using System; using System.Linq; using System.Runtime.InteropServices; using Vanara.Extensions; using Vanara.Extensions.Reflection; using Vanara.InteropServices; namespace Vanara.PInvoke { /// Items from the DbgHelp.dll public static partial class DbgHelp { /// The maximum length of a symbol name. public const int MAX_SYM_NAME = 2000; /// Flags for . [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_DEFERRED_SYMBOL_LOAD64")] [Flags] public enum DSLFLAG { /// DSLFLAG_MISMATCHED_PDB = 0x1, /// DSLFLAG_MISMATCHED_DBG = 0x2, /// FLAG_ENGINE_PRESENT = 0x4, /// FLAG_ENGOPT_DISALLOW_NETWORK_PATHS = 0x8, /// FLAG_OVERRIDE_ARM_MACHINE_TYPE = 0x10, } /// Flags for . [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_GET_TYPE_INFO_PARAMS")] public enum IMAGEHLP_GTI_FLAGS { /// /// Do not cache the data for later retrievals. It is good to use this flag if you will not be requesting the information again. /// IMAGEHLP_GET_TYPE_INFO_UNCACHED = 0x00000001, /// Retrieve information about the children of the specified types, not the types themselves. IMAGEHLP_GET_TYPE_INFO_CHILDREN = 0x00000002 } /// Specifies the type of the inline frame context. [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._tagSTACKFRAME_EX")] public enum INLINE_FRAME_CONTEXT : uint { /// INLINE_FRAME_CONTEXT_INIT = 0, /// INLINE_FRAME_CONTEXT_IGNORE = 0xFFFFFFFF } /// The type of symbols that are loaded. [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_MODULE")] public enum SYM_TYPE { /// No symbols are loaded. SymNone = 0, /// COFF symbols. SymCoff, /// CodeView symbols. SymCv, /// PDB symbols. SymPdb, /// Symbols generated from a DLL export table. SymExport, /// Symbol loading deferred. SymDeferred, /// .sym file. SymSym, // .sym file /// DIA symbols. SymDia, /// The virtual module created by SymLoadModuleEx with SLMFLAG_VIRTUAL. SymVirtual, /// Unused. NumSymTypes } /// flags found in SYMBOL_INFO.Flags [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._SYMBOL_INFO")] public enum SYMFLAG : uint { /// The Value member is used. SYMFLAG_VALUEPRESENT = 0x00000001, /// The symbol is a register. The Register member is used. SYMFLAG_REGISTER = 0x00000008, /// Offsets are register relative. SYMFLAG_REGREL = 0x00000010, /// Offsets are frame relative. SYMFLAG_FRAMEREL = 0x00000020, /// The symbol is a parameter. SYMFLAG_PARAMETER = 0x00000040, /// The symbol is a local variable. SYMFLAG_LOCAL = 0x00000080, /// The symbol is a constant. SYMFLAG_CONSTANT = 0x00000100, /// The symbol is from the export table. SYMFLAG_EXPORT = 0x00000200, /// The symbol is a forwarder. SYMFLAG_FORWARDER = 0x00000400, /// The symbol is a known function. SYMFLAG_FUNCTION = 0x00000800, /// The symbol is a virtual symbol created by the SymAddSymbol function. SYMFLAG_VIRTUAL = 0x00001000, /// The symbol is a thunk. SYMFLAG_THUNK = 0x00002000, /// The symbol is an offset into the TLS data area. SYMFLAG_TLSREL = 0x00004000, /// The symbol is a managed code slot. SYMFLAG_SLOT = 0x00008000, /// /// The symbol address is an offset relative to the beginning of the intermediate language block. This applies to managed code only. /// SYMFLAG_ILREL = 0x00010000, /// The symbol is managed metadata. SYMFLAG_METADATA = 0x00020000, /// The symbol is a CLR token. SYMFLAG_CLR_TOKEN = 0x00040000, /// SYMFLAG_NULL = 0x00080000, /// SYMFLAG_FUNC_NO_RETURN = 0x00100000, /// SYMFLAG_SYNTHETIC_ZEROBASE = 0x00200000, /// SYMFLAG_PUBLIC_CODE = 0x00400000, /// SYMFLAG_REGREL_ALIASINDIR = 0x00800000, /// this resets SymNext/Prev to the beginning of the module passed in the address field SYMFLAG_RESET = 0x80000000, } /// Converts a time stamp to a . /// /// The time stamp which is a value represented in the number of seconds elapsed since midnight (00:00:00), January 1, 1970, /// Universal Coordinated Time, according to the system clock. /// /// public static DateTime TimeStampToDateTime(uint timeStamp) => new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc) + TimeSpan.FromSeconds(timeStamp); /// Represents an address. It is used in the STACKFRAME64 structure. /// /// /// This structure supersedes the ADDRESS structure. For more information, see Updated Platform Support. ADDRESS is /// defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define ADDRESS ADDRESS64 #define LPADDRESS LPADDRESS64 #else typedef struct _tagADDRESS { DWORD Offset; WORD Segment; ADDRESS_MODE Mode; } ADDRESS, *LPADDRESS; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-address typedef struct _tagADDRESS { DWORD Offset; WORD // Segment; ADDRESS_MODE Mode; } ADDRESS, *LPADDRESS; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._tagADDRESS")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct ADDRESS { /// /// The offset into the segment, or a 32-bit virtual address. The interpretation of this value depends on the value contained in /// the Mode member. /// public uint Offset; /// The segment number. This value is used only for 16-bit addressing. public ushort Segment; /// /// The addressing mode. This member can be one of the following values. /// /// /// Value /// Meaning /// /// /// AddrMode1616 0 /// 16:16 addressing. To support this addressing mode, you must supply a TranslateAddressProc64 callback function. /// /// /// AddrMode1632 1 /// 16:32 addressing. To support this addressing mode, you must supply a TranslateAddressProc64 callback function. /// /// /// AddrModeReal 2 /// Real-mode addressing. To support this addressing mode, you must supply a TranslateAddressProc64 callback function. /// /// /// AddrModeFlat 3 /// Flat addressing. This is the only addressing mode supported by the library. /// /// /// public ADDRESS_MODE Mode; } /// Represents an address. It is used in the STACKFRAME64 structure. /// /// /// This structure supersedes the ADDRESS structure. For more information, see Updated Platform Support. ADDRESS is /// defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define ADDRESS ADDRESS64 #define LPADDRESS LPADDRESS64 #else typedef struct _tagADDRESS { DWORD Offset; WORD Segment; ADDRESS_MODE Mode; } ADDRESS, *LPADDRESS; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-address64 typedef struct _tagADDRESS64 { DWORD64 Offset; // WORD Segment; ADDRESS_MODE Mode; } ADDRESS64, *LPADDRESS64; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._tagADDRESS64")] [StructLayout(LayoutKind.Sequential)] public struct ADDRESS64 { /// /// The offset into the segment, or a 32-bit virtual address. The interpretation of this value depends on the value contained in /// the Mode member. /// public ulong Offset; /// The segment number. This value is used only for 16-bit addressing. public ushort Segment; /// /// The addressing mode. This member can be one of the following values. /// /// /// Value /// Meaning /// /// /// AddrMode1616 0 /// 16:16 addressing. To support this addressing mode, you must supply a TranslateAddressProc64 callback function. /// /// /// AddrMode1632 1 /// 16:32 addressing. To support this addressing mode, you must supply a TranslateAddressProc64 callback function. /// /// /// AddrModeReal 2 /// Real-mode addressing. To support this addressing mode, you must supply a TranslateAddressProc64 callback function. /// /// /// AddrModeFlat 3 /// Flat addressing. This is the only addressing mode supported by the library. /// /// /// public ADDRESS_MODE Mode; } /// Contains the library version. // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-api_version typedef struct API_VERSION { USHORT // MajorVersion; USHORT MinorVersion; USHORT Revision; USHORT Reserved; } API_VERSION, *LPAPI_VERSION; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp.API_VERSION")] [StructLayout(LayoutKind.Sequential)] public struct API_VERSION { /// The major version number. public ushort MajorVersion; /// The minor version number. public ushort MinorVersion; /// The revision number. public ushort Revision; /// This member is reserved for use by the operating system. public ushort Reserved; /// Performs an explicit conversion from to . /// The version. /// The resulting instance from the conversion. /// version.Build must be 0 public static implicit operator API_VERSION(Version version) => new API_VERSION { MajorVersion = (ushort)version.Major, MinorVersion = (ushort)version.Minor, Revision = (ushort)version.Revision, Reserved = version.Build == 0 ? (ushort)0 : throw new ArgumentException("version.Build must be 0") }; /// Performs an explicit conversion from to . /// The version. /// The resulting instance from the conversion. public static explicit operator Version(API_VERSION version) => new Version(version.MajorVersion, version.MinorVersion, 0, version.Revision); } /// /// Contains debugging information. /// /// Note This structure is used by the MapDebugInformation and UnmapDebugInformation functions, which are provided only for /// backward compatibility. /// /// /// /// The LIST_ENTRY structure is defined as follows: /// /// typedef struct _LIST_ENTRY { struct _LIST_ENTRY *Flink; struct _LIST_ENTRY *Blink; } LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY; /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-image_debug_information typedef struct // _IMAGE_DEBUG_INFORMATION { LIST_ENTRY List; DWORD ReservedSize; PVOID ReservedMappedBase; USHORT ReservedMachine; USHORT // ReservedCharacteristics; DWORD ReservedCheckSum; DWORD ImageBase; DWORD SizeOfImage; DWORD ReservedNumberOfSections; // PIMAGE_SECTION_HEADER ReservedSections; DWORD ReservedExportedNamesSize; PSTR ReservedExportedNames; DWORD // ReservedNumberOfFunctionTableEntries; PIMAGE_FUNCTION_ENTRY ReservedFunctionTableEntries; DWORD // ReservedLowestFunctionStartingAddress; DWORD ReservedHighestFunctionEndingAddress; DWORD ReservedNumberOfFpoTableEntries; // PFPO_DATA ReservedFpoTableEntries; DWORD SizeOfCoffSymbols; PIMAGE_COFF_SYMBOLS_HEADER CoffSymbols; DWORD // ReservedSizeOfCodeViewSymbols; PVOID ReservedCodeViewSymbols; PSTR ImageFilePath; PSTR ImageFileName; PSTR ReservedDebugFilePath; // DWORD ReservedTimeDateStamp; BOOL ReservedRomImage; PIMAGE_DEBUG_DIRECTORY ReservedDebugDirectory; DWORD // ReservedNumberOfDebugDirectories; DWORD ReservedOriginalFunctionTableBaseAddress; DWORD Reserved[2]; } IMAGE_DEBUG_INFORMATION, *PIMAGE_DEBUG_INFORMATION; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGE_DEBUG_INFORMATION")] [StructLayout(LayoutKind.Sequential)] public struct IMAGE_DEBUG_INFORMATION { /// A linked list of LIST_ENTRY structures. public LIST_ENTRY List; /// /// The size of the memory allocated for the IMAGE_DEBUG_INFORMATION structure and all debugging information, in bytes. /// public uint ReservedSize; /// The base address of the image. public IntPtr ReservedMappedBase; /// /// The computer type. This member can be one of the following values. /// /// /// Value /// Meaning /// /// /// IMAGE_FILE_MACHINE_I386 0x014c /// Intel (32-bit) /// /// /// IMAGE_FILE_MACHINE_IA64 0x0200 /// Intel Itanium /// /// /// IMAGE_FILE_MACHINE_AMD64 0x8664 /// x64 (AMD64 or EM64T) /// /// /// public IMAGE_FILE_MACHINE ReservedMachine; /// /// The characteristics of the image. This member can be one of the following values. /// /// /// Value /// Meaning /// /// /// IMAGE_FILE_RELOCS_STRIPPED 0x0001 /// Relocation information is stripped from the file. /// /// /// IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 /// The file is executable (there are no unresolved external references). /// /// /// IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 /// Line numbers are stripped from the file. /// /// /// IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 /// Local symbols are stripped from file. /// /// /// IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010 /// Aggressively trim the working set. /// /// /// IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 /// The application can handle addresses larger than 2 GB. /// /// /// IMAGE_FILE_BYTES_REVERSED_LO 0x0080 /// Bytes of the word are reversed. /// /// /// IMAGE_FILE_32BIT_MACHINE 0x0100 /// Computer supports 32-bit words. /// /// /// IMAGE_FILE_DEBUG_STRIPPED 0x0200 /// Debugging information is stored separately in a .dbg file. /// /// /// IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 /// If the image is on removable media, copy and run from the swap file. /// /// /// IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 /// If the image is on the network, copy and run from the swap file. /// /// /// IMAGE_FILE_SYSTEM 0x1000 /// System file. /// /// /// IMAGE_FILE_DLL 0x2000 /// DLL file. /// /// /// IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 /// File should be run only on a uniprocessor computer. /// /// /// IMAGE_FILE_BYTES_REVERSED_HI 0x8000 /// Bytes of the word are reversed. /// /// /// public IMAGE_FILE ReservedCharacteristics; /// The checksum of the image. public uint ReservedCheckSum; /// The requested base address of the image. public uint ImageBase; /// The size of the image, in bytes. public uint SizeOfImage; /// The number of COFF section headers. public uint ReservedNumberOfSections; /// A pointer to the first COFF section header. For more information, see IMAGE_SECTION_HEADER. public IntPtr ReservedSections; /// The size of the ExportedNames member, in bytes. public uint ReservedExportedNamesSize; /// A pointer to a series of null-terminated strings that name all the functions exported from the image. public IntPtr ReservedExportedNames; /// The number of entries contained in the FunctionTableEntries member. public uint ReservedNumberOfFunctionTableEntries; /// A pointer to the first function table entry. For more information, see IMAGE_FUNCTION_ENTRY. public IntPtr ReservedFunctionTableEntries; /// The lowest function table starting address. public uint ReservedLowestFunctionStartingAddress; /// The highest function table ending address. public uint ReservedHighestFunctionEndingAddress; /// The number of entries contained in the FpoTableEntries member. public uint ReservedNumberOfFpoTableEntries; /// A pointer to the first FPO entry. For more information, see FPO_DATA. public IntPtr ReservedFpoTableEntries; /// The size of the COFF symbol table, in bytes. public uint SizeOfCoffSymbols; /// A pointer to the COFF symbol table. public IntPtr CoffSymbols; /// The size of the CodeView symbol table, in bytes. public uint ReservedSizeOfCodeViewSymbols; /// A pointer to the beginning of the CodeView symbol table. public IntPtr ReservedCodeViewSymbols; /// The relative path to the image file name. [MarshalAs(UnmanagedType.LPStr)] public string ImageFilePath; /// The image file name. [MarshalAs(UnmanagedType.LPStr)] public string ImageFileName; /// The full path to the symbol file. [MarshalAs(UnmanagedType.LPStr)] public string ReservedDebugFilePath; /// The timestamp of the image. This represents the date and time the image was created by the linker. public uint ReservedTimeDateStamp; /// This value is TRUE if the image is a ROM image. [MarshalAs(UnmanagedType.Bool)] public bool ReservedRomImage; /// A pointer to the first debug directory. For more information, see IMAGE_DEBUG_DIRECTORY. public IntPtr ReservedDebugDirectory; /// The number of entries contained in the DebugDirectory member. public uint ReservedNumberOfDebugDirectories; /// The original function table base address. public uint ReservedOriginalFunctionTableBaseAddress; /// This member is reserved for use by the operating system. public ulong Reserved; } /// Contains information about a debugging event. // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_cba_event typedef struct _IMAGEHLP_CBA_EVENT { // DWORD severity; DWORD code; PCHAR desc; PVOID object; } IMAGEHLP_CBA_EVENT, *PIMAGEHLP_CBA_EVENT; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_CBA_EVENT")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct IMAGEHLP_CBA_EVENT { /// /// The event severity. This parameter can be one of the following values. /// /// /// Value /// Meaning /// /// /// sevInfo 0 /// Informational event. /// /// /// sevProblem 1 /// Reserved for future use. /// /// /// sevAttn 2 /// Reserved for future use. /// /// /// sevFatal 3 /// Reserved for future use. /// /// /// public EVENT_SEVERITY severity; /// This member is reserved for future use. public uint code; /// A text description of the error. [MarshalAs(UnmanagedType.LPTStr)] public string desc; /// This member is reserved for future use. public IntPtr @object; } /// Contains information about a memory read operation. // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_cba_read_memory typedef struct // _IMAGEHLP_CBA_READ_MEMORY { DWORD64 addr; PVOID buf; DWORD bytes; DWORD *bytesread; } IMAGEHLP_CBA_READ_MEMORY, *PIMAGEHLP_CBA_READ_MEMORY; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_CBA_READ_MEMORY")] [StructLayout(LayoutKind.Sequential)] public struct IMAGEHLP_CBA_READ_MEMORY { /// The address to be read. public ulong addr; /// A pointer to a buffer that receives the memory read. public IntPtr buf; /// The number of bytes to read. public uint bytes; /// A pointer to a variable that receives the number of bytes read. public IntPtr bytesread; } /// Contains information about a deferred symbol load. /// /// /// This structure supersedes the IMAGEHLP_DEFERRED_SYMBOL_LOAD structure. For more information, see Updated Platform /// Support. IMAGEHLP_DEFERRED_SYMBOL_LOAD is defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_DEFERRED_SYMBOL_LOAD IMAGEHLP_DEFERRED_SYMBOL_LOAD64 #define PIMAGEHLP_DEFERRED_SYMBOL_LOAD PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 #else typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD CheckSum; DWORD TimeDateStamp; CHAR FileName[MAX_PATH]; BOOLEAN Reparse; HANDLE hFile; } IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_deferred_symbol_load typedef struct // _IMAGEHLP_DEFERRED_SYMBOL_LOAD { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD CheckSum; DWORD TimeDateStamp; CHAR // FileName[MAX_PATH]; BOOLEAN Reparse; HANDLE hFile; } IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_DEFERRED_SYMBOL_LOAD")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)] public struct IMAGEHLP_DEFERRED_SYMBOL_LOAD { /// /// The size of the structure, in bytes. The caller must set this member to /// sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64) /// . /// public uint SizeOfStruct; /// The base virtual address where the image is loaded. public uint BaseOfImage; /// The computed checksum of the image. This value can be zero. public uint CheckSum; /// /// The date and timestamp value. The value is represented in the number of seconds elapsed since midnight (00:00:00), January /// 1, 1970, Universal Coordinated Time, according to the system clock. The timestamp can be printed using the C run-time (CRT) /// function ctime. /// public uint TimeDateStamp; /// The image name. The name may or may not contain a full path. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260 /*MAX_PATH*/)] public string FileName; /// If this member is TRUE, the operation should be performed again. Otherwise, it should not. [MarshalAs(UnmanagedType.U1)] public bool Reparse; /// /// A handle to a file. This member is used with CBA_DEFERRED_SYMBOL_LOAD_PARTIAL and /// IMAGEHLP_DEFERRED_SYMBOL_LOAD_FAILURE callbacks. /// public HFILE hFile; } /// Contains information about a deferred symbol load. /// /// /// This structure supersedes the IMAGEHLP_DEFERRED_SYMBOL_LOAD structure. For more information, see Updated Platform /// Support. IMAGEHLP_DEFERRED_SYMBOL_LOAD is defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_DEFERRED_SYMBOL_LOAD IMAGEHLP_DEFERRED_SYMBOL_LOAD64 #define PIMAGEHLP_DEFERRED_SYMBOL_LOAD PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 #else typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD CheckSum; DWORD TimeDateStamp; CHAR FileName[MAX_PATH]; BOOLEAN Reparse; HANDLE hFile; } IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_deferred_symbol_load64 typedef struct // _IMAGEHLP_DEFERRED_SYMBOL_LOAD64 { DWORD SizeOfStruct; DWORD64 BaseOfImage; DWORD CheckSum; DWORD TimeDateStamp; CHAR // FileName[MAX_PATH]; BOOLEAN Reparse; HANDLE hFile; DWORD Flags; } IMAGEHLP_DEFERRED_SYMBOL_LOAD64, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD64; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_DEFERRED_SYMBOL_LOAD64")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)] public struct IMAGEHLP_DEFERRED_SYMBOL_LOAD64 { /// /// The size of the structure, in bytes. The caller must set this member to /// sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64) /// . /// public uint SizeOfStruct; /// The base virtual address where the image is loaded. public ulong BaseOfImage; /// The computed checksum of the image. This value can be zero. public uint CheckSum; /// /// The date and timestamp value. The value is represented in the number of seconds elapsed since midnight (00:00:00), January /// 1, 1970, Universal Coordinated Time, according to the system clock. The timestamp can be printed using the C run-time (CRT) /// function ctime. /// public uint TimeDateStamp; /// The image name. The name may or may not contain a full path. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260 /*MAX_PATH*/)] public string FileName; /// If this member is TRUE, the operation should be performed again. Otherwise, it should not. [MarshalAs(UnmanagedType.U1)] public bool Reparse; /// /// A handle to a file. This member is used with CBA_DEFERRED_SYMBOL_LOAD_PARTIAL and /// IMAGEHLP_DEFERRED_SYMBOL_LOAD_FAILURE callbacks. /// public HFILE hFile; /// /// This member can be one of the following values. /// DSLFLAG_MISMATCHED_DBG (0x2) /// DSLFLAG_MISMATCHED_PDB (0x1) /// public DSLFLAG Flags; } /// Contains information about a deferred symbol load. /// /// /// This structure supersedes the IMAGEHLP_DEFERRED_SYMBOL_LOAD structure. For more information, see Updated Platform /// Support. IMAGEHLP_DEFERRED_SYMBOL_LOAD is defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_DEFERRED_SYMBOL_LOAD IMAGEHLP_DEFERRED_SYMBOL_LOAD64 #define PIMAGEHLP_DEFERRED_SYMBOL_LOAD PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 #else typedef struct _IMAGEHLP_DEFERRED_SYMBOL_LOAD { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD CheckSum; DWORD TimeDateStamp; CHAR FileName[MAX_PATH]; BOOLEAN Reparse; HANDLE hFile; } IMAGEHLP_DEFERRED_SYMBOL_LOAD, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_deferred_symbol_load64 typedef struct // _IMAGEHLP_DEFERRED_SYMBOL_LOAD64 { DWORD SizeOfStruct; DWORD64 BaseOfImage; DWORD CheckSum; DWORD TimeDateStamp; CHAR // FileName[MAX_PATH]; BOOLEAN Reparse; HANDLE hFile; DWORD Flags; } IMAGEHLP_DEFERRED_SYMBOL_LOAD64, *PIMAGEHLP_DEFERRED_SYMBOL_LOAD64; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_DEFERRED_SYMBOL_LOAD64")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] public struct IMAGEHLP_DEFERRED_SYMBOL_LOADW64 { /// /// The size of the structure, in bytes. The caller must set this member to /// sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64) /// . /// public uint SizeOfStruct; /// The base virtual address where the image is loaded. public ulong BaseOfImage; /// The computed checksum of the image. This value can be zero. public uint CheckSum; /// /// The date and timestamp value. The value is represented in the number of seconds elapsed since midnight (00:00:00), January /// 1, 1970, Universal Coordinated Time, according to the system clock. The timestamp can be printed using the C run-time (CRT) /// function ctime. /// public uint TimeDateStamp; /// The image name. The name may or may not contain a full path. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 261 /*MAX_PATH + 1*/)] public string FileName; /// If this member is TRUE, the operation should be performed again. Otherwise, it should not. [MarshalAs(UnmanagedType.U1)] public bool Reparse; /// /// A handle to a file. This member is used with CBA_DEFERRED_SYMBOL_LOAD_PARTIAL and /// IMAGEHLP_DEFERRED_SYMBOL_LOAD_FAILURE callbacks. /// public HFILE hFile; /// /// This member can be one of the following values. /// DSLFLAG_MISMATCHED_DBG (0x2) /// DSLFLAG_MISMATCHED_PDB (0x1) /// public DSLFLAG Flags; } /// Contains duplicate symbol information. /// /// /// This structure supersedes the IMAGEHLP_DUPLICATE_SYMBOL structure. For more information, see Updated Platform Support. /// IMAGEHLP_DUPLICATE_SYMBOL is defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_DUPLICATE_SYMBOL IMAGEHLP_DUPLICATE_SYMBOL64 #define PIMAGEHLP_DUPLICATE_SYMBOL PIMAGEHLP_DUPLICATE_SYMBOL64 #else typedef struct _IMAGEHLP_DUPLICATE_SYMBOL { DWORD SizeOfStruct; DWORD NumberOfDups; PIMAGEHLP_SYMBOL Symbol; DWORD SelectedSymbol; } IMAGEHLP_DUPLICATE_SYMBOL, *PIMAGEHLP_DUPLICATE_SYMBOL; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_duplicate_symbol64 typedef struct // _IMAGEHLP_DUPLICATE_SYMBOL64 { DWORD SizeOfStruct; DWORD NumberOfDups; PIMAGEHLP_SYMBOL64 Symbol; DWORD SelectedSymbol; } // IMAGEHLP_DUPLICATE_SYMBOL64, *PIMAGEHLP_DUPLICATE_SYMBOL64; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_DUPLICATE_SYMBOL64")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct IMAGEHLP_DUPLICATE_SYMBOL64 { /// /// The size of the structure, in bytes. The caller must set this member to /// sizeof(IMAGEHLP_DUPLICATE_SYMBOL64) /// . /// public uint SizeOfStruct; /// The number of duplicate symbols. public uint NumberOfDups; /// /// A pointer to an array of symbols ( IMAGEHLP_SYMBOL64 structures). The number of entries in the array is specified by the /// NumberOfDups member. /// public IntPtr Symbol; /// The index into the symbol array for the selected symbol. public uint SelectedSymbol; } /// Contains type information for a module. // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_get_type_info_params typedef struct // _IMAGEHLP_GET_TYPE_INFO_PARAMS { IN ULONG SizeOfStruct; IN ULONG Flags; IN ULONG NumIds; IN PULONG TypeIds; IN ULONG64 TagFilter; // IN ULONG NumReqs; IN IMAGEHLP_SYMBOL_TYPE_INFO *ReqKinds; IN PULONG_PTR ReqOffsets; IN PULONG ReqSizes; IN ULONG_PTR ReqStride; // IN ULONG_PTR BufferSize; OUT PVOID Buffer; OUT ULONG EntriesMatched; OUT ULONG EntriesFilled; OUT ULONG64 TagsFound; OUT ULONG64 // AllReqsValid; IN ULONG NumReqsValid; OUT PULONG64 ReqsValid; } IMAGEHLP_GET_TYPE_INFO_PARAMS, *PIMAGEHLP_GET_TYPE_INFO_PARAMS; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_GET_TYPE_INFO_PARAMS")] [StructLayout(LayoutKind.Sequential)] public struct IMAGEHLP_GET_TYPE_INFO_PARAMS { /// The size of this structure, in bytes. public uint SizeOfStruct; /// /// This member can be one of the following values. /// /// /// Value /// Meaning /// /// /// IMAGEHLP_GET_TYPE_INFO_CHILDREN 0x00000002 /// Retrieve information about the children of the specified types, not the types themselves. /// /// /// IMAGEHLP_GET_TYPE_INFO_UNCACHED 0x00000001 /// /// Do not cache the data for later retrievals. It is good to use this flag if you will not be requesting the information again. /// /// /// /// public uint Flags; /// The number of elements specified in the TypeIds array. public uint NumIds; /// An array of type indexes. public IntPtr TypeIds; /// /// The filter for return values. For example, set this member to 1 << SymTagData to return only results with a /// symbol tag of SymTagData. For a list of tags, see the SymTagEnum type defined in Dbghelp.h /// public ulong TagFilter; /// /// The number of elements specified in the arrays specified in the ReqKinds, ReqOffsets, and ReqSizes /// members. These arrays must be the same size. /// public uint NumReqs; /// /// An array of information types to be requested. Each element is one of the enumeration values in the /// IMAGEHLP_SYMBOL_TYPE_INFO enumeration type. /// public IntPtr ReqKinds; /// /// An array of offsets that specify where to store the data for each request within each element of Buffer array. /// public IntPtr ReqOffsets; /// The size of each data request, in bytes. The required sizes are described in IMAGEHLP_SYMBOL_TYPE_INFO. public IntPtr ReqSizes; /// The number of bytes for each element in the Buffer array. public IntPtr ReqStride; /// The size of the Buffer array, in bytes. public IntPtr BufferSize; /// /// An array of records used for storing query results. Each record is separated by ReqStride bytes. Each type for which /// data is to be retrieved requires one record in the array. Within each record, there are NumReqs pieces of data stored /// as the result of individual queries. The data is stored within the record according to the offsets specified in /// ReqOffsets. The format of the data depends on the value of the ReqKinds member in use. /// public IntPtr Buffer; /// The number of type entries that match the filter. public uint EntriesMatched; /// The number of elements in the Buffer array that received results. public uint EntriesFilled; /// A bitmask indicating all tag bits encountered during the search operation. public ulong TagsFound; /// A bitmask indicate the bit-wise AND of all ReqsValid fields. public ulong AllReqsValid; /// The size of ReqsValid, in elements. public uint NumReqsValid; /// /// A bitmask indexed by Buffer element index that indicates which request data is valid. This member can be NULL. /// public IntPtr ReqsValid; } /// Represents a source file line. /// /// /// This structure supersedes the IMAGEHLP_LINE structure. For more information, see Updated Platform Support. /// IMAGEHLP_LINE is defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_LINE IMAGEHLP_LINE64 #define PIMAGEHLP_LINE PIMAGEHLP_LINE64 #else typedef struct _IMAGEHLP_LINE { DWORD SizeOfStruct; PVOID Key; DWORD LineNumber; PCHAR FileName; DWORD Address; } IMAGEHLP_LINE, *PIMAGEHLP_LINE; typedef struct _IMAGEHLP_LINEW { DWORD SizeOfStruct; PVOID Key; DWORD LineNumber; PCHAR FileName; DWORD64 Address; } IMAGEHLP_LINEW, *PIMAGEHLP_LINEW; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_line typedef struct _IMAGEHLP_LINE { DWORD // SizeOfStruct; PVOID Key; DWORD LineNumber; PCHAR FileName; DWORD Address; } IMAGEHLP_LINE, *PIMAGEHLP_LINE; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_LINE")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct IMAGEHLP_LINE { /// /// The size of the structure, in bytes. The caller must set this member to /// sizeof(IMAGEHLP_LINE64) /// . /// public uint SizeOfStruct; /// This member is reserved for use by the operating system. public IntPtr Key; /// The line number in the file. public uint LineNumber; /// The name of the file, including the full path. [MarshalAs(UnmanagedType.LPTStr)] public string FileName; /// The address of the first instruction in the line. public uint Address; } /// Represents a source file line. /// /// /// This structure supersedes the IMAGEHLP_LINE structure. For more information, see Updated Platform Support. /// IMAGEHLP_LINE is defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_LINE IMAGEHLP_LINE64 #define PIMAGEHLP_LINE PIMAGEHLP_LINE64 #else typedef struct _IMAGEHLP_LINE { DWORD SizeOfStruct; PVOID Key; DWORD LineNumber; PCHAR FileName; DWORD Address; } IMAGEHLP_LINE, *PIMAGEHLP_LINE; typedef struct _IMAGEHLP_LINEW { DWORD SizeOfStruct; PVOID Key; DWORD LineNumber; PCHAR FileName; DWORD64 Address; } IMAGEHLP_LINEW, *PIMAGEHLP_LINEW; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_line64 typedef struct _IMAGEHLP_LINE64 { DWORD // SizeOfStruct; PVOID Key; DWORD LineNumber; PCHAR FileName; DWORD64 Address; } IMAGEHLP_LINE64, *PIMAGEHLP_LINE64; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_LINE64")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct IMAGEHLP_LINE64 { /// /// The size of the structure, in bytes. The caller must set this member to /// sizeof(IMAGEHLP_LINE64) /// . /// public uint SizeOfStruct; /// This member is reserved for use by the operating system. public IntPtr Key; /// The line number in the file. public uint LineNumber; /// The name of the file, including the full path. [MarshalAs(UnmanagedType.LPTStr)] public string FileName; /// The address of the first instruction in the line. public ulong Address; } /// Contains module information. /// /// /// This structure supersedes the IMAGEHLP_MODULE structure. For more information, see Updated Platform Support. /// IMAGEHLP_MODULE is defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_MODULE IMAGEHLP_MODULE64 #define PIMAGEHLP_MODULE PIMAGEHLP_MODULE64 #define IMAGEHLP_MODULEW IMAGEHLP_MODULEW64 #define PIMAGEHLP_MODULEW PIMAGEHLP_MODULEW64 #else typedef struct _IMAGEHLP_MODULE { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD ImageSize; DWORD TimeDateStamp; DWORD CheckSum; DWORD NumSyms; SYM_TYPE SymType; CHAR ModuleName[32]; CHAR ImageName[256]; CHAR LoadedImageName[256]; } IMAGEHLP_MODULE, *PIMAGEHLP_MODULE; typedef struct _IMAGEHLP_MODULEW { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD ImageSize; DWORD TimeDateStamp; DWORD CheckSum; DWORD NumSyms; SYM_TYPE SymType; WCHAR ModuleName[32]; WCHAR ImageName[256]; WCHAR LoadedImageName[256]; } IMAGEHLP_MODULEW, *PIMAGEHLP_MODULEW; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_module typedef struct _IMAGEHLP_MODULE { DWORD // SizeOfStruct; DWORD BaseOfImage; DWORD ImageSize; DWORD TimeDateStamp; DWORD CheckSum; DWORD NumSyms; SYM_TYPE SymType; CHAR // ModuleName[32]; CHAR ImageName[256]; CHAR LoadedImageName[256]; } IMAGEHLP_MODULE, *PIMAGEHLP_MODULE; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_MODULE")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct IMAGEHLP_MODULE { /// /// The size of the structure, in bytes. The caller must set this member to /// sizeof(IMAGEHLP_MODULE64) /// . /// public uint SizeOfStruct; /// The base virtual address where the image is loaded. public uint BaseOfImage; /// The size of the image, in bytes. public uint ImageSize; /// /// The date and timestamp value. The value is represented in the number of seconds elapsed since midnight (00:00:00), January /// 1, 1970, Universal Coordinated Time, according to the system clock. The timestamp can be printed using the C run-time (CRT) /// function ctime. /// public uint TimeDateStamp; /// The checksum of the image. This value can be zero. public uint CheckSum; /// /// The number of symbols in the symbol table. The value of this parameter is not meaningful when SymPdb is specified as /// the value of the SymType parameter. /// public uint NumSyms; /// /// The type of symbols that are loaded. This member can be one of the following values. /// /// /// Value /// Meaning /// /// /// SymCoff /// COFF symbols. /// /// /// SymCv /// CodeView symbols. /// /// /// SymDeferred /// Symbol loading deferred. /// /// /// SymDia /// DIA symbols. /// /// /// SymExport /// Symbols generated from a DLL export table. /// /// /// SymNone /// No symbols are loaded. /// /// /// SymPdb /// PDB symbols. /// /// /// SymSym /// .sym file. /// /// /// SymVirtual /// The virtual module created by SymLoadModuleEx with SLMFLAG_VIRTUAL. /// /// /// public SYM_TYPE SymType; /// The module name. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 32)] public string ModuleName; /// The image name. The name may or may not contain a full path. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)] public string ImageName; /// The full path and file name of the file from which symbols were loaded. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)] public string LoadedImageName; } /// Contains module information. /// /// /// This structure supersedes the IMAGEHLP_MODULE structure. For more information, see Updated Platform Support. /// IMAGEHLP_MODULE is defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_MODULE IMAGEHLP_MODULE64 #define PIMAGEHLP_MODULE PIMAGEHLP_MODULE64 #define IMAGEHLP_MODULEW IMAGEHLP_MODULEW64 #define PIMAGEHLP_MODULEW PIMAGEHLP_MODULEW64 #else typedef struct _IMAGEHLP_MODULE { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD ImageSize; DWORD TimeDateStamp; DWORD CheckSum; DWORD NumSyms; SYM_TYPE SymType; CHAR ModuleName[32]; CHAR ImageName[256]; CHAR LoadedImageName[256]; } IMAGEHLP_MODULE, *PIMAGEHLP_MODULE; typedef struct _IMAGEHLP_MODULEW { DWORD SizeOfStruct; DWORD BaseOfImage; DWORD ImageSize; DWORD TimeDateStamp; DWORD CheckSum; DWORD NumSyms; SYM_TYPE SymType; WCHAR ModuleName[32]; WCHAR ImageName[256]; WCHAR LoadedImageName[256]; } IMAGEHLP_MODULEW, *PIMAGEHLP_MODULEW; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_module64 typedef struct _IMAGEHLP_MODULE64 { DWORD // SizeOfStruct; DWORD64 BaseOfImage; DWORD ImageSize; DWORD TimeDateStamp; DWORD CheckSum; DWORD NumSyms; SYM_TYPE SymType; CHAR // ModuleName[32]; CHAR ImageName[256]; CHAR LoadedImageName[256]; CHAR LoadedPdbName[256]; DWORD CVSig; CHAR *CVData[MAX_PATH 3]; // DWORD PdbSig; GUID PdbSig70; DWORD PdbAge; BOOL PdbUnmatched; BOOL DbgUnmatched; BOOL LineNumbers; BOOL GlobalSymbols; BOOL // TypeInfo; BOOL SourceIndexed; BOOL Publics; DWORD MachineType; DWORD Reserved; } IMAGEHLP_MODULE64, *PIMAGEHLP_MODULE64; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_MODULE64")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct IMAGEHLP_MODULE64 { /// /// The size of the structure, in bytes. The caller must set this member to /// sizeof(IMAGEHLP_MODULE64) /// . /// public uint SizeOfStruct; /// The base virtual address where the image is loaded. public ulong BaseOfImage; /// The size of the image, in bytes. public uint ImageSize; /// /// The date and timestamp value. The value is represented in the number of seconds elapsed since midnight (00:00:00), January /// 1, 1970, Universal Coordinated Time, according to the system clock. The timestamp can be printed using the C run-time (CRT) /// function ctime. /// public uint TimeDateStamp; /// The checksum of the image. This value can be zero. public uint CheckSum; /// /// The number of symbols in the symbol table. The value of this parameter is not meaningful when SymPdb is specified as /// the value of the SymType parameter. /// public uint NumSyms; /// /// The type of symbols that are loaded. This member can be one of the following values. /// /// /// Value /// Meaning /// /// /// SymCoff /// COFF symbols. /// /// /// SymCv /// CodeView symbols. /// /// /// SymDeferred /// Symbol loading deferred. /// /// /// SymDia /// DIA symbols. /// /// /// SymExport /// Symbols generated from a DLL export table. /// /// /// SymNone /// No symbols are loaded. /// /// /// SymPdb /// PDB symbols. /// /// /// SymSym /// .sym file. /// /// /// SymVirtual /// The virtual module created by SymLoadModuleEx with SLMFLAG_VIRTUAL. /// /// /// public SYM_TYPE SymType; /// The module name. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 32)] public string ModuleName; /// The image name. The name may or may not contain a full path. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)] public string ImageName; /// The full path and file name of the file from which symbols were loaded. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)] public string LoadedImageName; /// The full path and file name of the .pdb file. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)] public string LoadedPdbName; /// The signature of the CV record in the debug directories. public uint CVSig; /// The contents of the CV record. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260 * 3)] public string CVData; /// The PDB signature. public uint PdbSig; /// The PDB signature (Visual C/C++ 7.0 and later) public Guid PdbSig70; /// The DBI age of PDB. public uint PdbAge; /// A value that indicates whether the loaded PDB is unmatched. [MarshalAs(UnmanagedType.Bool)] public bool PdbUnmatched; /// A value that indicates whether the loaded DBG is unmatched. [MarshalAs(UnmanagedType.Bool)] public bool DbgUnmatched; /// A value that indicates whether line number information is available. [MarshalAs(UnmanagedType.Bool)] public bool LineNumbers; /// A value that indicates whether symbol information is available. [MarshalAs(UnmanagedType.Bool)] public bool GlobalSymbols; /// A value that indicates whether type information is available. [MarshalAs(UnmanagedType.Bool)] public bool TypeInfo; /// /// A value that indicates whether the .pdb supports the source server. /// DbgHelp 6.1 and earlier: This member is not supported. /// [MarshalAs(UnmanagedType.Bool)] public bool SourceIndexed; /// /// A value that indicates whether the module contains public symbols. /// DbgHelp 6.1 and earlier: This member is not supported. /// [MarshalAs(UnmanagedType.Bool)] public bool Publics; /// public uint MachineType; /// public uint Reserved; } /// Contains the stack frame information. This structure is used with the SymSetContext function. // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_stack_frame typedef struct _IMAGEHLP_STACK_FRAME { // ULONG64 InstructionOffset; ULONG64 ReturnOffset; ULONG64 FrameOffset; ULONG64 StackOffset; ULONG64 BackingStoreOffset; ULONG64 // FuncTableEntry; ULONG64 Params[4]; ULONG64 Reserved[5]; BOOL Virtual; ULONG Reserved2; } IMAGEHLP_STACK_FRAME, *PIMAGEHLP_STACK_FRAME; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_STACK_FRAME")] [StructLayout(LayoutKind.Sequential)] public struct IMAGEHLP_STACK_FRAME { /// /// The program counter. /// x86: The program counter is EIP. /// /// Intel Itanium: The program counter is a combination of the bundle address and a slot indicator of 0, 4, or 8 for the /// slot within the bundle. /// /// x64: The program counter is RIP. /// public ulong InstructionOffset; /// The return address. public ulong ReturnOffset; /// /// The frame pointer. /// x86: The frame pointer is EBP. /// Intel Itanium: There is no frame pointer, but AddrBStore is used. /// x64: The frame pointer is RBP. AMD-64 does not always use this value. /// public ulong FrameOffset; /// /// The stack pointer. /// x86: The stack pointer is ESP. /// Intel Itanium: The stack pointer is SP. /// x64: The stack pointer is RSP. /// public ulong StackOffset; /// Intel Itanium: The backing store address. public ulong BackingStoreOffset; /// x86: An FPO_DATA structure. If there is no function table entry, this member is NULL. public ulong FuncTableEntry; /// The possible arguments to the function. [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] public ulong[] Params; /// This member is reserved for system use. [MarshalAs(UnmanagedType.ByValArray, SizeConst = 5)] public ulong[] Reserved; /// If this is a virtual frame, this member is TRUE. Otherwise, this member is FALSE. [MarshalAs(UnmanagedType.Bool)] public bool Virtual; /// This member is reserved for system use. public uint Reserved2; } /// Contains symbol information. /// /// /// This structure supersedes the IMAGEHLP_SYMBOL structure. For more information, see Updated Platform Support. /// IMAGEHLP_SYMBOL is defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64 #define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64 #else typedef struct _IMAGEHLP_SYMBOL { DWORD SizeOfStruct; DWORD Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_symbol typedef struct _IMAGEHLP_SYMBOL { DWORD // SizeOfStruct; DWORD Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_SYMBOL")] [VanaraMarshaler(typeof(SafeAnysizeStringMarshaler), "Ansi")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)] public struct IMAGEHLP_SYMBOL { /// The size of the structure, in bytes. The caller must set this member to sizeof(IMAGEHLP_SYMBOL). public uint SizeOfStruct; /// The virtual address for the symbol. public uint Address; /// The size of the symbol, in bytes. This value is a best guess and can be zero. public uint Size; /// This member is reserved for use by the operating system. public uint Flags; /// /// The maximum length of the string that the Name member can contain, in characters, not including the null-terminating /// character. Because symbol names can vary in length, this data structure is allocated by the caller. This member is used so /// the library knows how much memory is available for use by the symbol name. /// public uint MaxNameLength; /// /// The decorated or undecorated symbol name. If the buffer is not large enough for the complete name, it is truncated to /// MaxNameLength characters, including the null-terminating character. /// [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)] public string Name; } /// /// A marshaler implementation of that pulls a full string from a structure with a last field having /// one character. /// /// The structure type to be marshaled. /// public class SafeAnysizeStringMarshaler : IVanaraMarshaler { private static readonly Type structType; private static readonly System.Reflection.FieldInfo fiStr; private CharSet charSet; static SafeAnysizeStringMarshaler() { structType = typeof(T); if (!structType.IsLayoutSequential) throw new InvalidOperationException("This class can only manange sequential layout structures."); fiStr = structType.GetOrderedFields().Last(); if (fiStr.FieldType != typeof(string)) throw new ArgumentException("The last field must be a string."); } /// Initializes a new instance of the class. /// /// The name of the field in that specifies the string length of the last field of . /// public SafeAnysizeStringMarshaler(string cookie) { charSet = (CharSet)Enum.Parse(typeof(CharSet), cookie); } /// Gets the size of the native data. /// /// The size, in bytes, of the base object in memory. This should return the equivalent of the sizeof(X) function in C/C++. /// public SizeT GetNativeSize() => Marshal.SizeOf(structType); SafeAllocatedMemoryHandle IVanaraMarshaler.MarshalManagedToNative(object managedObject) { // Get structure information if (managedObject is null) return SafeHGlobalHandle.Null; if (!(managedObject is T value)) throw new ArgumentException($"{nameof(managedObject)} must be an instance of {structType.Name}."); // Get the current value for the last field (or create one if needed) var strVal = fiStr.GetValue(value) as string ?? string.Empty; // Determine mem required for current struct and last field value var chSz = StringHelper.GetCharSize(charSet); var memSz = GetNativeSize() + chSz * strVal.Length; // Set structure into allocated mem var ret = new SafeHGlobalHandle(memSz); ret.Write(value); // Set string into mem StringHelper.Write(strVal, ret, out _, true, charSet, chSz * (strVal.Length + 1)); return ret; } object IVanaraMarshaler.MarshalNativeToManaged(IntPtr pNativeData, SizeT allocatedBytes) { if (pNativeData == IntPtr.Zero) return null; // Move structure and assign string var value = (T)Marshal.PtrToStructure(pNativeData, typeof(T)); var strVal = StringHelper.GetString(pNativeData.Offset(Marshal.OffsetOf(typeof(T), fiStr.Name).ToInt32()), charSet); fiStr.SetValueDirect(__makeref(value), strVal); return value; } } /// Contains symbol information. /// /// /// This structure supersedes the IMAGEHLP_SYMBOL structure. For more information, see Updated Platform Support. /// IMAGEHLP_SYMBOL is defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64 #define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64 #else typedef struct _IMAGEHLP_SYMBOL { DWORD SizeOfStruct; DWORD Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_symbol64 typedef struct _IMAGEHLP_SYMBOL64 { DWORD // SizeOfStruct; DWORD64 Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL64, *PIMAGEHLP_SYMBOL64; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_SYMBOL64")] [VanaraMarshaler(typeof(SafeAnysizeStringMarshaler), "Ansi")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)] public struct IMAGEHLP_SYMBOL64 { /// The size of the structure, in bytes. The caller must set this member to sizeof(IMAGEHLP_SYMBOL64). public uint SizeOfStruct; /// The virtual address for the symbol. public ulong Address; /// The size of the symbol, in bytes. This value is a best guess and can be zero. public uint Size; /// This member is reserved for use by the operating system. public uint Flags; /// /// The maximum length of the string that the Name member can contain, in characters, not including the null-terminating /// character. Because symbol names can vary in length, this data structure is allocated by the caller. This member is used so /// the library knows how much memory is available for use by the symbol name. /// public uint MaxNameLength; /// /// The decorated or undecorated symbol name. If the buffer is not large enough for the complete name, it is truncated to /// MaxNameLength characters, including the null-terminating character. /// [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)] public string Name; } /// Contains symbol information. /// /// /// This structure supersedes the IMAGEHLP_SYMBOL structure. For more information, see Updated Platform Support. /// IMAGEHLP_SYMBOL is defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64 #define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64 #else typedef struct _IMAGEHLP_SYMBOL { DWORD SizeOfStruct; DWORD Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_symbol typedef struct _IMAGEHLP_SYMBOL { DWORD // SizeOfStruct; DWORD Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_SYMBOL")] [VanaraMarshaler(typeof(SafeAnysizeStringMarshaler), "Unicode")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] public struct IMAGEHLP_SYMBOLW { /// The size of the structure, in bytes. The caller must set this member to sizeof(IMAGEHLP_SYMBOLW). public uint SizeOfStruct; /// The virtual address for the symbol. public uint Address; /// The size of the symbol, in bytes. This value is a best guess and can be zero. public uint Size; /// This member is reserved for use by the operating system. public uint Flags; /// /// The maximum length of the string that the Name member can contain, in characters, not including the null-terminating /// character. Because symbol names can vary in length, this data structure is allocated by the caller. This member is used so /// the library knows how much memory is available for use by the symbol name. /// public uint MaxNameLength; /// /// The decorated or undecorated symbol name. If the buffer is not large enough for the complete name, it is truncated to /// MaxNameLength characters, including the null-terminating character. /// [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)] public string Name; } /// Contains symbol information. /// /// /// This structure supersedes the IMAGEHLP_SYMBOL structure. For more information, see Updated Platform Support. /// IMAGEHLP_SYMBOL is defined as follows in DbgHelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64 #define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64 #else typedef struct _IMAGEHLP_SYMBOL { DWORD SizeOfStruct; DWORD Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; CHAR Name[1]; } IMAGEHLP_SYMBOL, *PIMAGEHLP_SYMBOL; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-imagehlp_symbolw64 typedef struct _IMAGEHLP_SYMBOLW64 { // DWORD SizeOfStruct; DWORD64 Address; DWORD Size; DWORD Flags; DWORD MaxNameLength; WCHAR Name[1]; } IMAGEHLP_SYMBOLW64, *PIMAGEHLP_SYMBOLW64; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._IMAGEHLP_SYMBOLW64")] [VanaraMarshaler(typeof(SafeAnysizeStringMarshaler), "Unicode")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] public struct IMAGEHLP_SYMBOLW64 { /// The size of the structure, in bytes. The caller must set this member to sizeof(IMAGEHLP_SYMBOLW64). public uint SizeOfStruct; /// The virtual address for the symbol. public ulong Address; /// The size of the symbol, in bytes. This value is a best guess and can be zero. public uint Size; /// This member is reserved for use by the operating system. public uint Flags; /// /// The maximum length of the string that the Name member can contain, in characters, not including the null-terminating /// character. Because symbol names can vary in length, this data structure is allocated by the caller. This member is used so /// the library knows how much memory is available for use by the symbol name. /// public uint MaxNameLength; /// /// The decorated or undecorated symbol name. If the buffer is not large enough for the complete name, it is truncated to /// MaxNameLength characters, including the null-terminating character. /// [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)] public string Name; } /// Information that is used by kernel debuggers to trace through user-mode callbacks in a thread's kernel stack. /// /// /// This structure supersedes the KDHELP structure. For more information, see Updated Platform Support. KDHELP is /// defined as follows in Dbghelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define KDHELP KDHELP64 #define PKDHELP PKDHELP64 #else typedef struct _KDHELP { DWORD Thread; DWORD ThCallbackStack; DWORD NextCallback; DWORD FramePointer; DWORD KiCallUserMode; DWORD KeUserCallbackDispatcher; DWORD SystemRangeStart; DWORD ThCallbackBStore; DWORD KiUserExceptionDispatcher; DWORD StackBase; DWORD StackLimit; DWORD Reserved[5]; } KDHELP, *PKDHELP; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-kdhelp typedef struct _KDHELP { DWORD Thread; DWORD // ThCallbackStack; DWORD NextCallback; DWORD FramePointer; DWORD KiCallUserMode; DWORD KeUserCallbackDispatcher; DWORD // SystemRangeStart; DWORD ThCallbackBStore; DWORD KiUserExceptionDispatcher; DWORD StackBase; DWORD StackLimit; DWORD Reserved[5]; // } KDHELP, *PKDHELP; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._KDHELP")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct KDHELP { /// The address of the kernel thread object, as provided in the WAIT_STATE_CHANGE packet. public uint Thread; /// The offset in the thread object to the pointer to the current callback frame in the kernel stack. public uint ThCallbackStack; /// The address of the next callback frame. public uint NextCallback; /// The address of the saved frame pointer, if applicable. public uint FramePointer; /// The address of the kernel function that calls out to user mode. public uint KiCallUserMode; /// The address of the user-mode dispatcher function. public uint KeUserCallbackDispatcher; /// The lowest kernel-mode address. public uint SystemRangeStart; /// /// Intel Itanium: The offset in the thread object to a pointer to the current callback backing store frame in the kernel stack. /// public uint ThCallbackBStore; /// /// The address of the user-mode exception dispatcher function. /// DbgHelp 6.1 and earlier: This member is not supported. /// public uint KiUserExceptionDispatcher; /// The address of the stack base. public uint StackBase; /// The stack limit. public uint StackLimit; /// This member is reserved for use by the operating system. private uint Reserved0; private uint Reserved1; private uint Reserved2; private uint Reserved3; private uint Reserved4; } /// Information that is used by kernel debuggers to trace through user-mode callbacks in a thread's kernel stack. /// /// /// This structure supersedes the KDHELP structure. For more information, see Updated Platform Support. KDHELP is /// defined as follows in Dbghelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define KDHELP KDHELP64 #define PKDHELP PKDHELP64 #else typedef struct _KDHELP { DWORD Thread; DWORD ThCallbackStack; DWORD NextCallback; DWORD FramePointer; DWORD KiCallUserMode; DWORD KeUserCallbackDispatcher; DWORD SystemRangeStart; DWORD ThCallbackBStore; DWORD KiUserExceptionDispatcher; DWORD StackBase; DWORD StackLimit; DWORD Reserved[5]; } KDHELP, *PKDHELP; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-kdhelp typedef struct _KDHELP { DWORD Thread; DWORD // ThCallbackStack; DWORD NextCallback; DWORD FramePointer; DWORD KiCallUserMode; DWORD KeUserCallbackDispatcher; DWORD // SystemRangeStart; DWORD ThCallbackBStore; DWORD KiUserExceptionDispatcher; DWORD StackBase; DWORD StackLimit; DWORD Reserved[5]; // } KDHELP, *PKDHELP; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._KDHELP")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct KDHELP64 { /// The address of the kernel thread object, as provided in the WAIT_STATE_CHANGE packet. public ulong Thread; /// The offset in the thread object to the pointer to the current callback frame in the kernel stack. public uint ThCallbackStack; /// /// Intel Itanium: The offset in the thread object to a pointer to the current callback backing store frame in the kernel stack. /// public uint ThCallbackBStore; /// The address of the next callback frame. public uint NextCallback; /// The address of the saved frame pointer, if applicable. public uint FramePointer; /// The address of the kernel function that calls out to user mode. public ulong KiCallUserMode; /// The address of the user-mode dispatcher function. public ulong KeUserCallbackDispatcher; /// The lowest kernel-mode address. public ulong SystemRangeStart; /// /// The address of the user-mode exception dispatcher function. /// DbgHelp 6.1 and earlier: This member is not supported. /// public ulong KiUserExceptionDispatcher; /// The address of the stack base. public ulong StackBase; /// The stack limit. public ulong StackLimit; /// Target OS build number. public uint BuildVersion; /// public uint RetpolineStubFunctionTableSize; /// public ulong RetpolineStubFunctionTable; /// public uint RetpolineStubOffset; /// public uint RetpolineStubSize; /// This member is reserved for use by the operating system. private ulong Reserved0; private ulong Reserved1; } /// Contains information about the loaded image. /// /// The LIST_ENTRY structure is defined as follows: /// /// typedef struct _LIST_ENTRY { struct _LIST_ENTRY *Flink; struct _LIST_ENTRY *Blink; } LIST_ENTRY, *PLIST_ENTRY, *RESTRICTED_POINTER PRLIST_ENTRY; /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-loaded_image typedef struct _LOADED_IMAGE { PSTR // ModuleName; HANDLE hFile; PUCHAR MappedAddress; #if ... PIMAGE_NT_HEADERS64 FileHeader; #else PIMAGE_NT_HEADERS32 FileHeader; // #endif PIMAGE_SECTION_HEADER LastRvaSection; ULONG NumberOfSections; PIMAGE_SECTION_HEADER Sections; ULONG Characteristics; // BOOLEAN fSystemImage; BOOLEAN fDOSImage; BOOLEAN fReadOnly; UCHAR Version; LIST_ENTRY Links; ULONG SizeOfImage; } LOADED_IMAGE, *PLOADED_IMAGE; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._LOADED_IMAGE")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Ansi)] public struct LOADED_IMAGE { /// The file name of the mapped file. [MarshalAs(UnmanagedType.LPStr)] public string ModuleName; /// A handle to the mapped file. public HFILE hFile; /// The base address of the mapped file. public IntPtr MappedAddress; /// A pointer to an structure. public IntPtr FileHeader; /// A pointer to an structure. public IntPtr LastRvaSection; /// The number of COFF section headers. public uint NumberOfSections; /// A pointer to an IMAGE_SECTION_HEADER structure. public IntPtr Sections; /// /// The image characteristics value. This member can be one of the following values. /// /// /// Value /// Meaning /// /// /// IMAGE_FILE_RELOCS_STRIPPED 0x0001 /// Relocation information is stripped from the file. /// /// /// IMAGE_FILE_EXECUTABLE_IMAGE 0x0002 /// The file is executable (there are no unresolved external references). /// /// /// IMAGE_FILE_LINE_NUMS_STRIPPED 0x0004 /// Line numbers are stripped from the file. /// /// /// IMAGE_FILE_LOCAL_SYMS_STRIPPED 0x0008 /// Local symbols are stripped from file. /// /// /// IMAGE_FILE_AGGRESIVE_WS_TRIM 0x0010 /// Aggressively trim the working set. /// /// /// IMAGE_FILE_LARGE_ADDRESS_AWARE 0x0020 /// The application can handle addresses larger than 2 GB. /// /// /// IMAGE_FILE_BYTES_REVERSED_LO 0x0080 /// Bytes of word are reversed. /// /// /// IMAGE_FILE_32BIT_MACHINE 0x0100 /// Computer supports 32-bit words. /// /// /// IMAGE_FILE_DEBUG_STRIPPED 0x0200 /// Debugging information is stored separately in a .dbg file. /// /// /// IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP 0x0400 /// If the image is on removable media, copy and run from the swap file. /// /// /// IMAGE_FILE_NET_RUN_FROM_SWAP 0x0800 /// If the image is on the network, copy and run from the swap file. /// /// /// IMAGE_FILE_SYSTEM 0x1000 /// System file. /// /// /// IMAGE_FILE_DLL 0x2000 /// DLL file. /// /// /// IMAGE_FILE_UP_SYSTEM_ONLY 0x4000 /// File should be run only on a uniprocessor computer. /// /// /// IMAGE_FILE_BYTES_REVERSED_HI 0x8000 /// Bytes of the word are reversed. /// /// /// public IMAGE_FILE Characteristics; /// If the image is a kernel mode executable image, this value is TRUE. [MarshalAs(UnmanagedType.U1)] public bool fSystemImage; /// If the image is a 16-bit executable image, this value is TRUE. [MarshalAs(UnmanagedType.U1)] public bool fDOSImage; /// /// If the image is read-only, this value is TRUE. /// Prior to Windows Vista: This member is not included in the structure. /// [MarshalAs(UnmanagedType.U1)] public bool fReadOnly; /// /// The version string. /// Prior to Windows Vista: This member is not included in the structure. /// public byte Version; /// The list of loaded images. public LIST_ENTRY Links; /// The size of the image, in bytes. public uint SizeOfImage; } /// Contains CodeView and Misc records. // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-modload_cvmisc typedef struct _MODLOAD_CVMISC { DWORD oCV; // size_t cCV; DWORD oMisc; size_t cMisc; DWORD dtImage; DWORD cImage; } MODLOAD_CVMISC, *PMODLOAD_CVMISC; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._MODLOAD_CVMISC")] [StructLayout(LayoutKind.Sequential)] public struct MODLOAD_CVMISC { /// The offset of the CodeView record. public uint oCV; /// The size of the CodeView record. public SizeT cCV; /// The offset of the Misc record. public uint oMisc; /// The size of the Misc record. public SizeT cMisc; /// The date/time stamp of the image. public uint dtImage; /// The size of the image. public uint cImage; } /// Contains module data. // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-modload_data typedef struct _MODLOAD_DATA { DWORD ssize; // DWORD ssig; PVOID data; DWORD size; DWORD flags; } MODLOAD_DATA, *PMODLOAD_DATA; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._MODLOAD_DATA")] [StructLayout(LayoutKind.Sequential)] public struct MODLOAD_DATA { /// The size of this structure, in bytes. public uint ssize; /// /// The type of data. This member can be one of the following values. /// /// /// Value /// Meaning /// /// /// DBHHEADER_DEBUGDIRS 0x1 /// The data member is a buffer that contains an array of IMAGE_DEBUG_DIRECTORY structures. /// /// /// DBHHEADER_CVMISC 0x2 /// The data member is a buffer that contains an array of MODLOAD_CVMISC structures. /// /// /// public uint ssig; /// The data. The format of this data depends on the value of the ssig member. public IntPtr data; /// The size of the data buffer, in bytes. public uint size; /// This member is unused. public uint flags; } /// Describes an entry in an address map. /// /// /// An address map provides a translation from one image layout (A) to another (B). An array of OMAP structures, sorted by /// rva, defines an address map. /// /// To translate an address, addrA, in image A to an address, addrB, in image B, perform the following steps: /// /// /// Search the map for the entry, e, with the largest rva less than or equal to addrA. /// /// /// Set delta = addrA – e.rva. /// /// /// Set addrB = e.rvaTo + delta. /// /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-omap typedef struct _OMAP { ULONG rva; ULONG rvaTo; } OMAP, *POMAP; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._OMAP")] [StructLayout(LayoutKind.Sequential)] public struct OMAP { /// A relative virtual address (RVA) in image A. public uint rva; /// The relative virtual address that rva is mapped to in image B. public uint rvaTo; } /// Contains source file information. // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-sourcefile typedef struct _SOURCEFILE { DWORD64 ModBase; // PCHAR FileName; } SOURCEFILE, *PSOURCEFILE; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._SOURCEFILE")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct SOURCEFILE { /// The base address of the module. public ulong ModBase; /// The fully qualified source file name. [MarshalAs(UnmanagedType.LPTStr)] public string FileName; } /// Contains line information. // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-srccodeinfo typedef struct _SRCCODEINFO { DWORD // SizeOfStruct; PVOID Key; DWORD64 ModBase; CHAR Obj[MAX_PATH + 1]; CHAR FileName[MAX_PATH + 1]; DWORD LineNumber; DWORD64 Address; // } SRCCODEINFO, *PSRCCODEINFO; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._SRCCODEINFO")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct SRCCODEINFO { /// The size of the structure, in bytes. public uint SizeOfStruct; /// This member is not used. public IntPtr Key; /// The base address of the module that contains the line. public ulong ModBase; /// The name of the object file within the module that contains the line. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 261 /*MAX_PATH + 1*/)] public string Obj; /// The fully qualified source file name. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 261 /*MAX_PATH + 1*/)] public string FileName; /// The line number within the source file. public uint LineNumber; /// The virtual address of the first instruction of the line. public ulong Address; } /// Represents a stack frame. /// /// /// This structure supersedes the STACKFRAME structure. For more information, see Updated Platform Support. STACKFRAME /// is defined as follows in Dbghelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define STACKFRAME STACKFRAME64 #define LPSTACKFRAME LPSTACKFRAME64 #else typedef struct _tagSTACKFRAME { ADDRESS AddrPC; ADDRESS AddrReturn; ADDRESS AddrFrame; ADDRESS AddrStack; PVOID FuncTableEntry; DWORD Params[4]; BOOL Far; BOOL Virtual; DWORD Reserved[3]; KDHELP KdHelp; ADDRESS AddrBStore; } STACKFRAME, *LPSTACKFRAME; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-stackframe64 typedef struct _tagSTACKFRAME64 { ADDRESS64 // AddrPC; ADDRESS64 AddrReturn; ADDRESS64 AddrFrame; ADDRESS64 AddrStack; ADDRESS64 AddrBStore; PVOID FuncTableEntry; DWORD64 // Params[4]; BOOL Far; BOOL Virtual; DWORD64 Reserved[3]; KDHELP64 KdHelp; } STACKFRAME64, *LPSTACKFRAME64; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._tagSTACKFRAME64")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct STACKFRAME { /// /// An ADDRESS64 structure that specifies the program counter. /// x86: The program counter is EIP. /// Intel Itanium: The program counter is StIIP. /// x64: The program counter is RIP. /// public ADDRESS AddrPC; /// An ADDRESS64 structure that specifies the return address. public ADDRESS AddrReturn; /// /// An ADDRESS64 structure that specifies the frame pointer. /// x86: The frame pointer is EBP. /// Intel Itanium: There is no frame pointer, but AddrBStore is used. /// x64: The frame pointer is RBP or RDI. This value is not always used. /// public ADDRESS AddrFrame; /// /// An ADDRESS64 structure that specifies the stack pointer. /// x86: The stack pointer is ESP. /// Intel Itanium: The stack pointer is SP. /// x64: The stack pointer is RSP. /// public ADDRESS AddrStack; /// /// On x86 computers, this member is an FPO_DATA structure. If there is no function table entry, this member is NULL. /// public IntPtr FuncTableEntry; /// The possible arguments to the function. [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] public uint[] Params; /// This member is TRUE if this is a WOW far call. [MarshalAs(UnmanagedType.Bool)] public bool Far; /// This member is TRUE if this is a virtual frame. [MarshalAs(UnmanagedType.Bool)] public bool Virtual; /// This member is used internally by the StackWalk64 function. [MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)] public uint[] Reserved; /// A KDHELP64 structure that specifies helper data for walking kernel callback frames. public KDHELP KdHelp; /// Intel Itanium: An ADDRESS64 structure that specifies the backing store (RsBSP). public ADDRESS AddrBStore; } /// Represents an extended stack frame. // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-stackframe_ex typedef struct _tagSTACKFRAME_EX { ADDRESS64 // AddrPC; ADDRESS64 AddrReturn; ADDRESS64 AddrFrame; ADDRESS64 AddrStack; ADDRESS64 AddrBStore; PVOID FuncTableEntry; DWORD64 // Params[4]; BOOL Far; BOOL Virtual; DWORD64 Reserved[3]; KDHELP64 KdHelp; DWORD StackFrameSize; DWORD InlineFrameContext; } // STACKFRAME_EX, *LPSTACKFRAME_EX; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._tagSTACKFRAME_EX")] [StructLayout(LayoutKind.Sequential)] public struct STACKFRAME_EX { /// /// An ADDRESS64 structure that specifies the program counter. /// x86: The program counter is EIP. /// Intel Itanium: The program counter is StIIP. /// x64: The program counter is RIP. /// public ADDRESS64 AddrPC; /// An ADDRESS64 structure that specifies the return address. public ADDRESS64 AddrReturn; /// /// An ADDRESS64 structure that specifies the frame pointer. /// x86: The frame pointer is EBP. /// Intel Itanium: There is no frame pointer, but AddrBStore is used. /// x64: The frame pointer is RBP or RDI. This value is not always used. /// public ADDRESS64 AddrFrame; /// /// An ADDRESS64 structure that specifies the stack pointer. /// x86: The stack pointer is ESP. /// Intel Itanium: The stack pointer is SP. /// x64: The stack pointer is RSP. /// public ADDRESS64 AddrStack; /// Intel Itanium: An ADDRESS64 structure that specifies the backing store (RsBSP). public ADDRESS64 AddrBStore; /// /// On x86 computers, this member is an FPO_DATA structure. If there is no function table entry, this member is NULL. /// public IntPtr FuncTableEntry; /// The possible arguments to the function. [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] public ulong[] Params; /// This member is TRUE if this is a WOW far call. [MarshalAs(UnmanagedType.Bool)] public bool Far; /// This member is TRUE if this is a virtual frame. [MarshalAs(UnmanagedType.Bool)] public bool Virtual; /// This member is used internally by the StackWalkEx function. [MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)] public ulong[] Reserved; /// A KDHELP64 structure that specifies helper data for walking kernel callback frames. public KDHELP64 KdHelp; /// /// Set to /// sizeof(STACKFRAME_EX) /// . /// public uint StackFrameSize; /// /// Specifies the type of the inline frame context. /// INLINE_FRAME_CONTEXT_INIT (0) /// INLINE_FRAME_CONTEXT_IGNORE (0xffffffff) /// public INLINE_FRAME_CONTEXT InlineFrameContext; } /// Represents a stack frame. /// /// /// This structure supersedes the STACKFRAME structure. For more information, see Updated Platform Support. STACKFRAME /// is defined as follows in Dbghelp.h. /// /// /// #if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64) #define STACKFRAME STACKFRAME64 #define LPSTACKFRAME LPSTACKFRAME64 #else typedef struct _tagSTACKFRAME { ADDRESS AddrPC; ADDRESS AddrReturn; ADDRESS AddrFrame; ADDRESS AddrStack; PVOID FuncTableEntry; DWORD Params[4]; BOOL Far; BOOL Virtual; DWORD Reserved[3]; KDHELP KdHelp; ADDRESS AddrBStore; } STACKFRAME, *LPSTACKFRAME; #endif /// /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-stackframe64 typedef struct _tagSTACKFRAME64 { ADDRESS64 // AddrPC; ADDRESS64 AddrReturn; ADDRESS64 AddrFrame; ADDRESS64 AddrStack; ADDRESS64 AddrBStore; PVOID FuncTableEntry; DWORD64 // Params[4]; BOOL Far; BOOL Virtual; DWORD64 Reserved[3]; KDHELP64 KdHelp; } STACKFRAME64, *LPSTACKFRAME64; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._tagSTACKFRAME64")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct STACKFRAME64 { /// /// An ADDRESS64 structure that specifies the program counter. /// x86: The program counter is EIP. /// Intel Itanium: The program counter is StIIP. /// x64: The program counter is RIP. /// public ADDRESS64 AddrPC; /// An ADDRESS64 structure that specifies the return address. public ADDRESS64 AddrReturn; /// /// An ADDRESS64 structure that specifies the frame pointer. /// x86: The frame pointer is EBP. /// Intel Itanium: There is no frame pointer, but AddrBStore is used. /// x64: The frame pointer is RBP or RDI. This value is not always used. /// public ADDRESS64 AddrFrame; /// /// An ADDRESS64 structure that specifies the stack pointer. /// x86: The stack pointer is ESP. /// Intel Itanium: The stack pointer is SP. /// x64: The stack pointer is RSP. /// public ADDRESS64 AddrStack; /// Intel Itanium: An ADDRESS64 structure that specifies the backing store (RsBSP). public ADDRESS64 AddrBStore; /// /// On x86 computers, this member is an FPO_DATA structure. If there is no function table entry, this member is NULL. /// public IntPtr FuncTableEntry; /// The possible arguments to the function. [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] public ulong[] Params; /// This member is TRUE if this is a WOW far call. [MarshalAs(UnmanagedType.Bool)] public bool Far; /// This member is TRUE if this is a virtual frame. [MarshalAs(UnmanagedType.Bool)] public bool Virtual; /// This member is used internally by the StackWalk64 function. [MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)] public ulong[] Reserved; /// A KDHELP64 structure that specifies helper data for walking kernel callback frames. public KDHELP64 KdHelp; } /// Contains symbol information. // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-symbol_info typedef struct _SYMBOL_INFO { ULONG // SizeOfStruct; ULONG TypeIndex; ULONG64 Reserved[2]; ULONG Index; ULONG Size; ULONG64 ModBase; ULONG Flags; ULONG64 Value; ULONG64 // Address; ULONG Register; ULONG Scope; ULONG Tag; ULONG NameLen; ULONG MaxNameLen; CHAR Name[1]; } SYMBOL_INFO, *PSYMBOL_INFO; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._SYMBOL_INFO")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct SYMBOL_INFO { /// /// The size of the structure, in bytes. This member must be set to sizeof(SYMBOL_INFO) . Note that the total size of the /// data is the SizeOfStruct + (MaxNameLen - 1) * sizeof(TCHAR) . The reason to subtract one is that the first character /// in the name is accounted for in the size of the structure. /// public uint SizeOfStruct; /// /// A unique value that identifies the type data that describes the symbol. This value does not persist between sessions. /// public uint TypeIndex; /// This member is reserved for system use. public ulong Reserved0; private ulong Reserved1; /// /// /// The unique value for the symbol. The value associated with a symbol is not guaranteed to be the same each time you run the process. /// /// /// For PDB symbols, the index value for a symbol is not generated until the symbol is enumerated or retrieved through a search /// by name or address. The index values for all CodeView and COFF symbols are generated when the symbols are loaded. /// /// public uint Index; /// /// The symbol size, in bytes. This value is meaningful only if the module symbols are from a pdb file; otherwise, this value is /// typically zero and should be ignored. /// public uint Size; /// The base address of the module that contains the symbol. public ulong ModBase; /// /// This member can be one or more of the following values. /// /// /// Value /// Meaning /// /// /// SYMFLAG_CLR_TOKEN 0x00040000 /// The symbol is a CLR token. /// /// /// SYMFLAG_CONSTANT 0x00000100 /// The symbol is a constant. /// /// /// SYMFLAG_EXPORT 0x00000200 /// The symbol is from the export table. /// /// /// SYMFLAG_FORWARDER 0x00000400 /// The symbol is a forwarder. /// /// /// SYMFLAG_FRAMEREL 0x00000020 /// Offsets are frame relative. /// /// /// SYMFLAG_FUNCTION 0x00000800 /// The symbol is a known function. /// /// /// SYMFLAG_ILREL 0x00010000 /// /// The symbol address is an offset relative to the beginning of the intermediate language block. This applies to managed code only. /// /// /// /// SYMFLAG_LOCAL 0x00000080 /// The symbol is a local variable. /// /// /// SYMFLAG_METADATA 0x00020000 /// The symbol is managed metadata. /// /// /// SYMFLAG_PARAMETER 0x00000040 /// The symbol is a parameter. /// /// /// SYMFLAG_REGISTER 0x00000008 /// The symbol is a register. The Register member is used. /// /// /// SYMFLAG_REGREL 0x00000010 /// Offsets are register relative. /// /// /// SYMFLAG_SLOT 0x00008000 /// The symbol is a managed code slot. /// /// /// SYMFLAG_THUNK 0x00002000 /// The symbol is a thunk. /// /// /// SYMFLAG_TLSREL 0x00004000 /// The symbol is an offset into the TLS data area. /// /// /// SYMFLAG_VALUEPRESENT 0x00000001 /// The Value member is used. /// /// /// SYMFLAG_VIRTUAL 0x00001000 /// The symbol is a virtual symbol created by the SymAddSymbol function. /// /// /// public SYMFLAG Flags; /// The value of a constant. public ulong Value; /// The virtual address of the start of the symbol. public ulong Address; /// The register. public uint Register; /// /// The DIA scope. For more information, see the Debug Interface Access SDK in the Visual Studio documentation. (This resource /// may not be available in some languages and countries.) /// public uint Scope; /// The PDB classification. These values are defined in Dbghelp.h in the SymTagEnum enumeration type. public uint Tag; /// The length of the name, in characters, not including the null-terminating character. public uint NameLen; /// The size of the Name buffer, in characters. If this member is 0, the Name member is not used. public uint MaxNameLen; /// /// The name of the symbol. The name can be undecorated if the SYMOPT_UNDNAME option is used with the SymSetOptions function. /// [MarshalAs(UnmanagedType.ByValTStr, SizeConst = MAX_SYM_NAME)] public string Name; /// The default initial value for SYMBOL_INFO with size parameters set. public static SYMBOL_INFO Default = new() { SizeOfStruct = (uint)Marshal.SizeOf(typeof(SYMBOL_INFO_V)), MaxNameLen = MAX_SYM_NAME }; } /// /// Contains symbol information. Use this structure when extracting from a pointer, like in the enumeration callbacks. /// /// /// This is a sample of how to use this structure in a callback. /// List<SYMBOL_INFO> list = new(); /// Win32Error.ThrowLastErrorIfFalse(SymEnumSymbolsEx(hProcess, baseOfDll, mask, EnumProc, userContext, options)); /// /// bool EnumProc(IntPtr pSymInfo, uint SymbolSize, IntPtr UserContext) /// { /// try { list.Add((SYMBOL_INFO)pSymInfo.ToStructure<SYMBOL_INFO_V>(SymbolSize)); return true; } /// catch { return false; } /// } /// // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-symbol_info typedef struct _SYMBOL_INFO { ULONG // SizeOfStruct; ULONG TypeIndex; ULONG64 Reserved[2]; ULONG Index; ULONG Size; ULONG64 ModBase; ULONG Flags; ULONG64 Value; ULONG64 // Address; ULONG Register; ULONG Scope; ULONG Tag; ULONG NameLen; ULONG MaxNameLen; CHAR Name[1]; } SYMBOL_INFO, *PSYMBOL_INFO; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._SYMBOL_INFO")] [VanaraMarshaler(typeof(SafeAnysizeStringMarshaler), "Auto")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct SYMBOL_INFO_V { /// /// The size of the structure, in bytes. This member must be set to sizeof(SYMBOL_INFO) . Note that the total size of the /// data is the SizeOfStruct + (MaxNameLen - 1) * sizeof(TCHAR) . The reason to subtract one is that the first character /// in the name is accounted for in the size of the structure. /// public uint SizeOfStruct; /// /// A unique value that identifies the type data that describes the symbol. This value does not persist between sessions. /// public uint TypeIndex; /// This member is reserved for system use. public ulong Reserved0; private ulong Reserved1; /// /// /// The unique value for the symbol. The value associated with a symbol is not guaranteed to be the same each time you run the process. /// /// /// For PDB symbols, the index value for a symbol is not generated until the symbol is enumerated or retrieved through a search /// by name or address. The index values for all CodeView and COFF symbols are generated when the symbols are loaded. /// /// public uint Index; /// /// The symbol size, in bytes. This value is meaningful only if the module symbols are from a pdb file; otherwise, this value is /// typically zero and should be ignored. /// public uint Size; /// The base address of the module that contains the symbol. public ulong ModBase; /// /// This member can be one or more of the following values. /// /// /// Value /// Meaning /// /// /// SYMFLAG_CLR_TOKEN 0x00040000 /// The symbol is a CLR token. /// /// /// SYMFLAG_CONSTANT 0x00000100 /// The symbol is a constant. /// /// /// SYMFLAG_EXPORT 0x00000200 /// The symbol is from the export table. /// /// /// SYMFLAG_FORWARDER 0x00000400 /// The symbol is a forwarder. /// /// /// SYMFLAG_FRAMEREL 0x00000020 /// Offsets are frame relative. /// /// /// SYMFLAG_FUNCTION 0x00000800 /// The symbol is a known function. /// /// /// SYMFLAG_ILREL 0x00010000 /// /// The symbol address is an offset relative to the beginning of the intermediate language block. This applies to managed code only. /// /// /// /// SYMFLAG_LOCAL 0x00000080 /// The symbol is a local variable. /// /// /// SYMFLAG_METADATA 0x00020000 /// The symbol is managed metadata. /// /// /// SYMFLAG_PARAMETER 0x00000040 /// The symbol is a parameter. /// /// /// SYMFLAG_REGISTER 0x00000008 /// The symbol is a register. The Register member is used. /// /// /// SYMFLAG_REGREL 0x00000010 /// Offsets are register relative. /// /// /// SYMFLAG_SLOT 0x00008000 /// The symbol is a managed code slot. /// /// /// SYMFLAG_THUNK 0x00002000 /// The symbol is a thunk. /// /// /// SYMFLAG_TLSREL 0x00004000 /// The symbol is an offset into the TLS data area. /// /// /// SYMFLAG_VALUEPRESENT 0x00000001 /// The Value member is used. /// /// /// SYMFLAG_VIRTUAL 0x00001000 /// The symbol is a virtual symbol created by the SymAddSymbol function. /// /// /// public SYMFLAG Flags; /// The value of a constant. public ulong Value; /// The virtual address of the start of the symbol. public ulong Address; /// The register. public uint Register; /// /// The DIA scope. For more information, see the Debug Interface Access SDK in the Visual Studio documentation. (This resource /// may not be available in some languages and countries.) /// public uint Scope; /// The PDB classification. These values are defined in Dbghelp.h in the SymTagEnum enumeration type. public uint Tag; /// The length of the name, in characters, not including the null-terminating character. public uint NameLen; /// The size of the Name buffer, in characters. If this member is 0, the Name member is not used. public uint MaxNameLen; /// /// The name of the symbol. The name can be undecorated if the SYMOPT_UNDNAME option is used with the SymSetOptions function. /// [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 1)] public string Name; /// Performs an implicit conversion from to . /// The r. /// The result of the conversion. public static implicit operator SYMBOL_INFO(SYMBOL_INFO_V r) { var ret = default(SYMBOL_INFO); foreach (var fi in typeof(SYMBOL_INFO_V).GetFields()) ret.SetFieldValue(fi.Name, fi.GetValue(r)); return ret; } } /// Contains symbol server index information. // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-symsrv_index_info typedef struct { DWORD sizeofstruct; char // file[MAX_PATH + 1]; BOOL stripped; DWORD timestamp; DWORD size; char dbgfile[MAX_PATH + 1]; char pdbfile[MAX_PATH + 1]; GUID // guid; DWORD sig; DWORD age; } SYMSRV_INDEX_INFO, *PSYMSRV_INDEX_INFO; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp.__unnamed_struct_0")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Auto)] public struct SYMSRV_INDEX_INFO { /// /// The size of the structure, in bytes. This member must be set to sizeof(SYMSRV_INDEX_INFO) or /// sizeof(SYMSRV_INDEX_INFOW) . /// public uint sizeofstruct; /// The name of the .pdb, .dbg, or image file. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 261 /*MAX_PATH + 1*/)] public string file; /// A value that indicates whether the image file is stripped. [MarshalAs(UnmanagedType.Bool)] public bool stripped; /// The timestamp from the PE header. This member is used only for image files. public uint timestamp; /// The file size from the PE header. This member is used only for image files. public uint size; /// /// If the image file is stripped and there is a .dbg file, this member is the path to the .dbg file from the CV record. /// [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 261 /*MAX_PATH + 1*/)] public string dbgfile; /// The .pdb file from the CV record. This member is used only for image and .dbg files. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 261 /*MAX_PATH + 1*/)] public string pdbfile; /// /// The GUID of the .pdb file. If there is no GUID available, the signature of the .pdb file is copied into first DWORD /// of the GUID. /// public Guid guid; /// /// The signature of the .pdb file (for use with old-style .pdb files). This value can be 0 if it is a new-style .pdb file that /// uses a GUID-length signature. /// public uint sig; /// The age of the .pdb file. public uint age; } /// Contains type index information. It is used by the SymGetTypeInfo function. // https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/ns-dbghelp-ti_findchildren_params typedef struct // _TI_FINDCHILDREN_PARAMS { ULONG Count; ULONG Start; ULONG ChildId[1]; } TI_FINDCHILDREN_PARAMS; [PInvokeData("dbghelp.h", MSDNShortId = "NS:dbghelp._TI_FINDCHILDREN_PARAMS")] [VanaraMarshaler(typeof(SafeAnysizeStructMarshaler), nameof(Count))] [StructLayout(LayoutKind.Sequential)] public struct TI_FINDCHILDREN_PARAMS { /// The number of children. public uint Count; /// /// The zero-based index of the child from which the child indexes are to be retrieved. For example, in an array with five /// elements, if Start is two, this indicates the third array element. In most cases, this member is zero. /// public uint Start; /// An array of type indexes. There is one index per child. [MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)] public uint[] ChildId; } /// Contains symbol information. /// public class SafeIMAGEHLP_SYMBOL : SafeHGlobalStruct { /// Initializes a new instance of the class. /// Maximum length of the name. public SafeIMAGEHLP_SYMBOL(int maxNameLen = 261) : base(BaseStructSize + (maxNameLen - 1)) { handle.Write((uint)BaseStructSize, 0, Size); handle.Write((uint)maxNameLen, (int)FieldOffset(nameof(IMAGEHLP_SYMBOL.MaxNameLength)), Size); } } /// Contains symbol information. /// public class SafeIMAGEHLP_SYMBOL64 : SafeHGlobalStruct { /// Initializes a new instance of the class. /// Maximum length of the name. public SafeIMAGEHLP_SYMBOL64(int maxNameLen = 261) : base(BaseStructSize + (maxNameLen - 1)) { handle.Write((uint)BaseStructSize, 0, Size); handle.Write((uint)maxNameLen, (int)FieldOffset(nameof(IMAGEHLP_SYMBOL64.MaxNameLength)), Size); } } /// Pointer to a LOADED_IMAGE structure. /// public class SafeLOADED_IMAGE : SafeHandle { private SafeLOADED_IMAGE() : base(IntPtr.Zero, true) { } /// When overridden in a derived class, gets a value indicating whether the handle value is invalid. public override bool IsInvalid => handle == IntPtr.Zero; /// Performs an implicit conversion from to . /// The instance. /// The resulting instance from the conversion. public static implicit operator LOADED_IMAGE(SafeLOADED_IMAGE i) => i.handle.ToStructure(); /// When overridden in a derived class, executes the code required to free the handle. /// /// true if the handle is released successfully; otherwise, in the event of a catastrophic failure, false. In this case, it /// generates a releaseHandleFailed MDA Managed Debugging Assistant. /// protected override bool ReleaseHandle() => ImageHlp.ImageUnload(handle); } } }