ホーム › System.Diagnostics.Etw › PROVIDER_FIELD_INFOARRAY

PROVIDER_FIELD_INFOARRAY

構造体

サイズx64: 24 バイト / x86: 24 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド	型	サイズ	x64	x86	説明
NumberOfElements	DWORD	4	+0	+0	FieldInfoArrayの要素数。
FieldType	EVENT_FIELD_TYPE	4	+4	+4	フィールドの種類(EVENT_FIELD_TYPE、キーワード/レベル等)。
FieldInfoArray	PROVIDER_FIELD_INFO	16	+8	+8	PROVIDER_FIELD_INFO配列の先頭。可変長。

各言語での定義

#include <windows.h>

// PROVIDER_FIELD_INFO  (x64 16 / x86 16 バイト)
typedef struct PROVIDER_FIELD_INFO {
    DWORD NameOffset;
    DWORD DescriptionOffset;
    ULONGLONG Value;
} PROVIDER_FIELD_INFO;

// PROVIDER_FIELD_INFOARRAY  (x64 24 / x86 24 バイト)
typedef struct PROVIDER_FIELD_INFOARRAY {
    DWORD NumberOfElements;
    EVENT_FIELD_TYPE FieldType;
    PROVIDER_FIELD_INFO FieldInfoArray[1];
} PROVIDER_FIELD_INFOARRAY;

using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PROVIDER_FIELD_INFO
{
    public uint NameOffset;
    public uint DescriptionOffset;
    public ulong Value;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PROVIDER_FIELD_INFOARRAY
{
    public uint NumberOfElements;
    public int FieldType;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)] public PROVIDER_FIELD_INFO[] FieldInfoArray;
}

Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure PROVIDER_FIELD_INFO
    Public NameOffset As UInteger
    Public DescriptionOffset As UInteger
    Public Value As ULong
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure PROVIDER_FIELD_INFOARRAY
    Public NumberOfElements As UInteger
    Public FieldType As Integer
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=1)> Public FieldInfoArray() As PROVIDER_FIELD_INFO
End Structure

import ctypes
from ctypes import wintypes

class PROVIDER_FIELD_INFO(ctypes.Structure):
    _fields_ = [
        ("NameOffset", wintypes.DWORD),
        ("DescriptionOffset", wintypes.DWORD),
        ("Value", ctypes.c_ulonglong),
    ]

class PROVIDER_FIELD_INFOARRAY(ctypes.Structure):
    _fields_ = [
        ("NumberOfElements", wintypes.DWORD),
        ("FieldType", ctypes.c_int),
        ("FieldInfoArray", PROVIDER_FIELD_INFO * 1),
    ]

#[repr(C)]
pub struct PROVIDER_FIELD_INFO {
    pub NameOffset: u32,
    pub DescriptionOffset: u32,
    pub Value: u64,
}

#[repr(C)]
pub struct PROVIDER_FIELD_INFOARRAY {
    pub NumberOfElements: u32,
    pub FieldType: i32,
    pub FieldInfoArray: [PROVIDER_FIELD_INFO; 1],
}

import "golang.org/x/sys/windows"

type PROVIDER_FIELD_INFO struct {
	NameOffset uint32
	DescriptionOffset uint32
	Value uint64
}

type PROVIDER_FIELD_INFOARRAY struct {
	NumberOfElements uint32
	FieldType int32
	FieldInfoArray [1]PROVIDER_FIELD_INFO
}

type
  PROVIDER_FIELD_INFO = record
    NameOffset: DWORD;
    DescriptionOffset: DWORD;
    Value: UInt64;
  end;

  PROVIDER_FIELD_INFOARRAY = record
    NumberOfElements: DWORD;
    FieldType: Integer;
    FieldInfoArray: array[0..0] of PROVIDER_FIELD_INFO;
  end;

const PROVIDER_FIELD_INFO = extern struct {
    NameOffset: u32,
    DescriptionOffset: u32,
    Value: u64,
};

const PROVIDER_FIELD_INFOARRAY = extern struct {
    NumberOfElements: u32,
    FieldType: i32,
    FieldInfoArray: [1]PROVIDER_FIELD_INFO,
};

type
  PROVIDER_FIELD_INFO {.bycopy.} = object
    NameOffset: uint32
    DescriptionOffset: uint32
    Value: uint64

  PROVIDER_FIELD_INFOARRAY {.bycopy.} = object
    NumberOfElements: uint32
    FieldType: int32
    FieldInfoArray: array[1, PROVIDER_FIELD_INFO]

struct PROVIDER_FIELD_INFO
{
    uint NameOffset;
    uint DescriptionOffset;
    ulong Value;
}

struct PROVIDER_FIELD_INFOARRAY
{
    uint NumberOfElements;
    int FieldType;
    PROVIDER_FIELD_INFO[1] FieldInfoArray;
}

HSP用定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; PROVIDER_FIELD_INFOARRAY サイズ: 24 バイト(x64)
dim st, 6    ; 4byte整数×6(構造体サイズ 24 / 4 切り上げ)
; NumberOfElements : DWORD (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; FieldType : EVENT_FIELD_TYPE (+4, 4byte)  st.1 = 値  /  値 = st.1   (lpoke/lpeek も可)
; FieldInfoArray : PROVIDER_FIELD_INFO (+8, 16byte)  varptr(st)+8 を基点に操作(16byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。

; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global PROVIDER_FIELD_INFO
    #field int NameOffset
    #field int DescriptionOffset
    #field int64 Value
#endstruct

#defstruct global PROVIDER_FIELD_INFOARRAY
    #field int NumberOfElements
    #field int FieldType
    #field PROVIDER_FIELD_INFO FieldInfoArray 1
#endstruct

stdim st, PROVIDER_FIELD_INFOARRAY        ; NSTRUCT 変数を確保
st->NumberOfElements = 100
mes "NumberOfElements=" + st->NumberOfElements

PROVIDER_FIELD_INFOARRAY

フィールド

各言語での定義

HSP用 定義

HSP用定義