using System;
using System.Linq;
using System.Runtime.InteropServices;
using Vanara.Extensions;
using Vanara.Extensions.Reflection;
using Vanara.InteropServices;
namespace Vanara.PInvoke
{
/// Items from the DbgHelp.dll
public static partial class DbgHelp
{
/// The maximum length of a symbol name.
public const int MAX_SYM_NAME = 2000;
/// Flags for .
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_DEFERRED_SYMBOL_LOAD64")]
[Flags]
public enum DSLFLAG
{
///
DSLFLAG_MISMATCHED_PDB = 0x1,
///
DSLFLAG_MISMATCHED_DBG = 0x2,
///
FLAG_ENGINE_PRESENT = 0x4,
///
FLAG_ENGOPT_DISALLOW_NETWORK_PATHS = 0x8,
///
FLAG_OVERRIDE_ARM_MACHINE_TYPE = 0x10,
}
/// Flags for .
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_GET_TYPE_INFO_PARAMS")]
public enum IMAGEHLP_GTI_FLAGS
{
///
/// Do not cache the data for later retrievals. It is good to use this flag if you will not be requesting the information again.
///
IMAGEHLP_GET_TYPE_INFO_UNCACHED = 0x00000001,
/// Retrieve information about the children of the specified types, not the types themselves.
IMAGEHLP_GET_TYPE_INFO_CHILDREN = 0x00000002
}
/// Specifies the type of the inline frame context.
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._tagSTACKFRAME_EX")]
public enum INLINE_FRAME_CONTEXT : uint
{
///
INLINE_FRAME_CONTEXT_INIT = 0,
///
INLINE_FRAME_CONTEXT_IGNORE = 0xFFFFFFFF
}
/// The type of symbols that are loaded.
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_MODULE")]
public enum SYM_TYPE
{
/// No symbols are loaded.
SymNone = 0,
/// COFF symbols.
SymCoff,
/// CodeView symbols.
SymCv,
/// PDB symbols.
SymPdb,
/// Symbols generated from a DLL export table.
SymExport,
/// Symbol loading deferred.
SymDeferred,
/// .sym file.
SymSym, // .sym file
/// DIA symbols.
SymDia,
/// The virtual module created by SymLoadModuleEx with SLMFLAG_VIRTUAL.
SymVirtual,
/// Unused.
NumSymTypes
}
/// flags found in SYMBOL_INFO.Flags
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._SYMBOL_INFO")]
public enum SYMFLAG : uint
{
/// The Value member is used.
SYMFLAG_VALUEPRESENT = 0x00000001,
/// The symbol is a register. The Register member is used.
SYMFLAG_REGISTER = 0x00000008,
/// Offsets are register relative.
SYMFLAG_REGREL = 0x00000010,
/// Offsets are frame relative.
SYMFLAG_FRAMEREL = 0x00000020,
/// The symbol is a parameter.
SYMFLAG_PARAMETER = 0x00000040,
/// The symbol is a local variable.
SYMFLAG_LOCAL = 0x00000080,
/// The symbol is a constant.
SYMFLAG_CONSTANT = 0x00000100,
/// The symbol is from the export table.
SYMFLAG_EXPORT = 0x00000200,
/// The symbol is a forwarder.
SYMFLAG_FORWARDER = 0x00000400,
/// The symbol is a known function.
SYMFLAG_FUNCTION = 0x00000800,
/// The symbol is a virtual symbol created by the SymAddSymbol function.
SYMFLAG_VIRTUAL = 0x00001000,
/// The symbol is a thunk.
SYMFLAG_THUNK = 0x00002000,
/// The symbol is an offset into the TLS data area.
SYMFLAG_TLSREL = 0x00004000,
/// The symbol is a managed code slot.
SYMFLAG_SLOT = 0x00008000,
///
/// The symbol address is an offset relative to the beginning of the intermediate language block. This applies to managed code only.
///
SYMFLAG_ILREL = 0x00010000,
/// The symbol is managed metadata.
SYMFLAG_METADATA = 0x00020000,
/// The symbol is a CLR token.
SYMFLAG_CLR_TOKEN = 0x00040000,
///
SYMFLAG_NULL = 0x00080000,
///
SYMFLAG_FUNC_NO_RETURN = 0x00100000,
///
SYMFLAG_SYNTHETIC_ZEROBASE = 0x00200000,
///
SYMFLAG_PUBLIC_CODE = 0x00400000,
///
SYMFLAG_REGREL_ALIASINDIR = 0x00800000,
/// this resets SymNext/Prev to the beginning of the module passed in the address field
SYMFLAG_RESET = 0x80000000,
}
/// Converts a time stamp to a .
///
/// The time stamp which is a value represented in the number of seconds elapsed since midnight (00:00:00), January 1, 1970,
/// Universal Coordinated Time, according to the system clock.
///
///
public static DateTime TimeStampToDateTime(uint timeStamp) => new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc) + TimeSpan.FromSeconds(timeStamp);
/// Represents an address. It is used in the STACKFRAME64 structure.
///
///
/// This structure supersedes the ADDRESS structure. For more information, see Updated Platform Support. ADDRESS is
/// defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define ADDRESS ADDRESS64 #define LPADDRESS LPADDRESS64 #else typedef struct _tagADDRESS { DWORD Offset; WORD Segment; ADDRESS_MODE Mode; } ADDRESS, *LPADDRESS; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-address typedef struct _tagADDRESS { DWORD Offset; WORD
// Segment; ADDRESS_MODE Mode; } ADDRESS, *LPADDRESS;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._tagADDRESS")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct ADDRESS
{
///
/// The offset into the segment, or a 32-bit virtual address. The interpretation of this value depends on the value contained in
/// the Mode member.
///
public uint Offset;
/// The segment number. This value is used only for 16-bit addressing.
public ushort Segment;
///
/// The addressing mode. This member can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// AddrMode1616 0
/// 16:16 addressing. To support this addressing mode, you must supply a TranslateAddressProc64 callback function.
///
/// -
/// AddrMode1632 1
/// 16:32 addressing. To support this addressing mode, you must supply a TranslateAddressProc64 callback function.
///
/// -
/// AddrModeReal 2
/// Real-mode addressing. To support this addressing mode, you must supply a TranslateAddressProc64 callback function.
///
/// -
/// AddrModeFlat 3
/// Flat addressing. This is the only addressing mode supported by the library.
///
///
///
public ADDRESS_MODE Mode;
}
/// Represents an address. It is used in the STACKFRAME64 structure.
///
///
/// This structure supersedes the ADDRESS structure. For more information, see Updated Platform Support. ADDRESS is
/// defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define ADDRESS ADDRESS64 #define LPADDRESS LPADDRESS64 #else typedef struct _tagADDRESS { DWORD Offset; WORD Segment; ADDRESS_MODE Mode; } ADDRESS, *LPADDRESS; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-address64 typedef struct _tagADDRESS64 { DWORD64 Offset;
// WORD Segment; ADDRESS_MODE Mode; } ADDRESS64, *LPADDRESS64;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._tagADDRESS64")]
[StructLayout(LayoutKind.Sequential)]
public struct ADDRESS64
{
///
/// The offset into the segment, or a 32-bit virtual address. The interpretation of this value depends on the value contained in
/// the Mode member.
///
public ulong Offset;
/// The segment number. This value is used only for 16-bit addressing.
public ushort Segment;
///
/// The addressing mode. This member can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// AddrMode1616 0
/// 16:16 addressing. To support this addressing mode, you must supply a TranslateAddressProc64 callback function.
///
/// -
/// AddrMode1632 1
/// 16:32 addressing. To support this addressing mode, you must supply a TranslateAddressProc64 callback function.
///
/// -
/// AddrModeReal 2
/// Real-mode addressing. To support this addressing mode, you must supply a TranslateAddressProc64 callback function.
///
/// -
/// AddrModeFlat 3
/// Flat addressing. This is the only addressing mode supported by the library.
///
///
///
public ADDRESS_MODE Mode;
}
/// Contains the library version.
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-api_version typedef struct API_VERSION { USHORT
// MajorVersion; USHORT MinorVersion; USHORT Revision; USHORT Reserved; } API_VERSION, *LPAPI_VERSION;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp.API_VERSION")]
[StructLayout(LayoutKind.Sequential)]
public struct API_VERSION
{
/// The major version number.
public ushort MajorVersion;
/// The minor version number.
public ushort MinorVersion;
/// The revision number.
public ushort Revision;
/// This member is reserved for use by the operating system.
public ushort Reserved;
/// Performs an explicit conversion from to .
/// The version.
/// The resulting instance from the conversion.
/// version.Build must be 0
public static implicit operator API_VERSION(Version version) => new API_VERSION { MajorVersion = (ushort)version.Major, MinorVersion = (ushort)version.Minor, Revision = (ushort)version.Revision, Reserved = version.Build == 0 ? (ushort)0 : throw new ArgumentException("version.Build must be 0") };
/// Performs an explicit conversion from to .
/// The version.
/// The resulting instance from the conversion.
public static explicit operator Version(API_VERSION version) => new Version(version.MajorVersion, version.MinorVersion, 0, version.Revision);
}
///
/// Contains debugging information.
///
/// Note This structure is used by the MapDebugInformation and UnmapDebugInformation functions, which are provided only for
/// backward compatibility.
///
///
///
/// The LIST_ENTRY structure is defined as follows:
///
/// typedef struct _LIST_ENTRY { struct _LIST_ENTRY *Flink; struct _LIST_ENTRY *Blink; } LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY;
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-image_debug_information typedef struct
// _IMAGE_DEBUG_INFORMATION { LIST_ENTRY List; DWORD ReservedSize; PVOID ReservedMappedBase; USHORT ReservedMachine; USHORT
// ReservedCharacteristics; DWORD ReservedCheckSum; DWORD ImageBase; DWORD SizeOfImage; DWORD ReservedNumberOfSections;
// PIMAGE_SECTION_HEADER ReservedSections; DWORD ReservedExportedNamesSize; PSTR ReservedExportedNames; DWORD
// ReservedNumberOfFunctionTableEntries; PIMAGE_FUNCTION_ENTRY ReservedFunctionTableEntries; DWORD
// ReservedLowestFunctionStartingAddress; DWORD ReservedHighestFunctionEndingAddress; DWORD ReservedNumberOfFpoTableEntries;
// PFPO_DATA ReservedFpoTableEntries; DWORD SizeOfCoffSymbols; PIMAGE_COFF_SYMBOLS_HEADER CoffSymbols; DWORD
// ReservedSizeOfCodeViewSymbols; PVOID ReservedCodeViewSymbols; PSTR ImageFilePath; PSTR ImageFileName; PSTR ReservedDebugFilePath;
// DWORD ReservedTimeDateStamp; BOOL ReservedRomImage; PIMAGE_DEBUG_DIRECTORY ReservedDebugDirectory; DWORD
// ReservedNumberOfDebugDirectories; DWORD ReservedOriginalFunctionTableBaseAddress; DWORD Reserved[2]; } IMAGE_DEBUG_INFORMATION, *PIMAGE_DEBUG_INFORMATION;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGE_DEBUG_INFORMATION")]
[StructLayout(LayoutKind.Sequential)]
public struct IMAGE_DEBUG_INFORMATION
{
/// A linked list of LIST_ENTRY structures.
public LIST_ENTRY List;
///
/// The size of the memory allocated for the IMAGE_DEBUG_INFORMATION structure and all debugging information, in bytes.
///
public uint ReservedSize;
/// The base address of the image.
public IntPtr ReservedMappedBase;
///
/// The computer type. This member can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// IMAGE_FILE_MACHINE_I386 0x014c
/// Intel (32-bit)
///
/// -
/// IMAGE_FILE_MACHINE_IA64 0x0200
/// Intel Itanium
///
/// -
/// IMAGE_FILE_MACHINE_AMD64 0x8664
/// x64 (AMD64 or EM64T)
///
///
///
public IMAGE_FILE_MACHINE ReservedMachine;
///
/// The characteristics of the image. This member can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// IMAGE_FILE_RELOCS_STRIPPED 0x0001
/// Relocation information is stripped from the file.
///
/// -
/// IMAGE_FILE_EXECUTABLE_IMAGE 0x0002
/// The file is executable (there are no unresolved external references).
///
/// -
/// IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004
/// Line numbers are stripped from the file.
///
/// -
/// IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008
/// Local symbols are stripped from file.
///
/// -
/// IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010
/// Aggressively trim the working set.
///
/// -
/// IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020
/// The application can handle addresses larger than 2 GB.
///
/// -
/// IMAGE_FILE_BYTES_REVERSED_LO 0x0080
/// Bytes of the word are reversed.
///
/// -
/// IMAGE_FILE_32BIT_MACHINE 0x0100
/// Computer supports 32-bit words.
///
/// -
/// IMAGE_FILE_DEBUG_STRIPPED 0x0200
/// Debugging information is stored separately in a .dbg file.
///
/// -
/// IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400
/// If the image is on removable media, copy and run from the swap file.
///
/// -
/// IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800
/// If the image is on the network, copy and run from the swap file.
///
/// -
/// IMAGE_FILE_SYSTEM 0x1000
/// System file.
///
/// -
/// IMAGE_FILE_DLL 0x2000
/// DLL file.
///
/// -
/// IMAGE_FILE_UP_SYSTEM_ONLY 0x4000
/// File should be run only on a uniprocessor computer.
///
/// -
/// IMAGE_FILE_BYTES_REVERSED_HI 0x8000
/// Bytes of the word are reversed.
///
///
///
public IMAGE_FILE ReservedCharacteristics;
/// The checksum of the image.
public uint ReservedCheckSum;
/// The requested base address of the image.
public uint ImageBase;
/// The size of the image, in bytes.
public uint SizeOfImage;
/// The number of COFF section headers.
public uint ReservedNumberOfSections;
/// A pointer to the first COFF section header. For more information, see IMAGE_SECTION_HEADER.
public IntPtr ReservedSections;
/// The size of the ExportedNames member, in bytes.
public uint ReservedExportedNamesSize;
/// A pointer to a series of null-terminated strings that name all the functions exported from the image.
public IntPtr ReservedExportedNames;
/// The number of entries contained in the FunctionTableEntries member.
public uint ReservedNumberOfFunctionTableEntries;
/// A pointer to the first function table entry. For more information, see IMAGE_FUNCTION_ENTRY.
public IntPtr ReservedFunctionTableEntries;
/// The lowest function table starting address.
public uint ReservedLowestFunctionStartingAddress;
/// The highest function table ending address.
public uint ReservedHighestFunctionEndingAddress;
/// The number of entries contained in the FpoTableEntries member.
public uint ReservedNumberOfFpoTableEntries;
/// A pointer to the first FPO entry. For more information, see FPO_DATA.
public IntPtr ReservedFpoTableEntries;
/// The size of the COFF symbol table, in bytes.
public uint SizeOfCoffSymbols;
/// A pointer to the COFF symbol table.
public IntPtr CoffSymbols;
/// The size of the CodeView symbol table, in bytes.
public uint ReservedSizeOfCodeViewSymbols;
/// A pointer to the beginning of the CodeView symbol table.
public IntPtr ReservedCodeViewSymbols;
/// The relative path to the image file name.
[MarshalAs(UnmanagedType.LPStr)] public string ImageFilePath;
/// The image file name.
[MarshalAs(UnmanagedType.LPStr)] public string ImageFileName;
/// The full path to the symbol file.
[MarshalAs(UnmanagedType.LPStr)] public string ReservedDebugFilePath;
/// The timestamp of the image. This represents the date and time the image was created by the linker.
public uint ReservedTimeDateStamp;
/// This value is TRUE if the image is a ROM image.
[MarshalAs(UnmanagedType.Bool)] public bool ReservedRomImage;
/// A pointer to the first debug directory. For more information, see IMAGE_DEBUG_DIRECTORY.
public IntPtr ReservedDebugDirectory;
/// The number of entries contained in the DebugDirectory member.
public uint ReservedNumberOfDebugDirectories;
/// The original function table base address.
public uint ReservedOriginalFunctionTableBaseAddress;
/// This member is reserved for use by the operating system.
public ulong Reserved;
}
/// Contains information about a debugging event.
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_cba_event typedef struct _IMAGEHLP_CBA_EVENT {
// DWORD severity; DWORD code; PCHAR desc; PVOID object; } IMAGEHLP_CBA_EVENT, *PIMAGEHLP_CBA_EVENT;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_CBA_EVENT")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct IMAGEHLP_CBA_EVENT
{
///
/// The event severity. This parameter can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// sevInfo 0
/// Informational event.
///
/// -
/// sevProblem 1
/// Reserved for future use.
///
/// -
/// sevAttn 2
/// Reserved for future use.
///
/// -
/// sevFatal 3
/// Reserved for future use.
///
///
///
public EVENT_SEVERITY severity;
/// This member is reserved for future use.
public uint code;
/// A text description of the error.
[MarshalAs(UnmanagedType.LPTStr)] public string desc;
/// This member is reserved for future use.
public IntPtr @object;
}
/// Contains information about a memory read operation.
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_cba_read_memory typedef struct
// _IMAGEHLP_CBA_READ_MEMORY { DWORD64 addr; PVOID buf; DWORD bytes; DWORD *bytesread; } IMAGEHLP_CBA_READ_MEMORY, *PIMAGEHLP_CBA_READ_MEMORY;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_CBA_READ_MEMORY")]
[StructLayout(LayoutKind.Sequential)]
public struct IMAGEHLP_CBA_READ_MEMORY
{
/// The address to be read.
public ulong addr;
/// A pointer to a buffer that receives the memory read.
public IntPtr buf;
/// The number of bytes to read.
public uint bytes;
/// A pointer to a variable that receives the number of bytes read.
public IntPtr bytesread;
}
/// Contains information about a deferred symbol load.
///
///
/// This structure supersedes the IMAGEHLP_DEFERRED_SYMBOL_LOAD structure. For more information, see Updated Platform
/// Support. IMAGEHLP_DEFERRED_SYMBOL_LOAD is defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_DEFERRED_SYMBOL_LOAD IMAGEHLP_DEFERRED_SYMBOL_LOAD64 #define PIMAGEHLP_DEFERRED_SYMBOL_LOAD PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 #else typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD CheckSum; DWORD TimeDateStamp; CHAR FileName[MAX_PATH]; BOOLEAN Reparse; HANDLE hFile; } IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_deferred_symbol_load typedef struct
// _IMAGEHLP_DEFERRED_SYMBOL_LOAD { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD CheckSum; DWORD TimeDateStamp; CHAR
// FileName[MAX_PATH]; BOOLEAN Reparse; HANDLE hFile; } IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_DEFERRED_SYMBOL_LOAD")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)]
public struct IMAGEHLP_DEFERRED_SYMBOL_LOAD
{
///
/// The size of the structure, in bytes. The caller must set this member to
/// sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64)
/// .
///
public uint SizeOfStruct;
/// The base virtual address where the image is loaded.
public uint BaseOfImage;
/// The computed checksum of the image. This value can be zero.
public uint CheckSum;
///
/// The date and timestamp value. The value is represented in the number of seconds elapsed since midnight (00:00:00), January
/// 1, 1970, Universal Coordinated Time, according to the system clock. The timestamp can be printed using the C run-time (CRT)
/// function ctime.
///
public uint TimeDateStamp;
/// The image name. The name may or may not contain a full path.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260 /*MAX_PATH*/)]
public string FileName;
/// If this member is TRUE, the operation should be performed again. Otherwise, it should not.
[MarshalAs(UnmanagedType.U1)] public bool Reparse;
///
/// A handle to a file. This member is used with CBA_DEFERRED_SYMBOL_LOAD_PARTIAL and
/// IMAGEHLP_DEFERRED_SYMBOL_LOAD_FAILURE callbacks.
///
public HFILE hFile;
}
/// Contains information about a deferred symbol load.
///
///
/// This structure supersedes the IMAGEHLP_DEFERRED_SYMBOL_LOAD structure. For more information, see Updated Platform
/// Support. IMAGEHLP_DEFERRED_SYMBOL_LOAD is defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_DEFERRED_SYMBOL_LOAD IMAGEHLP_DEFERRED_SYMBOL_LOAD64 #define PIMAGEHLP_DEFERRED_SYMBOL_LOAD PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 #else typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD CheckSum; DWORD TimeDateStamp; CHAR FileName[MAX_PATH]; BOOLEAN Reparse; HANDLE hFile; } IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_deferred_symbol_load64 typedef struct
// _IMAGEHLP_DEFERRED_SYMBOL_LOAD64 { DWORD SizeOfStruct; DWORD64 BaseOfImage; DWORD CheckSum; DWORD TimeDateStamp; CHAR
// FileName[MAX_PATH]; BOOLEAN Reparse; HANDLE hFile; DWORD Flags; } IMAGEHLP_DEFERRED_SYMBOL_LOAD64, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD64;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_DEFERRED_SYMBOL_LOAD64")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)]
public struct IMAGEHLP_DEFERRED_SYMBOL_LOAD64
{
///
/// The size of the structure, in bytes. The caller must set this member to
/// sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64)
/// .
///
public uint SizeOfStruct;
/// The base virtual address where the image is loaded.
public ulong BaseOfImage;
/// The computed checksum of the image. This value can be zero.
public uint CheckSum;
///
/// The date and timestamp value. The value is represented in the number of seconds elapsed since midnight (00:00:00), January
/// 1, 1970, Universal Coordinated Time, according to the system clock. The timestamp can be printed using the C run-time (CRT)
/// function ctime.
///
public uint TimeDateStamp;
/// The image name. The name may or may not contain a full path.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260 /*MAX_PATH*/)]
public string FileName;
/// If this member is TRUE, the operation should be performed again. Otherwise, it should not.
[MarshalAs(UnmanagedType.U1)] public bool Reparse;
///
/// A handle to a file. This member is used with CBA_DEFERRED_SYMBOL_LOAD_PARTIAL and
/// IMAGEHLP_DEFERRED_SYMBOL_LOAD_FAILURE callbacks.
///
public HFILE hFile;
///
/// This member can be one of the following values.
/// DSLFLAG_MISMATCHED_DBG (0x2)
/// DSLFLAG_MISMATCHED_PDB (0x1)
///
public DSLFLAG Flags;
}
/// Contains information about a deferred symbol load.
///
///
/// This structure supersedes the IMAGEHLP_DEFERRED_SYMBOL_LOAD structure. For more information, see Updated Platform
/// Support. IMAGEHLP_DEFERRED_SYMBOL_LOAD is defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_DEFERRED_SYMBOL_LOAD IMAGEHLP_DEFERRED_SYMBOL_LOAD64 #define PIMAGEHLP_DEFERRED_SYMBOL_LOAD PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 #else typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD CheckSum; DWORD TimeDateStamp; CHAR FileName[MAX_PATH]; BOOLEAN Reparse; HANDLE hFile; } IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_deferred_symbol_load64 typedef struct
// _IMAGEHLP_DEFERRED_SYMBOL_LOAD64 { DWORD SizeOfStruct; DWORD64 BaseOfImage; DWORD CheckSum; DWORD TimeDateStamp; CHAR
// FileName[MAX_PATH]; BOOLEAN Reparse; HANDLE hFile; DWORD Flags; } IMAGEHLP_DEFERRED_SYMBOL_LOAD64, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD64;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_DEFERRED_SYMBOL_LOAD64")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct IMAGEHLP_DEFERRED_SYMBOL_LOADW64
{
///
/// The size of the structure, in bytes. The caller must set this member to
/// sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64)
/// .
///
public uint SizeOfStruct;
/// The base virtual address where the image is loaded.
public ulong BaseOfImage;
/// The computed checksum of the image. This value can be zero.
public uint CheckSum;
///
/// The date and timestamp value. The value is represented in the number of seconds elapsed since midnight (00:00:00), January
/// 1, 1970, Universal Coordinated Time, according to the system clock. The timestamp can be printed using the C run-time (CRT)
/// function ctime.
///
public uint TimeDateStamp;
/// The image name. The name may or may not contain a full path.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 261 /*MAX_PATH + 1*/)]
public string FileName;
/// If this member is TRUE, the operation should be performed again. Otherwise, it should not.
[MarshalAs(UnmanagedType.U1)] public bool Reparse;
///
/// A handle to a file. This member is used with CBA_DEFERRED_SYMBOL_LOAD_PARTIAL and
/// IMAGEHLP_DEFERRED_SYMBOL_LOAD_FAILURE callbacks.
///
public HFILE hFile;
///
/// This member can be one of the following values.
/// DSLFLAG_MISMATCHED_DBG (0x2)
/// DSLFLAG_MISMATCHED_PDB (0x1)
///
public DSLFLAG Flags;
}
/// Contains duplicate symbol information.
///
///
/// This structure supersedes the IMAGEHLP_DUPLICATE_SYMBOL structure. For more information, see Updated Platform Support.
/// IMAGEHLP_DUPLICATE_SYMBOL is defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_DUPLICATE_SYMBOL IMAGEHLP_DUPLICATE_SYMBOL64 #define PIMAGEHLP_DUPLICATE_SYMBOL PIMAGEHLP_DUPLICATE_SYMBOL64 #else typedef struct _IMAGEHLP_DUPLICATE_SYMBOL { DWORD SizeOfStruct; DWORD NumberOfDups; PIMAGEHLP_SYMBOL Symbol; DWORD SelectedSymbol; } IMAGEHLP_DUPLICATE_SYMBOL, *PIMAGEHLP_DUPLICATE_SYMBOL; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_duplicate_symbol64 typedef struct
// _IMAGEHLP_DUPLICATE_SYMBOL64 { DWORD SizeOfStruct; DWORD NumberOfDups; PIMAGEHLP_SYMBOL64 Symbol; DWORD SelectedSymbol; }
// IMAGEHLP_DUPLICATE_SYMBOL64, *PIMAGEHLP_DUPLICATE_SYMBOL64;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_DUPLICATE_SYMBOL64")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct IMAGEHLP_DUPLICATE_SYMBOL64
{
///
/// The size of the structure, in bytes. The caller must set this member to
/// sizeof(IMAGEHLP_DUPLICATE_SYMBOL64)
/// .
///
public uint SizeOfStruct;
/// The number of duplicate symbols.
public uint NumberOfDups;
///
/// A pointer to an array of symbols ( IMAGEHLP_SYMBOL64 structures). The number of entries in the array is specified by the
/// NumberOfDups member.
///
public IntPtr Symbol;
/// The index into the symbol array for the selected symbol.
public uint SelectedSymbol;
}
/// Contains type information for a module.
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_get_type_info_params typedef struct
// _IMAGEHLP_GET_TYPE_INFO_PARAMS { IN ULONG SizeOfStruct; IN ULONG Flags; IN ULONG NumIds; IN PULONG TypeIds; IN ULONG64 TagFilter;
// IN ULONG NumReqs; IN IMAGEHLP_SYMBOL_TYPE_INFO *ReqKinds; IN PULONG_PTR ReqOffsets; IN PULONG ReqSizes; IN ULONG_PTR ReqStride;
// IN ULONG_PTR BufferSize; OUT PVOID Buffer; OUT ULONG EntriesMatched; OUT ULONG EntriesFilled; OUT ULONG64 TagsFound; OUT ULONG64
// AllReqsValid; IN ULONG NumReqsValid; OUT PULONG64 ReqsValid; } IMAGEHLP_GET_TYPE_INFO_PARAMS, *PIMAGEHLP_GET_TYPE_INFO_PARAMS;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_GET_TYPE_INFO_PARAMS")]
[StructLayout(LayoutKind.Sequential)]
public struct IMAGEHLP_GET_TYPE_INFO_PARAMS
{
/// The size of this structure, in bytes.
public uint SizeOfStruct;
///
/// This member can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// IMAGEHLP_GET_TYPE_INFO_CHILDREN 0x00000002
/// Retrieve information about the children of the specified types, not the types themselves.
///
/// -
/// IMAGEHLP_GET_TYPE_INFO_UNCACHED 0x00000001
///
/// Do not cache the data for later retrievals. It is good to use this flag if you will not be requesting the information again.
///
///
///
///
public uint Flags;
/// The number of elements specified in the TypeIds array.
public uint NumIds;
/// An array of type indexes.
public IntPtr TypeIds;
///
/// The filter for return values. For example, set this member to 1 << SymTagData to return only results with a
/// symbol tag of SymTagData. For a list of tags, see the SymTagEnum type defined in Dbghelp.h
///
public ulong TagFilter;
///
/// The number of elements specified in the arrays specified in the ReqKinds, ReqOffsets, and ReqSizes
/// members. These arrays must be the same size.
///
public uint NumReqs;
///
/// An array of information types to be requested. Each element is one of the enumeration values in the
/// IMAGEHLP_SYMBOL_TYPE_INFO enumeration type.
///
public IntPtr ReqKinds;
///
/// An array of offsets that specify where to store the data for each request within each element of Buffer array.
///
public IntPtr ReqOffsets;
/// The size of each data request, in bytes. The required sizes are described in IMAGEHLP_SYMBOL_TYPE_INFO.
public IntPtr ReqSizes;
/// The number of bytes for each element in the Buffer array.
public IntPtr ReqStride;
/// The size of the Buffer array, in bytes.
public IntPtr BufferSize;
///
/// An array of records used for storing query results. Each record is separated by ReqStride bytes. Each type for which
/// data is to be retrieved requires one record in the array. Within each record, there are NumReqs pieces of data stored
/// as the result of individual queries. The data is stored within the record according to the offsets specified in
/// ReqOffsets. The format of the data depends on the value of the ReqKinds member in use.
///
public IntPtr Buffer;
/// The number of type entries that match the filter.
public uint EntriesMatched;
/// The number of elements in the Buffer array that received results.
public uint EntriesFilled;
/// A bitmask indicating all tag bits encountered during the search operation.
public ulong TagsFound;
/// A bitmask indicate the bit-wise AND of all ReqsValid fields.
public ulong AllReqsValid;
/// The size of ReqsValid, in elements.
public uint NumReqsValid;
///
/// A bitmask indexed by Buffer element index that indicates which request data is valid. This member can be NULL.
///
public IntPtr ReqsValid;
}
/// Represents a source file line.
///
///
/// This structure supersedes the IMAGEHLP_LINE structure. For more information, see Updated Platform Support.
/// IMAGEHLP_LINE is defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_LINE IMAGEHLP_LINE64 #define PIMAGEHLP_LINE PIMAGEHLP_LINE64 #else typedef struct _IMAGEHLP_LINE { DWORD SizeOfStruct; PVOID Key; DWORD LineNumber; PCHAR FileName; DWORD Address; } IMAGEHLP_LINE, *PIMAGEHLP_LINE; typedef struct _IMAGEHLP_LINEW { DWORD SizeOfStruct; PVOID Key; DWORD LineNumber; PCHAR FileName; DWORD64 Address; } IMAGEHLP_LINEW, *PIMAGEHLP_LINEW; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_line typedef struct _IMAGEHLP_LINE { DWORD
// SizeOfStruct; PVOID Key; DWORD LineNumber; PCHAR FileName; DWORD Address; } IMAGEHLP_LINE, *PIMAGEHLP_LINE;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_LINE")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct IMAGEHLP_LINE
{
///
/// The size of the structure, in bytes. The caller must set this member to
/// sizeof(IMAGEHLP_LINE64)
/// .
///
public uint SizeOfStruct;
/// This member is reserved for use by the operating system.
public IntPtr Key;
/// The line number in the file.
public uint LineNumber;
/// The name of the file, including the full path.
[MarshalAs(UnmanagedType.LPTStr)] public string FileName;
/// The address of the first instruction in the line.
public uint Address;
}
/// Represents a source file line.
///
///
/// This structure supersedes the IMAGEHLP_LINE structure. For more information, see Updated Platform Support.
/// IMAGEHLP_LINE is defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_LINE IMAGEHLP_LINE64 #define PIMAGEHLP_LINE PIMAGEHLP_LINE64 #else typedef struct _IMAGEHLP_LINE { DWORD SizeOfStruct; PVOID Key; DWORD LineNumber; PCHAR FileName; DWORD Address; } IMAGEHLP_LINE, *PIMAGEHLP_LINE; typedef struct _IMAGEHLP_LINEW { DWORD SizeOfStruct; PVOID Key; DWORD LineNumber; PCHAR FileName; DWORD64 Address; } IMAGEHLP_LINEW, *PIMAGEHLP_LINEW; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_line64 typedef struct _IMAGEHLP_LINE64 { DWORD
// SizeOfStruct; PVOID Key; DWORD LineNumber; PCHAR FileName; DWORD64 Address; } IMAGEHLP_LINE64, *PIMAGEHLP_LINE64;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_LINE64")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct IMAGEHLP_LINE64
{
///
/// The size of the structure, in bytes. The caller must set this member to
/// sizeof(IMAGEHLP_LINE64)
/// .
///
public uint SizeOfStruct;
/// This member is reserved for use by the operating system.
public IntPtr Key;
/// The line number in the file.
public uint LineNumber;
/// The name of the file, including the full path.
[MarshalAs(UnmanagedType.LPTStr)] public string FileName;
/// The address of the first instruction in the line.
public ulong Address;
}
/// Contains module information.
///
///
/// This structure supersedes the IMAGEHLP_MODULE structure. For more information, see Updated Platform Support.
/// IMAGEHLP_MODULE is defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_MODULE IMAGEHLP_MODULE64 #define PIMAGEHLP_MODULE PIMAGEHLP_MODULE64 #define IMAGEHLP_MODULEW IMAGEHLP_MODULEW64 #define PIMAGEHLP_MODULEW PIMAGEHLP_MODULEW64 #else typedef struct _IMAGEHLP_MODULE { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD ImageSize; DWORD TimeDateStamp; DWORD CheckSum; DWORD NumSyms; SYM_TYPE SymType; CHAR ModuleName[32]; CHAR ImageName[256]; CHAR LoadedImageName[256]; } IMAGEHLP_MODULE, *PIMAGEHLP_MODULE; typedef struct _IMAGEHLP_MODULEW { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD ImageSize; DWORD TimeDateStamp; DWORD CheckSum; DWORD NumSyms; SYM_TYPE SymType; WCHAR ModuleName[32]; WCHAR ImageName[256]; WCHAR LoadedImageName[256]; } IMAGEHLP_MODULEW, *PIMAGEHLP_MODULEW; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_module typedef struct _IMAGEHLP_MODULE { DWORD
// SizeOfStruct; DWORD BaseOfImage; DWORD ImageSize; DWORD TimeDateStamp; DWORD CheckSum; DWORD NumSyms; SYM_TYPE SymType; CHAR
// ModuleName[32]; CHAR ImageName[256]; CHAR LoadedImageName[256]; } IMAGEHLP_MODULE, *PIMAGEHLP_MODULE;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_MODULE")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct IMAGEHLP_MODULE
{
///
/// The size of the structure, in bytes. The caller must set this member to
/// sizeof(IMAGEHLP_MODULE64)
/// .
///
public uint SizeOfStruct;
/// The base virtual address where the image is loaded.
public uint BaseOfImage;
/// The size of the image, in bytes.
public uint ImageSize;
///
/// The date and timestamp value. The value is represented in the number of seconds elapsed since midnight (00:00:00), January
/// 1, 1970, Universal Coordinated Time, according to the system clock. The timestamp can be printed using the C run-time (CRT)
/// function ctime.
///
public uint TimeDateStamp;
/// The checksum of the image. This value can be zero.
public uint CheckSum;
///
/// The number of symbols in the symbol table. The value of this parameter is not meaningful when SymPdb is specified as
/// the value of the SymType parameter.
///
public uint NumSyms;
///
/// The type of symbols that are loaded. This member can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// SymCoff
/// COFF symbols.
///
/// -
/// SymCv
/// CodeView symbols.
///
/// -
/// SymDeferred
/// Symbol loading deferred.
///
/// -
/// SymDia
/// DIA symbols.
///
/// -
/// SymExport
/// Symbols generated from a DLL export table.
///
/// -
/// SymNone
/// No symbols are loaded.
///
/// -
/// SymPdb
/// PDB symbols.
///
/// -
/// SymSym
/// .sym file.
///
/// -
/// SymVirtual
/// The virtual module created by SymLoadModuleEx with SLMFLAG_VIRTUAL.
///
///
///
public SYM_TYPE SymType;
/// The module name.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 32)]
public string ModuleName;
/// The image name. The name may or may not contain a full path.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)]
public string ImageName;
/// The full path and file name of the file from which symbols were loaded.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)]
public string LoadedImageName;
}
/// Contains module information.
///
///
/// This structure supersedes the IMAGEHLP_MODULE structure. For more information, see Updated Platform Support.
/// IMAGEHLP_MODULE is defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_MODULE IMAGEHLP_MODULE64 #define PIMAGEHLP_MODULE PIMAGEHLP_MODULE64 #define IMAGEHLP_MODULEW IMAGEHLP_MODULEW64 #define PIMAGEHLP_MODULEW PIMAGEHLP_MODULEW64 #else typedef struct _IMAGEHLP_MODULE { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD ImageSize; DWORD TimeDateStamp; DWORD CheckSum; DWORD NumSyms; SYM_TYPE SymType; CHAR ModuleName[32]; CHAR ImageName[256]; CHAR LoadedImageName[256]; } IMAGEHLP_MODULE, *PIMAGEHLP_MODULE; typedef struct _IMAGEHLP_MODULEW { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD ImageSize; DWORD TimeDateStamp; DWORD CheckSum; DWORD NumSyms; SYM_TYPE SymType; WCHAR ModuleName[32]; WCHAR ImageName[256]; WCHAR LoadedImageName[256]; } IMAGEHLP_MODULEW, *PIMAGEHLP_MODULEW; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_module64 typedef struct _IMAGEHLP_MODULE64 { DWORD
// SizeOfStruct; DWORD64 BaseOfImage; DWORD ImageSize; DWORD TimeDateStamp; DWORD CheckSum; DWORD NumSyms; SYM_TYPE SymType; CHAR
// ModuleName[32]; CHAR ImageName[256]; CHAR LoadedImageName[256]; CHAR LoadedPdbName[256]; DWORD CVSig; CHAR *CVData[MAX_PATH 3];
// DWORD PdbSig; GUID PdbSig70; DWORD PdbAge; BOOL PdbUnmatched; BOOL DbgUnmatched; BOOL LineNumbers; BOOL GlobalSymbols; BOOL
// TypeInfo; BOOL SourceIndexed; BOOL Publics; DWORD MachineType; DWORD Reserved; } IMAGEHLP_MODULE64, *PIMAGEHLP_MODULE64;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_MODULE64")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct IMAGEHLP_MODULE64
{
///
/// The size of the structure, in bytes. The caller must set this member to
/// sizeof(IMAGEHLP_MODULE64)
/// .
///
public uint SizeOfStruct;
/// The base virtual address where the image is loaded.
public ulong BaseOfImage;
/// The size of the image, in bytes.
public uint ImageSize;
///
/// The date and timestamp value. The value is represented in the number of seconds elapsed since midnight (00:00:00), January
/// 1, 1970, Universal Coordinated Time, according to the system clock. The timestamp can be printed using the C run-time (CRT)
/// function ctime.
///
public uint TimeDateStamp;
/// The checksum of the image. This value can be zero.
public uint CheckSum;
///
/// The number of symbols in the symbol table. The value of this parameter is not meaningful when SymPdb is specified as
/// the value of the SymType parameter.
///
public uint NumSyms;
///
/// The type of symbols that are loaded. This member can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// SymCoff
/// COFF symbols.
///
/// -
/// SymCv
/// CodeView symbols.
///
/// -
/// SymDeferred
/// Symbol loading deferred.
///
/// -
/// SymDia
/// DIA symbols.
///
/// -
/// SymExport
/// Symbols generated from a DLL export table.
///
/// -
/// SymNone
/// No symbols are loaded.
///
/// -
/// SymPdb
/// PDB symbols.
///
/// -
/// SymSym
/// .sym file.
///
/// -
/// SymVirtual
/// The virtual module created by SymLoadModuleEx with SLMFLAG_VIRTUAL.
///
///
///
public SYM_TYPE SymType;
/// The module name.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 32)]
public string ModuleName;
/// The image name. The name may or may not contain a full path.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)]
public string ImageName;
/// The full path and file name of the file from which symbols were loaded.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)]
public string LoadedImageName;
/// The full path and file name of the .pdb file.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)]
public string LoadedPdbName;
/// The signature of the CV record in the debug directories.
public uint CVSig;
/// The contents of the CV record.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260 * 3)]
public string CVData;
/// The PDB signature.
public uint PdbSig;
/// The PDB signature (Visual C/C++ 7.0 and later)
public Guid PdbSig70;
/// The DBI age of PDB.
public uint PdbAge;
/// A value that indicates whether the loaded PDB is unmatched.
[MarshalAs(UnmanagedType.Bool)] public bool PdbUnmatched;
/// A value that indicates whether the loaded DBG is unmatched.
[MarshalAs(UnmanagedType.Bool)] public bool DbgUnmatched;
/// A value that indicates whether line number information is available.
[MarshalAs(UnmanagedType.Bool)] public bool LineNumbers;
/// A value that indicates whether symbol information is available.
[MarshalAs(UnmanagedType.Bool)] public bool GlobalSymbols;
/// A value that indicates whether type information is available.
[MarshalAs(UnmanagedType.Bool)] public bool TypeInfo;
///
/// A value that indicates whether the .pdb supports the source server.
/// DbgHelp 6.1 and earlier: This member is not supported.
///
[MarshalAs(UnmanagedType.Bool)] public bool SourceIndexed;
///
/// A value that indicates whether the module contains public symbols.
/// DbgHelp 6.1 and earlier: This member is not supported.
///
[MarshalAs(UnmanagedType.Bool)] public bool Publics;
///
public uint MachineType;
///
public uint Reserved;
}
/// Contains the stack frame information. This structure is used with the SymSetContext function.
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_stack_frame typedef struct _IMAGEHLP_STACK_FRAME {
// ULONG64 InstructionOffset; ULONG64 ReturnOffset; ULONG64 FrameOffset; ULONG64 StackOffset; ULONG64 BackingStoreOffset; ULONG64
// FuncTableEntry; ULONG64 Params[4]; ULONG64 Reserved[5]; BOOL Virtual; ULONG Reserved2; } IMAGEHLP_STACK_FRAME, *PIMAGEHLP_STACK_FRAME;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_STACK_FRAME")]
[StructLayout(LayoutKind.Sequential)]
public struct IMAGEHLP_STACK_FRAME
{
///
/// The program counter.
/// x86: The program counter is EIP.
///
/// Intel Itanium: The program counter is a combination of the bundle address and a slot indicator of 0, 4, or 8 for the
/// slot within the bundle.
///
/// x64: The program counter is RIP.
///
public ulong InstructionOffset;
/// The return address.
public ulong ReturnOffset;
///
/// The frame pointer.
/// x86: The frame pointer is EBP.
/// Intel Itanium: There is no frame pointer, but AddrBStore is used.
/// x64: The frame pointer is RBP. AMD-64 does not always use this value.
///
public ulong FrameOffset;
///
/// The stack pointer.
/// x86: The stack pointer is ESP.
/// Intel Itanium: The stack pointer is SP.
/// x64: The stack pointer is RSP.
///
public ulong StackOffset;
/// Intel Itanium: The backing store address.
public ulong BackingStoreOffset;
/// x86: An FPO_DATA structure. If there is no function table entry, this member is NULL.
public ulong FuncTableEntry;
/// The possible arguments to the function.
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
public ulong[] Params;
/// This member is reserved for system use.
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 5)]
public ulong[] Reserved;
/// If this is a virtual frame, this member is TRUE. Otherwise, this member is FALSE.
[MarshalAs(UnmanagedType.Bool)] public bool Virtual;
/// This member is reserved for system use.
public uint Reserved2;
}
/// Contains symbol information.
///
///
/// This structure supersedes the IMAGEHLP_SYMBOL structure. For more information, see Updated Platform Support.
/// IMAGEHLP_SYMBOL is defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64 #define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64 #else typedef struct _IMAGEHLP_SYMBOL { DWORD SizeOfStruct; DWORD Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_symbol typedef struct _IMAGEHLP_SYMBOL { DWORD
// SizeOfStruct; DWORD Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_SYMBOL")]
[VanaraMarshaler(typeof(SafeAnysizeStringMarshaler), "Ansi")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)]
public struct IMAGEHLP_SYMBOL
{
/// The size of the structure, in bytes. The caller must set this member to sizeof(IMAGEHLP_SYMBOL).
public uint SizeOfStruct;
/// The virtual address for the symbol.
public uint Address;
/// The size of the symbol, in bytes. This value is a best guess and can be zero.
public uint Size;
/// This member is reserved for use by the operating system.
public uint Flags;
///
/// The maximum length of the string that the Name member can contain, in characters, not including the null-terminating
/// character. Because symbol names can vary in length, this data structure is allocated by the caller. This member is used so
/// the library knows how much memory is available for use by the symbol name.
///
public uint MaxNameLength;
///
/// The decorated or undecorated symbol name. If the buffer is not large enough for the complete name, it is truncated to
/// MaxNameLength characters, including the null-terminating character.
///
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)]
public string Name;
}
///
/// A marshaler implementation of that pulls a full string from a structure with a last field having
/// one character.
///
/// The structure type to be marshaled.
///
public class SafeAnysizeStringMarshaler : IVanaraMarshaler
{
private static readonly Type structType;
private static readonly System.Reflection.FieldInfo fiStr;
private CharSet charSet;
static SafeAnysizeStringMarshaler()
{
structType = typeof(T);
if (!structType.IsLayoutSequential)
throw new InvalidOperationException("This class can only manange sequential layout structures.");
fiStr = structType.GetOrderedFields().Last();
if (fiStr.FieldType != typeof(string))
throw new ArgumentException("The last field must be a string.");
}
/// Initializes a new instance of the class.
///
/// The name of the field in that specifies the string length of the last field of .
///
public SafeAnysizeStringMarshaler(string cookie)
{
charSet = (CharSet)Enum.Parse(typeof(CharSet), cookie);
}
/// Gets the size of the native data.
///
/// The size, in bytes, of the base object in memory. This should return the equivalent of the sizeof(X) function in C/C++.
///
public SizeT GetNativeSize() => Marshal.SizeOf(structType);
SafeAllocatedMemoryHandle IVanaraMarshaler.MarshalManagedToNative(object managedObject)
{
// Get structure information
if (managedObject is null) return SafeHGlobalHandle.Null;
if (!(managedObject is T value))
throw new ArgumentException($"{nameof(managedObject)} must be an instance of {structType.Name}.");
// Get the current value for the last field (or create one if needed)
var strVal = fiStr.GetValue(value) as string ?? string.Empty;
// Determine mem required for current struct and last field value
var chSz = StringHelper.GetCharSize(charSet);
var memSz = GetNativeSize() + chSz * strVal.Length;
// Set structure into allocated mem
var ret = new SafeHGlobalHandle(memSz);
ret.Write(value);
// Set string into mem
StringHelper.Write(strVal, ret, out _, true, charSet, chSz * (strVal.Length + 1));
return ret;
}
object IVanaraMarshaler.MarshalNativeToManaged(IntPtr pNativeData, SizeT allocatedBytes)
{
if (pNativeData == IntPtr.Zero) return null;
// Move structure and assign string
var value = (T)Marshal.PtrToStructure(pNativeData, typeof(T));
var strVal = StringHelper.GetString(pNativeData.Offset(Marshal.OffsetOf(typeof(T), fiStr.Name).ToInt32()), charSet);
fiStr.SetValueDirect(__makeref(value), strVal);
return value;
}
}
/// Contains symbol information.
///
///
/// This structure supersedes the IMAGEHLP_SYMBOL structure. For more information, see Updated Platform Support.
/// IMAGEHLP_SYMBOL is defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64 #define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64 #else typedef struct _IMAGEHLP_SYMBOL { DWORD SizeOfStruct; DWORD Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_symbol64 typedef struct _IMAGEHLP_SYMBOL64 { DWORD
// SizeOfStruct; DWORD64 Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL64, *PIMAGEHLP_SYMBOL64;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_SYMBOL64")]
[VanaraMarshaler(typeof(SafeAnysizeStringMarshaler), "Ansi")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)]
public struct IMAGEHLP_SYMBOL64
{
/// The size of the structure, in bytes. The caller must set this member to sizeof(IMAGEHLP_SYMBOL64).
public uint SizeOfStruct;
/// The virtual address for the symbol.
public ulong Address;
/// The size of the symbol, in bytes. This value is a best guess and can be zero.
public uint Size;
/// This member is reserved for use by the operating system.
public uint Flags;
///
/// The maximum length of the string that the Name member can contain, in characters, not including the null-terminating
/// character. Because symbol names can vary in length, this data structure is allocated by the caller. This member is used so
/// the library knows how much memory is available for use by the symbol name.
///
public uint MaxNameLength;
///
/// The decorated or undecorated symbol name. If the buffer is not large enough for the complete name, it is truncated to
/// MaxNameLength characters, including the null-terminating character.
///
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)]
public string Name;
}
/// Contains symbol information.
///
///
/// This structure supersedes the IMAGEHLP_SYMBOL structure. For more information, see Updated Platform Support.
/// IMAGEHLP_SYMBOL is defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64 #define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64 #else typedef struct _IMAGEHLP_SYMBOL { DWORD SizeOfStruct; DWORD Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_symbol typedef struct _IMAGEHLP_SYMBOL { DWORD
// SizeOfStruct; DWORD Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_SYMBOL")]
[VanaraMarshaler(typeof(SafeAnysizeStringMarshaler), "Unicode")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct IMAGEHLP_SYMBOLW
{
/// The size of the structure, in bytes. The caller must set this member to sizeof(IMAGEHLP_SYMBOLW).
public uint SizeOfStruct;
/// The virtual address for the symbol.
public uint Address;
/// The size of the symbol, in bytes. This value is a best guess and can be zero.
public uint Size;
/// This member is reserved for use by the operating system.
public uint Flags;
///
/// The maximum length of the string that the Name member can contain, in characters, not including the null-terminating
/// character. Because symbol names can vary in length, this data structure is allocated by the caller. This member is used so
/// the library knows how much memory is available for use by the symbol name.
///
public uint MaxNameLength;
///
/// The decorated or undecorated symbol name. If the buffer is not large enough for the complete name, it is truncated to
/// MaxNameLength characters, including the null-terminating character.
///
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)]
public string Name;
}
/// Contains symbol information.
///
///
/// This structure supersedes the IMAGEHLP_SYMBOL structure. For more information, see Updated Platform Support.
/// IMAGEHLP_SYMBOL is defined as follows in DbgHelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64 #define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64 #else typedef struct _IMAGEHLP_SYMBOL { DWORD SizeOfStruct; DWORD Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_symbolw64 typedef struct _IMAGEHLP_SYMBOLW64 {
// DWORD SizeOfStruct; DWORD64 Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; WCHAR Name[1]; } IMAGEHLP_SYMBOLW64, *PIMAGEHLP_SYMBOLW64;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_SYMBOLW64")]
[VanaraMarshaler(typeof(SafeAnysizeStringMarshaler), "Unicode")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct IMAGEHLP_SYMBOLW64
{
/// The size of the structure, in bytes. The caller must set this member to sizeof(IMAGEHLP_SYMBOLW64).
public uint SizeOfStruct;
/// The virtual address for the symbol.
public ulong Address;
/// The size of the symbol, in bytes. This value is a best guess and can be zero.
public uint Size;
/// This member is reserved for use by the operating system.
public uint Flags;
///
/// The maximum length of the string that the Name member can contain, in characters, not including the null-terminating
/// character. Because symbol names can vary in length, this data structure is allocated by the caller. This member is used so
/// the library knows how much memory is available for use by the symbol name.
///
public uint MaxNameLength;
///
/// The decorated or undecorated symbol name. If the buffer is not large enough for the complete name, it is truncated to
/// MaxNameLength characters, including the null-terminating character.
///
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)]
public string Name;
}
/// Information that is used by kernel debuggers to trace through user-mode callbacks in a thread's kernel stack.
///
///
/// This structure supersedes the KDHELP structure. For more information, see Updated Platform Support. KDHELP is
/// defined as follows in Dbghelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define KDHELP KDHELP64 #define PKDHELP PKDHELP64 #else typedef struct _KDHELP { DWORD Thread; DWORD ThCallbackStack; DWORD NextCallback; DWORD FramePointer; DWORD KiCallUserMode; DWORD KeUserCallbackDispatcher; DWORD SystemRangeStart; DWORD ThCallbackBStore; DWORD KiUserExceptionDispatcher; DWORD StackBase; DWORD StackLimit; DWORD Reserved[5]; } KDHELP, *PKDHELP; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-kdhelp typedef struct _KDHELP { DWORD Thread; DWORD
// ThCallbackStack; DWORD NextCallback; DWORD FramePointer; DWORD KiCallUserMode; DWORD KeUserCallbackDispatcher; DWORD
// SystemRangeStart; DWORD ThCallbackBStore; DWORD KiUserExceptionDispatcher; DWORD StackBase; DWORD StackLimit; DWORD Reserved[5];
// } KDHELP, *PKDHELP;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._KDHELP")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct KDHELP
{
/// The address of the kernel thread object, as provided in the WAIT_STATE_CHANGE packet.
public uint Thread;
/// The offset in the thread object to the pointer to the current callback frame in the kernel stack.
public uint ThCallbackStack;
/// The address of the next callback frame.
public uint NextCallback;
/// The address of the saved frame pointer, if applicable.
public uint FramePointer;
/// The address of the kernel function that calls out to user mode.
public uint KiCallUserMode;
/// The address of the user-mode dispatcher function.
public uint KeUserCallbackDispatcher;
/// The lowest kernel-mode address.
public uint SystemRangeStart;
///
/// Intel Itanium: The offset in the thread object to a pointer to the current callback backing store frame in the kernel stack.
///
public uint ThCallbackBStore;
///
/// The address of the user-mode exception dispatcher function.
/// DbgHelp 6.1 and earlier: This member is not supported.
///
public uint KiUserExceptionDispatcher;
/// The address of the stack base.
public uint StackBase;
/// The stack limit.
public uint StackLimit;
/// This member is reserved for use by the operating system.
private uint Reserved0;
private uint Reserved1;
private uint Reserved2;
private uint Reserved3;
private uint Reserved4;
}
/// Information that is used by kernel debuggers to trace through user-mode callbacks in a thread's kernel stack.
///
///
/// This structure supersedes the KDHELP structure. For more information, see Updated Platform Support. KDHELP is
/// defined as follows in Dbghelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define KDHELP KDHELP64 #define PKDHELP PKDHELP64 #else typedef struct _KDHELP { DWORD Thread; DWORD ThCallbackStack; DWORD NextCallback; DWORD FramePointer; DWORD KiCallUserMode; DWORD KeUserCallbackDispatcher; DWORD SystemRangeStart; DWORD ThCallbackBStore; DWORD KiUserExceptionDispatcher; DWORD StackBase; DWORD StackLimit; DWORD Reserved[5]; } KDHELP, *PKDHELP; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-kdhelp typedef struct _KDHELP { DWORD Thread; DWORD
// ThCallbackStack; DWORD NextCallback; DWORD FramePointer; DWORD KiCallUserMode; DWORD KeUserCallbackDispatcher; DWORD
// SystemRangeStart; DWORD ThCallbackBStore; DWORD KiUserExceptionDispatcher; DWORD StackBase; DWORD StackLimit; DWORD Reserved[5];
// } KDHELP, *PKDHELP;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._KDHELP")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct KDHELP64
{
/// The address of the kernel thread object, as provided in the WAIT_STATE_CHANGE packet.
public ulong Thread;
/// The offset in the thread object to the pointer to the current callback frame in the kernel stack.
public uint ThCallbackStack;
///
/// Intel Itanium: The offset in the thread object to a pointer to the current callback backing store frame in the kernel stack.
///
public uint ThCallbackBStore;
/// The address of the next callback frame.
public uint NextCallback;
/// The address of the saved frame pointer, if applicable.
public uint FramePointer;
/// The address of the kernel function that calls out to user mode.
public ulong KiCallUserMode;
/// The address of the user-mode dispatcher function.
public ulong KeUserCallbackDispatcher;
/// The lowest kernel-mode address.
public ulong SystemRangeStart;
///
/// The address of the user-mode exception dispatcher function.
/// DbgHelp 6.1 and earlier: This member is not supported.
///
public ulong KiUserExceptionDispatcher;
/// The address of the stack base.
public ulong StackBase;
/// The stack limit.
public ulong StackLimit;
/// Target OS build number.
public uint BuildVersion;
///
public uint RetpolineStubFunctionTableSize;
///
public ulong RetpolineStubFunctionTable;
///
public uint RetpolineStubOffset;
///
public uint RetpolineStubSize;
/// This member is reserved for use by the operating system.
private ulong Reserved0;
private ulong Reserved1;
}
/// Contains information about the loaded image.
///
/// The LIST_ENTRY structure is defined as follows:
///
/// typedef struct _LIST_ENTRY { struct _LIST_ENTRY *Flink; struct _LIST_ENTRY *Blink; } LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY;
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-loaded_image typedef struct _LOADED_IMAGE { PSTR
// ModuleName; HANDLE hFile; PUCHAR MappedAddress; #if ... PIMAGE_NT_HEADERS64 FileHeader; #else PIMAGE_NT_HEADERS32 FileHeader;
// #endif PIMAGE_SECTION_HEADER LastRvaSection; ULONG NumberOfSections; PIMAGE_SECTION_HEADER Sections; ULONG Characteristics;
// BOOLEAN fSystemImage; BOOLEAN fDOSImage; BOOLEAN fReadOnly; UCHAR Version; LIST_ENTRY Links; ULONG SizeOfImage; } LOADED_IMAGE, *PLOADED_IMAGE;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._LOADED_IMAGE")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)]
public struct LOADED_IMAGE
{
/// The file name of the mapped file.
[MarshalAs(UnmanagedType.LPStr)]
public string ModuleName;
/// A handle to the mapped file.
public HFILE hFile;
/// The base address of the mapped file.
public IntPtr MappedAddress;
/// A pointer to an structure.
public IntPtr FileHeader;
/// A pointer to an structure.
public IntPtr LastRvaSection;
/// The number of COFF section headers.
public uint NumberOfSections;
/// A pointer to an IMAGE_SECTION_HEADER structure.
public IntPtr Sections;
///
/// The image characteristics value. This member can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// IMAGE_FILE_RELOCS_STRIPPED 0x0001
/// Relocation information is stripped from the file.
///
/// -
/// IMAGE_FILE_EXECUTABLE_IMAGE 0x0002
/// The file is executable (there are no unresolved external references).
///
/// -
/// IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004
/// Line numbers are stripped from the file.
///
/// -
/// IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008
/// Local symbols are stripped from file.
///
/// -
/// IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010
/// Aggressively trim the working set.
///
/// -
/// IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020
/// The application can handle addresses larger than 2 GB.
///
/// -
/// IMAGE_FILE_BYTES_REVERSED_LO 0x0080
/// Bytes of word are reversed.
///
/// -
/// IMAGE_FILE_32BIT_MACHINE 0x0100
/// Computer supports 32-bit words.
///
/// -
/// IMAGE_FILE_DEBUG_STRIPPED 0x0200
/// Debugging information is stored separately in a .dbg file.
///
/// -
/// IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400
/// If the image is on removable media, copy and run from the swap file.
///
/// -
/// IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800
/// If the image is on the network, copy and run from the swap file.
///
/// -
/// IMAGE_FILE_SYSTEM 0x1000
/// System file.
///
/// -
/// IMAGE_FILE_DLL 0x2000
/// DLL file.
///
/// -
/// IMAGE_FILE_UP_SYSTEM_ONLY 0x4000
/// File should be run only on a uniprocessor computer.
///
/// -
/// IMAGE_FILE_BYTES_REVERSED_HI 0x8000
/// Bytes of the word are reversed.
///
///
///
public IMAGE_FILE Characteristics;
/// If the image is a kernel mode executable image, this value is TRUE.
[MarshalAs(UnmanagedType.U1)]
public bool fSystemImage;
/// If the image is a 16-bit executable image, this value is TRUE.
[MarshalAs(UnmanagedType.U1)]
public bool fDOSImage;
///
/// If the image is read-only, this value is TRUE.
/// Prior to Windows Vista: This member is not included in the structure.
///
[MarshalAs(UnmanagedType.U1)]
public bool fReadOnly;
///
/// The version string.
/// Prior to Windows Vista: This member is not included in the structure.
///
public byte Version;
/// The list of loaded images.
public LIST_ENTRY Links;
/// The size of the image, in bytes.
public uint SizeOfImage;
}
/// Contains CodeView and Misc records.
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-modload_cvmisc typedef struct _MODLOAD_CVMISC { DWORD oCV;
// size_t cCV; DWORD oMisc; size_t cMisc; DWORD dtImage; DWORD cImage; } MODLOAD_CVMISC, *PMODLOAD_CVMISC;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._MODLOAD_CVMISC")]
[StructLayout(LayoutKind.Sequential)]
public struct MODLOAD_CVMISC
{
/// The offset of the CodeView record.
public uint oCV;
/// The size of the CodeView record.
public SizeT cCV;
/// The offset of the Misc record.
public uint oMisc;
/// The size of the Misc record.
public SizeT cMisc;
/// The date/time stamp of the image.
public uint dtImage;
/// The size of the image.
public uint cImage;
}
/// Contains module data.
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-modload_data typedef struct _MODLOAD_DATA { DWORD ssize;
// DWORD ssig; PVOID data; DWORD size; DWORD flags; } MODLOAD_DATA, *PMODLOAD_DATA;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._MODLOAD_DATA")]
[StructLayout(LayoutKind.Sequential)]
public struct MODLOAD_DATA
{
/// The size of this structure, in bytes.
public uint ssize;
///
/// The type of data. This member can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// DBHHEADER_DEBUGDIRS 0x1
/// The data member is a buffer that contains an array of IMAGE_DEBUG_DIRECTORY structures.
///
/// -
/// DBHHEADER_CVMISC 0x2
/// The data member is a buffer that contains an array of MODLOAD_CVMISC structures.
///
///
///
public uint ssig;
/// The data. The format of this data depends on the value of the ssig member.
public IntPtr data;
/// The size of the data buffer, in bytes.
public uint size;
/// This member is unused.
public uint flags;
}
/// Describes an entry in an address map.
///
///
/// An address map provides a translation from one image layout (A) to another (B). An array of OMAP structures, sorted by
/// rva, defines an address map.
///
/// To translate an address, addrA, in image A to an address, addrB, in image B, perform the following steps:
///
/// -
/// Search the map for the entry, e, with the largest rva less than or equal to addrA.
///
/// -
/// Set delta = addrA – e.rva.
///
/// -
/// Set addrB = e.rvaTo + delta.
///
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-omap typedef struct _OMAP { ULONG rva; ULONG rvaTo; } OMAP, *POMAP;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._OMAP")]
[StructLayout(LayoutKind.Sequential)]
public struct OMAP
{
/// A relative virtual address (RVA) in image A.
public uint rva;
/// The relative virtual address that rva is mapped to in image B.
public uint rvaTo;
}
/// Contains source file information.
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-sourcefile typedef struct _SOURCEFILE { DWORD64 ModBase;
// PCHAR FileName; } SOURCEFILE, *PSOURCEFILE;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._SOURCEFILE")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct SOURCEFILE
{
/// The base address of the module.
public ulong ModBase;
/// The fully qualified source file name.
[MarshalAs(UnmanagedType.LPTStr)] public string FileName;
}
/// Contains line information.
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-srccodeinfo typedef struct _SRCCODEINFO { DWORD
// SizeOfStruct; PVOID Key; DWORD64 ModBase; CHAR Obj[MAX_PATH + 1]; CHAR FileName[MAX_PATH + 1]; DWORD LineNumber; DWORD64 Address;
// } SRCCODEINFO, *PSRCCODEINFO;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._SRCCODEINFO")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct SRCCODEINFO
{
/// The size of the structure, in bytes.
public uint SizeOfStruct;
/// This member is not used.
public IntPtr Key;
/// The base address of the module that contains the line.
public ulong ModBase;
/// The name of the object file within the module that contains the line.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 261 /*MAX_PATH + 1*/)]
public string Obj;
/// The fully qualified source file name.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 261 /*MAX_PATH + 1*/)]
public string FileName;
/// The line number within the source file.
public uint LineNumber;
/// The virtual address of the first instruction of the line.
public ulong Address;
}
/// Represents a stack frame.
///
///
/// This structure supersedes the STACKFRAME structure. For more information, see Updated Platform Support. STACKFRAME
/// is defined as follows in Dbghelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define STACKFRAME STACKFRAME64 #define LPSTACKFRAME LPSTACKFRAME64 #else typedef struct _tagSTACKFRAME { ADDRESS AddrPC; ADDRESS AddrReturn; ADDRESS AddrFrame; ADDRESS AddrStack; PVOID FuncTableEntry; DWORD Params[4]; BOOL Far; BOOL Virtual; DWORD Reserved[3]; KDHELP KdHelp; ADDRESS AddrBStore; } STACKFRAME, *LPSTACKFRAME; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-stackframe64 typedef struct _tagSTACKFRAME64 { ADDRESS64
// AddrPC; ADDRESS64 AddrReturn; ADDRESS64 AddrFrame; ADDRESS64 AddrStack; ADDRESS64 AddrBStore; PVOID FuncTableEntry; DWORD64
// Params[4]; BOOL Far; BOOL Virtual; DWORD64 Reserved[3]; KDHELP64 KdHelp; } STACKFRAME64, *LPSTACKFRAME64;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._tagSTACKFRAME64")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct STACKFRAME
{
///
/// An ADDRESS64 structure that specifies the program counter.
/// x86: The program counter is EIP.
/// Intel Itanium: The program counter is StIIP.
/// x64: The program counter is RIP.
///
public ADDRESS AddrPC;
/// An ADDRESS64 structure that specifies the return address.
public ADDRESS AddrReturn;
///
/// An ADDRESS64 structure that specifies the frame pointer.
/// x86: The frame pointer is EBP.
/// Intel Itanium: There is no frame pointer, but AddrBStore is used.
/// x64: The frame pointer is RBP or RDI. This value is not always used.
///
public ADDRESS AddrFrame;
///
/// An ADDRESS64 structure that specifies the stack pointer.
/// x86: The stack pointer is ESP.
/// Intel Itanium: The stack pointer is SP.
/// x64: The stack pointer is RSP.
///
public ADDRESS AddrStack;
///
/// On x86 computers, this member is an FPO_DATA structure. If there is no function table entry, this member is NULL.
///
public IntPtr FuncTableEntry;
/// The possible arguments to the function.
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
public uint[] Params;
/// This member is TRUE if this is a WOW far call.
[MarshalAs(UnmanagedType.Bool)] public bool Far;
/// This member is TRUE if this is a virtual frame.
[MarshalAs(UnmanagedType.Bool)] public bool Virtual;
/// This member is used internally by the StackWalk64 function.
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)]
public uint[] Reserved;
/// A KDHELP64 structure that specifies helper data for walking kernel callback frames.
public KDHELP KdHelp;
/// Intel Itanium: An ADDRESS64 structure that specifies the backing store (RsBSP).
public ADDRESS AddrBStore;
}
/// Represents an extended stack frame.
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-stackframe_ex typedef struct _tagSTACKFRAME_EX { ADDRESS64
// AddrPC; ADDRESS64 AddrReturn; ADDRESS64 AddrFrame; ADDRESS64 AddrStack; ADDRESS64 AddrBStore; PVOID FuncTableEntry; DWORD64
// Params[4]; BOOL Far; BOOL Virtual; DWORD64 Reserved[3]; KDHELP64 KdHelp; DWORD StackFrameSize; DWORD InlineFrameContext; }
// STACKFRAME_EX, *LPSTACKFRAME_EX;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._tagSTACKFRAME_EX")]
[StructLayout(LayoutKind.Sequential)]
public struct STACKFRAME_EX
{
///
/// An ADDRESS64 structure that specifies the program counter.
/// x86: The program counter is EIP.
/// Intel Itanium: The program counter is StIIP.
/// x64: The program counter is RIP.
///
public ADDRESS64 AddrPC;
/// An ADDRESS64 structure that specifies the return address.
public ADDRESS64 AddrReturn;
///
/// An ADDRESS64 structure that specifies the frame pointer.
/// x86: The frame pointer is EBP.
/// Intel Itanium: There is no frame pointer, but AddrBStore is used.
/// x64: The frame pointer is RBP or RDI. This value is not always used.
///
public ADDRESS64 AddrFrame;
///
/// An ADDRESS64 structure that specifies the stack pointer.
/// x86: The stack pointer is ESP.
/// Intel Itanium: The stack pointer is SP.
/// x64: The stack pointer is RSP.
///
public ADDRESS64 AddrStack;
/// Intel Itanium: An ADDRESS64 structure that specifies the backing store (RsBSP).
public ADDRESS64 AddrBStore;
///
/// On x86 computers, this member is an FPO_DATA structure. If there is no function table entry, this member is NULL.
///
public IntPtr FuncTableEntry;
/// The possible arguments to the function.
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
public ulong[] Params;
/// This member is TRUE if this is a WOW far call.
[MarshalAs(UnmanagedType.Bool)] public bool Far;
/// This member is TRUE if this is a virtual frame.
[MarshalAs(UnmanagedType.Bool)] public bool Virtual;
/// This member is used internally by the StackWalkEx function.
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)]
public ulong[] Reserved;
/// A KDHELP64 structure that specifies helper data for walking kernel callback frames.
public KDHELP64 KdHelp;
///
/// Set to
/// sizeof(STACKFRAME_EX)
/// .
///
public uint StackFrameSize;
///
/// Specifies the type of the inline frame context.
/// INLINE_FRAME_CONTEXT_INIT (0)
/// INLINE_FRAME_CONTEXT_IGNORE (0xffffffff)
///
public INLINE_FRAME_CONTEXT InlineFrameContext;
}
/// Represents a stack frame.
///
///
/// This structure supersedes the STACKFRAME structure. For more information, see Updated Platform Support. STACKFRAME
/// is defined as follows in Dbghelp.h.
///
///
/// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define STACKFRAME STACKFRAME64 #define LPSTACKFRAME LPSTACKFRAME64 #else typedef struct _tagSTACKFRAME { ADDRESS AddrPC; ADDRESS AddrReturn; ADDRESS AddrFrame; ADDRESS AddrStack; PVOID FuncTableEntry; DWORD Params[4]; BOOL Far; BOOL Virtual; DWORD Reserved[3]; KDHELP KdHelp; ADDRESS AddrBStore; } STACKFRAME, *LPSTACKFRAME; #endif
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-stackframe64 typedef struct _tagSTACKFRAME64 { ADDRESS64
// AddrPC; ADDRESS64 AddrReturn; ADDRESS64 AddrFrame; ADDRESS64 AddrStack; ADDRESS64 AddrBStore; PVOID FuncTableEntry; DWORD64
// Params[4]; BOOL Far; BOOL Virtual; DWORD64 Reserved[3]; KDHELP64 KdHelp; } STACKFRAME64, *LPSTACKFRAME64;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._tagSTACKFRAME64")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct STACKFRAME64
{
///
/// An ADDRESS64 structure that specifies the program counter.
/// x86: The program counter is EIP.
/// Intel Itanium: The program counter is StIIP.
/// x64: The program counter is RIP.
///
public ADDRESS64 AddrPC;
/// An ADDRESS64 structure that specifies the return address.
public ADDRESS64 AddrReturn;
///
/// An ADDRESS64 structure that specifies the frame pointer.
/// x86: The frame pointer is EBP.
/// Intel Itanium: There is no frame pointer, but AddrBStore is used.
/// x64: The frame pointer is RBP or RDI. This value is not always used.
///
public ADDRESS64 AddrFrame;
///
/// An ADDRESS64 structure that specifies the stack pointer.
/// x86: The stack pointer is ESP.
/// Intel Itanium: The stack pointer is SP.
/// x64: The stack pointer is RSP.
///
public ADDRESS64 AddrStack;
/// Intel Itanium: An ADDRESS64 structure that specifies the backing store (RsBSP).
public ADDRESS64 AddrBStore;
///
/// On x86 computers, this member is an FPO_DATA structure. If there is no function table entry, this member is NULL.
///
public IntPtr FuncTableEntry;
/// The possible arguments to the function.
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
public ulong[] Params;
/// This member is TRUE if this is a WOW far call.
[MarshalAs(UnmanagedType.Bool)] public bool Far;
/// This member is TRUE if this is a virtual frame.
[MarshalAs(UnmanagedType.Bool)] public bool Virtual;
/// This member is used internally by the StackWalk64 function.
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)]
public ulong[] Reserved;
/// A KDHELP64 structure that specifies helper data for walking kernel callback frames.
public KDHELP64 KdHelp;
}
/// Contains symbol information.
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-symbol_info typedef struct _SYMBOL_INFO { ULONG
// SizeOfStruct; ULONG TypeIndex; ULONG64 Reserved[2]; ULONG Index; ULONG Size; ULONG64 ModBase; ULONG Flags; ULONG64 Value; ULONG64
// Address; ULONG Register; ULONG Scope; ULONG Tag; ULONG NameLen; ULONG MaxNameLen; CHAR Name[1]; } SYMBOL_INFO, *PSYMBOL_INFO;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._SYMBOL_INFO")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct SYMBOL_INFO
{
///
/// The size of the structure, in bytes. This member must be set to sizeof(SYMBOL_INFO) . Note that the total size of the
/// data is the SizeOfStruct + (MaxNameLen - 1) * sizeof(TCHAR) . The reason to subtract one is that the first character
/// in the name is accounted for in the size of the structure.
///
public uint SizeOfStruct;
///
/// A unique value that identifies the type data that describes the symbol. This value does not persist between sessions.
///
public uint TypeIndex;
/// This member is reserved for system use.
public ulong Reserved0;
private ulong Reserved1;
///
///
/// The unique value for the symbol. The value associated with a symbol is not guaranteed to be the same each time you run the process.
///
///
/// For PDB symbols, the index value for a symbol is not generated until the symbol is enumerated or retrieved through a search
/// by name or address. The index values for all CodeView and COFF symbols are generated when the symbols are loaded.
///
///
public uint Index;
///
/// The symbol size, in bytes. This value is meaningful only if the module symbols are from a pdb file; otherwise, this value is
/// typically zero and should be ignored.
///
public uint Size;
/// The base address of the module that contains the symbol.
public ulong ModBase;
///
/// This member can be one or more of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// SYMFLAG_CLR_TOKEN 0x00040000
/// The symbol is a CLR token.
///
/// -
/// SYMFLAG_CONSTANT 0x00000100
/// The symbol is a constant.
///
/// -
/// SYMFLAG_EXPORT 0x00000200
/// The symbol is from the export table.
///
/// -
/// SYMFLAG_FORWARDER 0x00000400
/// The symbol is a forwarder.
///
/// -
/// SYMFLAG_FRAMEREL 0x00000020
/// Offsets are frame relative.
///
/// -
/// SYMFLAG_FUNCTION 0x00000800
/// The symbol is a known function.
///
/// -
/// SYMFLAG_ILREL 0x00010000
///
/// The symbol address is an offset relative to the beginning of the intermediate language block. This applies to managed code only.
///
///
/// -
/// SYMFLAG_LOCAL 0x00000080
/// The symbol is a local variable.
///
/// -
/// SYMFLAG_METADATA 0x00020000
/// The symbol is managed metadata.
///
/// -
/// SYMFLAG_PARAMETER 0x00000040
/// The symbol is a parameter.
///
/// -
/// SYMFLAG_REGISTER 0x00000008
/// The symbol is a register. The Register member is used.
///
/// -
/// SYMFLAG_REGREL 0x00000010
/// Offsets are register relative.
///
/// -
/// SYMFLAG_SLOT 0x00008000
/// The symbol is a managed code slot.
///
/// -
/// SYMFLAG_THUNK 0x00002000
/// The symbol is a thunk.
///
/// -
/// SYMFLAG_TLSREL 0x00004000
/// The symbol is an offset into the TLS data area.
///
/// -
/// SYMFLAG_VALUEPRESENT 0x00000001
/// The Value member is used.
///
/// -
/// SYMFLAG_VIRTUAL 0x00001000
/// The symbol is a virtual symbol created by the SymAddSymbol function.
///
///
///
public SYMFLAG Flags;
/// The value of a constant.
public ulong Value;
/// The virtual address of the start of the symbol.
public ulong Address;
/// The register.
public uint Register;
///
/// The DIA scope. For more information, see the Debug Interface Access SDK in the Visual Studio documentation. (This resource
/// may not be available in some languages and countries.)
///
public uint Scope;
/// The PDB classification. These values are defined in Dbghelp.h in the SymTagEnum enumeration type.
public uint Tag;
/// The length of the name, in characters, not including the null-terminating character.
public uint NameLen;
/// The size of the Name buffer, in characters. If this member is 0, the Name member is not used.
public uint MaxNameLen;
///
/// The name of the symbol. The name can be undecorated if the SYMOPT_UNDNAME option is used with the SymSetOptions function.
///
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = MAX_SYM_NAME)]
public string Name;
/// The default initial value for SYMBOL_INFO with size parameters set.
public static SYMBOL_INFO Default = new() { SizeOfStruct = (uint)Marshal.SizeOf(typeof(SYMBOL_INFO_V)), MaxNameLen = MAX_SYM_NAME };
}
///
/// Contains symbol information. Use this structure when extracting from a pointer, like in the enumeration callbacks.
///
///
/// This is a sample of how to use this structure in a callback.
/// List<SYMBOL_INFO> list = new();
/// Win32Error.ThrowLastErrorIfFalse(SymEnumSymbolsEx(hProcess, baseOfDll, mask, EnumProc, userContext, options));
///
/// bool EnumProc(IntPtr pSymInfo, uint SymbolSize, IntPtr UserContext)
/// {
/// try { list.Add((SYMBOL_INFO)pSymInfo.ToStructure<SYMBOL_INFO_V>(SymbolSize)); return true; }
/// catch { return false; }
/// }
///
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-symbol_info typedef struct _SYMBOL_INFO { ULONG
// SizeOfStruct; ULONG TypeIndex; ULONG64 Reserved[2]; ULONG Index; ULONG Size; ULONG64 ModBase; ULONG Flags; ULONG64 Value; ULONG64
// Address; ULONG Register; ULONG Scope; ULONG Tag; ULONG NameLen; ULONG MaxNameLen; CHAR Name[1]; } SYMBOL_INFO, *PSYMBOL_INFO;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._SYMBOL_INFO")]
[VanaraMarshaler(typeof(SafeAnysizeStringMarshaler), "Auto")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct SYMBOL_INFO_V
{
///
/// The size of the structure, in bytes. This member must be set to sizeof(SYMBOL_INFO) . Note that the total size of the
/// data is the SizeOfStruct + (MaxNameLen - 1) * sizeof(TCHAR) . The reason to subtract one is that the first character
/// in the name is accounted for in the size of the structure.
///
public uint SizeOfStruct;
///
/// A unique value that identifies the type data that describes the symbol. This value does not persist between sessions.
///
public uint TypeIndex;
/// This member is reserved for system use.
public ulong Reserved0;
private ulong Reserved1;
///
///
/// The unique value for the symbol. The value associated with a symbol is not guaranteed to be the same each time you run the process.
///
///
/// For PDB symbols, the index value for a symbol is not generated until the symbol is enumerated or retrieved through a search
/// by name or address. The index values for all CodeView and COFF symbols are generated when the symbols are loaded.
///
///
public uint Index;
///
/// The symbol size, in bytes. This value is meaningful only if the module symbols are from a pdb file; otherwise, this value is
/// typically zero and should be ignored.
///
public uint Size;
/// The base address of the module that contains the symbol.
public ulong ModBase;
///
/// This member can be one or more of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// SYMFLAG_CLR_TOKEN 0x00040000
/// The symbol is a CLR token.
///
/// -
/// SYMFLAG_CONSTANT 0x00000100
/// The symbol is a constant.
///
/// -
/// SYMFLAG_EXPORT 0x00000200
/// The symbol is from the export table.
///
/// -
/// SYMFLAG_FORWARDER 0x00000400
/// The symbol is a forwarder.
///
/// -
/// SYMFLAG_FRAMEREL 0x00000020
/// Offsets are frame relative.
///
/// -
/// SYMFLAG_FUNCTION 0x00000800
/// The symbol is a known function.
///
/// -
/// SYMFLAG_ILREL 0x00010000
///
/// The symbol address is an offset relative to the beginning of the intermediate language block. This applies to managed code only.
///
///
/// -
/// SYMFLAG_LOCAL 0x00000080
/// The symbol is a local variable.
///
/// -
/// SYMFLAG_METADATA 0x00020000
/// The symbol is managed metadata.
///
/// -
/// SYMFLAG_PARAMETER 0x00000040
/// The symbol is a parameter.
///
/// -
/// SYMFLAG_REGISTER 0x00000008
/// The symbol is a register. The Register member is used.
///
/// -
/// SYMFLAG_REGREL 0x00000010
/// Offsets are register relative.
///
/// -
/// SYMFLAG_SLOT 0x00008000
/// The symbol is a managed code slot.
///
/// -
/// SYMFLAG_THUNK 0x00002000
/// The symbol is a thunk.
///
/// -
/// SYMFLAG_TLSREL 0x00004000
/// The symbol is an offset into the TLS data area.
///
/// -
/// SYMFLAG_VALUEPRESENT 0x00000001
/// The Value member is used.
///
/// -
/// SYMFLAG_VIRTUAL 0x00001000
/// The symbol is a virtual symbol created by the SymAddSymbol function.
///
///
///
public SYMFLAG Flags;
/// The value of a constant.
public ulong Value;
/// The virtual address of the start of the symbol.
public ulong Address;
/// The register.
public uint Register;
///
/// The DIA scope. For more information, see the Debug Interface Access SDK in the Visual Studio documentation. (This resource
/// may not be available in some languages and countries.)
///
public uint Scope;
/// The PDB classification. These values are defined in Dbghelp.h in the SymTagEnum enumeration type.
public uint Tag;
/// The length of the name, in characters, not including the null-terminating character.
public uint NameLen;
/// The size of the Name buffer, in characters. If this member is 0, the Name member is not used.
public uint MaxNameLen;
///
/// The name of the symbol. The name can be undecorated if the SYMOPT_UNDNAME option is used with the SymSetOptions function.
///
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)]
public string Name;
/// Performs an implicit conversion from to .
/// The r.
/// The result of the conversion.
public static implicit operator SYMBOL_INFO(SYMBOL_INFO_V r)
{
var ret = default(SYMBOL_INFO);
foreach (var fi in typeof(SYMBOL_INFO_V).GetFields())
ret.SetFieldValue(fi.Name, fi.GetValue(r));
return ret;
}
}
/// Contains symbol server index information.
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-symsrv_index_info typedef struct { DWORD sizeofstruct; char
// file[MAX_PATH + 1]; BOOL stripped; DWORD timestamp; DWORD size; char dbgfile[MAX_PATH + 1]; char pdbfile[MAX_PATH + 1]; GUID
// guid; DWORD sig; DWORD age; } SYMSRV_INDEX_INFO, *PSYMSRV_INDEX_INFO;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp.__unnamed_struct_0")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)]
public struct SYMSRV_INDEX_INFO
{
///
/// The size of the structure, in bytes. This member must be set to sizeof(SYMSRV_INDEX_INFO) or
/// sizeof(SYMSRV_INDEX_INFOW) .
///
public uint sizeofstruct;
/// The name of the .pdb, .dbg, or image file.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 261 /*MAX_PATH + 1*/)]
public string file;
/// A value that indicates whether the image file is stripped.
[MarshalAs(UnmanagedType.Bool)] public bool stripped;
/// The timestamp from the PE header. This member is used only for image files.
public uint timestamp;
/// The file size from the PE header. This member is used only for image files.
public uint size;
///
/// If the image file is stripped and there is a .dbg file, this member is the path to the .dbg file from the CV record.
///
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 261 /*MAX_PATH + 1*/)]
public string dbgfile;
/// The .pdb file from the CV record. This member is used only for image and .dbg files.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 261 /*MAX_PATH + 1*/)]
public string pdbfile;
///
/// The GUID of the .pdb file. If there is no GUID available, the signature of the .pdb file is copied into first DWORD
/// of the GUID.
///
public Guid guid;
///
/// The signature of the .pdb file (for use with old-style .pdb files). This value can be 0 if it is a new-style .pdb file that
/// uses a GUID-length signature.
///
public uint sig;
/// The age of the .pdb file.
public uint age;
}
/// Contains type index information. It is used by the SymGetTypeInfo function.
// https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-ti_findchildren_params typedef struct
// _TI_FINDCHILDREN_PARAMS { ULONG Count; ULONG Start; ULONG ChildId[1]; } TI_FINDCHILDREN_PARAMS;
[PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._TI_FINDCHILDREN_PARAMS")]
[VanaraMarshaler(typeof(SafeAnysizeStructMarshaler), nameof(Count))]
[StructLayout(LayoutKind.Sequential)]
public struct TI_FINDCHILDREN_PARAMS
{
/// The number of children.
public uint Count;
///
/// The zero-based index of the child from which the child indexes are to be retrieved. For example, in an array with five
/// elements, if Start is two, this indicates the third array element. In most cases, this member is zero.
///
public uint Start;
/// An array of type indexes. There is one index per child.
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)]
public uint[] ChildId;
}
/// Contains symbol information.
///
public class SafeIMAGEHLP_SYMBOL : SafeHGlobalStruct
{
/// Initializes a new instance of the class.
/// Maximum length of the name.
public SafeIMAGEHLP_SYMBOL(int maxNameLen = 261) : base(BaseStructSize + (maxNameLen - 1))
{
handle.Write((uint)BaseStructSize, 0, Size);
handle.Write((uint)maxNameLen, (int)FieldOffset(nameof(IMAGEHLP_SYMBOL.MaxNameLength)), Size);
}
}
/// Contains symbol information.
///
public class SafeIMAGEHLP_SYMBOL64 : SafeHGlobalStruct
{
/// Initializes a new instance of the class.
/// Maximum length of the name.
public SafeIMAGEHLP_SYMBOL64(int maxNameLen = 261) : base(BaseStructSize + (maxNameLen - 1))
{
handle.Write((uint)BaseStructSize, 0, Size);
handle.Write((uint)maxNameLen, (int)FieldOffset(nameof(IMAGEHLP_SYMBOL64.MaxNameLength)), Size);
}
}
/// Pointer to a LOADED_IMAGE structure.
///
public class SafeLOADED_IMAGE : SafeHandle
{
private SafeLOADED_IMAGE() : base(IntPtr.Zero, true)
{
}
/// When overridden in a derived class, gets a value indicating whether the handle value is invalid.
public override bool IsInvalid => handle == IntPtr.Zero;
/// Performs an implicit conversion from to .
/// The instance.
/// The resulting instance from the conversion.
public static implicit operator LOADED_IMAGE(SafeLOADED_IMAGE i) => i.handle.ToStructure();
/// When overridden in a derived class, executes the code required to free the handle.
///
/// true if the handle is released successfully; otherwise, in the event of a catastrophic failure, false. In this case, it
/// generates a releaseHandleFailed MDA Managed Debugging Assistant.
///
protected override bool ReleaseHandle() => ImageHlp.ImageUnload(handle);
}
}
}