Win32 API 日本語リファレンス
ホームSystem.Diagnostics.Debug › DUMP_HEADER32

DUMP_HEADER32

構造体
サイズx64: 4096 バイト / x86: 4096 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールドサイズx64x86説明
SignatureDWORD4+0+0ダンプファイルの署名を示す。'PAGE' 等の識別値を格納する。
ValidDumpDWORD4+4+4有効なダンプであることを示す検証値。'DUMP' 等を格納する。
MajorVersionDWORD4+8+8ダンプ形式のメジャーバージョンを示す。
MinorVersionDWORD4+12+12ダンプ形式のマイナーバージョンを示す。
DirectoryTableBaseDWORD4+16+16ページディレクトリのベースアドレス(CR3)を示す。
PfnDataBaseDWORD4+20+20PFN データベースのアドレスを示す。
PsLoadedModuleListDWORD4+24+24ロード済みモジュールリストのアドレスを示す。
PsActiveProcessHeadDWORD4+28+28アクティブプロセスリスト先頭のアドレスを示す。
MachineImageTypeDWORD4+32+32マシン種別(CPU アーキテクチャ)を示す。
NumberProcessorsDWORD4+36+36プロセッサ数を示す。
BugCheckCodeDWORD4+40+40発生したバグチェック(ストップエラー)のコードを示す。
BugCheckParameter1DWORD4+44+44バグチェックの第1パラメータを示す。
BugCheckParameter2DWORD4+48+48バグチェックの第2パラメータを示す。
BugCheckParameter3DWORD4+52+52バグチェックの第3パラメータを示す。
BugCheckParameter4DWORD4+56+56バグチェックの第4パラメータを示す。
VersionUserCHAR32+60+60OS バージョン文字列を示す ANSI 文字配列。
PaeEnabledBYTE1+92+92PAE(物理アドレス拡張)が有効かを示すフラグ。
KdSecondaryVersionBYTE1+93+93カーネルデバッガの副バージョンを示す。
Spare3BYTE2+94+94予約フィールド。使用しない。
KdDebuggerDataBlockDWORD4+96+96KdDebuggerDataBlock のアドレスを示す。
Anonymous_Anonymous_e__Union700+100+100物理メモリ記述子等を保持する無名共用体。
ContextRecordBYTE1200+800+800クラッシュ時の CPU コンテキストを保持するバイト配列。
ExceptionEXCEPTION_RECORD3280+2000+2000発生した例外情報(EXCEPTION_RECORD32)を保持する。
CommentCHAR128+2080+2080ダンプに付与されたコメントを示す ANSI 文字配列。
AttributesDUMP_FILE_ATTRIBUTES4+2208+2208ダンプファイルの属性(DUMP_FILE_ATTRIBUTES)を示す。
BootIdDWORD4+2212+2212ブート識別子を示す。
_reserved0BYTE1760+2216+2216予約フィールド配列。使用しない。
DumpTypeDWORD4+3976+3976ダンプの種類(フル/カーネル等)を示す。
MiniDumpFieldsDWORD4+3980+3980ミニダンプに含まれるフィールドのビットマスクを示す。
SecondaryDataStateDWORD4+3984+3984二次データの状態を示す。
ProductTypeDWORD4+3988+3988OS の製品種別を示す。
SuiteMaskDWORD4+3992+3992OS のスイート(エディション)を示すビットマスク。
WriterStatusDWORD4+3996+3996ダンプ書き込みの状態(結果)を示す。
RequiredDumpSpaceLONGLONG8+4000+4000ダンプ作成に必要なディスク容量(バイト)を示す。
_reserved2BYTE16+4008+4008予約フィールド配列。使用しない。
SystemUpTimeLONGLONG8+4024+4024システムの稼働時間を示す。
SystemTimeLONGLONG8+4032+4032ダンプ作成時のシステム時刻を示す。
_reserved3BYTE56+4040+4040予約フィールド配列。使用しない。

共用体: _Anonymous_e__Union x64 700B / x86 700B

フィールドサイズx64x86
PhysicalMemoryBlockPHYSICAL_MEMORY_DESCRIPTOR3216+0+0
PhysicalMemoryBlockBufferBYTE700+0+0

各言語での定義

#include <windows.h>

// EXCEPTION_RECORD32  (x64 80 / x86 80 バイト)
typedef struct EXCEPTION_RECORD32 {
    NTSTATUS ExceptionCode;
    DWORD ExceptionFlags;
    DWORD ExceptionRecord;
    DWORD ExceptionAddress;
    DWORD NumberParameters;
    DWORD ExceptionInformation[15];
} EXCEPTION_RECORD32;

// DUMP_FILE_ATTRIBUTES  (x64 4 / x86 4 バイト)
typedef struct DUMP_FILE_ATTRIBUTES {
    _Anonymous_e__Struct Anonymous;
    DWORD Attributes;
} DUMP_FILE_ATTRIBUTES;

// DUMP_HEADER32  (x64 4096 / x86 4096 バイト)
typedef struct DUMP_HEADER32 {
    DWORD Signature;
    DWORD ValidDump;
    DWORD MajorVersion;
    DWORD MinorVersion;
    DWORD DirectoryTableBase;
    DWORD PfnDataBase;
    DWORD PsLoadedModuleList;
    DWORD PsActiveProcessHead;
    DWORD MachineImageType;
    DWORD NumberProcessors;
    DWORD BugCheckCode;
    DWORD BugCheckParameter1;
    DWORD BugCheckParameter2;
    DWORD BugCheckParameter3;
    DWORD BugCheckParameter4;
    CHAR VersionUser[32];
    BYTE PaeEnabled;
    BYTE KdSecondaryVersion;
    BYTE Spare3[2];
    DWORD KdDebuggerDataBlock;
    _Anonymous_e__Union Anonymous;
    BYTE ContextRecord[1200];
    EXCEPTION_RECORD32 Exception;
    CHAR Comment[128];
    DUMP_FILE_ATTRIBUTES Attributes;
    DWORD BootId;
    BYTE _reserved0[1760];
    DWORD DumpType;
    DWORD MiniDumpFields;
    DWORD SecondaryDataState;
    DWORD ProductType;
    DWORD SuiteMask;
    DWORD WriterStatus;
    LONGLONG RequiredDumpSpace;
    BYTE _reserved2[16];
    LONGLONG SystemUpTime;
    LONGLONG SystemTime;
    BYTE _reserved3[56];
} DUMP_HEADER32;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct EXCEPTION_RECORD32
{
    public int ExceptionCode;
    public uint ExceptionFlags;
    public uint ExceptionRecord;
    public uint ExceptionAddress;
    public uint NumberParameters;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 15)] public uint[] ExceptionInformation;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DUMP_FILE_ATTRIBUTES
{
    public _Anonymous_e__Struct Anonymous;
    public uint Attributes;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DUMP_HEADER32
{
    public uint Signature;
    public uint ValidDump;
    public uint MajorVersion;
    public uint MinorVersion;
    public uint DirectoryTableBase;
    public uint PfnDataBase;
    public uint PsLoadedModuleList;
    public uint PsActiveProcessHead;
    public uint MachineImageType;
    public uint NumberProcessors;
    public uint BugCheckCode;
    public uint BugCheckParameter1;
    public uint BugCheckParameter2;
    public uint BugCheckParameter3;
    public uint BugCheckParameter4;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 32)] public sbyte[] VersionUser;
    public byte PaeEnabled;
    public byte KdSecondaryVersion;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)] public byte[] Spare3;
    public uint KdDebuggerDataBlock;
    public _Anonymous_e__Union Anonymous;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 1200)] public byte[] ContextRecord;
    public EXCEPTION_RECORD32 Exception;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 128)] public sbyte[] Comment;
    public DUMP_FILE_ATTRIBUTES Attributes;
    public uint BootId;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 1760)] public byte[] _reserved0;
    public uint DumpType;
    public uint MiniDumpFields;
    public uint SecondaryDataState;
    public uint ProductType;
    public uint SuiteMask;
    public uint WriterStatus;
    public long RequiredDumpSpace;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] public byte[] _reserved2;
    public long SystemUpTime;
    public long SystemTime;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 56)] public byte[] _reserved3;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure EXCEPTION_RECORD32
    Public ExceptionCode As Integer
    Public ExceptionFlags As UInteger
    Public ExceptionRecord As UInteger
    Public ExceptionAddress As UInteger
    Public NumberParameters As UInteger
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=15)> Public ExceptionInformation() As UInteger
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DUMP_FILE_ATTRIBUTES
    Public Anonymous As _Anonymous_e__Struct
    Public Attributes As UInteger
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DUMP_HEADER32
    Public Signature As UInteger
    Public ValidDump As UInteger
    Public MajorVersion As UInteger
    Public MinorVersion As UInteger
    Public DirectoryTableBase As UInteger
    Public PfnDataBase As UInteger
    Public PsLoadedModuleList As UInteger
    Public PsActiveProcessHead As UInteger
    Public MachineImageType As UInteger
    Public NumberProcessors As UInteger
    Public BugCheckCode As UInteger
    Public BugCheckParameter1 As UInteger
    Public BugCheckParameter2 As UInteger
    Public BugCheckParameter3 As UInteger
    Public BugCheckParameter4 As UInteger
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=32)> Public VersionUser() As SByte
    Public PaeEnabled As Byte
    Public KdSecondaryVersion As Byte
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=2)> Public Spare3() As Byte
    Public KdDebuggerDataBlock As UInteger
    Public Anonymous As _Anonymous_e__Union
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=1200)> Public ContextRecord() As Byte
    Public Exception As EXCEPTION_RECORD32
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=128)> Public Comment() As SByte
    Public Attributes As DUMP_FILE_ATTRIBUTES
    Public BootId As UInteger
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=1760)> Public _reserved0() As Byte
    Public DumpType As UInteger
    Public MiniDumpFields As UInteger
    Public SecondaryDataState As UInteger
    Public ProductType As UInteger
    Public SuiteMask As UInteger
    Public WriterStatus As UInteger
    Public RequiredDumpSpace As Long
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=16)> Public _reserved2() As Byte
    Public SystemUpTime As Long
    Public SystemTime As Long
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=56)> Public _reserved3() As Byte
End Structure
import ctypes
from ctypes import wintypes

class EXCEPTION_RECORD32(ctypes.Structure):
    _fields_ = [
        ("ExceptionCode", ctypes.c_int),
        ("ExceptionFlags", wintypes.DWORD),
        ("ExceptionRecord", wintypes.DWORD),
        ("ExceptionAddress", wintypes.DWORD),
        ("NumberParameters", wintypes.DWORD),
        ("ExceptionInformation", wintypes.DWORD * 15),
    ]

class DUMP_FILE_ATTRIBUTES(ctypes.Structure):
    _fields_ = [
        ("Anonymous", _Anonymous_e__Struct),
        ("Attributes", wintypes.DWORD),
    ]

class DUMP_HEADER32(ctypes.Structure):
    _fields_ = [
        ("Signature", wintypes.DWORD),
        ("ValidDump", wintypes.DWORD),
        ("MajorVersion", wintypes.DWORD),
        ("MinorVersion", wintypes.DWORD),
        ("DirectoryTableBase", wintypes.DWORD),
        ("PfnDataBase", wintypes.DWORD),
        ("PsLoadedModuleList", wintypes.DWORD),
        ("PsActiveProcessHead", wintypes.DWORD),
        ("MachineImageType", wintypes.DWORD),
        ("NumberProcessors", wintypes.DWORD),
        ("BugCheckCode", wintypes.DWORD),
        ("BugCheckParameter1", wintypes.DWORD),
        ("BugCheckParameter2", wintypes.DWORD),
        ("BugCheckParameter3", wintypes.DWORD),
        ("BugCheckParameter4", wintypes.DWORD),
        ("VersionUser", ctypes.c_byte * 32),
        ("PaeEnabled", ctypes.c_ubyte),
        ("KdSecondaryVersion", ctypes.c_ubyte),
        ("Spare3", ctypes.c_ubyte * 2),
        ("KdDebuggerDataBlock", wintypes.DWORD),
        ("Anonymous", _Anonymous_e__Union),
        ("ContextRecord", ctypes.c_ubyte * 1200),
        ("Exception", EXCEPTION_RECORD32),
        ("Comment", ctypes.c_byte * 128),
        ("Attributes", DUMP_FILE_ATTRIBUTES),
        ("BootId", wintypes.DWORD),
        ("_reserved0", ctypes.c_ubyte * 1760),
        ("DumpType", wintypes.DWORD),
        ("MiniDumpFields", wintypes.DWORD),
        ("SecondaryDataState", wintypes.DWORD),
        ("ProductType", wintypes.DWORD),
        ("SuiteMask", wintypes.DWORD),
        ("WriterStatus", wintypes.DWORD),
        ("RequiredDumpSpace", ctypes.c_longlong),
        ("_reserved2", ctypes.c_ubyte * 16),
        ("SystemUpTime", ctypes.c_longlong),
        ("SystemTime", ctypes.c_longlong),
        ("_reserved3", ctypes.c_ubyte * 56),
    ]
#[repr(C)]
pub struct EXCEPTION_RECORD32 {
    pub ExceptionCode: i32,
    pub ExceptionFlags: u32,
    pub ExceptionRecord: u32,
    pub ExceptionAddress: u32,
    pub NumberParameters: u32,
    pub ExceptionInformation: [u32; 15],
}

#[repr(C)]
pub struct DUMP_FILE_ATTRIBUTES {
    pub Anonymous: _Anonymous_e__Struct,
    pub Attributes: u32,
}

#[repr(C)]
pub struct DUMP_HEADER32 {
    pub Signature: u32,
    pub ValidDump: u32,
    pub MajorVersion: u32,
    pub MinorVersion: u32,
    pub DirectoryTableBase: u32,
    pub PfnDataBase: u32,
    pub PsLoadedModuleList: u32,
    pub PsActiveProcessHead: u32,
    pub MachineImageType: u32,
    pub NumberProcessors: u32,
    pub BugCheckCode: u32,
    pub BugCheckParameter1: u32,
    pub BugCheckParameter2: u32,
    pub BugCheckParameter3: u32,
    pub BugCheckParameter4: u32,
    pub VersionUser: [i8; 32],
    pub PaeEnabled: u8,
    pub KdSecondaryVersion: u8,
    pub Spare3: [u8; 2],
    pub KdDebuggerDataBlock: u32,
    pub Anonymous: _Anonymous_e__Union,
    pub ContextRecord: [u8; 1200],
    pub Exception: EXCEPTION_RECORD32,
    pub Comment: [i8; 128],
    pub Attributes: DUMP_FILE_ATTRIBUTES,
    pub BootId: u32,
    pub _reserved0: [u8; 1760],
    pub DumpType: u32,
    pub MiniDumpFields: u32,
    pub SecondaryDataState: u32,
    pub ProductType: u32,
    pub SuiteMask: u32,
    pub WriterStatus: u32,
    pub RequiredDumpSpace: i64,
    pub _reserved2: [u8; 16],
    pub SystemUpTime: i64,
    pub SystemTime: i64,
    pub _reserved3: [u8; 56],
}
import "golang.org/x/sys/windows"

type EXCEPTION_RECORD32 struct {
	ExceptionCode int32
	ExceptionFlags uint32
	ExceptionRecord uint32
	ExceptionAddress uint32
	NumberParameters uint32
	ExceptionInformation [15]uint32
}

type DUMP_FILE_ATTRIBUTES struct {
	Anonymous _Anonymous_e__Struct
	Attributes uint32
}

type DUMP_HEADER32 struct {
	Signature uint32
	ValidDump uint32
	MajorVersion uint32
	MinorVersion uint32
	DirectoryTableBase uint32
	PfnDataBase uint32
	PsLoadedModuleList uint32
	PsActiveProcessHead uint32
	MachineImageType uint32
	NumberProcessors uint32
	BugCheckCode uint32
	BugCheckParameter1 uint32
	BugCheckParameter2 uint32
	BugCheckParameter3 uint32
	BugCheckParameter4 uint32
	VersionUser [32]int8
	PaeEnabled byte
	KdSecondaryVersion byte
	Spare3 [2]byte
	KdDebuggerDataBlock uint32
	Anonymous _Anonymous_e__Union
	ContextRecord [1200]byte
	Exception EXCEPTION_RECORD32
	Comment [128]int8
	Attributes DUMP_FILE_ATTRIBUTES
	BootId uint32
	_reserved0 [1760]byte
	DumpType uint32
	MiniDumpFields uint32
	SecondaryDataState uint32
	ProductType uint32
	SuiteMask uint32
	WriterStatus uint32
	RequiredDumpSpace int64
	_reserved2 [16]byte
	SystemUpTime int64
	SystemTime int64
	_reserved3 [56]byte
}
type
  EXCEPTION_RECORD32 = record
    ExceptionCode: Integer;
    ExceptionFlags: DWORD;
    ExceptionRecord: DWORD;
    ExceptionAddress: DWORD;
    NumberParameters: DWORD;
    ExceptionInformation: array[0..14] of DWORD;
  end;

  DUMP_FILE_ATTRIBUTES = record
    Anonymous: _Anonymous_e__Struct;
    Attributes: DWORD;
  end;

  DUMP_HEADER32 = record
    Signature: DWORD;
    ValidDump: DWORD;
    MajorVersion: DWORD;
    MinorVersion: DWORD;
    DirectoryTableBase: DWORD;
    PfnDataBase: DWORD;
    PsLoadedModuleList: DWORD;
    PsActiveProcessHead: DWORD;
    MachineImageType: DWORD;
    NumberProcessors: DWORD;
    BugCheckCode: DWORD;
    BugCheckParameter1: DWORD;
    BugCheckParameter2: DWORD;
    BugCheckParameter3: DWORD;
    BugCheckParameter4: DWORD;
    VersionUser: array[0..31] of Shortint;
    PaeEnabled: Byte;
    KdSecondaryVersion: Byte;
    Spare3: array[0..1] of Byte;
    KdDebuggerDataBlock: DWORD;
    Anonymous: _Anonymous_e__Union;
    ContextRecord: array[0..1199] of Byte;
    Exception: EXCEPTION_RECORD32;
    Comment: array[0..127] of Shortint;
    Attributes: DUMP_FILE_ATTRIBUTES;
    BootId: DWORD;
    _reserved0: array[0..1759] of Byte;
    DumpType: DWORD;
    MiniDumpFields: DWORD;
    SecondaryDataState: DWORD;
    ProductType: DWORD;
    SuiteMask: DWORD;
    WriterStatus: DWORD;
    RequiredDumpSpace: Int64;
    _reserved2: array[0..15] of Byte;
    SystemUpTime: Int64;
    SystemTime: Int64;
    _reserved3: array[0..55] of Byte;
  end;
const EXCEPTION_RECORD32 = extern struct {
    ExceptionCode: i32,
    ExceptionFlags: u32,
    ExceptionRecord: u32,
    ExceptionAddress: u32,
    NumberParameters: u32,
    ExceptionInformation: [15]u32,
};

const DUMP_FILE_ATTRIBUTES = extern struct {
    Anonymous: _Anonymous_e__Struct,
    Attributes: u32,
};

const DUMP_HEADER32 = extern struct {
    Signature: u32,
    ValidDump: u32,
    MajorVersion: u32,
    MinorVersion: u32,
    DirectoryTableBase: u32,
    PfnDataBase: u32,
    PsLoadedModuleList: u32,
    PsActiveProcessHead: u32,
    MachineImageType: u32,
    NumberProcessors: u32,
    BugCheckCode: u32,
    BugCheckParameter1: u32,
    BugCheckParameter2: u32,
    BugCheckParameter3: u32,
    BugCheckParameter4: u32,
    VersionUser: [32]i8,
    PaeEnabled: u8,
    KdSecondaryVersion: u8,
    Spare3: [2]u8,
    KdDebuggerDataBlock: u32,
    Anonymous: _Anonymous_e__Union,
    ContextRecord: [1200]u8,
    Exception: EXCEPTION_RECORD32,
    Comment: [128]i8,
    Attributes: DUMP_FILE_ATTRIBUTES,
    BootId: u32,
    _reserved0: [1760]u8,
    DumpType: u32,
    MiniDumpFields: u32,
    SecondaryDataState: u32,
    ProductType: u32,
    SuiteMask: u32,
    WriterStatus: u32,
    RequiredDumpSpace: i64,
    _reserved2: [16]u8,
    SystemUpTime: i64,
    SystemTime: i64,
    _reserved3: [56]u8,
};
type
  EXCEPTION_RECORD32 {.bycopy.} = object
    ExceptionCode: int32
    ExceptionFlags: uint32
    ExceptionRecord: uint32
    ExceptionAddress: uint32
    NumberParameters: uint32
    ExceptionInformation: array[15, uint32]

  DUMP_FILE_ATTRIBUTES {.bycopy.} = object
    Anonymous: _Anonymous_e__Struct
    Attributes: uint32

  DUMP_HEADER32 {.bycopy.} = object
    Signature: uint32
    ValidDump: uint32
    MajorVersion: uint32
    MinorVersion: uint32
    DirectoryTableBase: uint32
    PfnDataBase: uint32
    PsLoadedModuleList: uint32
    PsActiveProcessHead: uint32
    MachineImageType: uint32
    NumberProcessors: uint32
    BugCheckCode: uint32
    BugCheckParameter1: uint32
    BugCheckParameter2: uint32
    BugCheckParameter3: uint32
    BugCheckParameter4: uint32
    VersionUser: array[32, int8]
    PaeEnabled: uint8
    KdSecondaryVersion: uint8
    Spare3: array[2, uint8]
    KdDebuggerDataBlock: uint32
    Anonymous: _Anonymous_e__Union
    ContextRecord: array[1200, uint8]
    Exception: EXCEPTION_RECORD32
    Comment: array[128, int8]
    Attributes: DUMP_FILE_ATTRIBUTES
    BootId: uint32
    _reserved0: array[1760, uint8]
    DumpType: uint32
    MiniDumpFields: uint32
    SecondaryDataState: uint32
    ProductType: uint32
    SuiteMask: uint32
    WriterStatus: uint32
    RequiredDumpSpace: int64
    _reserved2: array[16, uint8]
    SystemUpTime: int64
    SystemTime: int64
    _reserved3: array[56, uint8]
struct EXCEPTION_RECORD32
{
    int ExceptionCode;
    uint ExceptionFlags;
    uint ExceptionRecord;
    uint ExceptionAddress;
    uint NumberParameters;
    uint[15] ExceptionInformation;
}

struct DUMP_FILE_ATTRIBUTES
{
    _Anonymous_e__Struct Anonymous;
    uint Attributes;
}

struct DUMP_HEADER32
{
    uint Signature;
    uint ValidDump;
    uint MajorVersion;
    uint MinorVersion;
    uint DirectoryTableBase;
    uint PfnDataBase;
    uint PsLoadedModuleList;
    uint PsActiveProcessHead;
    uint MachineImageType;
    uint NumberProcessors;
    uint BugCheckCode;
    uint BugCheckParameter1;
    uint BugCheckParameter2;
    uint BugCheckParameter3;
    uint BugCheckParameter4;
    byte[32] VersionUser;
    ubyte PaeEnabled;
    ubyte KdSecondaryVersion;
    ubyte[2] Spare3;
    uint KdDebuggerDataBlock;
    _Anonymous_e__Union Anonymous;
    ubyte[1200] ContextRecord;
    EXCEPTION_RECORD32 Exception;
    byte[128] Comment;
    DUMP_FILE_ATTRIBUTES Attributes;
    uint BootId;
    ubyte[1760] _reserved0;
    uint DumpType;
    uint MiniDumpFields;
    uint SecondaryDataState;
    uint ProductType;
    uint SuiteMask;
    uint WriterStatus;
    long RequiredDumpSpace;
    ubyte[16] _reserved2;
    long SystemUpTime;
    long SystemTime;
    ubyte[56] _reserved3;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; DUMP_HEADER32 サイズ: 4096 バイト(x64)
dim st, 1024    ; 4byte整数×1024(構造体サイズ 4096 / 4 切り上げ)
; Signature : DWORD (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; ValidDump : DWORD (+4, 4byte)  st.1 = 値  /  値 = st.1   (lpoke/lpeek も可)
; MajorVersion : DWORD (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; MinorVersion : DWORD (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; DirectoryTableBase : DWORD (+16, 4byte)  st.4 = 値  /  値 = st.4   (lpoke/lpeek も可)
; PfnDataBase : DWORD (+20, 4byte)  st.5 = 値  /  値 = st.5   (lpoke/lpeek も可)
; PsLoadedModuleList : DWORD (+24, 4byte)  st.6 = 値  /  値 = st.6   (lpoke/lpeek も可)
; PsActiveProcessHead : DWORD (+28, 4byte)  st.7 = 値  /  値 = st.7   (lpoke/lpeek も可)
; MachineImageType : DWORD (+32, 4byte)  st.8 = 値  /  値 = st.8   (lpoke/lpeek も可)
; NumberProcessors : DWORD (+36, 4byte)  st.9 = 値  /  値 = st.9   (lpoke/lpeek も可)
; BugCheckCode : DWORD (+40, 4byte)  st.10 = 値  /  値 = st.10   (lpoke/lpeek も可)
; BugCheckParameter1 : DWORD (+44, 4byte)  st.11 = 値  /  値 = st.11   (lpoke/lpeek も可)
; BugCheckParameter2 : DWORD (+48, 4byte)  st.12 = 値  /  値 = st.12   (lpoke/lpeek も可)
; BugCheckParameter3 : DWORD (+52, 4byte)  st.13 = 値  /  値 = st.13   (lpoke/lpeek も可)
; BugCheckParameter4 : DWORD (+56, 4byte)  st.14 = 値  /  値 = st.14   (lpoke/lpeek も可)
; VersionUser : CHAR (+60, 32byte)  varptr(st)+60 を基点に操作(32byte:入れ子/配列)
; PaeEnabled : BYTE (+92, 1byte)  poke st,92,値  /  値 = peek(st,92)
; KdSecondaryVersion : BYTE (+93, 1byte)  poke st,93,値  /  値 = peek(st,93)
; Spare3 : BYTE (+94, 2byte)  varptr(st)+94 を基点に操作(2byte:入れ子/配列)
; KdDebuggerDataBlock : DWORD (+96, 4byte)  st.24 = 値  /  値 = st.24   (lpoke/lpeek も可)
; Anonymous : _Anonymous_e__Union (+100, 700byte)  varptr(st)+100 を基点に操作(700byte:入れ子/配列)
; ContextRecord : BYTE (+800, 1200byte)  varptr(st)+800 を基点に操作(1200byte:入れ子/配列)
; Exception : EXCEPTION_RECORD32 (+2000, 80byte)  varptr(st)+2000 を基点に操作(80byte:入れ子/配列)
; Comment : CHAR (+2080, 128byte)  varptr(st)+2080 を基点に操作(128byte:入れ子/配列)
; Attributes : DUMP_FILE_ATTRIBUTES (+2208, 4byte)  varptr(st)+2208 を基点に操作(4byte:入れ子/配列)
; BootId : DWORD (+2212, 4byte)  st.553 = 値  /  値 = st.553   (lpoke/lpeek も可)
; _reserved0 : BYTE (+2216, 1760byte)  varptr(st)+2216 を基点に操作(1760byte:入れ子/配列)
; DumpType : DWORD (+3976, 4byte)  st.994 = 値  /  値 = st.994   (lpoke/lpeek も可)
; MiniDumpFields : DWORD (+3980, 4byte)  st.995 = 値  /  値 = st.995   (lpoke/lpeek も可)
; SecondaryDataState : DWORD (+3984, 4byte)  st.996 = 値  /  値 = st.996   (lpoke/lpeek も可)
; ProductType : DWORD (+3988, 4byte)  st.997 = 値  /  値 = st.997   (lpoke/lpeek も可)
; SuiteMask : DWORD (+3992, 4byte)  st.998 = 値  /  値 = st.998   (lpoke/lpeek も可)
; WriterStatus : DWORD (+3996, 4byte)  st.999 = 値  /  値 = st.999   (lpoke/lpeek も可)
; RequiredDumpSpace : LONGLONG (+4000, 8byte)  qpoke st,4000,値 / qpeek(st,4000)  ※IronHSPのみ。3.7/3.8は lpoke st,4000,下位 : lpoke st,4004,上位
; _reserved2 : BYTE (+4008, 16byte)  varptr(st)+4008 を基点に操作(16byte:入れ子/配列)
; SystemUpTime : LONGLONG (+4024, 8byte)  qpoke st,4024,値 / qpeek(st,4024)  ※IronHSPのみ。3.7/3.8は lpoke st,4024,下位 : lpoke st,4028,上位
; SystemTime : LONGLONG (+4032, 8byte)  qpoke st,4032,値 / qpeek(st,4032)  ※IronHSPのみ。3.7/3.8は lpoke st,4032,下位 : lpoke st,4036,上位
; _reserved3 : BYTE (+4040, 56byte)  varptr(st)+4040 を基点に操作(56byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global EXCEPTION_RECORD32
    #field int ExceptionCode
    #field int ExceptionFlags
    #field int ExceptionRecord
    #field int ExceptionAddress
    #field int NumberParameters
    #field int ExceptionInformation 15
#endstruct

#defstruct global DUMP_HEADER32
    #field int Signature
    #field int ValidDump
    #field int MajorVersion
    #field int MinorVersion
    #field int DirectoryTableBase
    #field int PfnDataBase
    #field int PsLoadedModuleList
    #field int PsActiveProcessHead
    #field int MachineImageType
    #field int NumberProcessors
    #field int BugCheckCode
    #field int BugCheckParameter1
    #field int BugCheckParameter2
    #field int BugCheckParameter3
    #field int BugCheckParameter4
    #field byte VersionUser 32
    #field byte PaeEnabled
    #field byte KdSecondaryVersion
    #field byte Spare3 2
    #field int KdDebuggerDataBlock
    #field byte Anonymous 700
    #field byte ContextRecord 1200
    #field EXCEPTION_RECORD32 Exception
    #field byte Comment 128
    #field byte Attributes 4
    #field int BootId
    #field byte _reserved0 1760
    #field int DumpType
    #field int MiniDumpFields
    #field int SecondaryDataState
    #field int ProductType
    #field int SuiteMask
    #field int WriterStatus
    #field int64 RequiredDumpSpace
    #field byte _reserved2 16
    #field int64 SystemUpTime
    #field int64 SystemTime
    #field byte _reserved3 56
#endstruct

stdim st, DUMP_HEADER32        ; NSTRUCT 変数を確保
st->Signature = 100
mes "Signature=" + st->Signature
; ※union フィールドは byte 列で確保(NSTRUCT は union 非対応)。必要に応じ手動でアクセス。