Win32 API 日本語リファレンス
ホームSystem.Diagnostics.ProcessSnapshotting › PSS_HANDLE_ENTRY

PSS_HANDLE_ENTRY

構造体
サイズx64: 96 バイト / x86: 72 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールドサイズx64x86説明
HandleHANDLE8/4+0+0キャプチャされたハンドルの値。
FlagsPSS_HANDLE_FLAGS4+8+4ハンドルエントリのフラグ(PSS_HANDLE_FLAGS)。
ObjectTypePSS_OBJECT_TYPE4+12+8ハンドルが指すオブジェクトの種類(PSS_OBJECT_TYPE)。
CaptureTimeFILETIME8+16+12ハンドルをキャプチャした時刻(FILETIME)。
AttributesDWORD4+24+20ハンドルの属性。
GrantedAccessDWORD4+28+24ハンドルに付与されたアクセス権マスク。
HandleCountDWORD4+32+28オブジェクトを参照するハンドル数。
PointerCountDWORD4+36+32オブジェクトへの参照ポインタ数。
PagedPoolChargeDWORD4+40+36オブジェクトのページプール課金量。
NonPagedPoolChargeDWORD4+44+40オブジェクトの非ページプール課金量。
CreationTimeFILETIME8+48+44オブジェクトの作成時刻(FILETIME)。
TypeNameLengthWORD2+56+52TypeName文字列のバイト長。
TypeNameLPWSTR8/4+64+56オブジェクト型名(ワイド文字列)。
ObjectNameLengthWORD2+72+60ObjectName文字列のバイト長。
ObjectNameLPWSTR8/4+80+64オブジェクト名(ワイド文字列)。無しでNULL。
TypeSpecificInformation_TypeSpecificInformation_e__Union8/4+88+68オブジェクト型固有の追加情報を含む共用体。

共用体: _TypeSpecificInformation_e__Union x64 8B / x86 4B

フィールドサイズx64x86
Process_Process_e__Struct8/4+0+0
Thread_Thread_e__Struct8/4+0+0
Mutant_Mutant_e__Struct8/4+0+0
Event_Event_e__Struct8/4+0+0
Section_Section_e__Struct8/4+0+0
Semaphore_Semaphore_e__Struct8/4+0+0

各言語での定義

#include <windows.h>

// FILETIME  (x64 8 / x86 8 バイト)
typedef struct FILETIME {
    DWORD dwLowDateTime;
    DWORD dwHighDateTime;
} FILETIME;

// PSS_HANDLE_ENTRY  (x64 96 / x86 72 バイト)
typedef struct PSS_HANDLE_ENTRY {
    HANDLE Handle;
    PSS_HANDLE_FLAGS Flags;
    PSS_OBJECT_TYPE ObjectType;
    FILETIME CaptureTime;
    DWORD Attributes;
    DWORD GrantedAccess;
    DWORD HandleCount;
    DWORD PointerCount;
    DWORD PagedPoolCharge;
    DWORD NonPagedPoolCharge;
    FILETIME CreationTime;
    WORD TypeNameLength;
    LPWSTR TypeName;
    WORD ObjectNameLength;
    LPWSTR ObjectName;
    _TypeSpecificInformation_e__Union TypeSpecificInformation;
} PSS_HANDLE_ENTRY;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FILETIME
{
    public uint dwLowDateTime;
    public uint dwHighDateTime;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PSS_HANDLE_ENTRY
{
    public IntPtr Handle;
    public int Flags;
    public int ObjectType;
    public FILETIME CaptureTime;
    public uint Attributes;
    public uint GrantedAccess;
    public uint HandleCount;
    public uint PointerCount;
    public uint PagedPoolCharge;
    public uint NonPagedPoolCharge;
    public FILETIME CreationTime;
    public ushort TypeNameLength;
    public IntPtr TypeName;
    public ushort ObjectNameLength;
    public IntPtr ObjectName;
    public _TypeSpecificInformation_e__Union TypeSpecificInformation;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FILETIME
    Public dwLowDateTime As UInteger
    Public dwHighDateTime As UInteger
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure PSS_HANDLE_ENTRY
    Public Handle As IntPtr
    Public Flags As Integer
    Public ObjectType As Integer
    Public CaptureTime As FILETIME
    Public Attributes As UInteger
    Public GrantedAccess As UInteger
    Public HandleCount As UInteger
    Public PointerCount As UInteger
    Public PagedPoolCharge As UInteger
    Public NonPagedPoolCharge As UInteger
    Public CreationTime As FILETIME
    Public TypeNameLength As UShort
    Public TypeName As IntPtr
    Public ObjectNameLength As UShort
    Public ObjectName As IntPtr
    Public TypeSpecificInformation As _TypeSpecificInformation_e__Union
End Structure
import ctypes
from ctypes import wintypes

class FILETIME(ctypes.Structure):
    _fields_ = [
        ("dwLowDateTime", wintypes.DWORD),
        ("dwHighDateTime", wintypes.DWORD),
    ]

class PSS_HANDLE_ENTRY(ctypes.Structure):
    _fields_ = [
        ("Handle", ctypes.c_void_p),
        ("Flags", ctypes.c_int),
        ("ObjectType", ctypes.c_int),
        ("CaptureTime", FILETIME),
        ("Attributes", wintypes.DWORD),
        ("GrantedAccess", wintypes.DWORD),
        ("HandleCount", wintypes.DWORD),
        ("PointerCount", wintypes.DWORD),
        ("PagedPoolCharge", wintypes.DWORD),
        ("NonPagedPoolCharge", wintypes.DWORD),
        ("CreationTime", FILETIME),
        ("TypeNameLength", ctypes.c_ushort),
        ("TypeName", ctypes.c_void_p),
        ("ObjectNameLength", ctypes.c_ushort),
        ("ObjectName", ctypes.c_void_p),
        ("TypeSpecificInformation", _TypeSpecificInformation_e__Union),
    ]
#[repr(C)]
pub struct FILETIME {
    pub dwLowDateTime: u32,
    pub dwHighDateTime: u32,
}

#[repr(C)]
pub struct PSS_HANDLE_ENTRY {
    pub Handle: *mut core::ffi::c_void,
    pub Flags: i32,
    pub ObjectType: i32,
    pub CaptureTime: FILETIME,
    pub Attributes: u32,
    pub GrantedAccess: u32,
    pub HandleCount: u32,
    pub PointerCount: u32,
    pub PagedPoolCharge: u32,
    pub NonPagedPoolCharge: u32,
    pub CreationTime: FILETIME,
    pub TypeNameLength: u16,
    pub TypeName: *mut core::ffi::c_void,
    pub ObjectNameLength: u16,
    pub ObjectName: *mut core::ffi::c_void,
    pub TypeSpecificInformation: _TypeSpecificInformation_e__Union,
}
import "golang.org/x/sys/windows"

type FILETIME struct {
	dwLowDateTime uint32
	dwHighDateTime uint32
}

type PSS_HANDLE_ENTRY struct {
	Handle uintptr
	Flags int32
	ObjectType int32
	CaptureTime FILETIME
	Attributes uint32
	GrantedAccess uint32
	HandleCount uint32
	PointerCount uint32
	PagedPoolCharge uint32
	NonPagedPoolCharge uint32
	CreationTime FILETIME
	TypeNameLength uint16
	TypeName uintptr
	ObjectNameLength uint16
	ObjectName uintptr
	TypeSpecificInformation _TypeSpecificInformation_e__Union
}
type
  FILETIME = record
    dwLowDateTime: DWORD;
    dwHighDateTime: DWORD;
  end;

  PSS_HANDLE_ENTRY = record
    Handle: Pointer;
    Flags: Integer;
    ObjectType: Integer;
    CaptureTime: FILETIME;
    Attributes: DWORD;
    GrantedAccess: DWORD;
    HandleCount: DWORD;
    PointerCount: DWORD;
    PagedPoolCharge: DWORD;
    NonPagedPoolCharge: DWORD;
    CreationTime: FILETIME;
    TypeNameLength: Word;
    TypeName: Pointer;
    ObjectNameLength: Word;
    ObjectName: Pointer;
    TypeSpecificInformation: _TypeSpecificInformation_e__Union;
  end;
const FILETIME = extern struct {
    dwLowDateTime: u32,
    dwHighDateTime: u32,
};

const PSS_HANDLE_ENTRY = extern struct {
    Handle: ?*anyopaque,
    Flags: i32,
    ObjectType: i32,
    CaptureTime: FILETIME,
    Attributes: u32,
    GrantedAccess: u32,
    HandleCount: u32,
    PointerCount: u32,
    PagedPoolCharge: u32,
    NonPagedPoolCharge: u32,
    CreationTime: FILETIME,
    TypeNameLength: u16,
    TypeName: ?*anyopaque,
    ObjectNameLength: u16,
    ObjectName: ?*anyopaque,
    TypeSpecificInformation: _TypeSpecificInformation_e__Union,
};
type
  FILETIME {.bycopy.} = object
    dwLowDateTime: uint32
    dwHighDateTime: uint32

  PSS_HANDLE_ENTRY {.bycopy.} = object
    Handle: pointer
    Flags: int32
    ObjectType: int32
    CaptureTime: FILETIME
    Attributes: uint32
    GrantedAccess: uint32
    HandleCount: uint32
    PointerCount: uint32
    PagedPoolCharge: uint32
    NonPagedPoolCharge: uint32
    CreationTime: FILETIME
    TypeNameLength: uint16
    TypeName: pointer
    ObjectNameLength: uint16
    ObjectName: pointer
    TypeSpecificInformation: _TypeSpecificInformation_e__Union
struct FILETIME
{
    uint dwLowDateTime;
    uint dwHighDateTime;
}

struct PSS_HANDLE_ENTRY
{
    void* Handle;
    int Flags;
    int ObjectType;
    FILETIME CaptureTime;
    uint Attributes;
    uint GrantedAccess;
    uint HandleCount;
    uint PointerCount;
    uint PagedPoolCharge;
    uint NonPagedPoolCharge;
    FILETIME CreationTime;
    ushort TypeNameLength;
    void* TypeName;
    ushort ObjectNameLength;
    void* ObjectName;
    _TypeSpecificInformation_e__Union TypeSpecificInformation;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; PSS_HANDLE_ENTRY サイズ: 72 バイト(x86)
dim st, 18    ; 4byte整数×18(構造体サイズ 72 / 4 切り上げ)
; Handle : HANDLE (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; Flags : PSS_HANDLE_FLAGS (+4, 4byte)  st.1 = 値  /  値 = st.1   (lpoke/lpeek も可)
; ObjectType : PSS_OBJECT_TYPE (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; CaptureTime : FILETIME (+12, 8byte)  varptr(st)+12 を基点に操作(8byte:入れ子/配列)
; Attributes : DWORD (+20, 4byte)  st.5 = 値  /  値 = st.5   (lpoke/lpeek も可)
; GrantedAccess : DWORD (+24, 4byte)  st.6 = 値  /  値 = st.6   (lpoke/lpeek も可)
; HandleCount : DWORD (+28, 4byte)  st.7 = 値  /  値 = st.7   (lpoke/lpeek も可)
; PointerCount : DWORD (+32, 4byte)  st.8 = 値  /  値 = st.8   (lpoke/lpeek も可)
; PagedPoolCharge : DWORD (+36, 4byte)  st.9 = 値  /  値 = st.9   (lpoke/lpeek も可)
; NonPagedPoolCharge : DWORD (+40, 4byte)  st.10 = 値  /  値 = st.10   (lpoke/lpeek も可)
; CreationTime : FILETIME (+44, 8byte)  varptr(st)+44 を基点に操作(8byte:入れ子/配列)
; TypeNameLength : WORD (+52, 2byte)  wpoke st,52,値  /  値 = wpeek(st,52)
; TypeName : LPWSTR (+56, 4byte)  st.14 = 値  /  値 = st.14   (lpoke/lpeek も可)
; ObjectNameLength : WORD (+60, 2byte)  wpoke st,60,値  /  値 = wpeek(st,60)
; ObjectName : LPWSTR (+64, 4byte)  st.16 = 値  /  値 = st.16   (lpoke/lpeek も可)
; TypeSpecificInformation : _TypeSpecificInformation_e__Union (+68, 4byte)  varptr(st)+68 を基点に操作(4byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; PSS_HANDLE_ENTRY サイズ: 96 バイト(x64)
dim st, 24    ; 4byte整数×24(構造体サイズ 96 / 4 切り上げ)
; Handle : HANDLE (+0, 8byte)  qpoke st,0,値 / qpeek(st,0)  ※IronHSPのみ。3.7/3.8は lpoke st,0,下位 : lpoke st,4,上位
; Flags : PSS_HANDLE_FLAGS (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; ObjectType : PSS_OBJECT_TYPE (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; CaptureTime : FILETIME (+16, 8byte)  varptr(st)+16 を基点に操作(8byte:入れ子/配列)
; Attributes : DWORD (+24, 4byte)  st.6 = 値  /  値 = st.6   (lpoke/lpeek も可)
; GrantedAccess : DWORD (+28, 4byte)  st.7 = 値  /  値 = st.7   (lpoke/lpeek も可)
; HandleCount : DWORD (+32, 4byte)  st.8 = 値  /  値 = st.8   (lpoke/lpeek も可)
; PointerCount : DWORD (+36, 4byte)  st.9 = 値  /  値 = st.9   (lpoke/lpeek も可)
; PagedPoolCharge : DWORD (+40, 4byte)  st.10 = 値  /  値 = st.10   (lpoke/lpeek も可)
; NonPagedPoolCharge : DWORD (+44, 4byte)  st.11 = 値  /  値 = st.11   (lpoke/lpeek も可)
; CreationTime : FILETIME (+48, 8byte)  varptr(st)+48 を基点に操作(8byte:入れ子/配列)
; TypeNameLength : WORD (+56, 2byte)  wpoke st,56,値  /  値 = wpeek(st,56)
; TypeName : LPWSTR (+64, 8byte)  qpoke st,64,値 / qpeek(st,64)  ※IronHSPのみ。3.7/3.8は lpoke st,64,下位 : lpoke st,68,上位
; ObjectNameLength : WORD (+72, 2byte)  wpoke st,72,値  /  値 = wpeek(st,72)
; ObjectName : LPWSTR (+80, 8byte)  qpoke st,80,値 / qpeek(st,80)  ※IronHSPのみ。3.7/3.8は lpoke st,80,下位 : lpoke st,84,上位
; TypeSpecificInformation : _TypeSpecificInformation_e__Union (+88, 8byte)  varptr(st)+88 を基点に操作(8byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global FILETIME
    #field int dwLowDateTime
    #field int dwHighDateTime
#endstruct

#defstruct global PSS_HANDLE_ENTRY
    #field intptr Handle
    #field int Flags
    #field int ObjectType
    #field FILETIME CaptureTime
    #field int Attributes
    #field int GrantedAccess
    #field int HandleCount
    #field int PointerCount
    #field int PagedPoolCharge
    #field int NonPagedPoolCharge
    #field FILETIME CreationTime
    #field short TypeNameLength
    #field intptr TypeName
    #field short ObjectNameLength
    #field intptr ObjectName
    #field byte TypeSpecificInformation 8
#endstruct

stdim st, PSS_HANDLE_ENTRY        ; NSTRUCT 変数を確保
st->Flags = 100
mes "Flags=" + st->Flags
; ※union フィールドは byte 列で確保(NSTRUCT は union 非対応)。必要に応じ手動でアクセス。