Win32 API 日本語リファレンス
ホームSystem.Diagnostics.Debug › LOADED_IMAGE

LOADED_IMAGE

構造体
サイズx64: 88 バイト / x86: 48 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールドサイズx64x86説明
ModuleNameLPSTR8/4+0+0モジュール名を示す ANSI 文字列。
hFileHANDLE8/4+8+4イメージファイルのハンドル。
MappedAddressBYTE*8/4+16+8メモリにマップされたイメージの先頭アドレスを指すポインタ。
FileHeaderIMAGE_NT_HEADERS32*8/4+24+12イメージの NT ヘッダー(IMAGE_NT_HEADERS32)を指すポインタ。
LastRvaSectionIMAGE_SECTION_HEADER*8/4+32+16直近にアクセスしたセクションヘッダーを指すポインタ。RVA 変換のキャッシュ用。
NumberOfSectionsDWORD4+40+20イメージ内のセクション数を示す。
SectionsIMAGE_SECTION_HEADER*8/4+48+24セクションヘッダー配列の先頭を指すポインタ。
CharacteristicsIMAGE_FILE_CHARACTERISTICS24+56+28イメージの特性フラグ(IMAGE_FILE_CHARACTERISTICS)を示す。
fSystemImageBOOLEAN1+60+32システムイメージかどうかを示す真偽値。
fDOSImageBOOLEAN1+61+33DOS イメージかどうかを示す真偽値。
fReadOnlyBOOLEAN1+62+34読み取り専用としてマップされたかを示す真偽値。
VersionBYTE1+63+35構造体のバージョンを示す。
LinksLIST_ENTRY16/8+64+36ロード済みイメージのリンクリストエントリ。
SizeOfImageDWORD4+80+44イメージのバイトサイズを示す。

各言語での定義

#include <windows.h>

// LIST_ENTRY  (x64 16 / x86 8 バイト)
typedef struct LIST_ENTRY {
    LIST_ENTRY* Flink;
    LIST_ENTRY* Blink;
} LIST_ENTRY;

// LOADED_IMAGE  (x64 88 / x86 48 バイト)
typedef struct LOADED_IMAGE {
    LPSTR ModuleName;
    HANDLE hFile;
    BYTE* MappedAddress;
    IMAGE_NT_HEADERS32* FileHeader;
    IMAGE_SECTION_HEADER* LastRvaSection;
    DWORD NumberOfSections;
    IMAGE_SECTION_HEADER* Sections;
    IMAGE_FILE_CHARACTERISTICS2 Characteristics;
    BOOLEAN fSystemImage;
    BOOLEAN fDOSImage;
    BOOLEAN fReadOnly;
    BYTE Version;
    LIST_ENTRY Links;
    DWORD SizeOfImage;
} LOADED_IMAGE;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct LIST_ENTRY
{
    public IntPtr Flink;
    public IntPtr Blink;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct LOADED_IMAGE
{
    public IntPtr ModuleName;
    public IntPtr hFile;
    public IntPtr MappedAddress;
    public IntPtr FileHeader;
    public IntPtr LastRvaSection;
    public uint NumberOfSections;
    public IntPtr Sections;
    public uint Characteristics;
    [MarshalAs(UnmanagedType.U1)] public bool fSystemImage;
    [MarshalAs(UnmanagedType.U1)] public bool fDOSImage;
    [MarshalAs(UnmanagedType.U1)] public bool fReadOnly;
    public byte Version;
    public LIST_ENTRY Links;
    public uint SizeOfImage;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure LIST_ENTRY
    Public Flink As IntPtr
    Public Blink As IntPtr
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure LOADED_IMAGE
    Public ModuleName As IntPtr
    Public hFile As IntPtr
    Public MappedAddress As IntPtr
    Public FileHeader As IntPtr
    Public LastRvaSection As IntPtr
    Public NumberOfSections As UInteger
    Public Sections As IntPtr
    Public Characteristics As UInteger
    <MarshalAs(UnmanagedType.U1)> Public fSystemImage As Boolean
    <MarshalAs(UnmanagedType.U1)> Public fDOSImage As Boolean
    <MarshalAs(UnmanagedType.U1)> Public fReadOnly As Boolean
    Public Version As Byte
    Public Links As LIST_ENTRY
    Public SizeOfImage As UInteger
End Structure
import ctypes
from ctypes import wintypes

class LIST_ENTRY(ctypes.Structure):
    _fields_ = [
        ("Flink", ctypes.c_void_p),
        ("Blink", ctypes.c_void_p),
    ]

class LOADED_IMAGE(ctypes.Structure):
    _fields_ = [
        ("ModuleName", ctypes.c_void_p),
        ("hFile", ctypes.c_void_p),
        ("MappedAddress", ctypes.c_void_p),
        ("FileHeader", ctypes.c_void_p),
        ("LastRvaSection", ctypes.c_void_p),
        ("NumberOfSections", wintypes.DWORD),
        ("Sections", ctypes.c_void_p),
        ("Characteristics", wintypes.DWORD),
        ("fSystemImage", ctypes.c_byte),
        ("fDOSImage", ctypes.c_byte),
        ("fReadOnly", ctypes.c_byte),
        ("Version", ctypes.c_ubyte),
        ("Links", LIST_ENTRY),
        ("SizeOfImage", wintypes.DWORD),
    ]
#[repr(C)]
pub struct LIST_ENTRY {
    pub Flink: *mut core::ffi::c_void,
    pub Blink: *mut core::ffi::c_void,
}

#[repr(C)]
pub struct LOADED_IMAGE {
    pub ModuleName: *mut core::ffi::c_void,
    pub hFile: *mut core::ffi::c_void,
    pub MappedAddress: *mut core::ffi::c_void,
    pub FileHeader: *mut core::ffi::c_void,
    pub LastRvaSection: *mut core::ffi::c_void,
    pub NumberOfSections: u32,
    pub Sections: *mut core::ffi::c_void,
    pub Characteristics: u32,
    pub fSystemImage: u8,
    pub fDOSImage: u8,
    pub fReadOnly: u8,
    pub Version: u8,
    pub Links: LIST_ENTRY,
    pub SizeOfImage: u32,
}
import "golang.org/x/sys/windows"

type LIST_ENTRY struct {
	Flink uintptr
	Blink uintptr
}

type LOADED_IMAGE struct {
	ModuleName uintptr
	hFile uintptr
	MappedAddress uintptr
	FileHeader uintptr
	LastRvaSection uintptr
	NumberOfSections uint32
	Sections uintptr
	Characteristics uint32
	fSystemImage byte
	fDOSImage byte
	fReadOnly byte
	Version byte
	Links LIST_ENTRY
	SizeOfImage uint32
}
type
  LIST_ENTRY = record
    Flink: Pointer;
    Blink: Pointer;
  end;

  LOADED_IMAGE = record
    ModuleName: Pointer;
    hFile: Pointer;
    MappedAddress: Pointer;
    FileHeader: Pointer;
    LastRvaSection: Pointer;
    NumberOfSections: DWORD;
    Sections: Pointer;
    Characteristics: DWORD;
    fSystemImage: ByteBool;
    fDOSImage: ByteBool;
    fReadOnly: ByteBool;
    Version: Byte;
    Links: LIST_ENTRY;
    SizeOfImage: DWORD;
  end;
const LIST_ENTRY = extern struct {
    Flink: ?*anyopaque,
    Blink: ?*anyopaque,
};

const LOADED_IMAGE = extern struct {
    ModuleName: ?*anyopaque,
    hFile: ?*anyopaque,
    MappedAddress: ?*anyopaque,
    FileHeader: ?*anyopaque,
    LastRvaSection: ?*anyopaque,
    NumberOfSections: u32,
    Sections: ?*anyopaque,
    Characteristics: u32,
    fSystemImage: u8,
    fDOSImage: u8,
    fReadOnly: u8,
    Version: u8,
    Links: LIST_ENTRY,
    SizeOfImage: u32,
};
type
  LIST_ENTRY {.bycopy.} = object
    Flink: pointer
    Blink: pointer

  LOADED_IMAGE {.bycopy.} = object
    ModuleName: pointer
    hFile: pointer
    MappedAddress: pointer
    FileHeader: pointer
    LastRvaSection: pointer
    NumberOfSections: uint32
    Sections: pointer
    Characteristics: uint32
    fSystemImage: uint8
    fDOSImage: uint8
    fReadOnly: uint8
    Version: uint8
    Links: LIST_ENTRY
    SizeOfImage: uint32
struct LIST_ENTRY
{
    void* Flink;
    void* Blink;
}

struct LOADED_IMAGE
{
    void* ModuleName;
    void* hFile;
    void* MappedAddress;
    void* FileHeader;
    void* LastRvaSection;
    uint NumberOfSections;
    void* Sections;
    uint Characteristics;
    ubyte fSystemImage;
    ubyte fDOSImage;
    ubyte fReadOnly;
    ubyte Version;
    LIST_ENTRY Links;
    uint SizeOfImage;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; LOADED_IMAGE サイズ: 48 バイト(x86)
dim st, 12    ; 4byte整数×12(構造体サイズ 48 / 4 切り上げ)
; ModuleName : LPSTR (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; hFile : HANDLE (+4, 4byte)  st.1 = 値  /  値 = st.1   (lpoke/lpeek も可)
; MappedAddress : BYTE* (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; FileHeader : IMAGE_NT_HEADERS32* (+12, 4byte)  varptr(st)+12 を基点に操作(4byte:入れ子/配列)
; LastRvaSection : IMAGE_SECTION_HEADER* (+16, 4byte)  varptr(st)+16 を基点に操作(4byte:入れ子/配列)
; NumberOfSections : DWORD (+20, 4byte)  st.5 = 値  /  値 = st.5   (lpoke/lpeek も可)
; Sections : IMAGE_SECTION_HEADER* (+24, 4byte)  varptr(st)+24 を基点に操作(4byte:入れ子/配列)
; Characteristics : IMAGE_FILE_CHARACTERISTICS2 (+28, 4byte)  st.7 = 値  /  値 = st.7   (lpoke/lpeek も可)
; fSystemImage : BOOLEAN (+32, 1byte)  poke st,32,値  /  値 = peek(st,32)
; fDOSImage : BOOLEAN (+33, 1byte)  poke st,33,値  /  値 = peek(st,33)
; fReadOnly : BOOLEAN (+34, 1byte)  poke st,34,値  /  値 = peek(st,34)
; Version : BYTE (+35, 1byte)  poke st,35,値  /  値 = peek(st,35)
; Links : LIST_ENTRY (+36, 8byte)  varptr(st)+36 を基点に操作(8byte:入れ子/配列)
; SizeOfImage : DWORD (+44, 4byte)  st.11 = 値  /  値 = st.11   (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; LOADED_IMAGE サイズ: 88 バイト(x64)
dim st, 22    ; 4byte整数×22(構造体サイズ 88 / 4 切り上げ)
; ModuleName : LPSTR (+0, 8byte)  qpoke st,0,値 / qpeek(st,0)  ※IronHSPのみ。3.7/3.8は lpoke st,0,下位 : lpoke st,4,上位
; hFile : HANDLE (+8, 8byte)  qpoke st,8,値 / qpeek(st,8)  ※IronHSPのみ。3.7/3.8は lpoke st,8,下位 : lpoke st,12,上位
; MappedAddress : BYTE* (+16, 8byte)  qpoke st,16,値 / qpeek(st,16)  ※IronHSPのみ。3.7/3.8は lpoke st,16,下位 : lpoke st,20,上位
; FileHeader : IMAGE_NT_HEADERS32* (+24, 8byte)  varptr(st)+24 を基点に操作(8byte:入れ子/配列)
; LastRvaSection : IMAGE_SECTION_HEADER* (+32, 8byte)  varptr(st)+32 を基点に操作(8byte:入れ子/配列)
; NumberOfSections : DWORD (+40, 4byte)  st.10 = 値  /  値 = st.10   (lpoke/lpeek も可)
; Sections : IMAGE_SECTION_HEADER* (+48, 8byte)  varptr(st)+48 を基点に操作(8byte:入れ子/配列)
; Characteristics : IMAGE_FILE_CHARACTERISTICS2 (+56, 4byte)  st.14 = 値  /  値 = st.14   (lpoke/lpeek も可)
; fSystemImage : BOOLEAN (+60, 1byte)  poke st,60,値  /  値 = peek(st,60)
; fDOSImage : BOOLEAN (+61, 1byte)  poke st,61,値  /  値 = peek(st,61)
; fReadOnly : BOOLEAN (+62, 1byte)  poke st,62,値  /  値 = peek(st,62)
; Version : BYTE (+63, 1byte)  poke st,63,値  /  値 = peek(st,63)
; Links : LIST_ENTRY (+64, 16byte)  varptr(st)+64 を基点に操作(16byte:入れ子/配列)
; SizeOfImage : DWORD (+80, 4byte)  st.20 = 値  /  値 = st.20   (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global LIST_ENTRY
    #field intptr Flink
    #field intptr Blink
#endstruct

#defstruct global LOADED_IMAGE
    #field intptr ModuleName
    #field intptr hFile
    #field intptr MappedAddress
    #field intptr FileHeader
    #field intptr LastRvaSection
    #field int NumberOfSections
    #field intptr Sections
    #field int Characteristics
    #field bool1 fSystemImage
    #field bool1 fDOSImage
    #field bool1 fReadOnly
    #field byte Version
    #field LIST_ENTRY Links
    #field int SizeOfImage
#endstruct

stdim st, LOADED_IMAGE        ; NSTRUCT 変数を確保
st->NumberOfSections = 100
mes "NumberOfSections=" + st->NumberOfSections