ホーム › System.Diagnostics.ProcessSnapshotting › PSS_AUXILIARY_PAGE_ENTRY
PSS_AUXILIARY_PAGE_ENTRY
構造体サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。
フィールド
| フィールド | 型 | サイズ | x64 | x86 | 説明 |
|---|---|---|---|---|---|
| Address | void* | 8/4 | +0 | +0 | 補助ページの仮想アドレス。 |
| BasicInformation | MEMORY_BASIC_INFORMATION | 48/32 | +8 | +4 | ページの基本メモリ情報(MEMORY_BASIC_INFORMATION)。 |
| CaptureTime | FILETIME | 8 | +56 | +36 | ページをキャプチャした時刻(FILETIME)。 |
| PageContents | void* | 8/4 | +64 | +44 | ページ内容のコピーへのポインタ。NULL可。 |
| PageSize | DWORD | 4 | +72 | +48 | ページのサイズ。単位はバイト。 |
各言語での定義
#include <windows.h>
// MEMORY_BASIC_INFORMATION (x64 48 / x86 32 バイト)
typedef struct MEMORY_BASIC_INFORMATION {
void* BaseAddress;
void* AllocationBase;
PAGE_PROTECTION_FLAGS AllocationProtect;
WORD PartitionId;
UINT_PTR RegionSize;
VIRTUAL_ALLOCATION_TYPE State;
PAGE_PROTECTION_FLAGS Protect;
PAGE_TYPE Type;
} MEMORY_BASIC_INFORMATION;
// FILETIME (x64 8 / x86 8 バイト)
typedef struct FILETIME {
DWORD dwLowDateTime;
DWORD dwHighDateTime;
} FILETIME;
// PSS_AUXILIARY_PAGE_ENTRY (x64 80 / x86 52 バイト)
typedef struct PSS_AUXILIARY_PAGE_ENTRY {
void* Address;
MEMORY_BASIC_INFORMATION BasicInformation;
FILETIME CaptureTime;
void* PageContents;
DWORD PageSize;
} PSS_AUXILIARY_PAGE_ENTRY;using System;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct MEMORY_BASIC_INFORMATION
{
public IntPtr BaseAddress;
public IntPtr AllocationBase;
public uint AllocationProtect;
public ushort PartitionId;
public UIntPtr RegionSize;
public uint State;
public uint Protect;
public uint Type;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FILETIME
{
public uint dwLowDateTime;
public uint dwHighDateTime;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PSS_AUXILIARY_PAGE_ENTRY
{
public IntPtr Address;
public MEMORY_BASIC_INFORMATION BasicInformation;
public FILETIME CaptureTime;
public IntPtr PageContents;
public uint PageSize;
}Imports System.Runtime.InteropServices
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure MEMORY_BASIC_INFORMATION
Public BaseAddress As IntPtr
Public AllocationBase As IntPtr
Public AllocationProtect As UInteger
Public PartitionId As UShort
Public RegionSize As UIntPtr
Public State As UInteger
Public Protect As UInteger
Public Type As UInteger
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FILETIME
Public dwLowDateTime As UInteger
Public dwHighDateTime As UInteger
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure PSS_AUXILIARY_PAGE_ENTRY
Public Address As IntPtr
Public BasicInformation As MEMORY_BASIC_INFORMATION
Public CaptureTime As FILETIME
Public PageContents As IntPtr
Public PageSize As UInteger
End Structureimport ctypes
from ctypes import wintypes
class MEMORY_BASIC_INFORMATION(ctypes.Structure):
_fields_ = [
("BaseAddress", ctypes.c_void_p),
("AllocationBase", ctypes.c_void_p),
("AllocationProtect", wintypes.DWORD),
("PartitionId", ctypes.c_ushort),
("RegionSize", ctypes.c_size_t),
("State", wintypes.DWORD),
("Protect", wintypes.DWORD),
("Type", wintypes.DWORD),
]
class FILETIME(ctypes.Structure):
_fields_ = [
("dwLowDateTime", wintypes.DWORD),
("dwHighDateTime", wintypes.DWORD),
]
class PSS_AUXILIARY_PAGE_ENTRY(ctypes.Structure):
_fields_ = [
("Address", ctypes.c_void_p),
("BasicInformation", MEMORY_BASIC_INFORMATION),
("CaptureTime", FILETIME),
("PageContents", ctypes.c_void_p),
("PageSize", wintypes.DWORD),
]#[repr(C)]
pub struct MEMORY_BASIC_INFORMATION {
pub BaseAddress: *mut core::ffi::c_void,
pub AllocationBase: *mut core::ffi::c_void,
pub AllocationProtect: u32,
pub PartitionId: u16,
pub RegionSize: usize,
pub State: u32,
pub Protect: u32,
pub Type: u32,
}
#[repr(C)]
pub struct FILETIME {
pub dwLowDateTime: u32,
pub dwHighDateTime: u32,
}
#[repr(C)]
pub struct PSS_AUXILIARY_PAGE_ENTRY {
pub Address: *mut core::ffi::c_void,
pub BasicInformation: MEMORY_BASIC_INFORMATION,
pub CaptureTime: FILETIME,
pub PageContents: *mut core::ffi::c_void,
pub PageSize: u32,
}import "golang.org/x/sys/windows"
type MEMORY_BASIC_INFORMATION struct {
BaseAddress uintptr
AllocationBase uintptr
AllocationProtect uint32
PartitionId uint16
RegionSize uintptr
State uint32
Protect uint32
Type uint32
}
type FILETIME struct {
dwLowDateTime uint32
dwHighDateTime uint32
}
type PSS_AUXILIARY_PAGE_ENTRY struct {
Address uintptr
BasicInformation MEMORY_BASIC_INFORMATION
CaptureTime FILETIME
PageContents uintptr
PageSize uint32
}type
MEMORY_BASIC_INFORMATION = record
BaseAddress: Pointer;
AllocationBase: Pointer;
AllocationProtect: DWORD;
PartitionId: Word;
RegionSize: NativeUInt;
State: DWORD;
Protect: DWORD;
Type: DWORD;
end;
FILETIME = record
dwLowDateTime: DWORD;
dwHighDateTime: DWORD;
end;
PSS_AUXILIARY_PAGE_ENTRY = record
Address: Pointer;
BasicInformation: MEMORY_BASIC_INFORMATION;
CaptureTime: FILETIME;
PageContents: Pointer;
PageSize: DWORD;
end;const MEMORY_BASIC_INFORMATION = extern struct {
BaseAddress: ?*anyopaque,
AllocationBase: ?*anyopaque,
AllocationProtect: u32,
PartitionId: u16,
RegionSize: usize,
State: u32,
Protect: u32,
Type: u32,
};
const FILETIME = extern struct {
dwLowDateTime: u32,
dwHighDateTime: u32,
};
const PSS_AUXILIARY_PAGE_ENTRY = extern struct {
Address: ?*anyopaque,
BasicInformation: MEMORY_BASIC_INFORMATION,
CaptureTime: FILETIME,
PageContents: ?*anyopaque,
PageSize: u32,
};type
MEMORY_BASIC_INFORMATION {.bycopy.} = object
BaseAddress: pointer
AllocationBase: pointer
AllocationProtect: uint32
PartitionId: uint16
RegionSize: uint
State: uint32
Protect: uint32
Type: uint32
FILETIME {.bycopy.} = object
dwLowDateTime: uint32
dwHighDateTime: uint32
PSS_AUXILIARY_PAGE_ENTRY {.bycopy.} = object
Address: pointer
BasicInformation: MEMORY_BASIC_INFORMATION
CaptureTime: FILETIME
PageContents: pointer
PageSize: uint32struct MEMORY_BASIC_INFORMATION
{
void* BaseAddress;
void* AllocationBase;
uint AllocationProtect;
ushort PartitionId;
size_t RegionSize;
uint State;
uint Protect;
uint Type;
}
struct FILETIME
{
uint dwLowDateTime;
uint dwHighDateTime;
}
struct PSS_AUXILIARY_PAGE_ENTRY
{
void* Address;
MEMORY_BASIC_INFORMATION BasicInformation;
FILETIME CaptureTime;
void* PageContents;
uint PageSize;
}HSP用 定義
HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; PSS_AUXILIARY_PAGE_ENTRY サイズ: 52 バイト(x86)
dim st, 13 ; 4byte整数×13(構造体サイズ 52 / 4 切り上げ)
; Address : void* (+0, 4byte) st.0 = 値 / 値 = st.0 (lpoke/lpeek も可)
; BasicInformation : MEMORY_BASIC_INFORMATION (+4, 32byte) varptr(st)+4 を基点に操作(32byte:入れ子/配列)
; CaptureTime : FILETIME (+36, 8byte) varptr(st)+36 を基点に操作(8byte:入れ子/配列)
; PageContents : void* (+44, 4byte) st.11 = 値 / 値 = st.11 (lpoke/lpeek も可)
; PageSize : DWORD (+48, 4byte) st.12 = 値 / 値 = st.12 (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; PSS_AUXILIARY_PAGE_ENTRY サイズ: 80 バイト(x64)
dim st, 20 ; 4byte整数×20(構造体サイズ 80 / 4 切り上げ)
; Address : void* (+0, 8byte) qpoke st,0,値 / qpeek(st,0) ※IronHSPのみ。3.7/3.8は lpoke st,0,下位 : lpoke st,4,上位
; BasicInformation : MEMORY_BASIC_INFORMATION (+8, 48byte) varptr(st)+8 を基点に操作(48byte:入れ子/配列)
; CaptureTime : FILETIME (+56, 8byte) varptr(st)+56 を基点に操作(8byte:入れ子/配列)
; PageContents : void* (+64, 8byte) qpoke st,64,値 / qpeek(st,64) ※IronHSPのみ。3.7/3.8は lpoke st,64,下位 : lpoke st,68,上位
; PageSize : DWORD (+72, 4byte) st.18 = 値 / 値 = st.18 (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global MEMORY_BASIC_INFORMATION
#field intptr BaseAddress
#field intptr AllocationBase
#field int AllocationProtect
#field short PartitionId
#field intptr RegionSize
#field int State
#field int Protect
#field int Type
#endstruct
#defstruct global FILETIME
#field int dwLowDateTime
#field int dwHighDateTime
#endstruct
#defstruct global PSS_AUXILIARY_PAGE_ENTRY
#field intptr Address
#field MEMORY_BASIC_INFORMATION BasicInformation
#field FILETIME CaptureTime
#field intptr PageContents
#field int PageSize
#endstruct
stdim st, PSS_AUXILIARY_PAGE_ENTRY ; NSTRUCT 変数を確保
st->PageSize = 100
mes "PageSize=" + st->PageSize