Win32 API 日本語リファレンス
ホーム › System.Ioctl › USN_RECORD_V2

USN_RECORD_V2

構造体
📘 Microsoft Learn (日本語) · English
サイズx64: 64 バイト / x86: 64 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド型サイズx64x86説明
RecordLengthDWORD4+0+0このレコードのバイト単位の長さ。
MajorVersionWORD2+4+4USNレコードのメジャーバージョン(2)。
MinorVersionWORD2+6+6USNレコードのマイナーバージョン。
FileReferenceNumberULONGLONG8+8+8レコード対象ファイルの参照番号(FRN)。
ParentFileReferenceNumberULONGLONG8+16+16親ディレクトリのファイル参照番号(FRN)。
UsnLONGLONG8+24+24このレコードのUSN(更新シーケンス番号)。
TimeStampLONGLONG8+32+32変更が記録された時刻。FILETIME形式。
ReasonDWORD4+40+40ファイルに加えられた変更の理由を示すフラグのビットマスク。
SourceInfoDWORD4+44+44変更の発生元情報を示すフラグのビットマスク。
SecurityIdDWORD4+48+48ファイルのセキュリティ識別子(SecurityID)。
FileAttributesDWORD4+52+52ファイル属性のビットマスク。
FileNameLengthWORD2+56+56FileNameのバイト長。
FileNameOffsetWORD2+58+58構造体先頭からFileNameまでのバイトオフセット。
FileNameWCHAR2+60+60ファイル名。ワイド文字配列。先頭要素。

各言語での定義

#include <windows.h>

// USN_RECORD_V2  (x64 64 / x86 64 バイト)
typedef struct USN_RECORD_V2 {
    DWORD RecordLength;
    WORD MajorVersion;
    WORD MinorVersion;
    ULONGLONG FileReferenceNumber;
    ULONGLONG ParentFileReferenceNumber;
    LONGLONG Usn;
    LONGLONG TimeStamp;
    DWORD Reason;
    DWORD SourceInfo;
    DWORD SecurityId;
    DWORD FileAttributes;
    WORD FileNameLength;
    WORD FileNameOffset;
    WCHAR FileName[1];
} USN_RECORD_V2;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct USN_RECORD_V2
{
    public uint RecordLength;
    public ushort MajorVersion;
    public ushort MinorVersion;
    public ulong FileReferenceNumber;
    public ulong ParentFileReferenceNumber;
    public long Usn;
    public long TimeStamp;
    public uint Reason;
    public uint SourceInfo;
    public uint SecurityId;
    public uint FileAttributes;
    public ushort FileNameLength;
    public ushort FileNameOffset;
    [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)] public string FileName;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure USN_RECORD_V2
    Public RecordLength As UInteger
    Public MajorVersion As UShort
    Public MinorVersion As UShort
    Public FileReferenceNumber As ULong
    Public ParentFileReferenceNumber As ULong
    Public Usn As Long
    Public TimeStamp As Long
    Public Reason As UInteger
    Public SourceInfo As UInteger
    Public SecurityId As UInteger
    Public FileAttributes As UInteger
    Public FileNameLength As UShort
    Public FileNameOffset As UShort
    <MarshalAs(UnmanagedType.ByValTStr, SizeConst:=1)> Public FileName As String
End Structure
import ctypes
from ctypes import wintypes

class USN_RECORD_V2(ctypes.Structure):
    _fields_ = [
        ("RecordLength", wintypes.DWORD),
        ("MajorVersion", ctypes.c_ushort),
        ("MinorVersion", ctypes.c_ushort),
        ("FileReferenceNumber", ctypes.c_ulonglong),
        ("ParentFileReferenceNumber", ctypes.c_ulonglong),
        ("Usn", ctypes.c_longlong),
        ("TimeStamp", ctypes.c_longlong),
        ("Reason", wintypes.DWORD),
        ("SourceInfo", wintypes.DWORD),
        ("SecurityId", wintypes.DWORD),
        ("FileAttributes", wintypes.DWORD),
        ("FileNameLength", ctypes.c_ushort),
        ("FileNameOffset", ctypes.c_ushort),
        ("FileName", ctypes.c_wchar * 1),
    ]
#[repr(C)]
pub struct USN_RECORD_V2 {
    pub RecordLength: u32,
    pub MajorVersion: u16,
    pub MinorVersion: u16,
    pub FileReferenceNumber: u64,
    pub ParentFileReferenceNumber: u64,
    pub Usn: i64,
    pub TimeStamp: i64,
    pub Reason: u32,
    pub SourceInfo: u32,
    pub SecurityId: u32,
    pub FileAttributes: u32,
    pub FileNameLength: u16,
    pub FileNameOffset: u16,
    pub FileName: [u16; 1],
}
import "golang.org/x/sys/windows"

type USN_RECORD_V2 struct {
	RecordLength uint32
	MajorVersion uint16
	MinorVersion uint16
	FileReferenceNumber uint64
	ParentFileReferenceNumber uint64
	Usn int64
	TimeStamp int64
	Reason uint32
	SourceInfo uint32
	SecurityId uint32
	FileAttributes uint32
	FileNameLength uint16
	FileNameOffset uint16
	FileName [1]uint16
}
type
  USN_RECORD_V2 = record
    RecordLength: DWORD;
    MajorVersion: Word;
    MinorVersion: Word;
    FileReferenceNumber: UInt64;
    ParentFileReferenceNumber: UInt64;
    Usn: Int64;
    TimeStamp: Int64;
    Reason: DWORD;
    SourceInfo: DWORD;
    SecurityId: DWORD;
    FileAttributes: DWORD;
    FileNameLength: Word;
    FileNameOffset: Word;
    FileName: array[0..0] of WideChar;
  end;
const USN_RECORD_V2 = extern struct {
    RecordLength: u32,
    MajorVersion: u16,
    MinorVersion: u16,
    FileReferenceNumber: u64,
    ParentFileReferenceNumber: u64,
    Usn: i64,
    TimeStamp: i64,
    Reason: u32,
    SourceInfo: u32,
    SecurityId: u32,
    FileAttributes: u32,
    FileNameLength: u16,
    FileNameOffset: u16,
    FileName: [1]u16,
};
type
  USN_RECORD_V2 {.bycopy.} = object
    RecordLength: uint32
    MajorVersion: uint16
    MinorVersion: uint16
    FileReferenceNumber: uint64
    ParentFileReferenceNumber: uint64
    Usn: int64
    TimeStamp: int64
    Reason: uint32
    SourceInfo: uint32
    SecurityId: uint32
    FileAttributes: uint32
    FileNameLength: uint16
    FileNameOffset: uint16
    FileName: array[1, uint16]
struct USN_RECORD_V2
{
    uint RecordLength;
    ushort MajorVersion;
    ushort MinorVersion;
    ulong FileReferenceNumber;
    ulong ParentFileReferenceNumber;
    long Usn;
    long TimeStamp;
    uint Reason;
    uint SourceInfo;
    uint SecurityId;
    uint FileAttributes;
    ushort FileNameLength;
    ushort FileNameOffset;
    wchar[1] FileName;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; USN_RECORD_V2 サイズ: 64 バイト(x64)
dim st, 16    ; 4byte整数×16(構造体サイズ 64 / 4 切り上げ)
; RecordLength : DWORD (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; MajorVersion : WORD (+4, 2byte)  wpoke st,4,値  /  値 = wpeek(st,4)
; MinorVersion : WORD (+6, 2byte)  wpoke st,6,値  /  値 = wpeek(st,6)
; FileReferenceNumber : ULONGLONG (+8, 8byte)  qpoke st,8,値 / qpeek(st,8)  ※IronHSPのみ。3.7/3.8は lpoke st,8,下位 : lpoke st,12,上位
; ParentFileReferenceNumber : ULONGLONG (+16, 8byte)  qpoke st,16,値 / qpeek(st,16)  ※IronHSPのみ。3.7/3.8は lpoke st,16,下位 : lpoke st,20,上位
; Usn : LONGLONG (+24, 8byte)  qpoke st,24,値 / qpeek(st,24)  ※IronHSPのみ。3.7/3.8は lpoke st,24,下位 : lpoke st,28,上位
; TimeStamp : LONGLONG (+32, 8byte)  qpoke st,32,値 / qpeek(st,32)  ※IronHSPのみ。3.7/3.8は lpoke st,32,下位 : lpoke st,36,上位
; Reason : DWORD (+40, 4byte)  st.10 = 値  /  値 = st.10   (lpoke/lpeek も可)
; SourceInfo : DWORD (+44, 4byte)  st.11 = 値  /  値 = st.11   (lpoke/lpeek も可)
; SecurityId : DWORD (+48, 4byte)  st.12 = 値  /  値 = st.12   (lpoke/lpeek も可)
; FileAttributes : DWORD (+52, 4byte)  st.13 = 値  /  値 = st.13   (lpoke/lpeek も可)
; FileNameLength : WORD (+56, 2byte)  wpoke st,56,値  /  値 = wpeek(st,56)
; FileNameOffset : WORD (+58, 2byte)  wpoke st,58,値  /  値 = wpeek(st,58)
; FileName : WCHAR (+60, 2byte)  varptr(st)+60 を基点に操作(2byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
#defstruct global USN_RECORD_V2
    #field int RecordLength
    #field short MajorVersion
    #field short MinorVersion
    #field int64 FileReferenceNumber
    #field int64 ParentFileReferenceNumber
    #field int64 Usn
    #field int64 TimeStamp
    #field int Reason
    #field int SourceInfo
    #field int SecurityId
    #field int FileAttributes
    #field short FileNameLength
    #field short FileNameOffset
    #field wchar FileName 1
#endstruct

stdim st, USN_RECORD_V2        ; NSTRUCT 変数を確保
st->RecordLength = 100
mes "RecordLength=" + st->RecordLength