ホーム › System.Diagnostics.ProcessSnapshotting › PSS_VA_SPACE_ENTRY
PSS_VA_SPACE_ENTRY
構造体サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。
フィールド
| フィールド | 型 | サイズ | x64 | x86 | 説明 |
|---|---|---|---|---|---|
| BaseAddress | void* | 8/4 | +0 | +0 | リージョンのベースアドレス。 |
| AllocationBase | void* | 8/4 | +8 | +4 | 割り当て時のベースアドレス。 |
| AllocationProtect | DWORD | 4 | +16 | +8 | 割り当て時のメモリ保護属性。 |
| RegionSize | UINT_PTR | 8/4 | +24 | +12 | リージョンのサイズ。単位はバイト。 |
| State | DWORD | 4 | +32 | +16 | メモリの状態(MEM_COMMIT/RESERVE/FREE)。 |
| Protect | DWORD | 4 | +36 | +20 | 現在のメモリ保護属性。 |
| Type | DWORD | 4 | +40 | +24 | メモリの種類(MEM_IMAGE/MAPPED/PRIVATE)。 |
| TimeDateStamp | DWORD | 4 | +44 | +28 | イメージのタイムスタンプ。イメージ領域のみ有効。 |
| SizeOfImage | DWORD | 4 | +48 | +32 | マップされたイメージのサイズ。単位はバイト。 |
| ImageBase | void* | 8/4 | +56 | +36 | イメージのベースアドレス。 |
| CheckSum | DWORD | 4 | +64 | +40 | イメージのチェックサム値。 |
| MappedFileNameLength | WORD | 2 | +68 | +44 | MappedFileName文字列のバイト長。 |
| MappedFileName | LPWSTR | 8/4 | +72 | +48 | マップされたファイルのパス(ワイド文字列)。無しでNULL。 |
各言語での定義
#include <windows.h>
// PSS_VA_SPACE_ENTRY (x64 80 / x86 52 バイト)
typedef struct PSS_VA_SPACE_ENTRY {
void* BaseAddress;
void* AllocationBase;
DWORD AllocationProtect;
UINT_PTR RegionSize;
DWORD State;
DWORD Protect;
DWORD Type;
DWORD TimeDateStamp;
DWORD SizeOfImage;
void* ImageBase;
DWORD CheckSum;
WORD MappedFileNameLength;
LPWSTR MappedFileName;
} PSS_VA_SPACE_ENTRY;using System;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PSS_VA_SPACE_ENTRY
{
public IntPtr BaseAddress;
public IntPtr AllocationBase;
public uint AllocationProtect;
public UIntPtr RegionSize;
public uint State;
public uint Protect;
public uint Type;
public uint TimeDateStamp;
public uint SizeOfImage;
public IntPtr ImageBase;
public uint CheckSum;
public ushort MappedFileNameLength;
public IntPtr MappedFileName;
}Imports System.Runtime.InteropServices
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure PSS_VA_SPACE_ENTRY
Public BaseAddress As IntPtr
Public AllocationBase As IntPtr
Public AllocationProtect As UInteger
Public RegionSize As UIntPtr
Public State As UInteger
Public Protect As UInteger
Public Type As UInteger
Public TimeDateStamp As UInteger
Public SizeOfImage As UInteger
Public ImageBase As IntPtr
Public CheckSum As UInteger
Public MappedFileNameLength As UShort
Public MappedFileName As IntPtr
End Structureimport ctypes
from ctypes import wintypes
class PSS_VA_SPACE_ENTRY(ctypes.Structure):
_fields_ = [
("BaseAddress", ctypes.c_void_p),
("AllocationBase", ctypes.c_void_p),
("AllocationProtect", wintypes.DWORD),
("RegionSize", ctypes.c_size_t),
("State", wintypes.DWORD),
("Protect", wintypes.DWORD),
("Type", wintypes.DWORD),
("TimeDateStamp", wintypes.DWORD),
("SizeOfImage", wintypes.DWORD),
("ImageBase", ctypes.c_void_p),
("CheckSum", wintypes.DWORD),
("MappedFileNameLength", ctypes.c_ushort),
("MappedFileName", ctypes.c_void_p),
]#[repr(C)]
pub struct PSS_VA_SPACE_ENTRY {
pub BaseAddress: *mut core::ffi::c_void,
pub AllocationBase: *mut core::ffi::c_void,
pub AllocationProtect: u32,
pub RegionSize: usize,
pub State: u32,
pub Protect: u32,
pub Type: u32,
pub TimeDateStamp: u32,
pub SizeOfImage: u32,
pub ImageBase: *mut core::ffi::c_void,
pub CheckSum: u32,
pub MappedFileNameLength: u16,
pub MappedFileName: *mut core::ffi::c_void,
}import "golang.org/x/sys/windows"
type PSS_VA_SPACE_ENTRY struct {
BaseAddress uintptr
AllocationBase uintptr
AllocationProtect uint32
RegionSize uintptr
State uint32
Protect uint32
Type uint32
TimeDateStamp uint32
SizeOfImage uint32
ImageBase uintptr
CheckSum uint32
MappedFileNameLength uint16
MappedFileName uintptr
}type
PSS_VA_SPACE_ENTRY = record
BaseAddress: Pointer;
AllocationBase: Pointer;
AllocationProtect: DWORD;
RegionSize: NativeUInt;
State: DWORD;
Protect: DWORD;
Type: DWORD;
TimeDateStamp: DWORD;
SizeOfImage: DWORD;
ImageBase: Pointer;
CheckSum: DWORD;
MappedFileNameLength: Word;
MappedFileName: Pointer;
end;const PSS_VA_SPACE_ENTRY = extern struct {
BaseAddress: ?*anyopaque,
AllocationBase: ?*anyopaque,
AllocationProtect: u32,
RegionSize: usize,
State: u32,
Protect: u32,
Type: u32,
TimeDateStamp: u32,
SizeOfImage: u32,
ImageBase: ?*anyopaque,
CheckSum: u32,
MappedFileNameLength: u16,
MappedFileName: ?*anyopaque,
};type
PSS_VA_SPACE_ENTRY {.bycopy.} = object
BaseAddress: pointer
AllocationBase: pointer
AllocationProtect: uint32
RegionSize: uint
State: uint32
Protect: uint32
Type: uint32
TimeDateStamp: uint32
SizeOfImage: uint32
ImageBase: pointer
CheckSum: uint32
MappedFileNameLength: uint16
MappedFileName: pointerstruct PSS_VA_SPACE_ENTRY
{
void* BaseAddress;
void* AllocationBase;
uint AllocationProtect;
size_t RegionSize;
uint State;
uint Protect;
uint Type;
uint TimeDateStamp;
uint SizeOfImage;
void* ImageBase;
uint CheckSum;
ushort MappedFileNameLength;
void* MappedFileName;
}HSP用 定義
HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; PSS_VA_SPACE_ENTRY サイズ: 52 バイト(x86)
dim st, 13 ; 4byte整数×13(構造体サイズ 52 / 4 切り上げ)
; BaseAddress : void* (+0, 4byte) st.0 = 値 / 値 = st.0 (lpoke/lpeek も可)
; AllocationBase : void* (+4, 4byte) st.1 = 値 / 値 = st.1 (lpoke/lpeek も可)
; AllocationProtect : DWORD (+8, 4byte) st.2 = 値 / 値 = st.2 (lpoke/lpeek も可)
; RegionSize : UINT_PTR (+12, 4byte) st.3 = 値 / 値 = st.3 (lpoke/lpeek も可)
; State : DWORD (+16, 4byte) st.4 = 値 / 値 = st.4 (lpoke/lpeek も可)
; Protect : DWORD (+20, 4byte) st.5 = 値 / 値 = st.5 (lpoke/lpeek も可)
; Type : DWORD (+24, 4byte) st.6 = 値 / 値 = st.6 (lpoke/lpeek も可)
; TimeDateStamp : DWORD (+28, 4byte) st.7 = 値 / 値 = st.7 (lpoke/lpeek も可)
; SizeOfImage : DWORD (+32, 4byte) st.8 = 値 / 値 = st.8 (lpoke/lpeek も可)
; ImageBase : void* (+36, 4byte) st.9 = 値 / 値 = st.9 (lpoke/lpeek も可)
; CheckSum : DWORD (+40, 4byte) st.10 = 値 / 値 = st.10 (lpoke/lpeek も可)
; MappedFileNameLength : WORD (+44, 2byte) wpoke st,44,値 / 値 = wpeek(st,44)
; MappedFileName : LPWSTR (+48, 4byte) st.12 = 値 / 値 = st.12 (lpoke/lpeek も可)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; PSS_VA_SPACE_ENTRY サイズ: 80 バイト(x64)
dim st, 20 ; 4byte整数×20(構造体サイズ 80 / 4 切り上げ)
; BaseAddress : void* (+0, 8byte) qpoke st,0,値 / qpeek(st,0) ※IronHSPのみ。3.7/3.8は lpoke st,0,下位 : lpoke st,4,上位
; AllocationBase : void* (+8, 8byte) qpoke st,8,値 / qpeek(st,8) ※IronHSPのみ。3.7/3.8は lpoke st,8,下位 : lpoke st,12,上位
; AllocationProtect : DWORD (+16, 4byte) st.4 = 値 / 値 = st.4 (lpoke/lpeek も可)
; RegionSize : UINT_PTR (+24, 8byte) qpoke st,24,値 / qpeek(st,24) ※IronHSPのみ。3.7/3.8は lpoke st,24,下位 : lpoke st,28,上位
; State : DWORD (+32, 4byte) st.8 = 値 / 値 = st.8 (lpoke/lpeek も可)
; Protect : DWORD (+36, 4byte) st.9 = 値 / 値 = st.9 (lpoke/lpeek も可)
; Type : DWORD (+40, 4byte) st.10 = 値 / 値 = st.10 (lpoke/lpeek も可)
; TimeDateStamp : DWORD (+44, 4byte) st.11 = 値 / 値 = st.11 (lpoke/lpeek も可)
; SizeOfImage : DWORD (+48, 4byte) st.12 = 値 / 値 = st.12 (lpoke/lpeek も可)
; ImageBase : void* (+56, 8byte) qpoke st,56,値 / qpeek(st,56) ※IronHSPのみ。3.7/3.8は lpoke st,56,下位 : lpoke st,60,上位
; CheckSum : DWORD (+64, 4byte) st.16 = 値 / 値 = st.16 (lpoke/lpeek も可)
; MappedFileNameLength : WORD (+68, 2byte) wpoke st,68,値 / 値 = wpeek(st,68)
; MappedFileName : LPWSTR (+72, 8byte) qpoke st,72,値 / qpeek(st,72) ※IronHSPのみ。3.7/3.8は lpoke st,72,下位 : lpoke st,76,上位
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
#defstruct global PSS_VA_SPACE_ENTRY
#field intptr BaseAddress
#field intptr AllocationBase
#field int AllocationProtect
#field intptr RegionSize
#field int State
#field int Protect
#field int Type
#field int TimeDateStamp
#field int SizeOfImage
#field intptr ImageBase
#field int CheckSum
#field short MappedFileNameLength
#field intptr MappedFileName
#endstruct
stdim st, PSS_VA_SPACE_ENTRY ; NSTRUCT 変数を確保
st->AllocationProtect = 100
mes "AllocationProtect=" + st->AllocationProtect