# InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE -> Int32
# InBuffer : void* optional -> Ptr{Cvoid}
# InBufferSize : DWORD -> UInt32
# OutBuffer : void* optional, out -> Ptr{Cvoid}
# OutBufferSize : DWORD -> UInt32
# ReturnLength : DWORD* in/out -> Ptr{UInt32}
# stdcall は 32bit のみ意味を持つ(x64 では無視)。
local ffi = require("ffi")
ffi.cdef[[
uint32_t QueryTraceProcessingHandle(
    PROCESSTRACE_HANDLE ProcessingHandle,
    int32_t InformationClass,
    void* InBuffer,
    uint32_t InBufferSize,
    void* OutBuffer,
    uint32_t OutBufferSize,
    uint32_t* ReturnLength);
]]
local advapi32 = ffi.load("advapi32")
-- advapi32.QueryTraceProcessingHandle(ProcessingHandle, InformationClass, InBuffer, InBufferSize, OutBuffer, OutBufferSize, ReturnLength)
-- ProcessingHandle : PROCESSTRACE_HANDLE
-- InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE
-- InBuffer : void* optional
-- InBufferSize : DWORD
-- OutBuffer : void* optional, out
-- OutBufferSize : DWORD
-- ReturnLength : DWORD* in/out
-- 構造体/GUIDへのポインタは cdef が通るよう void* で表記(実型は各引数コメント参照)。値渡し構造体・enum は対応する typedef を cdef に追加すること。
const koffi = require('koffi');
const lib = koffi.load('ADVAPI32.dll');
const QueryTraceProcessingHandle = lib.func('__stdcall', 'QueryTraceProcessingHandle', 'uint32_t', ['PROCESSTRACE_HANDLE', 'int32_t', 'void *', 'uint32_t', 'void *', 'uint32_t', 'uint32_t *']);
// QueryTraceProcessingHandle(ProcessingHandle, InformationClass, InBuffer, InBufferSize, OutBuffer, OutBufferSize, ReturnLength)
// ProcessingHandle : PROCESSTRACE_HANDLE -> 'PROCESSTRACE_HANDLE'
// InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE -> 'int32_t'
// InBuffer : void* optional -> 'void *'
// InBufferSize : DWORD -> 'uint32_t'
// OutBuffer : void* optional, out -> 'void *'
// OutBufferSize : DWORD -> 'uint32_t'
// ReturnLength : DWORD* in/out -> 'uint32_t *'
// 出力ポインタは koffi.out(...) で包む。構造体は koffi.struct で定義。
const lib = Deno.dlopen("ADVAPI32.dll", {
  QueryTraceProcessingHandle: { parameters: ["buffer", "i32", "pointer", "u32", "pointer", "u32", "pointer"], result: "u32" },
});
// lib.symbols.QueryTraceProcessingHandle(ProcessingHandle, InformationClass, InBuffer, InBufferSize, OutBuffer, OutBufferSize, ReturnLength)
// ProcessingHandle : PROCESSTRACE_HANDLE -> "buffer"
// InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE -> "i32"
// InBuffer : void* optional -> "pointer"
// InBufferSize : DWORD -> "u32"
// OutBuffer : void* optional, out -> "pointer"
// OutBufferSize : DWORD -> "u32"
// ReturnLength : DWORD* in/out -> "pointer"
// 文字列引数は "buffer"(NUL 終端のバイト列を Uint8Array で渡す)。
// 値渡し構造体は { struct: [ ...field types... ] } を使用。
<?php
$ffi = FFI::cdef(<<<C
uint32_t QueryTraceProcessingHandle(
    PROCESSTRACE_HANDLE ProcessingHandle,
    int32_t InformationClass,
    void* InBuffer,
    uint32_t InBufferSize,
    void* OutBuffer,
    uint32_t OutBufferSize,
    uint32_t* ReturnLength);
C, "ADVAPI32.dll");
// $ffi->QueryTraceProcessingHandle(ProcessingHandle, InformationClass, InBuffer, InBufferSize, OutBuffer, OutBufferSize, ReturnLength);
// ProcessingHandle : PROCESSTRACE_HANDLE
// InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE
// InBuffer : void* optional
// InBufferSize : DWORD
// OutBuffer : void* optional, out
// OutBufferSize : DWORD
// ReturnLength : DWORD* in/out
// 構造体/GUIDへのポインタは cdef が通るよう void* で表記(実型は各引数コメント参照)。値渡し構造体・enum は対応する typedef を cdef に追加すること。
// WINAPI(stdcall): x64 では呼出規約が統一されるため問題なし。x86 では __stdcall 対応のラッパが必要な場合あり。
import com.sun.jna.*;
import com.sun.jna.ptr.*;
import com.sun.jna.win32.StdCallLibrary;
import com.sun.jna.win32.W32APIOptions;

public interface Advapi32 extends StdCallLibrary {
    Advapi32 INSTANCE = Native.load("advapi32", Advapi32.class);
    int QueryTraceProcessingHandle(
        PROCESSTRACE_HANDLE /* extends Structure (by value) */ ProcessingHandle,   // PROCESSTRACE_HANDLE
        int InformationClass,   // ETW_PROCESS_HANDLE_INFO_TYPE
        Pointer InBuffer,   // void* optional
        int InBufferSize,   // DWORD
        Pointer OutBuffer,   // void* optional, out
        int OutBufferSize,   // DWORD
        IntByReference ReturnLength   // DWORD* in/out
    );
}
@[Link("advapi32")]
lib LibADVAPI32
  fun QueryTraceProcessingHandle = QueryTraceProcessingHandle(
    ProcessingHandle : PROCESSTRACE_HANDLE,   # PROCESSTRACE_HANDLE
    InformationClass : Int32,   # ETW_PROCESS_HANDLE_INFO_TYPE
    InBuffer : Void*,   # void* optional
    InBufferSize : UInt32,   # DWORD
    OutBuffer : Void*,   # void* optional, out
    OutBufferSize : UInt32,   # DWORD
    ReturnLength : UInt32*   # DWORD* in/out
  ) : UInt32
end
# 構造体/GUID/enum は lib 内に対応する型定義が必要。
# 呼出規約: x64 は規約統一のため OK。x86(32bit)は WINAPI=stdcall だが Crystal の fun に stdcall 付与構文がなく非対応。
import 'dart:ffi';
import 'package:ffi/ffi.dart';

typedef QueryTraceProcessingHandleNative = Uint32 Function(PROCESSTRACE_HANDLE, Int32, Pointer<Void>, Uint32, Pointer<Void>, Uint32, Pointer<Uint32>);
typedef QueryTraceProcessingHandleDart = int Function(int, int, Pointer<Void>, int, Pointer<Void>, int, Pointer<Uint32>);
final QueryTraceProcessingHandle = DynamicLibrary.open('ADVAPI32.dll')
    .lookupFunction<QueryTraceProcessingHandleNative, QueryTraceProcessingHandleDart>('QueryTraceProcessingHandle');
// ProcessingHandle : PROCESSTRACE_HANDLE -> PROCESSTRACE_HANDLE
// InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE -> Int32
// InBuffer : void* optional -> Pointer<Void>
// InBufferSize : DWORD -> Uint32
// OutBuffer : void* optional, out -> Pointer<Void>
// OutBufferSize : DWORD -> Uint32
// ReturnLength : DWORD* in/out -> Pointer<Uint32>
// 文字列は package:ffi の "...".toNativeUtf16()/toNativeUtf8() で変換。
{$mode objfpc}{$H+}
function QueryTraceProcessingHandle(
  ProcessingHandle: PROCESSTRACE_HANDLE;   // PROCESSTRACE_HANDLE
  InformationClass: Integer;   // ETW_PROCESS_HANDLE_INFO_TYPE
  InBuffer: Pointer;   // void* optional
  InBufferSize: DWORD;   // DWORD
  OutBuffer: Pointer;   // void* optional, out
  OutBufferSize: DWORD;   // DWORD
  ReturnLength: Pointer   // DWORD* in/out
): DWORD; stdcall;
  external 'ADVAPI32.dll' name 'QueryTraceProcessingHandle';
import Foreign
import Foreign.C.Types
import Foreign.C.String

foreign import stdcall safe "QueryTraceProcessingHandle"
  c_QueryTraceProcessingHandle :: PROCESSTRACE_HANDLE -> Int32 -> Ptr () -> Word32 -> Ptr () -> Word32 -> Ptr Word32 -> IO Word32
-- ProcessingHandle : PROCESSTRACE_HANDLE -> PROCESSTRACE_HANDLE
-- InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE -> Int32
-- InBuffer : void* optional -> Ptr ()
-- InBufferSize : DWORD -> Word32
-- OutBuffer : void* optional, out -> Ptr ()
-- OutBufferSize : DWORD -> Word32
-- ReturnLength : DWORD* in/out -> Ptr Word32
-- 要 GHC(Windows)。stdcall は x64 では ccall として扱われる。ブロックする API は safe 呼び出し推奨。
-- ※値渡し構造体は GHC FFI で直接渡せません。Ptr で渡すラッパ(C側)経由にしてください。
open Ctypes
open Foreign

let querytraceprocessinghandle =
  foreign "QueryTraceProcessingHandle"
    (PROCESSTRACE_HANDLE @-> int32_t @-> (ptr void) @-> uint32_t @-> (ptr void) @-> uint32_t @-> (ptr uint32_t) @-> returning uint32_t)
(* ProcessingHandle : PROCESSTRACE_HANDLE -> PROCESSTRACE_HANDLE *)
(* InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE -> int32_t *)
(* InBuffer : void* optional -> (ptr void) *)
(* InBufferSize : DWORD -> uint32_t *)
(* OutBuffer : void* optional, out -> (ptr void) *)
(* OutBufferSize : DWORD -> uint32_t *)
(* ReturnLength : DWORD* in/out -> (ptr uint32_t) *)
(* foreign は cdecl 前提。x64 Windows では WINAPI と一致。構造体は ctypes structure を定義のこと。 *)
(cffi:define-foreign-library advapi32 (t "ADVAPI32.dll"))
(cffi:use-foreign-library advapi32)

(cffi:defcfun ("QueryTraceProcessingHandle" query-trace-processing-handle :convention :stdcall) :uint32
  (processing-handle (:struct processtrace-handle))   ; PROCESSTRACE_HANDLE
  (information-class :int32)   ; ETW_PROCESS_HANDLE_INFO_TYPE
  (in-buffer :pointer)   ; void* optional
  (in-buffer-size :uint32)   ; DWORD
  (out-buffer :pointer)   ; void* optional, out
  (out-buffer-size :uint32)   ; DWORD
  (return-length :pointer))   ; DWORD* in/out
; isize/usize(INT_PTR/SIZE_T)は x64 前提で :int64/:uint64。x86 では :int32/:uint32。
use Win32::API;
my $QueryTraceProcessingHandle = Win32::API::More->new('ADVAPI32',
    'DWORD QueryTraceProcessingHandle(LPVOID ProcessingHandle, int InformationClass, LPVOID InBuffer, DWORD InBufferSize, LPVOID OutBuffer, DWORD OutBufferSize, LPVOID ReturnLength)');
# my $ret = $QueryTraceProcessingHandle->Call($ProcessingHandle, $InformationClass, $InBuffer, $InBufferSize, $OutBuffer, $OutBufferSize, $ReturnLength);
# ProcessingHandle : PROCESSTRACE_HANDLE -> LPVOID
# InformationClass : ETW_PROCESS_HANDLE_INFO_TYPE -> int
# InBuffer : void* optional -> LPVOID
# InBufferSize : DWORD -> DWORD
# OutBuffer : void* optional, out -> LPVOID
# OutBufferSize : DWORD -> DWORD
# ReturnLength : DWORD* in/out -> LPVOID
# 値渡し構造体は pack() した文字列、または Win32::API::Struct を使用。

関連項目

使用する型