ホーム › System.WinRT › WindowsInspectString

WindowsInspectString

関数

別プロセス内のHSTRING内容をコールバック経由で調査する。

DLLapi-ms-win-core-winrt-string-l1-1-0.dll呼出規約winapi対応OSwindows8.0

シグネチャ

// api-ms-win-core-winrt-string-l1-1-0.dll
#include <windows.h>

HRESULT WindowsInspectString(
    UINT_PTR targetHString,
    WORD machine,
    PINSPECT_HSTRING_CALLBACK callback,
    void* context,   // optional
    DWORD* length,
    UINT_PTR* targetStringAddress
);

パラメーター

名前	型	方向	説明
targetHString	UINT_PTR	in	検査対象プロセス内のHSTRINGのアドレス(UINT_PTR)。
machine	WORD	in	対象プロセスのマシンアーキテクチャを示すIMAGE_FILE_MACHINE値。
callback	PINSPECT_HSTRING_CALLBACK	in	対象プロセスのメモリを読み取るPINSPECT_HSTRING_CALLBACKコールバック。
context	void*	inoptional	コールバックに渡すユーザー定義コンテキストポインタ。NULL可。
length	DWORD*	out	出力として文字列長を受け取るDWORDポインタ。
targetStringAddress	UINT_PTR*	out	出力として対象プロセス内の文字列バッファアドレスを受け取るポインタ。

戻り値の型: HRESULT

各言語での呼び出し定義

// api-ms-win-core-winrt-string-l1-1-0.dll
#include <windows.h>

HRESULT WindowsInspectString(
    UINT_PTR targetHString,
    WORD machine,
    PINSPECT_HSTRING_CALLBACK callback,
    void* context,   // optional
    DWORD* length,
    UINT_PTR* targetStringAddress
);

[DllImport("api-ms-win-core-winrt-string-l1-1-0.dll", ExactSpelling = true)]
static extern int WindowsInspectString(
    UIntPtr targetHString,   // UINT_PTR
    ushort machine,   // WORD
    IntPtr callback,   // PINSPECT_HSTRING_CALLBACK
    IntPtr context,   // void* optional
    out uint length,   // DWORD* out
    out UIntPtr targetStringAddress   // UINT_PTR* out
);

<DllImport("api-ms-win-core-winrt-string-l1-1-0.dll", ExactSpelling:=True)>
Public Shared Function WindowsInspectString(
    targetHString As UIntPtr,   ' UINT_PTR
    machine As UShort,   ' WORD
    callback As IntPtr,   ' PINSPECT_HSTRING_CALLBACK
    context As IntPtr,   ' void* optional
    <Out> ByRef length As UInteger,   ' DWORD* out
    <Out> ByRef targetStringAddress As UIntPtr   ' UINT_PTR* out
) As Integer
End Function

' targetHString : UINT_PTR
' machine : WORD
' callback : PINSPECT_HSTRING_CALLBACK
' context : void* optional
' length : DWORD* out
' targetStringAddress : UINT_PTR* out
Declare PtrSafe Function WindowsInspectString Lib "api-ms-win-core-winrt-string-l1-1-0" ( _
    ByVal targetHString As LongPtr, _
    ByVal machine As Integer, _
    ByVal callback As LongPtr, _
    ByVal context As LongPtr, _
    ByRef length As Long, _
    ByRef targetStringAddress As LongPtr) As Long
' VBA7前提(PtrSafe)。32bit Office では LongPtr→Long。Integer=16bit / Long=32bit / LongLong=64bit。

import ctypes
from ctypes import wintypes

WindowsInspectString = ctypes.windll.LoadLibrary("api-ms-win-core-winrt-string-l1-1-0.dll").WindowsInspectString
WindowsInspectString.restype = ctypes.c_int
WindowsInspectString.argtypes = [
    ctypes.c_size_t,  # targetHString : UINT_PTR
    ctypes.c_ushort,  # machine : WORD
    ctypes.c_void_p,  # callback : PINSPECT_HSTRING_CALLBACK
    ctypes.POINTER(None),  # context : void* optional
    ctypes.POINTER(wintypes.DWORD),  # length : DWORD* out
    ctypes.POINTER(ctypes.c_size_t),  # targetStringAddress : UINT_PTR* out
]

require 'fiddle'
require 'fiddle/import'

lib = Fiddle.dlopen('api-ms-win-core-winrt-string-l1-1-0.dll')
WindowsInspectString = Fiddle::Function.new(
  lib['WindowsInspectString'],
  [
    Fiddle::TYPE_UINTPTR_T,  # targetHString : UINT_PTR
    -Fiddle::TYPE_SHORT,  # machine : WORD
    Fiddle::TYPE_VOIDP,  # callback : PINSPECT_HSTRING_CALLBACK
    Fiddle::TYPE_VOIDP,  # context : void* optional
    Fiddle::TYPE_VOIDP,  # length : DWORD* out
    Fiddle::TYPE_VOIDP,  # targetStringAddress : UINT_PTR* out
  ],
  Fiddle::TYPE_INT)

#[link(name = "api-ms-win-core-winrt-string-l1-1-0")]
extern "system" {
    fn WindowsInspectString(
        targetHString: usize,  // UINT_PTR
        machine: u16,  // WORD
        callback: *const core::ffi::c_void,  // PINSPECT_HSTRING_CALLBACK
        context: *mut (),  // void* optional
        length: *mut u32,  // DWORD* out
        targetStringAddress: *mut usize  // UINT_PTR* out
    ) -> i32;
}
// crates: windows-sys provides ready-made bindings for this API.

$sig = @"
[DllImport("api-ms-win-core-winrt-string-l1-1-0.dll")]
public static extern int WindowsInspectString(UIntPtr targetHString, ushort machine, IntPtr callback, IntPtr context, out uint length, out UIntPtr targetStringAddress);
"@
$api = Add-Type -MemberDefinition $sig -Name 'api-ms-win-core-winrt-string-l1-1-0_WindowsInspectString' -Namespace Win32 -PassThru
# $api::WindowsInspectString(targetHString, machine, callback, context, length, targetStringAddress)

#uselib "api-ms-win-core-winrt-string-l1-1-0.dll"
#func global WindowsInspectString "WindowsInspectString" sptr, sptr, sptr, sptr, sptr, sptr
; WindowsInspectString targetHString, machine, callback, context, varptr(length), varptr(targetStringAddress)   ; 戻り値は stat
; targetHString : UINT_PTR -> "sptr"
; machine : WORD -> "sptr"
; callback : PINSPECT_HSTRING_CALLBACK -> "sptr"
; context : void* optional -> "sptr"
; length : DWORD* out -> "sptr"
; targetStringAddress : UINT_PTR* out -> "sptr"
; ※HSP3.7は #func のため戻り値はシステム変数 stat に格納されます。

出力引数:

#uselib "api-ms-win-core-winrt-string-l1-1-0.dll"
#cfunc global WindowsInspectString "WindowsInspectString" sptr, int, sptr, sptr, var, var
; res = WindowsInspectString(targetHString, machine, callback, context, length, targetStringAddress)
; targetHString : UINT_PTR -> "sptr"
; machine : WORD -> "int"
; callback : PINSPECT_HSTRING_CALLBACK -> "sptr"
; context : void* optional -> "sptr"
; length : DWORD* out -> "var"
; targetStringAddress : UINT_PTR* out -> "var"
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。#uselib "api-ms-win-core-winrt-string-l1-1-0.dll"
#cfunc global WindowsInspectString "WindowsInspectString" sptr, int, sptr, sptr, sptr, sptr
; res = WindowsInspectString(targetHString, machine, callback, context, varptr(length), varptr(targetStringAddress))
; targetHString : UINT_PTR -> "sptr"
; machine : WORD -> "int"
; callback : PINSPECT_HSTRING_CALLBACK -> "sptr"
; context : void* optional -> "sptr"
; length : DWORD* out -> "sptr"
; targetStringAddress : UINT_PTR* out -> "sptr"
; ※出力/バッファ引数はポインタ方式(token=sptr / 呼び出しは varptr(変数))。

出力引数:

; HRESULT WindowsInspectString(UINT_PTR targetHString, WORD machine, PINSPECT_HSTRING_CALLBACK callback, void* context, DWORD* length, UINT_PTR* targetStringAddress)
#uselib "api-ms-win-core-winrt-string-l1-1-0.dll"
#cfunc global WindowsInspectString "WindowsInspectString" intptr, int, intptr, intptr, var, var
; res = WindowsInspectString(targetHString, machine, callback, context, length, targetStringAddress)
; targetHString : UINT_PTR -> "intptr"
; machine : WORD -> "int"
; callback : PINSPECT_HSTRING_CALLBACK -> "intptr"
; context : void* optional -> "intptr"
; length : DWORD* out -> "var"
; targetStringAddress : UINT_PTR* out -> "var"
; ※出力/バッファ引数は var 方式(変数を直接渡す)。varptr 方式にも切替可。; HRESULT WindowsInspectString(UINT_PTR targetHString, WORD machine, PINSPECT_HSTRING_CALLBACK callback, void* context, DWORD* length, UINT_PTR* targetStringAddress)
#uselib "api-ms-win-core-winrt-string-l1-1-0.dll"
#cfunc global WindowsInspectString "WindowsInspectString" intptr, int, intptr, intptr, intptr, intptr
; res = WindowsInspectString(targetHString, machine, callback, context, varptr(length), varptr(targetStringAddress))
; targetHString : UINT_PTR -> "intptr"
; machine : WORD -> "int"
; callback : PINSPECT_HSTRING_CALLBACK -> "intptr"
; context : void* optional -> "intptr"
; length : DWORD* out -> "intptr"
; targetStringAddress : UINT_PTR* out -> "intptr"
; ※出力/バッファ引数はポインタ方式(token=intptr / 呼び出しは varptr(変数))。

import (
	"golang.org/x/sys/windows"
	"unsafe"
)

var (
	api_ms_win_core_winrt_string_l1_1_0 = windows.NewLazySystemDLL("api-ms-win-core-winrt-string-l1-1-0.dll")
	procWindowsInspectString = api_ms_win_core_winrt_string_l1_1_0.NewProc("WindowsInspectString")
)

// targetHString (UINT_PTR), machine (WORD), callback (PINSPECT_HSTRING_CALLBACK), context (void* optional), length (DWORD* out), targetStringAddress (UINT_PTR* out)
r1, _, err := procWindowsInspectString.Call(
	uintptr(targetHString),
	uintptr(machine),
	uintptr(callback),
	uintptr(context),
	uintptr(length),
	uintptr(targetStringAddress),
)
_ = err  // syscall.Errno (valid when the call sets last-error)
_ = r1   // HRESULT

function WindowsInspectString(
  targetHString: NativeUInt;   // UINT_PTR
  machine: Word;   // WORD
  callback: Pointer;   // PINSPECT_HSTRING_CALLBACK
  context: Pointer;   // void* optional
  length: Pointer;   // DWORD* out
  targetStringAddress: Pointer   // UINT_PTR* out
): Integer; stdcall;
  external 'api-ms-win-core-winrt-string-l1-1-0.dll' name 'WindowsInspectString';

result := DllCall("api-ms-win-core-winrt-string-l1-1-0\WindowsInspectString"
    , "UPtr", targetHString   ; UINT_PTR
    , "UShort", machine   ; WORD
    , "Ptr", callback   ; PINSPECT_HSTRING_CALLBACK
    , "Ptr", context   ; void* optional
    , "Ptr", length   ; DWORD* out
    , "Ptr", targetStringAddress   ; UINT_PTR* out
    , "Int")   ; return: HRESULT

●WindowsInspectString(targetHString, machine, callback, context, length, targetStringAddress) = DLL("api-ms-win-core-winrt-string-l1-1-0.dll", "int WindowsInspectString(int, int, void*, void*, void*, void*)")
# 呼び出し: WindowsInspectString(targetHString, machine, callback, context, length, targetStringAddress)
# targetHString : UINT_PTR -> "int"
# machine : WORD -> "int"
# callback : PINSPECT_HSTRING_CALLBACK -> "void*"
# context : void* optional -> "void*"
# length : DWORD* out -> "void*"
# targetStringAddress : UINT_PTR* out -> "void*"
# なでしこ1は32bit・ANSI(Shift_JIS)。文字列=char*(ANSI)、ポインタ/ハンドル=void*(4byte)。

const std = @import("std");

extern "api-ms-win-core-winrt-string-l1-1-0" fn WindowsInspectString(
    targetHString: usize, // UINT_PTR
    machine: u16, // WORD
    callback: ?*anyopaque, // PINSPECT_HSTRING_CALLBACK
    context: ?*anyopaque, // void* optional
    length: [*c]u32, // DWORD* out
    targetStringAddress: [*c]usize // UINT_PTR* out
) callconv(std.os.windows.WINAPI) i32;

proc WindowsInspectString(
    targetHString: uint,  # UINT_PTR
    machine: uint16,  # WORD
    callback: pointer,  # PINSPECT_HSTRING_CALLBACK
    context: pointer,  # void* optional
    length: ptr uint32,  # DWORD* out
    targetStringAddress: ptr uint  # UINT_PTR* out
): int32 {.importc: "WindowsInspectString", stdcall, dynlib: "api-ms-win-core-winrt-string-l1-1-0.dll".}

pragma(lib, "api-ms-win-core-winrt-string-l1-1-0");
extern(Windows)
int WindowsInspectString(
    size_t targetHString,   // UINT_PTR
    ushort machine,   // WORD
    void* callback,   // PINSPECT_HSTRING_CALLBACK
    void* context,   // void* optional
    uint* length,   // DWORD* out
    size_t* targetStringAddress   // UINT_PTR* out
);

ccall((:WindowsInspectString, "api-ms-win-core-winrt-string-l1-1-0.dll"), stdcall, Int32,
      (Csize_t, UInt16, Ptr{Cvoid}, Ptr{Cvoid}, Ptr{UInt32}, Ptr{Csize_t}),
      targetHString, machine, callback, context, length, targetStringAddress)
# targetHString : UINT_PTR -> Csize_t
# machine : WORD -> UInt16
# callback : PINSPECT_HSTRING_CALLBACK -> Ptr{Cvoid}
# context : void* optional -> Ptr{Cvoid}
# length : DWORD* out -> Ptr{UInt32}
# targetStringAddress : UINT_PTR* out -> Ptr{Csize_t}
# stdcall は 32bit のみ意味を持つ(x64 では無視)。

local ffi = require("ffi")
ffi.cdef[[
int32_t WindowsInspectString(
    uintptr_t targetHString,
    uint16_t machine,
    void* callback,
    void* context,
    uint32_t* length,
    uintptr_t* targetStringAddress);
]]
local api-ms-win-core-winrt-string-l1-1-0 = ffi.load("api-ms-win-core-winrt-string-l1-1-0")
-- api-ms-win-core-winrt-string-l1-1-0.WindowsInspectString(targetHString, machine, callback, context, length, targetStringAddress)
-- targetHString : UINT_PTR
-- machine : WORD
-- callback : PINSPECT_HSTRING_CALLBACK
-- context : void* optional
-- length : DWORD* out
-- targetStringAddress : UINT_PTR* out
-- 構造体/GUIDへのポインタは cdef が通るよう void* で表記(実型は各引数コメント参照)。値渡し構造体・enum は対応する typedef を cdef に追加すること。

const koffi = require('koffi');
const lib = koffi.load('api-ms-win-core-winrt-string-l1-1-0.dll');
const WindowsInspectString = lib.func('__stdcall', 'WindowsInspectString', 'int32_t', ['uintptr_t', 'uint16_t', 'void *', 'void *', 'uint32_t *', 'uintptr_t *']);
// WindowsInspectString(targetHString, machine, callback, context, length, targetStringAddress)
// targetHString : UINT_PTR -> 'uintptr_t'
// machine : WORD -> 'uint16_t'
// callback : PINSPECT_HSTRING_CALLBACK -> 'void *'
// context : void* optional -> 'void *'
// length : DWORD* out -> 'uint32_t *'
// targetStringAddress : UINT_PTR* out -> 'uintptr_t *'
// 出力ポインタは koffi.out(...) で包む。構造体は koffi.struct で定義。
// コールバック(関数ポインタ)は koffi.proto/koffi.register で型を定義して渡す(素の void* では JS 関数を渡せない)。

const lib = Deno.dlopen("api-ms-win-core-winrt-string-l1-1-0.dll", {
  WindowsInspectString: { parameters: ["usize", "u16", "pointer", "pointer", "pointer", "pointer"], result: "i32" },
});
// lib.symbols.WindowsInspectString(targetHString, machine, callback, context, length, targetStringAddress)
// targetHString : UINT_PTR -> "usize"
// machine : WORD -> "u16"
// callback : PINSPECT_HSTRING_CALLBACK -> "pointer"
// context : void* optional -> "pointer"
// length : DWORD* out -> "pointer"
// targetStringAddress : UINT_PTR* out -> "pointer"
// 文字列引数は "buffer"(NUL 終端のバイト列を Uint8Array で渡す)。
// 値渡し構造体は { struct: [ ...field types... ] } を使用。

<?php
$ffi = FFI::cdef(<<<C
int32_t WindowsInspectString(
    size_t targetHString,
    uint16_t machine,
    void* callback,
    void* context,
    uint32_t* length,
    size_t* targetStringAddress);
C, "api-ms-win-core-winrt-string-l1-1-0.dll");
// $ffi->WindowsInspectString(targetHString, machine, callback, context, length, targetStringAddress);
// targetHString : UINT_PTR
// machine : WORD
// callback : PINSPECT_HSTRING_CALLBACK
// context : void* optional
// length : DWORD* out
// targetStringAddress : UINT_PTR* out
// 構造体/GUIDへのポインタは cdef が通るよう void* で表記(実型は各引数コメント参照)。値渡し構造体・enum は対応する typedef を cdef に追加すること。
// WINAPI(stdcall): x64 では呼出規約が統一されるため問題なし。x86 では __stdcall 対応のラッパが必要な場合あり。

import com.sun.jna.*;
import com.sun.jna.ptr.*;
import com.sun.jna.win32.StdCallLibrary;
import com.sun.jna.win32.W32APIOptions;

public interface Api-ms-win-core-winrt-string-l1-1-0 extends StdCallLibrary {
    Api-ms-win-core-winrt-string-l1-1-0 INSTANCE = Native.load("api-ms-win-core-winrt-string-l1-1-0", Api-ms-win-core-winrt-string-l1-1-0.class);
    int WindowsInspectString(
        long targetHString,   // UINT_PTR
        short machine,   // WORD
        Callback callback,   // PINSPECT_HSTRING_CALLBACK
        Pointer context,   // void* optional
        IntByReference length,   // DWORD* out
        LongByReference targetStringAddress   // UINT_PTR* out
    );
}

@[Link("api-ms-win-core-winrt-string-l1-1-0")]
lib Libapi-ms-win-core-winrt-string-l1-1-0
  fun WindowsInspectString = WindowsInspectString(
    targetHString : LibC::SizeT,   # UINT_PTR
    machine : UInt16,   # WORD
    callback : Void*,   # PINSPECT_HSTRING_CALLBACK
    context : Void*,   # void* optional
    length : UInt32*,   # DWORD* out
    targetStringAddress : LibC::SizeT*   # UINT_PTR* out
  ) : Int32
end
# 構造体/GUID/enum は lib 内に対応する型定義が必要。
# 呼出規約: x64 は規約統一のため OK。x86(32bit)は WINAPI=stdcall だが Crystal の fun に stdcall 付与構文がなく非対応。

import 'dart:ffi';
import 'package:ffi/ffi.dart';

typedef WindowsInspectStringNative = Int32 Function(UintPtr, Uint16, Pointer<Void>, Pointer<Void>, Pointer<Uint32>, Pointer<UintPtr>);
typedef WindowsInspectStringDart = int Function(int, int, Pointer<Void>, Pointer<Void>, Pointer<Uint32>, Pointer<UintPtr>);
final WindowsInspectString = DynamicLibrary.open('api-ms-win-core-winrt-string-l1-1-0.dll')
    .lookupFunction<WindowsInspectStringNative, WindowsInspectStringDart>('WindowsInspectString');
// targetHString : UINT_PTR -> UintPtr
// machine : WORD -> Uint16
// callback : PINSPECT_HSTRING_CALLBACK -> Pointer<Void>
// context : void* optional -> Pointer<Void>
// length : DWORD* out -> Pointer<Uint32>
// targetStringAddress : UINT_PTR* out -> Pointer<UintPtr>
// 文字列は package:ffi の "...".toNativeUtf16()/toNativeUtf8() で変換。

{$mode objfpc}{$H+}
function WindowsInspectString(
  targetHString: NativeUInt;   // UINT_PTR
  machine: Word;   // WORD
  callback: Pointer;   // PINSPECT_HSTRING_CALLBACK
  context: Pointer;   // void* optional
  length: Pointer;   // DWORD* out
  targetStringAddress: Pointer   // UINT_PTR* out
): Integer; stdcall;
  external 'api-ms-win-core-winrt-string-l1-1-0.dll' name 'WindowsInspectString';

import Foreign
import Foreign.C.Types
import Foreign.C.String

foreign import stdcall safe "WindowsInspectString"
  c_WindowsInspectString :: CUIntPtr -> Word16 -> Ptr () -> Ptr () -> Ptr Word32 -> Ptr CUIntPtr -> IO Int32
-- targetHString : UINT_PTR -> CUIntPtr
-- machine : WORD -> Word16
-- callback : PINSPECT_HSTRING_CALLBACK -> Ptr ()
-- context : void* optional -> Ptr ()
-- length : DWORD* out -> Ptr Word32
-- targetStringAddress : UINT_PTR* out -> Ptr CUIntPtr
-- 要 GHC(Windows)。stdcall は x64 では ccall として扱われる。ブロックする API は safe 呼び出し推奨。

open Ctypes
open Foreign

let windowsinspectstring =
  foreign "WindowsInspectString"
    (size_t @-> uint16_t @-> (ptr void) @-> (ptr void) @-> (ptr uint32_t) @-> (ptr size_t) @-> returning int32_t)
(* targetHString : UINT_PTR -> size_t *)
(* machine : WORD -> uint16_t *)
(* callback : PINSPECT_HSTRING_CALLBACK -> (ptr void) *)
(* context : void* optional -> (ptr void) *)
(* length : DWORD* out -> (ptr uint32_t) *)
(* targetStringAddress : UINT_PTR* out -> (ptr size_t) *)
(* foreign は cdecl 前提。x64 Windows では WINAPI と一致。構造体は ctypes structure を定義のこと。 *)

(cffi:define-foreign-library api-ms-win-core-winrt-string-l1-1-0 (t "api-ms-win-core-winrt-string-l1-1-0.dll"))
(cffi:use-foreign-library api-ms-win-core-winrt-string-l1-1-0)

(cffi:defcfun ("WindowsInspectString" windows-inspect-string :convention :stdcall) :int32
  (target-hstring :uint64)   ; UINT_PTR
  (machine :uint16)   ; WORD
  (callback :pointer)   ; PINSPECT_HSTRING_CALLBACK
  (context :pointer)   ; void* optional
  (length :pointer)   ; DWORD* out
  (target-string-address :pointer))   ; UINT_PTR* out
; isize/usize(INT_PTR/SIZE_T)は x64 前提で :int64/:uint64。x86 では :int32/:uint32。

use Win32::API;
my $WindowsInspectString = Win32::API::More->new('api-ms-win-core-winrt-string-l1-1-0',
    'int WindowsInspectString(WPARAM targetHString, WORD machine, LPVOID callback, LPVOID context, LPVOID length, LPVOID targetStringAddress)');
# my $ret = $WindowsInspectString->Call($targetHString, $machine, $callback, $context, $length, $targetStringAddress);
# targetHString : UINT_PTR -> WPARAM
# machine : WORD -> WORD
# callback : PINSPECT_HSTRING_CALLBACK -> LPVOID
# context : void* optional -> LPVOID
# length : DWORD* out -> LPVOID
# targetStringAddress : UINT_PTR* out -> LPVOID
# 値渡し構造体は pack() した文字列、または Win32::API::Struct を使用。
# コールバック(関数ポインタ)は Perl sub を直接渡せません。Win32::API::Callback を使用してください。

WindowsInspectString

シグネチャ

パラメーター

各言語での呼び出し定義

関連項目