ホーム › System.Diagnostics.ProcessSnapshotting › PSS_THREAD_ENTRY
PSS_THREAD_ENTRY
構造体サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。
フィールド
| フィールド | 型 | サイズ | x64 | x86 | 説明 |
|---|---|---|---|---|---|
| ExitStatus | DWORD | 4 | +0 | +0 | スレッドの終了コード。実行中はSTILL_ACTIVE。 |
| TebBaseAddress | void* | 8/4 | +8 | +4 | スレッド環境ブロック(TEB)のベースアドレス。 |
| ProcessId | DWORD | 4 | +16 | +8 | スレッドが属するプロセスのID。 |
| ThreadId | DWORD | 4 | +20 | +12 | スレッドのID。 |
| AffinityMask | UINT_PTR | 8/4 | +24 | +16 | スレッドのプロセッサアフィニティマスク。 |
| Priority | INT | 4 | +32 | +20 | スレッドの現在の優先度。 |
| BasePriority | INT | 4 | +36 | +24 | スレッドの基本優先度。 |
| LastSyscallFirstArgument | void* | 8/4 | +40 | +28 | 直近のシステムコールの第1引数。 |
| LastSyscallNumber | WORD | 2 | +48 | +32 | 直近のシステムコール番号。 |
| CreateTime | FILETIME | 8 | +52 | +36 | スレッドの作成時刻(FILETIME)。 |
| ExitTime | FILETIME | 8 | +60 | +44 | スレッドの終了時刻。実行中は0。 |
| KernelTime | FILETIME | 8 | +68 | +52 | カーネルモードで費やした累積時間。 |
| UserTime | FILETIME | 8 | +76 | +60 | ユーザーモードで費やした累積時間。 |
| Win32StartAddress | void* | 8/4 | +88 | +68 | スレッドの開始アドレス。 |
| CaptureTime | FILETIME | 8 | +96 | +72 | スレッドをキャプチャした時刻(FILETIME)。 |
| Flags | PSS_THREAD_FLAGS | 4 | +104 | +80 | スレッドエントリのフラグ(PSS_THREAD_FLAGS)。 |
| SuspendCount | WORD | 2 | +108 | +84 | スレッドのサスペンドカウント。 |
| SizeOfContextRecord | WORD | 2 | +110 | +86 | ContextRecordのバイトサイズ。 |
| ContextRecord | CONTEXT* | 8/4 | +112 | +88 | スレッドのレジスタ状態(CONTEXT)へのポインタ。NULL可。 |
各言語での定義
#include <windows.h>
// FILETIME (x64 8 / x86 8 バイト)
typedef struct FILETIME {
DWORD dwLowDateTime;
DWORD dwHighDateTime;
} FILETIME;
// PSS_THREAD_ENTRY (x64 120 / x86 92 バイト)
typedef struct PSS_THREAD_ENTRY {
DWORD ExitStatus;
void* TebBaseAddress;
DWORD ProcessId;
DWORD ThreadId;
UINT_PTR AffinityMask;
INT Priority;
INT BasePriority;
void* LastSyscallFirstArgument;
WORD LastSyscallNumber;
FILETIME CreateTime;
FILETIME ExitTime;
FILETIME KernelTime;
FILETIME UserTime;
void* Win32StartAddress;
FILETIME CaptureTime;
PSS_THREAD_FLAGS Flags;
WORD SuspendCount;
WORD SizeOfContextRecord;
CONTEXT* ContextRecord;
} PSS_THREAD_ENTRY;using System;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FILETIME
{
public uint dwLowDateTime;
public uint dwHighDateTime;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PSS_THREAD_ENTRY
{
public uint ExitStatus;
public IntPtr TebBaseAddress;
public uint ProcessId;
public uint ThreadId;
public UIntPtr AffinityMask;
public int Priority;
public int BasePriority;
public IntPtr LastSyscallFirstArgument;
public ushort LastSyscallNumber;
public FILETIME CreateTime;
public FILETIME ExitTime;
public FILETIME KernelTime;
public FILETIME UserTime;
public IntPtr Win32StartAddress;
public FILETIME CaptureTime;
public int Flags;
public ushort SuspendCount;
public ushort SizeOfContextRecord;
public IntPtr ContextRecord;
}Imports System.Runtime.InteropServices
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FILETIME
Public dwLowDateTime As UInteger
Public dwHighDateTime As UInteger
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure PSS_THREAD_ENTRY
Public ExitStatus As UInteger
Public TebBaseAddress As IntPtr
Public ProcessId As UInteger
Public ThreadId As UInteger
Public AffinityMask As UIntPtr
Public Priority As Integer
Public BasePriority As Integer
Public LastSyscallFirstArgument As IntPtr
Public LastSyscallNumber As UShort
Public CreateTime As FILETIME
Public ExitTime As FILETIME
Public KernelTime As FILETIME
Public UserTime As FILETIME
Public Win32StartAddress As IntPtr
Public CaptureTime As FILETIME
Public Flags As Integer
Public SuspendCount As UShort
Public SizeOfContextRecord As UShort
Public ContextRecord As IntPtr
End Structureimport ctypes
from ctypes import wintypes
class FILETIME(ctypes.Structure):
_fields_ = [
("dwLowDateTime", wintypes.DWORD),
("dwHighDateTime", wintypes.DWORD),
]
class PSS_THREAD_ENTRY(ctypes.Structure):
_fields_ = [
("ExitStatus", wintypes.DWORD),
("TebBaseAddress", ctypes.c_void_p),
("ProcessId", wintypes.DWORD),
("ThreadId", wintypes.DWORD),
("AffinityMask", ctypes.c_size_t),
("Priority", ctypes.c_int),
("BasePriority", ctypes.c_int),
("LastSyscallFirstArgument", ctypes.c_void_p),
("LastSyscallNumber", ctypes.c_ushort),
("CreateTime", FILETIME),
("ExitTime", FILETIME),
("KernelTime", FILETIME),
("UserTime", FILETIME),
("Win32StartAddress", ctypes.c_void_p),
("CaptureTime", FILETIME),
("Flags", ctypes.c_int),
("SuspendCount", ctypes.c_ushort),
("SizeOfContextRecord", ctypes.c_ushort),
("ContextRecord", ctypes.c_void_p),
]#[repr(C)]
pub struct FILETIME {
pub dwLowDateTime: u32,
pub dwHighDateTime: u32,
}
#[repr(C)]
pub struct PSS_THREAD_ENTRY {
pub ExitStatus: u32,
pub TebBaseAddress: *mut core::ffi::c_void,
pub ProcessId: u32,
pub ThreadId: u32,
pub AffinityMask: usize,
pub Priority: i32,
pub BasePriority: i32,
pub LastSyscallFirstArgument: *mut core::ffi::c_void,
pub LastSyscallNumber: u16,
pub CreateTime: FILETIME,
pub ExitTime: FILETIME,
pub KernelTime: FILETIME,
pub UserTime: FILETIME,
pub Win32StartAddress: *mut core::ffi::c_void,
pub CaptureTime: FILETIME,
pub Flags: i32,
pub SuspendCount: u16,
pub SizeOfContextRecord: u16,
pub ContextRecord: *mut core::ffi::c_void,
}import "golang.org/x/sys/windows"
type FILETIME struct {
dwLowDateTime uint32
dwHighDateTime uint32
}
type PSS_THREAD_ENTRY struct {
ExitStatus uint32
TebBaseAddress uintptr
ProcessId uint32
ThreadId uint32
AffinityMask uintptr
Priority int32
BasePriority int32
LastSyscallFirstArgument uintptr
LastSyscallNumber uint16
CreateTime FILETIME
ExitTime FILETIME
KernelTime FILETIME
UserTime FILETIME
Win32StartAddress uintptr
CaptureTime FILETIME
Flags int32
SuspendCount uint16
SizeOfContextRecord uint16
ContextRecord uintptr
}type
FILETIME = record
dwLowDateTime: DWORD;
dwHighDateTime: DWORD;
end;
PSS_THREAD_ENTRY = record
ExitStatus: DWORD;
TebBaseAddress: Pointer;
ProcessId: DWORD;
ThreadId: DWORD;
AffinityMask: NativeUInt;
Priority: Integer;
BasePriority: Integer;
LastSyscallFirstArgument: Pointer;
LastSyscallNumber: Word;
CreateTime: FILETIME;
ExitTime: FILETIME;
KernelTime: FILETIME;
UserTime: FILETIME;
Win32StartAddress: Pointer;
CaptureTime: FILETIME;
Flags: Integer;
SuspendCount: Word;
SizeOfContextRecord: Word;
ContextRecord: Pointer;
end;const FILETIME = extern struct {
dwLowDateTime: u32,
dwHighDateTime: u32,
};
const PSS_THREAD_ENTRY = extern struct {
ExitStatus: u32,
TebBaseAddress: ?*anyopaque,
ProcessId: u32,
ThreadId: u32,
AffinityMask: usize,
Priority: i32,
BasePriority: i32,
LastSyscallFirstArgument: ?*anyopaque,
LastSyscallNumber: u16,
CreateTime: FILETIME,
ExitTime: FILETIME,
KernelTime: FILETIME,
UserTime: FILETIME,
Win32StartAddress: ?*anyopaque,
CaptureTime: FILETIME,
Flags: i32,
SuspendCount: u16,
SizeOfContextRecord: u16,
ContextRecord: ?*anyopaque,
};type
FILETIME {.bycopy.} = object
dwLowDateTime: uint32
dwHighDateTime: uint32
PSS_THREAD_ENTRY {.bycopy.} = object
ExitStatus: uint32
TebBaseAddress: pointer
ProcessId: uint32
ThreadId: uint32
AffinityMask: uint
Priority: int32
BasePriority: int32
LastSyscallFirstArgument: pointer
LastSyscallNumber: uint16
CreateTime: FILETIME
ExitTime: FILETIME
KernelTime: FILETIME
UserTime: FILETIME
Win32StartAddress: pointer
CaptureTime: FILETIME
Flags: int32
SuspendCount: uint16
SizeOfContextRecord: uint16
ContextRecord: pointerstruct FILETIME
{
uint dwLowDateTime;
uint dwHighDateTime;
}
struct PSS_THREAD_ENTRY
{
uint ExitStatus;
void* TebBaseAddress;
uint ProcessId;
uint ThreadId;
size_t AffinityMask;
int Priority;
int BasePriority;
void* LastSyscallFirstArgument;
ushort LastSyscallNumber;
FILETIME CreateTime;
FILETIME ExitTime;
FILETIME KernelTime;
FILETIME UserTime;
void* Win32StartAddress;
FILETIME CaptureTime;
int Flags;
ushort SuspendCount;
ushort SizeOfContextRecord;
void* ContextRecord;
}HSP用 定義
HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; PSS_THREAD_ENTRY サイズ: 92 バイト(x86)
dim st, 23 ; 4byte整数×23(構造体サイズ 92 / 4 切り上げ)
; ExitStatus : DWORD (+0, 4byte) st.0 = 値 / 値 = st.0 (lpoke/lpeek も可)
; TebBaseAddress : void* (+4, 4byte) st.1 = 値 / 値 = st.1 (lpoke/lpeek も可)
; ProcessId : DWORD (+8, 4byte) st.2 = 値 / 値 = st.2 (lpoke/lpeek も可)
; ThreadId : DWORD (+12, 4byte) st.3 = 値 / 値 = st.3 (lpoke/lpeek も可)
; AffinityMask : UINT_PTR (+16, 4byte) st.4 = 値 / 値 = st.4 (lpoke/lpeek も可)
; Priority : INT (+20, 4byte) st.5 = 値 / 値 = st.5 (lpoke/lpeek も可)
; BasePriority : INT (+24, 4byte) st.6 = 値 / 値 = st.6 (lpoke/lpeek も可)
; LastSyscallFirstArgument : void* (+28, 4byte) st.7 = 値 / 値 = st.7 (lpoke/lpeek も可)
; LastSyscallNumber : WORD (+32, 2byte) wpoke st,32,値 / 値 = wpeek(st,32)
; CreateTime : FILETIME (+36, 8byte) varptr(st)+36 を基点に操作(8byte:入れ子/配列)
; ExitTime : FILETIME (+44, 8byte) varptr(st)+44 を基点に操作(8byte:入れ子/配列)
; KernelTime : FILETIME (+52, 8byte) varptr(st)+52 を基点に操作(8byte:入れ子/配列)
; UserTime : FILETIME (+60, 8byte) varptr(st)+60 を基点に操作(8byte:入れ子/配列)
; Win32StartAddress : void* (+68, 4byte) st.17 = 値 / 値 = st.17 (lpoke/lpeek も可)
; CaptureTime : FILETIME (+72, 8byte) varptr(st)+72 を基点に操作(8byte:入れ子/配列)
; Flags : PSS_THREAD_FLAGS (+80, 4byte) st.20 = 値 / 値 = st.20 (lpoke/lpeek も可)
; SuspendCount : WORD (+84, 2byte) wpoke st,84,値 / 値 = wpeek(st,84)
; SizeOfContextRecord : WORD (+86, 2byte) wpoke st,86,値 / 値 = wpeek(st,86)
; ContextRecord : CONTEXT* (+88, 4byte) varptr(st)+88 を基点に操作(4byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; PSS_THREAD_ENTRY サイズ: 120 バイト(x64)
dim st, 30 ; 4byte整数×30(構造体サイズ 120 / 4 切り上げ)
; ExitStatus : DWORD (+0, 4byte) st.0 = 値 / 値 = st.0 (lpoke/lpeek も可)
; TebBaseAddress : void* (+8, 8byte) qpoke st,8,値 / qpeek(st,8) ※IronHSPのみ。3.7/3.8は lpoke st,8,下位 : lpoke st,12,上位
; ProcessId : DWORD (+16, 4byte) st.4 = 値 / 値 = st.4 (lpoke/lpeek も可)
; ThreadId : DWORD (+20, 4byte) st.5 = 値 / 値 = st.5 (lpoke/lpeek も可)
; AffinityMask : UINT_PTR (+24, 8byte) qpoke st,24,値 / qpeek(st,24) ※IronHSPのみ。3.7/3.8は lpoke st,24,下位 : lpoke st,28,上位
; Priority : INT (+32, 4byte) st.8 = 値 / 値 = st.8 (lpoke/lpeek も可)
; BasePriority : INT (+36, 4byte) st.9 = 値 / 値 = st.9 (lpoke/lpeek も可)
; LastSyscallFirstArgument : void* (+40, 8byte) qpoke st,40,値 / qpeek(st,40) ※IronHSPのみ。3.7/3.8は lpoke st,40,下位 : lpoke st,44,上位
; LastSyscallNumber : WORD (+48, 2byte) wpoke st,48,値 / 値 = wpeek(st,48)
; CreateTime : FILETIME (+52, 8byte) varptr(st)+52 を基点に操作(8byte:入れ子/配列)
; ExitTime : FILETIME (+60, 8byte) varptr(st)+60 を基点に操作(8byte:入れ子/配列)
; KernelTime : FILETIME (+68, 8byte) varptr(st)+68 を基点に操作(8byte:入れ子/配列)
; UserTime : FILETIME (+76, 8byte) varptr(st)+76 を基点に操作(8byte:入れ子/配列)
; Win32StartAddress : void* (+88, 8byte) qpoke st,88,値 / qpeek(st,88) ※IronHSPのみ。3.7/3.8は lpoke st,88,下位 : lpoke st,92,上位
; CaptureTime : FILETIME (+96, 8byte) varptr(st)+96 を基点に操作(8byte:入れ子/配列)
; Flags : PSS_THREAD_FLAGS (+104, 4byte) st.26 = 値 / 値 = st.26 (lpoke/lpeek も可)
; SuspendCount : WORD (+108, 2byte) wpoke st,108,値 / 値 = wpeek(st,108)
; SizeOfContextRecord : WORD (+110, 2byte) wpoke st,110,値 / 値 = wpeek(st,110)
; ContextRecord : CONTEXT* (+112, 8byte) varptr(st)+112 を基点に操作(8byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global FILETIME
#field int dwLowDateTime
#field int dwHighDateTime
#endstruct
#defstruct global PSS_THREAD_ENTRY
#field int ExitStatus
#field intptr TebBaseAddress
#field int ProcessId
#field int ThreadId
#field intptr AffinityMask
#field int Priority
#field int BasePriority
#field intptr LastSyscallFirstArgument
#field short LastSyscallNumber
#field FILETIME CreateTime
#field FILETIME ExitTime
#field FILETIME KernelTime
#field FILETIME UserTime
#field intptr Win32StartAddress
#field FILETIME CaptureTime
#field int Flags
#field short SuspendCount
#field short SizeOfContextRecord
#field intptr ContextRecord
#endstruct
stdim st, PSS_THREAD_ENTRY ; NSTRUCT 変数を確保
st->ExitStatus = 100
mes "ExitStatus=" + st->ExitStatus