ホーム › System.Diagnostics.ProcessSnapshotting › PSS_HANDLE_ENTRY
PSS_HANDLE_ENTRY
構造体サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。
フィールド
| フィールド | 型 | サイズ | x64 | x86 | 説明 |
|---|---|---|---|---|---|
| Handle | HANDLE | 8/4 | +0 | +0 | キャプチャされたハンドルの値。 |
| Flags | PSS_HANDLE_FLAGS | 4 | +8 | +4 | ハンドルエントリのフラグ(PSS_HANDLE_FLAGS)。 |
| ObjectType | PSS_OBJECT_TYPE | 4 | +12 | +8 | ハンドルが指すオブジェクトの種類(PSS_OBJECT_TYPE)。 |
| CaptureTime | FILETIME | 8 | +16 | +12 | ハンドルをキャプチャした時刻(FILETIME)。 |
| Attributes | DWORD | 4 | +24 | +20 | ハンドルの属性。 |
| GrantedAccess | DWORD | 4 | +28 | +24 | ハンドルに付与されたアクセス権マスク。 |
| HandleCount | DWORD | 4 | +32 | +28 | オブジェクトを参照するハンドル数。 |
| PointerCount | DWORD | 4 | +36 | +32 | オブジェクトへの参照ポインタ数。 |
| PagedPoolCharge | DWORD | 4 | +40 | +36 | オブジェクトのページプール課金量。 |
| NonPagedPoolCharge | DWORD | 4 | +44 | +40 | オブジェクトの非ページプール課金量。 |
| CreationTime | FILETIME | 8 | +48 | +44 | オブジェクトの作成時刻(FILETIME)。 |
| TypeNameLength | WORD | 2 | +56 | +52 | TypeName文字列のバイト長。 |
| TypeName | LPWSTR | 8/4 | +64 | +56 | オブジェクト型名(ワイド文字列)。 |
| ObjectNameLength | WORD | 2 | +72 | +60 | ObjectName文字列のバイト長。 |
| ObjectName | LPWSTR | 8/4 | +80 | +64 | オブジェクト名(ワイド文字列)。無しでNULL。 |
| TypeSpecificInformation | _TypeSpecificInformation_e__Union | 8/4 | +88 | +68 | オブジェクト型固有の追加情報を含む共用体。 |
共用体: _TypeSpecificInformation_e__Union x64 8B / x86 4B
| フィールド | 型 | サイズ | x64 | x86 |
|---|---|---|---|---|
| Process | _Process_e__Struct | 8/4 | +0 | +0 |
| Thread | _Thread_e__Struct | 8/4 | +0 | +0 |
| Mutant | _Mutant_e__Struct | 8/4 | +0 | +0 |
| Event | _Event_e__Struct | 8/4 | +0 | +0 |
| Section | _Section_e__Struct | 8/4 | +0 | +0 |
| Semaphore | _Semaphore_e__Struct | 8/4 | +0 | +0 |
各言語での定義
#include <windows.h>
// FILETIME (x64 8 / x86 8 バイト)
typedef struct FILETIME {
DWORD dwLowDateTime;
DWORD dwHighDateTime;
} FILETIME;
// PSS_HANDLE_ENTRY (x64 96 / x86 72 バイト)
typedef struct PSS_HANDLE_ENTRY {
HANDLE Handle;
PSS_HANDLE_FLAGS Flags;
PSS_OBJECT_TYPE ObjectType;
FILETIME CaptureTime;
DWORD Attributes;
DWORD GrantedAccess;
DWORD HandleCount;
DWORD PointerCount;
DWORD PagedPoolCharge;
DWORD NonPagedPoolCharge;
FILETIME CreationTime;
WORD TypeNameLength;
LPWSTR TypeName;
WORD ObjectNameLength;
LPWSTR ObjectName;
_TypeSpecificInformation_e__Union TypeSpecificInformation;
} PSS_HANDLE_ENTRY;using System;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FILETIME
{
public uint dwLowDateTime;
public uint dwHighDateTime;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PSS_HANDLE_ENTRY
{
public IntPtr Handle;
public int Flags;
public int ObjectType;
public FILETIME CaptureTime;
public uint Attributes;
public uint GrantedAccess;
public uint HandleCount;
public uint PointerCount;
public uint PagedPoolCharge;
public uint NonPagedPoolCharge;
public FILETIME CreationTime;
public ushort TypeNameLength;
public IntPtr TypeName;
public ushort ObjectNameLength;
public IntPtr ObjectName;
public _TypeSpecificInformation_e__Union TypeSpecificInformation;
}Imports System.Runtime.InteropServices
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FILETIME
Public dwLowDateTime As UInteger
Public dwHighDateTime As UInteger
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure PSS_HANDLE_ENTRY
Public Handle As IntPtr
Public Flags As Integer
Public ObjectType As Integer
Public CaptureTime As FILETIME
Public Attributes As UInteger
Public GrantedAccess As UInteger
Public HandleCount As UInteger
Public PointerCount As UInteger
Public PagedPoolCharge As UInteger
Public NonPagedPoolCharge As UInteger
Public CreationTime As FILETIME
Public TypeNameLength As UShort
Public TypeName As IntPtr
Public ObjectNameLength As UShort
Public ObjectName As IntPtr
Public TypeSpecificInformation As _TypeSpecificInformation_e__Union
End Structureimport ctypes
from ctypes import wintypes
class FILETIME(ctypes.Structure):
_fields_ = [
("dwLowDateTime", wintypes.DWORD),
("dwHighDateTime", wintypes.DWORD),
]
class PSS_HANDLE_ENTRY(ctypes.Structure):
_fields_ = [
("Handle", ctypes.c_void_p),
("Flags", ctypes.c_int),
("ObjectType", ctypes.c_int),
("CaptureTime", FILETIME),
("Attributes", wintypes.DWORD),
("GrantedAccess", wintypes.DWORD),
("HandleCount", wintypes.DWORD),
("PointerCount", wintypes.DWORD),
("PagedPoolCharge", wintypes.DWORD),
("NonPagedPoolCharge", wintypes.DWORD),
("CreationTime", FILETIME),
("TypeNameLength", ctypes.c_ushort),
("TypeName", ctypes.c_void_p),
("ObjectNameLength", ctypes.c_ushort),
("ObjectName", ctypes.c_void_p),
("TypeSpecificInformation", _TypeSpecificInformation_e__Union),
]#[repr(C)]
pub struct FILETIME {
pub dwLowDateTime: u32,
pub dwHighDateTime: u32,
}
#[repr(C)]
pub struct PSS_HANDLE_ENTRY {
pub Handle: *mut core::ffi::c_void,
pub Flags: i32,
pub ObjectType: i32,
pub CaptureTime: FILETIME,
pub Attributes: u32,
pub GrantedAccess: u32,
pub HandleCount: u32,
pub PointerCount: u32,
pub PagedPoolCharge: u32,
pub NonPagedPoolCharge: u32,
pub CreationTime: FILETIME,
pub TypeNameLength: u16,
pub TypeName: *mut core::ffi::c_void,
pub ObjectNameLength: u16,
pub ObjectName: *mut core::ffi::c_void,
pub TypeSpecificInformation: _TypeSpecificInformation_e__Union,
}import "golang.org/x/sys/windows"
type FILETIME struct {
dwLowDateTime uint32
dwHighDateTime uint32
}
type PSS_HANDLE_ENTRY struct {
Handle uintptr
Flags int32
ObjectType int32
CaptureTime FILETIME
Attributes uint32
GrantedAccess uint32
HandleCount uint32
PointerCount uint32
PagedPoolCharge uint32
NonPagedPoolCharge uint32
CreationTime FILETIME
TypeNameLength uint16
TypeName uintptr
ObjectNameLength uint16
ObjectName uintptr
TypeSpecificInformation _TypeSpecificInformation_e__Union
}type
FILETIME = record
dwLowDateTime: DWORD;
dwHighDateTime: DWORD;
end;
PSS_HANDLE_ENTRY = record
Handle: Pointer;
Flags: Integer;
ObjectType: Integer;
CaptureTime: FILETIME;
Attributes: DWORD;
GrantedAccess: DWORD;
HandleCount: DWORD;
PointerCount: DWORD;
PagedPoolCharge: DWORD;
NonPagedPoolCharge: DWORD;
CreationTime: FILETIME;
TypeNameLength: Word;
TypeName: Pointer;
ObjectNameLength: Word;
ObjectName: Pointer;
TypeSpecificInformation: _TypeSpecificInformation_e__Union;
end;const FILETIME = extern struct {
dwLowDateTime: u32,
dwHighDateTime: u32,
};
const PSS_HANDLE_ENTRY = extern struct {
Handle: ?*anyopaque,
Flags: i32,
ObjectType: i32,
CaptureTime: FILETIME,
Attributes: u32,
GrantedAccess: u32,
HandleCount: u32,
PointerCount: u32,
PagedPoolCharge: u32,
NonPagedPoolCharge: u32,
CreationTime: FILETIME,
TypeNameLength: u16,
TypeName: ?*anyopaque,
ObjectNameLength: u16,
ObjectName: ?*anyopaque,
TypeSpecificInformation: _TypeSpecificInformation_e__Union,
};type
FILETIME {.bycopy.} = object
dwLowDateTime: uint32
dwHighDateTime: uint32
PSS_HANDLE_ENTRY {.bycopy.} = object
Handle: pointer
Flags: int32
ObjectType: int32
CaptureTime: FILETIME
Attributes: uint32
GrantedAccess: uint32
HandleCount: uint32
PointerCount: uint32
PagedPoolCharge: uint32
NonPagedPoolCharge: uint32
CreationTime: FILETIME
TypeNameLength: uint16
TypeName: pointer
ObjectNameLength: uint16
ObjectName: pointer
TypeSpecificInformation: _TypeSpecificInformation_e__Unionstruct FILETIME
{
uint dwLowDateTime;
uint dwHighDateTime;
}
struct PSS_HANDLE_ENTRY
{
void* Handle;
int Flags;
int ObjectType;
FILETIME CaptureTime;
uint Attributes;
uint GrantedAccess;
uint HandleCount;
uint PointerCount;
uint PagedPoolCharge;
uint NonPagedPoolCharge;
FILETIME CreationTime;
ushort TypeNameLength;
void* TypeName;
ushort ObjectNameLength;
void* ObjectName;
_TypeSpecificInformation_e__Union TypeSpecificInformation;
}HSP用 定義
HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; PSS_HANDLE_ENTRY サイズ: 72 バイト(x86)
dim st, 18 ; 4byte整数×18(構造体サイズ 72 / 4 切り上げ)
; Handle : HANDLE (+0, 4byte) st.0 = 値 / 値 = st.0 (lpoke/lpeek も可)
; Flags : PSS_HANDLE_FLAGS (+4, 4byte) st.1 = 値 / 値 = st.1 (lpoke/lpeek も可)
; ObjectType : PSS_OBJECT_TYPE (+8, 4byte) st.2 = 値 / 値 = st.2 (lpoke/lpeek も可)
; CaptureTime : FILETIME (+12, 8byte) varptr(st)+12 を基点に操作(8byte:入れ子/配列)
; Attributes : DWORD (+20, 4byte) st.5 = 値 / 値 = st.5 (lpoke/lpeek も可)
; GrantedAccess : DWORD (+24, 4byte) st.6 = 値 / 値 = st.6 (lpoke/lpeek も可)
; HandleCount : DWORD (+28, 4byte) st.7 = 値 / 値 = st.7 (lpoke/lpeek も可)
; PointerCount : DWORD (+32, 4byte) st.8 = 値 / 値 = st.8 (lpoke/lpeek も可)
; PagedPoolCharge : DWORD (+36, 4byte) st.9 = 値 / 値 = st.9 (lpoke/lpeek も可)
; NonPagedPoolCharge : DWORD (+40, 4byte) st.10 = 値 / 値 = st.10 (lpoke/lpeek も可)
; CreationTime : FILETIME (+44, 8byte) varptr(st)+44 を基点に操作(8byte:入れ子/配列)
; TypeNameLength : WORD (+52, 2byte) wpoke st,52,値 / 値 = wpeek(st,52)
; TypeName : LPWSTR (+56, 4byte) st.14 = 値 / 値 = st.14 (lpoke/lpeek も可)
; ObjectNameLength : WORD (+60, 2byte) wpoke st,60,値 / 値 = wpeek(st,60)
; ObjectName : LPWSTR (+64, 4byte) st.16 = 値 / 値 = st.16 (lpoke/lpeek も可)
; TypeSpecificInformation : _TypeSpecificInformation_e__Union (+68, 4byte) varptr(st)+68 を基点に操作(4byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; PSS_HANDLE_ENTRY サイズ: 96 バイト(x64)
dim st, 24 ; 4byte整数×24(構造体サイズ 96 / 4 切り上げ)
; Handle : HANDLE (+0, 8byte) qpoke st,0,値 / qpeek(st,0) ※IronHSPのみ。3.7/3.8は lpoke st,0,下位 : lpoke st,4,上位
; Flags : PSS_HANDLE_FLAGS (+8, 4byte) st.2 = 値 / 値 = st.2 (lpoke/lpeek も可)
; ObjectType : PSS_OBJECT_TYPE (+12, 4byte) st.3 = 値 / 値 = st.3 (lpoke/lpeek も可)
; CaptureTime : FILETIME (+16, 8byte) varptr(st)+16 を基点に操作(8byte:入れ子/配列)
; Attributes : DWORD (+24, 4byte) st.6 = 値 / 値 = st.6 (lpoke/lpeek も可)
; GrantedAccess : DWORD (+28, 4byte) st.7 = 値 / 値 = st.7 (lpoke/lpeek も可)
; HandleCount : DWORD (+32, 4byte) st.8 = 値 / 値 = st.8 (lpoke/lpeek も可)
; PointerCount : DWORD (+36, 4byte) st.9 = 値 / 値 = st.9 (lpoke/lpeek も可)
; PagedPoolCharge : DWORD (+40, 4byte) st.10 = 値 / 値 = st.10 (lpoke/lpeek も可)
; NonPagedPoolCharge : DWORD (+44, 4byte) st.11 = 値 / 値 = st.11 (lpoke/lpeek も可)
; CreationTime : FILETIME (+48, 8byte) varptr(st)+48 を基点に操作(8byte:入れ子/配列)
; TypeNameLength : WORD (+56, 2byte) wpoke st,56,値 / 値 = wpeek(st,56)
; TypeName : LPWSTR (+64, 8byte) qpoke st,64,値 / qpeek(st,64) ※IronHSPのみ。3.7/3.8は lpoke st,64,下位 : lpoke st,68,上位
; ObjectNameLength : WORD (+72, 2byte) wpoke st,72,値 / 値 = wpeek(st,72)
; ObjectName : LPWSTR (+80, 8byte) qpoke st,80,値 / qpeek(st,80) ※IronHSPのみ。3.7/3.8は lpoke st,80,下位 : lpoke st,84,上位
; TypeSpecificInformation : _TypeSpecificInformation_e__Union (+88, 8byte) varptr(st)+88 を基点に操作(8byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global FILETIME
#field int dwLowDateTime
#field int dwHighDateTime
#endstruct
#defstruct global PSS_HANDLE_ENTRY
#field intptr Handle
#field int Flags
#field int ObjectType
#field FILETIME CaptureTime
#field int Attributes
#field int GrantedAccess
#field int HandleCount
#field int PointerCount
#field int PagedPoolCharge
#field int NonPagedPoolCharge
#field FILETIME CreationTime
#field short TypeNameLength
#field intptr TypeName
#field short ObjectNameLength
#field intptr ObjectName
#field byte TypeSpecificInformation 8
#endstruct
stdim st, PSS_HANDLE_ENTRY ; NSTRUCT 変数を確保
st->Flags = 100
mes "Flags=" + st->Flags
; ※union フィールドは byte 列で確保(NSTRUCT は union 非対応)。必要に応じ手動でアクセス。