ホーム › System.Hypervisor › ScanMemoryForDosImages

ScanMemoryForDosImages

関数

メモリ範囲を走査してPE/DOSイメージを検出する。

DLLVmSavedStateDumpProvider.dll呼出規約winapi

シグネチャ

// VmSavedStateDumpProvider.dll
#include <windows.h>

HRESULT ScanMemoryForDosImages(
    void* vmSavedStateDumpHandle,
    DWORD vpId,
    ULONGLONG startAddress,
    ULONGLONG endAddress,
    void* callbackContext,
    FOUND_IMAGE_CALLBACK foundImageCallback,
    ULONGLONG* standaloneAddress,
    DWORD standaloneAddressCount
);

パラメーター

名前	型	方向	説明
vmSavedStateDumpHandle	void*	inout	対象の保存状態ダンプハンドルを指定する。
vpId	DWORD	in	走査のコンテキストとなる仮想プロセッサのIDを指定する。
startAddress	ULONGLONG	in	メモリ走査を開始するゲスト仮想アドレスを指定する。
endAddress	ULONGLONG	in	メモリ走査を終了するゲスト仮想アドレスを指定する。
callbackContext	void*	inout	コールバックへ渡される呼び出し側定義のコンテキストポインタ。NULL可。
foundImageCallback	FOUND_IMAGE_CALLBACK	in	DOS/PEイメージを発見した際に呼び出されるコールバック関数ポインタ。
standaloneAddress	ULONGLONG*	in	追加で個別に走査するアドレスの配列へのポインタ。NULL可。
standaloneAddressCount	DWORD	in	standaloneAddress配列の要素数を指定する。

戻り値の型: HRESULT

各言語での呼び出し定義

// VmSavedStateDumpProvider.dll
#include <windows.h>

HRESULT ScanMemoryForDosImages(
    void* vmSavedStateDumpHandle,
    DWORD vpId,
    ULONGLONG startAddress,
    ULONGLONG endAddress,
    void* callbackContext,
    FOUND_IMAGE_CALLBACK foundImageCallback,
    ULONGLONG* standaloneAddress,
    DWORD standaloneAddressCount
);

[DllImport("VmSavedStateDumpProvider.dll", ExactSpelling = true)]
static extern int ScanMemoryForDosImages(
    IntPtr vmSavedStateDumpHandle,   // void* in/out
    uint vpId,   // DWORD
    ulong startAddress,   // ULONGLONG
    ulong endAddress,   // ULONGLONG
    IntPtr callbackContext,   // void* in/out
    IntPtr foundImageCallback,   // FOUND_IMAGE_CALLBACK
    ref ulong standaloneAddress,   // ULONGLONG*
    uint standaloneAddressCount   // DWORD
);

<DllImport("VmSavedStateDumpProvider.dll", ExactSpelling:=True)>
Public Shared Function ScanMemoryForDosImages(
    vmSavedStateDumpHandle As IntPtr,   ' void* in/out
    vpId As UInteger,   ' DWORD
    startAddress As ULong,   ' ULONGLONG
    endAddress As ULong,   ' ULONGLONG
    callbackContext As IntPtr,   ' void* in/out
    foundImageCallback As IntPtr,   ' FOUND_IMAGE_CALLBACK
    ByRef standaloneAddress As ULong,   ' ULONGLONG*
    standaloneAddressCount As UInteger   ' DWORD
) As Integer
End Function

' vmSavedStateDumpHandle : void* in/out
' vpId : DWORD
' startAddress : ULONGLONG
' endAddress : ULONGLONG
' callbackContext : void* in/out
' foundImageCallback : FOUND_IMAGE_CALLBACK
' standaloneAddress : ULONGLONG*
' standaloneAddressCount : DWORD
Declare PtrSafe Function ScanMemoryForDosImages Lib "vmsavedstatedumpprovider" ( _
    ByVal vmSavedStateDumpHandle As LongPtr, _
    ByVal vpId As Long, _
    ByVal startAddress As LongLong, _
    ByVal endAddress As LongLong, _
    ByVal callbackContext As LongPtr, _
    ByVal foundImageCallback As LongPtr, _
    ByRef standaloneAddress As LongLong, _
    ByVal standaloneAddressCount As Long) As Long
' VBA7前提(PtrSafe)。32bit Office では LongPtr→Long。Integer=16bit / Long=32bit / LongLong=64bit。

import ctypes
from ctypes import wintypes

ScanMemoryForDosImages = ctypes.windll.vmsavedstatedumpprovider.ScanMemoryForDosImages
ScanMemoryForDosImages.restype = ctypes.c_int
ScanMemoryForDosImages.argtypes = [
    ctypes.POINTER(None),  # vmSavedStateDumpHandle : void* in/out
    wintypes.DWORD,  # vpId : DWORD
    ctypes.c_ulonglong,  # startAddress : ULONGLONG
    ctypes.c_ulonglong,  # endAddress : ULONGLONG
    ctypes.POINTER(None),  # callbackContext : void* in/out
    ctypes.c_void_p,  # foundImageCallback : FOUND_IMAGE_CALLBACK
    ctypes.POINTER(ctypes.c_ulonglong),  # standaloneAddress : ULONGLONG*
    wintypes.DWORD,  # standaloneAddressCount : DWORD
]

require 'fiddle'
require 'fiddle/import'

lib = Fiddle.dlopen('VmSavedStateDumpProvider.dll')
ScanMemoryForDosImages = Fiddle::Function.new(
  lib['ScanMemoryForDosImages'],
  [
    Fiddle::TYPE_VOIDP,  # vmSavedStateDumpHandle : void* in/out
    -Fiddle::TYPE_INT,  # vpId : DWORD
    -Fiddle::TYPE_LONG_LONG,  # startAddress : ULONGLONG
    -Fiddle::TYPE_LONG_LONG,  # endAddress : ULONGLONG
    Fiddle::TYPE_VOIDP,  # callbackContext : void* in/out
    Fiddle::TYPE_VOIDP,  # foundImageCallback : FOUND_IMAGE_CALLBACK
    Fiddle::TYPE_VOIDP,  # standaloneAddress : ULONGLONG*
    -Fiddle::TYPE_INT,  # standaloneAddressCount : DWORD
  ],
  Fiddle::TYPE_INT)

#[link(name = "vmsavedstatedumpprovider")]
extern "system" {
    fn ScanMemoryForDosImages(
        vmSavedStateDumpHandle: *mut (),  // void* in/out
        vpId: u32,  // DWORD
        startAddress: u64,  // ULONGLONG
        endAddress: u64,  // ULONGLONG
        callbackContext: *mut (),  // void* in/out
        foundImageCallback: *const core::ffi::c_void,  // FOUND_IMAGE_CALLBACK
        standaloneAddress: *mut u64,  // ULONGLONG*
        standaloneAddressCount: u32  // DWORD
    ) -> i32;
}
// crates: windows-sys provides ready-made bindings for this API.

$sig = @"
[DllImport("VmSavedStateDumpProvider.dll")]
public static extern int ScanMemoryForDosImages(IntPtr vmSavedStateDumpHandle, uint vpId, ulong startAddress, ulong endAddress, IntPtr callbackContext, IntPtr foundImageCallback, ref ulong standaloneAddress, uint standaloneAddressCount);
"@
$api = Add-Type -MemberDefinition $sig -Name 'VmSavedStateDumpProvider_ScanMemoryForDosImages' -Namespace Win32 -PassThru
# $api::ScanMemoryForDosImages(vmSavedStateDumpHandle, vpId, startAddress, endAddress, callbackContext, foundImageCallback, standaloneAddress, standaloneAddressCount)

#uselib "VmSavedStateDumpProvider.dll"
#func global ScanMemoryForDosImages "ScanMemoryForDosImages" sptr, sptr, sptr, sptr, sptr, sptr, sptr, sptr
; ScanMemoryForDosImages vmSavedStateDumpHandle, vpId, startAddress, endAddress, callbackContext, foundImageCallback, varptr(standaloneAddress), standaloneAddressCount   ; 戻り値は stat
; vmSavedStateDumpHandle : void* in/out -> "sptr"
; vpId : DWORD -> "sptr"
; startAddress : ULONGLONG -> "sptr"
; endAddress : ULONGLONG -> "sptr"
; callbackContext : void* in/out -> "sptr"
; foundImageCallback : FOUND_IMAGE_CALLBACK -> "sptr"
; standaloneAddress : ULONGLONG* -> "sptr"
; standaloneAddressCount : DWORD -> "sptr"
; ※HSP3.7は int64 引数(64bit値渡し)に非対応です。
; ※HSP3.7は #func のため戻り値はシステム変数 stat に格納されます。

出力引数:

#uselib "VmSavedStateDumpProvider.dll"
#cfunc global ScanMemoryForDosImages "ScanMemoryForDosImages" sptr, int, int64, int64, sptr, sptr, var, int
; res = ScanMemoryForDosImages(vmSavedStateDumpHandle, vpId, startAddress, endAddress, callbackContext, foundImageCallback, standaloneAddress, standaloneAddressCount)
; vmSavedStateDumpHandle : void* in/out -> "sptr"
; vpId : DWORD -> "int"
; startAddress : ULONGLONG -> "int64"
; endAddress : ULONGLONG -> "int64"
; callbackContext : void* in/out -> "sptr"
; foundImageCallback : FOUND_IMAGE_CALLBACK -> "sptr"
; standaloneAddress : ULONGLONG* -> "var"
; standaloneAddressCount : DWORD -> "int"
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。
; ※int64 引数の DLL 値渡しは x64 ランタイム(hsp3_64)のみ対応(x86 は未対応)。#uselib "VmSavedStateDumpProvider.dll"
#cfunc global ScanMemoryForDosImages "ScanMemoryForDosImages" sptr, int, int64, int64, sptr, sptr, sptr, int
; res = ScanMemoryForDosImages(vmSavedStateDumpHandle, vpId, startAddress, endAddress, callbackContext, foundImageCallback, varptr(standaloneAddress), standaloneAddressCount)
; vmSavedStateDumpHandle : void* in/out -> "sptr"
; vpId : DWORD -> "int"
; startAddress : ULONGLONG -> "int64"
; endAddress : ULONGLONG -> "int64"
; callbackContext : void* in/out -> "sptr"
; foundImageCallback : FOUND_IMAGE_CALLBACK -> "sptr"
; standaloneAddress : ULONGLONG* -> "sptr"
; standaloneAddressCount : DWORD -> "int"
; ※出力/バッファ引数はポインタ方式(token=sptr / 呼び出しは varptr(変数))。
; ※int64 引数の DLL 値渡しは x64 ランタイム(hsp3_64)のみ対応(x86 は未対応)。

出力引数:

; HRESULT ScanMemoryForDosImages(void* vmSavedStateDumpHandle, DWORD vpId, ULONGLONG startAddress, ULONGLONG endAddress, void* callbackContext, FOUND_IMAGE_CALLBACK foundImageCallback, ULONGLONG* standaloneAddress, DWORD standaloneAddressCount)
#uselib "VmSavedStateDumpProvider.dll"
#cfunc global ScanMemoryForDosImages "ScanMemoryForDosImages" intptr, int, int64, int64, intptr, intptr, var, int
; res = ScanMemoryForDosImages(vmSavedStateDumpHandle, vpId, startAddress, endAddress, callbackContext, foundImageCallback, standaloneAddress, standaloneAddressCount)
; vmSavedStateDumpHandle : void* in/out -> "intptr"
; vpId : DWORD -> "int"
; startAddress : ULONGLONG -> "int64"
; endAddress : ULONGLONG -> "int64"
; callbackContext : void* in/out -> "intptr"
; foundImageCallback : FOUND_IMAGE_CALLBACK -> "intptr"
; standaloneAddress : ULONGLONG* -> "var"
; standaloneAddressCount : DWORD -> "int"
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。; HRESULT ScanMemoryForDosImages(void* vmSavedStateDumpHandle, DWORD vpId, ULONGLONG startAddress, ULONGLONG endAddress, void* callbackContext, FOUND_IMAGE_CALLBACK foundImageCallback, ULONGLONG* standaloneAddress, DWORD standaloneAddressCount)
#uselib "VmSavedStateDumpProvider.dll"
#cfunc global ScanMemoryForDosImages "ScanMemoryForDosImages" intptr, int, int64, int64, intptr, intptr, intptr, int
; res = ScanMemoryForDosImages(vmSavedStateDumpHandle, vpId, startAddress, endAddress, callbackContext, foundImageCallback, varptr(standaloneAddress), standaloneAddressCount)
; vmSavedStateDumpHandle : void* in/out -> "intptr"
; vpId : DWORD -> "int"
; startAddress : ULONGLONG -> "int64"
; endAddress : ULONGLONG -> "int64"
; callbackContext : void* in/out -> "intptr"
; foundImageCallback : FOUND_IMAGE_CALLBACK -> "intptr"
; standaloneAddress : ULONGLONG* -> "intptr"
; standaloneAddressCount : DWORD -> "int"
; ※出力/バッファ引数はポインタ方式(token=intptr / 呼び出しは varptr(変数))。

import (
	"golang.org/x/sys/windows"
	"unsafe"
)

var (
	vmsavedstatedumpprovider = windows.NewLazySystemDLL("VmSavedStateDumpProvider.dll")
	procScanMemoryForDosImages = vmsavedstatedumpprovider.NewProc("ScanMemoryForDosImages")
)

// vmSavedStateDumpHandle (void* in/out), vpId (DWORD), startAddress (ULONGLONG), endAddress (ULONGLONG), callbackContext (void* in/out), foundImageCallback (FOUND_IMAGE_CALLBACK), standaloneAddress (ULONGLONG*), standaloneAddressCount (DWORD)
r1, _, err := procScanMemoryForDosImages.Call(
	uintptr(vmSavedStateDumpHandle),
	uintptr(vpId),
	uintptr(startAddress),
	uintptr(endAddress),
	uintptr(callbackContext),
	uintptr(foundImageCallback),
	uintptr(standaloneAddress),
	uintptr(standaloneAddressCount),
)
_ = err  // syscall.Errno (valid when the call sets last-error)
_ = r1   // HRESULT

function ScanMemoryForDosImages(
  vmSavedStateDumpHandle: Pointer;   // void* in/out
  vpId: DWORD;   // DWORD
  startAddress: UInt64;   // ULONGLONG
  endAddress: UInt64;   // ULONGLONG
  callbackContext: Pointer;   // void* in/out
  foundImageCallback: Pointer;   // FOUND_IMAGE_CALLBACK
  standaloneAddress: Pointer;   // ULONGLONG*
  standaloneAddressCount: DWORD   // DWORD
): Integer; stdcall;
  external 'VmSavedStateDumpProvider.dll' name 'ScanMemoryForDosImages';

result := DllCall("VmSavedStateDumpProvider\ScanMemoryForDosImages"
    , "Ptr", vmSavedStateDumpHandle   ; void* in/out
    , "UInt", vpId   ; DWORD
    , "Int64", startAddress   ; ULONGLONG
    , "Int64", endAddress   ; ULONGLONG
    , "Ptr", callbackContext   ; void* in/out
    , "Ptr", foundImageCallback   ; FOUND_IMAGE_CALLBACK
    , "Ptr", standaloneAddress   ; ULONGLONG*
    , "UInt", standaloneAddressCount   ; DWORD
    , "Int")   ; return: HRESULT

●ScanMemoryForDosImages(vmSavedStateDumpHandle, vpId, startAddress, endAddress, callbackContext, foundImageCallback, standaloneAddress, standaloneAddressCount) = DLL("VmSavedStateDumpProvider.dll", "int ScanMemoryForDosImages(void*, dword, qword, qword, void*, void*, void*, dword)")
# 呼び出し: ScanMemoryForDosImages(vmSavedStateDumpHandle, vpId, startAddress, endAddress, callbackContext, foundImageCallback, standaloneAddress, standaloneAddressCount)
# vmSavedStateDumpHandle : void* in/out -> "void*"
# vpId : DWORD -> "dword"
# startAddress : ULONGLONG -> "qword"
# endAddress : ULONGLONG -> "qword"
# callbackContext : void* in/out -> "void*"
# foundImageCallback : FOUND_IMAGE_CALLBACK -> "void*"
# standaloneAddress : ULONGLONG* -> "void*"
# standaloneAddressCount : DWORD -> "dword"
# なでしこ1は32bit・ANSI(Shift_JIS)。文字列=char*(ANSI)、ポインタ/ハンドル=void*(4byte)。

const std = @import("std");

extern "vmsavedstatedumpprovider" fn ScanMemoryForDosImages(
    vmSavedStateDumpHandle: ?*anyopaque, // void* in/out
    vpId: u32, // DWORD
    startAddress: u64, // ULONGLONG
    endAddress: u64, // ULONGLONG
    callbackContext: ?*anyopaque, // void* in/out
    foundImageCallback: ?*anyopaque, // FOUND_IMAGE_CALLBACK
    standaloneAddress: [*c]u64, // ULONGLONG*
    standaloneAddressCount: u32 // DWORD
) callconv(std.os.windows.WINAPI) i32;

proc ScanMemoryForDosImages(
    vmSavedStateDumpHandle: pointer,  # void* in/out
    vpId: uint32,  # DWORD
    startAddress: uint64,  # ULONGLONG
    endAddress: uint64,  # ULONGLONG
    callbackContext: pointer,  # void* in/out
    foundImageCallback: pointer,  # FOUND_IMAGE_CALLBACK
    standaloneAddress: ptr uint64,  # ULONGLONG*
    standaloneAddressCount: uint32  # DWORD
): int32 {.importc: "ScanMemoryForDosImages", stdcall, dynlib: "VmSavedStateDumpProvider.dll".}

pragma(lib, "vmsavedstatedumpprovider");
extern(Windows)
int ScanMemoryForDosImages(
    void* vmSavedStateDumpHandle,   // void* in/out
    uint vpId,   // DWORD
    ulong startAddress,   // ULONGLONG
    ulong endAddress,   // ULONGLONG
    void* callbackContext,   // void* in/out
    void* foundImageCallback,   // FOUND_IMAGE_CALLBACK
    ulong* standaloneAddress,   // ULONGLONG*
    uint standaloneAddressCount   // DWORD
);

ccall((:ScanMemoryForDosImages, "VmSavedStateDumpProvider.dll"), stdcall, Int32,
      (Ptr{Cvoid}, UInt32, UInt64, UInt64, Ptr{Cvoid}, Ptr{Cvoid}, Ptr{UInt64}, UInt32),
      vmSavedStateDumpHandle, vpId, startAddress, endAddress, callbackContext, foundImageCallback, standaloneAddress, standaloneAddressCount)
# vmSavedStateDumpHandle : void* in/out -> Ptr{Cvoid}
# vpId : DWORD -> UInt32
# startAddress : ULONGLONG -> UInt64
# endAddress : ULONGLONG -> UInt64
# callbackContext : void* in/out -> Ptr{Cvoid}
# foundImageCallback : FOUND_IMAGE_CALLBACK -> Ptr{Cvoid}
# standaloneAddress : ULONGLONG* -> Ptr{UInt64}
# standaloneAddressCount : DWORD -> UInt32
# stdcall は 32bit のみ意味を持つ(x64 では無視)。

local ffi = require("ffi")
ffi.cdef[[
int32_t ScanMemoryForDosImages(
    void* vmSavedStateDumpHandle,
    uint32_t vpId,
    uint64_t startAddress,
    uint64_t endAddress,
    void* callbackContext,
    void* foundImageCallback,
    uint64_t* standaloneAddress,
    uint32_t standaloneAddressCount);
]]
local vmsavedstatedumpprovider = ffi.load("vmsavedstatedumpprovider")
-- vmsavedstatedumpprovider.ScanMemoryForDosImages(vmSavedStateDumpHandle, vpId, startAddress, endAddress, callbackContext, foundImageCallback, standaloneAddress, standaloneAddressCount)
-- vmSavedStateDumpHandle : void* in/out
-- vpId : DWORD
-- startAddress : ULONGLONG
-- endAddress : ULONGLONG
-- callbackContext : void* in/out
-- foundImageCallback : FOUND_IMAGE_CALLBACK
-- standaloneAddress : ULONGLONG*
-- standaloneAddressCount : DWORD
-- 構造体/GUIDへのポインタは cdef が通るよう void* で表記(実型は各引数コメント参照)。値渡し構造体・enum は対応する typedef を cdef に追加すること。

const koffi = require('koffi');
const lib = koffi.load('VmSavedStateDumpProvider.dll');
const ScanMemoryForDosImages = lib.func('__stdcall', 'ScanMemoryForDosImages', 'int32_t', ['void *', 'uint32_t', 'uint64_t', 'uint64_t', 'void *', 'void *', 'uint64_t *', 'uint32_t']);
// ScanMemoryForDosImages(vmSavedStateDumpHandle, vpId, startAddress, endAddress, callbackContext, foundImageCallback, standaloneAddress, standaloneAddressCount)
// vmSavedStateDumpHandle : void* in/out -> 'void *'
// vpId : DWORD -> 'uint32_t'
// startAddress : ULONGLONG -> 'uint64_t'
// endAddress : ULONGLONG -> 'uint64_t'
// callbackContext : void* in/out -> 'void *'
// foundImageCallback : FOUND_IMAGE_CALLBACK -> 'void *'
// standaloneAddress : ULONGLONG* -> 'uint64_t *'
// standaloneAddressCount : DWORD -> 'uint32_t'
// 出力ポインタは koffi.out(...) で包む。構造体は koffi.struct で定義。
// コールバック(関数ポインタ)は koffi.proto/koffi.register で型を定義して渡す(素の void* では JS 関数を渡せない)。

const lib = Deno.dlopen("VmSavedStateDumpProvider.dll", {
  ScanMemoryForDosImages: { parameters: ["pointer", "u32", "u64", "u64", "pointer", "pointer", "pointer", "u32"], result: "i32" },
});
// lib.symbols.ScanMemoryForDosImages(vmSavedStateDumpHandle, vpId, startAddress, endAddress, callbackContext, foundImageCallback, standaloneAddress, standaloneAddressCount)
// vmSavedStateDumpHandle : void* in/out -> "pointer"
// vpId : DWORD -> "u32"
// startAddress : ULONGLONG -> "u64"
// endAddress : ULONGLONG -> "u64"
// callbackContext : void* in/out -> "pointer"
// foundImageCallback : FOUND_IMAGE_CALLBACK -> "pointer"
// standaloneAddress : ULONGLONG* -> "pointer"
// standaloneAddressCount : DWORD -> "u32"
// 文字列引数は "buffer"(NUL 終端のバイト列を Uint8Array で渡す)。
// 値渡し構造体は { struct: [ ...field types... ] } を使用。

<?php
$ffi = FFI::cdef(<<<C
int32_t ScanMemoryForDosImages(
    void* vmSavedStateDumpHandle,
    uint32_t vpId,
    uint64_t startAddress,
    uint64_t endAddress,
    void* callbackContext,
    void* foundImageCallback,
    uint64_t* standaloneAddress,
    uint32_t standaloneAddressCount);
C, "VmSavedStateDumpProvider.dll");
// $ffi->ScanMemoryForDosImages(vmSavedStateDumpHandle, vpId, startAddress, endAddress, callbackContext, foundImageCallback, standaloneAddress, standaloneAddressCount);
// vmSavedStateDumpHandle : void* in/out
// vpId : DWORD
// startAddress : ULONGLONG
// endAddress : ULONGLONG
// callbackContext : void* in/out
// foundImageCallback : FOUND_IMAGE_CALLBACK
// standaloneAddress : ULONGLONG*
// standaloneAddressCount : DWORD
// 構造体/GUIDへのポインタは cdef が通るよう void* で表記(実型は各引数コメント参照)。値渡し構造体・enum は対応する typedef を cdef に追加すること。
// WINAPI(stdcall): x64 では呼出規約が統一されるため問題なし。x86 では __stdcall 対応のラッパが必要な場合あり。

import com.sun.jna.*;
import com.sun.jna.ptr.*;
import com.sun.jna.win32.StdCallLibrary;
import com.sun.jna.win32.W32APIOptions;

public interface Vmsavedstatedumpprovider extends StdCallLibrary {
    Vmsavedstatedumpprovider INSTANCE = Native.load("vmsavedstatedumpprovider", Vmsavedstatedumpprovider.class);
    int ScanMemoryForDosImages(
        Pointer vmSavedStateDumpHandle,   // void* in/out
        int vpId,   // DWORD
        long startAddress,   // ULONGLONG
        long endAddress,   // ULONGLONG
        Pointer callbackContext,   // void* in/out
        Callback foundImageCallback,   // FOUND_IMAGE_CALLBACK
        LongByReference standaloneAddress,   // ULONGLONG*
        int standaloneAddressCount   // DWORD
    );
}

@[Link("vmsavedstatedumpprovider")]
lib LibVmSavedStateDumpProvider
  fun ScanMemoryForDosImages = ScanMemoryForDosImages(
    vmSavedStateDumpHandle : Void*,   # void* in/out
    vpId : UInt32,   # DWORD
    startAddress : UInt64,   # ULONGLONG
    endAddress : UInt64,   # ULONGLONG
    callbackContext : Void*,   # void* in/out
    foundImageCallback : Void*,   # FOUND_IMAGE_CALLBACK
    standaloneAddress : UInt64*,   # ULONGLONG*
    standaloneAddressCount : UInt32   # DWORD
  ) : Int32
end
# 構造体/GUID/enum は lib 内に対応する型定義が必要。
# 呼出規約: x64 は規約統一のため OK。x86(32bit)は WINAPI=stdcall だが Crystal の fun に stdcall 付与構文がなく非対応。

import 'dart:ffi';
import 'package:ffi/ffi.dart';

typedef ScanMemoryForDosImagesNative = Int32 Function(Pointer<Void>, Uint32, Uint64, Uint64, Pointer<Void>, Pointer<Void>, Pointer<Uint64>, Uint32);
typedef ScanMemoryForDosImagesDart = int Function(Pointer<Void>, int, int, int, Pointer<Void>, Pointer<Void>, Pointer<Uint64>, int);
final ScanMemoryForDosImages = DynamicLibrary.open('VmSavedStateDumpProvider.dll')
    .lookupFunction<ScanMemoryForDosImagesNative, ScanMemoryForDosImagesDart>('ScanMemoryForDosImages');
// vmSavedStateDumpHandle : void* in/out -> Pointer<Void>
// vpId : DWORD -> Uint32
// startAddress : ULONGLONG -> Uint64
// endAddress : ULONGLONG -> Uint64
// callbackContext : void* in/out -> Pointer<Void>
// foundImageCallback : FOUND_IMAGE_CALLBACK -> Pointer<Void>
// standaloneAddress : ULONGLONG* -> Pointer<Uint64>
// standaloneAddressCount : DWORD -> Uint32
// 文字列は package:ffi の "...".toNativeUtf16()/toNativeUtf8() で変換。

{$mode objfpc}{$H+}
function ScanMemoryForDosImages(
  vmSavedStateDumpHandle: Pointer;   // void* in/out
  vpId: DWORD;   // DWORD
  startAddress: UInt64;   // ULONGLONG
  endAddress: UInt64;   // ULONGLONG
  callbackContext: Pointer;   // void* in/out
  foundImageCallback: Pointer;   // FOUND_IMAGE_CALLBACK
  standaloneAddress: Pointer;   // ULONGLONG*
  standaloneAddressCount: DWORD   // DWORD
): Integer; stdcall;
  external 'VmSavedStateDumpProvider.dll' name 'ScanMemoryForDosImages';

import Foreign
import Foreign.C.Types
import Foreign.C.String

foreign import stdcall safe "ScanMemoryForDosImages"
  c_ScanMemoryForDosImages :: Ptr () -> Word32 -> Word64 -> Word64 -> Ptr () -> Ptr () -> Ptr Word64 -> Word32 -> IO Int32
-- vmSavedStateDumpHandle : void* in/out -> Ptr ()
-- vpId : DWORD -> Word32
-- startAddress : ULONGLONG -> Word64
-- endAddress : ULONGLONG -> Word64
-- callbackContext : void* in/out -> Ptr ()
-- foundImageCallback : FOUND_IMAGE_CALLBACK -> Ptr ()
-- standaloneAddress : ULONGLONG* -> Ptr Word64
-- standaloneAddressCount : DWORD -> Word32
-- 要 GHC(Windows)。stdcall は x64 では ccall として扱われる。ブロックする API は safe 呼び出し推奨。

open Ctypes
open Foreign

let scanmemoryfordosimages =
  foreign "ScanMemoryForDosImages"
    ((ptr void) @-> uint32_t @-> uint64_t @-> uint64_t @-> (ptr void) @-> (ptr void) @-> (ptr uint64_t) @-> uint32_t @-> returning int32_t)
(* vmSavedStateDumpHandle : void* in/out -> (ptr void) *)
(* vpId : DWORD -> uint32_t *)
(* startAddress : ULONGLONG -> uint64_t *)
(* endAddress : ULONGLONG -> uint64_t *)
(* callbackContext : void* in/out -> (ptr void) *)
(* foundImageCallback : FOUND_IMAGE_CALLBACK -> (ptr void) *)
(* standaloneAddress : ULONGLONG* -> (ptr uint64_t) *)
(* standaloneAddressCount : DWORD -> uint32_t *)
(* foreign は cdecl 前提。x64 Windows では WINAPI と一致。構造体は ctypes structure を定義のこと。 *)

(cffi:define-foreign-library vmsavedstatedumpprovider (t "VmSavedStateDumpProvider.dll"))
(cffi:use-foreign-library vmsavedstatedumpprovider)

(cffi:defcfun ("ScanMemoryForDosImages" scan-memory-for-dos-images :convention :stdcall) :int32
  (vm-saved-state-dump-handle :pointer)   ; void* in/out
  (vp-id :uint32)   ; DWORD
  (start-address :uint64)   ; ULONGLONG
  (end-address :uint64)   ; ULONGLONG
  (callback-context :pointer)   ; void* in/out
  (found-image-callback :pointer)   ; FOUND_IMAGE_CALLBACK
  (standalone-address :pointer)   ; ULONGLONG*
  (standalone-address-count :uint32))   ; DWORD
; isize/usize(INT_PTR/SIZE_T)は x64 前提で :int64/:uint64。x86 では :int32/:uint32。

use Win32::API;
my $ScanMemoryForDosImages = Win32::API::More->new('VmSavedStateDumpProvider',
    'int ScanMemoryForDosImages(LPVOID vmSavedStateDumpHandle, DWORD vpId, UINT64 startAddress, UINT64 endAddress, LPVOID callbackContext, LPVOID foundImageCallback, LPVOID standaloneAddress, DWORD standaloneAddressCount)');
# my $ret = $ScanMemoryForDosImages->Call($vmSavedStateDumpHandle, $vpId, $startAddress, $endAddress, $callbackContext, $foundImageCallback, $standaloneAddress, $standaloneAddressCount);
# vmSavedStateDumpHandle : void* in/out -> LPVOID
# vpId : DWORD -> DWORD
# startAddress : ULONGLONG -> UINT64
# endAddress : ULONGLONG -> UINT64
# callbackContext : void* in/out -> LPVOID
# foundImageCallback : FOUND_IMAGE_CALLBACK -> LPVOID
# standaloneAddress : ULONGLONG* -> LPVOID
# standaloneAddressCount : DWORD -> DWORD
# 値渡し構造体は pack() した文字列、または Win32::API::Struct を使用。
# コールバック(関数ポインタ)は Perl sub を直接渡せません。Win32::API::Callback を使用してください。

ScanMemoryForDosImages

シグネチャ

パラメーター

各言語での呼び出し定義

関連項目