ホーム › Security.Authorization › AUTHZ_SOURCE_SCHEMA_REGISTRATION
AUTHZ_SOURCE_SCHEMA_REGISTRATION
構造体サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。
フィールド
| フィールド | 型 | サイズ | x64 | x86 | 説明 |
|---|---|---|---|---|---|
| dwFlags | DWORD | 4 | +0 | +0 | 監査ソース登録の扱いを制御するフラグ。 |
| szEventSourceName | LPWSTR | 8/4 | +8 | +4 | イベントソースの名前(Unicode)。 |
| szEventMessageFile | LPWSTR | 8/4 | +16 | +8 | イベントメッセージファイルのパス(Unicode)。 |
| szEventSourceXmlSchemaFile | LPWSTR | 8/4 | +24 | +12 | イベントソースのXMLスキーマファイルパス。 |
| szEventAccessStringsFile | LPWSTR | 8/4 | +32 | +16 | イベントのアクセス文字列ファイルパス。 |
| szExecutableImagePath | LPWSTR | 8/4 | +40 | +20 | イベントを生成する実行可能イメージのパス。 |
| Anonymous | _Anonymous_e__Union | 8/4 | +48 | +24 | 追加のソース固有情報を保持する無名共用体。 |
| dwObjectTypeNameCount | DWORD | 4 | +56 | +28 | ObjectTypeNamesの要素数。 |
| ObjectTypeNames | AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET | 16/8 | +64 | +32 | 登録するオブジェクト種別名オフセット情報(可変長配列の先頭)。 |
共用体: _Anonymous_e__Union x64 8B / x86 4B
| フィールド | 型 | サイズ | x64 | x86 |
|---|---|---|---|---|
| pReserved | void* | 8/4 | +0 | +0 |
| pProviderGuid | GUID* | 8/4 | +0 | +0 |
各言語での定義
#include <windows.h>
// AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET (x64 16 / x86 8 バイト)
typedef struct AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET {
LPWSTR szObjectTypeName;
DWORD dwOffset;
} AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET;
// AUTHZ_SOURCE_SCHEMA_REGISTRATION (x64 80 / x86 40 バイト)
typedef struct AUTHZ_SOURCE_SCHEMA_REGISTRATION {
DWORD dwFlags;
LPWSTR szEventSourceName;
LPWSTR szEventMessageFile;
LPWSTR szEventSourceXmlSchemaFile;
LPWSTR szEventAccessStringsFile;
LPWSTR szExecutableImagePath;
_Anonymous_e__Union Anonymous;
DWORD dwObjectTypeNameCount;
AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET ObjectTypeNames[1];
} AUTHZ_SOURCE_SCHEMA_REGISTRATION;using System;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET
{
public IntPtr szObjectTypeName;
public uint dwOffset;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct AUTHZ_SOURCE_SCHEMA_REGISTRATION
{
public uint dwFlags;
public IntPtr szEventSourceName;
public IntPtr szEventMessageFile;
public IntPtr szEventSourceXmlSchemaFile;
public IntPtr szEventAccessStringsFile;
public IntPtr szExecutableImagePath;
public _Anonymous_e__Union Anonymous;
public uint dwObjectTypeNameCount;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)] public AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET[] ObjectTypeNames;
}Imports System.Runtime.InteropServices
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET
Public szObjectTypeName As IntPtr
Public dwOffset As UInteger
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure AUTHZ_SOURCE_SCHEMA_REGISTRATION
Public dwFlags As UInteger
Public szEventSourceName As IntPtr
Public szEventMessageFile As IntPtr
Public szEventSourceXmlSchemaFile As IntPtr
Public szEventAccessStringsFile As IntPtr
Public szExecutableImagePath As IntPtr
Public Anonymous As _Anonymous_e__Union
Public dwObjectTypeNameCount As UInteger
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=1)> Public ObjectTypeNames() As AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET
End Structureimport ctypes
from ctypes import wintypes
class AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET(ctypes.Structure):
_fields_ = [
("szObjectTypeName", ctypes.c_void_p),
("dwOffset", wintypes.DWORD),
]
class AUTHZ_SOURCE_SCHEMA_REGISTRATION(ctypes.Structure):
_fields_ = [
("dwFlags", wintypes.DWORD),
("szEventSourceName", ctypes.c_void_p),
("szEventMessageFile", ctypes.c_void_p),
("szEventSourceXmlSchemaFile", ctypes.c_void_p),
("szEventAccessStringsFile", ctypes.c_void_p),
("szExecutableImagePath", ctypes.c_void_p),
("Anonymous", _Anonymous_e__Union),
("dwObjectTypeNameCount", wintypes.DWORD),
("ObjectTypeNames", AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET * 1),
]#[repr(C)]
pub struct AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET {
pub szObjectTypeName: *mut core::ffi::c_void,
pub dwOffset: u32,
}
#[repr(C)]
pub struct AUTHZ_SOURCE_SCHEMA_REGISTRATION {
pub dwFlags: u32,
pub szEventSourceName: *mut core::ffi::c_void,
pub szEventMessageFile: *mut core::ffi::c_void,
pub szEventSourceXmlSchemaFile: *mut core::ffi::c_void,
pub szEventAccessStringsFile: *mut core::ffi::c_void,
pub szExecutableImagePath: *mut core::ffi::c_void,
pub Anonymous: _Anonymous_e__Union,
pub dwObjectTypeNameCount: u32,
pub ObjectTypeNames: [AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET; 1],
}import "golang.org/x/sys/windows"
type AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET struct {
szObjectTypeName uintptr
dwOffset uint32
}
type AUTHZ_SOURCE_SCHEMA_REGISTRATION struct {
dwFlags uint32
szEventSourceName uintptr
szEventMessageFile uintptr
szEventSourceXmlSchemaFile uintptr
szEventAccessStringsFile uintptr
szExecutableImagePath uintptr
Anonymous _Anonymous_e__Union
dwObjectTypeNameCount uint32
ObjectTypeNames [1]AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET
}type
AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET = record
szObjectTypeName: Pointer;
dwOffset: DWORD;
end;
AUTHZ_SOURCE_SCHEMA_REGISTRATION = record
dwFlags: DWORD;
szEventSourceName: Pointer;
szEventMessageFile: Pointer;
szEventSourceXmlSchemaFile: Pointer;
szEventAccessStringsFile: Pointer;
szExecutableImagePath: Pointer;
Anonymous: _Anonymous_e__Union;
dwObjectTypeNameCount: DWORD;
ObjectTypeNames: array[0..0] of AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET;
end;const AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET = extern struct {
szObjectTypeName: ?*anyopaque,
dwOffset: u32,
};
const AUTHZ_SOURCE_SCHEMA_REGISTRATION = extern struct {
dwFlags: u32,
szEventSourceName: ?*anyopaque,
szEventMessageFile: ?*anyopaque,
szEventSourceXmlSchemaFile: ?*anyopaque,
szEventAccessStringsFile: ?*anyopaque,
szExecutableImagePath: ?*anyopaque,
Anonymous: _Anonymous_e__Union,
dwObjectTypeNameCount: u32,
ObjectTypeNames: [1]AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET,
};type
AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET {.bycopy.} = object
szObjectTypeName: pointer
dwOffset: uint32
AUTHZ_SOURCE_SCHEMA_REGISTRATION {.bycopy.} = object
dwFlags: uint32
szEventSourceName: pointer
szEventMessageFile: pointer
szEventSourceXmlSchemaFile: pointer
szEventAccessStringsFile: pointer
szExecutableImagePath: pointer
Anonymous: _Anonymous_e__Union
dwObjectTypeNameCount: uint32
ObjectTypeNames: array[1, AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET]struct AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET
{
void* szObjectTypeName;
uint dwOffset;
}
struct AUTHZ_SOURCE_SCHEMA_REGISTRATION
{
uint dwFlags;
void* szEventSourceName;
void* szEventMessageFile;
void* szEventSourceXmlSchemaFile;
void* szEventAccessStringsFile;
void* szExecutableImagePath;
_Anonymous_e__Union Anonymous;
uint dwObjectTypeNameCount;
AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET[1] ObjectTypeNames;
}HSP用 定義
HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; AUTHZ_SOURCE_SCHEMA_REGISTRATION サイズ: 40 バイト(x86)
dim st, 10 ; 4byte整数×10(構造体サイズ 40 / 4 切り上げ)
; dwFlags : DWORD (+0, 4byte) st.0 = 値 / 値 = st.0 (lpoke/lpeek も可)
; szEventSourceName : LPWSTR (+4, 4byte) st.1 = 値 / 値 = st.1 (lpoke/lpeek も可)
; szEventMessageFile : LPWSTR (+8, 4byte) st.2 = 値 / 値 = st.2 (lpoke/lpeek も可)
; szEventSourceXmlSchemaFile : LPWSTR (+12, 4byte) st.3 = 値 / 値 = st.3 (lpoke/lpeek も可)
; szEventAccessStringsFile : LPWSTR (+16, 4byte) st.4 = 値 / 値 = st.4 (lpoke/lpeek も可)
; szExecutableImagePath : LPWSTR (+20, 4byte) st.5 = 値 / 値 = st.5 (lpoke/lpeek も可)
; Anonymous : _Anonymous_e__Union (+24, 4byte) varptr(st)+24 を基点に操作(4byte:入れ子/配列)
; dwObjectTypeNameCount : DWORD (+28, 4byte) st.7 = 値 / 値 = st.7 (lpoke/lpeek も可)
; ObjectTypeNames : AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET (+32, 8byte) varptr(st)+32 を基点に操作(8byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; AUTHZ_SOURCE_SCHEMA_REGISTRATION サイズ: 80 バイト(x64)
dim st, 20 ; 4byte整数×20(構造体サイズ 80 / 4 切り上げ)
; dwFlags : DWORD (+0, 4byte) st.0 = 値 / 値 = st.0 (lpoke/lpeek も可)
; szEventSourceName : LPWSTR (+8, 8byte) qpoke st,8,値 / qpeek(st,8) ※IronHSPのみ。3.7/3.8は lpoke st,8,下位 : lpoke st,12,上位
; szEventMessageFile : LPWSTR (+16, 8byte) qpoke st,16,値 / qpeek(st,16) ※IronHSPのみ。3.7/3.8は lpoke st,16,下位 : lpoke st,20,上位
; szEventSourceXmlSchemaFile : LPWSTR (+24, 8byte) qpoke st,24,値 / qpeek(st,24) ※IronHSPのみ。3.7/3.8は lpoke st,24,下位 : lpoke st,28,上位
; szEventAccessStringsFile : LPWSTR (+32, 8byte) qpoke st,32,値 / qpeek(st,32) ※IronHSPのみ。3.7/3.8は lpoke st,32,下位 : lpoke st,36,上位
; szExecutableImagePath : LPWSTR (+40, 8byte) qpoke st,40,値 / qpeek(st,40) ※IronHSPのみ。3.7/3.8は lpoke st,40,下位 : lpoke st,44,上位
; Anonymous : _Anonymous_e__Union (+48, 8byte) varptr(st)+48 を基点に操作(8byte:入れ子/配列)
; dwObjectTypeNameCount : DWORD (+56, 4byte) st.14 = 値 / 値 = st.14 (lpoke/lpeek も可)
; ObjectTypeNames : AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET (+64, 16byte) varptr(st)+64 を基点に操作(16byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET
#field intptr szObjectTypeName
#field int dwOffset
#endstruct
#defstruct global AUTHZ_SOURCE_SCHEMA_REGISTRATION
#field int dwFlags
#field intptr szEventSourceName
#field intptr szEventMessageFile
#field intptr szEventSourceXmlSchemaFile
#field intptr szEventAccessStringsFile
#field intptr szExecutableImagePath
#field byte Anonymous 8
#field int dwObjectTypeNameCount
#field AUTHZ_REGISTRATION_OBJECT_TYPE_NAME_OFFSET ObjectTypeNames 1
#endstruct
stdim st, AUTHZ_SOURCE_SCHEMA_REGISTRATION ; NSTRUCT 変数を確保
st->dwFlags = 100
mes "dwFlags=" + st->dwFlags
; ※union フィールドは byte 列で確保(NSTRUCT は union 非対応)。必要に応じ手動でアクセス。