Win32 API 日本語リファレンス
ホーム › System.Ioctl › USN_RECORD_V3

USN_RECORD_V3

構造体
📘 Microsoft Learn (日本語) · English
サイズx64: 80 バイト / x86: 80 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド型サイズx64x86説明
RecordLengthDWORD4+0+0このレコードのバイト単位の長さ。
MajorVersionWORD2+4+4USNレコードのメジャーバージョン(3)。
MinorVersionWORD2+6+6USNレコードのマイナーバージョン。
FileReferenceNumberFILE_ID_12816+8+8レコード対象ファイルの128ビットファイル参照番号。
ParentFileReferenceNumberFILE_ID_12816+24+24親ディレクトリの128ビットファイル参照番号。
UsnLONGLONG8+40+40このレコードのUSN(更新シーケンス番号)。
TimeStampLONGLONG8+48+48変更が記録された時刻。FILETIME形式。
ReasonDWORD4+56+56ファイルに加えられた変更の理由を示すフラグのビットマスク。
SourceInfoDWORD4+60+60変更の発生元情報を示すフラグのビットマスク。
SecurityIdDWORD4+64+64ファイルのセキュリティ識別子(SecurityID)。
FileAttributesDWORD4+68+68ファイル属性のビットマスク。
FileNameLengthWORD2+72+72FileNameのバイト長。
FileNameOffsetWORD2+74+74構造体先頭からFileNameまでのバイトオフセット。
FileNameWCHAR2+76+76ファイル名。ワイド文字配列。先頭要素。

各言語での定義

#include <windows.h>

// FILE_ID_128  (x64 16 / x86 16 バイト)
typedef struct FILE_ID_128 {
    BYTE Identifier[16];
} FILE_ID_128;

// USN_RECORD_V3  (x64 80 / x86 80 バイト)
typedef struct USN_RECORD_V3 {
    DWORD RecordLength;
    WORD MajorVersion;
    WORD MinorVersion;
    FILE_ID_128 FileReferenceNumber;
    FILE_ID_128 ParentFileReferenceNumber;
    LONGLONG Usn;
    LONGLONG TimeStamp;
    DWORD Reason;
    DWORD SourceInfo;
    DWORD SecurityId;
    DWORD FileAttributes;
    WORD FileNameLength;
    WORD FileNameOffset;
    WCHAR FileName[1];
} USN_RECORD_V3;
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct FILE_ID_128
{
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] public byte[] Identifier;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct USN_RECORD_V3
{
    public uint RecordLength;
    public ushort MajorVersion;
    public ushort MinorVersion;
    public FILE_ID_128 FileReferenceNumber;
    public FILE_ID_128 ParentFileReferenceNumber;
    public long Usn;
    public long TimeStamp;
    public uint Reason;
    public uint SourceInfo;
    public uint SecurityId;
    public uint FileAttributes;
    public ushort FileNameLength;
    public ushort FileNameOffset;
    [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)] public string FileName;
}
Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure FILE_ID_128
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=16)> Public Identifier() As Byte
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure USN_RECORD_V3
    Public RecordLength As UInteger
    Public MajorVersion As UShort
    Public MinorVersion As UShort
    Public FileReferenceNumber As FILE_ID_128
    Public ParentFileReferenceNumber As FILE_ID_128
    Public Usn As Long
    Public TimeStamp As Long
    Public Reason As UInteger
    Public SourceInfo As UInteger
    Public SecurityId As UInteger
    Public FileAttributes As UInteger
    Public FileNameLength As UShort
    Public FileNameOffset As UShort
    <MarshalAs(UnmanagedType.ByValTStr, SizeConst:=1)> Public FileName As String
End Structure
import ctypes
from ctypes import wintypes

class FILE_ID_128(ctypes.Structure):
    _fields_ = [
        ("Identifier", ctypes.c_ubyte * 16),
    ]

class USN_RECORD_V3(ctypes.Structure):
    _fields_ = [
        ("RecordLength", wintypes.DWORD),
        ("MajorVersion", ctypes.c_ushort),
        ("MinorVersion", ctypes.c_ushort),
        ("FileReferenceNumber", FILE_ID_128),
        ("ParentFileReferenceNumber", FILE_ID_128),
        ("Usn", ctypes.c_longlong),
        ("TimeStamp", ctypes.c_longlong),
        ("Reason", wintypes.DWORD),
        ("SourceInfo", wintypes.DWORD),
        ("SecurityId", wintypes.DWORD),
        ("FileAttributes", wintypes.DWORD),
        ("FileNameLength", ctypes.c_ushort),
        ("FileNameOffset", ctypes.c_ushort),
        ("FileName", ctypes.c_wchar * 1),
    ]
#[repr(C)]
pub struct FILE_ID_128 {
    pub Identifier: [u8; 16],
}

#[repr(C)]
pub struct USN_RECORD_V3 {
    pub RecordLength: u32,
    pub MajorVersion: u16,
    pub MinorVersion: u16,
    pub FileReferenceNumber: FILE_ID_128,
    pub ParentFileReferenceNumber: FILE_ID_128,
    pub Usn: i64,
    pub TimeStamp: i64,
    pub Reason: u32,
    pub SourceInfo: u32,
    pub SecurityId: u32,
    pub FileAttributes: u32,
    pub FileNameLength: u16,
    pub FileNameOffset: u16,
    pub FileName: [u16; 1],
}
import "golang.org/x/sys/windows"

type FILE_ID_128 struct {
	Identifier [16]byte
}

type USN_RECORD_V3 struct {
	RecordLength uint32
	MajorVersion uint16
	MinorVersion uint16
	FileReferenceNumber FILE_ID_128
	ParentFileReferenceNumber FILE_ID_128
	Usn int64
	TimeStamp int64
	Reason uint32
	SourceInfo uint32
	SecurityId uint32
	FileAttributes uint32
	FileNameLength uint16
	FileNameOffset uint16
	FileName [1]uint16
}
type
  FILE_ID_128 = record
    Identifier: array[0..15] of Byte;
  end;

  USN_RECORD_V3 = record
    RecordLength: DWORD;
    MajorVersion: Word;
    MinorVersion: Word;
    FileReferenceNumber: FILE_ID_128;
    ParentFileReferenceNumber: FILE_ID_128;
    Usn: Int64;
    TimeStamp: Int64;
    Reason: DWORD;
    SourceInfo: DWORD;
    SecurityId: DWORD;
    FileAttributes: DWORD;
    FileNameLength: Word;
    FileNameOffset: Word;
    FileName: array[0..0] of WideChar;
  end;
const FILE_ID_128 = extern struct {
    Identifier: [16]u8,
};

const USN_RECORD_V3 = extern struct {
    RecordLength: u32,
    MajorVersion: u16,
    MinorVersion: u16,
    FileReferenceNumber: FILE_ID_128,
    ParentFileReferenceNumber: FILE_ID_128,
    Usn: i64,
    TimeStamp: i64,
    Reason: u32,
    SourceInfo: u32,
    SecurityId: u32,
    FileAttributes: u32,
    FileNameLength: u16,
    FileNameOffset: u16,
    FileName: [1]u16,
};
type
  FILE_ID_128 {.bycopy.} = object
    Identifier: array[16, uint8]

  USN_RECORD_V3 {.bycopy.} = object
    RecordLength: uint32
    MajorVersion: uint16
    MinorVersion: uint16
    FileReferenceNumber: FILE_ID_128
    ParentFileReferenceNumber: FILE_ID_128
    Usn: int64
    TimeStamp: int64
    Reason: uint32
    SourceInfo: uint32
    SecurityId: uint32
    FileAttributes: uint32
    FileNameLength: uint16
    FileNameOffset: uint16
    FileName: array[1, uint16]
struct FILE_ID_128
{
    ubyte[16] Identifier;
}

struct USN_RECORD_V3
{
    uint RecordLength;
    ushort MajorVersion;
    ushort MinorVersion;
    FILE_ID_128 FileReferenceNumber;
    FILE_ID_128 ParentFileReferenceNumber;
    long Usn;
    long TimeStamp;
    uint Reason;
    uint SourceInfo;
    uint SecurityId;
    uint FileAttributes;
    ushort FileNameLength;
    ushort FileNameOffset;
    wchar[1] FileName;
}

HSP用 定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; USN_RECORD_V3 サイズ: 80 バイト(x64)
dim st, 20    ; 4byte整数×20(構造体サイズ 80 / 4 切り上げ)
; RecordLength : DWORD (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; MajorVersion : WORD (+4, 2byte)  wpoke st,4,値  /  値 = wpeek(st,4)
; MinorVersion : WORD (+6, 2byte)  wpoke st,6,値  /  値 = wpeek(st,6)
; FileReferenceNumber : FILE_ID_128 (+8, 16byte)  varptr(st)+8 を基点に操作(16byte:入れ子/配列)
; ParentFileReferenceNumber : FILE_ID_128 (+24, 16byte)  varptr(st)+24 を基点に操作(16byte:入れ子/配列)
; Usn : LONGLONG (+40, 8byte)  qpoke st,40,値 / qpeek(st,40)  ※IronHSPのみ。3.7/3.8は lpoke st,40,下位 : lpoke st,44,上位
; TimeStamp : LONGLONG (+48, 8byte)  qpoke st,48,値 / qpeek(st,48)  ※IronHSPのみ。3.7/3.8は lpoke st,48,下位 : lpoke st,52,上位
; Reason : DWORD (+56, 4byte)  st.14 = 値  /  値 = st.14   (lpoke/lpeek も可)
; SourceInfo : DWORD (+60, 4byte)  st.15 = 値  /  値 = st.15   (lpoke/lpeek も可)
; SecurityId : DWORD (+64, 4byte)  st.16 = 値  /  値 = st.16   (lpoke/lpeek も可)
; FileAttributes : DWORD (+68, 4byte)  st.17 = 値  /  値 = st.17   (lpoke/lpeek も可)
; FileNameLength : WORD (+72, 2byte)  wpoke st,72,値  /  値 = wpeek(st,72)
; FileNameOffset : WORD (+74, 2byte)  wpoke st,74,値  /  値 = wpeek(st,74)
; FileName : WCHAR (+76, 2byte)  varptr(st)+76 を基点に操作(2byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。
; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global FILE_ID_128
    #field byte Identifier 16
#endstruct

#defstruct global USN_RECORD_V3
    #field int RecordLength
    #field short MajorVersion
    #field short MinorVersion
    #field FILE_ID_128 FileReferenceNumber
    #field FILE_ID_128 ParentFileReferenceNumber
    #field int64 Usn
    #field int64 TimeStamp
    #field int Reason
    #field int SourceInfo
    #field int SecurityId
    #field int FileAttributes
    #field short FileNameLength
    #field short FileNameOffset
    #field wchar FileName 1
#endstruct

stdim st, USN_RECORD_V3        ; NSTRUCT 変数を確保
st->RecordLength = 100
mes "RecordLength=" + st->RecordLength