Win32 API 日本語リファレンス
ホームSystem.Diagnostics.Debug › DUMP_HEADER64

DUMP_HEADER64

構造体
サイズx64: 8192 バイト / x86: 8192 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールドサイズx64x86説明
SignatureDWORD4+0+0ダンプファイルの署名を示す。'PAGE' 等の識別値を格納する。
ValidDumpDWORD4+4+4有効なダンプであることを示す検証値。'DU64' 等を格納する。
MajorVersionDWORD4+8+8ダンプ形式のメジャーバージョンを示す。
MinorVersionDWORD4+12+12ダンプ形式のマイナーバージョンを示す。
DirectoryTableBaseULONGLONG8+16+16ページディレクトリのベースアドレス(CR3)を示す。
PfnDataBaseULONGLONG8+24+24PFN データベースのアドレスを示す。
PsLoadedModuleListULONGLONG8+32+32ロード済みモジュールリストのアドレスを示す。
PsActiveProcessHeadULONGLONG8+40+40アクティブプロセスリスト先頭のアドレスを示す。
MachineImageTypeDWORD4+48+48マシン種別(CPU アーキテクチャ)を示す。
NumberProcessorsDWORD4+52+52プロセッサ数を示す。
BugCheckCodeDWORD4+56+56発生したバグチェック(ストップエラー)のコードを示す。
BugCheckParameter1ULONGLONG8+64+64バグチェックの第1パラメータを示す。
BugCheckParameter2ULONGLONG8+72+72バグチェックの第2パラメータを示す。
BugCheckParameter3ULONGLONG8+80+80バグチェックの第3パラメータを示す。
BugCheckParameter4ULONGLONG8+88+88バグチェックの第4パラメータを示す。
VersionUserCHAR32+96+96OS バージョン文字列を示す ANSI 文字配列。
KdDebuggerDataBlockULONGLONG8+128+128KdDebuggerDataBlock のアドレスを示す。
Anonymous_Anonymous_e__Union704+136+136物理メモリ記述子等を保持する無名共用体。
ContextRecordBYTE3000+840+840クラッシュ時の CPU コンテキストを保持するバイト配列。
ExceptionEXCEPTION_RECORD64152+3840+3840発生した例外情報(EXCEPTION_RECORD64)を保持する。
DumpTypeDWORD4+3992+3992ダンプの種類(フル/カーネル等)を示す。
RequiredDumpSpaceLONGLONG8+4000+4000ダンプ作成に必要なディスク容量(バイト)を示す。
SystemTimeLONGLONG8+4008+4008ダンプ作成時のシステム時刻を示す。
CommentCHAR128+4016+4016ダンプに付与されたコメントを示す ANSI 文字配列。
SystemUpTimeLONGLONG8+4144+4144システムの稼働時間を示す。
MiniDumpFieldsDWORD4+4152+4152ミニダンプに含まれるフィールドのビットマスクを示す。
SecondaryDataStateDWORD4+4156+4156二次データの状態を示す。
ProductTypeDWORD4+4160+4160OS の製品種別を示す。
SuiteMaskDWORD4+4164+4164OS のスイート(エディション)を示すビットマスク。
WriterStatusDWORD4+4168+4168ダンプ書き込みの状態(結果)を示す。
Unused1BYTE1+4172+4172予約(未使用)フィールド。使用しない。
KdSecondaryVersionBYTE1+4173+4173カーネルデバッガの副バージョンを示す。
UnusedBYTE2+4174+4174予約(未使用)フィールド配列。使用しない。
AttributesDUMP_FILE_ATTRIBUTES4+4176+4176ダンプファイルの属性(DUMP_FILE_ATTRIBUTES)を示す。
BootIdDWORD4+4180+4180ブート識別子を示す。
_reserved0BYTE4008+4184+4184予約フィールド配列。使用しない。

共用体: _Anonymous_e__Union x64 704B / x86 704B

フィールドサイズx64x86
PhysicalMemoryBlockPHYSICAL_MEMORY_DESCRIPTOR6432+0+0
PhysicalMemoryBlockBufferBYTE700+0+0

各言語での定義

#include <windows.h>

// EXCEPTION_RECORD64  (x64 152 / x86 152 バイト)
typedef struct EXCEPTION_RECORD64 {
    NTSTATUS ExceptionCode;
    DWORD ExceptionFlags;
    ULONGLONG ExceptionRecord;
    ULONGLONG ExceptionAddress;
    DWORD NumberParameters;
    DWORD __unusedAlignment;
    ULONGLONG ExceptionInformation[15];
} EXCEPTION_RECORD64;

// DUMP_FILE_ATTRIBUTES  (x64 4 / x86 4 バイト)
typedef struct DUMP_FILE_ATTRIBUTES {
    _Anonymous_e__Struct Anonymous;
    DWORD Attributes;
} DUMP_FILE_ATTRIBUTES;

// DUMP_HEADER64  (x64 8192 / x86 8192 バイト)
typedef struct DUMP_HEADER64 {
    DWORD Signature;
    DWORD ValidDump;
    DWORD MajorVersion;
    DWORD MinorVersion;
    ULONGLONG DirectoryTableBase;
    ULONGLONG PfnDataBase;
    ULONGLONG PsLoadedModuleList;
    ULONGLONG PsActiveProcessHead;
    DWORD MachineImageType;
    DWORD NumberProcessors;
    DWORD BugCheckCode;
    ULONGLONG BugCheckParameter1;
    ULONGLONG BugCheckParameter2;
    ULONGLONG BugCheckParameter3;
    ULONGLONG BugCheckParameter4;
    CHAR VersionUser[32];
    ULONGLONG KdDebuggerDataBlock;
    _Anonymous_e__Union Anonymous;
    BYTE ContextRecord[3000];
    EXCEPTION_RECORD64 Exception;
    DWORD DumpType;
    LONGLONG RequiredDumpSpace;
    LONGLONG SystemTime;
    CHAR Comment[128];
    LONGLONG SystemUpTime;
    DWORD MiniDumpFields;
    DWORD SecondaryDataState;
    DWORD ProductType;
    DWORD SuiteMask;
    DWORD WriterStatus;
    BYTE Unused1;
    BYTE KdSecondaryVersion;
    BYTE Unused[2];
    DUMP_FILE_ATTRIBUTES Attributes;
    DWORD BootId;
    BYTE _reserved0[4008];
} DUMP_HEADER64;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct EXCEPTION_RECORD64
{
    public int ExceptionCode;
    public uint ExceptionFlags;
    public ulong ExceptionRecord;
    public ulong ExceptionAddress;
    public uint NumberParameters;
    public uint __unusedAlignment;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 15)] public ulong[] ExceptionInformation;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DUMP_FILE_ATTRIBUTES
{
    public _Anonymous_e__Struct Anonymous;
    public uint Attributes;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DUMP_HEADER64
{
    public uint Signature;
    public uint ValidDump;
    public uint MajorVersion;
    public uint MinorVersion;
    public ulong DirectoryTableBase;
    public ulong PfnDataBase;
    public ulong PsLoadedModuleList;
    public ulong PsActiveProcessHead;
    public uint MachineImageType;
    public uint NumberProcessors;
    public uint BugCheckCode;
    public ulong BugCheckParameter1;
    public ulong BugCheckParameter2;
    public ulong BugCheckParameter3;
    public ulong BugCheckParameter4;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 32)] public sbyte[] VersionUser;
    public ulong KdDebuggerDataBlock;
    public _Anonymous_e__Union Anonymous;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 3000)] public byte[] ContextRecord;
    public EXCEPTION_RECORD64 Exception;
    public uint DumpType;
    public long RequiredDumpSpace;
    public long SystemTime;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 128)] public sbyte[] Comment;
    public long SystemUpTime;
    public uint MiniDumpFields;
    public uint SecondaryDataState;
    public uint ProductType;
    public uint SuiteMask;
    public uint WriterStatus;
    public byte Unused1;
    public byte KdSecondaryVersion;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)] public byte[] Unused;
    public DUMP_FILE_ATTRIBUTES Attributes;
    public uint BootId;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4008)] public byte[] _reserved0;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure EXCEPTION_RECORD64
    Public ExceptionCode As Integer
    Public ExceptionFlags As UInteger
    Public ExceptionRecord As ULong
    Public ExceptionAddress As ULong
    Public NumberParameters As UInteger
    Public __unusedAlignment As UInteger
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=15)> Public ExceptionInformation() As ULong
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DUMP_FILE_ATTRIBUTES
    Public Anonymous As _Anonymous_e__Struct
    Public Attributes As UInteger
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DUMP_HEADER64
    Public Signature As UInteger
    Public ValidDump As UInteger
    Public MajorVersion As UInteger
    Public MinorVersion As UInteger
    Public DirectoryTableBase As ULong
    Public PfnDataBase As ULong
    Public PsLoadedModuleList As ULong
    Public PsActiveProcessHead As ULong
    Public MachineImageType As UInteger
    Public NumberProcessors As UInteger
    Public BugCheckCode As UInteger
    Public BugCheckParameter1 As ULong
    Public BugCheckParameter2 As ULong
    Public BugCheckParameter3 As ULong
    Public BugCheckParameter4 As ULong
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=32)> Public VersionUser() As SByte
    Public KdDebuggerDataBlock As ULong
    Public Anonymous As _Anonymous_e__Union
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=3000)> Public ContextRecord() As Byte
    Public Exception As EXCEPTION_RECORD64
    Public DumpType As UInteger
    Public RequiredDumpSpace As Long
    Public SystemTime As Long
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=128)> Public Comment() As SByte
    Public SystemUpTime As Long
    Public MiniDumpFields As UInteger
    Public SecondaryDataState As UInteger
    Public ProductType As UInteger
    Public SuiteMask As UInteger
    Public WriterStatus As UInteger
    Public Unused1 As Byte
    Public KdSecondaryVersion As Byte
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=2)> Public Unused() As Byte
    Public Attributes As DUMP_FILE_ATTRIBUTES
    Public BootId As UInteger
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=4008)> Public _reserved0() As Byte
End Structure
import ctypes
from ctypes import wintypes

class EXCEPTION_RECORD64(ctypes.Structure):
    _fields_ = [
        ("ExceptionCode", ctypes.c_int),
        ("ExceptionFlags", wintypes.DWORD),
        ("ExceptionRecord", ctypes.c_ulonglong),
        ("ExceptionAddress", ctypes.c_ulonglong),
        ("NumberParameters", wintypes.DWORD),
        ("__unusedAlignment", wintypes.DWORD),
        ("ExceptionInformation", ctypes.c_ulonglong * 15),
    ]

class DUMP_FILE_ATTRIBUTES(ctypes.Structure):
    _fields_ = [
        ("Anonymous", _Anonymous_e__Struct),
        ("Attributes", wintypes.DWORD),
    ]

class DUMP_HEADER64(ctypes.Structure):
    _fields_ = [
        ("Signature", wintypes.DWORD),
        ("ValidDump", wintypes.DWORD),
        ("MajorVersion", wintypes.DWORD),
        ("MinorVersion", wintypes.DWORD),
        ("DirectoryTableBase", ctypes.c_ulonglong),
        ("PfnDataBase", ctypes.c_ulonglong),
        ("PsLoadedModuleList", ctypes.c_ulonglong),
        ("PsActiveProcessHead", ctypes.c_ulonglong),
        ("MachineImageType", wintypes.DWORD),
        ("NumberProcessors", wintypes.DWORD),
        ("BugCheckCode", wintypes.DWORD),
        ("BugCheckParameter1", ctypes.c_ulonglong),
        ("BugCheckParameter2", ctypes.c_ulonglong),
        ("BugCheckParameter3", ctypes.c_ulonglong),
        ("BugCheckParameter4", ctypes.c_ulonglong),
        ("VersionUser", ctypes.c_byte * 32),
        ("KdDebuggerDataBlock", ctypes.c_ulonglong),
        ("Anonymous", _Anonymous_e__Union),
        ("ContextRecord", ctypes.c_ubyte * 3000),
        ("Exception", EXCEPTION_RECORD64),
        ("DumpType", wintypes.DWORD),
        ("RequiredDumpSpace", ctypes.c_longlong),
        ("SystemTime", ctypes.c_longlong),
        ("Comment", ctypes.c_byte * 128),
        ("SystemUpTime", ctypes.c_longlong),
        ("MiniDumpFields", wintypes.DWORD),
        ("SecondaryDataState", wintypes.DWORD),
        ("ProductType", wintypes.DWORD),
        ("SuiteMask", wintypes.DWORD),
        ("WriterStatus", wintypes.DWORD),
        ("Unused1", ctypes.c_ubyte),
        ("KdSecondaryVersion", ctypes.c_ubyte),
        ("Unused", ctypes.c_ubyte * 2),
        ("Attributes", DUMP_FILE_ATTRIBUTES),
        ("BootId", wintypes.DWORD),
        ("_reserved0", ctypes.c_ubyte * 4008),
    ]
#[repr(C)]
pub struct EXCEPTION_RECORD64 {
    pub ExceptionCode: i32,
    pub ExceptionFlags: u32,
    pub ExceptionRecord: u64,
    pub ExceptionAddress: u64,
    pub NumberParameters: u32,
    pub __unusedAlignment: u32,
    pub ExceptionInformation: [u64; 15],
}

#[repr(C)]
pub struct DUMP_FILE_ATTRIBUTES {
    pub Anonymous: _Anonymous_e__Struct,
    pub Attributes: u32,
}

#[repr(C)]
pub struct DUMP_HEADER64 {
    pub Signature: u32,
    pub ValidDump: u32,
    pub MajorVersion: u32,
    pub MinorVersion: u32,
    pub DirectoryTableBase: u64,
    pub PfnDataBase: u64,
    pub PsLoadedModuleList: u64,
    pub PsActiveProcessHead: u64,
    pub MachineImageType: u32,
    pub NumberProcessors: u32,
    pub BugCheckCode: u32,
    pub BugCheckParameter1: u64,
    pub BugCheckParameter2: u64,
    pub BugCheckParameter3: u64,
    pub BugCheckParameter4: u64,
    pub VersionUser: [i8; 32],
    pub KdDebuggerDataBlock: u64,
    pub Anonymous: _Anonymous_e__Union,
    pub ContextRecord: [u8; 3000],
    pub Exception: EXCEPTION_RECORD64,
    pub DumpType: u32,
    pub RequiredDumpSpace: i64,
    pub SystemTime: i64,
    pub Comment: [i8; 128],
    pub SystemUpTime: i64,
    pub MiniDumpFields: u32,
    pub SecondaryDataState: u32,
    pub ProductType: u32,
    pub SuiteMask: u32,
    pub WriterStatus: u32,
    pub Unused1: u8,
    pub KdSecondaryVersion: u8,
    pub Unused: [u8; 2],
    pub Attributes: DUMP_FILE_ATTRIBUTES,
    pub BootId: u32,
    pub _reserved0: [u8; 4008],
}
import "golang.org/x/sys/windows"

type EXCEPTION_RECORD64 struct {
	ExceptionCode int32
	ExceptionFlags uint32
	ExceptionRecord uint64
	ExceptionAddress uint64
	NumberParameters uint32
	__unusedAlignment uint32
	ExceptionInformation [15]uint64
}

type DUMP_FILE_ATTRIBUTES struct {
	Anonymous _Anonymous_e__Struct
	Attributes uint32
}

type DUMP_HEADER64 struct {
	Signature uint32
	ValidDump uint32
	MajorVersion uint32
	MinorVersion uint32
	DirectoryTableBase uint64
	PfnDataBase uint64
	PsLoadedModuleList uint64
	PsActiveProcessHead uint64
	MachineImageType uint32
	NumberProcessors uint32
	BugCheckCode uint32
	BugCheckParameter1 uint64
	BugCheckParameter2 uint64
	BugCheckParameter3 uint64
	BugCheckParameter4 uint64
	VersionUser [32]int8
	KdDebuggerDataBlock uint64
	Anonymous _Anonymous_e__Union
	ContextRecord [3000]byte
	Exception EXCEPTION_RECORD64
	DumpType uint32
	RequiredDumpSpace int64
	SystemTime int64
	Comment [128]int8
	SystemUpTime int64
	MiniDumpFields uint32
	SecondaryDataState uint32
	ProductType uint32
	SuiteMask uint32
	WriterStatus uint32
	Unused1 byte
	KdSecondaryVersion byte
	Unused [2]byte
	Attributes DUMP_FILE_ATTRIBUTES
	BootId uint32
	_reserved0 [4008]byte
}
type
  EXCEPTION_RECORD64 = record
    ExceptionCode: Integer;
    ExceptionFlags: DWORD;
    ExceptionRecord: UInt64;
    ExceptionAddress: UInt64;
    NumberParameters: DWORD;
    __unusedAlignment: DWORD;
    ExceptionInformation: array[0..14] of UInt64;
  end;

  DUMP_FILE_ATTRIBUTES = record
    Anonymous: _Anonymous_e__Struct;
    Attributes: DWORD;
  end;

  DUMP_HEADER64 = record
    Signature: DWORD;
    ValidDump: DWORD;
    MajorVersion: DWORD;
    MinorVersion: DWORD;
    DirectoryTableBase: UInt64;
    PfnDataBase: UInt64;
    PsLoadedModuleList: UInt64;
    PsActiveProcessHead: UInt64;
    MachineImageType: DWORD;
    NumberProcessors: DWORD;
    BugCheckCode: DWORD;
    BugCheckParameter1: UInt64;
    BugCheckParameter2: UInt64;
    BugCheckParameter3: UInt64;
    BugCheckParameter4: UInt64;
    VersionUser: array[0..31] of Shortint;
    KdDebuggerDataBlock: UInt64;
    Anonymous: _Anonymous_e__Union;
    ContextRecord: array[0..2999] of Byte;
    Exception: EXCEPTION_RECORD64;
    DumpType: DWORD;
    RequiredDumpSpace: Int64;
    SystemTime: Int64;
    Comment: array[0..127] of Shortint;
    SystemUpTime: Int64;
    MiniDumpFields: DWORD;
    SecondaryDataState: DWORD;
    ProductType: DWORD;
    SuiteMask: DWORD;
    WriterStatus: DWORD;
    Unused1: Byte;
    KdSecondaryVersion: Byte;
    Unused: array[0..1] of Byte;
    Attributes: DUMP_FILE_ATTRIBUTES;
    BootId: DWORD;
    _reserved0: array[0..4007] of Byte;
  end;
const EXCEPTION_RECORD64 = extern struct {
    ExceptionCode: i32,
    ExceptionFlags: u32,
    ExceptionRecord: u64,
    ExceptionAddress: u64,
    NumberParameters: u32,
    __unusedAlignment: u32,
    ExceptionInformation: [15]u64,
};

const DUMP_FILE_ATTRIBUTES = extern struct {
    Anonymous: _Anonymous_e__Struct,
    Attributes: u32,
};

const DUMP_HEADER64 = extern struct {
    Signature: u32,
    ValidDump: u32,
    MajorVersion: u32,
    MinorVersion: u32,
    DirectoryTableBase: u64,
    PfnDataBase: u64,
    PsLoadedModuleList: u64,
    PsActiveProcessHead: u64,
    MachineImageType: u32,
    NumberProcessors: u32,
    BugCheckCode: u32,
    BugCheckParameter1: u64,
    BugCheckParameter2: u64,
    BugCheckParameter3: u64,
    BugCheckParameter4: u64,
    VersionUser: [32]i8,
    KdDebuggerDataBlock: u64,
    Anonymous: _Anonymous_e__Union,
    ContextRecord: [3000]u8,
    Exception: EXCEPTION_RECORD64,
    DumpType: u32,
    RequiredDumpSpace: i64,
    SystemTime: i64,
    Comment: [128]i8,
    SystemUpTime: i64,
    MiniDumpFields: u32,
    SecondaryDataState: u32,
    ProductType: u32,
    SuiteMask: u32,
    WriterStatus: u32,
    Unused1: u8,
    KdSecondaryVersion: u8,
    Unused: [2]u8,
    Attributes: DUMP_FILE_ATTRIBUTES,
    BootId: u32,
    _reserved0: [4008]u8,
};
type
  EXCEPTION_RECORD64 {.bycopy.} = object
    ExceptionCode: int32
    ExceptionFlags: uint32
    ExceptionRecord: uint64
    ExceptionAddress: uint64
    NumberParameters: uint32
    __unusedAlignment: uint32
    ExceptionInformation: array[15, uint64]

  DUMP_FILE_ATTRIBUTES {.bycopy.} = object
    Anonymous: _Anonymous_e__Struct
    Attributes: uint32

  DUMP_HEADER64 {.bycopy.} = object
    Signature: uint32
    ValidDump: uint32
    MajorVersion: uint32
    MinorVersion: uint32
    DirectoryTableBase: uint64
    PfnDataBase: uint64
    PsLoadedModuleList: uint64
    PsActiveProcessHead: uint64
    MachineImageType: uint32
    NumberProcessors: uint32
    BugCheckCode: uint32
    BugCheckParameter1: uint64
    BugCheckParameter2: uint64
    BugCheckParameter3: uint64
    BugCheckParameter4: uint64
    VersionUser: array[32, int8]
    KdDebuggerDataBlock: uint64
    Anonymous: _Anonymous_e__Union
    ContextRecord: array[3000, uint8]
    Exception: EXCEPTION_RECORD64
    DumpType: uint32
    RequiredDumpSpace: int64
    SystemTime: int64
    Comment: array[128, int8]
    SystemUpTime: int64
    MiniDumpFields: uint32
    SecondaryDataState: uint32
    ProductType: uint32
    SuiteMask: uint32
    WriterStatus: uint32
    Unused1: uint8
    KdSecondaryVersion: uint8
    Unused: array[2, uint8]
    Attributes: DUMP_FILE_ATTRIBUTES
    BootId: uint32
    _reserved0: array[4008, uint8]
struct EXCEPTION_RECORD64
{
    int ExceptionCode;
    uint ExceptionFlags;
    ulong ExceptionRecord;
    ulong ExceptionAddress;
    uint NumberParameters;
    uint __unusedAlignment;
    ulong[15] ExceptionInformation;
}

struct DUMP_FILE_ATTRIBUTES
{
    _Anonymous_e__Struct Anonymous;
    uint Attributes;
}

struct DUMP_HEADER64
{
    uint Signature;
    uint ValidDump;
    uint MajorVersion;
    uint MinorVersion;
    ulong DirectoryTableBase;
    ulong PfnDataBase;
    ulong PsLoadedModuleList;
    ulong PsActiveProcessHead;
    uint MachineImageType;
    uint NumberProcessors;
    uint BugCheckCode;
    ulong BugCheckParameter1;
    ulong BugCheckParameter2;
    ulong BugCheckParameter3;
    ulong BugCheckParameter4;
    byte[32] VersionUser;
    ulong KdDebuggerDataBlock;
    _Anonymous_e__Union Anonymous;
    ubyte[3000] ContextRecord;
    EXCEPTION_RECORD64 Exception;
    uint DumpType;
    long RequiredDumpSpace;
    long SystemTime;
    byte[128] Comment;
    long SystemUpTime;
    uint MiniDumpFields;
    uint SecondaryDataState;
    uint ProductType;
    uint SuiteMask;
    uint WriterStatus;
    ubyte Unused1;
    ubyte KdSecondaryVersion;
    ubyte[2] Unused;
    DUMP_FILE_ATTRIBUTES Attributes;
    uint BootId;
    ubyte[4008] _reserved0;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; DUMP_HEADER64 サイズ: 8192 バイト(x64)
dim st, 2048    ; 4byte整数×2048(構造体サイズ 8192 / 4 切り上げ)
; Signature : DWORD (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; ValidDump : DWORD (+4, 4byte)  st.1 = 値  /  値 = st.1   (lpoke/lpeek も可)
; MajorVersion : DWORD (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; MinorVersion : DWORD (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; DirectoryTableBase : ULONGLONG (+16, 8byte)  qpoke st,16,値 / qpeek(st,16)  ※IronHSPのみ。3.7/3.8は lpoke st,16,下位 : lpoke st,20,上位
; PfnDataBase : ULONGLONG (+24, 8byte)  qpoke st,24,値 / qpeek(st,24)  ※IronHSPのみ。3.7/3.8は lpoke st,24,下位 : lpoke st,28,上位
; PsLoadedModuleList : ULONGLONG (+32, 8byte)  qpoke st,32,値 / qpeek(st,32)  ※IronHSPのみ。3.7/3.8は lpoke st,32,下位 : lpoke st,36,上位
; PsActiveProcessHead : ULONGLONG (+40, 8byte)  qpoke st,40,値 / qpeek(st,40)  ※IronHSPのみ。3.7/3.8は lpoke st,40,下位 : lpoke st,44,上位
; MachineImageType : DWORD (+48, 4byte)  st.12 = 値  /  値 = st.12   (lpoke/lpeek も可)
; NumberProcessors : DWORD (+52, 4byte)  st.13 = 値  /  値 = st.13   (lpoke/lpeek も可)
; BugCheckCode : DWORD (+56, 4byte)  st.14 = 値  /  値 = st.14   (lpoke/lpeek も可)
; BugCheckParameter1 : ULONGLONG (+64, 8byte)  qpoke st,64,値 / qpeek(st,64)  ※IronHSPのみ。3.7/3.8は lpoke st,64,下位 : lpoke st,68,上位
; BugCheckParameter2 : ULONGLONG (+72, 8byte)  qpoke st,72,値 / qpeek(st,72)  ※IronHSPのみ。3.7/3.8は lpoke st,72,下位 : lpoke st,76,上位
; BugCheckParameter3 : ULONGLONG (+80, 8byte)  qpoke st,80,値 / qpeek(st,80)  ※IronHSPのみ。3.7/3.8は lpoke st,80,下位 : lpoke st,84,上位
; BugCheckParameter4 : ULONGLONG (+88, 8byte)  qpoke st,88,値 / qpeek(st,88)  ※IronHSPのみ。3.7/3.8は lpoke st,88,下位 : lpoke st,92,上位
; VersionUser : CHAR (+96, 32byte)  varptr(st)+96 を基点に操作(32byte:入れ子/配列)
; KdDebuggerDataBlock : ULONGLONG (+128, 8byte)  qpoke st,128,値 / qpeek(st,128)  ※IronHSPのみ。3.7/3.8は lpoke st,128,下位 : lpoke st,132,上位
; Anonymous : _Anonymous_e__Union (+136, 704byte)  varptr(st)+136 を基点に操作(704byte:入れ子/配列)
; ContextRecord : BYTE (+840, 3000byte)  varptr(st)+840 を基点に操作(3000byte:入れ子/配列)
; Exception : EXCEPTION_RECORD64 (+3840, 152byte)  varptr(st)+3840 を基点に操作(152byte:入れ子/配列)
; DumpType : DWORD (+3992, 4byte)  st.998 = 値  /  値 = st.998   (lpoke/lpeek も可)
; RequiredDumpSpace : LONGLONG (+4000, 8byte)  qpoke st,4000,値 / qpeek(st,4000)  ※IronHSPのみ。3.7/3.8は lpoke st,4000,下位 : lpoke st,4004,上位
; SystemTime : LONGLONG (+4008, 8byte)  qpoke st,4008,値 / qpeek(st,4008)  ※IronHSPのみ。3.7/3.8は lpoke st,4008,下位 : lpoke st,4012,上位
; Comment : CHAR (+4016, 128byte)  varptr(st)+4016 を基点に操作(128byte:入れ子/配列)
; SystemUpTime : LONGLONG (+4144, 8byte)  qpoke st,4144,値 / qpeek(st,4144)  ※IronHSPのみ。3.7/3.8は lpoke st,4144,下位 : lpoke st,4148,上位
; MiniDumpFields : DWORD (+4152, 4byte)  st.1038 = 値  /  値 = st.1038   (lpoke/lpeek も可)
; SecondaryDataState : DWORD (+4156, 4byte)  st.1039 = 値  /  値 = st.1039   (lpoke/lpeek も可)
; ProductType : DWORD (+4160, 4byte)  st.1040 = 値  /  値 = st.1040   (lpoke/lpeek も可)
; SuiteMask : DWORD (+4164, 4byte)  st.1041 = 値  /  値 = st.1041   (lpoke/lpeek も可)
; WriterStatus : DWORD (+4168, 4byte)  st.1042 = 値  /  値 = st.1042   (lpoke/lpeek も可)
; Unused1 : BYTE (+4172, 1byte)  poke st,4172,値  /  値 = peek(st,4172)
; KdSecondaryVersion : BYTE (+4173, 1byte)  poke st,4173,値  /  値 = peek(st,4173)
; Unused : BYTE (+4174, 2byte)  varptr(st)+4174 を基点に操作(2byte:入れ子/配列)
; Attributes : DUMP_FILE_ATTRIBUTES (+4176, 4byte)  varptr(st)+4176 を基点に操作(4byte:入れ子/配列)
; BootId : DWORD (+4180, 4byte)  st.1045 = 値  /  値 = st.1045   (lpoke/lpeek も可)
; _reserved0 : BYTE (+4184, 4008byte)  varptr(st)+4184 を基点に操作(4008byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global EXCEPTION_RECORD64
    #field int ExceptionCode
    #field int ExceptionFlags
    #field int64 ExceptionRecord
    #field int64 ExceptionAddress
    #field int NumberParameters
    #field int __unusedAlignment
    #field int64 ExceptionInformation 15
#endstruct

#defstruct global DUMP_HEADER64
    #field int Signature
    #field int ValidDump
    #field int MajorVersion
    #field int MinorVersion
    #field int64 DirectoryTableBase
    #field int64 PfnDataBase
    #field int64 PsLoadedModuleList
    #field int64 PsActiveProcessHead
    #field int MachineImageType
    #field int NumberProcessors
    #field int BugCheckCode
    #field int64 BugCheckParameter1
    #field int64 BugCheckParameter2
    #field int64 BugCheckParameter3
    #field int64 BugCheckParameter4
    #field byte VersionUser 32
    #field int64 KdDebuggerDataBlock
    #field byte Anonymous 704
    #field byte ContextRecord 3000
    #field EXCEPTION_RECORD64 Exception
    #field int DumpType
    #field int64 RequiredDumpSpace
    #field int64 SystemTime
    #field byte Comment 128
    #field int64 SystemUpTime
    #field int MiniDumpFields
    #field int SecondaryDataState
    #field int ProductType
    #field int SuiteMask
    #field int WriterStatus
    #field byte Unused1
    #field byte KdSecondaryVersion
    #field byte Unused 2
    #field byte Attributes 4
    #field int BootId
    #field byte _reserved0 4008
#endstruct

stdim st, DUMP_HEADER64        ; NSTRUCT 変数を確保
st->Signature = 100
mes "Signature=" + st->Signature
; ※union フィールドは byte 列で確保(NSTRUCT は union 非対応)。必要に応じ手動でアクセス。