using System;
using System.Runtime.InteropServices;
using System.Text;
using Vanara.Extensions;
using Vanara.InteropServices;
using static Vanara.PInvoke.DbgHelp;
namespace Vanara.PInvoke
{
/// Items from the ImageHlp.dll
public static partial class ImageHlp
{
private const string Lib_ImageHlp = "imagehlp.dll";
///
/// An application-defined callback function used by the ImageGetDigestStream function to process data.
///
/// The DIGEST_FUNCTION type defines a pointer to this callback function. DigestFunction is a placeholder for the
/// application-defined function name.
///
///
///
/// A user-supplied handle to the digest. This value is passed as a parameter to the ImageGetDigestStream function.
///
/// The data stream.
/// The size of the data stream, in bytes.
///
/// If the function succeeds, the return value should be TRUE. If the function fails, the return value should be FALSE.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nc-imagehlp-digest_function DIGEST_FUNCTION DigestFunction; BOOL
// DigestFunction( DIGEST_HANDLE refdata, PBYTE pData, DWORD dwLength ) {...}
[UnmanagedFunctionPointer(CallingConvention.Winapi, CharSet = CharSet.Ansi)]
[PInvokeData("imagehlp.h", MSDNShortId = "NC:imagehlp.DIGEST_FUNCTION")]
[return: MarshalAs(UnmanagedType.Bool)]
public delegate bool DIGEST_FUNCTION(IntPtr refdata, IntPtr pData, uint dwLength);
///
///
/// An application-defined callback function used with the BindImageEx function. The status routine is called during the process of
/// the image binding.
///
///
/// The PIMAGEHLP_STATUS_ROUTINE type defines a pointer to this callback function. StatusRoutine is a placeholder for
/// the application-defined function name.
///
///
///
/// The current status of the bind operation. This parameter can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// BindOutOfMemory 0
/// Out of memory. The Parameter value is the number of bytes in the allocation attempt.
///
/// -
/// BindRvaToVaFailed 1
/// The relative virtual address is invalid for the image. The Parameter value is not used.
///
/// -
/// BindNoRoomInImage 2
/// No room in the image for new format import table. The Parameter value is not used.
///
/// -
/// BindImportModuleFailed 3
/// Module import failed. The Parameter value is not used.
///
/// -
/// BindImportProcedureFailed 4
/// Procedure import failed. The Parameter value is the name of the function.
///
/// -
/// BindImportModule 5
/// Module import is starting. The Parameter value is not used.
///
/// -
/// BindImportProcedure 6
/// Procedure import is starting. The Parameter value is the name of the function.
///
/// -
/// BindForwarder 7
/// The Parameter value is the name of the function forwarded.
///
/// -
/// BindForwarderNOT 8
/// The Parameter value is the name of the function not forwarded.
///
/// -
/// BindImageModified 9
/// Image modified. The Parameter value is not used.
///
/// -
/// BindExpandFileHeaders 10
/// File headers expanded. The Parameter value is the number of bytes
///
/// -
/// BindImageComplete 11
/// Binding is complete. For more information on the Parameter value, see the following Remarks section.
///
/// -
/// BindMismatchedSymbols 12
/// Checksum did not match. The Parameter value is the name of the symbol file.
///
/// -
/// BindSymbolsNotUpdated 13
/// Symbol file was not updated. The Parameter value is the name of the symbol file not updated.
///
///
///
/// The name of the file to be bound. This value can be a file name, a partial path, or a full path.
/// The name of the DLL.
/// The computed virtual address.
///
/// Any additional status information. This value depends on the value of the Reason parameter. For more information, see the code
/// fragment in the following Remarks section.
///
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
/// The following code fragment describes how to use the Va value when the status is BindImageComplete.
///
/// case BindImageComplete: if (fVerbose) { fprintf(stderr, "BIND: Details of binding %s\n", ImageName ); NewImports = (PIMAGE_BOUND_IMPORT_DESCRIPTOR)Va; NewImport = NewImports; while (NewImport->OffsetModuleName) { fprintf( stderr, " Import from %s [%x]", (LPSTR)NewImports + NewImport->OffsetModuleName, NewImport->TimeDateStamp ); if (NewImport->NumberOfModuleForwarderRefs != 0) { fprintf( stderr, " with %u forwarders", NewImport-> NumberOfModuleForwarderRefs ); } fprintf( stderr, "\n" ); NewForwarder = (PIMAGE_BOUND_FORWARDER_REF)(NewImport+1); for (i=0; i<NewImport->NumberOfModuleForwarderRefs; i++) { fprintf( stderr, " Forward to %s [%x]\n", (LPSTR)NewImports + NewForwarder->OffsetModuleName, NewForwarder->TimeDateStamp); NewForwarder += 1; } NewImport = (PIMAGE_BOUND_IMPORT_DESCRIPTOR)NewForwarder; } } break;
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nc-imagehlp-pimagehlp_status_routine PIMAGEHLP_STATUS_ROUTINE
// PimagehlpStatusRoutine; BOOL PimagehlpStatusRoutine( IMAGEHLP_STATUS_REASON Reason, PCSTR ImageName, PCSTR DllName, ULONG_PTR Va,
// ULONG_PTR Parameter ) {...}
[UnmanagedFunctionPointer(CallingConvention.Winapi, CharSet = CharSet.Ansi)]
[PInvokeData("imagehlp.h", MSDNShortId = "NC:imagehlp.PIMAGEHLP_STATUS_ROUTINE")]
[return: MarshalAs(UnmanagedType.Bool)]
public delegate bool PIMAGEHLP_STATUS_ROUTINE(IMAGEHLP_STATUS_REASON Reason, string ImageName, string DllName, IntPtr Va, IntPtr Parameter);
/*
public enum IMAGEHLP_SYMBOL_TYPE_INFO
{
TI_GET_SYMTAG,
TI_GET_SYMNAME,
TI_GET_LENGTH,
TI_GET_TYPE,
TI_GET_TYPEID,
TI_GET_BASETYPE,
TI_GET_ARRAYINDEXTYPEID,
TI_FINDCHILDREN,
TI_GET_DATAKIND,
TI_GET_ADDRESSOFFSET,
TI_GET_OFFSET,
TI_GET_VALUE,
TI_GET_COUNT,
TI_GET_CHILDRENCOUNT,
TI_GET_BITPOSITION,
TI_GET_VIRTUALBASECLASS,
TI_GET_VIRTUALTABLESHAPEID,
TI_GET_VIRTUALBASEPOINTEROFFSET,
TI_GET_CLASSPARENTID,
TI_GET_NESTED,
TI_GET_SYMINDEX,
TI_GET_LEXICALPARENT,
TI_GET_ADDRESS,
TI_GET_THISADJUST,
TI_GET_UDTKIND,
TI_IS_EQUIV_TO,
TI_GET_CALLING_CONVENTION,
TI_IS_CLOSE_EQUIV_TO,
TI_GTIEX_REQS_VALID,
TI_GET_VIRTUALBASEOFFSET,
TI_GET_VIRTUALBASEDISPINDEX,
TI_GET_IS_REFERENCE,
TI_GET_INDIRECTVIRTUALBASECLASS,
TI_GET_VIRTUALBASETABLETYPE,
IMAGEHLP_SYMBOL_TYPE_INFO_MAX,
}
public enum SYM_TYPE
{
SymNone = 0,
SymCoff,
SymCv,
SymPdb,
SymExport,
SymDeferred,
SymSym, // .sym file
SymDia,
SymVirtual,
NumSymTypes
}
public enum SymTagEnum
{
SymTagNull,
SymTagExe,
SymTagCompiland,
SymTagCompilandDetails,
SymTagCompilandEnv,
SymTagFunction,
SymTagBlock,
SymTagData,
SymTagAnnotation,
SymTagLabel,
SymTagPublicSymbol,
SymTagUDT,
SymTagEnum,
SymTagFunctionType,
SymTagPointerType,
SymTagArrayType,
SymTagBaseType,
SymTagTypedef,
SymTagBaseClass,
SymTagFriend,
SymTagFunctionArgType,
SymTagFuncDebugStart,
SymTagFuncDebugEnd,
SymTagUsingNamespace,
SymTagVTableShape,
SymTagVTable,
SymTagCustom,
SymTagThunk,
SymTagCustomType,
SymTagManagedType,
SymTagDimension,
SymTagCallSite,
SymTagInlineSite,
SymTagBaseInterface,
SymTagVectorType,
SymTagMatrixType,
SymTagHLSLType,
SymTagCaller,
SymTagCallee,
SymTagExport,
SymTagHeapAllocationSite,
SymTagCoffGroup,
SymTagMax
}
public enum ADDRESS_MODE
{
AddrMode1616,
AddrMode1632,
AddrModeReal,
AddrModeFlat
}
*/
/// The bind options for .
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.BindImageEx")]
[Flags]
public enum BINDOPTS
{
/// Bind all images in the call tree for this file.
BIND_ALL_IMAGES = 0x00000004,
///
/// Do not discard DLL information in the cache between calls. This improves performance when binding a large number of images.
///
BIND_CACHE_IMPORT_DLLS = 0x00000008,
/// Do not generate a new import address table.
BIND_NO_BOUND_IMPORTS = 0x00000001,
/// Do not make changes to the file.
BIND_NO_UPDATE = 0x00000002,
///
BIND_REPORT_64BIT_VA = 0x00000010,
}
/// Return code from .
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.MapFileAndCheckSumA")]
public enum CHECKSUM
{
/// Could not map a view of the file.
CHECKSUM_MAPVIEW_FAILURE = 3,
/// Could not map the file.
CHECKSUM_MAP_FAILURE = 2,
/// Could not open the file.
CHECKSUM_OPEN_FAILURE = 1,
/// The function succeeded.
CHECKSUM_SUCCESS = 0,
/// CHECKSUM_UNICODE_FAILURE 4
CHECKSUM_UNICODE_FAILURE = 4,
}
/// The current status of the bind operation.
[PInvokeData("imagehlp.h", MSDNShortId = "NC:imagehlp.PIMAGEHLP_STATUS_ROUTINE")]
public enum IMAGEHLP_STATUS_REASON
{
/// Out of memory. The Parameter value is the number of bytes in the allocation attempt.
BindOutOfMemory = 0,
/// The relative virtual address is invalid for the image. The Parameter value is not used.
BindRvaToVaFailed = 1,
/// No room in the image for new format import table. The Parameter value is not used.
BindNoRoomInImage = 2,
/// Module import failed. The Parameter value is not used.
BindImportModuleFailed = 3,
/// Procedure import failed. The Parameter value is the name of the function.
BindImportProcedureFailed = 4,
/// Module import is starting. The Parameter value is not used.
BindImportModule = 5,
/// Procedure import is starting. The Parameter value is the name of the function.
BindImportProcedure = 6,
/// The Parameter value is the name of the function forwarded.
BindForwarder = 7,
/// The Parameter value is the name of the function not forwarded.
BindForwarderNOT = 8,
/// Image modified. The Parameter value is not used.
BindImageModified = 9,
/// File headers expanded. The Parameter value is the number of bytes
BindExpandFileHeaders = 10,
/// Binding is complete. For more information on the Parameter value, see the following Remarks section.
BindImageComplete = 11,
/// Checksum did not match. The Parameter value is the name of the symbol file.
BindMismatchedSymbols = 12,
/// Symbol file was not updated. The Parameter value is the name of the symbol file not updated.
BindSymbolsNotUpdated = 13,
}
/// The information to be split from the image.
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.SplitSymbols")]
[Flags]
public enum SPLITSYM
{
///
/// Usually, an image with the symbols split off will still contain a MISC debug directory with the name of the symbol file.
/// Therefore, the debugger can still find the symbols. Using this flag removes this link. The end result is similar to using
/// the -debug:none switch on the Microsoft linker.
///
SPLITSYM_EXTRACT_ALL = 0x00000002,
/// This strips off the private CodeView symbolic information when generating the symbol file.
SPLITSYM_REMOVE_PRIVATE = 0x00000001,
/// The symbol file path contains an alternate path to locate the .pdb file.
SPLITSYM_SYMBOLPATH_IS_SRC = 0x00000004,
}
/// Computes the virtual address of each function that is imported.
///
/// The bind options. This parameter can be a combination of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// BIND_ALL_IMAGES 0x00000004
/// Bind all images in the call tree for this file.
///
/// -
/// BIND_CACHE_IMPORT_DLLS 0x00000008
/// Do not discard DLL information in the cache between calls. This improves performance when binding a large number of images.
///
/// -
/// BIND_NO_BOUND_IMPORTS 0x00000001
/// Do not generate a new import address table.
///
/// -
/// BIND_NO_UPDATE 0x00000002
/// Do not make changes to the file.
///
///
///
/// The name of the file to be bound. This value can be a file name, a partial path, or a full path.
/// The root of the search path to use if the file specified by the ImageName parameter cannot be opened.
/// The root of the path to search for the file's corresponding symbol file.
///
/// A pointer to a status routine. The status routine is called during the progress of the image binding. For more information, see StatusRoutine.
///
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
///
/// The process of binding an image consists of computing the virtual address of each imported function. The computed virtual
/// address is then saved in the importing image's Import Address Table (IAT). As a result, the image is loaded much faster,
/// particularly if it uses many DLLs, because the system loader does not have to compute the address of each imported function.
///
/// If a corresponding symbol file can be located, its time stamp and checksum are updated.
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-bindimageex BOOL IMAGEAPI BindImageEx( DWORD Flags, PCSTR
// ImageName, PCSTR DllPath, PCSTR SymbolPath, PIMAGEHLP_STATUS_ROUTINE StatusRoutine );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.BindImageEx")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool BindImageEx(BINDOPTS Flags, [MarshalAs(UnmanagedType.LPStr)] string ImageName, [MarshalAs(UnmanagedType.LPStr)] string DllPath,
[MarshalAs(UnmanagedType.LPStr)] string SymbolPath, PIMAGEHLP_STATUS_ROUTINE StatusRoutine);
/// Computes the checksum of the specified image file.
/// The base address of the mapped file. This value is obtained by calling the MapViewOfFile function.
/// The size of the file, in bytes.
///
/// A pointer to a variable that receives the original checksum from the image file, or zero if there is an error.
///
/// A pointer to the variable that receives the computed checksum.
///
/// If the function succeeds, the return value is a pointer to the IMAGE_NT_HEADERS structure contained in the mapped image.
/// If the function fails, the return value is NULL. To retrieve extended error information, call GetLastError.
///
///
///
/// The CheckSumMappedFile function computes a new checksum for the file and returns it in the CheckSum parameter. This
/// function is used by any application that creates or modifies an executable image. Checksums are required for kernel-mode drivers
/// and some system DLLs. The linker computes the original checksum at link time, if you use the appropriate linker switch. For more
/// details, see your linker documentation.
///
///
/// It is recommended that all images have valid checksums. It is the caller's responsibility to place the newly computed checksum
/// into the mapped image and update the on-disk image of the file.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-checksummappedfile PIMAGE_NT_HEADERS IMAGEAPI
// CheckSumMappedFile( PVOID BaseAddress, DWORD FileLength, PDWORD HeaderSum, PDWORD CheckSum );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.CheckSumMappedFile")]
public static extern IntPtr CheckSumMappedFile(IntPtr BaseAddress, uint FileLength, out uint HeaderSum, out uint CheckSum);
/// Locates and returns the load configuration data of an image.
/// A pointer to a LOADED_IMAGE structure that is returned from a call to MapAndLoad or ImageLoad.
///
/// A pointer to an IMAGE_LOAD_CONFIG_DIRECTORY64 structure that receives the configuration information.
///
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
/// The SetImageConfigInformation function locates and changes the load configuration data of an image.
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-getimageconfiginformation BOOL IMAGEAPI
// GetImageConfigInformation( PLOADED_IMAGE LoadedImage, PIMAGE_LOAD_CONFIG_DIRECTORY ImageConfigInformation );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.GetImageConfigInformation")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool GetImageConfigInformation(in LOADED_IMAGE LoadedImage, out IMAGE_LOAD_CONFIG_DIRECTORY32 ImageConfigInformation);
/// Retrieves the offset and size of the part of the PE header that is currently unused.
/// A pointer to a LOADED_IMAGE structure that is returned from a call to MapAndLoad or ImageLoad.
///
/// A pointer to a variable to receive the size, in bytes, of the part of the image's header which is unused.
///
///
/// If the function succeeds, the return value is the offset from the base address of the first unused header byte.
/// If the function fails, the return value is zero. To retrieve extended error information, call GetLastError.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-getimageunusedheaderbytes DWORD IMAGEAPI
// GetImageUnusedHeaderBytes( PLOADED_IMAGE LoadedImage, PDWORD SizeUnusedHeaderBytes );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.GetImageUnusedHeaderBytes")]
public static extern uint GetImageUnusedHeaderBytes(in LOADED_IMAGE LoadedImage, out uint SizeUnusedHeaderBytes);
/// Adds a certificate to the specified file.
///
/// A handle to the image file to be modified. This handle must be opened for FILE_READ_DATA and FILE_WRITE_DATA access.
///
///
/// A pointer to a WIN_CERTIFICATE header and all associated sections. The Length member in the certificate header
/// will be used to determine the length of this buffer.
///
/// A pointer to a variable that receives the index of the newly added certificate.
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
/// The certificate is added at the end of the existing list of certificates and is assigned an index.
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-imageaddcertificate BOOL IMAGEAPI ImageAddCertificate(
// HANDLE FileHandle, LPWIN_CERTIFICATE Certificate, PDWORD Index );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.ImageAddCertificate")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool ImageAddCertificate(HFILE FileHandle, [In] IntPtr Certificate, out uint Index);
/// Retrieves information about the certificates currently contained in an image file.
/// A handle to the image file to be examined. This handle must be opened for FILE_READ_DATA access.
///
/// The certificate section type to be used as a filter when returning certificate information. CERT_SECTION_TYPE_ANY should be
/// passed for information on all section types present in the image.
///
///
/// A pointer to a variable that receives the number of certificates in the image containing sections of the type specified by the
/// TypeFilter parameter. If none are found, this parameter is zero.
///
///
/// Optionally provides a buffer to use to return an array of indices to the certificates containing sections of the specified type.
/// No ordering should be assumed for the index values, nor are they guaranteed to be contiguous when CERT_SECTION_TYPE_ANY is queried.
///
///
/// The size of the Indices buffer, in DWORDs. This parameter will be examined whenever Indices is present. If
/// CertificateCount is greater than IndexCount, Indices will be filled in with the first IndexCount sections found in the image;
/// any others will not be returned.
///
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
///
/// The ImageEnumerateCertificates function returns information about the certificates currently contained in an image file.
/// It has filtering capabilities which allow certificates containing sections of any single type (or of any type) to be returned.
///
///
/// After the indices of interesting certificates are discovered, they can be passed to the ImageGetCertificateData function to
/// obtain the actual bodies of the certificates.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-imageenumeratecertificates BOOL IMAGEAPI
// ImageEnumerateCertificates( HANDLE FileHandle, WORD TypeFilter, PDWORD CertificateCount, PDWORD Indices, DWORD IndexCount );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.ImageEnumerateCertificates")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool ImageEnumerateCertificates(HFILE FileHandle, ushort TypeFilter, out uint CertificateCount,
[Optional, In, Out, MarshalAs(UnmanagedType.LPArray, SizeParamIndex = 4)] uint[] Indices, uint IndexCount);
/// Retrieves a complete certificate from a file.
/// A handle to the image file. This handle must be opened for FILE_READ_DATA access.
/// The index of the certificate to be returned.
///
/// A pointer to a WIN_CERTIFICATE structure that receives the certificate data. If the buffer is not large enough to contain
/// the structure, the function fails and the last error code is set to ERROR_INSUFFICIENT_BUFFER.
///
///
/// On input, this parameter specifies the length of the Certificate buffer in bytes. On success, it receives the length of the certificate.
///
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
/// The WIN_CERTIFICATE structure is defined as follows:
///
/// typedef struct _WIN_CERTIFICATE { DWORD dwLength; WORD wRevision; WORD wCertificateType; // WIN_CERT_TYPE_xxx BYTE bCertificate[ANYSIZE_ARRAY]; } WIN_CERTIFICATE, *LPWIN_CERTIFICATE;
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-imagegetcertificatedata BOOL IMAGEAPI
// ImageGetCertificateData( HANDLE FileHandle, DWORD CertificateIndex, LPWIN_CERTIFICATE Certificate, PDWORD RequiredLength );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.ImageGetCertificateData")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool ImageGetCertificateData(HFILE FileHandle, uint CertificateIndex, [Out] IntPtr Certificate, ref uint RequiredLength);
/// Retrieves the header of the specified certificate, up to, but not including, the section offset array.
/// A handle to the image file. This handle must be opened for FILE_READ_DATA access.
/// The index of the certificate whose header is to be returned.
/// A pointer to the WIN_CERTIFICATE structure that receives the certificate header.
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-imagegetcertificateheader BOOL IMAGEAPI
// ImageGetCertificateHeader( HANDLE FileHandle, DWORD CertificateIndex, LPWIN_CERTIFICATE Certificateheader );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.ImageGetCertificateHeader")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool ImageGetCertificateHeader(HFILE FileHandle, uint CertificateIndex, [In, Out] IntPtr Certificateheader);
/// Retrieves the requested data from the specified image file.
/// A handle to the image file. This handle must be opened for FILE_READ_DATA access.
///
///
/// The aspects of the image that are to be included in the returned data stream. This parameter can be one or more of the following values.
///
///
///
/// Value
/// Meaning
///
/// -
/// CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO 0x04
/// Include all import information.
///
/// -
/// CERT_PE_IMAGE_DIGEST_DEBUG_INFO 0x01
/// Include symbolic debugging information.
///
/// -
/// CERT_PE_IMAGE_DIGEST_RESOURCES 0x02
/// Include resource information.
///
///
///
/// A pointer to a callback routine to process the data. For more information, see DigestFunction.
/// A user-supplied handle to the digest. This parameter is passed to DigestFunction as the first argument.
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
///
/// The ImageGetDigestStream function returns the data to be digested from a specified image file, subject to the passed
/// DigestLevel parameter. The order of the bytes will be consistent for different calls, which is required to ensure that the same
/// message digest is always produced from the retrieved byte stream.
///
///
/// To ensure cross-platform compatibility, all implementations of this function must behave in a consistent manner with respect to
/// the order in which the various parts of the image file are returned.
///
/// Data should be returned in the following order:
///
/// -
/// Image (executable and static data) information.
///
/// -
/// Resource data.
///
/// -
/// Debugging information.
///
///
/// If any of these are not specified, the remaining parts must be returned in the same order.
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-imagegetdigeststream BOOL IMAGEAPI ImageGetDigestStream(
// HANDLE FileHandle, DWORD DigestLevel, DIGEST_FUNCTION DigestFunction, DIGEST_HANDLE DigestHandle );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.ImageGetDigestStream")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool ImageGetDigestStream(HFILE FileHandle, uint DigestLevel, DIGEST_FUNCTION DigestFunction, IntPtr DigestHandle);
/// Maintains a list of loaded DLLs.
/// The name of the image.
///
/// The path used to locate the image if the name provided cannot be found. If NULL is used, then the search path rules set
/// forth in the SearchPath function apply.
///
///
/// If the function succeeds, the return value is a pointer to a LOADED_IMAGE structure.
/// If the function fails, the return value is NULL. To retrieve extended error information, call GetLastError.
///
///
///
/// The ImageLoad function is used to maintain a list of loaded DLLs. If the image has already been loaded, the prior
/// LOADED_IMAGE is returned. Otherwise, the new image is added to the list.
///
/// The LOADED_IMAGE structure must be deallocated by the ImageUnload function.
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-imageload PLOADED_IMAGE IMAGEAPI ImageLoad( PCSTR
// DllName, PCSTR DllPath );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.ImageLoad")]
public static extern SafeLOADED_IMAGE ImageLoad([MarshalAs(UnmanagedType.LPStr)] string DllName, [MarshalAs(UnmanagedType.LPStr)] string DllPath);
/// Removes the specified certificate from the given file.
///
/// A handle to the image file to be modified. This handle must be opened for FILE_READ_DATA and FILE_WRITE_DATA access.
///
/// The index of the certificate to be removed.
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-imageremovecertificate BOOL IMAGEAPI
// ImageRemoveCertificate( HANDLE FileHandle, DWORD Index );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.ImageRemoveCertificate")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool ImageRemoveCertificate(HFILE FileHandle, uint Index);
/// Deallocates resources from a previous call to the ImageLoad function.
/// A pointer to a LOADED_IMAGE structure that is returned from a call to the ImageLoad function.
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
/// ImageLoad and ImageUnload share internal data that can be corrupted if multiple consecutive calls to ImageLoad are
/// performed. Therefore, make sure that you have called ImageLoad only once before calling ImageUnload.
///
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-imageunload BOOL IMAGEAPI ImageUnload( PLOADED_IMAGE
// LoadedImage );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.ImageUnload")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool ImageUnload(IntPtr LoadedImage);
/// Maps an image and preloads data from the mapped file.
/// The file name of the image (executable file or DLL) that is loaded.
///
/// The path used to locate the image if the name provided cannot be found. If this parameter is NULL, then the search path
/// rules set using the SearchPath function apply.
///
/// A pointer to a LOADED_IMAGE structure that receives information about the image after it is loaded.
///
/// The default extension to be used if the image name does not contain a file name extension. If the value is TRUE, a .DLL
/// extension is used. If the value is FALSE, then an .EXE extension is used.
///
///
/// The access mode. If this value is TRUE, the file is mapped for read-access only. If the value is FALSE, the file
/// is mapped for read and write access.
///
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
///
/// The MapAndLoad function maps an image and preloads data from the mapped file. The corresponding function, UnMapAndLoad,
/// must be used to deallocate all resources that are allocated by the MapAndLoad function.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-mapandload BOOL IMAGEAPI MapAndLoad( PCSTR ImageName,
// PCSTR DllPath, PLOADED_IMAGE LoadedImage, BOOL DotDll, BOOL ReadOnly );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true, CharSet = CharSet.Ansi)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.MapAndLoad")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool MapAndLoad(string ImageName, [Optional] string DllPath, out LOADED_IMAGE LoadedImage, [MarshalAs(UnmanagedType.Bool)] bool DotDll, [MarshalAs(UnmanagedType.Bool)] bool ReadOnly);
/// Computes the checksum of the specified file.
/// The file name of the file for which the checksum is to be computed.
///
/// A pointer to a variable that receives the original checksum from the image file, or zero if there is an error.
///
/// A pointer to a variable that receives the computed checksum.
///
/// If the function succeeds, the return value is CHECKSUM_SUCCESS (0).
/// If the function fails, the return value is one of the following.
///
///
/// Return code/value
/// Description
///
/// -
/// CHECKSUM_MAP_FAILURE 2
/// Could not map the file.
///
/// -
/// CHECKSUM_MAPVIEW_FAILURE 3
/// Could not map a view of the file.
///
/// -
/// CHECKSUM_OPEN_FAILURE 1
/// Could not open the file.
///
/// -
/// CHECKSUM_UNICODE_FAILURE 4
/// Could not convert the file name to Unicode.
///
///
///
///
///
/// The MapFileAndCheckSum function computes a new checksum for the file and returns it in the CheckSum parameter. This
/// function is used by any application that creates or modifies an executable image. Checksums are required for kernel-mode drivers
/// and some system DLLs. The linker computes the original checksum at link time, if you use the appropriate linker switch. For more
/// details, see your linker documentation.
///
///
/// It is recommended that all images have valid checksums. It is the caller's responsibility to place the newly computed checksum
/// into the mapped image and update the on-disk image of the file.
///
///
/// Passing a Filename parameter that does not point to a valid executable image will produce unpredictable results. Any user of
/// this function is encouraged to make sure that a valid executable image is being passed.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
/// Note The Unicode implementation of this function calls the ASCII implementation and as a result, the function can fail if
/// the codepage does not support the characters in the path. For example, if you pass a non-English Unicode file path, and the
/// default codepage is English, the unrecognized non-English wide chars are converted to "??" and the file cannot be opened (the
/// function returns CHECKSUM_OPEN_FAILURE).
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-mapfileandchecksuma DWORD IMAGEAPI MapFileAndCheckSumA(
// PCSTR Filename, PDWORD HeaderSum, PDWORD CheckSum );
[DllImport(Lib_ImageHlp, SetLastError = false, CharSet = CharSet.Auto)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.MapFileAndCheckSumA")]
public static extern CHECKSUM MapFileAndCheckSum([MarshalAs(UnmanagedType.LPTStr)] string Filename, out uint HeaderSum, out uint CheckSum);
///
/// Changes the load address for the specified image, which reduces the required load time for a DLL.
/// Alternatively, you can use the Rebase tool. This tool is available in Visual Studio and the Windows SDK.
/// Note that this function is implemented as a call to the ReBaseImage64 function.
///
///
/// The name of the file to be rebased. You must specify the full path to the file unless the module is in the current working
/// directory of the calling process.
///
///
/// The path used to find the corresponding symbol file. Specify this path for executable images that have symbolic information
/// because when image addresses change, the corresponding symbol database file (PDB) may also need to be changed. Note that even if
/// the symbol path is not valid, the function will succeed if it is able to rebases your image.
///
/// If this value is TRUE, the image is rebased. Otherwise, the image is not rebased.
///
/// If this value is TRUE, the system image is rebased. Otherwise, the system image is not rebased.
///
/// If this value is TRUE, the image can be rebased below the given base; otherwise, it cannot.
/// The maximum size that the image can grow to, in bytes, or zero if there is no limit.
/// A pointer to a variable that receives the original image size, in bytes.
/// A pointer to a variable that receives the original image base.
/// A pointer to a variable that receives the new image size after the rebase operation, in bytes.
///
/// The base address to use for rebasing the image. If the address is not available and the fGoingDown parameter is set to
/// TRUE, the function finds a new base address and sets this parameter to the new base address. If fGoingDown is
/// FALSE, the function finds a new base address but does not set this parameter to the new base address.
///
///
///
/// The new time date stamp for the image file header. The value must be represented in the number of seconds elapsed since midnight
/// (00:00:00), January 1, 1970, Universal Coordinated Time, according to the system clock.
///
/// If this parameter is 0, the current file header time date stamp is incremented by 1 second.
///
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
///
/// The ReBaseImage function changes the desired load address for the specified image. This operation involves reading the
/// entire image and updating all fixups, debugging information, and checksum. You can rebase an image to reduce the required load
/// time for its DLLs. If an application can rely on a DLL being loaded at the desired load address, then the system loader does not
/// have to relocate the image. The image is simply loaded into the application's virtual address space and the DllMain function is
/// called, if one is present.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
/// You cannot rebase DLLs that link with /DYNAMICBASE or that reside in protected directories, such as the System32 folder.
/// As an alternative to using this function, see the /BASE linker option.
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-rebaseimage BOOL IMAGEAPI ReBaseImage( PCSTR
// CurrentImageName, PCSTR SymbolPath, BOOL fReBase, BOOL fRebaseSysfileOk, BOOL fGoingDown, ULONG CheckImageSize, ULONG
// *OldImageSize, ULONG_PTR *OldImageBase, ULONG *NewImageSize, ULONG_PTR *NewImageBase, ULONG TimeStamp );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true, CharSet = CharSet.Ansi)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.ReBaseImage")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool ReBaseImage(string CurrentImageName, string SymbolPath, [MarshalAs(UnmanagedType.Bool)] bool fReBase, [MarshalAs(UnmanagedType.Bool)] bool fRebaseSysfileOk,
[MarshalAs(UnmanagedType.Bool)] bool fGoingDown, uint CheckImageSize, out uint OldImageSize, out IntPtr OldImageBase, out uint NewImageSize, ref IntPtr NewImageBase, uint TimeStamp);
///
/// Changes the load address for the specified image, which reduces the required load time for a DLL.
/// Alternatively, you can use the Rebase tool. This tool is available in Visual Studio and the Windows SDK.
///
///
/// The name of the file to be rebased. You must specify the full path to the file unless the module is in the current working
/// directory of the calling process.
///
///
/// The path used to find the corresponding symbol file. Specify this path for executable images that have symbolic information
/// because when image addresses change, the corresponding symbol database file (PDB) may also need to be changed. Note that even if
/// the symbol path is not valid, the function will succeed if it is able to rebases your image.
///
/// If this value is TRUE, the image is rebased. Otherwise, the image is not rebased.
///
/// If this value is TRUE, the system image is rebased. Otherwise, the system image is not rebased.
///
/// If this value is TRUE, the image can be rebased below the given base; otherwise, it cannot.
/// The maximum size that the image can grow to, in bytes, or zero if there is no limit.
/// A pointer to a variable that receives the original image size, in bytes.
/// A pointer to a variable that receives the original image base.
/// A pointer to a variable that receives the new image size after the rebase operation, in bytes.
///
/// The base address to use for rebasing the image. If the address is not available and the fGoingDown parameter is set to
/// TRUE, the function finds a new base address and sets this parameter to the new base address. If fGoingDown is
/// FALSE, the function finds a new base address but does not set this parameter to the new base address.
///
///
///
/// The new time date stamp for the image file header. The value must be represented in the number of seconds elapsed since midnight
/// (00:00:00), January 1, 1970, Universal Coordinated Time, according to the system clock.
///
/// If this parameter is 0, the current file header time date stamp is incremented by 1 second.
///
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
///
/// The ReBaseImage64 function changes the desired load address for the specified image. This operation involves reading the
/// entire image and updating all fixups, debugging information, and checksum. You can rebase an image to reduce the required load
/// time for its DLLs. If an application can rely on a DLL being loaded at the desired load address, then the system loader does not
/// have to relocate the image. The image is simply loaded into the application's virtual address space and the DllMain function is
/// called, if one is present.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
/// You cannot rebase DLLs that link with /DYNAMICBASE or that reside in protected directories, such as the System32 folder.
/// As an alternative to using this function, see the /BASE linker option.
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-rebaseimage64 BOOL IMAGEAPI ReBaseImage64( PCSTR
// CurrentImageName, PCSTR SymbolPath, BOOL fReBase, BOOL fRebaseSysfileOk, BOOL fGoingDown, ULONG CheckImageSize, ULONG
// *OldImageSize, ULONG64 *OldImageBase, ULONG *NewImageSize, ULONG64 *NewImageBase, ULONG TimeStamp );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true, CharSet = CharSet.Ansi)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.ReBaseImage64")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool ReBaseImage64(string CurrentImageName, string SymbolPath, [MarshalAs(UnmanagedType.Bool)] bool fReBase, [MarshalAs(UnmanagedType.Bool)] bool fRebaseSysfileOk,
[MarshalAs(UnmanagedType.Bool)] bool fGoingDown, uint CheckImageSize, out uint OldImageSize, out ulong OldImageBase, out uint NewImageSize, ref ulong NewImageBase, uint TimeStamp);
/// Locates and changes the load configuration data of an image.
/// A pointer to a LOADED_IMAGE structure that is returned from a call to MapAndLoad or LoadImage.
/// A pointer to an IMAGE_LOAD_CONFIG_DIRECTORY64 structure.
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
/// The SetImageConfigInformation function locates and returns the load configuration data of an image.
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-setimageconfiginformation BOOL IMAGEAPI
// SetImageConfigInformation( PLOADED_IMAGE LoadedImage, PIMAGE_LOAD_CONFIG_DIRECTORY ImageConfigInformation );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.SetImageConfigInformation")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool SetImageConfigInformation(ref LOADED_IMAGE LoadedImage, in IMAGE_LOAD_CONFIG_DIRECTORY32 ImageConfigInformation);
/// Locates and changes the load configuration data of an image.
/// A pointer to a LOADED_IMAGE structure that is returned from a call to MapAndLoad or LoadImage.
/// A pointer to an IMAGE_LOAD_CONFIG_DIRECTORY64 structure.
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
/// The SetImageConfigInformation function locates and returns the load configuration data of an image.
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-setimageconfiginformation BOOL IMAGEAPI
// SetImageConfigInformation( PLOADED_IMAGE LoadedImage, PIMAGE_LOAD_CONFIG_DIRECTORY ImageConfigInformation );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.SetImageConfigInformation")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool SetImageConfigInformation(ref LOADED_IMAGE LoadedImage, in IMAGE_LOAD_CONFIG_DIRECTORY64 ImageConfigInformation);
/// Strips symbols from the specified image.
/// The name of the image from which to split symbols.
/// The subdirectory for storing symbols. This parameter is optional.
/// The name of the generated symbol file. This file typically has a .dbg extension.
///
/// The information to be split from the image. This parameter can be zero or a combination of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// SPLITSYM_EXTRACT_ALL 0x00000002
///
/// Usually, an image with the symbols split off will still contain a MISC debug directory with the name of the symbol file.
/// Therefore, the debugger can still find the symbols. Using this flag removes this link. The end result is similar to using the
/// -debug:none switch on the Microsoft linker.
///
///
/// -
/// SPLITSYM_REMOVE_PRIVATE 0x00000001
/// This strips off the private CodeView symbolic information when generating the symbol file.
///
/// -
/// SPLITSYM_SYMBOLPATH_IS_SRC 0x00000004
/// The symbol file path contains an alternate path to locate the .pdb file.
///
///
///
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
///
/// The SplitSymbols function should be used when stripping symbols from an image. It will create a symbol file that all
/// compatible debuggers understand. The format is defined in WinNT.h and consists of an image header, followed by the array of
/// section headers, the FPO information, and all debugging symbolic information from the image.
///
///
/// If the SymbolsPath parameter is NULL, the symbol file is stored in the directory where the image exists. Otherwise, it is
/// stored in the subdirectory below SymbolsPath that matches the extension of the image. Using this method reduces the chances of
/// symbol file collision. For example, the symbols for myapp.exe will be in the SymbolsPath\exe directory and the symbols for
/// myapp.dll will be in the SymbolsPath\dll directory.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-splitsymbols BOOL IMAGEAPI SplitSymbols( PSTR ImageName,
// PCSTR SymbolsPath, PSTR SymbolFilePath, ULONG Flags );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true, CharSet = CharSet.Ansi)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.SplitSymbols")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool SplitSymbols(StringBuilder ImageName, [Optional] string SymbolsPath, StringBuilder SymbolFilePath, SPLITSYM Flags);
/// Updates the date and time at which the specified file was last modified.
/// A handle to the file of interest.
///
/// A pointer to a SYSTEMTIME structure. If this parameter is NULL, the current system date and time is used.
///
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-touchfiletimes BOOL IMAGEAPI TouchFileTimes( HANDLE
// FileHandle, PSYSTEMTIME pSystemTime );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.TouchFileTimes")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool TouchFileTimes(HFILE FileHandle, in SYSTEMTIME pSystemTime);
/// Updates the date and time at which the specified file was last modified.
/// A handle to the file of interest.
///
/// A pointer to a SYSTEMTIME structure. If this parameter is NULL, the current system date and time is used.
///
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-touchfiletimes BOOL IMAGEAPI TouchFileTimes( HANDLE
// FileHandle, PSYSTEMTIME pSystemTime );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.TouchFileTimes")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool TouchFileTimes(HFILE FileHandle, [In, Optional] IntPtr pSystemTime);
/// Deallocate all resources that are allocated by a previous call to the MapAndLoad function.
///
/// A pointer to a LOADED_IMAGE structure. This structure is obtained through a call to the MapAndLoad function.
///
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
///
/// The UnMapAndLoad function must be used to deallocate all resources that are allocated by a previous call to MapAndLoad.
/// This function also writes a new checksum value into the image before the file is closed. This ensures that if a file is changed,
/// it can be successfully loaded by the system loader.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-unmapandload BOOL IMAGEAPI UnMapAndLoad( PLOADED_IMAGE
// LoadedImage );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.UnMapAndLoad")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool UnMapAndLoad(ref LOADED_IMAGE LoadedImage);
///
/// Uses the specified information to update the corresponding fields in the symbol file.
/// Note This function works with .dbg files, not .pdb files.
///
/// This function has been superseded by the UpdateDebugInfoFileEx function. Use UpdateDebugInfoFileEx to verify the checksum value.
///
///
/// The name of the image that is now out of date with respect to its symbol file.
/// The path in which to look for the symbol file.
/// A pointer to a buffer that receives the name of the symbol file that was updated.
/// A pointer to an IMAGE_NT_HEADERS structure that specifies the new header information.
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE. To retrieve extended error information, call GetLastError.
///
///
///
/// The UpdateDebugInfoFile function takes the information stored in the IMAGE_NT_HEADERS structure and updates the
/// corresponding fields in the symbol file. Any time an image file is modified, this function should be called to keep the numbers
/// in sync. Specifically, whenever an image checksum changes, the symbol file should be updated to match.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-updatedebuginfofile BOOL IMAGEAPI UpdateDebugInfoFile(
// PCSTR ImageFileName, PCSTR SymbolPath, PSTR DebugFilePath, PIMAGE_NT_HEADERS32 NtHeaders );
[DllImport(Lib_ImageHlp, SetLastError = true, ExactSpelling = true, CharSet = CharSet.Ansi)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.UpdateDebugInfoFile")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool UpdateDebugInfoFile(string ImageFileName, string SymbolPath, StringBuilder DebugFilePath, in IMAGE_NT_HEADERS NtHeaders);
///
/// Uses the specified extended information to update the corresponding fields in the symbol file.
/// Note This function works with .dbg files, not .pdb files.
///
/// The name of the image that is now out of date with respect to its symbol file.
/// The path in which to look for the symbol file.
/// A pointer to a buffer that receives the name of the symbol file that was updated.
/// A pointer to an IMAGE_NT_HEADERS structure that specifies the new header information.
///
/// The original checksum value. If this value does not match the checksum that is present in the mapped image, the flags in the
/// symbol file contain IMAGE_SEPARATE_DEBUG_MISMATCH and the last error value is set to ERROR_INVALID_DATA.
///
///
/// If the function succeeds, the return value is TRUE.
/// If the function fails, the return value is FALSE.
///
///
///
/// The UpdateDebugInfoFileEx function takes the information stored in the IMAGE_NT_HEADERS structure and updates the
/// corresponding fields in the symbol file. Any time an image file is modified, this function should be called to keep the numbers
/// in sync. Specifically, whenever an image checksum changes, the symbol file should be updated to match.
///
///
/// All ImageHlp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/imagehlp/nf-imagehlp-updatedebuginfofileex BOOL IMAGEAPI
// UpdateDebugInfoFileEx( PCSTR ImageFileName, PCSTR SymbolPath, PSTR DebugFilePath, PIMAGE_NT_HEADERS32 NtHeaders, DWORD
// OldCheckSum );
[DllImport(Lib_ImageHlp, SetLastError = false, ExactSpelling = true, CharSet = CharSet.Ansi)]
[PInvokeData("imagehlp.h", MSDNShortId = "NF:imagehlp.UpdateDebugInfoFileEx")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool UpdateDebugInfoFileEx(string ImageFileName, string SymbolPath, StringBuilder DebugFilePath,
in IMAGE_NT_HEADERS NtHeaders, uint OldCheckSum);
}
}