ホーム › NetworkManagement.WindowsFilteringPlatform › FWPM_NET_EVENT5

FWPM_NET_EVENT5

構造体

サイズx64: 152 バイト / x86: 112 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド	型	サイズ	x64	x86	説明
header	FWPM_NET_EVENT_HEADER3	136/104	+0	+0	イベント共通情報を保持するヘッダー(バージョン3)。
type	FWPM_NET_EVENT_TYPE	4	+136	+104	ネットワークイベントの種類を示すFWPM_NET_EVENT_TYPE。
Anonymous	_Anonymous_e__Union	8/4	+144	+108	イベント種別に応じた詳細情報を保持する共用体。

共用体: _Anonymous_e__Union x64 8B / x86 4B

フィールド	型	サイズ	x64	x86
ikeMmFailure	FWPM_NET_EVENT_IKEEXT_MM_FAILURE2*	8/4	+0	+0
ikeQmFailure	FWPM_NET_EVENT_IKEEXT_QM_FAILURE1*	8/4	+0	+0
ikeEmFailure	FWPM_NET_EVENT_IKEEXT_EM_FAILURE1*	8/4	+0	+0
classifyDrop	FWPM_NET_EVENT_CLASSIFY_DROP2*	8/4	+0	+0
ipsecDrop	FWPM_NET_EVENT_IPSEC_KERNEL_DROP0*	8/4	+0	+0
idpDrop	FWPM_NET_EVENT_IPSEC_DOSP_DROP0*	8/4	+0	+0
classifyAllow	FWPM_NET_EVENT_CLASSIFY_ALLOW0*	8/4	+0	+0
capabilityDrop	FWPM_NET_EVENT_CAPABILITY_DROP0*	8/4	+0	+0
capabilityAllow	FWPM_NET_EVENT_CAPABILITY_ALLOW0*	8/4	+0	+0
classifyDropMac	FWPM_NET_EVENT_CLASSIFY_DROP_MAC0*	8/4	+0	+0
lpmPacketArrival	FWPM_NET_EVENT_LPM_PACKET_ARRIVAL0*	8/4	+0	+0

各言語での定義

#include <windows.h>

// FILETIME  (x64 8 / x86 8 バイト)
typedef struct FILETIME {
    DWORD dwLowDateTime;
    DWORD dwHighDateTime;
} FILETIME;

// FWP_BYTE_BLOB  (x64 16 / x86 8 バイト)
typedef struct FWP_BYTE_BLOB {
    DWORD size;
    BYTE* data;
} FWP_BYTE_BLOB;

// FWPM_NET_EVENT_HEADER3  (x64 136 / x86 104 バイト)
typedef struct FWPM_NET_EVENT_HEADER3 {
    FILETIME timeStamp;
    DWORD flags;
    FWP_IP_VERSION ipVersion;
    BYTE ipProtocol;
    _Anonymous1_e__Union Anonymous1;
    _Anonymous2_e__Union Anonymous2;
    WORD localPort;
    WORD remotePort;
    DWORD scopeId;
    FWP_BYTE_BLOB appId;
    SID* userId;
    FWP_AF addressFamily;
    SID* packageSid;
    LPWSTR enterpriseId;
    ULONGLONG policyFlags;
    FWP_BYTE_BLOB effectiveName;
} FWPM_NET_EVENT_HEADER3;

// FWPM_NET_EVENT5  (x64 152 / x86 112 バイト)
typedef struct FWPM_NET_EVENT5 {
    FWPM_NET_EVENT_HEADER3 header;
    FWPM_NET_EVENT_TYPE type;
    _Anonymous_e__Union Anonymous;
} FWPM_NET_EVENT5;

using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FILETIME
{
    public uint dwLowDateTime;
    public uint dwHighDateTime;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FWP_BYTE_BLOB
{
    public uint size;
    public IntPtr data;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FWPM_NET_EVENT_HEADER3
{
    public FILETIME timeStamp;
    public uint flags;
    public int ipVersion;
    public byte ipProtocol;
    public _Anonymous1_e__Union Anonymous1;
    public _Anonymous2_e__Union Anonymous2;
    public ushort localPort;
    public ushort remotePort;
    public uint scopeId;
    public FWP_BYTE_BLOB appId;
    public IntPtr userId;
    public int addressFamily;
    public IntPtr packageSid;
    public IntPtr enterpriseId;
    public ulong policyFlags;
    public FWP_BYTE_BLOB effectiveName;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FWPM_NET_EVENT5
{
    public FWPM_NET_EVENT_HEADER3 header;
    public int type;
    public _Anonymous_e__Union Anonymous;
}

Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FILETIME
    Public dwLowDateTime As UInteger
    Public dwHighDateTime As UInteger
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FWP_BYTE_BLOB
    Public size As UInteger
    Public data As IntPtr
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FWPM_NET_EVENT_HEADER3
    Public timeStamp As FILETIME
    Public flags As UInteger
    Public ipVersion As Integer
    Public ipProtocol As Byte
    Public Anonymous1 As _Anonymous1_e__Union
    Public Anonymous2 As _Anonymous2_e__Union
    Public localPort As UShort
    Public remotePort As UShort
    Public scopeId As UInteger
    Public appId As FWP_BYTE_BLOB
    Public userId As IntPtr
    Public addressFamily As Integer
    Public packageSid As IntPtr
    Public enterpriseId As IntPtr
    Public policyFlags As ULong
    Public effectiveName As FWP_BYTE_BLOB
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FWPM_NET_EVENT5
    Public header As FWPM_NET_EVENT_HEADER3
    Public type As Integer
    Public Anonymous As _Anonymous_e__Union
End Structure

import ctypes
from ctypes import wintypes

class FILETIME(ctypes.Structure):
    _fields_ = [
        ("dwLowDateTime", wintypes.DWORD),
        ("dwHighDateTime", wintypes.DWORD),
    ]

class FWP_BYTE_BLOB(ctypes.Structure):
    _fields_ = [
        ("size", wintypes.DWORD),
        ("data", ctypes.c_void_p),
    ]

class FWPM_NET_EVENT_HEADER3(ctypes.Structure):
    _fields_ = [
        ("timeStamp", FILETIME),
        ("flags", wintypes.DWORD),
        ("ipVersion", ctypes.c_int),
        ("ipProtocol", ctypes.c_ubyte),
        ("Anonymous1", _Anonymous1_e__Union),
        ("Anonymous2", _Anonymous2_e__Union),
        ("localPort", ctypes.c_ushort),
        ("remotePort", ctypes.c_ushort),
        ("scopeId", wintypes.DWORD),
        ("appId", FWP_BYTE_BLOB),
        ("userId", ctypes.c_void_p),
        ("addressFamily", ctypes.c_int),
        ("packageSid", ctypes.c_void_p),
        ("enterpriseId", ctypes.c_void_p),
        ("policyFlags", ctypes.c_ulonglong),
        ("effectiveName", FWP_BYTE_BLOB),
    ]

class FWPM_NET_EVENT5(ctypes.Structure):
    _fields_ = [
        ("header", FWPM_NET_EVENT_HEADER3),
        ("type", ctypes.c_int),
        ("Anonymous", _Anonymous_e__Union),
    ]

#[repr(C)]
pub struct FILETIME {
    pub dwLowDateTime: u32,
    pub dwHighDateTime: u32,
}

#[repr(C)]
pub struct FWP_BYTE_BLOB {
    pub size: u32,
    pub data: *mut core::ffi::c_void,
}

#[repr(C)]
pub struct FWPM_NET_EVENT_HEADER3 {
    pub timeStamp: FILETIME,
    pub flags: u32,
    pub ipVersion: i32,
    pub ipProtocol: u8,
    pub Anonymous1: _Anonymous1_e__Union,
    pub Anonymous2: _Anonymous2_e__Union,
    pub localPort: u16,
    pub remotePort: u16,
    pub scopeId: u32,
    pub appId: FWP_BYTE_BLOB,
    pub userId: *mut core::ffi::c_void,
    pub addressFamily: i32,
    pub packageSid: *mut core::ffi::c_void,
    pub enterpriseId: *mut core::ffi::c_void,
    pub policyFlags: u64,
    pub effectiveName: FWP_BYTE_BLOB,
}

#[repr(C)]
pub struct FWPM_NET_EVENT5 {
    pub header: FWPM_NET_EVENT_HEADER3,
    pub type: i32,
    pub Anonymous: _Anonymous_e__Union,
}

import "golang.org/x/sys/windows"

type FILETIME struct {
	dwLowDateTime uint32
	dwHighDateTime uint32
}

type FWP_BYTE_BLOB struct {
	size uint32
	data uintptr
}

type FWPM_NET_EVENT_HEADER3 struct {
	timeStamp FILETIME
	flags uint32
	ipVersion int32
	ipProtocol byte
	Anonymous1 _Anonymous1_e__Union
	Anonymous2 _Anonymous2_e__Union
	localPort uint16
	remotePort uint16
	scopeId uint32
	appId FWP_BYTE_BLOB
	userId uintptr
	addressFamily int32
	packageSid uintptr
	enterpriseId uintptr
	policyFlags uint64
	effectiveName FWP_BYTE_BLOB
}

type FWPM_NET_EVENT5 struct {
	header FWPM_NET_EVENT_HEADER3
	type int32
	Anonymous _Anonymous_e__Union
}

type
  FILETIME = record
    dwLowDateTime: DWORD;
    dwHighDateTime: DWORD;
  end;

  FWP_BYTE_BLOB = record
    size: DWORD;
    data: Pointer;
  end;

  FWPM_NET_EVENT_HEADER3 = record
    timeStamp: FILETIME;
    flags: DWORD;
    ipVersion: Integer;
    ipProtocol: Byte;
    Anonymous1: _Anonymous1_e__Union;
    Anonymous2: _Anonymous2_e__Union;
    localPort: Word;
    remotePort: Word;
    scopeId: DWORD;
    appId: FWP_BYTE_BLOB;
    userId: Pointer;
    addressFamily: Integer;
    packageSid: Pointer;
    enterpriseId: Pointer;
    policyFlags: UInt64;
    effectiveName: FWP_BYTE_BLOB;
  end;

  FWPM_NET_EVENT5 = record
    header: FWPM_NET_EVENT_HEADER3;
    type: Integer;
    Anonymous: _Anonymous_e__Union;
  end;

const FILETIME = extern struct {
    dwLowDateTime: u32,
    dwHighDateTime: u32,
};

const FWP_BYTE_BLOB = extern struct {
    size: u32,
    data: ?*anyopaque,
};

const FWPM_NET_EVENT_HEADER3 = extern struct {
    timeStamp: FILETIME,
    flags: u32,
    ipVersion: i32,
    ipProtocol: u8,
    Anonymous1: _Anonymous1_e__Union,
    Anonymous2: _Anonymous2_e__Union,
    localPort: u16,
    remotePort: u16,
    scopeId: u32,
    appId: FWP_BYTE_BLOB,
    userId: ?*anyopaque,
    addressFamily: i32,
    packageSid: ?*anyopaque,
    enterpriseId: ?*anyopaque,
    policyFlags: u64,
    effectiveName: FWP_BYTE_BLOB,
};

const FWPM_NET_EVENT5 = extern struct {
    header: FWPM_NET_EVENT_HEADER3,
    type: i32,
    Anonymous: _Anonymous_e__Union,
};

type
  FILETIME {.bycopy.} = object
    dwLowDateTime: uint32
    dwHighDateTime: uint32

  FWP_BYTE_BLOB {.bycopy.} = object
    size: uint32
    data: pointer

  FWPM_NET_EVENT_HEADER3 {.bycopy.} = object
    timeStamp: FILETIME
    flags: uint32
    ipVersion: int32
    ipProtocol: uint8
    Anonymous1: _Anonymous1_e__Union
    Anonymous2: _Anonymous2_e__Union
    localPort: uint16
    remotePort: uint16
    scopeId: uint32
    appId: FWP_BYTE_BLOB
    userId: pointer
    addressFamily: int32
    packageSid: pointer
    enterpriseId: pointer
    policyFlags: uint64
    effectiveName: FWP_BYTE_BLOB

  FWPM_NET_EVENT5 {.bycopy.} = object
    header: FWPM_NET_EVENT_HEADER3
    type: int32
    Anonymous: _Anonymous_e__Union

struct FILETIME
{
    uint dwLowDateTime;
    uint dwHighDateTime;
}

struct FWP_BYTE_BLOB
{
    uint size;
    void* data;
}

struct FWPM_NET_EVENT_HEADER3
{
    FILETIME timeStamp;
    uint flags;
    int ipVersion;
    ubyte ipProtocol;
    _Anonymous1_e__Union Anonymous1;
    _Anonymous2_e__Union Anonymous2;
    ushort localPort;
    ushort remotePort;
    uint scopeId;
    FWP_BYTE_BLOB appId;
    void* userId;
    int addressFamily;
    void* packageSid;
    void* enterpriseId;
    ulong policyFlags;
    FWP_BYTE_BLOB effectiveName;
}

struct FWPM_NET_EVENT5
{
    FWPM_NET_EVENT_HEADER3 header;
    int type;
    _Anonymous_e__Union Anonymous;
}

HSP用定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; FWPM_NET_EVENT5 サイズ: 112 バイト(x86)
dim st, 28    ; 4byte整数×28(構造体サイズ 112 / 4 切り上げ)
; header : FWPM_NET_EVENT_HEADER3 (+0, 104byte)  varptr(st)+0 を基点に操作(104byte:入れ子/配列)
; type : FWPM_NET_EVENT_TYPE (+104, 4byte)  st.26 = 値  /  値 = st.26   (lpoke/lpeek も可)
; Anonymous : _Anonymous_e__Union (+108, 4byte)  varptr(st)+108 を基点に操作(4byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; FWPM_NET_EVENT5 サイズ: 152 バイト(x64)
dim st, 38    ; 4byte整数×38(構造体サイズ 152 / 4 切り上げ)
; header : FWPM_NET_EVENT_HEADER3 (+0, 136byte)  varptr(st)+0 を基点に操作(136byte:入れ子/配列)
; type : FWPM_NET_EVENT_TYPE (+136, 4byte)  st.34 = 値  /  値 = st.34   (lpoke/lpeek も可)
; Anonymous : _Anonymous_e__Union (+144, 8byte)  varptr(st)+144 を基点に操作(8byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。

; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global FILETIME
    #field int dwLowDateTime
    #field int dwHighDateTime
#endstruct

#defstruct global FWP_BYTE_BLOB
    #field int size
    #field intptr data
#endstruct

#defstruct global FWPM_NET_EVENT_HEADER3
    #field FILETIME timeStamp
    #field int flags
    #field int ipVersion
    #field byte ipProtocol
    #field byte Anonymous1 16
    #field byte Anonymous2 16
    #field short localPort
    #field short remotePort
    #field int scopeId
    #field FWP_BYTE_BLOB appId
    #field intptr userId
    #field int addressFamily
    #field intptr packageSid
    #field intptr enterpriseId
    #field int64 policyFlags
    #field FWP_BYTE_BLOB effectiveName
#endstruct

#defstruct global FWPM_NET_EVENT5
    #field FWPM_NET_EVENT_HEADER3 header
    #field int type
    #field byte Anonymous 8
#endstruct

stdim st, FWPM_NET_EVENT5        ; NSTRUCT 変数を確保
st->type = 100
mes "type=" + st->type
; ※union フィールドは byte 列で確保(NSTRUCT は union 非対応)。必要に応じ手動でアクセス。

FWPM_NET_EVENT5

フィールド

共用体: _Anonymous_e__Union x64 8B / x86 4B

各言語での定義

HSP用 定義

HSP用定義