ホーム › Security.DiagnosticDataQuery › DIAGNOSTIC_REPORT_DATA
DIAGNOSTIC_REPORT_DATA
構造体サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。
フィールド
| フィールド | 型 | サイズ | x64 | x86 | 説明 |
|---|---|---|---|---|---|
| signature | DIAGNOSTIC_REPORT_SIGNATURE | 7910 | +0 | +0 | レポートのシグネチャ(イベント名とパラメータ)情報。 |
| bucketId | GUID | 16 | +7912 | +7912 | Windowsエラー報告のバケットを識別するGUID。 |
| reportId | GUID | 16 | +7928 | +7928 | レポートを一意に識別するGUID。 |
| creationTime | FILETIME | 8 | +7944 | +7944 | レポート作成時刻。FILETIME形式。 |
| sizeInBytes | ULONGLONG | 8 | +7952 | +7952 | レポートの総バイト数。 |
| cabId | LPWSTR | 8/4 | +7960 | +7960 | アップロードされたCAB(圧縮アーカイブ)を識別する文字列。 |
| reportStatus | DWORD | 4 | +7968 | +7964 | レポートの状態を示すフラグ値。 |
| reportIntegratorId | GUID | 16 | +7972 | +7968 | レポートを統合した主体を識別するGUID。 |
| fileNames | LPWSTR* | 8/4 | +7992 | +7984 | レポートに含まれるファイル名文字列の配列へのポインタ。 |
| fileCount | DWORD | 4 | +8000 | +7988 | fileNames配列の要素数。 |
| friendlyEventName | LPWSTR | 8/4 | +8008 | +7992 | イベントの分かりやすい表示名文字列。 |
| applicationName | LPWSTR | 8/4 | +8016 | +7996 | 障害が発生したアプリケーション名文字列。 |
| applicationPath | LPWSTR | 8/4 | +8024 | +8000 | アプリケーションの実行ファイルパス文字列。 |
| description | LPWSTR | 8/4 | +8032 | +8004 | レポートの説明文字列。 |
| bucketIdString | LPWSTR | 8/4 | +8040 | +8008 | バケットIDの文字列表現。 |
| legacyBucketId | ULONGLONG | 8 | +8048 | +8016 | 旧形式のバケットID(符号なし64ビット値)。 |
| reportKey | LPWSTR | 8/4 | +8056 | +8024 | レポートを識別するキー文字列。 |
各言語での定義
#include <windows.h>
// DIAGNOSTIC_REPORT_PARAMETER (x64 778 / x86 778 バイト)
typedef struct DIAGNOSTIC_REPORT_PARAMETER {
WCHAR name[129];
WCHAR value[260];
} DIAGNOSTIC_REPORT_PARAMETER;
// DIAGNOSTIC_REPORT_SIGNATURE (x64 7910 / x86 7910 バイト)
typedef struct DIAGNOSTIC_REPORT_SIGNATURE {
WCHAR eventName[65];
DIAGNOSTIC_REPORT_PARAMETER parameters[10];
} DIAGNOSTIC_REPORT_SIGNATURE;
// FILETIME (x64 8 / x86 8 バイト)
typedef struct FILETIME {
DWORD dwLowDateTime;
DWORD dwHighDateTime;
} FILETIME;
// DIAGNOSTIC_REPORT_DATA (x64 8064 / x86 8032 バイト)
typedef struct DIAGNOSTIC_REPORT_DATA {
DIAGNOSTIC_REPORT_SIGNATURE signature;
GUID bucketId;
GUID reportId;
FILETIME creationTime;
ULONGLONG sizeInBytes;
LPWSTR cabId;
DWORD reportStatus;
GUID reportIntegratorId;
LPWSTR* fileNames;
DWORD fileCount;
LPWSTR friendlyEventName;
LPWSTR applicationName;
LPWSTR applicationPath;
LPWSTR description;
LPWSTR bucketIdString;
ULONGLONG legacyBucketId;
LPWSTR reportKey;
} DIAGNOSTIC_REPORT_DATA;using System;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DIAGNOSTIC_REPORT_PARAMETER
{
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 129)] public string name;
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)] public string value;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DIAGNOSTIC_REPORT_SIGNATURE
{
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 65)] public string eventName;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)] public DIAGNOSTIC_REPORT_PARAMETER[] parameters;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FILETIME
{
public uint dwLowDateTime;
public uint dwHighDateTime;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DIAGNOSTIC_REPORT_DATA
{
public DIAGNOSTIC_REPORT_SIGNATURE signature;
public Guid bucketId;
public Guid reportId;
public FILETIME creationTime;
public ulong sizeInBytes;
public IntPtr cabId;
public uint reportStatus;
public Guid reportIntegratorId;
public IntPtr fileNames;
public uint fileCount;
public IntPtr friendlyEventName;
public IntPtr applicationName;
public IntPtr applicationPath;
public IntPtr description;
public IntPtr bucketIdString;
public ulong legacyBucketId;
public IntPtr reportKey;
}Imports System.Runtime.InteropServices
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DIAGNOSTIC_REPORT_PARAMETER
<MarshalAs(UnmanagedType.ByValTStr, SizeConst:=129)> Public name As String
<MarshalAs(UnmanagedType.ByValTStr, SizeConst:=260)> Public value As String
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DIAGNOSTIC_REPORT_SIGNATURE
<MarshalAs(UnmanagedType.ByValTStr, SizeConst:=65)> Public eventName As String
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=10)> Public parameters() As DIAGNOSTIC_REPORT_PARAMETER
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FILETIME
Public dwLowDateTime As UInteger
Public dwHighDateTime As UInteger
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DIAGNOSTIC_REPORT_DATA
Public signature As DIAGNOSTIC_REPORT_SIGNATURE
Public bucketId As Guid
Public reportId As Guid
Public creationTime As FILETIME
Public sizeInBytes As ULong
Public cabId As IntPtr
Public reportStatus As UInteger
Public reportIntegratorId As Guid
Public fileNames As IntPtr
Public fileCount As UInteger
Public friendlyEventName As IntPtr
Public applicationName As IntPtr
Public applicationPath As IntPtr
Public description As IntPtr
Public bucketIdString As IntPtr
Public legacyBucketId As ULong
Public reportKey As IntPtr
End Structureimport ctypes
from ctypes import wintypes
class DIAGNOSTIC_REPORT_PARAMETER(ctypes.Structure):
_fields_ = [
("name", ctypes.c_wchar * 129),
("value", ctypes.c_wchar * 260),
]
class DIAGNOSTIC_REPORT_SIGNATURE(ctypes.Structure):
_fields_ = [
("eventName", ctypes.c_wchar * 65),
("parameters", DIAGNOSTIC_REPORT_PARAMETER * 10),
]
class FILETIME(ctypes.Structure):
_fields_ = [
("dwLowDateTime", wintypes.DWORD),
("dwHighDateTime", wintypes.DWORD),
]
class DIAGNOSTIC_REPORT_DATA(ctypes.Structure):
_fields_ = [
("signature", DIAGNOSTIC_REPORT_SIGNATURE),
("bucketId", GUID),
("reportId", GUID),
("creationTime", FILETIME),
("sizeInBytes", ctypes.c_ulonglong),
("cabId", ctypes.c_void_p),
("reportStatus", wintypes.DWORD),
("reportIntegratorId", GUID),
("fileNames", ctypes.c_void_p),
("fileCount", wintypes.DWORD),
("friendlyEventName", ctypes.c_void_p),
("applicationName", ctypes.c_void_p),
("applicationPath", ctypes.c_void_p),
("description", ctypes.c_void_p),
("bucketIdString", ctypes.c_void_p),
("legacyBucketId", ctypes.c_ulonglong),
("reportKey", ctypes.c_void_p),
]#[repr(C)]
pub struct DIAGNOSTIC_REPORT_PARAMETER {
pub name: [u16; 129],
pub value: [u16; 260],
}
#[repr(C)]
pub struct DIAGNOSTIC_REPORT_SIGNATURE {
pub eventName: [u16; 65],
pub parameters: [DIAGNOSTIC_REPORT_PARAMETER; 10],
}
#[repr(C)]
pub struct FILETIME {
pub dwLowDateTime: u32,
pub dwHighDateTime: u32,
}
#[repr(C)]
pub struct DIAGNOSTIC_REPORT_DATA {
pub signature: DIAGNOSTIC_REPORT_SIGNATURE,
pub bucketId: GUID,
pub reportId: GUID,
pub creationTime: FILETIME,
pub sizeInBytes: u64,
pub cabId: *mut core::ffi::c_void,
pub reportStatus: u32,
pub reportIntegratorId: GUID,
pub fileNames: *mut core::ffi::c_void,
pub fileCount: u32,
pub friendlyEventName: *mut core::ffi::c_void,
pub applicationName: *mut core::ffi::c_void,
pub applicationPath: *mut core::ffi::c_void,
pub description: *mut core::ffi::c_void,
pub bucketIdString: *mut core::ffi::c_void,
pub legacyBucketId: u64,
pub reportKey: *mut core::ffi::c_void,
}import "golang.org/x/sys/windows"
type DIAGNOSTIC_REPORT_PARAMETER struct {
name [129]uint16
value [260]uint16
}
type DIAGNOSTIC_REPORT_SIGNATURE struct {
eventName [65]uint16
parameters [10]DIAGNOSTIC_REPORT_PARAMETER
}
type FILETIME struct {
dwLowDateTime uint32
dwHighDateTime uint32
}
type DIAGNOSTIC_REPORT_DATA struct {
signature DIAGNOSTIC_REPORT_SIGNATURE
bucketId windows.GUID
reportId windows.GUID
creationTime FILETIME
sizeInBytes uint64
cabId uintptr
reportStatus uint32
reportIntegratorId windows.GUID
fileNames uintptr
fileCount uint32
friendlyEventName uintptr
applicationName uintptr
applicationPath uintptr
description uintptr
bucketIdString uintptr
legacyBucketId uint64
reportKey uintptr
}type
DIAGNOSTIC_REPORT_PARAMETER = record
name: array[0..128] of WideChar;
value: array[0..259] of WideChar;
end;
DIAGNOSTIC_REPORT_SIGNATURE = record
eventName: array[0..64] of WideChar;
parameters: array[0..9] of DIAGNOSTIC_REPORT_PARAMETER;
end;
FILETIME = record
dwLowDateTime: DWORD;
dwHighDateTime: DWORD;
end;
DIAGNOSTIC_REPORT_DATA = record
signature: DIAGNOSTIC_REPORT_SIGNATURE;
bucketId: TGUID;
reportId: TGUID;
creationTime: FILETIME;
sizeInBytes: UInt64;
cabId: Pointer;
reportStatus: DWORD;
reportIntegratorId: TGUID;
fileNames: Pointer;
fileCount: DWORD;
friendlyEventName: Pointer;
applicationName: Pointer;
applicationPath: Pointer;
description: Pointer;
bucketIdString: Pointer;
legacyBucketId: UInt64;
reportKey: Pointer;
end;const DIAGNOSTIC_REPORT_PARAMETER = extern struct {
name: [129]u16,
value: [260]u16,
};
const DIAGNOSTIC_REPORT_SIGNATURE = extern struct {
eventName: [65]u16,
parameters: [10]DIAGNOSTIC_REPORT_PARAMETER,
};
const FILETIME = extern struct {
dwLowDateTime: u32,
dwHighDateTime: u32,
};
const DIAGNOSTIC_REPORT_DATA = extern struct {
signature: DIAGNOSTIC_REPORT_SIGNATURE,
bucketId: GUID,
reportId: GUID,
creationTime: FILETIME,
sizeInBytes: u64,
cabId: ?*anyopaque,
reportStatus: u32,
reportIntegratorId: GUID,
fileNames: ?*anyopaque,
fileCount: u32,
friendlyEventName: ?*anyopaque,
applicationName: ?*anyopaque,
applicationPath: ?*anyopaque,
description: ?*anyopaque,
bucketIdString: ?*anyopaque,
legacyBucketId: u64,
reportKey: ?*anyopaque,
};type
DIAGNOSTIC_REPORT_PARAMETER {.bycopy.} = object
name: array[129, uint16]
value: array[260, uint16]
DIAGNOSTIC_REPORT_SIGNATURE {.bycopy.} = object
eventName: array[65, uint16]
parameters: array[10, DIAGNOSTIC_REPORT_PARAMETER]
FILETIME {.bycopy.} = object
dwLowDateTime: uint32
dwHighDateTime: uint32
DIAGNOSTIC_REPORT_DATA {.bycopy.} = object
signature: DIAGNOSTIC_REPORT_SIGNATURE
bucketId: GUID
reportId: GUID
creationTime: FILETIME
sizeInBytes: uint64
cabId: pointer
reportStatus: uint32
reportIntegratorId: GUID
fileNames: pointer
fileCount: uint32
friendlyEventName: pointer
applicationName: pointer
applicationPath: pointer
description: pointer
bucketIdString: pointer
legacyBucketId: uint64
reportKey: pointerstruct DIAGNOSTIC_REPORT_PARAMETER
{
wchar[129] name;
wchar[260] value;
}
struct DIAGNOSTIC_REPORT_SIGNATURE
{
wchar[65] eventName;
DIAGNOSTIC_REPORT_PARAMETER[10] parameters;
}
struct FILETIME
{
uint dwLowDateTime;
uint dwHighDateTime;
}
struct DIAGNOSTIC_REPORT_DATA
{
DIAGNOSTIC_REPORT_SIGNATURE signature;
GUID bucketId;
GUID reportId;
FILETIME creationTime;
ulong sizeInBytes;
void* cabId;
uint reportStatus;
GUID reportIntegratorId;
void* fileNames;
uint fileCount;
void* friendlyEventName;
void* applicationName;
void* applicationPath;
void* description;
void* bucketIdString;
ulong legacyBucketId;
void* reportKey;
}HSP用 定義
HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; DIAGNOSTIC_REPORT_DATA サイズ: 8032 バイト(x86)
dim st, 2008 ; 4byte整数×2008(構造体サイズ 8032 / 4 切り上げ)
; signature : DIAGNOSTIC_REPORT_SIGNATURE (+0, 7910byte) varptr(st)+0 を基点に操作(7910byte:入れ子/配列)
; bucketId : GUID (+7912, 16byte) varptr(st)+7912 を基点に操作(16byte:入れ子/配列)
; reportId : GUID (+7928, 16byte) varptr(st)+7928 を基点に操作(16byte:入れ子/配列)
; creationTime : FILETIME (+7944, 8byte) varptr(st)+7944 を基点に操作(8byte:入れ子/配列)
; sizeInBytes : ULONGLONG (+7952, 8byte) qpoke st,7952,値 / qpeek(st,7952) ※IronHSPのみ。3.7/3.8は lpoke st,7952,下位 : lpoke st,7956,上位
; cabId : LPWSTR (+7960, 4byte) st.1990 = 値 / 値 = st.1990 (lpoke/lpeek も可)
; reportStatus : DWORD (+7964, 4byte) st.1991 = 値 / 値 = st.1991 (lpoke/lpeek も可)
; reportIntegratorId : GUID (+7968, 16byte) varptr(st)+7968 を基点に操作(16byte:入れ子/配列)
; fileNames : LPWSTR* (+7984, 4byte) st.1996 = 値 / 値 = st.1996 (lpoke/lpeek も可)
; fileCount : DWORD (+7988, 4byte) st.1997 = 値 / 値 = st.1997 (lpoke/lpeek も可)
; friendlyEventName : LPWSTR (+7992, 4byte) st.1998 = 値 / 値 = st.1998 (lpoke/lpeek も可)
; applicationName : LPWSTR (+7996, 4byte) st.1999 = 値 / 値 = st.1999 (lpoke/lpeek も可)
; applicationPath : LPWSTR (+8000, 4byte) st.2000 = 値 / 値 = st.2000 (lpoke/lpeek も可)
; description : LPWSTR (+8004, 4byte) st.2001 = 値 / 値 = st.2001 (lpoke/lpeek も可)
; bucketIdString : LPWSTR (+8008, 4byte) st.2002 = 値 / 値 = st.2002 (lpoke/lpeek も可)
; legacyBucketId : ULONGLONG (+8016, 8byte) qpoke st,8016,値 / qpeek(st,8016) ※IronHSPのみ。3.7/3.8は lpoke st,8016,下位 : lpoke st,8020,上位
; reportKey : LPWSTR (+8024, 4byte) st.2006 = 値 / 値 = st.2006 (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; DIAGNOSTIC_REPORT_DATA サイズ: 8064 バイト(x64)
dim st, 2016 ; 4byte整数×2016(構造体サイズ 8064 / 4 切り上げ)
; signature : DIAGNOSTIC_REPORT_SIGNATURE (+0, 7910byte) varptr(st)+0 を基点に操作(7910byte:入れ子/配列)
; bucketId : GUID (+7912, 16byte) varptr(st)+7912 を基点に操作(16byte:入れ子/配列)
; reportId : GUID (+7928, 16byte) varptr(st)+7928 を基点に操作(16byte:入れ子/配列)
; creationTime : FILETIME (+7944, 8byte) varptr(st)+7944 を基点に操作(8byte:入れ子/配列)
; sizeInBytes : ULONGLONG (+7952, 8byte) qpoke st,7952,値 / qpeek(st,7952) ※IronHSPのみ。3.7/3.8は lpoke st,7952,下位 : lpoke st,7956,上位
; cabId : LPWSTR (+7960, 8byte) qpoke st,7960,値 / qpeek(st,7960) ※IronHSPのみ。3.7/3.8は lpoke st,7960,下位 : lpoke st,7964,上位
; reportStatus : DWORD (+7968, 4byte) st.1992 = 値 / 値 = st.1992 (lpoke/lpeek も可)
; reportIntegratorId : GUID (+7972, 16byte) varptr(st)+7972 を基点に操作(16byte:入れ子/配列)
; fileNames : LPWSTR* (+7992, 8byte) qpoke st,7992,値 / qpeek(st,7992) ※IronHSPのみ。3.7/3.8は lpoke st,7992,下位 : lpoke st,7996,上位
; fileCount : DWORD (+8000, 4byte) st.2000 = 値 / 値 = st.2000 (lpoke/lpeek も可)
; friendlyEventName : LPWSTR (+8008, 8byte) qpoke st,8008,値 / qpeek(st,8008) ※IronHSPのみ。3.7/3.8は lpoke st,8008,下位 : lpoke st,8012,上位
; applicationName : LPWSTR (+8016, 8byte) qpoke st,8016,値 / qpeek(st,8016) ※IronHSPのみ。3.7/3.8は lpoke st,8016,下位 : lpoke st,8020,上位
; applicationPath : LPWSTR (+8024, 8byte) qpoke st,8024,値 / qpeek(st,8024) ※IronHSPのみ。3.7/3.8は lpoke st,8024,下位 : lpoke st,8028,上位
; description : LPWSTR (+8032, 8byte) qpoke st,8032,値 / qpeek(st,8032) ※IronHSPのみ。3.7/3.8は lpoke st,8032,下位 : lpoke st,8036,上位
; bucketIdString : LPWSTR (+8040, 8byte) qpoke st,8040,値 / qpeek(st,8040) ※IronHSPのみ。3.7/3.8は lpoke st,8040,下位 : lpoke st,8044,上位
; legacyBucketId : ULONGLONG (+8048, 8byte) qpoke st,8048,値 / qpeek(st,8048) ※IronHSPのみ。3.7/3.8は lpoke st,8048,下位 : lpoke st,8052,上位
; reportKey : LPWSTR (+8056, 8byte) qpoke st,8056,値 / qpeek(st,8056) ※IronHSPのみ。3.7/3.8は lpoke st,8056,下位 : lpoke st,8060,上位
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global DIAGNOSTIC_REPORT_PARAMETER
#field wchar name 129
#field wchar value 260
#endstruct
#defstruct global DIAGNOSTIC_REPORT_SIGNATURE
#field wchar eventName 65
#field DIAGNOSTIC_REPORT_PARAMETER parameters 10
#endstruct
#defstruct global GUID, pack=1
#field int Data1
#field short Data2
#field short Data3
#field byte Data4 8
#endstruct
#defstruct global FILETIME
#field int dwLowDateTime
#field int dwHighDateTime
#endstruct
#defstruct global DIAGNOSTIC_REPORT_DATA
#field DIAGNOSTIC_REPORT_SIGNATURE signature
#field GUID bucketId
#field GUID reportId
#field FILETIME creationTime
#field int64 sizeInBytes
#field intptr cabId
#field int reportStatus
#field GUID reportIntegratorId
#field intptr fileNames
#field int fileCount
#field intptr friendlyEventName
#field intptr applicationName
#field intptr applicationPath
#field intptr description
#field intptr bucketIdString
#field int64 legacyBucketId
#field intptr reportKey
#endstruct
stdim st, DIAGNOSTIC_REPORT_DATA ; NSTRUCT 変数を確保
st->sizeInBytes = 100
mes "sizeInBytes=" + st->sizeInBytes