ホーム › System.Diagnostics.Debug › DUMP_HEADER32
DUMP_HEADER32
構造体サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。
フィールド
| フィールド | 型 | サイズ | x64 | x86 | 説明 |
|---|---|---|---|---|---|
| Signature | DWORD | 4 | +0 | +0 | ダンプファイルの署名を示す。'PAGE' 等の識別値を格納する。 |
| ValidDump | DWORD | 4 | +4 | +4 | 有効なダンプであることを示す検証値。'DUMP' 等を格納する。 |
| MajorVersion | DWORD | 4 | +8 | +8 | ダンプ形式のメジャーバージョンを示す。 |
| MinorVersion | DWORD | 4 | +12 | +12 | ダンプ形式のマイナーバージョンを示す。 |
| DirectoryTableBase | DWORD | 4 | +16 | +16 | ページディレクトリのベースアドレス(CR3)を示す。 |
| PfnDataBase | DWORD | 4 | +20 | +20 | PFN データベースのアドレスを示す。 |
| PsLoadedModuleList | DWORD | 4 | +24 | +24 | ロード済みモジュールリストのアドレスを示す。 |
| PsActiveProcessHead | DWORD | 4 | +28 | +28 | アクティブプロセスリスト先頭のアドレスを示す。 |
| MachineImageType | DWORD | 4 | +32 | +32 | マシン種別(CPU アーキテクチャ)を示す。 |
| NumberProcessors | DWORD | 4 | +36 | +36 | プロセッサ数を示す。 |
| BugCheckCode | DWORD | 4 | +40 | +40 | 発生したバグチェック(ストップエラー)のコードを示す。 |
| BugCheckParameter1 | DWORD | 4 | +44 | +44 | バグチェックの第1パラメータを示す。 |
| BugCheckParameter2 | DWORD | 4 | +48 | +48 | バグチェックの第2パラメータを示す。 |
| BugCheckParameter3 | DWORD | 4 | +52 | +52 | バグチェックの第3パラメータを示す。 |
| BugCheckParameter4 | DWORD | 4 | +56 | +56 | バグチェックの第4パラメータを示す。 |
| VersionUser | CHAR | 32 | +60 | +60 | OS バージョン文字列を示す ANSI 文字配列。 |
| PaeEnabled | BYTE | 1 | +92 | +92 | PAE(物理アドレス拡張)が有効かを示すフラグ。 |
| KdSecondaryVersion | BYTE | 1 | +93 | +93 | カーネルデバッガの副バージョンを示す。 |
| Spare3 | BYTE | 2 | +94 | +94 | 予約フィールド。使用しない。 |
| KdDebuggerDataBlock | DWORD | 4 | +96 | +96 | KdDebuggerDataBlock のアドレスを示す。 |
| Anonymous | _Anonymous_e__Union | 700 | +100 | +100 | 物理メモリ記述子等を保持する無名共用体。 |
| ContextRecord | BYTE | 1200 | +800 | +800 | クラッシュ時の CPU コンテキストを保持するバイト配列。 |
| Exception | EXCEPTION_RECORD32 | 80 | +2000 | +2000 | 発生した例外情報(EXCEPTION_RECORD32)を保持する。 |
| Comment | CHAR | 128 | +2080 | +2080 | ダンプに付与されたコメントを示す ANSI 文字配列。 |
| Attributes | DUMP_FILE_ATTRIBUTES | 4 | +2208 | +2208 | ダンプファイルの属性(DUMP_FILE_ATTRIBUTES)を示す。 |
| BootId | DWORD | 4 | +2212 | +2212 | ブート識別子を示す。 |
| _reserved0 | BYTE | 1760 | +2216 | +2216 | 予約フィールド配列。使用しない。 |
| DumpType | DWORD | 4 | +3976 | +3976 | ダンプの種類(フル/カーネル等)を示す。 |
| MiniDumpFields | DWORD | 4 | +3980 | +3980 | ミニダンプに含まれるフィールドのビットマスクを示す。 |
| SecondaryDataState | DWORD | 4 | +3984 | +3984 | 二次データの状態を示す。 |
| ProductType | DWORD | 4 | +3988 | +3988 | OS の製品種別を示す。 |
| SuiteMask | DWORD | 4 | +3992 | +3992 | OS のスイート(エディション)を示すビットマスク。 |
| WriterStatus | DWORD | 4 | +3996 | +3996 | ダンプ書き込みの状態(結果)を示す。 |
| RequiredDumpSpace | LONGLONG | 8 | +4000 | +4000 | ダンプ作成に必要なディスク容量(バイト)を示す。 |
| _reserved2 | BYTE | 16 | +4008 | +4008 | 予約フィールド配列。使用しない。 |
| SystemUpTime | LONGLONG | 8 | +4024 | +4024 | システムの稼働時間を示す。 |
| SystemTime | LONGLONG | 8 | +4032 | +4032 | ダンプ作成時のシステム時刻を示す。 |
| _reserved3 | BYTE | 56 | +4040 | +4040 | 予約フィールド配列。使用しない。 |
共用体: _Anonymous_e__Union x64 700B / x86 700B
| フィールド | 型 | サイズ | x64 | x86 |
|---|---|---|---|---|
| PhysicalMemoryBlock | PHYSICAL_MEMORY_DESCRIPTOR32 | 16 | +0 | +0 |
| PhysicalMemoryBlockBuffer | BYTE | 700 | +0 | +0 |
各言語での定義
#include <windows.h>
// EXCEPTION_RECORD32 (x64 80 / x86 80 バイト)
typedef struct EXCEPTION_RECORD32 {
NTSTATUS ExceptionCode;
DWORD ExceptionFlags;
DWORD ExceptionRecord;
DWORD ExceptionAddress;
DWORD NumberParameters;
DWORD ExceptionInformation[15];
} EXCEPTION_RECORD32;
// DUMP_FILE_ATTRIBUTES (x64 4 / x86 4 バイト)
typedef struct DUMP_FILE_ATTRIBUTES {
_Anonymous_e__Struct Anonymous;
DWORD Attributes;
} DUMP_FILE_ATTRIBUTES;
// DUMP_HEADER32 (x64 4096 / x86 4096 バイト)
typedef struct DUMP_HEADER32 {
DWORD Signature;
DWORD ValidDump;
DWORD MajorVersion;
DWORD MinorVersion;
DWORD DirectoryTableBase;
DWORD PfnDataBase;
DWORD PsLoadedModuleList;
DWORD PsActiveProcessHead;
DWORD MachineImageType;
DWORD NumberProcessors;
DWORD BugCheckCode;
DWORD BugCheckParameter1;
DWORD BugCheckParameter2;
DWORD BugCheckParameter3;
DWORD BugCheckParameter4;
CHAR VersionUser[32];
BYTE PaeEnabled;
BYTE KdSecondaryVersion;
BYTE Spare3[2];
DWORD KdDebuggerDataBlock;
_Anonymous_e__Union Anonymous;
BYTE ContextRecord[1200];
EXCEPTION_RECORD32 Exception;
CHAR Comment[128];
DUMP_FILE_ATTRIBUTES Attributes;
DWORD BootId;
BYTE _reserved0[1760];
DWORD DumpType;
DWORD MiniDumpFields;
DWORD SecondaryDataState;
DWORD ProductType;
DWORD SuiteMask;
DWORD WriterStatus;
LONGLONG RequiredDumpSpace;
BYTE _reserved2[16];
LONGLONG SystemUpTime;
LONGLONG SystemTime;
BYTE _reserved3[56];
} DUMP_HEADER32;using System;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct EXCEPTION_RECORD32
{
public int ExceptionCode;
public uint ExceptionFlags;
public uint ExceptionRecord;
public uint ExceptionAddress;
public uint NumberParameters;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 15)] public uint[] ExceptionInformation;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DUMP_FILE_ATTRIBUTES
{
public _Anonymous_e__Struct Anonymous;
public uint Attributes;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DUMP_HEADER32
{
public uint Signature;
public uint ValidDump;
public uint MajorVersion;
public uint MinorVersion;
public uint DirectoryTableBase;
public uint PfnDataBase;
public uint PsLoadedModuleList;
public uint PsActiveProcessHead;
public uint MachineImageType;
public uint NumberProcessors;
public uint BugCheckCode;
public uint BugCheckParameter1;
public uint BugCheckParameter2;
public uint BugCheckParameter3;
public uint BugCheckParameter4;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 32)] public sbyte[] VersionUser;
public byte PaeEnabled;
public byte KdSecondaryVersion;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)] public byte[] Spare3;
public uint KdDebuggerDataBlock;
public _Anonymous_e__Union Anonymous;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 1200)] public byte[] ContextRecord;
public EXCEPTION_RECORD32 Exception;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 128)] public sbyte[] Comment;
public DUMP_FILE_ATTRIBUTES Attributes;
public uint BootId;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 1760)] public byte[] _reserved0;
public uint DumpType;
public uint MiniDumpFields;
public uint SecondaryDataState;
public uint ProductType;
public uint SuiteMask;
public uint WriterStatus;
public long RequiredDumpSpace;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] public byte[] _reserved2;
public long SystemUpTime;
public long SystemTime;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 56)] public byte[] _reserved3;
}Imports System.Runtime.InteropServices
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure EXCEPTION_RECORD32
Public ExceptionCode As Integer
Public ExceptionFlags As UInteger
Public ExceptionRecord As UInteger
Public ExceptionAddress As UInteger
Public NumberParameters As UInteger
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=15)> Public ExceptionInformation() As UInteger
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DUMP_FILE_ATTRIBUTES
Public Anonymous As _Anonymous_e__Struct
Public Attributes As UInteger
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DUMP_HEADER32
Public Signature As UInteger
Public ValidDump As UInteger
Public MajorVersion As UInteger
Public MinorVersion As UInteger
Public DirectoryTableBase As UInteger
Public PfnDataBase As UInteger
Public PsLoadedModuleList As UInteger
Public PsActiveProcessHead As UInteger
Public MachineImageType As UInteger
Public NumberProcessors As UInteger
Public BugCheckCode As UInteger
Public BugCheckParameter1 As UInteger
Public BugCheckParameter2 As UInteger
Public BugCheckParameter3 As UInteger
Public BugCheckParameter4 As UInteger
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=32)> Public VersionUser() As SByte
Public PaeEnabled As Byte
Public KdSecondaryVersion As Byte
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=2)> Public Spare3() As Byte
Public KdDebuggerDataBlock As UInteger
Public Anonymous As _Anonymous_e__Union
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=1200)> Public ContextRecord() As Byte
Public Exception As EXCEPTION_RECORD32
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=128)> Public Comment() As SByte
Public Attributes As DUMP_FILE_ATTRIBUTES
Public BootId As UInteger
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=1760)> Public _reserved0() As Byte
Public DumpType As UInteger
Public MiniDumpFields As UInteger
Public SecondaryDataState As UInteger
Public ProductType As UInteger
Public SuiteMask As UInteger
Public WriterStatus As UInteger
Public RequiredDumpSpace As Long
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=16)> Public _reserved2() As Byte
Public SystemUpTime As Long
Public SystemTime As Long
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=56)> Public _reserved3() As Byte
End Structureimport ctypes
from ctypes import wintypes
class EXCEPTION_RECORD32(ctypes.Structure):
_fields_ = [
("ExceptionCode", ctypes.c_int),
("ExceptionFlags", wintypes.DWORD),
("ExceptionRecord", wintypes.DWORD),
("ExceptionAddress", wintypes.DWORD),
("NumberParameters", wintypes.DWORD),
("ExceptionInformation", wintypes.DWORD * 15),
]
class DUMP_FILE_ATTRIBUTES(ctypes.Structure):
_fields_ = [
("Anonymous", _Anonymous_e__Struct),
("Attributes", wintypes.DWORD),
]
class DUMP_HEADER32(ctypes.Structure):
_fields_ = [
("Signature", wintypes.DWORD),
("ValidDump", wintypes.DWORD),
("MajorVersion", wintypes.DWORD),
("MinorVersion", wintypes.DWORD),
("DirectoryTableBase", wintypes.DWORD),
("PfnDataBase", wintypes.DWORD),
("PsLoadedModuleList", wintypes.DWORD),
("PsActiveProcessHead", wintypes.DWORD),
("MachineImageType", wintypes.DWORD),
("NumberProcessors", wintypes.DWORD),
("BugCheckCode", wintypes.DWORD),
("BugCheckParameter1", wintypes.DWORD),
("BugCheckParameter2", wintypes.DWORD),
("BugCheckParameter3", wintypes.DWORD),
("BugCheckParameter4", wintypes.DWORD),
("VersionUser", ctypes.c_byte * 32),
("PaeEnabled", ctypes.c_ubyte),
("KdSecondaryVersion", ctypes.c_ubyte),
("Spare3", ctypes.c_ubyte * 2),
("KdDebuggerDataBlock", wintypes.DWORD),
("Anonymous", _Anonymous_e__Union),
("ContextRecord", ctypes.c_ubyte * 1200),
("Exception", EXCEPTION_RECORD32),
("Comment", ctypes.c_byte * 128),
("Attributes", DUMP_FILE_ATTRIBUTES),
("BootId", wintypes.DWORD),
("_reserved0", ctypes.c_ubyte * 1760),
("DumpType", wintypes.DWORD),
("MiniDumpFields", wintypes.DWORD),
("SecondaryDataState", wintypes.DWORD),
("ProductType", wintypes.DWORD),
("SuiteMask", wintypes.DWORD),
("WriterStatus", wintypes.DWORD),
("RequiredDumpSpace", ctypes.c_longlong),
("_reserved2", ctypes.c_ubyte * 16),
("SystemUpTime", ctypes.c_longlong),
("SystemTime", ctypes.c_longlong),
("_reserved3", ctypes.c_ubyte * 56),
]#[repr(C)]
pub struct EXCEPTION_RECORD32 {
pub ExceptionCode: i32,
pub ExceptionFlags: u32,
pub ExceptionRecord: u32,
pub ExceptionAddress: u32,
pub NumberParameters: u32,
pub ExceptionInformation: [u32; 15],
}
#[repr(C)]
pub struct DUMP_FILE_ATTRIBUTES {
pub Anonymous: _Anonymous_e__Struct,
pub Attributes: u32,
}
#[repr(C)]
pub struct DUMP_HEADER32 {
pub Signature: u32,
pub ValidDump: u32,
pub MajorVersion: u32,
pub MinorVersion: u32,
pub DirectoryTableBase: u32,
pub PfnDataBase: u32,
pub PsLoadedModuleList: u32,
pub PsActiveProcessHead: u32,
pub MachineImageType: u32,
pub NumberProcessors: u32,
pub BugCheckCode: u32,
pub BugCheckParameter1: u32,
pub BugCheckParameter2: u32,
pub BugCheckParameter3: u32,
pub BugCheckParameter4: u32,
pub VersionUser: [i8; 32],
pub PaeEnabled: u8,
pub KdSecondaryVersion: u8,
pub Spare3: [u8; 2],
pub KdDebuggerDataBlock: u32,
pub Anonymous: _Anonymous_e__Union,
pub ContextRecord: [u8; 1200],
pub Exception: EXCEPTION_RECORD32,
pub Comment: [i8; 128],
pub Attributes: DUMP_FILE_ATTRIBUTES,
pub BootId: u32,
pub _reserved0: [u8; 1760],
pub DumpType: u32,
pub MiniDumpFields: u32,
pub SecondaryDataState: u32,
pub ProductType: u32,
pub SuiteMask: u32,
pub WriterStatus: u32,
pub RequiredDumpSpace: i64,
pub _reserved2: [u8; 16],
pub SystemUpTime: i64,
pub SystemTime: i64,
pub _reserved3: [u8; 56],
}import "golang.org/x/sys/windows"
type EXCEPTION_RECORD32 struct {
ExceptionCode int32
ExceptionFlags uint32
ExceptionRecord uint32
ExceptionAddress uint32
NumberParameters uint32
ExceptionInformation [15]uint32
}
type DUMP_FILE_ATTRIBUTES struct {
Anonymous _Anonymous_e__Struct
Attributes uint32
}
type DUMP_HEADER32 struct {
Signature uint32
ValidDump uint32
MajorVersion uint32
MinorVersion uint32
DirectoryTableBase uint32
PfnDataBase uint32
PsLoadedModuleList uint32
PsActiveProcessHead uint32
MachineImageType uint32
NumberProcessors uint32
BugCheckCode uint32
BugCheckParameter1 uint32
BugCheckParameter2 uint32
BugCheckParameter3 uint32
BugCheckParameter4 uint32
VersionUser [32]int8
PaeEnabled byte
KdSecondaryVersion byte
Spare3 [2]byte
KdDebuggerDataBlock uint32
Anonymous _Anonymous_e__Union
ContextRecord [1200]byte
Exception EXCEPTION_RECORD32
Comment [128]int8
Attributes DUMP_FILE_ATTRIBUTES
BootId uint32
_reserved0 [1760]byte
DumpType uint32
MiniDumpFields uint32
SecondaryDataState uint32
ProductType uint32
SuiteMask uint32
WriterStatus uint32
RequiredDumpSpace int64
_reserved2 [16]byte
SystemUpTime int64
SystemTime int64
_reserved3 [56]byte
}type
EXCEPTION_RECORD32 = record
ExceptionCode: Integer;
ExceptionFlags: DWORD;
ExceptionRecord: DWORD;
ExceptionAddress: DWORD;
NumberParameters: DWORD;
ExceptionInformation: array[0..14] of DWORD;
end;
DUMP_FILE_ATTRIBUTES = record
Anonymous: _Anonymous_e__Struct;
Attributes: DWORD;
end;
DUMP_HEADER32 = record
Signature: DWORD;
ValidDump: DWORD;
MajorVersion: DWORD;
MinorVersion: DWORD;
DirectoryTableBase: DWORD;
PfnDataBase: DWORD;
PsLoadedModuleList: DWORD;
PsActiveProcessHead: DWORD;
MachineImageType: DWORD;
NumberProcessors: DWORD;
BugCheckCode: DWORD;
BugCheckParameter1: DWORD;
BugCheckParameter2: DWORD;
BugCheckParameter3: DWORD;
BugCheckParameter4: DWORD;
VersionUser: array[0..31] of Shortint;
PaeEnabled: Byte;
KdSecondaryVersion: Byte;
Spare3: array[0..1] of Byte;
KdDebuggerDataBlock: DWORD;
Anonymous: _Anonymous_e__Union;
ContextRecord: array[0..1199] of Byte;
Exception: EXCEPTION_RECORD32;
Comment: array[0..127] of Shortint;
Attributes: DUMP_FILE_ATTRIBUTES;
BootId: DWORD;
_reserved0: array[0..1759] of Byte;
DumpType: DWORD;
MiniDumpFields: DWORD;
SecondaryDataState: DWORD;
ProductType: DWORD;
SuiteMask: DWORD;
WriterStatus: DWORD;
RequiredDumpSpace: Int64;
_reserved2: array[0..15] of Byte;
SystemUpTime: Int64;
SystemTime: Int64;
_reserved3: array[0..55] of Byte;
end;const EXCEPTION_RECORD32 = extern struct {
ExceptionCode: i32,
ExceptionFlags: u32,
ExceptionRecord: u32,
ExceptionAddress: u32,
NumberParameters: u32,
ExceptionInformation: [15]u32,
};
const DUMP_FILE_ATTRIBUTES = extern struct {
Anonymous: _Anonymous_e__Struct,
Attributes: u32,
};
const DUMP_HEADER32 = extern struct {
Signature: u32,
ValidDump: u32,
MajorVersion: u32,
MinorVersion: u32,
DirectoryTableBase: u32,
PfnDataBase: u32,
PsLoadedModuleList: u32,
PsActiveProcessHead: u32,
MachineImageType: u32,
NumberProcessors: u32,
BugCheckCode: u32,
BugCheckParameter1: u32,
BugCheckParameter2: u32,
BugCheckParameter3: u32,
BugCheckParameter4: u32,
VersionUser: [32]i8,
PaeEnabled: u8,
KdSecondaryVersion: u8,
Spare3: [2]u8,
KdDebuggerDataBlock: u32,
Anonymous: _Anonymous_e__Union,
ContextRecord: [1200]u8,
Exception: EXCEPTION_RECORD32,
Comment: [128]i8,
Attributes: DUMP_FILE_ATTRIBUTES,
BootId: u32,
_reserved0: [1760]u8,
DumpType: u32,
MiniDumpFields: u32,
SecondaryDataState: u32,
ProductType: u32,
SuiteMask: u32,
WriterStatus: u32,
RequiredDumpSpace: i64,
_reserved2: [16]u8,
SystemUpTime: i64,
SystemTime: i64,
_reserved3: [56]u8,
};type
EXCEPTION_RECORD32 {.bycopy.} = object
ExceptionCode: int32
ExceptionFlags: uint32
ExceptionRecord: uint32
ExceptionAddress: uint32
NumberParameters: uint32
ExceptionInformation: array[15, uint32]
DUMP_FILE_ATTRIBUTES {.bycopy.} = object
Anonymous: _Anonymous_e__Struct
Attributes: uint32
DUMP_HEADER32 {.bycopy.} = object
Signature: uint32
ValidDump: uint32
MajorVersion: uint32
MinorVersion: uint32
DirectoryTableBase: uint32
PfnDataBase: uint32
PsLoadedModuleList: uint32
PsActiveProcessHead: uint32
MachineImageType: uint32
NumberProcessors: uint32
BugCheckCode: uint32
BugCheckParameter1: uint32
BugCheckParameter2: uint32
BugCheckParameter3: uint32
BugCheckParameter4: uint32
VersionUser: array[32, int8]
PaeEnabled: uint8
KdSecondaryVersion: uint8
Spare3: array[2, uint8]
KdDebuggerDataBlock: uint32
Anonymous: _Anonymous_e__Union
ContextRecord: array[1200, uint8]
Exception: EXCEPTION_RECORD32
Comment: array[128, int8]
Attributes: DUMP_FILE_ATTRIBUTES
BootId: uint32
_reserved0: array[1760, uint8]
DumpType: uint32
MiniDumpFields: uint32
SecondaryDataState: uint32
ProductType: uint32
SuiteMask: uint32
WriterStatus: uint32
RequiredDumpSpace: int64
_reserved2: array[16, uint8]
SystemUpTime: int64
SystemTime: int64
_reserved3: array[56, uint8]struct EXCEPTION_RECORD32
{
int ExceptionCode;
uint ExceptionFlags;
uint ExceptionRecord;
uint ExceptionAddress;
uint NumberParameters;
uint[15] ExceptionInformation;
}
struct DUMP_FILE_ATTRIBUTES
{
_Anonymous_e__Struct Anonymous;
uint Attributes;
}
struct DUMP_HEADER32
{
uint Signature;
uint ValidDump;
uint MajorVersion;
uint MinorVersion;
uint DirectoryTableBase;
uint PfnDataBase;
uint PsLoadedModuleList;
uint PsActiveProcessHead;
uint MachineImageType;
uint NumberProcessors;
uint BugCheckCode;
uint BugCheckParameter1;
uint BugCheckParameter2;
uint BugCheckParameter3;
uint BugCheckParameter4;
byte[32] VersionUser;
ubyte PaeEnabled;
ubyte KdSecondaryVersion;
ubyte[2] Spare3;
uint KdDebuggerDataBlock;
_Anonymous_e__Union Anonymous;
ubyte[1200] ContextRecord;
EXCEPTION_RECORD32 Exception;
byte[128] Comment;
DUMP_FILE_ATTRIBUTES Attributes;
uint BootId;
ubyte[1760] _reserved0;
uint DumpType;
uint MiniDumpFields;
uint SecondaryDataState;
uint ProductType;
uint SuiteMask;
uint WriterStatus;
long RequiredDumpSpace;
ubyte[16] _reserved2;
long SystemUpTime;
long SystemTime;
ubyte[56] _reserved3;
}HSP用 定義
HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; DUMP_HEADER32 サイズ: 4096 バイト(x64)
dim st, 1024 ; 4byte整数×1024(構造体サイズ 4096 / 4 切り上げ)
; Signature : DWORD (+0, 4byte) st.0 = 値 / 値 = st.0 (lpoke/lpeek も可)
; ValidDump : DWORD (+4, 4byte) st.1 = 値 / 値 = st.1 (lpoke/lpeek も可)
; MajorVersion : DWORD (+8, 4byte) st.2 = 値 / 値 = st.2 (lpoke/lpeek も可)
; MinorVersion : DWORD (+12, 4byte) st.3 = 値 / 値 = st.3 (lpoke/lpeek も可)
; DirectoryTableBase : DWORD (+16, 4byte) st.4 = 値 / 値 = st.4 (lpoke/lpeek も可)
; PfnDataBase : DWORD (+20, 4byte) st.5 = 値 / 値 = st.5 (lpoke/lpeek も可)
; PsLoadedModuleList : DWORD (+24, 4byte) st.6 = 値 / 値 = st.6 (lpoke/lpeek も可)
; PsActiveProcessHead : DWORD (+28, 4byte) st.7 = 値 / 値 = st.7 (lpoke/lpeek も可)
; MachineImageType : DWORD (+32, 4byte) st.8 = 値 / 値 = st.8 (lpoke/lpeek も可)
; NumberProcessors : DWORD (+36, 4byte) st.9 = 値 / 値 = st.9 (lpoke/lpeek も可)
; BugCheckCode : DWORD (+40, 4byte) st.10 = 値 / 値 = st.10 (lpoke/lpeek も可)
; BugCheckParameter1 : DWORD (+44, 4byte) st.11 = 値 / 値 = st.11 (lpoke/lpeek も可)
; BugCheckParameter2 : DWORD (+48, 4byte) st.12 = 値 / 値 = st.12 (lpoke/lpeek も可)
; BugCheckParameter3 : DWORD (+52, 4byte) st.13 = 値 / 値 = st.13 (lpoke/lpeek も可)
; BugCheckParameter4 : DWORD (+56, 4byte) st.14 = 値 / 値 = st.14 (lpoke/lpeek も可)
; VersionUser : CHAR (+60, 32byte) varptr(st)+60 を基点に操作(32byte:入れ子/配列)
; PaeEnabled : BYTE (+92, 1byte) poke st,92,値 / 値 = peek(st,92)
; KdSecondaryVersion : BYTE (+93, 1byte) poke st,93,値 / 値 = peek(st,93)
; Spare3 : BYTE (+94, 2byte) varptr(st)+94 を基点に操作(2byte:入れ子/配列)
; KdDebuggerDataBlock : DWORD (+96, 4byte) st.24 = 値 / 値 = st.24 (lpoke/lpeek も可)
; Anonymous : _Anonymous_e__Union (+100, 700byte) varptr(st)+100 を基点に操作(700byte:入れ子/配列)
; ContextRecord : BYTE (+800, 1200byte) varptr(st)+800 を基点に操作(1200byte:入れ子/配列)
; Exception : EXCEPTION_RECORD32 (+2000, 80byte) varptr(st)+2000 を基点に操作(80byte:入れ子/配列)
; Comment : CHAR (+2080, 128byte) varptr(st)+2080 を基点に操作(128byte:入れ子/配列)
; Attributes : DUMP_FILE_ATTRIBUTES (+2208, 4byte) varptr(st)+2208 を基点に操作(4byte:入れ子/配列)
; BootId : DWORD (+2212, 4byte) st.553 = 値 / 値 = st.553 (lpoke/lpeek も可)
; _reserved0 : BYTE (+2216, 1760byte) varptr(st)+2216 を基点に操作(1760byte:入れ子/配列)
; DumpType : DWORD (+3976, 4byte) st.994 = 値 / 値 = st.994 (lpoke/lpeek も可)
; MiniDumpFields : DWORD (+3980, 4byte) st.995 = 値 / 値 = st.995 (lpoke/lpeek も可)
; SecondaryDataState : DWORD (+3984, 4byte) st.996 = 値 / 値 = st.996 (lpoke/lpeek も可)
; ProductType : DWORD (+3988, 4byte) st.997 = 値 / 値 = st.997 (lpoke/lpeek も可)
; SuiteMask : DWORD (+3992, 4byte) st.998 = 値 / 値 = st.998 (lpoke/lpeek も可)
; WriterStatus : DWORD (+3996, 4byte) st.999 = 値 / 値 = st.999 (lpoke/lpeek も可)
; RequiredDumpSpace : LONGLONG (+4000, 8byte) qpoke st,4000,値 / qpeek(st,4000) ※IronHSPのみ。3.7/3.8は lpoke st,4000,下位 : lpoke st,4004,上位
; _reserved2 : BYTE (+4008, 16byte) varptr(st)+4008 を基点に操作(16byte:入れ子/配列)
; SystemUpTime : LONGLONG (+4024, 8byte) qpoke st,4024,値 / qpeek(st,4024) ※IronHSPのみ。3.7/3.8は lpoke st,4024,下位 : lpoke st,4028,上位
; SystemTime : LONGLONG (+4032, 8byte) qpoke st,4032,値 / qpeek(st,4032) ※IronHSPのみ。3.7/3.8は lpoke st,4032,下位 : lpoke st,4036,上位
; _reserved3 : BYTE (+4040, 56byte) varptr(st)+4040 を基点に操作(56byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global EXCEPTION_RECORD32
#field int ExceptionCode
#field int ExceptionFlags
#field int ExceptionRecord
#field int ExceptionAddress
#field int NumberParameters
#field int ExceptionInformation 15
#endstruct
#defstruct global DUMP_HEADER32
#field int Signature
#field int ValidDump
#field int MajorVersion
#field int MinorVersion
#field int DirectoryTableBase
#field int PfnDataBase
#field int PsLoadedModuleList
#field int PsActiveProcessHead
#field int MachineImageType
#field int NumberProcessors
#field int BugCheckCode
#field int BugCheckParameter1
#field int BugCheckParameter2
#field int BugCheckParameter3
#field int BugCheckParameter4
#field byte VersionUser 32
#field byte PaeEnabled
#field byte KdSecondaryVersion
#field byte Spare3 2
#field int KdDebuggerDataBlock
#field byte Anonymous 700
#field byte ContextRecord 1200
#field EXCEPTION_RECORD32 Exception
#field byte Comment 128
#field byte Attributes 4
#field int BootId
#field byte _reserved0 1760
#field int DumpType
#field int MiniDumpFields
#field int SecondaryDataState
#field int ProductType
#field int SuiteMask
#field int WriterStatus
#field int64 RequiredDumpSpace
#field byte _reserved2 16
#field int64 SystemUpTime
#field int64 SystemTime
#field byte _reserved3 56
#endstruct
stdim st, DUMP_HEADER32 ; NSTRUCT 変数を確保
st->Signature = 100
mes "Signature=" + st->Signature
; ※union フィールドは byte 列で確保(NSTRUCT は union 非対応)。必要に応じ手動でアクセス。