Win32 API 日本語リファレンス
ホームSecurity.DiagnosticDataQuery › DIAGNOSTIC_REPORT_DATA

DIAGNOSTIC_REPORT_DATA

構造体
サイズx64: 8064 バイト / x86: 8032 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールドサイズx64x86説明
signatureDIAGNOSTIC_REPORT_SIGNATURE7910+0+0レポートのシグネチャ(イベント名とパラメータ)情報。
bucketIdGUID16+7912+7912Windowsエラー報告のバケットを識別するGUID。
reportIdGUID16+7928+7928レポートを一意に識別するGUID。
creationTimeFILETIME8+7944+7944レポート作成時刻。FILETIME形式。
sizeInBytesULONGLONG8+7952+7952レポートの総バイト数。
cabIdLPWSTR8/4+7960+7960アップロードされたCAB(圧縮アーカイブ)を識別する文字列。
reportStatusDWORD4+7968+7964レポートの状態を示すフラグ値。
reportIntegratorIdGUID16+7972+7968レポートを統合した主体を識別するGUID。
fileNamesLPWSTR*8/4+7992+7984レポートに含まれるファイル名文字列の配列へのポインタ。
fileCountDWORD4+8000+7988fileNames配列の要素数。
friendlyEventNameLPWSTR8/4+8008+7992イベントの分かりやすい表示名文字列。
applicationNameLPWSTR8/4+8016+7996障害が発生したアプリケーション名文字列。
applicationPathLPWSTR8/4+8024+8000アプリケーションの実行ファイルパス文字列。
descriptionLPWSTR8/4+8032+8004レポートの説明文字列。
bucketIdStringLPWSTR8/4+8040+8008バケットIDの文字列表現。
legacyBucketIdULONGLONG8+8048+8016旧形式のバケットID(符号なし64ビット値)。
reportKeyLPWSTR8/4+8056+8024レポートを識別するキー文字列。

各言語での定義

#include <windows.h>

// DIAGNOSTIC_REPORT_PARAMETER  (x64 778 / x86 778 バイト)
typedef struct DIAGNOSTIC_REPORT_PARAMETER {
    WCHAR name[129];
    WCHAR value[260];
} DIAGNOSTIC_REPORT_PARAMETER;

// DIAGNOSTIC_REPORT_SIGNATURE  (x64 7910 / x86 7910 バイト)
typedef struct DIAGNOSTIC_REPORT_SIGNATURE {
    WCHAR eventName[65];
    DIAGNOSTIC_REPORT_PARAMETER parameters[10];
} DIAGNOSTIC_REPORT_SIGNATURE;

// FILETIME  (x64 8 / x86 8 バイト)
typedef struct FILETIME {
    DWORD dwLowDateTime;
    DWORD dwHighDateTime;
} FILETIME;

// DIAGNOSTIC_REPORT_DATA  (x64 8064 / x86 8032 バイト)
typedef struct DIAGNOSTIC_REPORT_DATA {
    DIAGNOSTIC_REPORT_SIGNATURE signature;
    GUID bucketId;
    GUID reportId;
    FILETIME creationTime;
    ULONGLONG sizeInBytes;
    LPWSTR cabId;
    DWORD reportStatus;
    GUID reportIntegratorId;
    LPWSTR* fileNames;
    DWORD fileCount;
    LPWSTR friendlyEventName;
    LPWSTR applicationName;
    LPWSTR applicationPath;
    LPWSTR description;
    LPWSTR bucketIdString;
    ULONGLONG legacyBucketId;
    LPWSTR reportKey;
} DIAGNOSTIC_REPORT_DATA;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DIAGNOSTIC_REPORT_PARAMETER
{
    [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 129)] public string name;
    [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)] public string value;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DIAGNOSTIC_REPORT_SIGNATURE
{
    [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 65)] public string eventName;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)] public DIAGNOSTIC_REPORT_PARAMETER[] parameters;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FILETIME
{
    public uint dwLowDateTime;
    public uint dwHighDateTime;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DIAGNOSTIC_REPORT_DATA
{
    public DIAGNOSTIC_REPORT_SIGNATURE signature;
    public Guid bucketId;
    public Guid reportId;
    public FILETIME creationTime;
    public ulong sizeInBytes;
    public IntPtr cabId;
    public uint reportStatus;
    public Guid reportIntegratorId;
    public IntPtr fileNames;
    public uint fileCount;
    public IntPtr friendlyEventName;
    public IntPtr applicationName;
    public IntPtr applicationPath;
    public IntPtr description;
    public IntPtr bucketIdString;
    public ulong legacyBucketId;
    public IntPtr reportKey;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DIAGNOSTIC_REPORT_PARAMETER
    <MarshalAs(UnmanagedType.ByValTStr, SizeConst:=129)> Public name As String
    <MarshalAs(UnmanagedType.ByValTStr, SizeConst:=260)> Public value As String
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DIAGNOSTIC_REPORT_SIGNATURE
    <MarshalAs(UnmanagedType.ByValTStr, SizeConst:=65)> Public eventName As String
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=10)> Public parameters() As DIAGNOSTIC_REPORT_PARAMETER
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FILETIME
    Public dwLowDateTime As UInteger
    Public dwHighDateTime As UInteger
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DIAGNOSTIC_REPORT_DATA
    Public signature As DIAGNOSTIC_REPORT_SIGNATURE
    Public bucketId As Guid
    Public reportId As Guid
    Public creationTime As FILETIME
    Public sizeInBytes As ULong
    Public cabId As IntPtr
    Public reportStatus As UInteger
    Public reportIntegratorId As Guid
    Public fileNames As IntPtr
    Public fileCount As UInteger
    Public friendlyEventName As IntPtr
    Public applicationName As IntPtr
    Public applicationPath As IntPtr
    Public description As IntPtr
    Public bucketIdString As IntPtr
    Public legacyBucketId As ULong
    Public reportKey As IntPtr
End Structure
import ctypes
from ctypes import wintypes

class DIAGNOSTIC_REPORT_PARAMETER(ctypes.Structure):
    _fields_ = [
        ("name", ctypes.c_wchar * 129),
        ("value", ctypes.c_wchar * 260),
    ]

class DIAGNOSTIC_REPORT_SIGNATURE(ctypes.Structure):
    _fields_ = [
        ("eventName", ctypes.c_wchar * 65),
        ("parameters", DIAGNOSTIC_REPORT_PARAMETER * 10),
    ]

class FILETIME(ctypes.Structure):
    _fields_ = [
        ("dwLowDateTime", wintypes.DWORD),
        ("dwHighDateTime", wintypes.DWORD),
    ]

class DIAGNOSTIC_REPORT_DATA(ctypes.Structure):
    _fields_ = [
        ("signature", DIAGNOSTIC_REPORT_SIGNATURE),
        ("bucketId", GUID),
        ("reportId", GUID),
        ("creationTime", FILETIME),
        ("sizeInBytes", ctypes.c_ulonglong),
        ("cabId", ctypes.c_void_p),
        ("reportStatus", wintypes.DWORD),
        ("reportIntegratorId", GUID),
        ("fileNames", ctypes.c_void_p),
        ("fileCount", wintypes.DWORD),
        ("friendlyEventName", ctypes.c_void_p),
        ("applicationName", ctypes.c_void_p),
        ("applicationPath", ctypes.c_void_p),
        ("description", ctypes.c_void_p),
        ("bucketIdString", ctypes.c_void_p),
        ("legacyBucketId", ctypes.c_ulonglong),
        ("reportKey", ctypes.c_void_p),
    ]
#[repr(C)]
pub struct DIAGNOSTIC_REPORT_PARAMETER {
    pub name: [u16; 129],
    pub value: [u16; 260],
}

#[repr(C)]
pub struct DIAGNOSTIC_REPORT_SIGNATURE {
    pub eventName: [u16; 65],
    pub parameters: [DIAGNOSTIC_REPORT_PARAMETER; 10],
}

#[repr(C)]
pub struct FILETIME {
    pub dwLowDateTime: u32,
    pub dwHighDateTime: u32,
}

#[repr(C)]
pub struct DIAGNOSTIC_REPORT_DATA {
    pub signature: DIAGNOSTIC_REPORT_SIGNATURE,
    pub bucketId: GUID,
    pub reportId: GUID,
    pub creationTime: FILETIME,
    pub sizeInBytes: u64,
    pub cabId: *mut core::ffi::c_void,
    pub reportStatus: u32,
    pub reportIntegratorId: GUID,
    pub fileNames: *mut core::ffi::c_void,
    pub fileCount: u32,
    pub friendlyEventName: *mut core::ffi::c_void,
    pub applicationName: *mut core::ffi::c_void,
    pub applicationPath: *mut core::ffi::c_void,
    pub description: *mut core::ffi::c_void,
    pub bucketIdString: *mut core::ffi::c_void,
    pub legacyBucketId: u64,
    pub reportKey: *mut core::ffi::c_void,
}
import "golang.org/x/sys/windows"

type DIAGNOSTIC_REPORT_PARAMETER struct {
	name [129]uint16
	value [260]uint16
}

type DIAGNOSTIC_REPORT_SIGNATURE struct {
	eventName [65]uint16
	parameters [10]DIAGNOSTIC_REPORT_PARAMETER
}

type FILETIME struct {
	dwLowDateTime uint32
	dwHighDateTime uint32
}

type DIAGNOSTIC_REPORT_DATA struct {
	signature DIAGNOSTIC_REPORT_SIGNATURE
	bucketId windows.GUID
	reportId windows.GUID
	creationTime FILETIME
	sizeInBytes uint64
	cabId uintptr
	reportStatus uint32
	reportIntegratorId windows.GUID
	fileNames uintptr
	fileCount uint32
	friendlyEventName uintptr
	applicationName uintptr
	applicationPath uintptr
	description uintptr
	bucketIdString uintptr
	legacyBucketId uint64
	reportKey uintptr
}
type
  DIAGNOSTIC_REPORT_PARAMETER = record
    name: array[0..128] of WideChar;
    value: array[0..259] of WideChar;
  end;

  DIAGNOSTIC_REPORT_SIGNATURE = record
    eventName: array[0..64] of WideChar;
    parameters: array[0..9] of DIAGNOSTIC_REPORT_PARAMETER;
  end;

  FILETIME = record
    dwLowDateTime: DWORD;
    dwHighDateTime: DWORD;
  end;

  DIAGNOSTIC_REPORT_DATA = record
    signature: DIAGNOSTIC_REPORT_SIGNATURE;
    bucketId: TGUID;
    reportId: TGUID;
    creationTime: FILETIME;
    sizeInBytes: UInt64;
    cabId: Pointer;
    reportStatus: DWORD;
    reportIntegratorId: TGUID;
    fileNames: Pointer;
    fileCount: DWORD;
    friendlyEventName: Pointer;
    applicationName: Pointer;
    applicationPath: Pointer;
    description: Pointer;
    bucketIdString: Pointer;
    legacyBucketId: UInt64;
    reportKey: Pointer;
  end;
const DIAGNOSTIC_REPORT_PARAMETER = extern struct {
    name: [129]u16,
    value: [260]u16,
};

const DIAGNOSTIC_REPORT_SIGNATURE = extern struct {
    eventName: [65]u16,
    parameters: [10]DIAGNOSTIC_REPORT_PARAMETER,
};

const FILETIME = extern struct {
    dwLowDateTime: u32,
    dwHighDateTime: u32,
};

const DIAGNOSTIC_REPORT_DATA = extern struct {
    signature: DIAGNOSTIC_REPORT_SIGNATURE,
    bucketId: GUID,
    reportId: GUID,
    creationTime: FILETIME,
    sizeInBytes: u64,
    cabId: ?*anyopaque,
    reportStatus: u32,
    reportIntegratorId: GUID,
    fileNames: ?*anyopaque,
    fileCount: u32,
    friendlyEventName: ?*anyopaque,
    applicationName: ?*anyopaque,
    applicationPath: ?*anyopaque,
    description: ?*anyopaque,
    bucketIdString: ?*anyopaque,
    legacyBucketId: u64,
    reportKey: ?*anyopaque,
};
type
  DIAGNOSTIC_REPORT_PARAMETER {.bycopy.} = object
    name: array[129, uint16]
    value: array[260, uint16]

  DIAGNOSTIC_REPORT_SIGNATURE {.bycopy.} = object
    eventName: array[65, uint16]
    parameters: array[10, DIAGNOSTIC_REPORT_PARAMETER]

  FILETIME {.bycopy.} = object
    dwLowDateTime: uint32
    dwHighDateTime: uint32

  DIAGNOSTIC_REPORT_DATA {.bycopy.} = object
    signature: DIAGNOSTIC_REPORT_SIGNATURE
    bucketId: GUID
    reportId: GUID
    creationTime: FILETIME
    sizeInBytes: uint64
    cabId: pointer
    reportStatus: uint32
    reportIntegratorId: GUID
    fileNames: pointer
    fileCount: uint32
    friendlyEventName: pointer
    applicationName: pointer
    applicationPath: pointer
    description: pointer
    bucketIdString: pointer
    legacyBucketId: uint64
    reportKey: pointer
struct DIAGNOSTIC_REPORT_PARAMETER
{
    wchar[129] name;
    wchar[260] value;
}

struct DIAGNOSTIC_REPORT_SIGNATURE
{
    wchar[65] eventName;
    DIAGNOSTIC_REPORT_PARAMETER[10] parameters;
}

struct FILETIME
{
    uint dwLowDateTime;
    uint dwHighDateTime;
}

struct DIAGNOSTIC_REPORT_DATA
{
    DIAGNOSTIC_REPORT_SIGNATURE signature;
    GUID bucketId;
    GUID reportId;
    FILETIME creationTime;
    ulong sizeInBytes;
    void* cabId;
    uint reportStatus;
    GUID reportIntegratorId;
    void* fileNames;
    uint fileCount;
    void* friendlyEventName;
    void* applicationName;
    void* applicationPath;
    void* description;
    void* bucketIdString;
    ulong legacyBucketId;
    void* reportKey;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; DIAGNOSTIC_REPORT_DATA サイズ: 8032 バイト(x86)
dim st, 2008    ; 4byte整数×2008(構造体サイズ 8032 / 4 切り上げ)
; signature : DIAGNOSTIC_REPORT_SIGNATURE (+0, 7910byte)  varptr(st)+0 を基点に操作(7910byte:入れ子/配列)
; bucketId : GUID (+7912, 16byte)  varptr(st)+7912 を基点に操作(16byte:入れ子/配列)
; reportId : GUID (+7928, 16byte)  varptr(st)+7928 を基点に操作(16byte:入れ子/配列)
; creationTime : FILETIME (+7944, 8byte)  varptr(st)+7944 を基点に操作(8byte:入れ子/配列)
; sizeInBytes : ULONGLONG (+7952, 8byte)  qpoke st,7952,値 / qpeek(st,7952)  ※IronHSPのみ。3.7/3.8は lpoke st,7952,下位 : lpoke st,7956,上位
; cabId : LPWSTR (+7960, 4byte)  st.1990 = 値  /  値 = st.1990   (lpoke/lpeek も可)
; reportStatus : DWORD (+7964, 4byte)  st.1991 = 値  /  値 = st.1991   (lpoke/lpeek も可)
; reportIntegratorId : GUID (+7968, 16byte)  varptr(st)+7968 を基点に操作(16byte:入れ子/配列)
; fileNames : LPWSTR* (+7984, 4byte)  st.1996 = 値  /  値 = st.1996   (lpoke/lpeek も可)
; fileCount : DWORD (+7988, 4byte)  st.1997 = 値  /  値 = st.1997   (lpoke/lpeek も可)
; friendlyEventName : LPWSTR (+7992, 4byte)  st.1998 = 値  /  値 = st.1998   (lpoke/lpeek も可)
; applicationName : LPWSTR (+7996, 4byte)  st.1999 = 値  /  値 = st.1999   (lpoke/lpeek も可)
; applicationPath : LPWSTR (+8000, 4byte)  st.2000 = 値  /  値 = st.2000   (lpoke/lpeek も可)
; description : LPWSTR (+8004, 4byte)  st.2001 = 値  /  値 = st.2001   (lpoke/lpeek も可)
; bucketIdString : LPWSTR (+8008, 4byte)  st.2002 = 値  /  値 = st.2002   (lpoke/lpeek も可)
; legacyBucketId : ULONGLONG (+8016, 8byte)  qpoke st,8016,値 / qpeek(st,8016)  ※IronHSPのみ。3.7/3.8は lpoke st,8016,下位 : lpoke st,8020,上位
; reportKey : LPWSTR (+8024, 4byte)  st.2006 = 値  /  値 = st.2006   (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; DIAGNOSTIC_REPORT_DATA サイズ: 8064 バイト(x64)
dim st, 2016    ; 4byte整数×2016(構造体サイズ 8064 / 4 切り上げ)
; signature : DIAGNOSTIC_REPORT_SIGNATURE (+0, 7910byte)  varptr(st)+0 を基点に操作(7910byte:入れ子/配列)
; bucketId : GUID (+7912, 16byte)  varptr(st)+7912 を基点に操作(16byte:入れ子/配列)
; reportId : GUID (+7928, 16byte)  varptr(st)+7928 を基点に操作(16byte:入れ子/配列)
; creationTime : FILETIME (+7944, 8byte)  varptr(st)+7944 を基点に操作(8byte:入れ子/配列)
; sizeInBytes : ULONGLONG (+7952, 8byte)  qpoke st,7952,値 / qpeek(st,7952)  ※IronHSPのみ。3.7/3.8は lpoke st,7952,下位 : lpoke st,7956,上位
; cabId : LPWSTR (+7960, 8byte)  qpoke st,7960,値 / qpeek(st,7960)  ※IronHSPのみ。3.7/3.8は lpoke st,7960,下位 : lpoke st,7964,上位
; reportStatus : DWORD (+7968, 4byte)  st.1992 = 値  /  値 = st.1992   (lpoke/lpeek も可)
; reportIntegratorId : GUID (+7972, 16byte)  varptr(st)+7972 を基点に操作(16byte:入れ子/配列)
; fileNames : LPWSTR* (+7992, 8byte)  qpoke st,7992,値 / qpeek(st,7992)  ※IronHSPのみ。3.7/3.8は lpoke st,7992,下位 : lpoke st,7996,上位
; fileCount : DWORD (+8000, 4byte)  st.2000 = 値  /  値 = st.2000   (lpoke/lpeek も可)
; friendlyEventName : LPWSTR (+8008, 8byte)  qpoke st,8008,値 / qpeek(st,8008)  ※IronHSPのみ。3.7/3.8は lpoke st,8008,下位 : lpoke st,8012,上位
; applicationName : LPWSTR (+8016, 8byte)  qpoke st,8016,値 / qpeek(st,8016)  ※IronHSPのみ。3.7/3.8は lpoke st,8016,下位 : lpoke st,8020,上位
; applicationPath : LPWSTR (+8024, 8byte)  qpoke st,8024,値 / qpeek(st,8024)  ※IronHSPのみ。3.7/3.8は lpoke st,8024,下位 : lpoke st,8028,上位
; description : LPWSTR (+8032, 8byte)  qpoke st,8032,値 / qpeek(st,8032)  ※IronHSPのみ。3.7/3.8は lpoke st,8032,下位 : lpoke st,8036,上位
; bucketIdString : LPWSTR (+8040, 8byte)  qpoke st,8040,値 / qpeek(st,8040)  ※IronHSPのみ。3.7/3.8は lpoke st,8040,下位 : lpoke st,8044,上位
; legacyBucketId : ULONGLONG (+8048, 8byte)  qpoke st,8048,値 / qpeek(st,8048)  ※IronHSPのみ。3.7/3.8は lpoke st,8048,下位 : lpoke st,8052,上位
; reportKey : LPWSTR (+8056, 8byte)  qpoke st,8056,値 / qpeek(st,8056)  ※IronHSPのみ。3.7/3.8は lpoke st,8056,下位 : lpoke st,8060,上位
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global DIAGNOSTIC_REPORT_PARAMETER
    #field wchar name 129
    #field wchar value 260
#endstruct

#defstruct global DIAGNOSTIC_REPORT_SIGNATURE
    #field wchar eventName 65
    #field DIAGNOSTIC_REPORT_PARAMETER parameters 10
#endstruct

#defstruct global GUID, pack=1
    #field int Data1
    #field short Data2
    #field short Data3
    #field byte Data4 8
#endstruct

#defstruct global FILETIME
    #field int dwLowDateTime
    #field int dwHighDateTime
#endstruct

#defstruct global DIAGNOSTIC_REPORT_DATA
    #field DIAGNOSTIC_REPORT_SIGNATURE signature
    #field GUID bucketId
    #field GUID reportId
    #field FILETIME creationTime
    #field int64 sizeInBytes
    #field intptr cabId
    #field int reportStatus
    #field GUID reportIntegratorId
    #field intptr fileNames
    #field int fileCount
    #field intptr friendlyEventName
    #field intptr applicationName
    #field intptr applicationPath
    #field intptr description
    #field intptr bucketIdString
    #field int64 legacyBucketId
    #field intptr reportKey
#endstruct

stdim st, DIAGNOSTIC_REPORT_DATA        ; NSTRUCT 変数を確保
st->sizeInBytes = 100
mes "sizeInBytes=" + st->sizeInBytes