using System; using System.Runtime.InteropServices; using Vanara.InteropServices; namespace Vanara.PInvoke { public static partial class DbgHelp { /// /// An application-defined callback function used with MiniDumpWriteDump. It receives extended minidump information. /// /// The MINIDUMP_CALLBACK_ROUTINE type defines a pointer to this callback function. MiniDumpCallback is a placeholder /// for the application-defined function name. /// /// /// An application-defined parameter value. /// A pointer to a MINIDUMP_CALLBACK_INPUT structure that specifies extended minidump information. /// /// A pointer to a MINIDUMP_CALLBACK_OUTPUT structure that receives application-defined information from the callback function. /// /// If the function succeeds, return TRUE; otherwise, return FALSE. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nc-minidumpapiset-minidump_callback_routine // MINIDUMP_CALLBACK_ROUTINE MinidumpCallbackRoutine; BOOL MinidumpCallbackRoutine( PVOID CallbackParam, PMINIDUMP_CALLBACK_INPUT // CallbackInput, PMINIDUMP_CALLBACK_OUTPUT CallbackOutput ) {...} [UnmanagedFunctionPointer(CallingConvention.Winapi)] [PInvokeData("minidumpapiset.h", MSDNShortId = "NC:minidumpapiset.MINIDUMP_CALLBACK_ROUTINE")] [return: MarshalAs(UnmanagedType.Bool)] public delegate bool MINIDUMP_CALLBACK_ROUTINE([In, Out] IntPtr CallbackParam, in MINIDUMP_CALLBACK_INPUT CallbackInput, ref MINIDUMP_CALLBACK_OUTPUT CallbackOutput); /// /// Identifies the type of information returned by the MiniDumpCallback function. Not all memory failures will cause a callback; for /// example if the failure is within a stack then the failure is considered to be unrecoverable and the minidump will fail. /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-minidump_callback_type typedef enum // _MINIDUMP_CALLBACK_TYPE { ModuleCallback, ThreadCallback, ThreadExCallback, IncludeThreadCallback, IncludeModuleCallback, // MemoryCallback, CancelCallback, WriteKernelMinidumpCallback, KernelMinidumpStatusCallback, RemoveMemoryCallback, // IncludeVmRegionCallback, IoStartCallback, IoWriteAllCallback, IoFinishCallback, ReadMemoryFailureCallback, // SecondaryFlagsCallback, IsProcessSnapshotCallback, VmStartCallback, VmQueryCallback, VmPreReadCallback, VmPostReadCallback } MINIDUMP_CALLBACK_TYPE; [PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._MINIDUMP_CALLBACK_TYPE")] public enum MINIDUMP_CALLBACK_TYPE { /// The callback function returns module information. ModuleCallback, /// The callback function returns thread information. ThreadCallback, /// The callback function returns extended thread information. ThreadExCallback, /// /// The callback function indicates which threads are to be included. It is called as the minidump library is enumerating the /// threads in a process, rather than after the information gathered, as it is with ThreadCallback or ThreadExCallback. It is /// called for each thread. If the callback function returns FALSE, the current thread is excluded. This allows the caller to /// obtain information for a subset of the threads in a process, without suspending threads that are not of interest. /// Alternately, you can modify the ThreadWriteFlags member of the MINIDUMP_CALLBACK_OUTPUT structure and return TRUE to avoid /// gathering unnecessary information for the thread. /// IncludeThreadCallback, /// /// The callback function indicates which modules are to be included. The callback function is called as the minidump library is /// enumerating the modules in a process, rather than after the information is gathered, as it is with ModuleCallback. It is /// called for each module. If the callback function returns FALSE, the current module is excluded. Alternatively, you can /// modify the ModuleWriteFlags member of the MINIDUMP_CALLBACK_OUTPUT structure and return TRUE to avoid gathering unnecessary /// information for the module. /// IncludeModuleCallback, /// /// The callback function returns a region of memory to be included in the dump. The callback is called only for dumps generated /// without the MiniDumpWithFullMemory flag. If the callback function returns FALSE or a region of size 0, the callback will not /// be called again. DbgHelp 6.1 and earlier: This value is not supported. /// MemoryCallback, /// The callback function returns cancellation information. DbgHelp 6.1 and earlier: This value is not supported. CancelCallback, /// /// The user-mode minidump has been successfully completed. To initiate a kernel-mode minidump, the callback should return TRUE /// and set the Handle member of the MINIDUMP_CALLBACK_OUTPUT structure. DbgHelp 6.1 and earlier: This value is not supported. /// WriteKernelMinidumpCallback, /// /// The callback function returns status information for the kernel minidump. DbgHelp 6.1 and earlier: This value is not supported. /// KernelMinidumpStatusCallback, /// /// The callback function returns a region of memory to be excluded from the dump. The callback is called only for dumps /// generated without the MiniDumpWithFullMemory flag. If the callback function returns FALSE or a region of size 0, the /// callback will not be called again. DbgHelp 6.3 and earlier: This value is not supported. /// RemoveMemoryCallback, /// /// The callback function returns information about the virtual memory region. It is called twice for each region during the /// full-memory writing pass. The VmRegion member of the MINIDUMP_CALLBACK_OUTPUT structure contains the current memory region. /// You can modify the base address and size of the region, as long as the new region remains a subset of the original region; /// changes to other members are ignored. If the callback returns TRUE and sets the Continue member of MINIDUMP_CALLBACK_OUTPUT /// to TRUE, the minidump library will use the region specified by VmRegion as the region to be written. If the callback returns /// FALSE or if Continue is FALSE, the callback will not be called for additional memory regions. DbgHelp 6.4 and earlier: This /// value is not supported. /// IncludeVmRegionCallback, /// /// The callback function indicates that the caller will be providing an alternate I/O routine. If the callback returns TRUE and /// sets the Status member of MINIDUMP_CALLBACK_OUTPUT to S_FALSE, the minidump library will send all I/O through callbacks. The /// caller will receive an IoWriteAllCallback callback for each piece of data. DbgHelp 6.4 and earlier: This value is not supported. /// IoStartCallback, /// /// The callback must write all requested bytes or fail. The Io member of the MINIDUMP_CALLBACK_INPUT structure contains the /// request. If the write operation fails, the callback should return FALSE. If the write operation succeeds, the callback /// should return TRUE and set the Status member of MINIDUMP_CALLBACK_OUTPUT to S_OK. The caller will receive an /// IoFinishCallback callback when the I/O has completed. DbgHelp 6.4 and earlier: This value is not supported. /// IoWriteAllCallback, /// /// The callback returns I/O completion information. If the callback returns FALSE or does not set the Status member of /// MINIDUMP_CALLBACK_OUTPUT to S_OK, the minidump library assumes the minidump write operation has failed. DbgHelp 6.4 and /// earlier: This value is not supported. /// IoFinishCallback, /// /// There has been a failure to read memory. If the callback returns TRUE and sets the Status member of MINIDUMP_CALLBACK_OUTPUT /// to S_OK, the memory failure is ignored and the block is omitted from the minidump. Otherwise, this failure results in a /// failure to write to the minidump. DbgHelp 6.4 and earlier: This value is not supported. /// ReadMemoryFailureCallback, /// The callback returns secondary information. DbgHelp 6.5 and earlier: This value is not supported. SecondaryFlagsCallback, /// /// The callback function indicates whether the target is a process or a snapshot.DbgHelp 6.2 and earlier: This value is not supported. /// IsProcessSnapshotCallback, /// /// The callback function indicates whether the callee supports and accepts virtual memory callbacks, such as VmQueryCallback, /// VmPreReadCallback, and VmPostReadCallback. A return value of S_FALSE means that virtual memory callbacks are supported. A /// value of S_OK means that virtual memory callbacks are not supported.DbgHelp 6.2 and earlier: This value is not supported. /// VmStartCallback, /// /// The callback function is invoked for snapshot targets to collect virtual address memory information from the target.The /// callback is only called if VmStartCallback returned a value of S_FALSE.DbgHelp 6.2 and earlier: This value is not supported. /// VmQueryCallback, /// /// The callback function is sent for every ReadVirtual operation. These reads are not limited to the memory blocks that are /// added to the dump. The engine also accesses the Process Environment Block (PEB), the Thread Environment Block (TEB), the /// loader data, the unloaded module traces, and other blocks. Even if those blocks do not end up in the dump, they are read /// from the target, and virtual memory callbacks are initiated for each. The callback is only called if VmStartCallback /// returned S_FALSE.DbgHelp 6.2 and earlier: This value is not supported. /// VmPreReadCallback, /// /// The callback function allows the callee to alter the buffer contents with data from other sources, such as a cache, or /// perform obfuscation. The buffer at this point is fully or partially filled by VmPreReadCallback and by ReadProcessMemory. /// The callback is only called if VmStartCallback returned S_FALSE.DbgHelp 6.2 and earlier: This value is not supported. /// VmPostReadCallback, } /// Identifies the type of object-specific information. /// /// The information represented by each of these values can vary by operating system and procesor architecture. Per-handle /// object-specific information is automatically gathered when minidump type is MiniDumpWithHandleData. For more information, see MINIDUMP_TYPE. /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-minidump_handle_object_information_type // typedef enum _MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE { MiniHandleObjectInformationNone, MiniThreadInformation1, // MiniMutantInformation1, MiniMutantInformation2, MiniProcessInformation1, MiniProcessInformation2, MiniEventInformation1, // MiniSectionInformation1, MiniSemaphoreInformation1, MiniHandleObjectInformationTypeMax } MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE; [PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE")] public enum MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE { /// There is no object-specific information for this handle type. MiniHandleObjectInformationNone, /// The information is specific to thread objects. MiniThreadInformation1, /// The information is specific to mutant objects. MiniMutantInformation1, /// The information is specific to mutant objects. MiniMutantInformation2, /// The information is specific to process objects. MiniProcessInformation1, /// The information is specific to process objects. MiniProcessInformation2, /// MiniEventInformation1, /// MiniSectionInformation1, /// MiniSemaphoreInformation1, /// MiniHandleObjectInformationTypeMax, } /// Specifies the secondary flags for the minidump. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-minidump_secondary_flags typedef enum // _MINIDUMP_SECONDARY_FLAGS { MiniSecondaryWithoutPowerInfo, MiniSecondaryValidFlags } MINIDUMP_SECONDARY_FLAGS; [PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._MINIDUMP_SECONDARY_FLAGS")] [Flags] public enum MINIDUMP_SECONDARY_FLAGS { /// /// The minidump information does not retrieve the processor power information contained in the MINIDUMP_MISC_INFO_2 structure. /// MiniSecondaryWithoutPowerInfo = 1, /// MiniSecondaryValidFlags = 1, } /// Represents the type of a minidump data stream. /// /// In this context, a data stream is a set of data in a minidump file. /// /// The StreamType member of the MINIDUMP_DIRECTORY structure can be one of these types. Additional types may be added in the /// future, so if a program reading the minidump header encounters a stream type it does not recognize, it should ignore the stream altogether. /// /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-minidump_stream_type typedef enum // _MINIDUMP_STREAM_TYPE { UnusedStream, ReservedStream0, ReservedStream1, ThreadListStream, ModuleListStream, MemoryListStream, // ExceptionStream, SystemInfoStream, ThreadExListStream, Memory64ListStream, CommentStreamA, CommentStreamW, HandleDataStream, // FunctionTableStream, UnloadedModuleListStream, MiscInfoStream, MemoryInfoListStream, ThreadInfoListStream, // HandleOperationListStream, TokenStream, JavaScriptDataStream, SystemMemoryInfoStream, ProcessVmCountersStream, IptTraceStream, // ThreadNamesStream, ceStreamNull, ceStreamSystemInfo, ceStreamException, ceStreamModuleList, ceStreamProcessList, // ceStreamThreadList, ceStreamThreadContextList, ceStreamThreadCallStackList, ceStreamMemoryVirtualList, // ceStreamMemoryPhysicalList, ceStreamBucketParameters, ceStreamProcessModuleMap, ceStreamDiagnosisList, LastReservedStream } MINIDUMP_STREAM_TYPE; [PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._MINIDUMP_STREAM_TYPE")] public enum MINIDUMP_STREAM_TYPE { /// Reserved. Do not use this enumeration value. UnusedStream, /// Reserved. Do not use this enumeration value. ReservedStream0, /// Reserved. Do not use this enumeration value. ReservedStream1, /// The stream contains thread information. For more information, see MINIDUMP_THREAD_LIST. ThreadListStream, /// The stream contains module information. For more information, see MINIDUMP_MODULE_LIST. ModuleListStream, /// The stream contains memory allocation information. For more information, see MINIDUMP_MEMORY_LIST. MemoryListStream, /// The stream contains exception information. For more information, see MINIDUMP_EXCEPTION_STREAM. ExceptionStream, /// The stream contains general system information. For more information, see MINIDUMP_SYSTEM_INFO. SystemInfoStream, /// The stream contains extended thread information. For more information, see MINIDUMP_THREAD_EX_LIST. ThreadExListStream, /// The stream contains memory allocation information. For more information, see MINIDUMP_MEMORY64_LIST. Memory64ListStream, /// The stream contains an ANSI string used for documentation purposes. CommentStreamA, /// The stream contains a Unicode string used for documentation purposes. CommentStreamW, /// /// The stream contains high-level information about the active operating system handles. For more information, see MINIDUMP_HANDLE_DATA_STREAM. /// HandleDataStream, /// The stream contains function table information. For more information, see MINIDUMP_FUNCTION_TABLE_STREAM. FunctionTableStream, /// /// The stream contains module information for the unloaded modules. For more information, see /// MINIDUMP_UNLOADED_MODULE_LIST.DbgHelp 5.1: This value is not supported. /// UnloadedModuleListStream, /// /// The stream contains miscellaneous information. For more information, see MINIDUMP_MISC_INFO or MINIDUMP_MISC_INFO_2.DbgHelp /// 5.1: This value is not supported. /// MiscInfoStream, /// /// The stream contains memory region description information. It corresponds to the information that would be returned for the /// process from the VirtualQuery function. For more information, see MINIDUMP_MEMORY_INFO_LIST.DbgHelp 6.1 and earlier: This /// value is not supported. /// MemoryInfoListStream, /// /// The stream contains thread state information. For more information, see MINIDUMP_THREAD_INFO_LIST.DbgHelp 6.1 and earlier: /// This value is not supported. /// ThreadInfoListStream, /// /// This stream contains operation list information. For more information, see MINIDUMP_HANDLE_OPERATION_LIST.DbgHelp 6.4 and /// earlier: This value is not supported. /// HandleOperationListStream, /// TokenStream, /// JavaScriptDataStream, /// SystemMemoryInfoStream, /// ProcessVmCountersStream, /// IptTraceStream, /// ThreadNamesStream, /// ceStreamNull = 0x8000, /// ceStreamSystemInfo, /// ceStreamException, /// ceStreamModuleList, /// ceStreamProcessList, /// ceStreamThreadList, /// ceStreamThreadContextList, /// ceStreamThreadCallStackList, /// ceStreamMemoryVirtualList, /// ceStreamMemoryPhysicalList, /// ceStreamBucketParameters, /// ceStreamProcessModuleMap, /// ceStreamDiagnosisList, /// /// Any value greater than this value will not be used by the system and can be used to represent application-defined data /// streams. For more information, see MINIDUMP_USER_STREAM. /// LastReservedStream = 0xffff, } /// The flags that indicate the thread state. [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_INFO")] [Flags] public enum MINIDUMP_THREAD_INFO_FLAG : uint { /// A placeholder thread due to an error accessing the thread. No thread information exists beyond the thread identifier. MINIDUMP_THREAD_INFO_ERROR_THREAD = 0x00000001, /// The thread has exited (not running any code) at the time of the dump. MINIDUMP_THREAD_INFO_EXITED_THREAD = 0x00000004, /// Thread context could not be retrieved. MINIDUMP_THREAD_INFO_INVALID_CONTEXT = 0x00000010, /// Thread information could not be retrieved. MINIDUMP_THREAD_INFO_INVALID_INFO = 0x00000008, /// TEB information could not be retrieved. MINIDUMP_THREAD_INFO_INVALID_TEB = 0x00000020, /// This is the thread that called MiniDumpWriteDump. MINIDUMP_THREAD_INFO_WRITING_THREAD = 0x00000002, } /// /// Identifies the type of information that will be written to the minidump file by the MiniDumpWriteDump function. /// Important /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-minidump_type typedef enum _MINIDUMP_TYPE { // MiniDumpNormal, MiniDumpWithDataSegs, MiniDumpWithFullMemory, MiniDumpWithHandleData, MiniDumpFilterMemory, MiniDumpScanMemory, // MiniDumpWithUnloadedModules, MiniDumpWithIndirectlyReferencedMemory, MiniDumpFilterModulePaths, MiniDumpWithProcessThreadData, // MiniDumpWithPrivateReadWriteMemory, MiniDumpWithoutOptionalData, MiniDumpWithFullMemoryInfo, MiniDumpWithThreadInfo, // MiniDumpWithCodeSegs, MiniDumpWithoutAuxiliaryState, MiniDumpWithFullAuxiliaryState, MiniDumpWithPrivateWriteCopyMemory, // MiniDumpIgnoreInaccessibleMemory, MiniDumpWithTokenInformation, MiniDumpWithModuleHeaders, MiniDumpFilterTriage, // MiniDumpWithAvxXStateContext, MiniDumpWithIptTrace, MiniDumpScanInaccessiblePartialPages, MiniDumpValidTypeFlags } MINIDUMP_TYPE; [PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._MINIDUMP_TYPE")] [Flags] public enum MINIDUMP_TYPE { /// Include just the information necessary to capture stack traces for all existing threads in a process. MiniDumpNormal = 0x00000000, /// /// Include the data sections from all loaded modules. This results in the inclusion of global variables, which can make the /// minidump file significantly larger. For per-module control, use the ModuleWriteDataSeg enumeration value from MODULE_WRITE_FLAGS. /// MiniDumpWithDataSegs = 0x00000001, /// /// Include all accessible memory in the process. The raw memory data is included at the end, so that the initial structures can /// be mapped directly without the raw memory information. This option can result in a very large file. /// MiniDumpWithFullMemory = 0x00000002, /// Include high-level information about the operating system handles that are active when the minidump is made. MiniDumpWithHandleData = 0x00000004, /// /// Stack and backing store memory written to the minidump file should be filtered to remove all but the pointer values /// necessary to reconstruct a stack trace. /// MiniDumpFilterMemory = 0x00000008, /// /// Stack and backing store memory should be scanned for pointer references to modules in the module list. If a module is /// referenced by stack or backing store memory, the ModuleWriteFlags member of the MINIDUMP_CALLBACK_OUTPUT structure is set to ModuleReferencedByMemory. /// MiniDumpScanMemory = 0x00000010, /// /// Include information from the list of modules that were recently unloaded, if this information is maintained by the operating /// system. Windows Server 2003 and Windows XP: The operating system does not maintain information for unloaded modules until /// Windows Server 2003 with SP1 and Windows XP with SP2.DbgHelp 5.1: This value is not supported. /// MiniDumpWithUnloadedModules = 0x00000020, /// /// Include pages with data referenced by locals or other stack memory. This option can increase the size of the minidump file /// significantly. DbgHelp 5.1: This value is not supported. /// MiniDumpWithIndirectlyReferencedMemory = 0x00000040, /// /// Filter module paths for information such as user names or important directories. This option may prevent the system from /// locating the image file and should be used only in special situations. DbgHelp 5.1: This value is not supported. /// MiniDumpFilterModulePaths = 0x00000080, /// /// Include complete per-process and per-thread information from the operating system. DbgHelp 5.1: This value is not supported. /// MiniDumpWithProcessThreadData = 0x00000100, /// Scan the virtual address space for PAGE_READWRITE memory to be included. DbgHelp 5.1: This value is not supported. MiniDumpWithPrivateReadWriteMemory = 0x00000200, /// /// Reduce the data that is dumped by eliminating memory regions that are not essential to meet criteria specified for the dump. /// This can avoid dumping memory that may contain data that is private to the user. However, it is not a guarantee that no /// private information will be present. DbgHelp 6.1 and earlier: This value is not supported. /// MiniDumpWithoutOptionalData = 0x00000400, /// /// Include memory region information. For more information, see MINIDUMP_MEMORY_INFO_LIST. DbgHelp 6.1 and earlier: This value /// is not supported. /// MiniDumpWithFullMemoryInfo = 0x00000800, /// /// Include thread state information. For more information, see MINIDUMP_THREAD_INFO_LIST. DbgHelp 6.1 and earlier: This value /// is not supported. /// MiniDumpWithThreadInfo = 0x00001000, /// /// Include all code and code-related sections from loaded modules to capture executable content. For per-module control, use /// the ModuleWriteCodeSegs enumeration value from MODULE_WRITE_FLAGS. DbgHelp 6.1 and earlier: This value is not supported. /// MiniDumpWithCodeSegs = 0x00002000, /// Turns off secondary auxiliary-supported memory gathering. MiniDumpWithoutAuxiliaryState = 0x00004000, /// /// Requests that auxiliary data providers include their state in the dump image; the state data that is included is provider /// dependent. This option can result in a large dump image. /// MiniDumpWithFullAuxiliaryState = 0x00008000, /// /// Scans the virtual address space for PAGE_WRITECOPY memory to be included. Prior to DbgHelp 6.1: This value is not supported. /// MiniDumpWithPrivateWriteCopyMemory = 0x00010000, /// /// If you specify MiniDumpWithFullMemory, the MiniDumpWriteDump function will fail if the function cannot read the memory /// regions; however, if you include MiniDumpIgnoreInaccessibleMemory, the MiniDumpWriteDump function will ignore the memory /// read failures and continue to generate the dump. Note that the inaccessible memory regions are not included in the /// dump.Prior to DbgHelp 6.1: This value is not supported. /// MiniDumpIgnoreInaccessibleMemory = 0x00020000, /// /// Adds security token related data. This will make the "!token" extension work when processing a user-mode dump. Prior to /// DbgHelp 6.1: This value is not supported. /// MiniDumpWithTokenInformation = 0x00040000, /// Adds module header related data. Prior to DbgHelp 6.1: This value is not supported. MiniDumpWithModuleHeaders = 0x00080000, /// Adds filter triage related data. Prior to DbgHelp 6.1: This value is not supported. MiniDumpFilterTriage = 0x00100000, /// MiniDumpWithAvxXStateContext = 0x00200000, /// MiniDumpWithIptTrace = 0x00400000, /// Indicates which flags are valid. MiniDumpValidTypeFlags = 0x00800000, } /// Identifies the type of module information that will be written to the minidump file by the MiniDumpWriteDump function. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-module_write_flags typedef enum // _MODULE_WRITE_FLAGS { ModuleWriteModule, ModuleWriteDataSeg, ModuleWriteMiscRecord, ModuleWriteCvRecord, // ModuleReferencedByMemory, ModuleWriteTlsData, ModuleWriteCodeSegs } MODULE_WRITE_FLAGS; [PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._MODULE_WRITE_FLAGS")] [Flags] public enum MODULE_WRITE_FLAGS { /// Only module information will be written to the minidump file. ModuleWriteModule = 0x0001, /// /// Module and data segment information will be written to the minidump file. This value will only be set if the /// MiniDumpWithDataSegs enumeration value from MINIDUMP_TYPE is set. /// ModuleWriteDataSeg = 0x0002, /// Module, data segment, and miscellaneous record information will be written to the minidump file. ModuleWriteMiscRecord = 0x0004, /// /// CodeView information will be written to the minidump file. Some debuggers need the CodeView information to properly locate symbols. /// ModuleWriteCvRecord = 0x0008, /// /// Indicates that a module was referenced by a pointer on the stack or backing store of a thread in the minidump. This value is /// valid only if the DumpType parameter of the MiniDumpWriteDump function includes MiniDumpScanMemory. /// ModuleReferencedByMemory = 0x0010, /// /// Per-module automatic TLS data is written to the minidump file. (Note that automatic TLS data is created using /// __declspec(thread) while TlsAlloc creates dynamic TLS data). This value is valid only if the DumpType parameter of the /// MiniDumpWriteDump function includes MiniDumpWithProcessThreadData.DbgHelp 6.1 and earlier: This value is not supported. /// ModuleWriteTlsData = 0x0020, /// /// Code segment information will be written to the minidump file. This value will only be set if the MiniDumpWithCodeSegs /// enumeration value from MINIDUMP_TYPE is set.DbgHelp 6.1 and earlier: This value is not supported. /// ModuleWriteCodeSegs = 0x0040, } /// Identifies the type of thread information that will be written to the minidump file by the MiniDumpWriteDump function. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-thread_write_flags typedef enum // _THREAD_WRITE_FLAGS { ThreadWriteThread, ThreadWriteStack, ThreadWriteContext, ThreadWriteBackingStore, // ThreadWriteInstructionWindow, ThreadWriteThreadData, ThreadWriteThreadInfo } THREAD_WRITE_FLAGS; [PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._THREAD_WRITE_FLAGS")] public enum THREAD_WRITE_FLAGS { /// Only basic thread information will be written to the minidump file. ThreadWriteThread, /// Basic thread and thread stack information will be written to the minidump file. ThreadWriteStack, /// The entire thread context will be written to the minidump file. ThreadWriteContext, /// Intel Itanium: The backing store memory of every thread will be written to the minidump file. ThreadWriteBackingStore, /// /// A small amount of memory surrounding each thread's instruction pointer will be written to the minidump file. This allows /// instructions near a thread's instruction pointer to be disassembled even if an executable image matching the module cannot /// be found. /// ThreadWriteInstructionWindow, /// /// When the minidump type includes MiniDumpWithProcessThreadData, this flag is set. The callback function can clear this flag /// to control which threads provide complete thread data in the minidump file.DbgHelp 5.1: This value is not supported. /// ThreadWriteThreadData, /// /// When the minidump type includes MiniDumpWithThreadInfo, this flag is set. The callback function can clear this flag to /// control which threads provide thread state information in the minidump file. For more information, see /// MINIDUMP_THREAD_INFO.DbgHelp 6.1 and earlier: This value is not supported. /// ThreadWriteThreadInfo, } /// Reads a stream from a user-mode minidump file. /// /// A pointer to the base of the mapped minidump file. The file should have been mapped into memory using the MapViewOfFile function. /// /// /// The type of data to be read from the minidump file. This member can be one of the values in the MINIDUMP_STREAM_TYPE enumeration. /// /// A pointer to a MINIDUMP_DIRECTORY structure. /// /// A pointer to the beginning of the minidump stream. The format of this stream depends on the value of StreamNumber. For more /// information, see MINIDUMP_STREAM_TYPE. /// /// The size of the stream pointed to by StreamPointer, in bytes. /// If the function succeeds, the return value is TRUE; otherwise, the return value is FALSE. /// In this context, a data stream is a block of data written to a minidump file. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpreaddumpstream BOOL // MiniDumpReadDumpStream( PVOID BaseOfDump, ULONG StreamNumber, PMINIDUMP_DIRECTORY *Dir, PVOID *StreamPointer, ULONG *StreamSize ); [DllImport(Lib_DbgHelp, SetLastError = false, ExactSpelling = true)] [PInvokeData("minidumpapiset.h", MSDNShortId = "NF:minidumpapiset.MiniDumpReadDumpStream")] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool MiniDumpReadDumpStream([In] IntPtr BaseOfDump, uint StreamNumber, out IntPtr Dir, out IntPtr StreamPointer, out uint StreamSize); /// Writes user-mode minidump information to the specified file. /// /// A handle to the process for which the information is to be generated. /// /// This handle must have PROCESS_QUERY_INFORMATION and PROCESS_VM_READ access to the process. If handle information /// is to be collected then PROCESS_DUP_HANDLE access is also required. For more information, see Process Security and Access /// Rights. The caller must also be able to get THREAD_ALL_ACCESS access to the threads in the process. For more information, /// see Thread Security and Access Rights. /// /// /// The identifier of the process for which the information is to be generated. /// A handle to the file in which the information is to be written. /// /// The type of information to be generated. This parameter can be one or more of the values from the MINIDUMP_TYPE enumeration. /// /// /// A pointer to a MINIDUMP_EXCEPTION_INFORMATION structure describing the client exception that caused the minidump to be /// generated. If the value of this parameter is NULL, no exception information is included in the minidump file. /// /// /// A pointer to a MINIDUMP_USER_STREAM_INFORMATION structure. If the value of this parameter is NULL, no user-defined /// information is included in the minidump file. /// /// /// A pointer to a MINIDUMP_CALLBACK_INFORMATION structure that specifies a callback routine which is to receive extended minidump /// information. If the value of this parameter is NULL, no callbacks are performed. /// /// /// /// If the function succeeds, the return value is TRUE; otherwise, the return value is FALSE. To retrieve extended /// error information, call GetLastError. Note that the last error will be an HRESULT value. /// /// If the operation is canceled, the last error code is /// HRESULT_FROM_WIN32(ERROR_CANCELLED) /// . /// /// /// /// /// The MiniDumpCallback function receives extended minidump information from MiniDumpWriteDump. It also provides a way for /// the caller to determine the granularity of information written to the minidump file, as the callback function can filter the /// default information. /// /// /// MiniDumpWriteDump should be called from a separate process if at all possible, rather than from within the target process /// being dumped. This is especially true when the target process is already not stable. For example, if it just crashed. A loader /// deadlock is one of many potential side effects of calling MiniDumpWriteDump from within the target process. /// /// /// MiniDumpWriteDump may not produce a valid stack trace for the calling thread. To work around this problem, you must /// capture the state of the calling thread before calling MiniDumpWriteDump and use it as the ExceptionParam parameter. One /// way to do this is to force an exception inside a __try/ __except block and use the EXCEPTION_POINTERS information /// provided by GetExceptionInformation. Alternatively, you can call the function from a new worker thread and filter this worker /// thread from the dump. /// /// /// All DbgHelp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will /// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more /// than one thread to this function. /// /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump BOOL MiniDumpWriteDump( // HANDLE hProcess, DWORD ProcessId, HANDLE hFile, MINIDUMP_TYPE DumpType, PMINIDUMP_EXCEPTION_INFORMATION ExceptionParam, // PMINIDUMP_USER_STREAM_INFORMATION UserStreamParam, PMINIDUMP_CALLBACK_INFORMATION CallbackParam ); [DllImport(Lib_DbgHelp, SetLastError = true, ExactSpelling = true)] [PInvokeData("minidumpapiset.h", MSDNShortId = "NF:minidumpapiset.MiniDumpWriteDump")] [return: MarshalAs(UnmanagedType.Bool)] public static extern unsafe bool MiniDumpWriteDump(HPROCESS hProcess, uint ProcessId, HFILE hFile, MINIDUMP_TYPE DumpType, [In, Optional] in MINIDUMP_EXCEPTION_INFORMATION ExceptionParam, [In, Optional] in MINIDUMP_USER_STREAM_INFORMATION UserStreamParam, [In, Optional] in MINIDUMP_CALLBACK_INFORMATION CallbackParam); /// Writes user-mode minidump information to the specified file. /// /// A handle to the process for which the information is to be generated. /// /// This handle must have PROCESS_QUERY_INFORMATION and PROCESS_VM_READ access to the process. If handle information /// is to be collected then PROCESS_DUP_HANDLE access is also required. For more information, see Process Security and Access /// Rights. The caller must also be able to get THREAD_ALL_ACCESS access to the threads in the process. For more information, /// see Thread Security and Access Rights. /// /// /// The identifier of the process for which the information is to be generated. /// A handle to the file in which the information is to be written. /// /// The type of information to be generated. This parameter can be one or more of the values from the MINIDUMP_TYPE enumeration. /// /// /// A pointer to a MINIDUMP_EXCEPTION_INFORMATION structure describing the client exception that caused the minidump to be /// generated. If the value of this parameter is NULL, no exception information is included in the minidump file. /// /// /// A pointer to a MINIDUMP_USER_STREAM_INFORMATION structure. If the value of this parameter is NULL, no user-defined /// information is included in the minidump file. /// /// /// A pointer to a MINIDUMP_CALLBACK_INFORMATION structure that specifies a callback routine which is to receive extended minidump /// information. If the value of this parameter is NULL, no callbacks are performed. /// /// /// /// If the function succeeds, the return value is TRUE; otherwise, the return value is FALSE. To retrieve extended /// error information, call GetLastError. Note that the last error will be an HRESULT value. /// /// If the operation is canceled, the last error code is /// HRESULT_FROM_WIN32(ERROR_CANCELLED) /// . /// /// /// /// /// The MiniDumpCallback function receives extended minidump information from MiniDumpWriteDump. It also provides a way for /// the caller to determine the granularity of information written to the minidump file, as the callback function can filter the /// default information. /// /// /// MiniDumpWriteDump should be called from a separate process if at all possible, rather than from within the target process /// being dumped. This is especially true when the target process is already not stable. For example, if it just crashed. A loader /// deadlock is one of many potential side effects of calling MiniDumpWriteDump from within the target process. /// /// /// MiniDumpWriteDump may not produce a valid stack trace for the calling thread. To work around this problem, you must /// capture the state of the calling thread before calling MiniDumpWriteDump and use it as the ExceptionParam parameter. One /// way to do this is to force an exception inside a __try/ __except block and use the EXCEPTION_POINTERS information /// provided by GetExceptionInformation. Alternatively, you can call the function from a new worker thread and filter this worker /// thread from the dump. /// /// /// All DbgHelp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will /// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more /// than one thread to this function. /// /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump BOOL MiniDumpWriteDump( // HANDLE hProcess, DWORD ProcessId, HANDLE hFile, MINIDUMP_TYPE DumpType, PMINIDUMP_EXCEPTION_INFORMATION ExceptionParam, // PMINIDUMP_USER_STREAM_INFORMATION UserStreamParam, PMINIDUMP_CALLBACK_INFORMATION CallbackParam ); [DllImport(Lib_DbgHelp, SetLastError = true, ExactSpelling = true)] [PInvokeData("minidumpapiset.h", MSDNShortId = "NF:minidumpapiset.MiniDumpWriteDump")] [return: MarshalAs(UnmanagedType.Bool)] public static extern unsafe bool MiniDumpWriteDump(HPROCESS hProcess, uint ProcessId, HFILE hFile, MINIDUMP_TYPE DumpType, [In, Optional] in MINIDUMP_EXCEPTION_INFORMATION ExceptionParam, [In, Optional] IntPtr UserStreamParam, [In, Optional] IntPtr CallbackParam); /// Writes user-mode minidump information to the specified file. /// /// A handle to the process for which the information is to be generated. /// /// This handle must have PROCESS_QUERY_INFORMATION and PROCESS_VM_READ access to the process. If handle information /// is to be collected then PROCESS_DUP_HANDLE access is also required. For more information, see Process Security and Access /// Rights. The caller must also be able to get THREAD_ALL_ACCESS access to the threads in the process. For more information, /// see Thread Security and Access Rights. /// /// /// The identifier of the process for which the information is to be generated. /// A handle to the file in which the information is to be written. /// /// The type of information to be generated. This parameter can be one or more of the values from the MINIDUMP_TYPE enumeration. /// /// /// A pointer to a MINIDUMP_EXCEPTION_INFORMATION structure describing the client exception that caused the minidump to be /// generated. If the value of this parameter is NULL, no exception information is included in the minidump file. /// /// /// A pointer to a MINIDUMP_USER_STREAM_INFORMATION structure. If the value of this parameter is NULL, no user-defined /// information is included in the minidump file. /// /// /// A pointer to a MINIDUMP_CALLBACK_INFORMATION structure that specifies a callback routine which is to receive extended minidump /// information. If the value of this parameter is NULL, no callbacks are performed. /// /// /// /// If the function succeeds, the return value is TRUE; otherwise, the return value is FALSE. To retrieve extended /// error information, call GetLastError. Note that the last error will be an HRESULT value. /// /// If the operation is canceled, the last error code is /// HRESULT_FROM_WIN32(ERROR_CANCELLED) /// . /// /// /// /// /// The MiniDumpCallback function receives extended minidump information from MiniDumpWriteDump. It also provides a way for /// the caller to determine the granularity of information written to the minidump file, as the callback function can filter the /// default information. /// /// /// MiniDumpWriteDump should be called from a separate process if at all possible, rather than from within the target process /// being dumped. This is especially true when the target process is already not stable. For example, if it just crashed. A loader /// deadlock is one of many potential side effects of calling MiniDumpWriteDump from within the target process. /// /// /// MiniDumpWriteDump may not produce a valid stack trace for the calling thread. To work around this problem, you must /// capture the state of the calling thread before calling MiniDumpWriteDump and use it as the ExceptionParam parameter. One /// way to do this is to force an exception inside a __try/ __except block and use the EXCEPTION_POINTERS information /// provided by GetExceptionInformation. Alternatively, you can call the function from a new worker thread and filter this worker /// thread from the dump. /// /// /// All DbgHelp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will /// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more /// than one thread to this function. /// /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump BOOL MiniDumpWriteDump( // HANDLE hProcess, DWORD ProcessId, HANDLE hFile, MINIDUMP_TYPE DumpType, PMINIDUMP_EXCEPTION_INFORMATION ExceptionParam, // PMINIDUMP_USER_STREAM_INFORMATION UserStreamParam, PMINIDUMP_CALLBACK_INFORMATION CallbackParam ); [DllImport(Lib_DbgHelp, SetLastError = true, ExactSpelling = true)] [PInvokeData("minidumpapiset.h", MSDNShortId = "NF:minidumpapiset.MiniDumpWriteDump")] [return: MarshalAs(UnmanagedType.Bool)] public static extern unsafe bool MiniDumpWriteDump(HPROCESS hProcess, uint ProcessId, HFILE hFile, MINIDUMP_TYPE DumpType, [In, Optional] IntPtr ExceptionParam, [In, Optional] IntPtr UserStreamParam, [In, Optional] IntPtr CallbackParam); /// [StructLayout(LayoutKind.Sequential, Size = #if x64 1232)] #else 716)] #endif public struct CONTEXT { private ulong f0; } /// [PInvokeData("minidumpapiset.h")] [StructLayout(LayoutKind.Sequential)] public struct CPU_INFORMATION { /// X86 platforms use CPUID function to obtain processor information. [StructLayout(LayoutKind.Sequential)] public struct X86CPUINFO { /// CPUID Subfunction 0, register EAX (VendorId [0]), EBX (VendorId [1]) and ECX (VendorId [2]). [MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)] public uint[] VendorId; /// CPUID Subfunction 1, register EAX public uint VersionInformation; /// CPUID Subfunction 1, register EDX public uint FeatureInformation; /// CPUID, Subfunction 80000001, register EBX. This will only be obtained if the vendor id is "AuthenticAMD". public uint AMDExtendedCpuFeatures; } /// X86 platforms use CPUID function to obtain processor information. public X86CPUINFO X86CpuInfo; /// Non-x86 platforms use processor feature flags. [StructLayout(LayoutKind.Sequential)] public struct OTHERCPUINFO { /// Non-x86 platforms use processor feature flags. [MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)] public ulong[] ProcessorFeatures; } /// Non-x86 platforms use processor feature flags. public OTHERCPUINFO OtherCpuInfo; } /// Contains a pointer to an optional callback function that can be used by the MiniDumpWriteDump function. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_callback_information typedef struct // _MINIDUMP_CALLBACK_INFORMATION { MINIDUMP_CALLBACK_ROUTINE CallbackRoutine; PVOID CallbackParam; } MINIDUMP_CALLBACK_INFORMATION, *PMINIDUMP_CALLBACK_INFORMATION; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_CALLBACK_INFORMATION")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_CALLBACK_INFORMATION { /// A pointer to the MiniDumpCallback callback function. [MarshalAs(UnmanagedType.FunctionPtr)] public MINIDUMP_CALLBACK_ROUTINE CallbackRoutine; /// The application-defined data for CallbackRoutine. public IntPtr CallbackParam; } /// Contains information used by the MiniDumpCallback function. /// /// If CallbackType is CancelCallback or MemoryCallback, the ProcessId, ProcessHandle, and /// CallbackType members are valid but no other input is specified. /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_callback_input typedef struct // _MINIDUMP_CALLBACK_INPUT { ULONG ProcessId; HANDLE ProcessHandle; ULONG CallbackType; union { HRESULT Status; // MINIDUMP_THREAD_CALLBACK Thread; MINIDUMP_THREAD_EX_CALLBACK ThreadEx; MINIDUMP_MODULE_CALLBACK Module; // MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread; MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule; MINIDUMP_IO_CALLBACK Io; // MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure; ULONG SecondaryFlags; MINIDUMP_VM_QUERY_CALLBACK VmQuery; // MINIDUMP_VM_PRE_READ_CALLBACK VmPreRead; MINIDUMP_VM_POST_READ_CALLBACK VmPostRead; }; } MINIDUMP_CALLBACK_INPUT, *PMINIDUMP_CALLBACK_INPUT; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_CALLBACK_INPUT")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_CALLBACK_INPUT { /// /// The identifier of the process that contains callback function. /// This member is not used if CallbackType is IoStartCallback. /// public uint ProcessId; /// /// A handle to the process that contains the callback function. /// This member is not used if CallbackType is IoStartCallback. /// public HPROCESS ProcessHandle; /// The type of callback function. This member can be one of the values in the MINIDUMP_CALLBACK_TYPE enumeration. public MINIDUMP_CALLBACK_TYPE CallbackType; /// Internal union. private UNION Union; /// /// If CallbackType is KernelMinidumpStatusCallback, the union is an HRESULT value that indicates the /// status of the kernel minidump write attempt. /// public HRESULT Status { get => Union.Status; set => Union.Status = value; } /// If CallbackType is ThreadCallback, the union is a MINIDUMP_THREAD_CALLBACK structure. public MINIDUMP_THREAD_CALLBACK Thread { get => Union.Thread; set => Union.Thread = value; } /// If CallbackType is ThreadExCallback, the union is a MINIDUMP_THREAD_EX_CALLBACK structure. public MINIDUMP_THREAD_EX_CALLBACK ThreadEx { get => Union.ThreadEx; set => Union.ThreadEx = value; } /// If CallbackType is ModuleCallback, the union is a MINIDUMP_MODULE_CALLBACK structure. public MINIDUMP_MODULE_CALLBACK Module { get => Union.Module; set => Union.Module = value; } /// /// If CallbackType is IncludeThreadCallback, the union is a MINIDUMP_INCLUDE_THREAD_CALLBACK structure. /// DbgHelp 6.2 and earlier: This member is not available. /// public MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread { get => Union.IncludeThread; set => Union.IncludeThread = value; } /// /// If CallbackType is IncludeModuleCallback, the union is a MINIDUMP_INCLUDE_MODULE_CALLBACK structure. /// DbgHelp 6.2 and earlier: This member is not available. /// public MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule { get => Union.IncludeModule; set => Union.IncludeModule = value; } /// /// /// If CallbackType is IoStartCallback, IoWriteAllCallback, or IoFinishCallback, the union is a /// MINIDUMP_IO_CALLBACK structure. /// /// DbgHelp 6.4 and earlier: This member is not available. /// public MINIDUMP_IO_CALLBACK Io { get => Union.Io; set => Union.Io = value; } /// /// /// If CallbackType is ReadMemoryFailureCallback, the union is a MINIDUMP_READ_MEMORY_FAILURE_CALLBACK structure. /// /// DbgHelp 6.4 and earlier: This member is not available. /// public MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure { get => Union.ReadMemoryFailure; set => Union.ReadMemoryFailure = value; } /// /// Contains a value from the MINIDUMP_SECONDARY_FLAGS enumeration type. /// DbgHelp 6.5 and earlier: This member is not available. /// public MINIDUMP_SECONDARY_FLAGS SecondaryFlags { get => Union.SecondaryFlags; set => Union.SecondaryFlags = value; } /// public MINIDUMP_VM_QUERY_CALLBACK VmQuery { get => Union.VmQuery; set => Union.VmQuery = value; } /// public MINIDUMP_VM_PRE_READ_CALLBACK VmPreRead { get => Union.VmPreRead; set => Union.VmPreRead = value; } /// public MINIDUMP_VM_POST_READ_CALLBACK VmPostRead { get => Union.VmPostRead; set => Union.VmPostRead = value; } /// Internal union. [StructLayout(LayoutKind.Explicit)] private struct UNION { [FieldOffset(0)] internal HRESULT Status; [FieldOffset(0)] internal MINIDUMP_THREAD_CALLBACK Thread; [FieldOffset(0)] internal MINIDUMP_THREAD_EX_CALLBACK ThreadEx; [FieldOffset(0)] internal MINIDUMP_MODULE_CALLBACK Module; [FieldOffset(0)] internal MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread; [FieldOffset(0)] internal MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule; [FieldOffset(0)] internal MINIDUMP_IO_CALLBACK Io; [FieldOffset(0)] internal MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure; [FieldOffset(0)] internal MINIDUMP_SECONDARY_FLAGS SecondaryFlags; [FieldOffset(0)] internal MINIDUMP_VM_QUERY_CALLBACK VmQuery; [FieldOffset(0)] internal MINIDUMP_VM_PRE_READ_CALLBACK VmPreRead; [FieldOffset(0)] internal MINIDUMP_VM_POST_READ_CALLBACK VmPostRead; } } /// Contains information returned by the MiniDumpCallback function. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_callback_output typedef struct // _MINIDUMP_CALLBACK_OUTPUT { union { ULONG ModuleWriteFlags; ULONG ThreadWriteFlags; ULONG SecondaryFlags; struct { ULONG64 // MemoryBase; ULONG MemorySize; }; struct { BOOL CheckCancel; BOOL Cancel; }; HANDLE Handle; struct { MINIDUMP_MEMORY_INFO // VmRegion; BOOL Continue; }; struct { HRESULT VmQueryStatus; MINIDUMP_MEMORY_INFO VmQueryResult; }; struct { HRESULT VmReadStatus; // ULONG VmReadBytesCompleted; }; HRESULT Status; }; } MINIDUMP_CALLBACK_OUTPUT, *PMINIDUMP_CALLBACK_OUTPUT; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_CALLBACK_OUTPUT")] [StructLayout(LayoutKind.Explicit)] public struct MINIDUMP_CALLBACK_OUTPUT { /// /// /// The module write operation flags. This member can be one or more of the values in the MODULE_WRITE_FLAGS enumeration. The /// flags are set to their default values on entry to the callback. /// /// This member is ignored unless the callback type is IncludeModuleCallback or ModuleCallback. /// [FieldOffset(0)] public MODULE_WRITE_FLAGS ModuleWriteFlags; /// /// /// The thread write operation flags. This member can be one or more of the values in the THREAD_WRITE_FLAGS enumeration. The /// flags are set to their default values on entry to the callback. /// /// This member is ignored unless the callback type is IncludeThreadCallback, ThreadCallback, or ThreadExCallback. /// [FieldOffset(0)] public THREAD_WRITE_FLAGS ThreadWriteFlags; /// /// Contains a value from the MINIDUMP_SECONDARY_FLAGS enumeration type. /// DbgHelp 6.5 and earlier: This member is not available. /// [FieldOffset(0)] public MINIDUMP_SECONDARY_FLAGS SecondaryFlags; /// /// The base address of the memory region to be included in the dump. /// This member is ignored unless the callback type is MemoryCallback or RemoveMemoryCallback. /// [FieldOffset(0)] public ulong MemoryBase; /// /// The size of the memory region to be included in the dump, in bytes. /// This member is ignored unless the callback type is MemoryCallback or RemoveMemoryCallback. /// [FieldOffset(8)] public uint MemorySize; /// /// /// Controls whether the callback function should receive cancel callbacks. If this member is TRUE, the cancel callbacks /// will continue. Otherwise, they will not. /// /// This member is ignored unless the callback type is CancelCallback. /// [FieldOffset(0)] [MarshalAs(UnmanagedType.Bool)] public bool CheckCancel; /// /// /// Controls whether the dump should be canceled. If the callback function returns TRUE and Cancel is TRUE, /// the dump will be canceled. In this case, the MiniDumpWriteDump function fails and the dump is not valid. /// /// This member is ignored unless the callback type is CancelCallback. /// [FieldOffset(4)] [MarshalAs(UnmanagedType.Bool)] public bool Cancel; /// /// A handle to the file to which a kernel minidump will be written. /// This member is ignored unless the callback type is WriteKernelMinidumpCallback. /// [FieldOffset(0)] public HFILE Handle; /// /// /// A MINIDUMP_MEMORY_INFO structure that describes the virtual memory region. The region base and size must be aligned on a /// page boundary. The region size can be set to 0 to filter out the region. /// /// This member is ignored unless the callback type is IncludeVmRegionCallback. /// [FieldOffset(0)] public MINIDUMP_MEMORY_INFO VmRegion; /// /// /// Controls whether the dump should be continued. If the callback function returns TRUE and Continue is /// TRUE, the dump will be continued. Otherwise, the MiniDumpWriteDump function fails and the dump is not valid. /// /// This member is ignored unless the callback type is IncludeVmRegionCallback. /// [FieldOffset(48)] [MarshalAs(UnmanagedType.Bool)] public bool Continue; /// [FieldOffset(0)] public HRESULT VmQueryStatus; /// public MINIDUMP_MEMORY_INFO VmQueryResult { get => ptrmi.f1; set => ptrmi.f1 = value; } /// [FieldOffset(0)] public HRESULT VmReadStatus; /// public uint VmReadBytesCompleted { get => ptrUint.f1; set => ptrUint.f1 = value; } /// /// The status of the operation. /// /// This member is ignored unless the callback type is ReadMemoryFailureCallback, IoStartCallback, /// IoWriteAllCallback, or IoFinishCallback. /// /// [FieldOffset(0)] public HRESULT Status; [FieldOffset(0)] private PtrUint ptrUint; [FieldOffset(0)] private PtrMI ptrmi; [StructLayout(LayoutKind.Sequential)] private struct PtrUint { private IntPtr f0; internal uint f1; } [StructLayout(LayoutKind.Sequential)] private struct PtrMI { private IntPtr f0; internal MINIDUMP_MEMORY_INFO f1; } } /// Contains the information needed to access a specific data stream in a minidump file. /// In this context, a data stream is a block of data within a minidump file. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_directory typedef struct // _MINIDUMP_DIRECTORY { ULONG32 StreamType; MINIDUMP_LOCATION_DESCRIPTOR Location; } MINIDUMP_DIRECTORY, *PMINIDUMP_DIRECTORY; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_DIRECTORY")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_DIRECTORY { /// The type of data stream. This member can be one of the values in the MINIDUMP_STREAM_TYPE enumeration. public MINIDUMP_STREAM_TYPE StreamType; /// A MINIDUMP_LOCATION_DESCRIPTOR structure that specifies the location of the data stream. public MINIDUMP_LOCATION_DESCRIPTOR Location; } /// Contains exception information. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_exception typedef struct // _MINIDUMP_EXCEPTION { ULONG32 ExceptionCode; ULONG32 ExceptionFlags; ULONG64 ExceptionRecord; ULONG64 ExceptionAddress; ULONG32 // NumberParameters; ULONG32 __unusedAlignment; ULONG64 ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; } MINIDUMP_EXCEPTION, *PMINIDUMP_EXCEPTION; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_EXCEPTION")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_EXCEPTION { /// /// /// The reason the exception occurred. This is the code generated by a hardware exception, or the code specified in the /// RaiseException function for a software-generated exception. Following are the exception codes likely to occur due to common /// programming errors. /// /// /// /// Value /// Meaning /// /// /// EXCEPTION_ACCESS_VIOLATION /// The thread tried to read from or write to a virtual address for which it does not have the appropriate access. /// /// /// EXCEPTION_ARRAY_BOUNDS_EXCEEDED /// The thread tried to access an array element that is out of bounds and the underlying hardware supports bounds checking. /// /// /// EXCEPTION_BREAKPOINT /// A breakpoint was encountered. /// /// /// EXCEPTION_DATATYPE_MISALIGNMENT /// /// The thread tried to read or write data that is misaligned on hardware that does not provide alignment. For example, 16-bit /// values must be aligned on 2-byte boundaries; 32-bit values on 4-byte boundaries, and so on. /// /// /// /// EXCEPTION_FLT_DENORMAL_OPERAND /// /// One of the operands in a floating-point operation is denormal. A denormal value is one that is too small to represent as a /// standard floating-point value. /// /// /// /// EXCEPTION_FLT_DIVIDE_BY_ZERO /// The thread tried to divide a floating-point value by a floating-point divisor of zero. /// /// /// EXCEPTION_FLT_INEXACT_RESULT /// The result of a floating-point operation cannot be represented exactly as a decimal fraction. /// /// /// EXCEPTION_FLT_INVALID_OPERATION /// This exception represents any floating-point exception not included in this list. /// /// /// EXCEPTION_FLT_OVERFLOW /// The exponent of a floating-point operation is greater than the magnitude allowed by the corresponding type. /// /// /// EXCEPTION_FLT_STACK_CHECK /// The stack overflowed or underflowed as the result of a floating-point operation. /// /// /// EXCEPTION_FLT_UNDERFLOW /// The exponent of a floating-point operation is less than the magnitude allowed by the corresponding type. /// /// /// EXCEPTION_ILLEGAL_INSTRUCTION /// The thread tried to execute an invalid instruction. /// /// /// EXCEPTION_IN_PAGE_ERROR /// /// The thread tried to access a page that was not present, and the system was unable to load the page. For example, this /// exception might occur if a network connection is lost while running a program over the network. /// /// /// /// EXCEPTION_INT_DIVIDE_BY_ZERO /// The thread tried to divide an integer value by an integer divisor of zero. /// /// /// EXCEPTION_INT_OVERFLOW /// The result of an integer operation caused a carry out of the most significant bit of the result. /// /// /// EXCEPTION_INVALID_DISPOSITION /// /// An exception handler returned an invalid disposition to the exception dispatcher. Programmers using a high-level language /// such as C should never encounter this exception. /// /// /// /// EXCEPTION_NONCONTINUABLE_EXCEPTION /// The thread tried to continue execution after a noncontinuable exception occurred. /// /// /// EXCEPTION_PRIV_INSTRUCTION /// The thread tried to execute an instruction whose operation is not allowed in the current machine mode. /// /// /// EXCEPTION_SINGLE_STEP /// A trace trap or other single-instruction mechanism signaled that one instruction has been executed. /// /// /// EXCEPTION_STACK_OVERFLOW /// The thread used up its stack. /// /// /// /// Another exception code is likely to occur when debugging console processes. It does not arise because of a programming /// error. The DBG_CONTROL_C exception code occurs when CTRL+C is input to a console process that handles CTRL+C signals and is /// being debugged. This exception code is not meant to be handled by applications. It is raised only for the benefit of the /// debugger, and is raised only when a debugger is attached to the console process. /// /// public NTStatus ExceptionCode; /// /// This member can be either zero, indicating a continuable exception, or EXCEPTION_NONCONTINUABLE, indicating a noncontinuable /// exception. Any attempt to continue execution after a noncontinuable exception causes the EXCEPTION_NONCONTINUABLE_EXCEPTION exception. /// public Kernel32.EXCEPTION_FLAG ExceptionFlags; /// /// A pointer to an associated MINIDUMP_EXCEPTION structure. Exception records can be chained together to provide /// additional information when nested exceptions occur. /// public ulong ExceptionRecord; /// The address where the exception occurred. public ulong ExceptionAddress; /// /// The number of parameters associated with the exception. This is the number of defined elements in the /// ExceptionInformation array. /// public uint NumberParameters; /// Reserved for cross-platform structure member alignment. Do not set. private uint unusedAlignment; /// /// /// An array of additional arguments that describe the exception. The RaiseException function can specify this array of /// arguments. For most exception codes, the array elements are undefined. For the following exception code, the array elements /// are defined as follows. /// /// /// /// Exception code /// Meaning /// /// /// EXCEPTION_ACCESS_VIOLATION /// /// The first element of the array contains a read/write flag that indicates the type of operation that caused the access /// violation. If this value is zero, the thread attempted to read the inaccessible data. If this value is 1, the thread /// attempted to write to an inaccessible address. The second array element specifies the virtual address of the inaccessible data. /// /// /// /// [MarshalAs(UnmanagedType.ByValArray, SizeConst = 15)] public ulong[] ExceptionInformation; } /// Contains the exception information written to the minidump file by the MiniDumpWriteDump function. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_exception_information typedef struct // _MINIDUMP_EXCEPTION_INFORMATION { DWORD ThreadId; PEXCEPTION_POINTERS ExceptionPointers; BOOL ClientPointers; } // MINIDUMP_EXCEPTION_INFORMATION, *PMINIDUMP_EXCEPTION_INFORMATION; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_EXCEPTION_INFORMATION")] [StructLayout(LayoutKind.Sequential, Pack = 4)] public struct MINIDUMP_EXCEPTION_INFORMATION { /// The identifier of the thread throwing the exception. public uint ThreadId; /// /// A pointer to an EXCEPTION_POINTERS structure specifying a computer-independent description of the exception and the /// processor context at the time of the exception. /// public IntPtr ExceptionPointers; /// /// Determines where to get the memory regions pointed to by the ExceptionPointers member. Set to TRUE if the /// memory resides in the process being debugged (the target process of the debugger). Otherwise, set to FALSE if the /// memory resides in the address space of the calling program (the debugger process). If you are accessing local memory (in the /// calling process) you should not set this member to TRUE. /// [MarshalAs(UnmanagedType.Bool)] public bool ClientPointers; } /// Represents an exception information stream. /// In this context, a data stream is a set of data in a minidump file. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_exception_stream typedef struct // MINIDUMP_EXCEPTION_STREAM { ULONG32 ThreadId; ULONG32 __alignment; MINIDUMP_EXCEPTION ExceptionRecord; // MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; } MINIDUMP_EXCEPTION_STREAM, *PMINIDUMP_EXCEPTION_STREAM; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset.MINIDUMP_EXCEPTION_STREAM")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_EXCEPTION_STREAM { /// The identifier of the thread that caused the exception. public uint ThreadId; /// A variable for alignment. private uint __alignment; /// A MINIDUMP_EXCEPTION structure. public MINIDUMP_EXCEPTION ExceptionRecord; /// A MINIDUMP_LOCATION_DESCRIPTOR structure. public MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; } /// Represents a function table stream. /// /// The first descriptor in the function table stream follows the header, MINIDUMP_FUNCTION_TABLE_STREAM. The generic descriptor is /// followed by a native system descriptor, then by EntryCount native system function entry structures. /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_function_table_descriptor typedef // struct _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR { ULONG64 MinimumAddress; ULONG64 MaximumAddress; ULONG64 BaseAddress; ULONG32 // EntryCount; ULONG32 SizeOfAlignPad; } MINIDUMP_FUNCTION_TABLE_DESCRIPTOR, *PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_FUNCTION_TABLE_DESCRIPTOR")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_FUNCTION_TABLE_DESCRIPTOR { /// The minimum address of functions described by the table. public ulong MinimumAddress; /// The maximum address of functions described by the table. public ulong MaximumAddress; /// The base address to use when computing full virtual addresses from relative virtual addresses in function entries. public ulong BaseAddress; /// The number of entries in the function table. public uint EntryCount; /// /// The size of alignment padding that follows the function entry data, in bytes. The function entry data in the stream is /// guaranteed to be aligned appropriately for access to the data members. If a minidump is directly mapped in memory, it is /// always possible to directly reference structure members in the stream. /// public uint SizeOfAlignPad; } /// Represents the header for the function table stream. /// /// In this context, a data stream is a set of data in a minidump file. This header structure is followed by /// NumberOfDescriptors function tables. For each function table there is a MINIDUMP_FUNCTION_TABLE_DESCRIPTOR structure, /// then the raw system descriptor for the table, then the raw system function entry data. If necessary, alignment padding is placed /// between tables to properly align the initial structures. /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_function_table_stream typedef struct // _MINIDUMP_FUNCTION_TABLE_STREAM { ULONG32 SizeOfHeader; ULONG32 SizeOfDescriptor; ULONG32 SizeOfNativeDescriptor; ULONG32 // SizeOfFunctionEntry; ULONG32 NumberOfDescriptors; ULONG32 SizeOfAlignPad; } MINIDUMP_FUNCTION_TABLE_STREAM, *PMINIDUMP_FUNCTION_TABLE_STREAM; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_FUNCTION_TABLE_STREAM")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_FUNCTION_TABLE_STREAM { /// /// The size of header information for the stream, in bytes. This value is /// sizeof(MINIDUMP_FUNCTION_TABLE_STREAM) /// . /// public uint SizeOfHeader; /// /// The size of a descriptor in the stream, in bytes. This value is /// sizeof(MINIDUMP_FUNCTION_TABLE_DESCRIPTOR) /// . /// public uint SizeOfDescriptor; /// /// The size of a raw system descriptor in the stream, in bytes. This value depends on the particular platform and system /// version on which the minidump was generated. /// public uint SizeOfNativeDescriptor; /// /// The size of a raw system function table entry, in bytes. This value depends on the particular platform and system version on /// which the minidump was generated. /// public uint SizeOfFunctionEntry; /// The number of descriptors in the stream. public uint NumberOfDescriptors; /// The size of alignment padding that follows the header, in bytes. public uint SizeOfAlignPad; } /// Represents the header for a handle data stream. /// /// In this context, a data stream is a set of data in a minidump file. This header structure is followed by /// NumberOfDescriptors MINIDUMP_HANDLE_DESCRIPTOR or MINIDUMP_HANDLE_DESCRIPTOR_2 structures. /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_handle_data_stream typedef struct // _MINIDUMP_HANDLE_DATA_STREAM { ULONG32 SizeOfHeader; ULONG32 SizeOfDescriptor; ULONG32 NumberOfDescriptors; ULONG32 Reserved; } // MINIDUMP_HANDLE_DATA_STREAM, *PMINIDUMP_HANDLE_DATA_STREAM; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_HANDLE_DATA_STREAM")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_HANDLE_DATA_STREAM { /// /// The size of the header information for the stream, in bytes. This value is /// sizeof(MINIDUMP_HANDLE_DATA_STREAM) /// . /// public uint SizeOfHeader; /// /// The size of a descriptor in the stream, in bytes. This value is /// sizeof(MINIDUMP_HANDLE_DESCRIPTOR) /// or /// sizeof(MINIDUMP_HANDLE_DESCRIPTOR_2) /// . /// public uint SizeOfDescriptor; /// The number of descriptors in the stream. public uint NumberOfDescriptors; /// Reserved for future use; must be zero. public uint Reserved; } /// Contains the state of an individual system handle at the time the minidump was written. /// The first descriptor in the handle data stream follows the header, MINIDUMP_HANDLE_DATA_STREAM. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_handle_descriptor typedef struct // _MINIDUMP_HANDLE_DESCRIPTOR { ULONG64 Handle; RVA TypeNameRva; RVA ObjectNameRva; ULONG32 Attributes; ULONG32 GrantedAccess; // ULONG32 HandleCount; ULONG32 PointerCount; } MINIDUMP_HANDLE_DESCRIPTOR, *PMINIDUMP_HANDLE_DESCRIPTOR; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_HANDLE_DESCRIPTOR")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_HANDLE_DESCRIPTOR { /// The operating system handle value. public ulong Handle; /// An RVA to a MINIDUMP_STRING structure that specifies the object type of the handle. This member can be zero. public uint TypeNameRva; /// An RVA to a MINIDUMP_STRING structure that specifies the object name of the handle. This member can be zero. public uint ObjectNameRva; /// The meaning of this member depends on the handle type and the operating system. public uint Attributes; /// The meaning of this member depends on the handle type and the operating system. public uint GrantedAccess; /// The meaning of this member depends on the handle type and the operating system. public uint HandleCount; /// The meaning of this member depends on the handle type and the operating system. public uint PointerCount; } /// Describes the state of an individual system handle at the time the minidump was written. /// The first descriptor in the handle data stream follows the header, MINIDUMP_HANDLE_DATA_STREAM. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_handle_descriptor_2 typedef struct // _MINIDUMP_HANDLE_DESCRIPTOR_2 { ULONG64 Handle; RVA TypeNameRva; RVA ObjectNameRva; ULONG32 Attributes; ULONG32 GrantedAccess; // ULONG32 HandleCount; ULONG32 PointerCount; RVA ObjectInfoRva; ULONG32 Reserved0; } MINIDUMP_HANDLE_DESCRIPTOR_2, *PMINIDUMP_HANDLE_DESCRIPTOR_2; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_HANDLE_DESCRIPTOR_2")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_HANDLE_DESCRIPTOR_2 { /// The operating system handle value. public ulong Handle; /// An RVA to a MINIDUMP_STRING structure that specifies the object type of the handle. This member can be zero. public uint TypeNameRva; /// An RVA to a MINIDUMP_STRING structure that specifies the object name of the handle. This member can be 0. public uint ObjectNameRva; /// The meaning of this member depends on the handle type and the operating system. public uint Attributes; /// The meaning of this member depends on the handle type and the operating system. public uint GrantedAccess; /// The meaning of this member depends on the handle type and the operating system. public uint HandleCount; /// The meaning of this member depends on the handle type and the operating system. public uint PointerCount; /// /// An RVA to a MINIDUMP_HANDLE_OBJECT_INFORMATION structure that specifies object-specific information. This member can be 0 if /// there is no extra information. /// public uint ObjectInfoRva; /// Reserved for future use; must be zero. public uint Reserved0; } /// Contains object-specific information for a handle. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_handle_object_information typedef // struct _MINIDUMP_HANDLE_OBJECT_INFORMATION { RVA NextInfoRva; ULONG32 InfoType; ULONG32 SizeOfInfo; } MINIDUMP_HANDLE_OBJECT_INFORMATION; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_HANDLE_OBJECT_INFORMATION")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_HANDLE_OBJECT_INFORMATION { /// /// An RVA to a MINIDUMP_HANDLE_OBJECT_INFORMATION structure that specifies additional object-specific information. This /// member is 0 if there are no more elements in the list. /// public uint NextInfoRva; /// /// The object information type. This member is one of the values from the MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE enumeration. /// public MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE InfoType; /// The size of the information that follows this member, in bytes. public uint SizeOfInfo; } /// Contains a list of handle operations. /// For a definition of the AVRF_HANDLE_OPERATION structure, see the Avrfsdk.h header file. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_handle_operation_list typedef struct // _MINIDUMP_HANDLE_OPERATION_LIST { ULONG32 SizeOfHeader; ULONG32 SizeOfEntry; ULONG32 NumberOfEntries; ULONG32 Reserved; } // MINIDUMP_HANDLE_OPERATION_LIST, *PMINIDUMP_HANDLE_OPERATION_LIST; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_HANDLE_OPERATION_LIST")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_HANDLE_OPERATION_LIST { /// /// The size of the header data for the stream, in bytes. This is generally /// sizeof(MINIDUMP_HANDLE_OPERATION_LIST) /// . /// public uint SizeOfHeader; /// /// The size of each entry following the header, in bytes. This is generally /// sizeof(AVRF_HANDLE_OPERATION) /// . /// public uint SizeOfEntry; /// /// The number of entries in the stream. These are generally AVRF_HANDLE_OPERATION structures. The entries follow the header. /// public uint NumberOfEntries; /// This member is reserved for future use. public uint Reserved; } /// Contains header information for the minidump file. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_header typedef struct // _MINIDUMP_HEADER { ULONG32 Signature; ULONG32 Version; ULONG32 NumberOfStreams; RVA StreamDirectoryRva; ULONG32 CheckSum; union { // ULONG32 Reserved; ULONG32 TimeDateStamp; }; ULONG64 Flags; } MINIDUMP_HEADER, *PMINIDUMP_HEADER; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_HEADER")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_HEADER { /// The signature. Set this member to MINIDUMP_SIGNATURE. public uint Signature; /// /// The version of the minidump format. The low-order word is MINIDUMP_VERSION. The high-order word is an internal value that is /// implementation specific. /// public uint Version; /// The number of streams in the minidump directory. public uint NumberOfStreams; /// The base RVA of the minidump directory. The directory is an array of MINIDUMP_DIRECTORY structures. public uint StreamDirectoryRva; /// The checksum for the minidump file. This member can be zero. public uint CheckSum; /// Time and date, in time_t format. public time_t TimeDateStamp; /// One or more values from the MINIDUMP_TYPE enumeration type. public ulong Flags; } /// Contains information for the MiniDumpCallback function when the callback type is IncludeModuleCallback. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_include_module_callback typedef // struct _MINIDUMP_INCLUDE_MODULE_CALLBACK { ULONG64 BaseOfImage; } MINIDUMP_INCLUDE_MODULE_CALLBACK, *PMINIDUMP_INCLUDE_MODULE_CALLBACK; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_INCLUDE_MODULE_CALLBACK")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_INCLUDE_MODULE_CALLBACK { /// The base address of the executable image in memory. public ulong BaseOfImage; } /// Contains information for the MiniDumpCallback function when the callback type is IncludeThreadCallback. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_include_thread_callback typedef // struct _MINIDUMP_INCLUDE_THREAD_CALLBACK { ULONG ThreadId; } MINIDUMP_INCLUDE_THREAD_CALLBACK, *PMINIDUMP_INCLUDE_THREAD_CALLBACK; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_INCLUDE_THREAD_CALLBACK")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_INCLUDE_THREAD_CALLBACK { /// The identifier of the thread. public uint ThreadId; } /// /// Contains I/O callback information. This structure is used by the MiniDumpCallbackfunction when the callback type is /// IoStartCallback, IoWriteAllCallback, or IoFinishCallback. /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_io_callback typedef struct // _MINIDUMP_IO_CALLBACK { HANDLE Handle; ULONG64 Offset; PVOID Buffer; ULONG BufferBytes; } MINIDUMP_IO_CALLBACK, *PMINIDUMP_IO_CALLBACK; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_IO_CALLBACK")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_IO_CALLBACK { /// The file handle passed to the MiniDumpWriteDump function. public HFILE Handle; /// The offset for the write operation from the start of the minidump data. This member is used only with IoWriteAllCallback. public ulong Offset; /// A pointer to a buffer that contains the data to be written. This member is used only with IoWriteAllCallback. public IntPtr Buffer; /// The size of the data buffer, in bytes. This member is used only with IoWriteAllCallback. public uint BufferBytes; } /// Contains information describing the location of a data stream within a minidump file. /// /// In this context, a data stream refers to a block of data within a minidump file. /// /// This structure uses 32-bit locations for RVAs in the first 4GB and 64-bit locations are used for larger RVAs. The /// MINIDUMP_LOCATION_DESCRIPTOR64 structure is defined as follows. /// /// /// typedef struct _MINIDUMP_LOCATION_DESCRIPTOR64 { ULONG64 DataSize; RVA64 Rva; } MINIDUMP_LOCATION_DESCRIPTOR64; /// /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_location_descriptor typedef struct // _MINIDUMP_LOCATION_DESCRIPTOR { ULONG32 DataSize; RVA Rva; } MINIDUMP_LOCATION_DESCRIPTOR; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_LOCATION_DESCRIPTOR")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_LOCATION_DESCRIPTOR { /// The size of the data stream, in bytes. public uint DataSize; /// /// The relative virtual address (RVA) of the data. This is the byte offset of the data stream from the beginning of the /// minidump file. /// public uint Rva; } /// Describes a range of memory. /// /// /// MINIDUMP_MEMORY_DESCRIPTOR64 is used for full-memory minidumps where all of the raw memory is sequential at the end of /// the minidump. There is no need for individual relative virtual addresses (RVAs), because the RVA is the base RVA plus the sum of /// the preceding data blocks. The MINIDUMP_MEMORY_DESCRIPTOR64 structure is defined as follows. /// /// /// typedef struct _MINIDUMP_MEMORY_DESCRIPTOR64 { ULONG64 StartOfMemoryRange; ULONG64 DataSize; } MINIDUMP_MEMORY_DESCRIPTOR64, *PMINIDUMP_MEMORY_DESCRIPTOR64; /// /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_memory_descriptor typedef struct // _MINIDUMP_MEMORY_DESCRIPTOR { ULONG64 StartOfMemoryRange; MINIDUMP_LOCATION_DESCRIPTOR Memory; } MINIDUMP_MEMORY_DESCRIPTOR, *PMINIDUMP_MEMORY_DESCRIPTOR; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MEMORY_DESCRIPTOR")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_MEMORY_DESCRIPTOR { /// The starting address of the memory range. public ulong StartOfMemoryRange; /// A MINIDUMP_LOCATION_DESCRIPTOR structure. public MINIDUMP_LOCATION_DESCRIPTOR Memory; } /// Describes a region of memory. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_memory_info typedef struct // _MINIDUMP_MEMORY_INFO { ULONG64 BaseAddress; ULONG64 AllocationBase; ULONG32 AllocationProtect; ULONG32 __alignment1; ULONG64 // RegionSize; ULONG32 State; ULONG32 Protect; ULONG32 Type; ULONG32 __alignment2; } MINIDUMP_MEMORY_INFO, *PMINIDUMP_MEMORY_INFO; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MEMORY_INFO")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_MEMORY_INFO { /// The base address of the region of pages. public ulong BaseAddress; /// The base address of a range of pages in this region. The page is contained within this memory region. public ulong AllocationBase; /// /// The memory protection when the region was initially allocated. This member can be one of the memory protection options, /// along with PAGE_GUARD or PAGE_NOCACHE, as needed. /// public uint AllocationProtect; /// A variable for alignment. private uint __alignment1; /// The size of the region beginning at the base address in which all pages have identical attributes, in bytes. public ulong RegionSize; /// /// The state of the pages in the region. This member can be one of the following values. /// /// /// State /// Meaning /// /// /// MEM_COMMIT 0x1000 /// /// Indicates committed pages for which physical storage has been allocated, either in memory or in the paging file on disk. /// /// /// /// MEM_FREE 0x10000 /// /// Indicates free pages not accessible to the calling process and available to be allocated. For free pages, the information in /// the AllocationBase, AllocationProtect, Protect, and Type members is undefined. /// /// /// /// MEM_RESERVE 0x2000 /// /// Indicates reserved pages where a range of the process's virtual address space is reserved without any physical storage being /// allocated. For reserved pages, the information in the Protect member is undefined. /// /// /// /// public uint State; /// /// The access protection of the pages in the region. This member is one of the values listed for the AllocationProtect member. /// public uint Protect; /// /// The type of pages in the region. The following types are defined. /// /// /// Type /// Meaning /// /// /// MEM_IMAGE 0x1000000 /// Indicates that the memory pages within the region are mapped into the view of an image section. /// /// /// MEM_MAPPED 0x40000 /// Indicates that the memory pages within the region are mapped into the view of a section. /// /// /// MEM_PRIVATE 0x20000 /// Indicates that the memory pages within the region are private (that is, not shared by other processes). /// /// /// public uint Type; /// A variable for alignment. private uint __alignment2; } /// Contains a list of memory regions. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_memory_info_list typedef struct // _MINIDUMP_MEMORY_INFO_LIST { ULONG SizeOfHeader; ULONG SizeOfEntry; ULONG64 NumberOfEntries; } MINIDUMP_MEMORY_INFO_LIST, *PMINIDUMP_MEMORY_INFO_LIST; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MEMORY_INFO_LIST")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_MEMORY_INFO_LIST { /// /// The size of the header data for the stream, in bytes. This is generally /// sizeof(MINIDUMP_MEMORY_INFO_LIST) /// . /// public uint SizeOfHeader; /// /// The size of each entry following the header, in bytes. This is generally /// sizeof(MINIDUMP_MEMORY_INFO) /// . /// public uint SizeOfEntry; /// /// The number of entries in the stream. These are generally MINIDUMP_MEMORY_INFO structures. The entries follow the header. /// public ulong NumberOfEntries; } /// Contains a list of memory ranges. /// /// The MINIDUMP_MEMORY64_LIST structure is defined as follows. It is used for full-memory minidumps. /// /// typedef struct _MINIDUMP_MEMORY64_LIST { ULONG64 NumberOfMemoryRanges; RVA64 BaseRva; MINIDUMP_MEMORY_DESCRIPTOR64 MemoryRanges [0]; } MINIDUMP_MEMORY64_LIST, *PMINIDUMP_MEMORY64_LIST; /// /// /// Note that BaseRva is the overall base RVA for the memory list. To locate the data for a particular descriptor, start at /// BaseRva and increment by the size of a descriptor until you reach the descriptor. /// /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_memory_list typedef struct // _MINIDUMP_MEMORY_LIST { ULONG32 NumberOfMemoryRanges; MINIDUMP_MEMORY_DESCRIPTOR MemoryRanges[0]; } MINIDUMP_MEMORY_LIST, *PMINIDUMP_MEMORY_LIST; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MEMORY_LIST")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_MEMORY_LIST { /// The number of structures in the MemoryRanges array. public uint NumberOfMemoryRanges; /// An array of MINIDUMP_MEMORY_DESCRIPTOR structures. public MINIDUMP_MEMORY_DESCRIPTOR[] MemoryRanges; } /// Contains a variety of information. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_misc_info typedef struct // _MINIDUMP_MISC_INFO { ULONG32 SizeOfInfo; ULONG32 Flags1; ULONG32 ProcessId; ULONG32 ProcessCreateTime; ULONG32 ProcessUserTime; // ULONG32 ProcessKernelTime; } MINIDUMP_MISC_INFO, *PMINIDUMP_MISC_INFO; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MISC_INFO")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_MISC_INFO { /// The size of the structure, in bytes. public uint SizeOfInfo; /// /// The flags that indicate the valid members of this structure. This member can be one or more of the following values. /// /// /// Value /// Meaning /// /// /// MINIDUMP_MISC1_PROCESS_ID 0x00000001 /// ProcessId is used. /// /// /// MINIDUMP_MISC1_PROCESS_TIMES 0x00000002 /// ProcessCreateTime, ProcessKernelTime, and ProcessUserTime are used. /// /// /// public uint Flags1; /// The identifier of the process. If Flags1 does not specify MINIDUMP_MISC1_PROCESS_ID, this member is unused. public uint ProcessId; /// /// The creation time of the process, in time_t format. If Flags1 does not specify MINIDUMP_MISC1_PROCESS_TIMES, /// this member is unused. /// public uint ProcessCreateTime; /// /// The time the process has executed in user mode, in seconds. The time that each of the threads of the process has executed in /// user mode is determined, then all these times are summed to obtain this value. If Flags1 does not specify /// MINIDUMP_MISC1_PROCESS_TIMES, this member is unused. /// public uint ProcessUserTime; /// /// The time the process has executed in kernel mode, in seconds. The time that each of the threads of the process has executed /// in kernel mode is determined, then all these times are summed to obtain this value. If Flags1 does not specify /// MINIDUMP_MISC1_PROCESS_TIMES, this member is unused. /// public uint ProcessKernelTime; } /// Represents information in the miscellaneous information stream. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_misc_info_2 typedef struct // _MINIDUMP_MISC_INFO_2 { ULONG32 SizeOfInfo; ULONG32 Flags1; ULONG32 ProcessId; ULONG32 ProcessCreateTime; ULONG32 // ProcessUserTime; ULONG32 ProcessKernelTime; ULONG32 ProcessorMaxMhz; ULONG32 ProcessorCurrentMhz; ULONG32 ProcessorMhzLimit; // ULONG32 ProcessorMaxIdleState; ULONG32 ProcessorCurrentIdleState; } MINIDUMP_MISC_INFO_2, *PMINIDUMP_MISC_INFO_2; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MISC_INFO_2")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_MISC_INFO_2 { /// The size of the structure, in bytes. public uint SizeOfInfo; /// /// The flags that indicate the valid members of this structure. This member can be one or more of the following values. /// /// /// Value /// Meaning /// /// /// MINIDUMP_MISC1_PROCESS_ID 0x00000001 /// ProcessId is used. /// /// /// MINIDUMP_MISC1_PROCESS_TIMES 0x00000002 /// ProcessCreateTime, ProcessKernelTime, and ProcessUserTime are used. /// /// /// MINIDUMP_MISC1_PROCESSOR_POWER_INFO 0x00000004 /// /// ProcessorMaxMhz, ProcessorCurrentMhz, ProcessorMhzLimit, ProcessorMaxIdleState, and ProcessorCurrentIdleState are used. /// /// /// /// public uint Flags1; /// /// The identifier of the process. If Flags1 does not specify MINIDUMP_MISC1_PROCESS_ID, this member is unused. /// public uint ProcessId; /// /// The creation time of the process, in time_t format. If Flags1 does not specify /// MINIDUMP_MISC1_PROCESS_TIMES, this member is unused. /// public uint ProcessCreateTime; /// /// The time the process has executed in user mode, in seconds. The time that each of the threads of the process has executed in /// user mode is determined, then all these times are summed to obtain this value. If Flags1 does not specify /// MINIDUMP_MISC1_PROCESS_TIMES, this member is unused. /// public uint ProcessUserTime; /// /// The time the process has executed in kernel mode, in seconds. The time that each of the threads of the process has executed /// in kernel mode is determined, then all these times are summed to obtain this value. If Flags1 does not specify /// MINIDUMP_MISC1_PROCESS_TIMES, this member is unused. /// public uint ProcessKernelTime; /// /// The maximum specified clock frequency of the system processor, in MHz. If Flags1 does not specify /// MINIDUMP_MISC1_PROCESSOR_POWER_INFO, this member is unused. /// public uint ProcessorMaxMhz; /// /// The processor clock frequency, in MHz. This number is the maximum specified processor clock frequency multiplied by the /// current processor throttle. If Flags1 does not specify MINIDUMP_MISC1_PROCESSOR_POWER_INFO, this member is unused. /// public uint ProcessorCurrentMhz; /// /// The limit on the processor clock frequency, in MHz. This number is the maximum specified processor clock frequency /// multiplied by the current processor thermal throttle limit. If Flags1 does not specify /// MINIDUMP_MISC1_PROCESSOR_POWER_INFO, this member is unused. /// public uint ProcessorMhzLimit; /// /// The maximum idle state of the processor. If Flags1 does not specify MINIDUMP_MISC1_PROCESSOR_POWER_INFO, this /// member is unused. /// public uint ProcessorMaxIdleState; /// /// The current idle state of the processor. If Flags1 does not specify MINIDUMP_MISC1_PROCESSOR_POWER_INFO, this /// member is unused. /// public uint ProcessorCurrentIdleState; } /// Contains information for a specific module. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_module typedef struct // _MINIDUMP_MODULE { ULONG64 BaseOfImage; ULONG32 SizeOfImage; ULONG32 CheckSum; ULONG32 TimeDateStamp; RVA ModuleNameRva; // VS_FIXEDFILEINFO VersionInfo; MINIDUMP_LOCATION_DESCRIPTOR CvRecord; MINIDUMP_LOCATION_DESCRIPTOR MiscRecord; ULONG64 Reserved0; // ULONG64 Reserved1; } MINIDUMP_MODULE, *PMINIDUMP_MODULE; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MODULE")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_MODULE { /// The base address of the module executable image in memory. public ulong BaseOfImage; /// The size of the module executable image in memory, in bytes. public uint SizeOfImage; /// The checksum value of the module executable image. public uint CheckSum; /// The timestamp value of the module executable image, in time_t format. public uint TimeDateStamp; /// An RVA to a MINIDUMP_STRING structure that specifies the name of the module. public uint ModuleNameRva; /// A VS_FIXEDFILEINFO structure that specifies the version of the module. public VersionDll.VS_FIXEDFILEINFO VersionInfo; /// A MINIDUMP_LOCATION_DESCRIPTOR structure that specifies the CodeView record of the module. public MINIDUMP_LOCATION_DESCRIPTOR CvRecord; /// A MINIDUMP_LOCATION_DESCRIPTOR structure that specifies the miscellaneous record of the module. public MINIDUMP_LOCATION_DESCRIPTOR MiscRecord; /// Reserved for future use. public ulong Reserved0; /// Reserved for future use. public ulong Reserved1; } /// Contains module information for the MiniDumpCallback function when the callback type is ModuleCallback. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_module_callback typedef struct // _MINIDUMP_MODULE_CALLBACK { PWCHAR FullPath; ULONG64 BaseOfImage; ULONG SizeOfImage; ULONG CheckSum; ULONG TimeDateStamp; // VS_FIXEDFILEINFO VersionInfo; PVOID CvRecord; ULONG SizeOfCvRecord; PVOID MiscRecord; ULONG SizeOfMiscRecord; } // MINIDUMP_MODULE_CALLBACK, *PMINIDUMP_MODULE_CALLBACK; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MODULE_CALLBACK")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_MODULE_CALLBACK { /// The fully qualified path of the module executable. public StrPtrUni FullPath; /// The base address of the module executable image in memory. public ulong BaseOfImage; /// The size of the module executable image in memory, in bytes. public uint SizeOfImage; /// The checksum value of the module executable image. public uint CheckSum; /// The timestamp value of the module executable image, in time_t format. public time_t TimeDateStamp; /// A VS_FIXEDFILEINFO structure that specifies the version of the module. public VersionDll.VS_FIXEDFILEINFO VersionInfo; /// A pointer to a string containing the CodeView record of the module. public IntPtr CvRecord; /// The size of the Codeview record of the module in the CvRecord member, in bytes. public uint SizeOfCvRecord; /// A pointer to a string that specifies the miscellaneous record of the module. public IntPtr MiscRecord; /// The size of the miscellaneous record of the module in the MiscRecord member, in bytes. public uint SizeOfMiscRecord; } /// Contains a list of modules. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_module_list typedef struct // _MINIDUMP_MODULE_LIST { ULONG32 NumberOfModules; MINIDUMP_MODULE Modules[0]; } MINIDUMP_MODULE_LIST, *PMINIDUMP_MODULE_LIST; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MODULE_LIST")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_MODULE_LIST { /// The number of structures in the Modules array. public uint NumberOfModules; /// An array of MINIDUMP_MODULE structures. public MINIDUMP_MODULE[] Modules; } /// /// Contains information about a failed memory read operation. This structure is used by the MiniDumpCallbackfunction when the /// callback type is ReadMemoryFailureCallback. /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_read_memory_failure_callback typedef // struct _MINIDUMP_READ_MEMORY_FAILURE_CALLBACK { ULONG64 Offset; ULONG Bytes; HRESULT FailureStatus; } // MINIDUMP_READ_MEMORY_FAILURE_CALLBACK, *PMINIDUMP_READ_MEMORY_FAILURE_CALLBACK; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_READ_MEMORY_FAILURE_CALLBACK")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_READ_MEMORY_FAILURE_CALLBACK { /// The offset of the address for the failed memory read operation. public ulong Offset; /// The size of the failed memory read operation, in bytes. public uint Bytes; /// The resulting error code from the failed memory read operation. public HRESULT FailureStatus; } /// Describes a string. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_string typedef struct // _MINIDUMP_STRING { ULONG32 Length; WCHAR Buffer[0]; } MINIDUMP_STRING, *PMINIDUMP_STRING; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_STRING")] [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] public struct MINIDUMP_STRING { /// /// The size of the string in the Buffer member, in bytes. This size does not include the null-terminating character. /// public uint Length; /// The null-terminated string. [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 0)] public string Buffer; } /// Contains processor and operating system information. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_system_info typedef struct // _MINIDUMP_SYSTEM_INFO { USHORT ProcessorArchitecture; USHORT ProcessorLevel; USHORT ProcessorRevision; union { USHORT Reserved0; // struct { UCHAR NumberOfProcessors; UCHAR ProductType; }; }; ULONG32 MajorVersion; ULONG32 MinorVersion; ULONG32 BuildNumber; // ULONG32 PlatformId; RVA CSDVersionRva; union { ULONG32 Reserved1; struct { USHORT SuiteMask; USHORT Reserved2; }; }; // CPU_INFORMATION Cpu; } MINIDUMP_SYSTEM_INFO, *PMINIDUMP_SYSTEM_INFO; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_SYSTEM_INFO")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_SYSTEM_INFO { /// /// The system's processor architecture. This member can be one of the following values. /// /// /// Value /// Meaning /// /// /// PROCESSOR_ARCHITECTURE_AMD64 9 /// x64 (AMD or Intel) /// /// /// PROCESSOR_ARCHITECTURE_ARM 5 /// ARM /// /// /// PROCESSOR_ARCHITECTURE_IA64 6 /// Intel Itanium /// /// /// PROCESSOR_ARCHITECTURE_INTEL 0 /// x86 /// /// /// PROCESSOR_ARCHITECTURE_UNKNOWN 0xffff /// Unknown processor. /// /// /// public ProcessorArchitecture ProcessorArchitecture; /// /// The system's architecture-dependent processor level. /// /// If ProcessorArchitecture is PROCESSOR_ARCHITECTURE_INTEL, ProcessorLevel can be one of the following values. /// /// /// /// Value /// Meaning /// /// /// 3 /// Intel 80386 /// /// /// 4 /// Intel 80486 /// /// /// 5 /// Intel Pentium /// /// /// 6 /// Intel Pentium Pro or Pentium II /// /// /// If ProcessorArchitecture is PROCESSOR_ARCHITECTURE_IA64, ProcessorLevel is set to 1. /// public ushort ProcessorLevel; /// /// The architecture-dependent processor revision. /// /// /// Processor /// Value /// /// /// Intel 80386 or 80486 /// /// A value of the form xxyz. If xx is equal to 0xFF, y - 0xA is the model number, and z is the stepping identifier. For /// example, an Intel 80486-D0 system returns 0xFFD0. If xx is not equal to 0xFF, xx + 'A' is the stepping letter and yz is the /// minor stepping. /// /// /// /// Intel Pentium, Cyrix, or NextGen 586 /// /// A value of the form xxyy, where xx is the model number and yy is the stepping. Display this value of 0x0201 as follows: /// Model xx, Stepping yy /// /// /// /// public ushort ProcessorRevision; /// The number of processors in the system. public byte NumberOfProcessors; /// /// Any additional information about the system. This member can be one of the following values. /// /// /// Value /// Meaning /// /// /// VER_NT_DOMAIN_CONTROLLER 0x0000002 /// The system is a domain controller. /// /// /// VER_NT_SERVER 0x0000003 /// The system is a server. /// /// /// VER_NT_WORKSTATION 0x0000001 /// The system is running Windows XP, Windows Vista, Windows 7, or Windows 8. /// /// /// public Kernel32.ProductType ProductType; /// The major version number of the operating system. This member can be 4, 5, or 6. public uint MajorVersion; /// The minor version number of the operating system. public uint MinorVersion; /// The build number of the operating system. public uint BuildNumber; /// /// The operating system platform. This member can be one of the following values. /// /// /// Value /// Meaning /// /// /// VER_PLATFORM_WIN32s 0 /// Not supported /// /// /// VER_PLATFORM_WIN32_WINDOWS 1 /// Not supported. /// /// /// VER_PLATFORM_WIN32_NT 2 /// The operating system platform is Windows. /// /// /// public PlatformID PlatformId; /// /// An RVA (from the beginning of the dump) to a MINIDUMP_STRING that describes the latest Service Pack installed on the system. /// If no Service Pack has been installed, the string is empty. /// public uint CSDVersionRva; /// /// /// The bit flags that identify the product suites available on the system. This member can be a combination of the following values. /// /// /// /// Value /// Meaning /// /// /// VER_SUITE_BACKOFFICE 0x00000004 /// Microsoft BackOffice components are installed. /// /// /// VER_SUITE_BLADE 0x00000400 /// Windows Server 2003, Web Edition is installed. /// /// /// VER_SUITE_COMPUTE_SERVER 0x00004000 /// Windows Server 2003, Compute Cluster Edition is installed. /// /// /// VER_SUITE_DATACENTER 0x00000080 /// Windows Server 2008 R2 Datacenter, Windows Server 2008 Datacenter, or Windows Server 2003, Datacenter Edition is installed. /// /// /// VER_SUITE_ENTERPRISE 0x00000002 /// Windows Server 2008 R2 Enterprise, Windows Server 2008 Enterprise, or Windows Server 2003, Enterprise Edition is installed. /// /// /// VER_SUITE_EMBEDDEDNT 0x00000040 /// Windows Embedded is installed. /// /// /// VER_SUITE_PERSONAL 0x00000200 /// Windows XP Home Edition is installed. /// /// /// VER_SUITE_SINGLEUSERTS 0x00000100 /// /// Remote Desktop is supported, but only one interactive session is supported. This value is set unless the system is running /// in application server mode. /// /// /// /// VER_SUITE_SMALLBUSINESS 0x00000001 /// /// Microsoft Small Business Server was once installed on the system, but may have been upgraded to another version of Windows. /// /// /// /// VER_SUITE_SMALLBUSINESS_RESTRICTED 0x00000020 /// Microsoft Small Business Server is installed with the restrictive client license in force. /// /// /// VER_SUITE_STORAGE_SERVER 0x00002000 /// Windows Storage Server is installed. /// /// /// VER_SUITE_TERMINAL 0x00000010 /// /// Terminal Services is installed. This value is always set. If VER_SUITE_TERMINAL is set but VER_SUITE_SINGLEUSERTS is not /// set, the system is running in application server mode. /// /// /// /// public Kernel32.SuiteMask SuiteMask; /// This member is reserved for future use. public ushort Reserved2; /// /// X86CpuInfo /// The CPU information obtained from the CPUID instruction. This structure is supported only for x86 computers. /// VendorId /// CPUID subfunction 0. The array elements are as follows: /// VersionInformation /// CPUID subfunction 1. Value of EAX. /// FeatureInformation /// CPUID subfunction 1. Value of EDX. /// AMDExtendedCpuFeatures /// CPUID subfunction 80000001. Value of EBX. This member is supported only if the vendor is "AuthenticAMD". /// OtherCpuInfo /// Other CPU information. This structure is supported only for non-x86 computers. /// ProcessorFeatures /// For a list of possible values, see the IsProcessorFeaturePresent function. /// public CPU_INFORMATION Cpu; } /// Contains information for a specific thread. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread typedef struct // _MINIDUMP_THREAD { ULONG32 ThreadId; ULONG32 SuspendCount; ULONG32 PriorityClass; ULONG32 Priority; ULONG64 Teb; // MINIDUMP_MEMORY_DESCRIPTOR Stack; MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; } MINIDUMP_THREAD, *PMINIDUMP_THREAD; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_THREAD { /// The identifier of the thread. public uint ThreadId; /// /// The suspend count for the thread. If the suspend count is greater than zero, the thread is suspended; otherwise, the thread /// is not suspended. The maximum value is MAXIMUM_SUSPEND_COUNT. /// public uint SuspendCount; /// The priority class of the thread. See Scheduling Priorities. public uint PriorityClass; /// The priority level of the thread. public uint Priority; /// The thread environment block. public ulong Teb; /// A MINIDUMP_MEMORY_DESCRIPTOR structure. public MINIDUMP_MEMORY_DESCRIPTOR Stack; /// A MINIDUMP_LOCATION_DESCRIPTOR structure. public MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; } /// Contains thread information for the MiniDumpCallback function when the callback type is ThreadCallback. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_callback typedef struct // _MINIDUMP_THREAD_CALLBACK { ULONG ThreadId; HANDLE ThreadHandle; ULONG Pad; CONTEXT Context; ULONG SizeOfContext; ULONG64 // StackBase; ULONG64 StackEnd; } MINIDUMP_THREAD_CALLBACK, *PMINIDUMP_THREAD_CALLBACK; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_CALLBACK")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_THREAD_CALLBACK { /// The identifier of the thread. public uint ThreadId; /// A handle to the thread public HTHREAD ThreadHandle; /// public uint Pad; /// A CONTEXT structure that contains the processor-specific data. public CONTEXT Context; /// The size of the returned processor-specific data in the Context member, in bytes. public uint SizeOfContext; /// The base address of the thread stack. public ulong StackBase; /// The ending address of the thread stack. public ulong StackEnd; } /// Contains extended information for a specific thread. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_ex typedef struct // _MINIDUMP_THREAD_EX { ULONG32 ThreadId; ULONG32 SuspendCount; ULONG32 PriorityClass; ULONG32 Priority; ULONG64 Teb; // MINIDUMP_MEMORY_DESCRIPTOR Stack; MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; MINIDUMP_MEMORY_DESCRIPTOR BackingStore; } // MINIDUMP_THREAD_EX, *PMINIDUMP_THREAD_EX; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_EX")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_THREAD_EX { /// The identifier of the thread. public uint ThreadId; /// /// The suspend count for the thread. If the suspend count is greater than zero, the thread is suspended; otherwise, the thread /// is not suspended. The maximum value is MAXIMUM_SUSPEND_COUNT. /// public uint SuspendCount; /// The priority class of the thread. See Scheduling Priorities. public uint PriorityClass; /// The priority level of the thread. public uint Priority; /// The thread environment block. public ulong Teb; /// A MINIDUMP_MEMORY_DESCRIPTOR structure. public MINIDUMP_MEMORY_DESCRIPTOR Stack; /// A MINIDUMP_LOCATION_DESCRIPTOR structure. public MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; /// Intel Itanium: The backing store for the thread. public MINIDUMP_MEMORY_DESCRIPTOR BackingStore; } /// Contains extended thread information for the MiniDumpCallback function when the callback type is ThreadExCallback. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_ex_callback typedef struct // _MINIDUMP_THREAD_EX_CALLBACK { ULONG ThreadId; HANDLE ThreadHandle; ULONG Pad; CONTEXT Context; ULONG SizeOfContext; ULONG64 // StackBase; ULONG64 StackEnd; ULONG64 BackingStoreBase; ULONG64 BackingStoreEnd; } MINIDUMP_THREAD_EX_CALLBACK, *PMINIDUMP_THREAD_EX_CALLBACK; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_EX_CALLBACK")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_THREAD_EX_CALLBACK { /// The identifier of the thread. public uint ThreadId; /// A handle to the thread public HTHREAD ThreadHandle; /// public uint Pad; /// A CONTEXT structure that contains the processor-specific data. public CONTEXT Context; /// The size of the returned processor-specific data in the Context member, in bytes. public uint SizeOfContext; /// The base address of the thread stack. public ulong StackBase; /// The ending address of the thread stack. public ulong StackEnd; /// Intel Itanium: The base address of the thread backing store. public ulong BackingStoreBase; /// Intel Itanium: The ending address of the thread backing store. public ulong BackingStoreEnd; } /// Contains a list of threads. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_ex_list typedef struct // _MINIDUMP_THREAD_EX_LIST { ULONG32 NumberOfThreads; MINIDUMP_THREAD_EX Threads[0]; } MINIDUMP_THREAD_EX_LIST, *PMINIDUMP_THREAD_EX_LIST; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_EX_LIST")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_THREAD_EX_LIST { /// The number of structures in the Threads array. public uint NumberOfThreads; /// An array of MINIDUMP_THREAD_EX structures. public MINIDUMP_THREAD_EX[] Threads; } /// Contains thread state information. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_info typedef struct // _MINIDUMP_THREAD_INFO { ULONG32 ThreadId; ULONG32 DumpFlags; ULONG32 DumpError; ULONG32 ExitStatus; ULONG64 CreateTime; ULONG64 // ExitTime; ULONG64 KernelTime; ULONG64 UserTime; ULONG64 StartAddress; ULONG64 Affinity; } MINIDUMP_THREAD_INFO, *PMINIDUMP_THREAD_INFO; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_INFO")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_THREAD_INFO { /// The identifier of the thread. public uint ThreadId; /// /// The flags that indicate the thread state. This member can be 0 or one of the following values. /// /// /// Value /// Meaning /// /// /// MINIDUMP_THREAD_INFO_ERROR_THREAD 0x00000001 /// A placeholder thread due to an error accessing the thread. No thread information exists beyond the thread identifier. /// /// /// MINIDUMP_THREAD_INFO_EXITED_THREAD 0x00000004 /// The thread has exited (not running any code) at the time of the dump. /// /// /// MINIDUMP_THREAD_INFO_INVALID_CONTEXT 0x00000010 /// Thread context could not be retrieved. /// /// /// MINIDUMP_THREAD_INFO_INVALID_INFO 0x00000008 /// Thread information could not be retrieved. /// /// /// MINIDUMP_THREAD_INFO_INVALID_TEB 0x00000020 /// TEB information could not be retrieved. /// /// /// MINIDUMP_THREAD_INFO_WRITING_THREAD 0x00000002 /// This is the thread that called MiniDumpWriteDump. /// /// /// public MINIDUMP_THREAD_INFO_FLAG DumpFlags; /// An HRESULT value that indicates the dump status. public HRESULT DumpError; /// The thread termination status code. public uint ExitStatus; /// The time when the thread was created, in 100-nanosecond intervals since January 1, 1601 (UTC). public ulong CreateTime; /// The time when the thread exited, in 100-nanosecond intervals since January 1, 1601 (UTC). public ulong ExitTime; /// The time executed in kernel mode, in 100-nanosecond intervals. public ulong KernelTime; /// The time executed in user mode, in 100-nanosecond intervals. public ulong UserTime; /// The starting address of the thread. public ulong StartAddress; /// The processor affinity mask. public ulong Affinity; } /// Contains a list of threads. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_info_list typedef struct // _MINIDUMP_THREAD_INFO_LIST { ULONG SizeOfHeader; ULONG SizeOfEntry; ULONG NumberOfEntries; } MINIDUMP_THREAD_INFO_LIST, *PMINIDUMP_THREAD_INFO_LIST; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_INFO_LIST")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_THREAD_INFO_LIST { /// /// The size of the header data for the stream, in bytes. This is generally /// sizeof(MINIDUMP_THREAD_INFO_LIST) /// . /// public uint SizeOfHeader; /// /// The size of each entry following the header, in bytes. This is generally /// sizeof(MINIDUMP_THREAD_INFO) /// . /// public uint SizeOfEntry; /// /// The number of entries in the stream. These are generally MINIDUMP_THREAD_INFO structures. The entries follow the header. /// public uint NumberOfEntries; } /// Contains a list of threads. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_list typedef struct // _MINIDUMP_THREAD_LIST { ULONG32 NumberOfThreads; MINIDUMP_THREAD Threads[0]; } MINIDUMP_THREAD_LIST, *PMINIDUMP_THREAD_LIST; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_LIST")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_THREAD_LIST { /// The number of structures in the Threads array. public uint NumberOfThreads; /// An array of MINIDUMP_THREAD structures. public MINIDUMP_THREAD[] Threads; } /// /// Contains information about a module that has been unloaded. This information can help diagnose problems calling code that is no /// longer loaded. /// // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_unloaded_module typedef struct // _MINIDUMP_UNLOADED_MODULE { ULONG64 BaseOfImage; ULONG32 SizeOfImage; ULONG32 CheckSum; ULONG32 TimeDateStamp; RVA ModuleNameRva; // } MINIDUMP_UNLOADED_MODULE, *PMINIDUMP_UNLOADED_MODULE; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_UNLOADED_MODULE")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_UNLOADED_MODULE { /// The base address of the module executable image in memory. public ulong BaseOfImage; /// The size of the module executable image in memory, in bytes. public uint SizeOfImage; /// The checksum value of the module executable image. public uint CheckSum; /// The timestamp value of the module executable image, in time_t format. public time_t TimeDateStamp; /// An RVA to a MINIDUMP_STRING structure that specifies the name of the module. public uint ModuleNameRva; } /// Contains a list of unloaded modules. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_unloaded_module_list typedef struct // _MINIDUMP_UNLOADED_MODULE_LIST { ULONG32 SizeOfHeader; ULONG32 SizeOfEntry; ULONG32 NumberOfEntries; } // MINIDUMP_UNLOADED_MODULE_LIST, *PMINIDUMP_UNLOADED_MODULE_LIST; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_UNLOADED_MODULE_LIST")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_UNLOADED_MODULE_LIST { /// /// The size of the header data for the stream, in bytes. This is generally /// sizeof(MINIDUMP_UNLOADED_MODULE_LIST) /// . /// public uint SizeOfHeader; /// /// The size of each entry following the header, in bytes. This is generally /// sizeof(MINIDUMP_UNLOADED_MODULE) /// . /// public uint SizeOfEntry; /// /// The number of entries in the stream. These are generally MINIDUMP_UNLOADED_MODULE structures. The entries follow the header. /// public uint NumberOfEntries; } /// Contains user-defined information stored in a data stream. /// In this context, a data stream refers to a block of data within a minidump file. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_user_stream typedef struct // _MINIDUMP_USER_STREAM { ULONG32 Type; ULONG BufferSize; PVOID Buffer; } MINIDUMP_USER_STREAM, *PMINIDUMP_USER_STREAM; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_USER_STREAM")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_USER_STREAM { /// The type of data stream. For more information, see MINIDUMP_STREAM_TYPE. public uint Type; /// The size of the user-defined data stream buffer, in bytes. public uint BufferSize; /// A pointer to a buffer that contains the user-defined data stream. public IntPtr Buffer; } /// Contains a list of user data streams used by the MiniDumpWriteDump function. /// In this context, a data stream refers to a block of data within a minidump file. // https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_user_stream_information typedef // struct _MINIDUMP_USER_STREAM_INFORMATION { ULONG UserStreamCount; PMINIDUMP_USER_STREAM UserStreamArray; } // MINIDUMP_USER_STREAM_INFORMATION, *PMINIDUMP_USER_STREAM_INFORMATION; [PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_USER_STREAM_INFORMATION")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_USER_STREAM_INFORMATION { /// The number of user streams. public uint UserStreamCount; /// An array of MINIDUMP_USER_STREAM structures. public MINIDUMP_USER_STREAM[] UserStreamArray; } #pragma warning disable CS1591 // Missing XML comment for publicly visible type or member [PInvokeData("minidumpapiset.h")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_VM_POST_READ_CALLBACK { public ulong Offset; public IntPtr Buffer; public uint Size; public uint Completed; public HRESULT Status; } [PInvokeData("minidumpapiset.h")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_VM_PRE_READ_CALLBACK { public ulong Offset; public IntPtr Buffer; public uint Size; } [PInvokeData("minidumpapiset.h")] [StructLayout(LayoutKind.Sequential)] public struct MINIDUMP_VM_QUERY_CALLBACK { public ulong Offset; } #pragma warning restore CS1591 // Missing XML comment for publicly visible type or member } }