Win32 API 日本語リファレンス
ホームSystem.Diagnostics.ProcessSnapshotting › PSS_THREAD_ENTRY

PSS_THREAD_ENTRY

構造体
サイズx64: 120 バイト / x86: 92 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールドサイズx64x86説明
ExitStatusDWORD4+0+0スレッドの終了コード。実行中はSTILL_ACTIVE。
TebBaseAddressvoid*8/4+8+4スレッド環境ブロック(TEB)のベースアドレス。
ProcessIdDWORD4+16+8スレッドが属するプロセスのID。
ThreadIdDWORD4+20+12スレッドのID。
AffinityMaskUINT_PTR8/4+24+16スレッドのプロセッサアフィニティマスク。
PriorityINT4+32+20スレッドの現在の優先度。
BasePriorityINT4+36+24スレッドの基本優先度。
LastSyscallFirstArgumentvoid*8/4+40+28直近のシステムコールの第1引数。
LastSyscallNumberWORD2+48+32直近のシステムコール番号。
CreateTimeFILETIME8+52+36スレッドの作成時刻(FILETIME)。
ExitTimeFILETIME8+60+44スレッドの終了時刻。実行中は0。
KernelTimeFILETIME8+68+52カーネルモードで費やした累積時間。
UserTimeFILETIME8+76+60ユーザーモードで費やした累積時間。
Win32StartAddressvoid*8/4+88+68スレッドの開始アドレス。
CaptureTimeFILETIME8+96+72スレッドをキャプチャした時刻(FILETIME)。
FlagsPSS_THREAD_FLAGS4+104+80スレッドエントリのフラグ(PSS_THREAD_FLAGS)。
SuspendCountWORD2+108+84スレッドのサスペンドカウント。
SizeOfContextRecordWORD2+110+86ContextRecordのバイトサイズ。
ContextRecordCONTEXT*8/4+112+88スレッドのレジスタ状態(CONTEXT)へのポインタ。NULL可。

各言語での定義

#include <windows.h>

// FILETIME  (x64 8 / x86 8 バイト)
typedef struct FILETIME {
    DWORD dwLowDateTime;
    DWORD dwHighDateTime;
} FILETIME;

// PSS_THREAD_ENTRY  (x64 120 / x86 92 バイト)
typedef struct PSS_THREAD_ENTRY {
    DWORD ExitStatus;
    void* TebBaseAddress;
    DWORD ProcessId;
    DWORD ThreadId;
    UINT_PTR AffinityMask;
    INT Priority;
    INT BasePriority;
    void* LastSyscallFirstArgument;
    WORD LastSyscallNumber;
    FILETIME CreateTime;
    FILETIME ExitTime;
    FILETIME KernelTime;
    FILETIME UserTime;
    void* Win32StartAddress;
    FILETIME CaptureTime;
    PSS_THREAD_FLAGS Flags;
    WORD SuspendCount;
    WORD SizeOfContextRecord;
    CONTEXT* ContextRecord;
} PSS_THREAD_ENTRY;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FILETIME
{
    public uint dwLowDateTime;
    public uint dwHighDateTime;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PSS_THREAD_ENTRY
{
    public uint ExitStatus;
    public IntPtr TebBaseAddress;
    public uint ProcessId;
    public uint ThreadId;
    public UIntPtr AffinityMask;
    public int Priority;
    public int BasePriority;
    public IntPtr LastSyscallFirstArgument;
    public ushort LastSyscallNumber;
    public FILETIME CreateTime;
    public FILETIME ExitTime;
    public FILETIME KernelTime;
    public FILETIME UserTime;
    public IntPtr Win32StartAddress;
    public FILETIME CaptureTime;
    public int Flags;
    public ushort SuspendCount;
    public ushort SizeOfContextRecord;
    public IntPtr ContextRecord;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FILETIME
    Public dwLowDateTime As UInteger
    Public dwHighDateTime As UInteger
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure PSS_THREAD_ENTRY
    Public ExitStatus As UInteger
    Public TebBaseAddress As IntPtr
    Public ProcessId As UInteger
    Public ThreadId As UInteger
    Public AffinityMask As UIntPtr
    Public Priority As Integer
    Public BasePriority As Integer
    Public LastSyscallFirstArgument As IntPtr
    Public LastSyscallNumber As UShort
    Public CreateTime As FILETIME
    Public ExitTime As FILETIME
    Public KernelTime As FILETIME
    Public UserTime As FILETIME
    Public Win32StartAddress As IntPtr
    Public CaptureTime As FILETIME
    Public Flags As Integer
    Public SuspendCount As UShort
    Public SizeOfContextRecord As UShort
    Public ContextRecord As IntPtr
End Structure
import ctypes
from ctypes import wintypes

class FILETIME(ctypes.Structure):
    _fields_ = [
        ("dwLowDateTime", wintypes.DWORD),
        ("dwHighDateTime", wintypes.DWORD),
    ]

class PSS_THREAD_ENTRY(ctypes.Structure):
    _fields_ = [
        ("ExitStatus", wintypes.DWORD),
        ("TebBaseAddress", ctypes.c_void_p),
        ("ProcessId", wintypes.DWORD),
        ("ThreadId", wintypes.DWORD),
        ("AffinityMask", ctypes.c_size_t),
        ("Priority", ctypes.c_int),
        ("BasePriority", ctypes.c_int),
        ("LastSyscallFirstArgument", ctypes.c_void_p),
        ("LastSyscallNumber", ctypes.c_ushort),
        ("CreateTime", FILETIME),
        ("ExitTime", FILETIME),
        ("KernelTime", FILETIME),
        ("UserTime", FILETIME),
        ("Win32StartAddress", ctypes.c_void_p),
        ("CaptureTime", FILETIME),
        ("Flags", ctypes.c_int),
        ("SuspendCount", ctypes.c_ushort),
        ("SizeOfContextRecord", ctypes.c_ushort),
        ("ContextRecord", ctypes.c_void_p),
    ]
#[repr(C)]
pub struct FILETIME {
    pub dwLowDateTime: u32,
    pub dwHighDateTime: u32,
}

#[repr(C)]
pub struct PSS_THREAD_ENTRY {
    pub ExitStatus: u32,
    pub TebBaseAddress: *mut core::ffi::c_void,
    pub ProcessId: u32,
    pub ThreadId: u32,
    pub AffinityMask: usize,
    pub Priority: i32,
    pub BasePriority: i32,
    pub LastSyscallFirstArgument: *mut core::ffi::c_void,
    pub LastSyscallNumber: u16,
    pub CreateTime: FILETIME,
    pub ExitTime: FILETIME,
    pub KernelTime: FILETIME,
    pub UserTime: FILETIME,
    pub Win32StartAddress: *mut core::ffi::c_void,
    pub CaptureTime: FILETIME,
    pub Flags: i32,
    pub SuspendCount: u16,
    pub SizeOfContextRecord: u16,
    pub ContextRecord: *mut core::ffi::c_void,
}
import "golang.org/x/sys/windows"

type FILETIME struct {
	dwLowDateTime uint32
	dwHighDateTime uint32
}

type PSS_THREAD_ENTRY struct {
	ExitStatus uint32
	TebBaseAddress uintptr
	ProcessId uint32
	ThreadId uint32
	AffinityMask uintptr
	Priority int32
	BasePriority int32
	LastSyscallFirstArgument uintptr
	LastSyscallNumber uint16
	CreateTime FILETIME
	ExitTime FILETIME
	KernelTime FILETIME
	UserTime FILETIME
	Win32StartAddress uintptr
	CaptureTime FILETIME
	Flags int32
	SuspendCount uint16
	SizeOfContextRecord uint16
	ContextRecord uintptr
}
type
  FILETIME = record
    dwLowDateTime: DWORD;
    dwHighDateTime: DWORD;
  end;

  PSS_THREAD_ENTRY = record
    ExitStatus: DWORD;
    TebBaseAddress: Pointer;
    ProcessId: DWORD;
    ThreadId: DWORD;
    AffinityMask: NativeUInt;
    Priority: Integer;
    BasePriority: Integer;
    LastSyscallFirstArgument: Pointer;
    LastSyscallNumber: Word;
    CreateTime: FILETIME;
    ExitTime: FILETIME;
    KernelTime: FILETIME;
    UserTime: FILETIME;
    Win32StartAddress: Pointer;
    CaptureTime: FILETIME;
    Flags: Integer;
    SuspendCount: Word;
    SizeOfContextRecord: Word;
    ContextRecord: Pointer;
  end;
const FILETIME = extern struct {
    dwLowDateTime: u32,
    dwHighDateTime: u32,
};

const PSS_THREAD_ENTRY = extern struct {
    ExitStatus: u32,
    TebBaseAddress: ?*anyopaque,
    ProcessId: u32,
    ThreadId: u32,
    AffinityMask: usize,
    Priority: i32,
    BasePriority: i32,
    LastSyscallFirstArgument: ?*anyopaque,
    LastSyscallNumber: u16,
    CreateTime: FILETIME,
    ExitTime: FILETIME,
    KernelTime: FILETIME,
    UserTime: FILETIME,
    Win32StartAddress: ?*anyopaque,
    CaptureTime: FILETIME,
    Flags: i32,
    SuspendCount: u16,
    SizeOfContextRecord: u16,
    ContextRecord: ?*anyopaque,
};
type
  FILETIME {.bycopy.} = object
    dwLowDateTime: uint32
    dwHighDateTime: uint32

  PSS_THREAD_ENTRY {.bycopy.} = object
    ExitStatus: uint32
    TebBaseAddress: pointer
    ProcessId: uint32
    ThreadId: uint32
    AffinityMask: uint
    Priority: int32
    BasePriority: int32
    LastSyscallFirstArgument: pointer
    LastSyscallNumber: uint16
    CreateTime: FILETIME
    ExitTime: FILETIME
    KernelTime: FILETIME
    UserTime: FILETIME
    Win32StartAddress: pointer
    CaptureTime: FILETIME
    Flags: int32
    SuspendCount: uint16
    SizeOfContextRecord: uint16
    ContextRecord: pointer
struct FILETIME
{
    uint dwLowDateTime;
    uint dwHighDateTime;
}

struct PSS_THREAD_ENTRY
{
    uint ExitStatus;
    void* TebBaseAddress;
    uint ProcessId;
    uint ThreadId;
    size_t AffinityMask;
    int Priority;
    int BasePriority;
    void* LastSyscallFirstArgument;
    ushort LastSyscallNumber;
    FILETIME CreateTime;
    FILETIME ExitTime;
    FILETIME KernelTime;
    FILETIME UserTime;
    void* Win32StartAddress;
    FILETIME CaptureTime;
    int Flags;
    ushort SuspendCount;
    ushort SizeOfContextRecord;
    void* ContextRecord;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; PSS_THREAD_ENTRY サイズ: 92 バイト(x86)
dim st, 23    ; 4byte整数×23(構造体サイズ 92 / 4 切り上げ)
; ExitStatus : DWORD (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; TebBaseAddress : void* (+4, 4byte)  st.1 = 値  /  値 = st.1   (lpoke/lpeek も可)
; ProcessId : DWORD (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; ThreadId : DWORD (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; AffinityMask : UINT_PTR (+16, 4byte)  st.4 = 値  /  値 = st.4   (lpoke/lpeek も可)
; Priority : INT (+20, 4byte)  st.5 = 値  /  値 = st.5   (lpoke/lpeek も可)
; BasePriority : INT (+24, 4byte)  st.6 = 値  /  値 = st.6   (lpoke/lpeek も可)
; LastSyscallFirstArgument : void* (+28, 4byte)  st.7 = 値  /  値 = st.7   (lpoke/lpeek も可)
; LastSyscallNumber : WORD (+32, 2byte)  wpoke st,32,値  /  値 = wpeek(st,32)
; CreateTime : FILETIME (+36, 8byte)  varptr(st)+36 を基点に操作(8byte:入れ子/配列)
; ExitTime : FILETIME (+44, 8byte)  varptr(st)+44 を基点に操作(8byte:入れ子/配列)
; KernelTime : FILETIME (+52, 8byte)  varptr(st)+52 を基点に操作(8byte:入れ子/配列)
; UserTime : FILETIME (+60, 8byte)  varptr(st)+60 を基点に操作(8byte:入れ子/配列)
; Win32StartAddress : void* (+68, 4byte)  st.17 = 値  /  値 = st.17   (lpoke/lpeek も可)
; CaptureTime : FILETIME (+72, 8byte)  varptr(st)+72 を基点に操作(8byte:入れ子/配列)
; Flags : PSS_THREAD_FLAGS (+80, 4byte)  st.20 = 値  /  値 = st.20   (lpoke/lpeek も可)
; SuspendCount : WORD (+84, 2byte)  wpoke st,84,値  /  値 = wpeek(st,84)
; SizeOfContextRecord : WORD (+86, 2byte)  wpoke st,86,値  /  値 = wpeek(st,86)
; ContextRecord : CONTEXT* (+88, 4byte)  varptr(st)+88 を基点に操作(4byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; PSS_THREAD_ENTRY サイズ: 120 バイト(x64)
dim st, 30    ; 4byte整数×30(構造体サイズ 120 / 4 切り上げ)
; ExitStatus : DWORD (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; TebBaseAddress : void* (+8, 8byte)  qpoke st,8,値 / qpeek(st,8)  ※IronHSPのみ。3.7/3.8は lpoke st,8,下位 : lpoke st,12,上位
; ProcessId : DWORD (+16, 4byte)  st.4 = 値  /  値 = st.4   (lpoke/lpeek も可)
; ThreadId : DWORD (+20, 4byte)  st.5 = 値  /  値 = st.5   (lpoke/lpeek も可)
; AffinityMask : UINT_PTR (+24, 8byte)  qpoke st,24,値 / qpeek(st,24)  ※IronHSPのみ。3.7/3.8は lpoke st,24,下位 : lpoke st,28,上位
; Priority : INT (+32, 4byte)  st.8 = 値  /  値 = st.8   (lpoke/lpeek も可)
; BasePriority : INT (+36, 4byte)  st.9 = 値  /  値 = st.9   (lpoke/lpeek も可)
; LastSyscallFirstArgument : void* (+40, 8byte)  qpoke st,40,値 / qpeek(st,40)  ※IronHSPのみ。3.7/3.8は lpoke st,40,下位 : lpoke st,44,上位
; LastSyscallNumber : WORD (+48, 2byte)  wpoke st,48,値  /  値 = wpeek(st,48)
; CreateTime : FILETIME (+52, 8byte)  varptr(st)+52 を基点に操作(8byte:入れ子/配列)
; ExitTime : FILETIME (+60, 8byte)  varptr(st)+60 を基点に操作(8byte:入れ子/配列)
; KernelTime : FILETIME (+68, 8byte)  varptr(st)+68 を基点に操作(8byte:入れ子/配列)
; UserTime : FILETIME (+76, 8byte)  varptr(st)+76 を基点に操作(8byte:入れ子/配列)
; Win32StartAddress : void* (+88, 8byte)  qpoke st,88,値 / qpeek(st,88)  ※IronHSPのみ。3.7/3.8は lpoke st,88,下位 : lpoke st,92,上位
; CaptureTime : FILETIME (+96, 8byte)  varptr(st)+96 を基点に操作(8byte:入れ子/配列)
; Flags : PSS_THREAD_FLAGS (+104, 4byte)  st.26 = 値  /  値 = st.26   (lpoke/lpeek も可)
; SuspendCount : WORD (+108, 2byte)  wpoke st,108,値  /  値 = wpeek(st,108)
; SizeOfContextRecord : WORD (+110, 2byte)  wpoke st,110,値  /  値 = wpeek(st,110)
; ContextRecord : CONTEXT* (+112, 8byte)  varptr(st)+112 を基点に操作(8byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global FILETIME
    #field int dwLowDateTime
    #field int dwHighDateTime
#endstruct

#defstruct global PSS_THREAD_ENTRY
    #field int ExitStatus
    #field intptr TebBaseAddress
    #field int ProcessId
    #field int ThreadId
    #field intptr AffinityMask
    #field int Priority
    #field int BasePriority
    #field intptr LastSyscallFirstArgument
    #field short LastSyscallNumber
    #field FILETIME CreateTime
    #field FILETIME ExitTime
    #field FILETIME KernelTime
    #field FILETIME UserTime
    #field intptr Win32StartAddress
    #field FILETIME CaptureTime
    #field int Flags
    #field short SuspendCount
    #field short SizeOfContextRecord
    #field intptr ContextRecord
#endstruct

stdim st, PSS_THREAD_ENTRY        ; NSTRUCT 変数を確保
st->ExitStatus = 100
mes "ExitStatus=" + st->ExitStatus