ホーム › System.Ioctl › USN_RECORD_UNION
USN_RECORD_UNION
共用体サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。
フィールド
| フィールド | 型 | サイズ | x64 | x86 | 説明 |
|---|---|---|---|---|---|
| Header | USN_RECORD_COMMON_HEADER | 8 | +0 | +0 | 全USNレコード版に共通する先頭ヘッダ。RecordLengthとMajor/MinorVersionを保持し版を判別する。 |
| V2 | USN_RECORD_V2 | 64 | +0 | +0 | バージョン2形式のUSNレコード。ファイル名をWCHARで持つ従来形式である。 |
| V3 | USN_RECORD_V3 | 80 | +0 | +0 | バージョン3形式のUSNレコード。128ビットのファイル参照番号(FILE_ID_128)を使用する。 |
| V4 | USN_RECORD_V4 | 80 | +0 | +0 | バージョン4形式のUSNレコード。ReFSのレンジトラッキング用で範囲情報を含む。 |
各言語での定義
#include <windows.h>
// USN_RECORD_COMMON_HEADER (x64 8 / x86 8 バイト)
typedef struct USN_RECORD_COMMON_HEADER {
DWORD RecordLength;
WORD MajorVersion;
WORD MinorVersion;
} USN_RECORD_COMMON_HEADER;
// USN_RECORD_V2 (x64 64 / x86 64 バイト)
typedef struct USN_RECORD_V2 {
DWORD RecordLength;
WORD MajorVersion;
WORD MinorVersion;
ULONGLONG FileReferenceNumber;
ULONGLONG ParentFileReferenceNumber;
LONGLONG Usn;
LONGLONG TimeStamp;
DWORD Reason;
DWORD SourceInfo;
DWORD SecurityId;
DWORD FileAttributes;
WORD FileNameLength;
WORD FileNameOffset;
WCHAR FileName[1];
} USN_RECORD_V2;
// FILE_ID_128 (x64 16 / x86 16 バイト)
typedef struct FILE_ID_128 {
BYTE Identifier[16];
} FILE_ID_128;
// USN_RECORD_V3 (x64 80 / x86 80 バイト)
typedef struct USN_RECORD_V3 {
DWORD RecordLength;
WORD MajorVersion;
WORD MinorVersion;
FILE_ID_128 FileReferenceNumber;
FILE_ID_128 ParentFileReferenceNumber;
LONGLONG Usn;
LONGLONG TimeStamp;
DWORD Reason;
DWORD SourceInfo;
DWORD SecurityId;
DWORD FileAttributes;
WORD FileNameLength;
WORD FileNameOffset;
WCHAR FileName[1];
} USN_RECORD_V3;
// USN_RECORD_EXTENT (x64 16 / x86 16 バイト)
typedef struct USN_RECORD_EXTENT {
LONGLONG Offset;
LONGLONG Length;
} USN_RECORD_EXTENT;
// USN_RECORD_V4 (x64 80 / x86 80 バイト)
typedef struct USN_RECORD_V4 {
USN_RECORD_COMMON_HEADER Header;
FILE_ID_128 FileReferenceNumber;
FILE_ID_128 ParentFileReferenceNumber;
LONGLONG Usn;
DWORD Reason;
USN_SOURCE_INFO_ID SourceInfo;
DWORD RemainingExtents;
WORD NumberOfExtents;
WORD ExtentSize;
USN_RECORD_EXTENT Extents[1];
} USN_RECORD_V4;
// USN_RECORD_UNION (x64 80 / x86 80 バイト)
typedef struct USN_RECORD_UNION {
USN_RECORD_COMMON_HEADER Header;
USN_RECORD_V2 V2;
USN_RECORD_V3 V3;
USN_RECORD_V4 V4;
} USN_RECORD_UNION;using System;
using System.Runtime.InteropServices;
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct USN_RECORD_COMMON_HEADER
{
public uint RecordLength;
public ushort MajorVersion;
public ushort MinorVersion;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct USN_RECORD_V2
{
public uint RecordLength;
public ushort MajorVersion;
public ushort MinorVersion;
public ulong FileReferenceNumber;
public ulong ParentFileReferenceNumber;
public long Usn;
public long TimeStamp;
public uint Reason;
public uint SourceInfo;
public uint SecurityId;
public uint FileAttributes;
public ushort FileNameLength;
public ushort FileNameOffset;
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)] public string FileName;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FILE_ID_128
{
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] public byte[] Identifier;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct USN_RECORD_V3
{
public uint RecordLength;
public ushort MajorVersion;
public ushort MinorVersion;
public FILE_ID_128 FileReferenceNumber;
public FILE_ID_128 ParentFileReferenceNumber;
public long Usn;
public long TimeStamp;
public uint Reason;
public uint SourceInfo;
public uint SecurityId;
public uint FileAttributes;
public ushort FileNameLength;
public ushort FileNameOffset;
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)] public string FileName;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct USN_RECORD_EXTENT
{
public long Offset;
public long Length;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct USN_RECORD_V4
{
public USN_RECORD_COMMON_HEADER Header;
public FILE_ID_128 FileReferenceNumber;
public FILE_ID_128 ParentFileReferenceNumber;
public long Usn;
public uint Reason;
public uint SourceInfo;
public uint RemainingExtents;
public ushort NumberOfExtents;
public ushort ExtentSize;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)] public USN_RECORD_EXTENT[] Extents;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct USN_RECORD_UNION
{
public USN_RECORD_COMMON_HEADER Header;
public USN_RECORD_V2 V2;
public USN_RECORD_V3 V3;
public USN_RECORD_V4 V4;
}Imports System.Runtime.InteropServices
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure USN_RECORD_COMMON_HEADER
Public RecordLength As UInteger
Public MajorVersion As UShort
Public MinorVersion As UShort
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure USN_RECORD_V2
Public RecordLength As UInteger
Public MajorVersion As UShort
Public MinorVersion As UShort
Public FileReferenceNumber As ULong
Public ParentFileReferenceNumber As ULong
Public Usn As Long
Public TimeStamp As Long
Public Reason As UInteger
Public SourceInfo As UInteger
Public SecurityId As UInteger
Public FileAttributes As UInteger
Public FileNameLength As UShort
Public FileNameOffset As UShort
<MarshalAs(UnmanagedType.ByValTStr, SizeConst:=1)> Public FileName As String
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FILE_ID_128
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=16)> Public Identifier() As Byte
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure USN_RECORD_V3
Public RecordLength As UInteger
Public MajorVersion As UShort
Public MinorVersion As UShort
Public FileReferenceNumber As FILE_ID_128
Public ParentFileReferenceNumber As FILE_ID_128
Public Usn As Long
Public TimeStamp As Long
Public Reason As UInteger
Public SourceInfo As UInteger
Public SecurityId As UInteger
Public FileAttributes As UInteger
Public FileNameLength As UShort
Public FileNameOffset As UShort
<MarshalAs(UnmanagedType.ByValTStr, SizeConst:=1)> Public FileName As String
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure USN_RECORD_EXTENT
Public Offset As Long
Public Length As Long
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure USN_RECORD_V4
Public Header As USN_RECORD_COMMON_HEADER
Public FileReferenceNumber As FILE_ID_128
Public ParentFileReferenceNumber As FILE_ID_128
Public Usn As Long
Public Reason As UInteger
Public SourceInfo As UInteger
Public RemainingExtents As UInteger
Public NumberOfExtents As UShort
Public ExtentSize As UShort
<MarshalAs(UnmanagedType.ByValArray, SizeConst:=1)> Public Extents() As USN_RECORD_EXTENT
End Structure
<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure USN_RECORD_UNION
Public Header As USN_RECORD_COMMON_HEADER
Public V2 As USN_RECORD_V2
Public V3 As USN_RECORD_V3
Public V4 As USN_RECORD_V4
End Structureimport ctypes
from ctypes import wintypes
class USN_RECORD_COMMON_HEADER(ctypes.Structure):
_fields_ = [
("RecordLength", wintypes.DWORD),
("MajorVersion", ctypes.c_ushort),
("MinorVersion", ctypes.c_ushort),
]
class USN_RECORD_V2(ctypes.Structure):
_fields_ = [
("RecordLength", wintypes.DWORD),
("MajorVersion", ctypes.c_ushort),
("MinorVersion", ctypes.c_ushort),
("FileReferenceNumber", ctypes.c_ulonglong),
("ParentFileReferenceNumber", ctypes.c_ulonglong),
("Usn", ctypes.c_longlong),
("TimeStamp", ctypes.c_longlong),
("Reason", wintypes.DWORD),
("SourceInfo", wintypes.DWORD),
("SecurityId", wintypes.DWORD),
("FileAttributes", wintypes.DWORD),
("FileNameLength", ctypes.c_ushort),
("FileNameOffset", ctypes.c_ushort),
("FileName", ctypes.c_wchar * 1),
]
class FILE_ID_128(ctypes.Structure):
_fields_ = [
("Identifier", ctypes.c_ubyte * 16),
]
class USN_RECORD_V3(ctypes.Structure):
_fields_ = [
("RecordLength", wintypes.DWORD),
("MajorVersion", ctypes.c_ushort),
("MinorVersion", ctypes.c_ushort),
("FileReferenceNumber", FILE_ID_128),
("ParentFileReferenceNumber", FILE_ID_128),
("Usn", ctypes.c_longlong),
("TimeStamp", ctypes.c_longlong),
("Reason", wintypes.DWORD),
("SourceInfo", wintypes.DWORD),
("SecurityId", wintypes.DWORD),
("FileAttributes", wintypes.DWORD),
("FileNameLength", ctypes.c_ushort),
("FileNameOffset", ctypes.c_ushort),
("FileName", ctypes.c_wchar * 1),
]
class USN_RECORD_EXTENT(ctypes.Structure):
_fields_ = [
("Offset", ctypes.c_longlong),
("Length", ctypes.c_longlong),
]
class USN_RECORD_V4(ctypes.Structure):
_fields_ = [
("Header", USN_RECORD_COMMON_HEADER),
("FileReferenceNumber", FILE_ID_128),
("ParentFileReferenceNumber", FILE_ID_128),
("Usn", ctypes.c_longlong),
("Reason", wintypes.DWORD),
("SourceInfo", wintypes.DWORD),
("RemainingExtents", wintypes.DWORD),
("NumberOfExtents", ctypes.c_ushort),
("ExtentSize", ctypes.c_ushort),
("Extents", USN_RECORD_EXTENT * 1),
]
class USN_RECORD_UNION(ctypes.Structure):
_fields_ = [
("Header", USN_RECORD_COMMON_HEADER),
("V2", USN_RECORD_V2),
("V3", USN_RECORD_V3),
("V4", USN_RECORD_V4),
]#[repr(C)]
pub struct USN_RECORD_COMMON_HEADER {
pub RecordLength: u32,
pub MajorVersion: u16,
pub MinorVersion: u16,
}
#[repr(C)]
pub struct USN_RECORD_V2 {
pub RecordLength: u32,
pub MajorVersion: u16,
pub MinorVersion: u16,
pub FileReferenceNumber: u64,
pub ParentFileReferenceNumber: u64,
pub Usn: i64,
pub TimeStamp: i64,
pub Reason: u32,
pub SourceInfo: u32,
pub SecurityId: u32,
pub FileAttributes: u32,
pub FileNameLength: u16,
pub FileNameOffset: u16,
pub FileName: [u16; 1],
}
#[repr(C)]
pub struct FILE_ID_128 {
pub Identifier: [u8; 16],
}
#[repr(C)]
pub struct USN_RECORD_V3 {
pub RecordLength: u32,
pub MajorVersion: u16,
pub MinorVersion: u16,
pub FileReferenceNumber: FILE_ID_128,
pub ParentFileReferenceNumber: FILE_ID_128,
pub Usn: i64,
pub TimeStamp: i64,
pub Reason: u32,
pub SourceInfo: u32,
pub SecurityId: u32,
pub FileAttributes: u32,
pub FileNameLength: u16,
pub FileNameOffset: u16,
pub FileName: [u16; 1],
}
#[repr(C)]
pub struct USN_RECORD_EXTENT {
pub Offset: i64,
pub Length: i64,
}
#[repr(C)]
pub struct USN_RECORD_V4 {
pub Header: USN_RECORD_COMMON_HEADER,
pub FileReferenceNumber: FILE_ID_128,
pub ParentFileReferenceNumber: FILE_ID_128,
pub Usn: i64,
pub Reason: u32,
pub SourceInfo: u32,
pub RemainingExtents: u32,
pub NumberOfExtents: u16,
pub ExtentSize: u16,
pub Extents: [USN_RECORD_EXTENT; 1],
}
#[repr(C)]
pub struct USN_RECORD_UNION {
pub Header: USN_RECORD_COMMON_HEADER,
pub V2: USN_RECORD_V2,
pub V3: USN_RECORD_V3,
pub V4: USN_RECORD_V4,
}import "golang.org/x/sys/windows"
type USN_RECORD_COMMON_HEADER struct {
RecordLength uint32
MajorVersion uint16
MinorVersion uint16
}
type USN_RECORD_V2 struct {
RecordLength uint32
MajorVersion uint16
MinorVersion uint16
FileReferenceNumber uint64
ParentFileReferenceNumber uint64
Usn int64
TimeStamp int64
Reason uint32
SourceInfo uint32
SecurityId uint32
FileAttributes uint32
FileNameLength uint16
FileNameOffset uint16
FileName [1]uint16
}
type FILE_ID_128 struct {
Identifier [16]byte
}
type USN_RECORD_V3 struct {
RecordLength uint32
MajorVersion uint16
MinorVersion uint16
FileReferenceNumber FILE_ID_128
ParentFileReferenceNumber FILE_ID_128
Usn int64
TimeStamp int64
Reason uint32
SourceInfo uint32
SecurityId uint32
FileAttributes uint32
FileNameLength uint16
FileNameOffset uint16
FileName [1]uint16
}
type USN_RECORD_EXTENT struct {
Offset int64
Length int64
}
type USN_RECORD_V4 struct {
Header USN_RECORD_COMMON_HEADER
FileReferenceNumber FILE_ID_128
ParentFileReferenceNumber FILE_ID_128
Usn int64
Reason uint32
SourceInfo uint32
RemainingExtents uint32
NumberOfExtents uint16
ExtentSize uint16
Extents [1]USN_RECORD_EXTENT
}
type USN_RECORD_UNION struct {
Header USN_RECORD_COMMON_HEADER
V2 USN_RECORD_V2
V3 USN_RECORD_V3
V4 USN_RECORD_V4
}type
USN_RECORD_COMMON_HEADER = record
RecordLength: DWORD;
MajorVersion: Word;
MinorVersion: Word;
end;
USN_RECORD_V2 = record
RecordLength: DWORD;
MajorVersion: Word;
MinorVersion: Word;
FileReferenceNumber: UInt64;
ParentFileReferenceNumber: UInt64;
Usn: Int64;
TimeStamp: Int64;
Reason: DWORD;
SourceInfo: DWORD;
SecurityId: DWORD;
FileAttributes: DWORD;
FileNameLength: Word;
FileNameOffset: Word;
FileName: array[0..0] of WideChar;
end;
FILE_ID_128 = record
Identifier: array[0..15] of Byte;
end;
USN_RECORD_V3 = record
RecordLength: DWORD;
MajorVersion: Word;
MinorVersion: Word;
FileReferenceNumber: FILE_ID_128;
ParentFileReferenceNumber: FILE_ID_128;
Usn: Int64;
TimeStamp: Int64;
Reason: DWORD;
SourceInfo: DWORD;
SecurityId: DWORD;
FileAttributes: DWORD;
FileNameLength: Word;
FileNameOffset: Word;
FileName: array[0..0] of WideChar;
end;
USN_RECORD_EXTENT = record
Offset: Int64;
Length: Int64;
end;
USN_RECORD_V4 = record
Header: USN_RECORD_COMMON_HEADER;
FileReferenceNumber: FILE_ID_128;
ParentFileReferenceNumber: FILE_ID_128;
Usn: Int64;
Reason: DWORD;
SourceInfo: DWORD;
RemainingExtents: DWORD;
NumberOfExtents: Word;
ExtentSize: Word;
Extents: array[0..0] of USN_RECORD_EXTENT;
end;
USN_RECORD_UNION = record
Header: USN_RECORD_COMMON_HEADER;
V2: USN_RECORD_V2;
V3: USN_RECORD_V3;
V4: USN_RECORD_V4;
end;const USN_RECORD_COMMON_HEADER = extern struct {
RecordLength: u32,
MajorVersion: u16,
MinorVersion: u16,
};
const USN_RECORD_V2 = extern struct {
RecordLength: u32,
MajorVersion: u16,
MinorVersion: u16,
FileReferenceNumber: u64,
ParentFileReferenceNumber: u64,
Usn: i64,
TimeStamp: i64,
Reason: u32,
SourceInfo: u32,
SecurityId: u32,
FileAttributes: u32,
FileNameLength: u16,
FileNameOffset: u16,
FileName: [1]u16,
};
const FILE_ID_128 = extern struct {
Identifier: [16]u8,
};
const USN_RECORD_V3 = extern struct {
RecordLength: u32,
MajorVersion: u16,
MinorVersion: u16,
FileReferenceNumber: FILE_ID_128,
ParentFileReferenceNumber: FILE_ID_128,
Usn: i64,
TimeStamp: i64,
Reason: u32,
SourceInfo: u32,
SecurityId: u32,
FileAttributes: u32,
FileNameLength: u16,
FileNameOffset: u16,
FileName: [1]u16,
};
const USN_RECORD_EXTENT = extern struct {
Offset: i64,
Length: i64,
};
const USN_RECORD_V4 = extern struct {
Header: USN_RECORD_COMMON_HEADER,
FileReferenceNumber: FILE_ID_128,
ParentFileReferenceNumber: FILE_ID_128,
Usn: i64,
Reason: u32,
SourceInfo: u32,
RemainingExtents: u32,
NumberOfExtents: u16,
ExtentSize: u16,
Extents: [1]USN_RECORD_EXTENT,
};
const USN_RECORD_UNION = extern struct {
Header: USN_RECORD_COMMON_HEADER,
V2: USN_RECORD_V2,
V3: USN_RECORD_V3,
V4: USN_RECORD_V4,
};type
USN_RECORD_COMMON_HEADER {.bycopy.} = object
RecordLength: uint32
MajorVersion: uint16
MinorVersion: uint16
USN_RECORD_V2 {.bycopy.} = object
RecordLength: uint32
MajorVersion: uint16
MinorVersion: uint16
FileReferenceNumber: uint64
ParentFileReferenceNumber: uint64
Usn: int64
TimeStamp: int64
Reason: uint32
SourceInfo: uint32
SecurityId: uint32
FileAttributes: uint32
FileNameLength: uint16
FileNameOffset: uint16
FileName: array[1, uint16]
FILE_ID_128 {.bycopy.} = object
Identifier: array[16, uint8]
USN_RECORD_V3 {.bycopy.} = object
RecordLength: uint32
MajorVersion: uint16
MinorVersion: uint16
FileReferenceNumber: FILE_ID_128
ParentFileReferenceNumber: FILE_ID_128
Usn: int64
TimeStamp: int64
Reason: uint32
SourceInfo: uint32
SecurityId: uint32
FileAttributes: uint32
FileNameLength: uint16
FileNameOffset: uint16
FileName: array[1, uint16]
USN_RECORD_EXTENT {.bycopy.} = object
Offset: int64
Length: int64
USN_RECORD_V4 {.bycopy.} = object
Header: USN_RECORD_COMMON_HEADER
FileReferenceNumber: FILE_ID_128
ParentFileReferenceNumber: FILE_ID_128
Usn: int64
Reason: uint32
SourceInfo: uint32
RemainingExtents: uint32
NumberOfExtents: uint16
ExtentSize: uint16
Extents: array[1, USN_RECORD_EXTENT]
USN_RECORD_UNION {.bycopy.} = object
Header: USN_RECORD_COMMON_HEADER
V2: USN_RECORD_V2
V3: USN_RECORD_V3
V4: USN_RECORD_V4struct USN_RECORD_COMMON_HEADER
{
uint RecordLength;
ushort MajorVersion;
ushort MinorVersion;
}
struct USN_RECORD_V2
{
uint RecordLength;
ushort MajorVersion;
ushort MinorVersion;
ulong FileReferenceNumber;
ulong ParentFileReferenceNumber;
long Usn;
long TimeStamp;
uint Reason;
uint SourceInfo;
uint SecurityId;
uint FileAttributes;
ushort FileNameLength;
ushort FileNameOffset;
wchar[1] FileName;
}
struct FILE_ID_128
{
ubyte[16] Identifier;
}
struct USN_RECORD_V3
{
uint RecordLength;
ushort MajorVersion;
ushort MinorVersion;
FILE_ID_128 FileReferenceNumber;
FILE_ID_128 ParentFileReferenceNumber;
long Usn;
long TimeStamp;
uint Reason;
uint SourceInfo;
uint SecurityId;
uint FileAttributes;
ushort FileNameLength;
ushort FileNameOffset;
wchar[1] FileName;
}
struct USN_RECORD_EXTENT
{
long Offset;
long Length;
}
struct USN_RECORD_V4
{
USN_RECORD_COMMON_HEADER Header;
FILE_ID_128 FileReferenceNumber;
FILE_ID_128 ParentFileReferenceNumber;
long Usn;
uint Reason;
uint SourceInfo;
uint RemainingExtents;
ushort NumberOfExtents;
ushort ExtentSize;
USN_RECORD_EXTENT[1] Extents;
}
struct USN_RECORD_UNION
{
USN_RECORD_COMMON_HEADER Header;
USN_RECORD_V2 V2;
USN_RECORD_V3 V3;
USN_RECORD_V4 V4;
}HSP用 定義
HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。
; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; USN_RECORD_UNION サイズ: 80 バイト(x64)
dim st, 20 ; 4byte整数×20(構造体サイズ 80 / 4 切り上げ)
; Header : USN_RECORD_COMMON_HEADER (+0, 8byte) varptr(st)+0 を基点に操作(8byte:入れ子/配列)
; V2 : USN_RECORD_V2 (+0, 64byte) varptr(st)+0 を基点に操作(64byte:入れ子/配列)
; V3 : USN_RECORD_V3 (+0, 80byte) varptr(st)+0 を基点に操作(80byte:入れ子/配列)
; V4 : USN_RECORD_V4 (+0, 80byte) varptr(st)+0 を基点に操作(80byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global USN_RECORD_COMMON_HEADER
#field int RecordLength
#field short MajorVersion
#field short MinorVersion
#endstruct
#defstruct global USN_RECORD_V2
#field int RecordLength
#field short MajorVersion
#field short MinorVersion
#field int64 FileReferenceNumber
#field int64 ParentFileReferenceNumber
#field int64 Usn
#field int64 TimeStamp
#field int Reason
#field int SourceInfo
#field int SecurityId
#field int FileAttributes
#field short FileNameLength
#field short FileNameOffset
#field wchar FileName 1
#endstruct
#defstruct global FILE_ID_128
#field byte Identifier 16
#endstruct
#defstruct global USN_RECORD_V3
#field int RecordLength
#field short MajorVersion
#field short MinorVersion
#field FILE_ID_128 FileReferenceNumber
#field FILE_ID_128 ParentFileReferenceNumber
#field int64 Usn
#field int64 TimeStamp
#field int Reason
#field int SourceInfo
#field int SecurityId
#field int FileAttributes
#field short FileNameLength
#field short FileNameOffset
#field wchar FileName 1
#endstruct
#defstruct global USN_RECORD_EXTENT
#field int64 Offset
#field int64 Length
#endstruct
#defstruct global USN_RECORD_V4
#field USN_RECORD_COMMON_HEADER Header
#field FILE_ID_128 FileReferenceNumber
#field FILE_ID_128 ParentFileReferenceNumber
#field int64 Usn
#field int Reason
#field int SourceInfo
#field int RemainingExtents
#field short NumberOfExtents
#field short ExtentSize
#field USN_RECORD_EXTENT Extents 1
#endstruct
#defstruct global USN_RECORD_UNION
#field USN_RECORD_COMMON_HEADER Header
#field USN_RECORD_V2 V2
#field USN_RECORD_V3 V3
#field USN_RECORD_V4 V4
#endstruct
stdim st, USN_RECORD_UNION ; NSTRUCT 変数を確保