ホーム › System.Diagnostics.Debug › DUMP_HEADER64
DUMP_HEADER64
構造体サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。
フィールド
| フィールド | 型 | サイズ | x64 | x86 | 説明 |
|---|---|---|---|---|---|
| Signature | DWORD | 4 | +0 | +0 | ダンプファイルの署名を示す。'PAGE' 等の識別値を格納する。 |
| ValidDump | DWORD | 4 | +4 | +4 | 有効なダンプであることを示す検証値。'DU64' 等を格納する。 |
| MajorVersion | DWORD | 4 | +8 | +8 | ダンプ形式のメジャーバージョンを示す。 |
| MinorVersion | DWORD | 4 | +12 | +12 | ダンプ形式のマイナーバージョンを示す。 |
| DirectoryTableBase | ULONGLONG | 8 | +16 | +16 | ページディレクトリのベースアドレス(CR3)を示す。 |
| PfnDataBase | ULONGLONG | 8 | +24 | +24 | PFN データベースのアドレスを示す。 |
| PsLoadedModuleList | ULONGLONG | 8 | +32 | +32 | ロード済みモジュールリストのアドレスを示す。 |
| PsActiveProcessHead | ULONGLONG | 8 | +40 | +40 | アクティブプロセスリスト先頭のアドレスを示す。 |
| MachineImageType | DWORD | 4 | +48 | +48 | マシン種別(CPU アーキテクチャ)を示す。 |
| NumberProcessors | DWORD | 4 | +52 | +52 | プロセッサ数を示す。 |
| BugCheckCode | DWORD | 4 | +56 | +56 | 発生したバグチェック(ストップエラー)のコードを示す。 |
| BugCheckParameter1 | ULONGLONG | 8 | +64 | +64 | バグチェックの第1パラメータを示す。 |
| BugCheckParameter2 | ULONGLONG | 8 | +72 | +72 | バグチェックの第2パラメータを示す。 |
| BugCheckParameter3 | ULONGLONG | 8 | +80 | +80 | バグチェックの第3パラメータを示す。 |
| BugCheckParameter4 | ULONGLONG | 8 | +88 | +88 | バグチェックの第4パラメータを示す。 |
| VersionUser | CHAR | 32 | +96 | +96 | OS バージョン文字列を示す ANSI 文字配列。 |
| KdDebuggerDataBlock | ULONGLONG | 8 | +128 | +128 | KdDebuggerDataBlock のアドレスを示す。 |
| Anonymous | _Anonymous_e__Union | 704 | +136 | +136 | 物理メモリ記述子等を保持する無名共用体。 |
| ContextRecord | BYTE | 3000 | +840 | +840 | クラッシュ時の CPU コンテキストを保持するバイト配列。 |
| Exception | EXCEPTION_RECORD64 | 152 | +3840 | +3840 | 発生した例外情報(EXCEPTION_RECORD64)を保持する。 |
| DumpType | DWORD | 4 | +3992 | +3992 | ダンプの種類(フル/カーネル等)を示す。 |
| RequiredDumpSpace | LONGLONG | 8 | +4000 | +4000 | ダンプ作成に必要なディスク容量(バイト)を示す。 |
| SystemTime | LONGLONG | 8 | +4008 | +4008 | ダンプ作成時のシステム時刻を示す。 |
| Comment | CHAR | 128 | +4016 | +4016 | ダンプに付与されたコメントを示す ANSI 文字配列。 |
| SystemUpTime | LONGLONG | 8 | +4144 | +4144 | システムの稼働時間を示す。 |
| MiniDumpFields | DWORD | 4 | +4152 | +4152 | ミニダンプに含まれるフィールドのビットマスクを示す。 |
| SecondaryDataState | DWORD | 4 | +4156 | +4156 | 二次データの状態を示す。 |
| ProductType | DWORD | 4 | +4160 | +4160 | OS の製品種別を示す。 |
| SuiteMask | DWORD | 4 | +4164 | +4164 | OS のスイート(エディション)を示すビットマスク。 |
| WriterStatus | DWORD | 4 | +4168 | +4168 | ダンプ書き込みの状態(結果)を示す。 |
| Unused1 | BYTE | 1 | +4172 | +4172 | 予約(未使用)フィールド。使用しない。 |
| KdSecondaryVersion | BYTE | 1 | +4173 | +4173 | カーネルデバッガの副バージョンを示す。 |
| Unused | BYTE | 2 | +4174 | +4174 | 予約(未使用)フィールド配列。使用しない。 |
| Attributes | DUMP_FILE_ATTRIBUTES | 4 | +4176 | +4176 | ダンプファイルの属性(DUMP_FILE_ATTRIBUTES)を示す。 |
| BootId | DWORD | 4 | +4180 | +4180 | ブート識別子を示す。 |
| _reserved0 | BYTE | 4008 | +4184 | +4184 | 予約フィールド配列。使用しない。 |
共用体: _Anonymous_e__Union x64 704B / x86 704B
| フィールド | 型 | サイズ | x64 | x86 |
|---|---|---|---|---|
| PhysicalMemoryBlock | PHYSICAL_MEMORY_DESCRIPTOR64 | 32 | +0 | +0 |
| PhysicalMemoryBlockBuffer | BYTE | 700 | +0 | +0 |
各言語での定義
#include <windows.h>
// EXCEPTION_RECORD64 (x64 152 / x86 152 バイト)
typedef struct EXCEPTION_RECORD64 {
NTSTATUS ExceptionCode;
DWORD ExceptionFlags;
ULONGLONG ExceptionRecord;
ULONGLONG ExceptionAddress;
DWORD NumberParameters;
DWORD __unusedAlignment;
ULONGLONG ExceptionInformation[15];
} EXCEPTION_RECORD64;
// DUMP_FILE_ATTRIBUTES (x64 4 / x86 4 バイト)
typedef struct DUMP_FILE_ATTRIBUTES {
_Anonymous_e__Struct Anonymous;
DWORD Attributes;
} DUMP_FILE_ATTRIBUTES;
// DUMP_HEADER64 (x64 8192 / x86 8192 バイト)
typedef struct DUMP_HEADER64 {
DWORD Signature;
DWORD ValidDump;
DWORD MajorVersion;
DWORD MinorVersion;
ULONGLONG DirectoryTableBase;
ULONGLONG PfnDataBase;
ULONGLONG PsLoadedModuleList;
ULONGLONG PsActiveProcessHead;
DWORD MachineImageType;
DWORD NumberProcessors;
DWORD BugCheckCode;
ULONGLONG BugCheckParameter1;
ULONGLONG BugCheckParameter2;
ULONGLONG BugCheckParameter3;
ULONGLONG BugCheckParameter4;
CHAR VersionUser[32];
ULONGLONG KdDebuggerDataBlock;
_Anonymous_e__Union Anonymous;
BYTE ContextRecord[3000];
EXCEPTION_RECORD64 Exception;
DWORD DumpType;
LONGLONG RequiredDumpSpace;
LONGLONG SystemTime;
CHAR Comment[128];
LONGLONG SystemUpTime;
DWORD MiniDumpFields;
DWORD SecondaryDataState;
DWORD ProductType;
DWORD SuiteMask;
DWORD WriterStatus;
BYTE Unused1;
BYTE KdSecondaryVersion;
BYTE Unused[2];
DUMP_FILE_ATTRIBUTES Attributes;
DWORD BootId;
BYTE _reserved0[4008];
} DUMP_HEADER64;using System;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct EXCEPTION_RECORD64
{
public int ExceptionCode;
public uint ExceptionFlags;
public ulong ExceptionRecord;
public ulong ExceptionAddress;
public uint NumberParameters;
public uint __unusedAlignment;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 15)] public ulong[] ExceptionInformation;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DUMP_FILE_ATTRIBUTES
{
public _Anonymous_e__Struct Anonymous;
public uint Attributes;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct DUMP_HEADER64
{
public uint Signature;
public uint ValidDump;
public uint MajorVersion;
public uint MinorVersion;
public ulong DirectoryTableBase;
public ulong PfnDataBase;
public ulong PsLoadedModuleList;
public ulong PsActiveProcessHead;
public uint MachineImageType;
public uint NumberProcessors;
public uint BugCheckCode;
public ulong BugCheckParameter1;
public ulong BugCheckParameter2;
public ulong BugCheckParameter3;
public ulong BugCheckParameter4;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 32)] public sbyte[] VersionUser;
public ulong KdDebuggerDataBlock;
public _Anonymous_e__Union Anonymous;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 3000)] public byte[] ContextRecord;
public EXCEPTION_RECORD64 Exception;
public uint DumpType;
public long RequiredDumpSpace;
public long SystemTime;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 128)] public sbyte[] Comment;
public long SystemUpTime;
public uint MiniDumpFields;
public uint SecondaryDataState;
public uint ProductType;
public uint SuiteMask;
public uint WriterStatus;
public byte Unused1;
public byte KdSecondaryVersion;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)] public byte[] Unused;
public DUMP_FILE_ATTRIBUTES Attributes;
public uint BootId;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 4008)] public byte[] _reserved0;
}Imports System.Runtime.InteropServices
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure EXCEPTION_RECORD64
Public ExceptionCode As Integer
Public ExceptionFlags As UInteger
Public ExceptionRecord As ULong
Public ExceptionAddress As ULong
Public NumberParameters As UInteger
Public __unusedAlignment As UInteger
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=15)> Public ExceptionInformation() As ULong
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DUMP_FILE_ATTRIBUTES
Public Anonymous As _Anonymous_e__Struct
Public Attributes As UInteger
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure DUMP_HEADER64
Public Signature As UInteger
Public ValidDump As UInteger
Public MajorVersion As UInteger
Public MinorVersion As UInteger
Public DirectoryTableBase As ULong
Public PfnDataBase As ULong
Public PsLoadedModuleList As ULong
Public PsActiveProcessHead As ULong
Public MachineImageType As UInteger
Public NumberProcessors As UInteger
Public BugCheckCode As UInteger
Public BugCheckParameter1 As ULong
Public BugCheckParameter2 As ULong
Public BugCheckParameter3 As ULong
Public BugCheckParameter4 As ULong
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=32)> Public VersionUser() As SByte
Public KdDebuggerDataBlock As ULong
Public Anonymous As _Anonymous_e__Union
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=3000)> Public ContextRecord() As Byte
Public Exception As EXCEPTION_RECORD64
Public DumpType As UInteger
Public RequiredDumpSpace As Long
Public SystemTime As Long
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=128)> Public Comment() As SByte
Public SystemUpTime As Long
Public MiniDumpFields As UInteger
Public SecondaryDataState As UInteger
Public ProductType As UInteger
Public SuiteMask As UInteger
Public WriterStatus As UInteger
Public Unused1 As Byte
Public KdSecondaryVersion As Byte
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=2)> Public Unused() As Byte
Public Attributes As DUMP_FILE_ATTRIBUTES
Public BootId As UInteger
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=4008)> Public _reserved0() As Byte
End Structureimport ctypes
from ctypes import wintypes
class EXCEPTION_RECORD64(ctypes.Structure):
_fields_ = [
("ExceptionCode", ctypes.c_int),
("ExceptionFlags", wintypes.DWORD),
("ExceptionRecord", ctypes.c_ulonglong),
("ExceptionAddress", ctypes.c_ulonglong),
("NumberParameters", wintypes.DWORD),
("__unusedAlignment", wintypes.DWORD),
("ExceptionInformation", ctypes.c_ulonglong * 15),
]
class DUMP_FILE_ATTRIBUTES(ctypes.Structure):
_fields_ = [
("Anonymous", _Anonymous_e__Struct),
("Attributes", wintypes.DWORD),
]
class DUMP_HEADER64(ctypes.Structure):
_fields_ = [
("Signature", wintypes.DWORD),
("ValidDump", wintypes.DWORD),
("MajorVersion", wintypes.DWORD),
("MinorVersion", wintypes.DWORD),
("DirectoryTableBase", ctypes.c_ulonglong),
("PfnDataBase", ctypes.c_ulonglong),
("PsLoadedModuleList", ctypes.c_ulonglong),
("PsActiveProcessHead", ctypes.c_ulonglong),
("MachineImageType", wintypes.DWORD),
("NumberProcessors", wintypes.DWORD),
("BugCheckCode", wintypes.DWORD),
("BugCheckParameter1", ctypes.c_ulonglong),
("BugCheckParameter2", ctypes.c_ulonglong),
("BugCheckParameter3", ctypes.c_ulonglong),
("BugCheckParameter4", ctypes.c_ulonglong),
("VersionUser", ctypes.c_byte * 32),
("KdDebuggerDataBlock", ctypes.c_ulonglong),
("Anonymous", _Anonymous_e__Union),
("ContextRecord", ctypes.c_ubyte * 3000),
("Exception", EXCEPTION_RECORD64),
("DumpType", wintypes.DWORD),
("RequiredDumpSpace", ctypes.c_longlong),
("SystemTime", ctypes.c_longlong),
("Comment", ctypes.c_byte * 128),
("SystemUpTime", ctypes.c_longlong),
("MiniDumpFields", wintypes.DWORD),
("SecondaryDataState", wintypes.DWORD),
("ProductType", wintypes.DWORD),
("SuiteMask", wintypes.DWORD),
("WriterStatus", wintypes.DWORD),
("Unused1", ctypes.c_ubyte),
("KdSecondaryVersion", ctypes.c_ubyte),
("Unused", ctypes.c_ubyte * 2),
("Attributes", DUMP_FILE_ATTRIBUTES),
("BootId", wintypes.DWORD),
("_reserved0", ctypes.c_ubyte * 4008),
]#[repr(C)]
pub struct EXCEPTION_RECORD64 {
pub ExceptionCode: i32,
pub ExceptionFlags: u32,
pub ExceptionRecord: u64,
pub ExceptionAddress: u64,
pub NumberParameters: u32,
pub __unusedAlignment: u32,
pub ExceptionInformation: [u64; 15],
}
#[repr(C)]
pub struct DUMP_FILE_ATTRIBUTES {
pub Anonymous: _Anonymous_e__Struct,
pub Attributes: u32,
}
#[repr(C)]
pub struct DUMP_HEADER64 {
pub Signature: u32,
pub ValidDump: u32,
pub MajorVersion: u32,
pub MinorVersion: u32,
pub DirectoryTableBase: u64,
pub PfnDataBase: u64,
pub PsLoadedModuleList: u64,
pub PsActiveProcessHead: u64,
pub MachineImageType: u32,
pub NumberProcessors: u32,
pub BugCheckCode: u32,
pub BugCheckParameter1: u64,
pub BugCheckParameter2: u64,
pub BugCheckParameter3: u64,
pub BugCheckParameter4: u64,
pub VersionUser: [i8; 32],
pub KdDebuggerDataBlock: u64,
pub Anonymous: _Anonymous_e__Union,
pub ContextRecord: [u8; 3000],
pub Exception: EXCEPTION_RECORD64,
pub DumpType: u32,
pub RequiredDumpSpace: i64,
pub SystemTime: i64,
pub Comment: [i8; 128],
pub SystemUpTime: i64,
pub MiniDumpFields: u32,
pub SecondaryDataState: u32,
pub ProductType: u32,
pub SuiteMask: u32,
pub WriterStatus: u32,
pub Unused1: u8,
pub KdSecondaryVersion: u8,
pub Unused: [u8; 2],
pub Attributes: DUMP_FILE_ATTRIBUTES,
pub BootId: u32,
pub _reserved0: [u8; 4008],
}import "golang.org/x/sys/windows"
type EXCEPTION_RECORD64 struct {
ExceptionCode int32
ExceptionFlags uint32
ExceptionRecord uint64
ExceptionAddress uint64
NumberParameters uint32
__unusedAlignment uint32
ExceptionInformation [15]uint64
}
type DUMP_FILE_ATTRIBUTES struct {
Anonymous _Anonymous_e__Struct
Attributes uint32
}
type DUMP_HEADER64 struct {
Signature uint32
ValidDump uint32
MajorVersion uint32
MinorVersion uint32
DirectoryTableBase uint64
PfnDataBase uint64
PsLoadedModuleList uint64
PsActiveProcessHead uint64
MachineImageType uint32
NumberProcessors uint32
BugCheckCode uint32
BugCheckParameter1 uint64
BugCheckParameter2 uint64
BugCheckParameter3 uint64
BugCheckParameter4 uint64
VersionUser [32]int8
KdDebuggerDataBlock uint64
Anonymous _Anonymous_e__Union
ContextRecord [3000]byte
Exception EXCEPTION_RECORD64
DumpType uint32
RequiredDumpSpace int64
SystemTime int64
Comment [128]int8
SystemUpTime int64
MiniDumpFields uint32
SecondaryDataState uint32
ProductType uint32
SuiteMask uint32
WriterStatus uint32
Unused1 byte
KdSecondaryVersion byte
Unused [2]byte
Attributes DUMP_FILE_ATTRIBUTES
BootId uint32
_reserved0 [4008]byte
}type
EXCEPTION_RECORD64 = record
ExceptionCode: Integer;
ExceptionFlags: DWORD;
ExceptionRecord: UInt64;
ExceptionAddress: UInt64;
NumberParameters: DWORD;
__unusedAlignment: DWORD;
ExceptionInformation: array[0..14] of UInt64;
end;
DUMP_FILE_ATTRIBUTES = record
Anonymous: _Anonymous_e__Struct;
Attributes: DWORD;
end;
DUMP_HEADER64 = record
Signature: DWORD;
ValidDump: DWORD;
MajorVersion: DWORD;
MinorVersion: DWORD;
DirectoryTableBase: UInt64;
PfnDataBase: UInt64;
PsLoadedModuleList: UInt64;
PsActiveProcessHead: UInt64;
MachineImageType: DWORD;
NumberProcessors: DWORD;
BugCheckCode: DWORD;
BugCheckParameter1: UInt64;
BugCheckParameter2: UInt64;
BugCheckParameter3: UInt64;
BugCheckParameter4: UInt64;
VersionUser: array[0..31] of Shortint;
KdDebuggerDataBlock: UInt64;
Anonymous: _Anonymous_e__Union;
ContextRecord: array[0..2999] of Byte;
Exception: EXCEPTION_RECORD64;
DumpType: DWORD;
RequiredDumpSpace: Int64;
SystemTime: Int64;
Comment: array[0..127] of Shortint;
SystemUpTime: Int64;
MiniDumpFields: DWORD;
SecondaryDataState: DWORD;
ProductType: DWORD;
SuiteMask: DWORD;
WriterStatus: DWORD;
Unused1: Byte;
KdSecondaryVersion: Byte;
Unused: array[0..1] of Byte;
Attributes: DUMP_FILE_ATTRIBUTES;
BootId: DWORD;
_reserved0: array[0..4007] of Byte;
end;const EXCEPTION_RECORD64 = extern struct {
ExceptionCode: i32,
ExceptionFlags: u32,
ExceptionRecord: u64,
ExceptionAddress: u64,
NumberParameters: u32,
__unusedAlignment: u32,
ExceptionInformation: [15]u64,
};
const DUMP_FILE_ATTRIBUTES = extern struct {
Anonymous: _Anonymous_e__Struct,
Attributes: u32,
};
const DUMP_HEADER64 = extern struct {
Signature: u32,
ValidDump: u32,
MajorVersion: u32,
MinorVersion: u32,
DirectoryTableBase: u64,
PfnDataBase: u64,
PsLoadedModuleList: u64,
PsActiveProcessHead: u64,
MachineImageType: u32,
NumberProcessors: u32,
BugCheckCode: u32,
BugCheckParameter1: u64,
BugCheckParameter2: u64,
BugCheckParameter3: u64,
BugCheckParameter4: u64,
VersionUser: [32]i8,
KdDebuggerDataBlock: u64,
Anonymous: _Anonymous_e__Union,
ContextRecord: [3000]u8,
Exception: EXCEPTION_RECORD64,
DumpType: u32,
RequiredDumpSpace: i64,
SystemTime: i64,
Comment: [128]i8,
SystemUpTime: i64,
MiniDumpFields: u32,
SecondaryDataState: u32,
ProductType: u32,
SuiteMask: u32,
WriterStatus: u32,
Unused1: u8,
KdSecondaryVersion: u8,
Unused: [2]u8,
Attributes: DUMP_FILE_ATTRIBUTES,
BootId: u32,
_reserved0: [4008]u8,
};type
EXCEPTION_RECORD64 {.bycopy.} = object
ExceptionCode: int32
ExceptionFlags: uint32
ExceptionRecord: uint64
ExceptionAddress: uint64
NumberParameters: uint32
__unusedAlignment: uint32
ExceptionInformation: array[15, uint64]
DUMP_FILE_ATTRIBUTES {.bycopy.} = object
Anonymous: _Anonymous_e__Struct
Attributes: uint32
DUMP_HEADER64 {.bycopy.} = object
Signature: uint32
ValidDump: uint32
MajorVersion: uint32
MinorVersion: uint32
DirectoryTableBase: uint64
PfnDataBase: uint64
PsLoadedModuleList: uint64
PsActiveProcessHead: uint64
MachineImageType: uint32
NumberProcessors: uint32
BugCheckCode: uint32
BugCheckParameter1: uint64
BugCheckParameter2: uint64
BugCheckParameter3: uint64
BugCheckParameter4: uint64
VersionUser: array[32, int8]
KdDebuggerDataBlock: uint64
Anonymous: _Anonymous_e__Union
ContextRecord: array[3000, uint8]
Exception: EXCEPTION_RECORD64
DumpType: uint32
RequiredDumpSpace: int64
SystemTime: int64
Comment: array[128, int8]
SystemUpTime: int64
MiniDumpFields: uint32
SecondaryDataState: uint32
ProductType: uint32
SuiteMask: uint32
WriterStatus: uint32
Unused1: uint8
KdSecondaryVersion: uint8
Unused: array[2, uint8]
Attributes: DUMP_FILE_ATTRIBUTES
BootId: uint32
_reserved0: array[4008, uint8]struct EXCEPTION_RECORD64
{
int ExceptionCode;
uint ExceptionFlags;
ulong ExceptionRecord;
ulong ExceptionAddress;
uint NumberParameters;
uint __unusedAlignment;
ulong[15] ExceptionInformation;
}
struct DUMP_FILE_ATTRIBUTES
{
_Anonymous_e__Struct Anonymous;
uint Attributes;
}
struct DUMP_HEADER64
{
uint Signature;
uint ValidDump;
uint MajorVersion;
uint MinorVersion;
ulong DirectoryTableBase;
ulong PfnDataBase;
ulong PsLoadedModuleList;
ulong PsActiveProcessHead;
uint MachineImageType;
uint NumberProcessors;
uint BugCheckCode;
ulong BugCheckParameter1;
ulong BugCheckParameter2;
ulong BugCheckParameter3;
ulong BugCheckParameter4;
byte[32] VersionUser;
ulong KdDebuggerDataBlock;
_Anonymous_e__Union Anonymous;
ubyte[3000] ContextRecord;
EXCEPTION_RECORD64 Exception;
uint DumpType;
long RequiredDumpSpace;
long SystemTime;
byte[128] Comment;
long SystemUpTime;
uint MiniDumpFields;
uint SecondaryDataState;
uint ProductType;
uint SuiteMask;
uint WriterStatus;
ubyte Unused1;
ubyte KdSecondaryVersion;
ubyte[2] Unused;
DUMP_FILE_ATTRIBUTES Attributes;
uint BootId;
ubyte[4008] _reserved0;
}HSP用 定義
HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; DUMP_HEADER64 サイズ: 8192 バイト(x64)
dim st, 2048 ; 4byte整数×2048(構造体サイズ 8192 / 4 切り上げ)
; Signature : DWORD (+0, 4byte) st.0 = 値 / 値 = st.0 (lpoke/lpeek も可)
; ValidDump : DWORD (+4, 4byte) st.1 = 値 / 値 = st.1 (lpoke/lpeek も可)
; MajorVersion : DWORD (+8, 4byte) st.2 = 値 / 値 = st.2 (lpoke/lpeek も可)
; MinorVersion : DWORD (+12, 4byte) st.3 = 値 / 値 = st.3 (lpoke/lpeek も可)
; DirectoryTableBase : ULONGLONG (+16, 8byte) qpoke st,16,値 / qpeek(st,16) ※IronHSPのみ。3.7/3.8は lpoke st,16,下位 : lpoke st,20,上位
; PfnDataBase : ULONGLONG (+24, 8byte) qpoke st,24,値 / qpeek(st,24) ※IronHSPのみ。3.7/3.8は lpoke st,24,下位 : lpoke st,28,上位
; PsLoadedModuleList : ULONGLONG (+32, 8byte) qpoke st,32,値 / qpeek(st,32) ※IronHSPのみ。3.7/3.8は lpoke st,32,下位 : lpoke st,36,上位
; PsActiveProcessHead : ULONGLONG (+40, 8byte) qpoke st,40,値 / qpeek(st,40) ※IronHSPのみ。3.7/3.8は lpoke st,40,下位 : lpoke st,44,上位
; MachineImageType : DWORD (+48, 4byte) st.12 = 値 / 値 = st.12 (lpoke/lpeek も可)
; NumberProcessors : DWORD (+52, 4byte) st.13 = 値 / 値 = st.13 (lpoke/lpeek も可)
; BugCheckCode : DWORD (+56, 4byte) st.14 = 値 / 値 = st.14 (lpoke/lpeek も可)
; BugCheckParameter1 : ULONGLONG (+64, 8byte) qpoke st,64,値 / qpeek(st,64) ※IronHSPのみ。3.7/3.8は lpoke st,64,下位 : lpoke st,68,上位
; BugCheckParameter2 : ULONGLONG (+72, 8byte) qpoke st,72,値 / qpeek(st,72) ※IronHSPのみ。3.7/3.8は lpoke st,72,下位 : lpoke st,76,上位
; BugCheckParameter3 : ULONGLONG (+80, 8byte) qpoke st,80,値 / qpeek(st,80) ※IronHSPのみ。3.7/3.8は lpoke st,80,下位 : lpoke st,84,上位
; BugCheckParameter4 : ULONGLONG (+88, 8byte) qpoke st,88,値 / qpeek(st,88) ※IronHSPのみ。3.7/3.8は lpoke st,88,下位 : lpoke st,92,上位
; VersionUser : CHAR (+96, 32byte) varptr(st)+96 を基点に操作(32byte:入れ子/配列)
; KdDebuggerDataBlock : ULONGLONG (+128, 8byte) qpoke st,128,値 / qpeek(st,128) ※IronHSPのみ。3.7/3.8は lpoke st,128,下位 : lpoke st,132,上位
; Anonymous : _Anonymous_e__Union (+136, 704byte) varptr(st)+136 を基点に操作(704byte:入れ子/配列)
; ContextRecord : BYTE (+840, 3000byte) varptr(st)+840 を基点に操作(3000byte:入れ子/配列)
; Exception : EXCEPTION_RECORD64 (+3840, 152byte) varptr(st)+3840 を基点に操作(152byte:入れ子/配列)
; DumpType : DWORD (+3992, 4byte) st.998 = 値 / 値 = st.998 (lpoke/lpeek も可)
; RequiredDumpSpace : LONGLONG (+4000, 8byte) qpoke st,4000,値 / qpeek(st,4000) ※IronHSPのみ。3.7/3.8は lpoke st,4000,下位 : lpoke st,4004,上位
; SystemTime : LONGLONG (+4008, 8byte) qpoke st,4008,値 / qpeek(st,4008) ※IronHSPのみ。3.7/3.8は lpoke st,4008,下位 : lpoke st,4012,上位
; Comment : CHAR (+4016, 128byte) varptr(st)+4016 を基点に操作(128byte:入れ子/配列)
; SystemUpTime : LONGLONG (+4144, 8byte) qpoke st,4144,値 / qpeek(st,4144) ※IronHSPのみ。3.7/3.8は lpoke st,4144,下位 : lpoke st,4148,上位
; MiniDumpFields : DWORD (+4152, 4byte) st.1038 = 値 / 値 = st.1038 (lpoke/lpeek も可)
; SecondaryDataState : DWORD (+4156, 4byte) st.1039 = 値 / 値 = st.1039 (lpoke/lpeek も可)
; ProductType : DWORD (+4160, 4byte) st.1040 = 値 / 値 = st.1040 (lpoke/lpeek も可)
; SuiteMask : DWORD (+4164, 4byte) st.1041 = 値 / 値 = st.1041 (lpoke/lpeek も可)
; WriterStatus : DWORD (+4168, 4byte) st.1042 = 値 / 値 = st.1042 (lpoke/lpeek も可)
; Unused1 : BYTE (+4172, 1byte) poke st,4172,値 / 値 = peek(st,4172)
; KdSecondaryVersion : BYTE (+4173, 1byte) poke st,4173,値 / 値 = peek(st,4173)
; Unused : BYTE (+4174, 2byte) varptr(st)+4174 を基点に操作(2byte:入れ子/配列)
; Attributes : DUMP_FILE_ATTRIBUTES (+4176, 4byte) varptr(st)+4176 を基点に操作(4byte:入れ子/配列)
; BootId : DWORD (+4180, 4byte) st.1045 = 値 / 値 = st.1045 (lpoke/lpeek も可)
; _reserved0 : BYTE (+4184, 4008byte) varptr(st)+4184 を基点に操作(4008byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global EXCEPTION_RECORD64
#field int ExceptionCode
#field int ExceptionFlags
#field int64 ExceptionRecord
#field int64 ExceptionAddress
#field int NumberParameters
#field int __unusedAlignment
#field int64 ExceptionInformation 15
#endstruct
#defstruct global DUMP_HEADER64
#field int Signature
#field int ValidDump
#field int MajorVersion
#field int MinorVersion
#field int64 DirectoryTableBase
#field int64 PfnDataBase
#field int64 PsLoadedModuleList
#field int64 PsActiveProcessHead
#field int MachineImageType
#field int NumberProcessors
#field int BugCheckCode
#field int64 BugCheckParameter1
#field int64 BugCheckParameter2
#field int64 BugCheckParameter3
#field int64 BugCheckParameter4
#field byte VersionUser 32
#field int64 KdDebuggerDataBlock
#field byte Anonymous 704
#field byte ContextRecord 3000
#field EXCEPTION_RECORD64 Exception
#field int DumpType
#field int64 RequiredDumpSpace
#field int64 SystemTime
#field byte Comment 128
#field int64 SystemUpTime
#field int MiniDumpFields
#field int SecondaryDataState
#field int ProductType
#field int SuiteMask
#field int WriterStatus
#field byte Unused1
#field byte KdSecondaryVersion
#field byte Unused 2
#field byte Attributes 4
#field int BootId
#field byte _reserved0 4008
#endstruct
stdim st, DUMP_HEADER64 ; NSTRUCT 変数を確保
st->Signature = 100
mes "Signature=" + st->Signature
; ※union フィールドは byte 列で確保(NSTRUCT は union 非対応)。必要に応じ手動でアクセス。