ホーム › System.Diagnostics.Debug › LOADED_IMAGE
LOADED_IMAGE
構造体サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。
フィールド
| フィールド | 型 | サイズ | x64 | x86 | 説明 |
|---|---|---|---|---|---|
| ModuleName | LPSTR | 8/4 | +0 | +0 | モジュール名を示す ANSI 文字列。 |
| hFile | HANDLE | 8/4 | +8 | +4 | イメージファイルのハンドル。 |
| MappedAddress | BYTE* | 8/4 | +16 | +8 | メモリにマップされたイメージの先頭アドレスを指すポインタ。 |
| FileHeader | IMAGE_NT_HEADERS32* | 8/4 | +24 | +12 | イメージの NT ヘッダー(IMAGE_NT_HEADERS32)を指すポインタ。 |
| LastRvaSection | IMAGE_SECTION_HEADER* | 8/4 | +32 | +16 | 直近にアクセスしたセクションヘッダーを指すポインタ。RVA 変換のキャッシュ用。 |
| NumberOfSections | DWORD | 4 | +40 | +20 | イメージ内のセクション数を示す。 |
| Sections | IMAGE_SECTION_HEADER* | 8/4 | +48 | +24 | セクションヘッダー配列の先頭を指すポインタ。 |
| Characteristics | IMAGE_FILE_CHARACTERISTICS2 | 4 | +56 | +28 | イメージの特性フラグ(IMAGE_FILE_CHARACTERISTICS)を示す。 |
| fSystemImage | BOOLEAN | 1 | +60 | +32 | システムイメージかどうかを示す真偽値。 |
| fDOSImage | BOOLEAN | 1 | +61 | +33 | DOS イメージかどうかを示す真偽値。 |
| fReadOnly | BOOLEAN | 1 | +62 | +34 | 読み取り専用としてマップされたかを示す真偽値。 |
| Version | BYTE | 1 | +63 | +35 | 構造体のバージョンを示す。 |
| Links | LIST_ENTRY | 16/8 | +64 | +36 | ロード済みイメージのリンクリストエントリ。 |
| SizeOfImage | DWORD | 4 | +80 | +44 | イメージのバイトサイズを示す。 |
各言語での定義
#include <windows.h>
// LIST_ENTRY (x64 16 / x86 8 バイト)
typedef struct LIST_ENTRY {
LIST_ENTRY* Flink;
LIST_ENTRY* Blink;
} LIST_ENTRY;
// LOADED_IMAGE (x64 88 / x86 48 バイト)
typedef struct LOADED_IMAGE {
LPSTR ModuleName;
HANDLE hFile;
BYTE* MappedAddress;
IMAGE_NT_HEADERS32* FileHeader;
IMAGE_SECTION_HEADER* LastRvaSection;
DWORD NumberOfSections;
IMAGE_SECTION_HEADER* Sections;
IMAGE_FILE_CHARACTERISTICS2 Characteristics;
BOOLEAN fSystemImage;
BOOLEAN fDOSImage;
BOOLEAN fReadOnly;
BYTE Version;
LIST_ENTRY Links;
DWORD SizeOfImage;
} LOADED_IMAGE;using System;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct LIST_ENTRY
{
public IntPtr Flink;
public IntPtr Blink;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct LOADED_IMAGE
{
public IntPtr ModuleName;
public IntPtr hFile;
public IntPtr MappedAddress;
public IntPtr FileHeader;
public IntPtr LastRvaSection;
public uint NumberOfSections;
public IntPtr Sections;
public uint Characteristics;
[MarshalAs(UnmanagedType.U1)] public bool fSystemImage;
[MarshalAs(UnmanagedType.U1)] public bool fDOSImage;
[MarshalAs(UnmanagedType.U1)] public bool fReadOnly;
public byte Version;
public LIST_ENTRY Links;
public uint SizeOfImage;
}Imports System.Runtime.InteropServices
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure LIST_ENTRY
Public Flink As IntPtr
Public Blink As IntPtr
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure LOADED_IMAGE
Public ModuleName As IntPtr
Public hFile As IntPtr
Public MappedAddress As IntPtr
Public FileHeader As IntPtr
Public LastRvaSection As IntPtr
Public NumberOfSections As UInteger
Public Sections As IntPtr
Public Characteristics As UInteger
<MarshalAs(UnmanagedType.U1)> Public fSystemImage As Boolean
<MarshalAs(UnmanagedType.U1)> Public fDOSImage As Boolean
<MarshalAs(UnmanagedType.U1)> Public fReadOnly As Boolean
Public Version As Byte
Public Links As LIST_ENTRY
Public SizeOfImage As UInteger
End Structureimport ctypes
from ctypes import wintypes
class LIST_ENTRY(ctypes.Structure):
_fields_ = [
("Flink", ctypes.c_void_p),
("Blink", ctypes.c_void_p),
]
class LOADED_IMAGE(ctypes.Structure):
_fields_ = [
("ModuleName", ctypes.c_void_p),
("hFile", ctypes.c_void_p),
("MappedAddress", ctypes.c_void_p),
("FileHeader", ctypes.c_void_p),
("LastRvaSection", ctypes.c_void_p),
("NumberOfSections", wintypes.DWORD),
("Sections", ctypes.c_void_p),
("Characteristics", wintypes.DWORD),
("fSystemImage", ctypes.c_byte),
("fDOSImage", ctypes.c_byte),
("fReadOnly", ctypes.c_byte),
("Version", ctypes.c_ubyte),
("Links", LIST_ENTRY),
("SizeOfImage", wintypes.DWORD),
]#[repr(C)]
pub struct LIST_ENTRY {
pub Flink: *mut core::ffi::c_void,
pub Blink: *mut core::ffi::c_void,
}
#[repr(C)]
pub struct LOADED_IMAGE {
pub ModuleName: *mut core::ffi::c_void,
pub hFile: *mut core::ffi::c_void,
pub MappedAddress: *mut core::ffi::c_void,
pub FileHeader: *mut core::ffi::c_void,
pub LastRvaSection: *mut core::ffi::c_void,
pub NumberOfSections: u32,
pub Sections: *mut core::ffi::c_void,
pub Characteristics: u32,
pub fSystemImage: u8,
pub fDOSImage: u8,
pub fReadOnly: u8,
pub Version: u8,
pub Links: LIST_ENTRY,
pub SizeOfImage: u32,
}import "golang.org/x/sys/windows"
type LIST_ENTRY struct {
Flink uintptr
Blink uintptr
}
type LOADED_IMAGE struct {
ModuleName uintptr
hFile uintptr
MappedAddress uintptr
FileHeader uintptr
LastRvaSection uintptr
NumberOfSections uint32
Sections uintptr
Characteristics uint32
fSystemImage byte
fDOSImage byte
fReadOnly byte
Version byte
Links LIST_ENTRY
SizeOfImage uint32
}type
LIST_ENTRY = record
Flink: Pointer;
Blink: Pointer;
end;
LOADED_IMAGE = record
ModuleName: Pointer;
hFile: Pointer;
MappedAddress: Pointer;
FileHeader: Pointer;
LastRvaSection: Pointer;
NumberOfSections: DWORD;
Sections: Pointer;
Characteristics: DWORD;
fSystemImage: ByteBool;
fDOSImage: ByteBool;
fReadOnly: ByteBool;
Version: Byte;
Links: LIST_ENTRY;
SizeOfImage: DWORD;
end;const LIST_ENTRY = extern struct {
Flink: ?*anyopaque,
Blink: ?*anyopaque,
};
const LOADED_IMAGE = extern struct {
ModuleName: ?*anyopaque,
hFile: ?*anyopaque,
MappedAddress: ?*anyopaque,
FileHeader: ?*anyopaque,
LastRvaSection: ?*anyopaque,
NumberOfSections: u32,
Sections: ?*anyopaque,
Characteristics: u32,
fSystemImage: u8,
fDOSImage: u8,
fReadOnly: u8,
Version: u8,
Links: LIST_ENTRY,
SizeOfImage: u32,
};type
LIST_ENTRY {.bycopy.} = object
Flink: pointer
Blink: pointer
LOADED_IMAGE {.bycopy.} = object
ModuleName: pointer
hFile: pointer
MappedAddress: pointer
FileHeader: pointer
LastRvaSection: pointer
NumberOfSections: uint32
Sections: pointer
Characteristics: uint32
fSystemImage: uint8
fDOSImage: uint8
fReadOnly: uint8
Version: uint8
Links: LIST_ENTRY
SizeOfImage: uint32struct LIST_ENTRY
{
void* Flink;
void* Blink;
}
struct LOADED_IMAGE
{
void* ModuleName;
void* hFile;
void* MappedAddress;
void* FileHeader;
void* LastRvaSection;
uint NumberOfSections;
void* Sections;
uint Characteristics;
ubyte fSystemImage;
ubyte fDOSImage;
ubyte fReadOnly;
ubyte Version;
LIST_ENTRY Links;
uint SizeOfImage;
}HSP用 定義
HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; LOADED_IMAGE サイズ: 48 バイト(x86)
dim st, 12 ; 4byte整数×12(構造体サイズ 48 / 4 切り上げ)
; ModuleName : LPSTR (+0, 4byte) st.0 = 値 / 値 = st.0 (lpoke/lpeek も可)
; hFile : HANDLE (+4, 4byte) st.1 = 値 / 値 = st.1 (lpoke/lpeek も可)
; MappedAddress : BYTE* (+8, 4byte) st.2 = 値 / 値 = st.2 (lpoke/lpeek も可)
; FileHeader : IMAGE_NT_HEADERS32* (+12, 4byte) varptr(st)+12 を基点に操作(4byte:入れ子/配列)
; LastRvaSection : IMAGE_SECTION_HEADER* (+16, 4byte) varptr(st)+16 を基点に操作(4byte:入れ子/配列)
; NumberOfSections : DWORD (+20, 4byte) st.5 = 値 / 値 = st.5 (lpoke/lpeek も可)
; Sections : IMAGE_SECTION_HEADER* (+24, 4byte) varptr(st)+24 を基点に操作(4byte:入れ子/配列)
; Characteristics : IMAGE_FILE_CHARACTERISTICS2 (+28, 4byte) st.7 = 値 / 値 = st.7 (lpoke/lpeek も可)
; fSystemImage : BOOLEAN (+32, 1byte) poke st,32,値 / 値 = peek(st,32)
; fDOSImage : BOOLEAN (+33, 1byte) poke st,33,値 / 値 = peek(st,33)
; fReadOnly : BOOLEAN (+34, 1byte) poke st,34,値 / 値 = peek(st,34)
; Version : BYTE (+35, 1byte) poke st,35,値 / 値 = peek(st,35)
; Links : LIST_ENTRY (+36, 8byte) varptr(st)+36 を基点に操作(8byte:入れ子/配列)
; SizeOfImage : DWORD (+44, 4byte) st.11 = 値 / 値 = st.11 (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; LOADED_IMAGE サイズ: 88 バイト(x64)
dim st, 22 ; 4byte整数×22(構造体サイズ 88 / 4 切り上げ)
; ModuleName : LPSTR (+0, 8byte) qpoke st,0,値 / qpeek(st,0) ※IronHSPのみ。3.7/3.8は lpoke st,0,下位 : lpoke st,4,上位
; hFile : HANDLE (+8, 8byte) qpoke st,8,値 / qpeek(st,8) ※IronHSPのみ。3.7/3.8は lpoke st,8,下位 : lpoke st,12,上位
; MappedAddress : BYTE* (+16, 8byte) qpoke st,16,値 / qpeek(st,16) ※IronHSPのみ。3.7/3.8は lpoke st,16,下位 : lpoke st,20,上位
; FileHeader : IMAGE_NT_HEADERS32* (+24, 8byte) varptr(st)+24 を基点に操作(8byte:入れ子/配列)
; LastRvaSection : IMAGE_SECTION_HEADER* (+32, 8byte) varptr(st)+32 を基点に操作(8byte:入れ子/配列)
; NumberOfSections : DWORD (+40, 4byte) st.10 = 値 / 値 = st.10 (lpoke/lpeek も可)
; Sections : IMAGE_SECTION_HEADER* (+48, 8byte) varptr(st)+48 を基点に操作(8byte:入れ子/配列)
; Characteristics : IMAGE_FILE_CHARACTERISTICS2 (+56, 4byte) st.14 = 値 / 値 = st.14 (lpoke/lpeek も可)
; fSystemImage : BOOLEAN (+60, 1byte) poke st,60,値 / 値 = peek(st,60)
; fDOSImage : BOOLEAN (+61, 1byte) poke st,61,値 / 値 = peek(st,61)
; fReadOnly : BOOLEAN (+62, 1byte) poke st,62,値 / 値 = peek(st,62)
; Version : BYTE (+63, 1byte) poke st,63,値 / 値 = peek(st,63)
; Links : LIST_ENTRY (+64, 16byte) varptr(st)+64 を基点に操作(16byte:入れ子/配列)
; SizeOfImage : DWORD (+80, 4byte) st.20 = 値 / 値 = st.20 (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global LIST_ENTRY
#field intptr Flink
#field intptr Blink
#endstruct
#defstruct global LOADED_IMAGE
#field intptr ModuleName
#field intptr hFile
#field intptr MappedAddress
#field intptr FileHeader
#field intptr LastRvaSection
#field int NumberOfSections
#field intptr Sections
#field int Characteristics
#field bool1 fSystemImage
#field bool1 fDOSImage
#field bool1 fReadOnly
#field byte Version
#field LIST_ENTRY Links
#field int SizeOfImage
#endstruct
stdim st, LOADED_IMAGE ; NSTRUCT 変数を確保
st->NumberOfSections = 100
mes "NumberOfSections=" + st->NumberOfSections