Win32 API 日本語リファレンス
ホーム › System.Diagnostics.Debug › KDHELP64

KDHELP64

構造体
📘 Microsoft Learn (日本語) · English
サイズx64: 112 バイト / x86: 112 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド型サイズx64x86説明
ThreadULONGLONG8+0+0現在のスレッドを表すアドレス値を示す。
ThCallbackStackDWORD4+8+8スレッド内のコールバックスタックフィールドへのオフセットを示す。
ThCallbackBStoreDWORD4+12+12スレッド内のコールバックバッキングストアへのオフセットを示す。
NextCallbackDWORD4+16+16次のコールバックフレームへのオフセットを示す。
FramePointerDWORD4+20+20コールバックフレームのフレームポインタへのオフセットを示す。
KiCallUserModeULONGLONG8+24+24kernel32 の KiCallUserMode 関数のアドレスを示す。
KeUserCallbackDispatcherULONGLONG8+32+32KeUserCallbackDispatcher 関数のアドレスを示す。
SystemRangeStartULONGLONG8+40+40ユーザー空間とシステム空間の境界となる開始アドレスを示す。
KiUserExceptionDispatcherULONGLONG8+48+48KiUserExceptionDispatcher 関数のアドレスを示す。
StackBaseULONGLONG8+56+56スタックの底アドレスを示す。
StackLimitULONGLONG8+64+64スタックの上限アドレスを示す。
BuildVersionDWORD4+72+72OS のビルドバージョンを示す。
RetpolineStubFunctionTableSizeDWORD4+76+76Retpoline スタブ関数テーブルのサイズを示す。
RetpolineStubFunctionTableULONGLONG8+80+80Retpoline スタブ関数テーブルのアドレスを示す。
RetpolineStubOffsetDWORD4+88+88Retpoline スタブへのオフセットを示す。
RetpolineStubSizeDWORD4+92+92Retpoline スタブのサイズを示す。
Reserved0ULONGLONG16+96+96予約フィールド。使用しない。

各言語での定義

#include <windows.h>

// KDHELP64  (x64 112 / x86 112 バイト)
typedef struct KDHELP64 {
    ULONGLONG Thread;
    DWORD ThCallbackStack;
    DWORD ThCallbackBStore;
    DWORD NextCallback;
    DWORD FramePointer;
    ULONGLONG KiCallUserMode;
    ULONGLONG KeUserCallbackDispatcher;
    ULONGLONG SystemRangeStart;
    ULONGLONG KiUserExceptionDispatcher;
    ULONGLONG StackBase;
    ULONGLONG StackLimit;
    DWORD BuildVersion;
    DWORD RetpolineStubFunctionTableSize;
    ULONGLONG RetpolineStubFunctionTable;
    DWORD RetpolineStubOffset;
    DWORD RetpolineStubSize;
    ULONGLONG Reserved0[2];
} KDHELP64;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct KDHELP64
{
    public ulong Thread;
    public uint ThCallbackStack;
    public uint ThCallbackBStore;
    public uint NextCallback;
    public uint FramePointer;
    public ulong KiCallUserMode;
    public ulong KeUserCallbackDispatcher;
    public ulong SystemRangeStart;
    public ulong KiUserExceptionDispatcher;
    public ulong StackBase;
    public ulong StackLimit;
    public uint BuildVersion;
    public uint RetpolineStubFunctionTableSize;
    public ulong RetpolineStubFunctionTable;
    public uint RetpolineStubOffset;
    public uint RetpolineStubSize;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)] public ulong[] Reserved0;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure KDHELP64
    Public Thread As ULong
    Public ThCallbackStack As UInteger
    Public ThCallbackBStore As UInteger
    Public NextCallback As UInteger
    Public FramePointer As UInteger
    Public KiCallUserMode As ULong
    Public KeUserCallbackDispatcher As ULong
    Public SystemRangeStart As ULong
    Public KiUserExceptionDispatcher As ULong
    Public StackBase As ULong
    Public StackLimit As ULong
    Public BuildVersion As UInteger
    Public RetpolineStubFunctionTableSize As UInteger
    Public RetpolineStubFunctionTable As ULong
    Public RetpolineStubOffset As UInteger
    Public RetpolineStubSize As UInteger
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=2)> Public Reserved0() As ULong
End Structure
import ctypes
from ctypes import wintypes

class KDHELP64(ctypes.Structure):
    _fields_ = [
        ("Thread", ctypes.c_ulonglong),
        ("ThCallbackStack", wintypes.DWORD),
        ("ThCallbackBStore", wintypes.DWORD),
        ("NextCallback", wintypes.DWORD),
        ("FramePointer", wintypes.DWORD),
        ("KiCallUserMode", ctypes.c_ulonglong),
        ("KeUserCallbackDispatcher", ctypes.c_ulonglong),
        ("SystemRangeStart", ctypes.c_ulonglong),
        ("KiUserExceptionDispatcher", ctypes.c_ulonglong),
        ("StackBase", ctypes.c_ulonglong),
        ("StackLimit", ctypes.c_ulonglong),
        ("BuildVersion", wintypes.DWORD),
        ("RetpolineStubFunctionTableSize", wintypes.DWORD),
        ("RetpolineStubFunctionTable", ctypes.c_ulonglong),
        ("RetpolineStubOffset", wintypes.DWORD),
        ("RetpolineStubSize", wintypes.DWORD),
        ("Reserved0", ctypes.c_ulonglong * 2),
    ]
#[repr(C)]
pub struct KDHELP64 {
    pub Thread: u64,
    pub ThCallbackStack: u32,
    pub ThCallbackBStore: u32,
    pub NextCallback: u32,
    pub FramePointer: u32,
    pub KiCallUserMode: u64,
    pub KeUserCallbackDispatcher: u64,
    pub SystemRangeStart: u64,
    pub KiUserExceptionDispatcher: u64,
    pub StackBase: u64,
    pub StackLimit: u64,
    pub BuildVersion: u32,
    pub RetpolineStubFunctionTableSize: u32,
    pub RetpolineStubFunctionTable: u64,
    pub RetpolineStubOffset: u32,
    pub RetpolineStubSize: u32,
    pub Reserved0: [u64; 2],
}
import "golang.org/x/sys/windows"

type KDHELP64 struct {
	Thread uint64
	ThCallbackStack uint32
	ThCallbackBStore uint32
	NextCallback uint32
	FramePointer uint32
	KiCallUserMode uint64
	KeUserCallbackDispatcher uint64
	SystemRangeStart uint64
	KiUserExceptionDispatcher uint64
	StackBase uint64
	StackLimit uint64
	BuildVersion uint32
	RetpolineStubFunctionTableSize uint32
	RetpolineStubFunctionTable uint64
	RetpolineStubOffset uint32
	RetpolineStubSize uint32
	Reserved0 [2]uint64
}
type
  KDHELP64 = record
    Thread: UInt64;
    ThCallbackStack: DWORD;
    ThCallbackBStore: DWORD;
    NextCallback: DWORD;
    FramePointer: DWORD;
    KiCallUserMode: UInt64;
    KeUserCallbackDispatcher: UInt64;
    SystemRangeStart: UInt64;
    KiUserExceptionDispatcher: UInt64;
    StackBase: UInt64;
    StackLimit: UInt64;
    BuildVersion: DWORD;
    RetpolineStubFunctionTableSize: DWORD;
    RetpolineStubFunctionTable: UInt64;
    RetpolineStubOffset: DWORD;
    RetpolineStubSize: DWORD;
    Reserved0: array[0..1] of UInt64;
  end;
const KDHELP64 = extern struct {
    Thread: u64,
    ThCallbackStack: u32,
    ThCallbackBStore: u32,
    NextCallback: u32,
    FramePointer: u32,
    KiCallUserMode: u64,
    KeUserCallbackDispatcher: u64,
    SystemRangeStart: u64,
    KiUserExceptionDispatcher: u64,
    StackBase: u64,
    StackLimit: u64,
    BuildVersion: u32,
    RetpolineStubFunctionTableSize: u32,
    RetpolineStubFunctionTable: u64,
    RetpolineStubOffset: u32,
    RetpolineStubSize: u32,
    Reserved0: [2]u64,
};
type
  KDHELP64 {.bycopy.} = object
    Thread: uint64
    ThCallbackStack: uint32
    ThCallbackBStore: uint32
    NextCallback: uint32
    FramePointer: uint32
    KiCallUserMode: uint64
    KeUserCallbackDispatcher: uint64
    SystemRangeStart: uint64
    KiUserExceptionDispatcher: uint64
    StackBase: uint64
    StackLimit: uint64
    BuildVersion: uint32
    RetpolineStubFunctionTableSize: uint32
    RetpolineStubFunctionTable: uint64
    RetpolineStubOffset: uint32
    RetpolineStubSize: uint32
    Reserved0: array[2, uint64]
struct KDHELP64
{
    ulong Thread;
    uint ThCallbackStack;
    uint ThCallbackBStore;
    uint NextCallback;
    uint FramePointer;
    ulong KiCallUserMode;
    ulong KeUserCallbackDispatcher;
    ulong SystemRangeStart;
    ulong KiUserExceptionDispatcher;
    ulong StackBase;
    ulong StackLimit;
    uint BuildVersion;
    uint RetpolineStubFunctionTableSize;
    ulong RetpolineStubFunctionTable;
    uint RetpolineStubOffset;
    uint RetpolineStubSize;
    ulong[2] Reserved0;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; KDHELP64 サイズ: 112 バイト(x64)
dim st, 28    ; 4byte整数×28(構造体サイズ 112 / 4 切り上げ)
; Thread : ULONGLONG (+0, 8byte)  qpoke st,0,値 / qpeek(st,0)  ※IronHSPのみ。3.7/3.8は lpoke st,0,下位 : lpoke st,4,上位
; ThCallbackStack : DWORD (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; ThCallbackBStore : DWORD (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; NextCallback : DWORD (+16, 4byte)  st.4 = 値  /  値 = st.4   (lpoke/lpeek も可)
; FramePointer : DWORD (+20, 4byte)  st.5 = 値  /  値 = st.5   (lpoke/lpeek も可)
; KiCallUserMode : ULONGLONG (+24, 8byte)  qpoke st,24,値 / qpeek(st,24)  ※IronHSPのみ。3.7/3.8は lpoke st,24,下位 : lpoke st,28,上位
; KeUserCallbackDispatcher : ULONGLONG (+32, 8byte)  qpoke st,32,値 / qpeek(st,32)  ※IronHSPのみ。3.7/3.8は lpoke st,32,下位 : lpoke st,36,上位
; SystemRangeStart : ULONGLONG (+40, 8byte)  qpoke st,40,値 / qpeek(st,40)  ※IronHSPのみ。3.7/3.8は lpoke st,40,下位 : lpoke st,44,上位
; KiUserExceptionDispatcher : ULONGLONG (+48, 8byte)  qpoke st,48,値 / qpeek(st,48)  ※IronHSPのみ。3.7/3.8は lpoke st,48,下位 : lpoke st,52,上位
; StackBase : ULONGLONG (+56, 8byte)  qpoke st,56,値 / qpeek(st,56)  ※IronHSPのみ。3.7/3.8は lpoke st,56,下位 : lpoke st,60,上位
; StackLimit : ULONGLONG (+64, 8byte)  qpoke st,64,値 / qpeek(st,64)  ※IronHSPのみ。3.7/3.8は lpoke st,64,下位 : lpoke st,68,上位
; BuildVersion : DWORD (+72, 4byte)  st.18 = 値  /  値 = st.18   (lpoke/lpeek も可)
; RetpolineStubFunctionTableSize : DWORD (+76, 4byte)  st.19 = 値  /  値 = st.19   (lpoke/lpeek も可)
; RetpolineStubFunctionTable : ULONGLONG (+80, 8byte)  qpoke st,80,値 / qpeek(st,80)  ※IronHSPのみ。3.7/3.8は lpoke st,80,下位 : lpoke st,84,上位
; RetpolineStubOffset : DWORD (+88, 4byte)  st.22 = 値  /  値 = st.22   (lpoke/lpeek も可)
; RetpolineStubSize : DWORD (+92, 4byte)  st.23 = 値  /  値 = st.23   (lpoke/lpeek も可)
; Reserved0 : ULONGLONG (+96, 16byte)  varptr(st)+96 を基点に操作(16byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
#defstruct global KDHELP64
    #field int64 Thread
    #field int ThCallbackStack
    #field int ThCallbackBStore
    #field int NextCallback
    #field int FramePointer
    #field int64 KiCallUserMode
    #field int64 KeUserCallbackDispatcher
    #field int64 SystemRangeStart
    #field int64 KiUserExceptionDispatcher
    #field int64 StackBase
    #field int64 StackLimit
    #field int BuildVersion
    #field int RetpolineStubFunctionTableSize
    #field int64 RetpolineStubFunctionTable
    #field int RetpolineStubOffset
    #field int RetpolineStubSize
    #field int64 Reserved0 2
#endstruct

stdim st, KDHELP64        ; NSTRUCT 変数を確保
st->Thread = 100
mes "Thread=" + st->Thread