using System;
using System.Runtime.InteropServices;
using Vanara.InteropServices;
namespace Vanara.PInvoke
{
public static partial class DbgHelp
{
///
/// An application-defined callback function used with MiniDumpWriteDump. It receives extended minidump information.
///
/// The MINIDUMP_CALLBACK_ROUTINE type defines a pointer to this callback function. MiniDumpCallback is a placeholder
/// for the application-defined function name.
///
///
/// An application-defined parameter value.
/// A pointer to a MINIDUMP_CALLBACK_INPUT structure that specifies extended minidump information.
///
/// A pointer to a MINIDUMP_CALLBACK_OUTPUT structure that receives application-defined information from the callback function.
///
/// If the function succeeds, return TRUE; otherwise, return FALSE.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nc-minidumpapiset-minidump_callback_routine
// MINIDUMP_CALLBACK_ROUTINE MinidumpCallbackRoutine; BOOL MinidumpCallbackRoutine( PVOID CallbackParam, PMINIDUMP_CALLBACK_INPUT
// CallbackInput, PMINIDUMP_CALLBACK_OUTPUT CallbackOutput ) {...}
[UnmanagedFunctionPointer(CallingConvention.Winapi)]
[PInvokeData("minidumpapiset.h", MSDNShortId = "NC:minidumpapiset.MINIDUMP_CALLBACK_ROUTINE")]
[return: MarshalAs(UnmanagedType.Bool)]
public delegate bool MINIDUMP_CALLBACK_ROUTINE([In, Out] IntPtr CallbackParam, in MINIDUMP_CALLBACK_INPUT CallbackInput, ref MINIDUMP_CALLBACK_OUTPUT CallbackOutput);
///
/// Identifies the type of information returned by the MiniDumpCallback function. Not all memory failures will cause a callback; for
/// example if the failure is within a stack then the failure is considered to be unrecoverable and the minidump will fail.
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-minidump_callback_type typedef enum
// _MINIDUMP_CALLBACK_TYPE { ModuleCallback, ThreadCallback, ThreadExCallback, IncludeThreadCallback, IncludeModuleCallback,
// MemoryCallback, CancelCallback, WriteKernelMinidumpCallback, KernelMinidumpStatusCallback, RemoveMemoryCallback,
// IncludeVmRegionCallback, IoStartCallback, IoWriteAllCallback, IoFinishCallback, ReadMemoryFailureCallback,
// SecondaryFlagsCallback, IsProcessSnapshotCallback, VmStartCallback, VmQueryCallback, VmPreReadCallback, VmPostReadCallback } MINIDUMP_CALLBACK_TYPE;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._MINIDUMP_CALLBACK_TYPE")]
public enum MINIDUMP_CALLBACK_TYPE
{
/// The callback function returns module information.
ModuleCallback,
/// The callback function returns thread information.
ThreadCallback,
/// The callback function returns extended thread information.
ThreadExCallback,
///
/// The callback function indicates which threads are to be included. It is called as the minidump library is enumerating the
/// threads in a process, rather than after the information gathered, as it is with ThreadCallback or ThreadExCallback. It is
/// called for each thread. If the callback function returns FALSE, the current thread is excluded. This allows the caller to
/// obtain information for a subset of the threads in a process, without suspending threads that are not of interest.
/// Alternately, you can modify the ThreadWriteFlags member of the MINIDUMP_CALLBACK_OUTPUT structure and return TRUE to avoid
/// gathering unnecessary information for the thread.
///
IncludeThreadCallback,
///
/// The callback function indicates which modules are to be included. The callback function is called as the minidump library is
/// enumerating the modules in a process, rather than after the information is gathered, as it is with ModuleCallback. It is
/// called for each module. If the callback function returns FALSE, the current module is excluded. Alternatively, you can
/// modify the ModuleWriteFlags member of the MINIDUMP_CALLBACK_OUTPUT structure and return TRUE to avoid gathering unnecessary
/// information for the module.
///
IncludeModuleCallback,
///
/// The callback function returns a region of memory to be included in the dump. The callback is called only for dumps generated
/// without the MiniDumpWithFullMemory flag. If the callback function returns FALSE or a region of size 0, the callback will not
/// be called again. DbgHelp 6.1 and earlier: This value is not supported.
///
MemoryCallback,
/// The callback function returns cancellation information. DbgHelp 6.1 and earlier: This value is not supported.
CancelCallback,
///
/// The user-mode minidump has been successfully completed. To initiate a kernel-mode minidump, the callback should return TRUE
/// and set the Handle member of the MINIDUMP_CALLBACK_OUTPUT structure. DbgHelp 6.1 and earlier: This value is not supported.
///
WriteKernelMinidumpCallback,
///
/// The callback function returns status information for the kernel minidump. DbgHelp 6.1 and earlier: This value is not supported.
///
KernelMinidumpStatusCallback,
///
/// The callback function returns a region of memory to be excluded from the dump. The callback is called only for dumps
/// generated without the MiniDumpWithFullMemory flag. If the callback function returns FALSE or a region of size 0, the
/// callback will not be called again. DbgHelp 6.3 and earlier: This value is not supported.
///
RemoveMemoryCallback,
///
/// The callback function returns information about the virtual memory region. It is called twice for each region during the
/// full-memory writing pass. The VmRegion member of the MINIDUMP_CALLBACK_OUTPUT structure contains the current memory region.
/// You can modify the base address and size of the region, as long as the new region remains a subset of the original region;
/// changes to other members are ignored. If the callback returns TRUE and sets the Continue member of MINIDUMP_CALLBACK_OUTPUT
/// to TRUE, the minidump library will use the region specified by VmRegion as the region to be written. If the callback returns
/// FALSE or if Continue is FALSE, the callback will not be called for additional memory regions. DbgHelp 6.4 and earlier: This
/// value is not supported.
///
IncludeVmRegionCallback,
///
/// The callback function indicates that the caller will be providing an alternate I/O routine. If the callback returns TRUE and
/// sets the Status member of MINIDUMP_CALLBACK_OUTPUT to S_FALSE, the minidump library will send all I/O through callbacks. The
/// caller will receive an IoWriteAllCallback callback for each piece of data. DbgHelp 6.4 and earlier: This value is not supported.
///
IoStartCallback,
///
/// The callback must write all requested bytes or fail. The Io member of the MINIDUMP_CALLBACK_INPUT structure contains the
/// request. If the write operation fails, the callback should return FALSE. If the write operation succeeds, the callback
/// should return TRUE and set the Status member of MINIDUMP_CALLBACK_OUTPUT to S_OK. The caller will receive an
/// IoFinishCallback callback when the I/O has completed. DbgHelp 6.4 and earlier: This value is not supported.
///
IoWriteAllCallback,
///
/// The callback returns I/O completion information. If the callback returns FALSE or does not set the Status member of
/// MINIDUMP_CALLBACK_OUTPUT to S_OK, the minidump library assumes the minidump write operation has failed. DbgHelp 6.4 and
/// earlier: This value is not supported.
///
IoFinishCallback,
///
/// There has been a failure to read memory. If the callback returns TRUE and sets the Status member of MINIDUMP_CALLBACK_OUTPUT
/// to S_OK, the memory failure is ignored and the block is omitted from the minidump. Otherwise, this failure results in a
/// failure to write to the minidump. DbgHelp 6.4 and earlier: This value is not supported.
///
ReadMemoryFailureCallback,
/// The callback returns secondary information. DbgHelp 6.5 and earlier: This value is not supported.
SecondaryFlagsCallback,
///
/// The callback function indicates whether the target is a process or a snapshot.DbgHelp 6.2 and earlier: This value is not supported.
///
IsProcessSnapshotCallback,
///
/// The callback function indicates whether the callee supports and accepts virtual memory callbacks, such as VmQueryCallback,
/// VmPreReadCallback, and VmPostReadCallback. A return value of S_FALSE means that virtual memory callbacks are supported. A
/// value of S_OK means that virtual memory callbacks are not supported.DbgHelp 6.2 and earlier: This value is not supported.
///
VmStartCallback,
///
/// The callback function is invoked for snapshot targets to collect virtual address memory information from the target.The
/// callback is only called if VmStartCallback returned a value of S_FALSE.DbgHelp 6.2 and earlier: This value is not supported.
///
VmQueryCallback,
///
/// The callback function is sent for every ReadVirtual operation. These reads are not limited to the memory blocks that are
/// added to the dump. The engine also accesses the Process Environment Block (PEB), the Thread Environment Block (TEB), the
/// loader data, the unloaded module traces, and other blocks. Even if those blocks do not end up in the dump, they are read
/// from the target, and virtual memory callbacks are initiated for each. The callback is only called if VmStartCallback
/// returned S_FALSE.DbgHelp 6.2 and earlier: This value is not supported.
///
VmPreReadCallback,
///
/// The callback function allows the callee to alter the buffer contents with data from other sources, such as a cache, or
/// perform obfuscation. The buffer at this point is fully or partially filled by VmPreReadCallback and by ReadProcessMemory.
/// The callback is only called if VmStartCallback returned S_FALSE.DbgHelp 6.2 and earlier: This value is not supported.
///
VmPostReadCallback,
}
/// Identifies the type of object-specific information.
///
/// The information represented by each of these values can vary by operating system and procesor architecture. Per-handle
/// object-specific information is automatically gathered when minidump type is MiniDumpWithHandleData. For more information, see MINIDUMP_TYPE.
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-minidump_handle_object_information_type
// typedef enum _MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE { MiniHandleObjectInformationNone, MiniThreadInformation1,
// MiniMutantInformation1, MiniMutantInformation2, MiniProcessInformation1, MiniProcessInformation2, MiniEventInformation1,
// MiniSectionInformation1, MiniSemaphoreInformation1, MiniHandleObjectInformationTypeMax } MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE")]
public enum MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE
{
/// There is no object-specific information for this handle type.
MiniHandleObjectInformationNone,
/// The information is specific to thread objects.
MiniThreadInformation1,
/// The information is specific to mutant objects.
MiniMutantInformation1,
/// The information is specific to mutant objects.
MiniMutantInformation2,
/// The information is specific to process objects.
MiniProcessInformation1,
/// The information is specific to process objects.
MiniProcessInformation2,
///
MiniEventInformation1,
///
MiniSectionInformation1,
///
MiniSemaphoreInformation1,
///
MiniHandleObjectInformationTypeMax,
}
/// Specifies the secondary flags for the minidump.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-minidump_secondary_flags typedef enum
// _MINIDUMP_SECONDARY_FLAGS { MiniSecondaryWithoutPowerInfo, MiniSecondaryValidFlags } MINIDUMP_SECONDARY_FLAGS;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._MINIDUMP_SECONDARY_FLAGS")]
[Flags]
public enum MINIDUMP_SECONDARY_FLAGS
{
///
/// The minidump information does not retrieve the processor power information contained in the MINIDUMP_MISC_INFO_2 structure.
///
MiniSecondaryWithoutPowerInfo = 1,
///
MiniSecondaryValidFlags = 1,
}
/// Represents the type of a minidump data stream.
///
/// In this context, a data stream is a set of data in a minidump file.
///
/// The StreamType member of the MINIDUMP_DIRECTORY structure can be one of these types. Additional types may be added in the
/// future, so if a program reading the minidump header encounters a stream type it does not recognize, it should ignore the stream altogether.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-minidump_stream_type typedef enum
// _MINIDUMP_STREAM_TYPE { UnusedStream, ReservedStream0, ReservedStream1, ThreadListStream, ModuleListStream, MemoryListStream,
// ExceptionStream, SystemInfoStream, ThreadExListStream, Memory64ListStream, CommentStreamA, CommentStreamW, HandleDataStream,
// FunctionTableStream, UnloadedModuleListStream, MiscInfoStream, MemoryInfoListStream, ThreadInfoListStream,
// HandleOperationListStream, TokenStream, JavaScriptDataStream, SystemMemoryInfoStream, ProcessVmCountersStream, IptTraceStream,
// ThreadNamesStream, ceStreamNull, ceStreamSystemInfo, ceStreamException, ceStreamModuleList, ceStreamProcessList,
// ceStreamThreadList, ceStreamThreadContextList, ceStreamThreadCallStackList, ceStreamMemoryVirtualList,
// ceStreamMemoryPhysicalList, ceStreamBucketParameters, ceStreamProcessModuleMap, ceStreamDiagnosisList, LastReservedStream } MINIDUMP_STREAM_TYPE;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._MINIDUMP_STREAM_TYPE")]
public enum MINIDUMP_STREAM_TYPE
{
/// Reserved. Do not use this enumeration value.
UnusedStream,
/// Reserved. Do not use this enumeration value.
ReservedStream0,
/// Reserved. Do not use this enumeration value.
ReservedStream1,
/// The stream contains thread information. For more information, see MINIDUMP_THREAD_LIST.
ThreadListStream,
/// The stream contains module information. For more information, see MINIDUMP_MODULE_LIST.
ModuleListStream,
/// The stream contains memory allocation information. For more information, see MINIDUMP_MEMORY_LIST.
MemoryListStream,
/// The stream contains exception information. For more information, see MINIDUMP_EXCEPTION_STREAM.
ExceptionStream,
/// The stream contains general system information. For more information, see MINIDUMP_SYSTEM_INFO.
SystemInfoStream,
/// The stream contains extended thread information. For more information, see MINIDUMP_THREAD_EX_LIST.
ThreadExListStream,
/// The stream contains memory allocation information. For more information, see MINIDUMP_MEMORY64_LIST.
Memory64ListStream,
/// The stream contains an ANSI string used for documentation purposes.
CommentStreamA,
/// The stream contains a Unicode string used for documentation purposes.
CommentStreamW,
///
/// The stream contains high-level information about the active operating system handles. For more information, see MINIDUMP_HANDLE_DATA_STREAM.
///
HandleDataStream,
/// The stream contains function table information. For more information, see MINIDUMP_FUNCTION_TABLE_STREAM.
FunctionTableStream,
///
/// The stream contains module information for the unloaded modules. For more information, see
/// MINIDUMP_UNLOADED_MODULE_LIST.DbgHelp 5.1: This value is not supported.
///
UnloadedModuleListStream,
///
/// The stream contains miscellaneous information. For more information, see MINIDUMP_MISC_INFO or MINIDUMP_MISC_INFO_2.DbgHelp
/// 5.1: This value is not supported.
///
MiscInfoStream,
///
/// The stream contains memory region description information. It corresponds to the information that would be returned for the
/// process from the VirtualQuery function. For more information, see MINIDUMP_MEMORY_INFO_LIST.DbgHelp 6.1 and earlier: This
/// value is not supported.
///
MemoryInfoListStream,
///
/// The stream contains thread state information. For more information, see MINIDUMP_THREAD_INFO_LIST.DbgHelp 6.1 and earlier:
/// This value is not supported.
///
ThreadInfoListStream,
///
/// This stream contains operation list information. For more information, see MINIDUMP_HANDLE_OPERATION_LIST.DbgHelp 6.4 and
/// earlier: This value is not supported.
///
HandleOperationListStream,
///
TokenStream,
///
JavaScriptDataStream,
///
SystemMemoryInfoStream,
///
ProcessVmCountersStream,
///
IptTraceStream,
///
ThreadNamesStream,
///
ceStreamNull = 0x8000,
///
ceStreamSystemInfo,
///
ceStreamException,
///
ceStreamModuleList,
///
ceStreamProcessList,
///
ceStreamThreadList,
///
ceStreamThreadContextList,
///
ceStreamThreadCallStackList,
///
ceStreamMemoryVirtualList,
///
ceStreamMemoryPhysicalList,
///
ceStreamBucketParameters,
///
ceStreamProcessModuleMap,
///
ceStreamDiagnosisList,
///
/// Any value greater than this value will not be used by the system and can be used to represent application-defined data
/// streams. For more information, see MINIDUMP_USER_STREAM.
///
LastReservedStream = 0xffff,
}
/// The flags that indicate the thread state.
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_INFO")]
[Flags]
public enum MINIDUMP_THREAD_INFO_FLAG : uint
{
/// A placeholder thread due to an error accessing the thread. No thread information exists beyond the thread identifier.
MINIDUMP_THREAD_INFO_ERROR_THREAD = 0x00000001,
/// The thread has exited (not running any code) at the time of the dump.
MINIDUMP_THREAD_INFO_EXITED_THREAD = 0x00000004,
/// Thread context could not be retrieved.
MINIDUMP_THREAD_INFO_INVALID_CONTEXT = 0x00000010,
/// Thread information could not be retrieved.
MINIDUMP_THREAD_INFO_INVALID_INFO = 0x00000008,
/// TEB information could not be retrieved.
MINIDUMP_THREAD_INFO_INVALID_TEB = 0x00000020,
/// This is the thread that called MiniDumpWriteDump.
MINIDUMP_THREAD_INFO_WRITING_THREAD = 0x00000002,
}
///
/// Identifies the type of information that will be written to the minidump file by the MiniDumpWriteDump function.
/// Important
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-minidump_type typedef enum _MINIDUMP_TYPE {
// MiniDumpNormal, MiniDumpWithDataSegs, MiniDumpWithFullMemory, MiniDumpWithHandleData, MiniDumpFilterMemory, MiniDumpScanMemory,
// MiniDumpWithUnloadedModules, MiniDumpWithIndirectlyReferencedMemory, MiniDumpFilterModulePaths, MiniDumpWithProcessThreadData,
// MiniDumpWithPrivateReadWriteMemory, MiniDumpWithoutOptionalData, MiniDumpWithFullMemoryInfo, MiniDumpWithThreadInfo,
// MiniDumpWithCodeSegs, MiniDumpWithoutAuxiliaryState, MiniDumpWithFullAuxiliaryState, MiniDumpWithPrivateWriteCopyMemory,
// MiniDumpIgnoreInaccessibleMemory, MiniDumpWithTokenInformation, MiniDumpWithModuleHeaders, MiniDumpFilterTriage,
// MiniDumpWithAvxXStateContext, MiniDumpWithIptTrace, MiniDumpScanInaccessiblePartialPages, MiniDumpValidTypeFlags } MINIDUMP_TYPE;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._MINIDUMP_TYPE")]
[Flags]
public enum MINIDUMP_TYPE
{
/// Include just the information necessary to capture stack traces for all existing threads in a process.
MiniDumpNormal = 0x00000000,
///
/// Include the data sections from all loaded modules. This results in the inclusion of global variables, which can make the
/// minidump file significantly larger. For per-module control, use the ModuleWriteDataSeg enumeration value from MODULE_WRITE_FLAGS.
///
MiniDumpWithDataSegs = 0x00000001,
///
/// Include all accessible memory in the process. The raw memory data is included at the end, so that the initial structures can
/// be mapped directly without the raw memory information. This option can result in a very large file.
///
MiniDumpWithFullMemory = 0x00000002,
/// Include high-level information about the operating system handles that are active when the minidump is made.
MiniDumpWithHandleData = 0x00000004,
///
/// Stack and backing store memory written to the minidump file should be filtered to remove all but the pointer values
/// necessary to reconstruct a stack trace.
///
MiniDumpFilterMemory = 0x00000008,
///
/// Stack and backing store memory should be scanned for pointer references to modules in the module list. If a module is
/// referenced by stack or backing store memory, the ModuleWriteFlags member of the MINIDUMP_CALLBACK_OUTPUT structure is set to ModuleReferencedByMemory.
///
MiniDumpScanMemory = 0x00000010,
///
/// Include information from the list of modules that were recently unloaded, if this information is maintained by the operating
/// system. Windows Server 2003 and Windows XP: The operating system does not maintain information for unloaded modules until
/// Windows Server 2003 with SP1 and Windows XP with SP2.DbgHelp 5.1: This value is not supported.
///
MiniDumpWithUnloadedModules = 0x00000020,
///
/// Include pages with data referenced by locals or other stack memory. This option can increase the size of the minidump file
/// significantly. DbgHelp 5.1: This value is not supported.
///
MiniDumpWithIndirectlyReferencedMemory = 0x00000040,
///
/// Filter module paths for information such as user names or important directories. This option may prevent the system from
/// locating the image file and should be used only in special situations. DbgHelp 5.1: This value is not supported.
///
MiniDumpFilterModulePaths = 0x00000080,
///
/// Include complete per-process and per-thread information from the operating system. DbgHelp 5.1: This value is not supported.
///
MiniDumpWithProcessThreadData = 0x00000100,
/// Scan the virtual address space for PAGE_READWRITE memory to be included. DbgHelp 5.1: This value is not supported.
MiniDumpWithPrivateReadWriteMemory = 0x00000200,
///
/// Reduce the data that is dumped by eliminating memory regions that are not essential to meet criteria specified for the dump.
/// This can avoid dumping memory that may contain data that is private to the user. However, it is not a guarantee that no
/// private information will be present. DbgHelp 6.1 and earlier: This value is not supported.
///
MiniDumpWithoutOptionalData = 0x00000400,
///
/// Include memory region information. For more information, see MINIDUMP_MEMORY_INFO_LIST. DbgHelp 6.1 and earlier: This value
/// is not supported.
///
MiniDumpWithFullMemoryInfo = 0x00000800,
///
/// Include thread state information. For more information, see MINIDUMP_THREAD_INFO_LIST. DbgHelp 6.1 and earlier: This value
/// is not supported.
///
MiniDumpWithThreadInfo = 0x00001000,
///
/// Include all code and code-related sections from loaded modules to capture executable content. For per-module control, use
/// the ModuleWriteCodeSegs enumeration value from MODULE_WRITE_FLAGS. DbgHelp 6.1 and earlier: This value is not supported.
///
MiniDumpWithCodeSegs = 0x00002000,
/// Turns off secondary auxiliary-supported memory gathering.
MiniDumpWithoutAuxiliaryState = 0x00004000,
///
/// Requests that auxiliary data providers include their state in the dump image; the state data that is included is provider
/// dependent. This option can result in a large dump image.
///
MiniDumpWithFullAuxiliaryState = 0x00008000,
///
/// Scans the virtual address space for PAGE_WRITECOPY memory to be included. Prior to DbgHelp 6.1: This value is not supported.
///
MiniDumpWithPrivateWriteCopyMemory = 0x00010000,
///
/// If you specify MiniDumpWithFullMemory, the MiniDumpWriteDump function will fail if the function cannot read the memory
/// regions; however, if you include MiniDumpIgnoreInaccessibleMemory, the MiniDumpWriteDump function will ignore the memory
/// read failures and continue to generate the dump. Note that the inaccessible memory regions are not included in the
/// dump.Prior to DbgHelp 6.1: This value is not supported.
///
MiniDumpIgnoreInaccessibleMemory = 0x00020000,
///
/// Adds security token related data. This will make the "!token" extension work when processing a user-mode dump. Prior to
/// DbgHelp 6.1: This value is not supported.
///
MiniDumpWithTokenInformation = 0x00040000,
/// Adds module header related data. Prior to DbgHelp 6.1: This value is not supported.
MiniDumpWithModuleHeaders = 0x00080000,
/// Adds filter triage related data. Prior to DbgHelp 6.1: This value is not supported.
MiniDumpFilterTriage = 0x00100000,
///
MiniDumpWithAvxXStateContext = 0x00200000,
///
MiniDumpWithIptTrace = 0x00400000,
/// Indicates which flags are valid.
MiniDumpValidTypeFlags = 0x00800000,
}
/// Identifies the type of module information that will be written to the minidump file by the MiniDumpWriteDump function.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-module_write_flags typedef enum
// _MODULE_WRITE_FLAGS { ModuleWriteModule, ModuleWriteDataSeg, ModuleWriteMiscRecord, ModuleWriteCvRecord,
// ModuleReferencedByMemory, ModuleWriteTlsData, ModuleWriteCodeSegs } MODULE_WRITE_FLAGS;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._MODULE_WRITE_FLAGS")]
[Flags]
public enum MODULE_WRITE_FLAGS
{
/// Only module information will be written to the minidump file.
ModuleWriteModule = 0x0001,
///
/// Module and data segment information will be written to the minidump file. This value will only be set if the
/// MiniDumpWithDataSegs enumeration value from MINIDUMP_TYPE is set.
///
ModuleWriteDataSeg = 0x0002,
/// Module, data segment, and miscellaneous record information will be written to the minidump file.
ModuleWriteMiscRecord = 0x0004,
///
/// CodeView information will be written to the minidump file. Some debuggers need the CodeView information to properly locate symbols.
///
ModuleWriteCvRecord = 0x0008,
///
/// Indicates that a module was referenced by a pointer on the stack or backing store of a thread in the minidump. This value is
/// valid only if the DumpType parameter of the MiniDumpWriteDump function includes MiniDumpScanMemory.
///
ModuleReferencedByMemory = 0x0010,
///
/// Per-module automatic TLS data is written to the minidump file. (Note that automatic TLS data is created using
/// __declspec(thread) while TlsAlloc creates dynamic TLS data). This value is valid only if the DumpType parameter of the
/// MiniDumpWriteDump function includes MiniDumpWithProcessThreadData.DbgHelp 6.1 and earlier: This value is not supported.
///
ModuleWriteTlsData = 0x0020,
///
/// Code segment information will be written to the minidump file. This value will only be set if the MiniDumpWithCodeSegs
/// enumeration value from MINIDUMP_TYPE is set.DbgHelp 6.1 and earlier: This value is not supported.
///
ModuleWriteCodeSegs = 0x0040,
}
/// Identifies the type of thread information that will be written to the minidump file by the MiniDumpWriteDump function.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ne-minidumpapiset-thread_write_flags typedef enum
// _THREAD_WRITE_FLAGS { ThreadWriteThread, ThreadWriteStack, ThreadWriteContext, ThreadWriteBackingStore,
// ThreadWriteInstructionWindow, ThreadWriteThreadData, ThreadWriteThreadInfo } THREAD_WRITE_FLAGS;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NE:minidumpapiset._THREAD_WRITE_FLAGS")]
public enum THREAD_WRITE_FLAGS
{
/// Only basic thread information will be written to the minidump file.
ThreadWriteThread,
/// Basic thread and thread stack information will be written to the minidump file.
ThreadWriteStack,
/// The entire thread context will be written to the minidump file.
ThreadWriteContext,
/// Intel Itanium: The backing store memory of every thread will be written to the minidump file.
ThreadWriteBackingStore,
///
/// A small amount of memory surrounding each thread's instruction pointer will be written to the minidump file. This allows
/// instructions near a thread's instruction pointer to be disassembled even if an executable image matching the module cannot
/// be found.
///
ThreadWriteInstructionWindow,
///
/// When the minidump type includes MiniDumpWithProcessThreadData, this flag is set. The callback function can clear this flag
/// to control which threads provide complete thread data in the minidump file.DbgHelp 5.1: This value is not supported.
///
ThreadWriteThreadData,
///
/// When the minidump type includes MiniDumpWithThreadInfo, this flag is set. The callback function can clear this flag to
/// control which threads provide thread state information in the minidump file. For more information, see
/// MINIDUMP_THREAD_INFO.DbgHelp 6.1 and earlier: This value is not supported.
///
ThreadWriteThreadInfo,
}
/// Reads a stream from a user-mode minidump file.
///
/// A pointer to the base of the mapped minidump file. The file should have been mapped into memory using the MapViewOfFile function.
///
///
/// The type of data to be read from the minidump file. This member can be one of the values in the MINIDUMP_STREAM_TYPE enumeration.
///
/// A pointer to a MINIDUMP_DIRECTORY structure.
///
/// A pointer to the beginning of the minidump stream. The format of this stream depends on the value of StreamNumber. For more
/// information, see MINIDUMP_STREAM_TYPE.
///
/// The size of the stream pointed to by StreamPointer, in bytes.
/// If the function succeeds, the return value is TRUE; otherwise, the return value is FALSE.
/// In this context, a data stream is a block of data written to a minidump file.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpreaddumpstream BOOL
// MiniDumpReadDumpStream( PVOID BaseOfDump, ULONG StreamNumber, PMINIDUMP_DIRECTORY *Dir, PVOID *StreamPointer, ULONG *StreamSize );
[DllImport(Lib_DbgHelp, SetLastError = false, ExactSpelling = true)]
[PInvokeData("minidumpapiset.h", MSDNShortId = "NF:minidumpapiset.MiniDumpReadDumpStream")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool MiniDumpReadDumpStream([In] IntPtr BaseOfDump, uint StreamNumber, out IntPtr Dir, out IntPtr StreamPointer, out uint StreamSize);
/// Writes user-mode minidump information to the specified file.
///
/// A handle to the process for which the information is to be generated.
///
/// This handle must have PROCESS_QUERY_INFORMATION and PROCESS_VM_READ access to the process. If handle information
/// is to be collected then PROCESS_DUP_HANDLE access is also required. For more information, see Process Security and Access
/// Rights. The caller must also be able to get THREAD_ALL_ACCESS access to the threads in the process. For more information,
/// see Thread Security and Access Rights.
///
///
/// The identifier of the process for which the information is to be generated.
/// A handle to the file in which the information is to be written.
///
/// The type of information to be generated. This parameter can be one or more of the values from the MINIDUMP_TYPE enumeration.
///
///
/// A pointer to a MINIDUMP_EXCEPTION_INFORMATION structure describing the client exception that caused the minidump to be
/// generated. If the value of this parameter is NULL, no exception information is included in the minidump file.
///
///
/// A pointer to a MINIDUMP_USER_STREAM_INFORMATION structure. If the value of this parameter is NULL, no user-defined
/// information is included in the minidump file.
///
///
/// A pointer to a MINIDUMP_CALLBACK_INFORMATION structure that specifies a callback routine which is to receive extended minidump
/// information. If the value of this parameter is NULL, no callbacks are performed.
///
///
///
/// If the function succeeds, the return value is TRUE; otherwise, the return value is FALSE. To retrieve extended
/// error information, call GetLastError. Note that the last error will be an HRESULT value.
///
/// If the operation is canceled, the last error code is
/// HRESULT_FROM_WIN32(ERROR_CANCELLED)
/// .
///
///
///
///
/// The MiniDumpCallback function receives extended minidump information from MiniDumpWriteDump. It also provides a way for
/// the caller to determine the granularity of information written to the minidump file, as the callback function can filter the
/// default information.
///
///
/// MiniDumpWriteDump should be called from a separate process if at all possible, rather than from within the target process
/// being dumped. This is especially true when the target process is already not stable. For example, if it just crashed. A loader
/// deadlock is one of many potential side effects of calling MiniDumpWriteDump from within the target process.
///
///
/// MiniDumpWriteDump may not produce a valid stack trace for the calling thread. To work around this problem, you must
/// capture the state of the calling thread before calling MiniDumpWriteDump and use it as the ExceptionParam parameter. One
/// way to do this is to force an exception inside a __try/ __except block and use the EXCEPTION_POINTERS information
/// provided by GetExceptionInformation. Alternatively, you can call the function from a new worker thread and filter this worker
/// thread from the dump.
///
///
/// All DbgHelp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump BOOL MiniDumpWriteDump(
// HANDLE hProcess, DWORD ProcessId, HANDLE hFile, MINIDUMP_TYPE DumpType, PMINIDUMP_EXCEPTION_INFORMATION ExceptionParam,
// PMINIDUMP_USER_STREAM_INFORMATION UserStreamParam, PMINIDUMP_CALLBACK_INFORMATION CallbackParam );
[DllImport(Lib_DbgHelp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("minidumpapiset.h", MSDNShortId = "NF:minidumpapiset.MiniDumpWriteDump")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern unsafe bool MiniDumpWriteDump(HPROCESS hProcess, uint ProcessId, HFILE hFile, MINIDUMP_TYPE DumpType,
[In, Optional] in MINIDUMP_EXCEPTION_INFORMATION ExceptionParam, [In, Optional] in MINIDUMP_USER_STREAM_INFORMATION UserStreamParam,
[In, Optional] in MINIDUMP_CALLBACK_INFORMATION CallbackParam);
/// Writes user-mode minidump information to the specified file.
///
/// A handle to the process for which the information is to be generated.
///
/// This handle must have PROCESS_QUERY_INFORMATION and PROCESS_VM_READ access to the process. If handle information
/// is to be collected then PROCESS_DUP_HANDLE access is also required. For more information, see Process Security and Access
/// Rights. The caller must also be able to get THREAD_ALL_ACCESS access to the threads in the process. For more information,
/// see Thread Security and Access Rights.
///
///
/// The identifier of the process for which the information is to be generated.
/// A handle to the file in which the information is to be written.
///
/// The type of information to be generated. This parameter can be one or more of the values from the MINIDUMP_TYPE enumeration.
///
///
/// A pointer to a MINIDUMP_EXCEPTION_INFORMATION structure describing the client exception that caused the minidump to be
/// generated. If the value of this parameter is NULL, no exception information is included in the minidump file.
///
///
/// A pointer to a MINIDUMP_USER_STREAM_INFORMATION structure. If the value of this parameter is NULL, no user-defined
/// information is included in the minidump file.
///
///
/// A pointer to a MINIDUMP_CALLBACK_INFORMATION structure that specifies a callback routine which is to receive extended minidump
/// information. If the value of this parameter is NULL, no callbacks are performed.
///
///
///
/// If the function succeeds, the return value is TRUE; otherwise, the return value is FALSE. To retrieve extended
/// error information, call GetLastError. Note that the last error will be an HRESULT value.
///
/// If the operation is canceled, the last error code is
/// HRESULT_FROM_WIN32(ERROR_CANCELLED)
/// .
///
///
///
///
/// The MiniDumpCallback function receives extended minidump information from MiniDumpWriteDump. It also provides a way for
/// the caller to determine the granularity of information written to the minidump file, as the callback function can filter the
/// default information.
///
///
/// MiniDumpWriteDump should be called from a separate process if at all possible, rather than from within the target process
/// being dumped. This is especially true when the target process is already not stable. For example, if it just crashed. A loader
/// deadlock is one of many potential side effects of calling MiniDumpWriteDump from within the target process.
///
///
/// MiniDumpWriteDump may not produce a valid stack trace for the calling thread. To work around this problem, you must
/// capture the state of the calling thread before calling MiniDumpWriteDump and use it as the ExceptionParam parameter. One
/// way to do this is to force an exception inside a __try/ __except block and use the EXCEPTION_POINTERS information
/// provided by GetExceptionInformation. Alternatively, you can call the function from a new worker thread and filter this worker
/// thread from the dump.
///
///
/// All DbgHelp functions, such as this one, are single threaded. Therefore, calls from more than one thread to this function will
/// likely result in unexpected behavior or memory corruption. To avoid this, you must synchronize all concurrent calls from more
/// than one thread to this function.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump BOOL MiniDumpWriteDump(
// HANDLE hProcess, DWORD ProcessId, HANDLE hFile, MINIDUMP_TYPE DumpType, PMINIDUMP_EXCEPTION_INFORMATION ExceptionParam,
// PMINIDUMP_USER_STREAM_INFORMATION UserStreamParam, PMINIDUMP_CALLBACK_INFORMATION CallbackParam );
[DllImport(Lib_DbgHelp, SetLastError = true, ExactSpelling = true)]
[PInvokeData("minidumpapiset.h", MSDNShortId = "NF:minidumpapiset.MiniDumpWriteDump")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern unsafe bool MiniDumpWriteDump(HPROCESS hProcess, uint ProcessId, HFILE hFile, MINIDUMP_TYPE DumpType,
[In, Optional] IntPtr ExceptionParam, [In, Optional] IntPtr UserStreamParam,
[In, Optional] IntPtr CallbackParam);
///
[StructLayout(LayoutKind.Sequential, Size =
#if x64
1232)]
#else
716)]
#endif
public struct CONTEXT
{
private ulong f0;
}
///
[PInvokeData("minidumpapiset.h")]
[StructLayout(LayoutKind.Sequential)]
public struct CPU_INFORMATION
{
/// X86 platforms use CPUID function to obtain processor information.
[StructLayout(LayoutKind.Sequential)]
public struct X86CPUINFO
{
/// CPUID Subfunction 0, register EAX (VendorId [0]), EBX (VendorId [1]) and ECX (VendorId [2]).
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)]
public uint[] VendorId;
/// CPUID Subfunction 1, register EAX
public uint VersionInformation;
/// CPUID Subfunction 1, register EDX
public uint FeatureInformation;
/// CPUID, Subfunction 80000001, register EBX. This will only be obtained if the vendor id is "AuthenticAMD".
public uint AMDExtendedCpuFeatures;
}
/// X86 platforms use CPUID function to obtain processor information.
public X86CPUINFO X86CpuInfo;
/// Non-x86 platforms use processor feature flags.
[StructLayout(LayoutKind.Sequential)]
public struct OTHERCPUINFO
{
/// Non-x86 platforms use processor feature flags.
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)]
public ulong[] ProcessorFeatures;
}
/// Non-x86 platforms use processor feature flags.
public OTHERCPUINFO OtherCpuInfo;
}
/// Contains a pointer to an optional callback function that can be used by the MiniDumpWriteDump function.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_callback_information typedef struct
// _MINIDUMP_CALLBACK_INFORMATION { MINIDUMP_CALLBACK_ROUTINE CallbackRoutine; PVOID CallbackParam; } MINIDUMP_CALLBACK_INFORMATION, *PMINIDUMP_CALLBACK_INFORMATION;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_CALLBACK_INFORMATION")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_CALLBACK_INFORMATION
{
/// A pointer to the MiniDumpCallback callback function.
[MarshalAs(UnmanagedType.FunctionPtr)]
public MINIDUMP_CALLBACK_ROUTINE CallbackRoutine;
/// The application-defined data for CallbackRoutine.
public IntPtr CallbackParam;
}
/// Contains information used by the MiniDumpCallback function.
///
/// If CallbackType is CancelCallback or MemoryCallback, the ProcessId, ProcessHandle, and
/// CallbackType members are valid but no other input is specified.
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_callback_input typedef struct
// _MINIDUMP_CALLBACK_INPUT { ULONG ProcessId; HANDLE ProcessHandle; ULONG CallbackType; union { HRESULT Status;
// MINIDUMP_THREAD_CALLBACK Thread; MINIDUMP_THREAD_EX_CALLBACK ThreadEx; MINIDUMP_MODULE_CALLBACK Module;
// MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread; MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule; MINIDUMP_IO_CALLBACK Io;
// MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure; ULONG SecondaryFlags; MINIDUMP_VM_QUERY_CALLBACK VmQuery;
// MINIDUMP_VM_PRE_READ_CALLBACK VmPreRead; MINIDUMP_VM_POST_READ_CALLBACK VmPostRead; }; } MINIDUMP_CALLBACK_INPUT, *PMINIDUMP_CALLBACK_INPUT;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_CALLBACK_INPUT")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_CALLBACK_INPUT
{
///
/// The identifier of the process that contains callback function.
/// This member is not used if CallbackType is IoStartCallback.
///
public uint ProcessId;
///
/// A handle to the process that contains the callback function.
/// This member is not used if CallbackType is IoStartCallback.
///
public HPROCESS ProcessHandle;
/// The type of callback function. This member can be one of the values in the MINIDUMP_CALLBACK_TYPE enumeration.
public MINIDUMP_CALLBACK_TYPE CallbackType;
/// Internal union.
private UNION Union;
///
/// If CallbackType is KernelMinidumpStatusCallback, the union is an HRESULT value that indicates the
/// status of the kernel minidump write attempt.
///
public HRESULT Status { get => Union.Status; set => Union.Status = value; }
/// If CallbackType is ThreadCallback, the union is a MINIDUMP_THREAD_CALLBACK structure.
public MINIDUMP_THREAD_CALLBACK Thread { get => Union.Thread; set => Union.Thread = value; }
/// If CallbackType is ThreadExCallback, the union is a MINIDUMP_THREAD_EX_CALLBACK structure.
public MINIDUMP_THREAD_EX_CALLBACK ThreadEx { get => Union.ThreadEx; set => Union.ThreadEx = value; }
/// If CallbackType is ModuleCallback, the union is a MINIDUMP_MODULE_CALLBACK structure.
public MINIDUMP_MODULE_CALLBACK Module { get => Union.Module; set => Union.Module = value; }
///
/// If CallbackType is IncludeThreadCallback, the union is a MINIDUMP_INCLUDE_THREAD_CALLBACK structure.
/// DbgHelp 6.2 and earlier: This member is not available.
///
public MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread { get => Union.IncludeThread; set => Union.IncludeThread = value; }
///
/// If CallbackType is IncludeModuleCallback, the union is a MINIDUMP_INCLUDE_MODULE_CALLBACK structure.
/// DbgHelp 6.2 and earlier: This member is not available.
///
public MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule { get => Union.IncludeModule; set => Union.IncludeModule = value; }
///
///
/// If CallbackType is IoStartCallback, IoWriteAllCallback, or IoFinishCallback, the union is a
/// MINIDUMP_IO_CALLBACK structure.
///
/// DbgHelp 6.4 and earlier: This member is not available.
///
public MINIDUMP_IO_CALLBACK Io { get => Union.Io; set => Union.Io = value; }
///
///
/// If CallbackType is ReadMemoryFailureCallback, the union is a MINIDUMP_READ_MEMORY_FAILURE_CALLBACK structure.
///
/// DbgHelp 6.4 and earlier: This member is not available.
///
public MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure { get => Union.ReadMemoryFailure; set => Union.ReadMemoryFailure = value; }
///
/// Contains a value from the MINIDUMP_SECONDARY_FLAGS enumeration type.
/// DbgHelp 6.5 and earlier: This member is not available.
///
public MINIDUMP_SECONDARY_FLAGS SecondaryFlags { get => Union.SecondaryFlags; set => Union.SecondaryFlags = value; }
///
public MINIDUMP_VM_QUERY_CALLBACK VmQuery { get => Union.VmQuery; set => Union.VmQuery = value; }
///
public MINIDUMP_VM_PRE_READ_CALLBACK VmPreRead { get => Union.VmPreRead; set => Union.VmPreRead = value; }
///
public MINIDUMP_VM_POST_READ_CALLBACK VmPostRead { get => Union.VmPostRead; set => Union.VmPostRead = value; }
/// Internal union.
[StructLayout(LayoutKind.Explicit)]
private struct UNION
{
[FieldOffset(0)]
internal HRESULT Status;
[FieldOffset(0)]
internal MINIDUMP_THREAD_CALLBACK Thread;
[FieldOffset(0)]
internal MINIDUMP_THREAD_EX_CALLBACK ThreadEx;
[FieldOffset(0)]
internal MINIDUMP_MODULE_CALLBACK Module;
[FieldOffset(0)]
internal MINIDUMP_INCLUDE_THREAD_CALLBACK IncludeThread;
[FieldOffset(0)]
internal MINIDUMP_INCLUDE_MODULE_CALLBACK IncludeModule;
[FieldOffset(0)]
internal MINIDUMP_IO_CALLBACK Io;
[FieldOffset(0)]
internal MINIDUMP_READ_MEMORY_FAILURE_CALLBACK ReadMemoryFailure;
[FieldOffset(0)]
internal MINIDUMP_SECONDARY_FLAGS SecondaryFlags;
[FieldOffset(0)]
internal MINIDUMP_VM_QUERY_CALLBACK VmQuery;
[FieldOffset(0)]
internal MINIDUMP_VM_PRE_READ_CALLBACK VmPreRead;
[FieldOffset(0)]
internal MINIDUMP_VM_POST_READ_CALLBACK VmPostRead;
}
}
/// Contains information returned by the MiniDumpCallback function.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_callback_output typedef struct
// _MINIDUMP_CALLBACK_OUTPUT { union { ULONG ModuleWriteFlags; ULONG ThreadWriteFlags; ULONG SecondaryFlags; struct { ULONG64
// MemoryBase; ULONG MemorySize; }; struct { BOOL CheckCancel; BOOL Cancel; }; HANDLE Handle; struct { MINIDUMP_MEMORY_INFO
// VmRegion; BOOL Continue; }; struct { HRESULT VmQueryStatus; MINIDUMP_MEMORY_INFO VmQueryResult; }; struct { HRESULT VmReadStatus;
// ULONG VmReadBytesCompleted; }; HRESULT Status; }; } MINIDUMP_CALLBACK_OUTPUT, *PMINIDUMP_CALLBACK_OUTPUT;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_CALLBACK_OUTPUT")]
[StructLayout(LayoutKind.Explicit)]
public struct MINIDUMP_CALLBACK_OUTPUT
{
///
///
/// The module write operation flags. This member can be one or more of the values in the MODULE_WRITE_FLAGS enumeration. The
/// flags are set to their default values on entry to the callback.
///
/// This member is ignored unless the callback type is IncludeModuleCallback or ModuleCallback.
///
[FieldOffset(0)]
public MODULE_WRITE_FLAGS ModuleWriteFlags;
///
///
/// The thread write operation flags. This member can be one or more of the values in the THREAD_WRITE_FLAGS enumeration. The
/// flags are set to their default values on entry to the callback.
///
/// This member is ignored unless the callback type is IncludeThreadCallback, ThreadCallback, or ThreadExCallback.
///
[FieldOffset(0)]
public THREAD_WRITE_FLAGS ThreadWriteFlags;
///
/// Contains a value from the MINIDUMP_SECONDARY_FLAGS enumeration type.
/// DbgHelp 6.5 and earlier: This member is not available.
///
[FieldOffset(0)]
public MINIDUMP_SECONDARY_FLAGS SecondaryFlags;
///
/// The base address of the memory region to be included in the dump.
/// This member is ignored unless the callback type is MemoryCallback or RemoveMemoryCallback.
///
[FieldOffset(0)]
public ulong MemoryBase;
///
/// The size of the memory region to be included in the dump, in bytes.
/// This member is ignored unless the callback type is MemoryCallback or RemoveMemoryCallback.
///
[FieldOffset(8)]
public uint MemorySize;
///
///
/// Controls whether the callback function should receive cancel callbacks. If this member is TRUE, the cancel callbacks
/// will continue. Otherwise, they will not.
///
/// This member is ignored unless the callback type is CancelCallback.
///
[FieldOffset(0)]
[MarshalAs(UnmanagedType.Bool)] public bool CheckCancel;
///
///
/// Controls whether the dump should be canceled. If the callback function returns TRUE and Cancel is TRUE,
/// the dump will be canceled. In this case, the MiniDumpWriteDump function fails and the dump is not valid.
///
/// This member is ignored unless the callback type is CancelCallback.
///
[FieldOffset(4)]
[MarshalAs(UnmanagedType.Bool)] public bool Cancel;
///
/// A handle to the file to which a kernel minidump will be written.
/// This member is ignored unless the callback type is WriteKernelMinidumpCallback.
///
[FieldOffset(0)]
public HFILE Handle;
///
///
/// A MINIDUMP_MEMORY_INFO structure that describes the virtual memory region. The region base and size must be aligned on a
/// page boundary. The region size can be set to 0 to filter out the region.
///
/// This member is ignored unless the callback type is IncludeVmRegionCallback.
///
[FieldOffset(0)]
public MINIDUMP_MEMORY_INFO VmRegion;
///
///
/// Controls whether the dump should be continued. If the callback function returns TRUE and Continue is
/// TRUE, the dump will be continued. Otherwise, the MiniDumpWriteDump function fails and the dump is not valid.
///
/// This member is ignored unless the callback type is IncludeVmRegionCallback.
///
[FieldOffset(48)]
[MarshalAs(UnmanagedType.Bool)]
public bool Continue;
///
[FieldOffset(0)]
public HRESULT VmQueryStatus;
///
public MINIDUMP_MEMORY_INFO VmQueryResult { get => ptrmi.f1; set => ptrmi.f1 = value; }
///
[FieldOffset(0)]
public HRESULT VmReadStatus;
///
public uint VmReadBytesCompleted { get => ptrUint.f1; set => ptrUint.f1 = value; }
///
/// The status of the operation.
///
/// This member is ignored unless the callback type is ReadMemoryFailureCallback, IoStartCallback,
/// IoWriteAllCallback, or IoFinishCallback.
///
///
[FieldOffset(0)]
public HRESULT Status;
[FieldOffset(0)]
private PtrUint ptrUint;
[FieldOffset(0)]
private PtrMI ptrmi;
[StructLayout(LayoutKind.Sequential)]
private struct PtrUint
{
private IntPtr f0;
internal uint f1;
}
[StructLayout(LayoutKind.Sequential)]
private struct PtrMI
{
private IntPtr f0;
internal MINIDUMP_MEMORY_INFO f1;
}
}
/// Contains the information needed to access a specific data stream in a minidump file.
/// In this context, a data stream is a block of data within a minidump file.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_directory typedef struct
// _MINIDUMP_DIRECTORY { ULONG32 StreamType; MINIDUMP_LOCATION_DESCRIPTOR Location; } MINIDUMP_DIRECTORY, *PMINIDUMP_DIRECTORY;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_DIRECTORY")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_DIRECTORY
{
/// The type of data stream. This member can be one of the values in the MINIDUMP_STREAM_TYPE enumeration.
public MINIDUMP_STREAM_TYPE StreamType;
/// A MINIDUMP_LOCATION_DESCRIPTOR structure that specifies the location of the data stream.
public MINIDUMP_LOCATION_DESCRIPTOR Location;
}
/// Contains exception information.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_exception typedef struct
// _MINIDUMP_EXCEPTION { ULONG32 ExceptionCode; ULONG32 ExceptionFlags; ULONG64 ExceptionRecord; ULONG64 ExceptionAddress; ULONG32
// NumberParameters; ULONG32 __unusedAlignment; ULONG64 ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; } MINIDUMP_EXCEPTION, *PMINIDUMP_EXCEPTION;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_EXCEPTION")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_EXCEPTION
{
///
///
/// The reason the exception occurred. This is the code generated by a hardware exception, or the code specified in the
/// RaiseException function for a software-generated exception. Following are the exception codes likely to occur due to common
/// programming errors.
///
///
///
/// Value
/// Meaning
///
/// -
/// EXCEPTION_ACCESS_VIOLATION
/// The thread tried to read from or write to a virtual address for which it does not have the appropriate access.
///
/// -
/// EXCEPTION_ARRAY_BOUNDS_EXCEEDED
/// The thread tried to access an array element that is out of bounds and the underlying hardware supports bounds checking.
///
/// -
/// EXCEPTION_BREAKPOINT
/// A breakpoint was encountered.
///
/// -
/// EXCEPTION_DATATYPE_MISALIGNMENT
///
/// The thread tried to read or write data that is misaligned on hardware that does not provide alignment. For example, 16-bit
/// values must be aligned on 2-byte boundaries; 32-bit values on 4-byte boundaries, and so on.
///
///
/// -
/// EXCEPTION_FLT_DENORMAL_OPERAND
///
/// One of the operands in a floating-point operation is denormal. A denormal value is one that is too small to represent as a
/// standard floating-point value.
///
///
/// -
/// EXCEPTION_FLT_DIVIDE_BY_ZERO
/// The thread tried to divide a floating-point value by a floating-point divisor of zero.
///
/// -
/// EXCEPTION_FLT_INEXACT_RESULT
/// The result of a floating-point operation cannot be represented exactly as a decimal fraction.
///
/// -
/// EXCEPTION_FLT_INVALID_OPERATION
/// This exception represents any floating-point exception not included in this list.
///
/// -
/// EXCEPTION_FLT_OVERFLOW
/// The exponent of a floating-point operation is greater than the magnitude allowed by the corresponding type.
///
/// -
/// EXCEPTION_FLT_STACK_CHECK
/// The stack overflowed or underflowed as the result of a floating-point operation.
///
/// -
/// EXCEPTION_FLT_UNDERFLOW
/// The exponent of a floating-point operation is less than the magnitude allowed by the corresponding type.
///
/// -
/// EXCEPTION_ILLEGAL_INSTRUCTION
/// The thread tried to execute an invalid instruction.
///
/// -
/// EXCEPTION_IN_PAGE_ERROR
///
/// The thread tried to access a page that was not present, and the system was unable to load the page. For example, this
/// exception might occur if a network connection is lost while running a program over the network.
///
///
/// -
/// EXCEPTION_INT_DIVIDE_BY_ZERO
/// The thread tried to divide an integer value by an integer divisor of zero.
///
/// -
/// EXCEPTION_INT_OVERFLOW
/// The result of an integer operation caused a carry out of the most significant bit of the result.
///
/// -
/// EXCEPTION_INVALID_DISPOSITION
///
/// An exception handler returned an invalid disposition to the exception dispatcher. Programmers using a high-level language
/// such as C should never encounter this exception.
///
///
/// -
/// EXCEPTION_NONCONTINUABLE_EXCEPTION
/// The thread tried to continue execution after a noncontinuable exception occurred.
///
/// -
/// EXCEPTION_PRIV_INSTRUCTION
/// The thread tried to execute an instruction whose operation is not allowed in the current machine mode.
///
/// -
/// EXCEPTION_SINGLE_STEP
/// A trace trap or other single-instruction mechanism signaled that one instruction has been executed.
///
/// -
/// EXCEPTION_STACK_OVERFLOW
/// The thread used up its stack.
///
///
///
/// Another exception code is likely to occur when debugging console processes. It does not arise because of a programming
/// error. The DBG_CONTROL_C exception code occurs when CTRL+C is input to a console process that handles CTRL+C signals and is
/// being debugged. This exception code is not meant to be handled by applications. It is raised only for the benefit of the
/// debugger, and is raised only when a debugger is attached to the console process.
///
///
public NTStatus ExceptionCode;
///
/// This member can be either zero, indicating a continuable exception, or EXCEPTION_NONCONTINUABLE, indicating a noncontinuable
/// exception. Any attempt to continue execution after a noncontinuable exception causes the EXCEPTION_NONCONTINUABLE_EXCEPTION exception.
///
public Kernel32.EXCEPTION_FLAG ExceptionFlags;
///
/// A pointer to an associated MINIDUMP_EXCEPTION structure. Exception records can be chained together to provide
/// additional information when nested exceptions occur.
///
public ulong ExceptionRecord;
/// The address where the exception occurred.
public ulong ExceptionAddress;
///
/// The number of parameters associated with the exception. This is the number of defined elements in the
/// ExceptionInformation array.
///
public uint NumberParameters;
/// Reserved for cross-platform structure member alignment. Do not set.
private uint unusedAlignment;
///
///
/// An array of additional arguments that describe the exception. The RaiseException function can specify this array of
/// arguments. For most exception codes, the array elements are undefined. For the following exception code, the array elements
/// are defined as follows.
///
///
///
/// Exception code
/// Meaning
///
/// -
/// EXCEPTION_ACCESS_VIOLATION
///
/// The first element of the array contains a read/write flag that indicates the type of operation that caused the access
/// violation. If this value is zero, the thread attempted to read the inaccessible data. If this value is 1, the thread
/// attempted to write to an inaccessible address. The second array element specifies the virtual address of the inaccessible data.
///
///
///
///
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 15)]
public ulong[] ExceptionInformation;
}
/// Contains the exception information written to the minidump file by the MiniDumpWriteDump function.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_exception_information typedef struct
// _MINIDUMP_EXCEPTION_INFORMATION { DWORD ThreadId; PEXCEPTION_POINTERS ExceptionPointers; BOOL ClientPointers; }
// MINIDUMP_EXCEPTION_INFORMATION, *PMINIDUMP_EXCEPTION_INFORMATION;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_EXCEPTION_INFORMATION")]
[StructLayout(LayoutKind.Sequential, Pack = 4)]
public struct MINIDUMP_EXCEPTION_INFORMATION
{
/// The identifier of the thread throwing the exception.
public uint ThreadId;
///
/// A pointer to an EXCEPTION_POINTERS structure specifying a computer-independent description of the exception and the
/// processor context at the time of the exception.
///
public IntPtr ExceptionPointers;
///
/// Determines where to get the memory regions pointed to by the ExceptionPointers member. Set to TRUE if the
/// memory resides in the process being debugged (the target process of the debugger). Otherwise, set to FALSE if the
/// memory resides in the address space of the calling program (the debugger process). If you are accessing local memory (in the
/// calling process) you should not set this member to TRUE.
///
[MarshalAs(UnmanagedType.Bool)]
public bool ClientPointers;
}
/// Represents an exception information stream.
/// In this context, a data stream is a set of data in a minidump file.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_exception_stream typedef struct
// MINIDUMP_EXCEPTION_STREAM { ULONG32 ThreadId; ULONG32 __alignment; MINIDUMP_EXCEPTION ExceptionRecord;
// MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; } MINIDUMP_EXCEPTION_STREAM, *PMINIDUMP_EXCEPTION_STREAM;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset.MINIDUMP_EXCEPTION_STREAM")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_EXCEPTION_STREAM
{
/// The identifier of the thread that caused the exception.
public uint ThreadId;
/// A variable for alignment.
private uint __alignment;
/// A MINIDUMP_EXCEPTION structure.
public MINIDUMP_EXCEPTION ExceptionRecord;
/// A MINIDUMP_LOCATION_DESCRIPTOR structure.
public MINIDUMP_LOCATION_DESCRIPTOR ThreadContext;
}
/// Represents a function table stream.
///
/// The first descriptor in the function table stream follows the header, MINIDUMP_FUNCTION_TABLE_STREAM. The generic descriptor is
/// followed by a native system descriptor, then by EntryCount native system function entry structures.
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_function_table_descriptor typedef
// struct _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR { ULONG64 MinimumAddress; ULONG64 MaximumAddress; ULONG64 BaseAddress; ULONG32
// EntryCount; ULONG32 SizeOfAlignPad; } MINIDUMP_FUNCTION_TABLE_DESCRIPTOR, *PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_FUNCTION_TABLE_DESCRIPTOR")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_FUNCTION_TABLE_DESCRIPTOR
{
/// The minimum address of functions described by the table.
public ulong MinimumAddress;
/// The maximum address of functions described by the table.
public ulong MaximumAddress;
/// The base address to use when computing full virtual addresses from relative virtual addresses in function entries.
public ulong BaseAddress;
/// The number of entries in the function table.
public uint EntryCount;
///
/// The size of alignment padding that follows the function entry data, in bytes. The function entry data in the stream is
/// guaranteed to be aligned appropriately for access to the data members. If a minidump is directly mapped in memory, it is
/// always possible to directly reference structure members in the stream.
///
public uint SizeOfAlignPad;
}
/// Represents the header for the function table stream.
///
/// In this context, a data stream is a set of data in a minidump file. This header structure is followed by
/// NumberOfDescriptors function tables. For each function table there is a MINIDUMP_FUNCTION_TABLE_DESCRIPTOR structure,
/// then the raw system descriptor for the table, then the raw system function entry data. If necessary, alignment padding is placed
/// between tables to properly align the initial structures.
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_function_table_stream typedef struct
// _MINIDUMP_FUNCTION_TABLE_STREAM { ULONG32 SizeOfHeader; ULONG32 SizeOfDescriptor; ULONG32 SizeOfNativeDescriptor; ULONG32
// SizeOfFunctionEntry; ULONG32 NumberOfDescriptors; ULONG32 SizeOfAlignPad; } MINIDUMP_FUNCTION_TABLE_STREAM, *PMINIDUMP_FUNCTION_TABLE_STREAM;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_FUNCTION_TABLE_STREAM")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_FUNCTION_TABLE_STREAM
{
///
/// The size of header information for the stream, in bytes. This value is
/// sizeof(MINIDUMP_FUNCTION_TABLE_STREAM)
/// .
///
public uint SizeOfHeader;
///
/// The size of a descriptor in the stream, in bytes. This value is
/// sizeof(MINIDUMP_FUNCTION_TABLE_DESCRIPTOR)
/// .
///
public uint SizeOfDescriptor;
///
/// The size of a raw system descriptor in the stream, in bytes. This value depends on the particular platform and system
/// version on which the minidump was generated.
///
public uint SizeOfNativeDescriptor;
///
/// The size of a raw system function table entry, in bytes. This value depends on the particular platform and system version on
/// which the minidump was generated.
///
public uint SizeOfFunctionEntry;
/// The number of descriptors in the stream.
public uint NumberOfDescriptors;
/// The size of alignment padding that follows the header, in bytes.
public uint SizeOfAlignPad;
}
/// Represents the header for a handle data stream.
///
/// In this context, a data stream is a set of data in a minidump file. This header structure is followed by
/// NumberOfDescriptors MINIDUMP_HANDLE_DESCRIPTOR or MINIDUMP_HANDLE_DESCRIPTOR_2 structures.
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_handle_data_stream typedef struct
// _MINIDUMP_HANDLE_DATA_STREAM { ULONG32 SizeOfHeader; ULONG32 SizeOfDescriptor; ULONG32 NumberOfDescriptors; ULONG32 Reserved; }
// MINIDUMP_HANDLE_DATA_STREAM, *PMINIDUMP_HANDLE_DATA_STREAM;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_HANDLE_DATA_STREAM")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_HANDLE_DATA_STREAM
{
///
/// The size of the header information for the stream, in bytes. This value is
/// sizeof(MINIDUMP_HANDLE_DATA_STREAM)
/// .
///
public uint SizeOfHeader;
///
/// The size of a descriptor in the stream, in bytes. This value is
/// sizeof(MINIDUMP_HANDLE_DESCRIPTOR)
/// or
/// sizeof(MINIDUMP_HANDLE_DESCRIPTOR_2)
/// .
///
public uint SizeOfDescriptor;
/// The number of descriptors in the stream.
public uint NumberOfDescriptors;
/// Reserved for future use; must be zero.
public uint Reserved;
}
/// Contains the state of an individual system handle at the time the minidump was written.
/// The first descriptor in the handle data stream follows the header, MINIDUMP_HANDLE_DATA_STREAM.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_handle_descriptor typedef struct
// _MINIDUMP_HANDLE_DESCRIPTOR { ULONG64 Handle; RVA TypeNameRva; RVA ObjectNameRva; ULONG32 Attributes; ULONG32 GrantedAccess;
// ULONG32 HandleCount; ULONG32 PointerCount; } MINIDUMP_HANDLE_DESCRIPTOR, *PMINIDUMP_HANDLE_DESCRIPTOR;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_HANDLE_DESCRIPTOR")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_HANDLE_DESCRIPTOR
{
/// The operating system handle value.
public ulong Handle;
/// An RVA to a MINIDUMP_STRING structure that specifies the object type of the handle. This member can be zero.
public uint TypeNameRva;
/// An RVA to a MINIDUMP_STRING structure that specifies the object name of the handle. This member can be zero.
public uint ObjectNameRva;
/// The meaning of this member depends on the handle type and the operating system.
public uint Attributes;
/// The meaning of this member depends on the handle type and the operating system.
public uint GrantedAccess;
/// The meaning of this member depends on the handle type and the operating system.
public uint HandleCount;
/// The meaning of this member depends on the handle type and the operating system.
public uint PointerCount;
}
/// Describes the state of an individual system handle at the time the minidump was written.
/// The first descriptor in the handle data stream follows the header, MINIDUMP_HANDLE_DATA_STREAM.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_handle_descriptor_2 typedef struct
// _MINIDUMP_HANDLE_DESCRIPTOR_2 { ULONG64 Handle; RVA TypeNameRva; RVA ObjectNameRva; ULONG32 Attributes; ULONG32 GrantedAccess;
// ULONG32 HandleCount; ULONG32 PointerCount; RVA ObjectInfoRva; ULONG32 Reserved0; } MINIDUMP_HANDLE_DESCRIPTOR_2, *PMINIDUMP_HANDLE_DESCRIPTOR_2;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_HANDLE_DESCRIPTOR_2")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_HANDLE_DESCRIPTOR_2
{
/// The operating system handle value.
public ulong Handle;
/// An RVA to a MINIDUMP_STRING structure that specifies the object type of the handle. This member can be zero.
public uint TypeNameRva;
/// An RVA to a MINIDUMP_STRING structure that specifies the object name of the handle. This member can be 0.
public uint ObjectNameRva;
/// The meaning of this member depends on the handle type and the operating system.
public uint Attributes;
/// The meaning of this member depends on the handle type and the operating system.
public uint GrantedAccess;
/// The meaning of this member depends on the handle type and the operating system.
public uint HandleCount;
/// The meaning of this member depends on the handle type and the operating system.
public uint PointerCount;
///
/// An RVA to a MINIDUMP_HANDLE_OBJECT_INFORMATION structure that specifies object-specific information. This member can be 0 if
/// there is no extra information.
///
public uint ObjectInfoRva;
/// Reserved for future use; must be zero.
public uint Reserved0;
}
/// Contains object-specific information for a handle.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_handle_object_information typedef
// struct _MINIDUMP_HANDLE_OBJECT_INFORMATION { RVA NextInfoRva; ULONG32 InfoType; ULONG32 SizeOfInfo; } MINIDUMP_HANDLE_OBJECT_INFORMATION;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_HANDLE_OBJECT_INFORMATION")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_HANDLE_OBJECT_INFORMATION
{
///
/// An RVA to a MINIDUMP_HANDLE_OBJECT_INFORMATION structure that specifies additional object-specific information. This
/// member is 0 if there are no more elements in the list.
///
public uint NextInfoRva;
///
/// The object information type. This member is one of the values from the MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE enumeration.
///
public MINIDUMP_HANDLE_OBJECT_INFORMATION_TYPE InfoType;
/// The size of the information that follows this member, in bytes.
public uint SizeOfInfo;
}
/// Contains a list of handle operations.
/// For a definition of the AVRF_HANDLE_OPERATION structure, see the Avrfsdk.h header file.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_handle_operation_list typedef struct
// _MINIDUMP_HANDLE_OPERATION_LIST { ULONG32 SizeOfHeader; ULONG32 SizeOfEntry; ULONG32 NumberOfEntries; ULONG32 Reserved; }
// MINIDUMP_HANDLE_OPERATION_LIST, *PMINIDUMP_HANDLE_OPERATION_LIST;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_HANDLE_OPERATION_LIST")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_HANDLE_OPERATION_LIST
{
///
/// The size of the header data for the stream, in bytes. This is generally
/// sizeof(MINIDUMP_HANDLE_OPERATION_LIST)
/// .
///
public uint SizeOfHeader;
///
/// The size of each entry following the header, in bytes. This is generally
/// sizeof(AVRF_HANDLE_OPERATION)
/// .
///
public uint SizeOfEntry;
///
/// The number of entries in the stream. These are generally AVRF_HANDLE_OPERATION structures. The entries follow the header.
///
public uint NumberOfEntries;
/// This member is reserved for future use.
public uint Reserved;
}
/// Contains header information for the minidump file.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_header typedef struct
// _MINIDUMP_HEADER { ULONG32 Signature; ULONG32 Version; ULONG32 NumberOfStreams; RVA StreamDirectoryRva; ULONG32 CheckSum; union {
// ULONG32 Reserved; ULONG32 TimeDateStamp; }; ULONG64 Flags; } MINIDUMP_HEADER, *PMINIDUMP_HEADER;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_HEADER")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_HEADER
{
/// The signature. Set this member to MINIDUMP_SIGNATURE.
public uint Signature;
///
/// The version of the minidump format. The low-order word is MINIDUMP_VERSION. The high-order word is an internal value that is
/// implementation specific.
///
public uint Version;
/// The number of streams in the minidump directory.
public uint NumberOfStreams;
/// The base RVA of the minidump directory. The directory is an array of MINIDUMP_DIRECTORY structures.
public uint StreamDirectoryRva;
/// The checksum for the minidump file. This member can be zero.
public uint CheckSum;
/// Time and date, in time_t format.
public time_t TimeDateStamp;
/// One or more values from the MINIDUMP_TYPE enumeration type.
public ulong Flags;
}
/// Contains information for the MiniDumpCallback function when the callback type is IncludeModuleCallback.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_include_module_callback typedef
// struct _MINIDUMP_INCLUDE_MODULE_CALLBACK { ULONG64 BaseOfImage; } MINIDUMP_INCLUDE_MODULE_CALLBACK, *PMINIDUMP_INCLUDE_MODULE_CALLBACK;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_INCLUDE_MODULE_CALLBACK")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_INCLUDE_MODULE_CALLBACK
{
/// The base address of the executable image in memory.
public ulong BaseOfImage;
}
/// Contains information for the MiniDumpCallback function when the callback type is IncludeThreadCallback.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_include_thread_callback typedef
// struct _MINIDUMP_INCLUDE_THREAD_CALLBACK { ULONG ThreadId; } MINIDUMP_INCLUDE_THREAD_CALLBACK, *PMINIDUMP_INCLUDE_THREAD_CALLBACK;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_INCLUDE_THREAD_CALLBACK")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_INCLUDE_THREAD_CALLBACK
{
/// The identifier of the thread.
public uint ThreadId;
}
///
/// Contains I/O callback information. This structure is used by the MiniDumpCallbackfunction when the callback type is
/// IoStartCallback, IoWriteAllCallback, or IoFinishCallback.
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_io_callback typedef struct
// _MINIDUMP_IO_CALLBACK { HANDLE Handle; ULONG64 Offset; PVOID Buffer; ULONG BufferBytes; } MINIDUMP_IO_CALLBACK, *PMINIDUMP_IO_CALLBACK;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_IO_CALLBACK")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_IO_CALLBACK
{
/// The file handle passed to the MiniDumpWriteDump function.
public HFILE Handle;
/// The offset for the write operation from the start of the minidump data. This member is used only with IoWriteAllCallback.
public ulong Offset;
/// A pointer to a buffer that contains the data to be written. This member is used only with IoWriteAllCallback.
public IntPtr Buffer;
/// The size of the data buffer, in bytes. This member is used only with IoWriteAllCallback.
public uint BufferBytes;
}
/// Contains information describing the location of a data stream within a minidump file.
///
/// In this context, a data stream refers to a block of data within a minidump file.
///
/// This structure uses 32-bit locations for RVAs in the first 4GB and 64-bit locations are used for larger RVAs. The
/// MINIDUMP_LOCATION_DESCRIPTOR64 structure is defined as follows.
///
///
/// typedef struct _MINIDUMP_LOCATION_DESCRIPTOR64 { ULONG64 DataSize; RVA64 Rva; } MINIDUMP_LOCATION_DESCRIPTOR64;
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_location_descriptor typedef struct
// _MINIDUMP_LOCATION_DESCRIPTOR { ULONG32 DataSize; RVA Rva; } MINIDUMP_LOCATION_DESCRIPTOR;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_LOCATION_DESCRIPTOR")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_LOCATION_DESCRIPTOR
{
/// The size of the data stream, in bytes.
public uint DataSize;
///
/// The relative virtual address (RVA) of the data. This is the byte offset of the data stream from the beginning of the
/// minidump file.
///
public uint Rva;
}
/// Describes a range of memory.
///
///
/// MINIDUMP_MEMORY_DESCRIPTOR64 is used for full-memory minidumps where all of the raw memory is sequential at the end of
/// the minidump. There is no need for individual relative virtual addresses (RVAs), because the RVA is the base RVA plus the sum of
/// the preceding data blocks. The MINIDUMP_MEMORY_DESCRIPTOR64 structure is defined as follows.
///
///
/// typedef struct _MINIDUMP_MEMORY_DESCRIPTOR64 { ULONG64 StartOfMemoryRange; ULONG64 DataSize; } MINIDUMP_MEMORY_DESCRIPTOR64, *PMINIDUMP_MEMORY_DESCRIPTOR64;
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_memory_descriptor typedef struct
// _MINIDUMP_MEMORY_DESCRIPTOR { ULONG64 StartOfMemoryRange; MINIDUMP_LOCATION_DESCRIPTOR Memory; } MINIDUMP_MEMORY_DESCRIPTOR, *PMINIDUMP_MEMORY_DESCRIPTOR;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MEMORY_DESCRIPTOR")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_MEMORY_DESCRIPTOR
{
/// The starting address of the memory range.
public ulong StartOfMemoryRange;
/// A MINIDUMP_LOCATION_DESCRIPTOR structure.
public MINIDUMP_LOCATION_DESCRIPTOR Memory;
}
/// Describes a region of memory.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_memory_info typedef struct
// _MINIDUMP_MEMORY_INFO { ULONG64 BaseAddress; ULONG64 AllocationBase; ULONG32 AllocationProtect; ULONG32 __alignment1; ULONG64
// RegionSize; ULONG32 State; ULONG32 Protect; ULONG32 Type; ULONG32 __alignment2; } MINIDUMP_MEMORY_INFO, *PMINIDUMP_MEMORY_INFO;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MEMORY_INFO")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_MEMORY_INFO
{
/// The base address of the region of pages.
public ulong BaseAddress;
/// The base address of a range of pages in this region. The page is contained within this memory region.
public ulong AllocationBase;
///
/// The memory protection when the region was initially allocated. This member can be one of the memory protection options,
/// along with PAGE_GUARD or PAGE_NOCACHE, as needed.
///
public uint AllocationProtect;
/// A variable for alignment.
private uint __alignment1;
/// The size of the region beginning at the base address in which all pages have identical attributes, in bytes.
public ulong RegionSize;
///
/// The state of the pages in the region. This member can be one of the following values.
///
///
/// State
/// Meaning
///
/// -
/// MEM_COMMIT 0x1000
///
/// Indicates committed pages for which physical storage has been allocated, either in memory or in the paging file on disk.
///
///
/// -
/// MEM_FREE 0x10000
///
/// Indicates free pages not accessible to the calling process and available to be allocated. For free pages, the information in
/// the AllocationBase, AllocationProtect, Protect, and Type members is undefined.
///
///
/// -
/// MEM_RESERVE 0x2000
///
/// Indicates reserved pages where a range of the process's virtual address space is reserved without any physical storage being
/// allocated. For reserved pages, the information in the Protect member is undefined.
///
///
///
///
public uint State;
///
/// The access protection of the pages in the region. This member is one of the values listed for the AllocationProtect member.
///
public uint Protect;
///
/// The type of pages in the region. The following types are defined.
///
///
/// Type
/// Meaning
///
/// -
/// MEM_IMAGE 0x1000000
/// Indicates that the memory pages within the region are mapped into the view of an image section.
///
/// -
/// MEM_MAPPED 0x40000
/// Indicates that the memory pages within the region are mapped into the view of a section.
///
/// -
/// MEM_PRIVATE 0x20000
/// Indicates that the memory pages within the region are private (that is, not shared by other processes).
///
///
///
public uint Type;
/// A variable for alignment.
private uint __alignment2;
}
/// Contains a list of memory regions.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_memory_info_list typedef struct
// _MINIDUMP_MEMORY_INFO_LIST { ULONG SizeOfHeader; ULONG SizeOfEntry; ULONG64 NumberOfEntries; } MINIDUMP_MEMORY_INFO_LIST, *PMINIDUMP_MEMORY_INFO_LIST;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MEMORY_INFO_LIST")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_MEMORY_INFO_LIST
{
///
/// The size of the header data for the stream, in bytes. This is generally
/// sizeof(MINIDUMP_MEMORY_INFO_LIST)
/// .
///
public uint SizeOfHeader;
///
/// The size of each entry following the header, in bytes. This is generally
/// sizeof(MINIDUMP_MEMORY_INFO)
/// .
///
public uint SizeOfEntry;
///
/// The number of entries in the stream. These are generally MINIDUMP_MEMORY_INFO structures. The entries follow the header.
///
public ulong NumberOfEntries;
}
/// Contains a list of memory ranges.
///
/// The MINIDUMP_MEMORY64_LIST structure is defined as follows. It is used for full-memory minidumps.
///
/// typedef struct _MINIDUMP_MEMORY64_LIST { ULONG64 NumberOfMemoryRanges; RVA64 BaseRva; MINIDUMP_MEMORY_DESCRIPTOR64 MemoryRanges [0]; } MINIDUMP_MEMORY64_LIST, *PMINIDUMP_MEMORY64_LIST;
///
///
/// Note that BaseRva is the overall base RVA for the memory list. To locate the data for a particular descriptor, start at
/// BaseRva and increment by the size of a descriptor until you reach the descriptor.
///
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_memory_list typedef struct
// _MINIDUMP_MEMORY_LIST { ULONG32 NumberOfMemoryRanges; MINIDUMP_MEMORY_DESCRIPTOR MemoryRanges[0]; } MINIDUMP_MEMORY_LIST, *PMINIDUMP_MEMORY_LIST;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MEMORY_LIST")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_MEMORY_LIST
{
/// The number of structures in the MemoryRanges array.
public uint NumberOfMemoryRanges;
/// An array of MINIDUMP_MEMORY_DESCRIPTOR structures.
public MINIDUMP_MEMORY_DESCRIPTOR[] MemoryRanges;
}
/// Contains a variety of information.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_misc_info typedef struct
// _MINIDUMP_MISC_INFO { ULONG32 SizeOfInfo; ULONG32 Flags1; ULONG32 ProcessId; ULONG32 ProcessCreateTime; ULONG32 ProcessUserTime;
// ULONG32 ProcessKernelTime; } MINIDUMP_MISC_INFO, *PMINIDUMP_MISC_INFO;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MISC_INFO")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_MISC_INFO
{
/// The size of the structure, in bytes.
public uint SizeOfInfo;
///
/// The flags that indicate the valid members of this structure. This member can be one or more of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// MINIDUMP_MISC1_PROCESS_ID 0x00000001
/// ProcessId is used.
///
/// -
/// MINIDUMP_MISC1_PROCESS_TIMES 0x00000002
/// ProcessCreateTime, ProcessKernelTime, and ProcessUserTime are used.
///
///
///
public uint Flags1;
/// The identifier of the process. If Flags1 does not specify MINIDUMP_MISC1_PROCESS_ID, this member is unused.
public uint ProcessId;
///
/// The creation time of the process, in time_t format. If Flags1 does not specify MINIDUMP_MISC1_PROCESS_TIMES,
/// this member is unused.
///
public uint ProcessCreateTime;
///
/// The time the process has executed in user mode, in seconds. The time that each of the threads of the process has executed in
/// user mode is determined, then all these times are summed to obtain this value. If Flags1 does not specify
/// MINIDUMP_MISC1_PROCESS_TIMES, this member is unused.
///
public uint ProcessUserTime;
///
/// The time the process has executed in kernel mode, in seconds. The time that each of the threads of the process has executed
/// in kernel mode is determined, then all these times are summed to obtain this value. If Flags1 does not specify
/// MINIDUMP_MISC1_PROCESS_TIMES, this member is unused.
///
public uint ProcessKernelTime;
}
/// Represents information in the miscellaneous information stream.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_misc_info_2 typedef struct
// _MINIDUMP_MISC_INFO_2 { ULONG32 SizeOfInfo; ULONG32 Flags1; ULONG32 ProcessId; ULONG32 ProcessCreateTime; ULONG32
// ProcessUserTime; ULONG32 ProcessKernelTime; ULONG32 ProcessorMaxMhz; ULONG32 ProcessorCurrentMhz; ULONG32 ProcessorMhzLimit;
// ULONG32 ProcessorMaxIdleState; ULONG32 ProcessorCurrentIdleState; } MINIDUMP_MISC_INFO_2, *PMINIDUMP_MISC_INFO_2;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MISC_INFO_2")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_MISC_INFO_2
{
/// The size of the structure, in bytes.
public uint SizeOfInfo;
///
/// The flags that indicate the valid members of this structure. This member can be one or more of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// MINIDUMP_MISC1_PROCESS_ID 0x00000001
/// ProcessId is used.
///
/// -
/// MINIDUMP_MISC1_PROCESS_TIMES 0x00000002
/// ProcessCreateTime, ProcessKernelTime, and ProcessUserTime are used.
///
/// -
/// MINIDUMP_MISC1_PROCESSOR_POWER_INFO 0x00000004
///
/// ProcessorMaxMhz, ProcessorCurrentMhz, ProcessorMhzLimit, ProcessorMaxIdleState, and ProcessorCurrentIdleState are used.
///
///
///
///
public uint Flags1;
///
/// The identifier of the process. If Flags1 does not specify MINIDUMP_MISC1_PROCESS_ID, this member is unused.
///
public uint ProcessId;
///
/// The creation time of the process, in time_t format. If Flags1 does not specify
/// MINIDUMP_MISC1_PROCESS_TIMES, this member is unused.
///
public uint ProcessCreateTime;
///
/// The time the process has executed in user mode, in seconds. The time that each of the threads of the process has executed in
/// user mode is determined, then all these times are summed to obtain this value. If Flags1 does not specify
/// MINIDUMP_MISC1_PROCESS_TIMES, this member is unused.
///
public uint ProcessUserTime;
///
/// The time the process has executed in kernel mode, in seconds. The time that each of the threads of the process has executed
/// in kernel mode is determined, then all these times are summed to obtain this value. If Flags1 does not specify
/// MINIDUMP_MISC1_PROCESS_TIMES, this member is unused.
///
public uint ProcessKernelTime;
///
/// The maximum specified clock frequency of the system processor, in MHz. If Flags1 does not specify
/// MINIDUMP_MISC1_PROCESSOR_POWER_INFO, this member is unused.
///
public uint ProcessorMaxMhz;
///
/// The processor clock frequency, in MHz. This number is the maximum specified processor clock frequency multiplied by the
/// current processor throttle. If Flags1 does not specify MINIDUMP_MISC1_PROCESSOR_POWER_INFO, this member is unused.
///
public uint ProcessorCurrentMhz;
///
/// The limit on the processor clock frequency, in MHz. This number is the maximum specified processor clock frequency
/// multiplied by the current processor thermal throttle limit. If Flags1 does not specify
/// MINIDUMP_MISC1_PROCESSOR_POWER_INFO, this member is unused.
///
public uint ProcessorMhzLimit;
///
/// The maximum idle state of the processor. If Flags1 does not specify MINIDUMP_MISC1_PROCESSOR_POWER_INFO, this
/// member is unused.
///
public uint ProcessorMaxIdleState;
///
/// The current idle state of the processor. If Flags1 does not specify MINIDUMP_MISC1_PROCESSOR_POWER_INFO, this
/// member is unused.
///
public uint ProcessorCurrentIdleState;
}
/// Contains information for a specific module.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_module typedef struct
// _MINIDUMP_MODULE { ULONG64 BaseOfImage; ULONG32 SizeOfImage; ULONG32 CheckSum; ULONG32 TimeDateStamp; RVA ModuleNameRva;
// VS_FIXEDFILEINFO VersionInfo; MINIDUMP_LOCATION_DESCRIPTOR CvRecord; MINIDUMP_LOCATION_DESCRIPTOR MiscRecord; ULONG64 Reserved0;
// ULONG64 Reserved1; } MINIDUMP_MODULE, *PMINIDUMP_MODULE;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MODULE")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_MODULE
{
/// The base address of the module executable image in memory.
public ulong BaseOfImage;
/// The size of the module executable image in memory, in bytes.
public uint SizeOfImage;
/// The checksum value of the module executable image.
public uint CheckSum;
/// The timestamp value of the module executable image, in time_t format.
public uint TimeDateStamp;
/// An RVA to a MINIDUMP_STRING structure that specifies the name of the module.
public uint ModuleNameRva;
/// A VS_FIXEDFILEINFO structure that specifies the version of the module.
public VersionDll.VS_FIXEDFILEINFO VersionInfo;
/// A MINIDUMP_LOCATION_DESCRIPTOR structure that specifies the CodeView record of the module.
public MINIDUMP_LOCATION_DESCRIPTOR CvRecord;
/// A MINIDUMP_LOCATION_DESCRIPTOR structure that specifies the miscellaneous record of the module.
public MINIDUMP_LOCATION_DESCRIPTOR MiscRecord;
/// Reserved for future use.
public ulong Reserved0;
/// Reserved for future use.
public ulong Reserved1;
}
/// Contains module information for the MiniDumpCallback function when the callback type is ModuleCallback.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_module_callback typedef struct
// _MINIDUMP_MODULE_CALLBACK { PWCHAR FullPath; ULONG64 BaseOfImage; ULONG SizeOfImage; ULONG CheckSum; ULONG TimeDateStamp;
// VS_FIXEDFILEINFO VersionInfo; PVOID CvRecord; ULONG SizeOfCvRecord; PVOID MiscRecord; ULONG SizeOfMiscRecord; }
// MINIDUMP_MODULE_CALLBACK, *PMINIDUMP_MODULE_CALLBACK;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MODULE_CALLBACK")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_MODULE_CALLBACK
{
/// The fully qualified path of the module executable.
public StrPtrUni FullPath;
/// The base address of the module executable image in memory.
public ulong BaseOfImage;
/// The size of the module executable image in memory, in bytes.
public uint SizeOfImage;
/// The checksum value of the module executable image.
public uint CheckSum;
/// The timestamp value of the module executable image, in time_t format.
public time_t TimeDateStamp;
/// A VS_FIXEDFILEINFO structure that specifies the version of the module.
public VersionDll.VS_FIXEDFILEINFO VersionInfo;
/// A pointer to a string containing the CodeView record of the module.
public IntPtr CvRecord;
/// The size of the Codeview record of the module in the CvRecord member, in bytes.
public uint SizeOfCvRecord;
/// A pointer to a string that specifies the miscellaneous record of the module.
public IntPtr MiscRecord;
/// The size of the miscellaneous record of the module in the MiscRecord member, in bytes.
public uint SizeOfMiscRecord;
}
/// Contains a list of modules.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_module_list typedef struct
// _MINIDUMP_MODULE_LIST { ULONG32 NumberOfModules; MINIDUMP_MODULE Modules[0]; } MINIDUMP_MODULE_LIST, *PMINIDUMP_MODULE_LIST;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_MODULE_LIST")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_MODULE_LIST
{
/// The number of structures in the Modules array.
public uint NumberOfModules;
/// An array of MINIDUMP_MODULE structures.
public MINIDUMP_MODULE[] Modules;
}
///
/// Contains information about a failed memory read operation. This structure is used by the MiniDumpCallbackfunction when the
/// callback type is ReadMemoryFailureCallback.
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_read_memory_failure_callback typedef
// struct _MINIDUMP_READ_MEMORY_FAILURE_CALLBACK { ULONG64 Offset; ULONG Bytes; HRESULT FailureStatus; }
// MINIDUMP_READ_MEMORY_FAILURE_CALLBACK, *PMINIDUMP_READ_MEMORY_FAILURE_CALLBACK;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_READ_MEMORY_FAILURE_CALLBACK")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_READ_MEMORY_FAILURE_CALLBACK
{
/// The offset of the address for the failed memory read operation.
public ulong Offset;
/// The size of the failed memory read operation, in bytes.
public uint Bytes;
/// The resulting error code from the failed memory read operation.
public HRESULT FailureStatus;
}
/// Describes a string.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_string typedef struct
// _MINIDUMP_STRING { ULONG32 Length; WCHAR Buffer[0]; } MINIDUMP_STRING, *PMINIDUMP_STRING;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_STRING")]
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct MINIDUMP_STRING
{
///
/// The size of the string in the Buffer member, in bytes. This size does not include the null-terminating character.
///
public uint Length;
/// The null-terminated string.
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 0)]
public string Buffer;
}
/// Contains processor and operating system information.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_system_info typedef struct
// _MINIDUMP_SYSTEM_INFO { USHORT ProcessorArchitecture; USHORT ProcessorLevel; USHORT ProcessorRevision; union { USHORT Reserved0;
// struct { UCHAR NumberOfProcessors; UCHAR ProductType; }; }; ULONG32 MajorVersion; ULONG32 MinorVersion; ULONG32 BuildNumber;
// ULONG32 PlatformId; RVA CSDVersionRva; union { ULONG32 Reserved1; struct { USHORT SuiteMask; USHORT Reserved2; }; };
// CPU_INFORMATION Cpu; } MINIDUMP_SYSTEM_INFO, *PMINIDUMP_SYSTEM_INFO;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_SYSTEM_INFO")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_SYSTEM_INFO
{
///
/// The system's processor architecture. This member can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// PROCESSOR_ARCHITECTURE_AMD64 9
/// x64 (AMD or Intel)
///
/// -
/// PROCESSOR_ARCHITECTURE_ARM 5
/// ARM
///
/// -
/// PROCESSOR_ARCHITECTURE_IA64 6
/// Intel Itanium
///
/// -
/// PROCESSOR_ARCHITECTURE_INTEL 0
/// x86
///
/// -
/// PROCESSOR_ARCHITECTURE_UNKNOWN 0xffff
/// Unknown processor.
///
///
///
public ProcessorArchitecture ProcessorArchitecture;
///
/// The system's architecture-dependent processor level.
///
/// If ProcessorArchitecture is PROCESSOR_ARCHITECTURE_INTEL, ProcessorLevel can be one of the following values.
///
///
///
/// Value
/// Meaning
///
/// -
/// 3
/// Intel 80386
///
/// -
/// 4
/// Intel 80486
///
/// -
/// 5
/// Intel Pentium
///
/// -
/// 6
/// Intel Pentium Pro or Pentium II
///
///
/// If ProcessorArchitecture is PROCESSOR_ARCHITECTURE_IA64, ProcessorLevel is set to 1.
///
public ushort ProcessorLevel;
///
/// The architecture-dependent processor revision.
///
///
/// Processor
/// Value
///
/// -
/// Intel 80386 or 80486
///
/// A value of the form xxyz. If xx is equal to 0xFF, y - 0xA is the model number, and z is the stepping identifier. For
/// example, an Intel 80486-D0 system returns 0xFFD0. If xx is not equal to 0xFF, xx + 'A' is the stepping letter and yz is the
/// minor stepping.
///
///
/// -
/// Intel Pentium, Cyrix, or NextGen 586
///
/// A value of the form xxyy, where xx is the model number and yy is the stepping. Display this value of 0x0201 as follows:
/// Model xx, Stepping yy
///
///
///
///
public ushort ProcessorRevision;
/// The number of processors in the system.
public byte NumberOfProcessors;
///
/// Any additional information about the system. This member can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// VER_NT_DOMAIN_CONTROLLER 0x0000002
/// The system is a domain controller.
///
/// -
/// VER_NT_SERVER 0x0000003
/// The system is a server.
///
/// -
/// VER_NT_WORKSTATION 0x0000001
/// The system is running Windows XP, Windows Vista, Windows 7, or Windows 8.
///
///
///
public Kernel32.ProductType ProductType;
/// The major version number of the operating system. This member can be 4, 5, or 6.
public uint MajorVersion;
/// The minor version number of the operating system.
public uint MinorVersion;
/// The build number of the operating system.
public uint BuildNumber;
///
/// The operating system platform. This member can be one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// VER_PLATFORM_WIN32s 0
/// Not supported
///
/// -
/// VER_PLATFORM_WIN32_WINDOWS 1
/// Not supported.
///
/// -
/// VER_PLATFORM_WIN32_NT 2
/// The operating system platform is Windows.
///
///
///
public PlatformID PlatformId;
///
/// An RVA (from the beginning of the dump) to a MINIDUMP_STRING that describes the latest Service Pack installed on the system.
/// If no Service Pack has been installed, the string is empty.
///
public uint CSDVersionRva;
///
///
/// The bit flags that identify the product suites available on the system. This member can be a combination of the following values.
///
///
///
/// Value
/// Meaning
///
/// -
/// VER_SUITE_BACKOFFICE 0x00000004
/// Microsoft BackOffice components are installed.
///
/// -
/// VER_SUITE_BLADE 0x00000400
/// Windows Server 2003, Web Edition is installed.
///
/// -
/// VER_SUITE_COMPUTE_SERVER 0x00004000
/// Windows Server 2003, Compute Cluster Edition is installed.
///
/// -
/// VER_SUITE_DATACENTER 0x00000080
/// Windows Server 2008 R2 Datacenter, Windows Server 2008 Datacenter, or Windows Server 2003, Datacenter Edition is installed.
///
/// -
/// VER_SUITE_ENTERPRISE 0x00000002
/// Windows Server 2008 R2 Enterprise, Windows Server 2008 Enterprise, or Windows Server 2003, Enterprise Edition is installed.
///
/// -
/// VER_SUITE_EMBEDDEDNT 0x00000040
/// Windows Embedded is installed.
///
/// -
/// VER_SUITE_PERSONAL 0x00000200
/// Windows XP Home Edition is installed.
///
/// -
/// VER_SUITE_SINGLEUSERTS 0x00000100
///
/// Remote Desktop is supported, but only one interactive session is supported. This value is set unless the system is running
/// in application server mode.
///
///
/// -
/// VER_SUITE_SMALLBUSINESS 0x00000001
///
/// Microsoft Small Business Server was once installed on the system, but may have been upgraded to another version of Windows.
///
///
/// -
/// VER_SUITE_SMALLBUSINESS_RESTRICTED 0x00000020
/// Microsoft Small Business Server is installed with the restrictive client license in force.
///
/// -
/// VER_SUITE_STORAGE_SERVER 0x00002000
/// Windows Storage Server is installed.
///
/// -
/// VER_SUITE_TERMINAL 0x00000010
///
/// Terminal Services is installed. This value is always set. If VER_SUITE_TERMINAL is set but VER_SUITE_SINGLEUSERTS is not
/// set, the system is running in application server mode.
///
///
///
///
public Kernel32.SuiteMask SuiteMask;
/// This member is reserved for future use.
public ushort Reserved2;
///
/// X86CpuInfo
/// The CPU information obtained from the CPUID instruction. This structure is supported only for x86 computers.
/// VendorId
/// CPUID subfunction 0. The array elements are as follows:
/// VersionInformation
/// CPUID subfunction 1. Value of EAX.
/// FeatureInformation
/// CPUID subfunction 1. Value of EDX.
/// AMDExtendedCpuFeatures
/// CPUID subfunction 80000001. Value of EBX. This member is supported only if the vendor is "AuthenticAMD".
/// OtherCpuInfo
/// Other CPU information. This structure is supported only for non-x86 computers.
/// ProcessorFeatures
/// For a list of possible values, see the IsProcessorFeaturePresent function.
///
public CPU_INFORMATION Cpu;
}
/// Contains information for a specific thread.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread typedef struct
// _MINIDUMP_THREAD { ULONG32 ThreadId; ULONG32 SuspendCount; ULONG32 PriorityClass; ULONG32 Priority; ULONG64 Teb;
// MINIDUMP_MEMORY_DESCRIPTOR Stack; MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; } MINIDUMP_THREAD, *PMINIDUMP_THREAD;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_THREAD
{
/// The identifier of the thread.
public uint ThreadId;
///
/// The suspend count for the thread. If the suspend count is greater than zero, the thread is suspended; otherwise, the thread
/// is not suspended. The maximum value is MAXIMUM_SUSPEND_COUNT.
///
public uint SuspendCount;
/// The priority class of the thread. See Scheduling Priorities.
public uint PriorityClass;
/// The priority level of the thread.
public uint Priority;
/// The thread environment block.
public ulong Teb;
/// A MINIDUMP_MEMORY_DESCRIPTOR structure.
public MINIDUMP_MEMORY_DESCRIPTOR Stack;
/// A MINIDUMP_LOCATION_DESCRIPTOR structure.
public MINIDUMP_LOCATION_DESCRIPTOR ThreadContext;
}
/// Contains thread information for the MiniDumpCallback function when the callback type is ThreadCallback.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_callback typedef struct
// _MINIDUMP_THREAD_CALLBACK { ULONG ThreadId; HANDLE ThreadHandle; ULONG Pad; CONTEXT Context; ULONG SizeOfContext; ULONG64
// StackBase; ULONG64 StackEnd; } MINIDUMP_THREAD_CALLBACK, *PMINIDUMP_THREAD_CALLBACK;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_CALLBACK")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_THREAD_CALLBACK
{
/// The identifier of the thread.
public uint ThreadId;
/// A handle to the thread
public HTHREAD ThreadHandle;
///
public uint Pad;
/// A CONTEXT structure that contains the processor-specific data.
public CONTEXT Context;
/// The size of the returned processor-specific data in the Context member, in bytes.
public uint SizeOfContext;
/// The base address of the thread stack.
public ulong StackBase;
/// The ending address of the thread stack.
public ulong StackEnd;
}
/// Contains extended information for a specific thread.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_ex typedef struct
// _MINIDUMP_THREAD_EX { ULONG32 ThreadId; ULONG32 SuspendCount; ULONG32 PriorityClass; ULONG32 Priority; ULONG64 Teb;
// MINIDUMP_MEMORY_DESCRIPTOR Stack; MINIDUMP_LOCATION_DESCRIPTOR ThreadContext; MINIDUMP_MEMORY_DESCRIPTOR BackingStore; }
// MINIDUMP_THREAD_EX, *PMINIDUMP_THREAD_EX;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_EX")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_THREAD_EX
{
/// The identifier of the thread.
public uint ThreadId;
///
/// The suspend count for the thread. If the suspend count is greater than zero, the thread is suspended; otherwise, the thread
/// is not suspended. The maximum value is MAXIMUM_SUSPEND_COUNT.
///
public uint SuspendCount;
/// The priority class of the thread. See Scheduling Priorities.
public uint PriorityClass;
/// The priority level of the thread.
public uint Priority;
/// The thread environment block.
public ulong Teb;
/// A MINIDUMP_MEMORY_DESCRIPTOR structure.
public MINIDUMP_MEMORY_DESCRIPTOR Stack;
/// A MINIDUMP_LOCATION_DESCRIPTOR structure.
public MINIDUMP_LOCATION_DESCRIPTOR ThreadContext;
/// Intel Itanium: The backing store for the thread.
public MINIDUMP_MEMORY_DESCRIPTOR BackingStore;
}
/// Contains extended thread information for the MiniDumpCallback function when the callback type is ThreadExCallback.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_ex_callback typedef struct
// _MINIDUMP_THREAD_EX_CALLBACK { ULONG ThreadId; HANDLE ThreadHandle; ULONG Pad; CONTEXT Context; ULONG SizeOfContext; ULONG64
// StackBase; ULONG64 StackEnd; ULONG64 BackingStoreBase; ULONG64 BackingStoreEnd; } MINIDUMP_THREAD_EX_CALLBACK, *PMINIDUMP_THREAD_EX_CALLBACK;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_EX_CALLBACK")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_THREAD_EX_CALLBACK
{
/// The identifier of the thread.
public uint ThreadId;
/// A handle to the thread
public HTHREAD ThreadHandle;
///
public uint Pad;
/// A CONTEXT structure that contains the processor-specific data.
public CONTEXT Context;
/// The size of the returned processor-specific data in the Context member, in bytes.
public uint SizeOfContext;
/// The base address of the thread stack.
public ulong StackBase;
/// The ending address of the thread stack.
public ulong StackEnd;
/// Intel Itanium: The base address of the thread backing store.
public ulong BackingStoreBase;
/// Intel Itanium: The ending address of the thread backing store.
public ulong BackingStoreEnd;
}
/// Contains a list of threads.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_ex_list typedef struct
// _MINIDUMP_THREAD_EX_LIST { ULONG32 NumberOfThreads; MINIDUMP_THREAD_EX Threads[0]; } MINIDUMP_THREAD_EX_LIST, *PMINIDUMP_THREAD_EX_LIST;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_EX_LIST")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_THREAD_EX_LIST
{
/// The number of structures in the Threads array.
public uint NumberOfThreads;
/// An array of MINIDUMP_THREAD_EX structures.
public MINIDUMP_THREAD_EX[] Threads;
}
/// Contains thread state information.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_info typedef struct
// _MINIDUMP_THREAD_INFO { ULONG32 ThreadId; ULONG32 DumpFlags; ULONG32 DumpError; ULONG32 ExitStatus; ULONG64 CreateTime; ULONG64
// ExitTime; ULONG64 KernelTime; ULONG64 UserTime; ULONG64 StartAddress; ULONG64 Affinity; } MINIDUMP_THREAD_INFO, *PMINIDUMP_THREAD_INFO;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_INFO")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_THREAD_INFO
{
/// The identifier of the thread.
public uint ThreadId;
///
/// The flags that indicate the thread state. This member can be 0 or one of the following values.
///
///
/// Value
/// Meaning
///
/// -
/// MINIDUMP_THREAD_INFO_ERROR_THREAD 0x00000001
/// A placeholder thread due to an error accessing the thread. No thread information exists beyond the thread identifier.
///
/// -
/// MINIDUMP_THREAD_INFO_EXITED_THREAD 0x00000004
/// The thread has exited (not running any code) at the time of the dump.
///
/// -
/// MINIDUMP_THREAD_INFO_INVALID_CONTEXT 0x00000010
/// Thread context could not be retrieved.
///
/// -
/// MINIDUMP_THREAD_INFO_INVALID_INFO 0x00000008
/// Thread information could not be retrieved.
///
/// -
/// MINIDUMP_THREAD_INFO_INVALID_TEB 0x00000020
/// TEB information could not be retrieved.
///
/// -
/// MINIDUMP_THREAD_INFO_WRITING_THREAD 0x00000002
/// This is the thread that called MiniDumpWriteDump.
///
///
///
public MINIDUMP_THREAD_INFO_FLAG DumpFlags;
/// An HRESULT value that indicates the dump status.
public HRESULT DumpError;
/// The thread termination status code.
public uint ExitStatus;
/// The time when the thread was created, in 100-nanosecond intervals since January 1, 1601 (UTC).
public ulong CreateTime;
/// The time when the thread exited, in 100-nanosecond intervals since January 1, 1601 (UTC).
public ulong ExitTime;
/// The time executed in kernel mode, in 100-nanosecond intervals.
public ulong KernelTime;
/// The time executed in user mode, in 100-nanosecond intervals.
public ulong UserTime;
/// The starting address of the thread.
public ulong StartAddress;
/// The processor affinity mask.
public ulong Affinity;
}
/// Contains a list of threads.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_info_list typedef struct
// _MINIDUMP_THREAD_INFO_LIST { ULONG SizeOfHeader; ULONG SizeOfEntry; ULONG NumberOfEntries; } MINIDUMP_THREAD_INFO_LIST, *PMINIDUMP_THREAD_INFO_LIST;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_INFO_LIST")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_THREAD_INFO_LIST
{
///
/// The size of the header data for the stream, in bytes. This is generally
/// sizeof(MINIDUMP_THREAD_INFO_LIST)
/// .
///
public uint SizeOfHeader;
///
/// The size of each entry following the header, in bytes. This is generally
/// sizeof(MINIDUMP_THREAD_INFO)
/// .
///
public uint SizeOfEntry;
///
/// The number of entries in the stream. These are generally MINIDUMP_THREAD_INFO structures. The entries follow the header.
///
public uint NumberOfEntries;
}
/// Contains a list of threads.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_thread_list typedef struct
// _MINIDUMP_THREAD_LIST { ULONG32 NumberOfThreads; MINIDUMP_THREAD Threads[0]; } MINIDUMP_THREAD_LIST, *PMINIDUMP_THREAD_LIST;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_THREAD_LIST")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_THREAD_LIST
{
/// The number of structures in the Threads array.
public uint NumberOfThreads;
/// An array of MINIDUMP_THREAD structures.
public MINIDUMP_THREAD[] Threads;
}
///
/// Contains information about a module that has been unloaded. This information can help diagnose problems calling code that is no
/// longer loaded.
///
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_unloaded_module typedef struct
// _MINIDUMP_UNLOADED_MODULE { ULONG64 BaseOfImage; ULONG32 SizeOfImage; ULONG32 CheckSum; ULONG32 TimeDateStamp; RVA ModuleNameRva;
// } MINIDUMP_UNLOADED_MODULE, *PMINIDUMP_UNLOADED_MODULE;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_UNLOADED_MODULE")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_UNLOADED_MODULE
{
/// The base address of the module executable image in memory.
public ulong BaseOfImage;
/// The size of the module executable image in memory, in bytes.
public uint SizeOfImage;
/// The checksum value of the module executable image.
public uint CheckSum;
/// The timestamp value of the module executable image, in time_t format.
public time_t TimeDateStamp;
/// An RVA to a MINIDUMP_STRING structure that specifies the name of the module.
public uint ModuleNameRva;
}
/// Contains a list of unloaded modules.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_unloaded_module_list typedef struct
// _MINIDUMP_UNLOADED_MODULE_LIST { ULONG32 SizeOfHeader; ULONG32 SizeOfEntry; ULONG32 NumberOfEntries; }
// MINIDUMP_UNLOADED_MODULE_LIST, *PMINIDUMP_UNLOADED_MODULE_LIST;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_UNLOADED_MODULE_LIST")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_UNLOADED_MODULE_LIST
{
///
/// The size of the header data for the stream, in bytes. This is generally
/// sizeof(MINIDUMP_UNLOADED_MODULE_LIST)
/// .
///
public uint SizeOfHeader;
///
/// The size of each entry following the header, in bytes. This is generally
/// sizeof(MINIDUMP_UNLOADED_MODULE)
/// .
///
public uint SizeOfEntry;
///
/// The number of entries in the stream. These are generally MINIDUMP_UNLOADED_MODULE structures. The entries follow the header.
///
public uint NumberOfEntries;
}
/// Contains user-defined information stored in a data stream.
/// In this context, a data stream refers to a block of data within a minidump file.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_user_stream typedef struct
// _MINIDUMP_USER_STREAM { ULONG32 Type; ULONG BufferSize; PVOID Buffer; } MINIDUMP_USER_STREAM, *PMINIDUMP_USER_STREAM;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_USER_STREAM")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_USER_STREAM
{
/// The type of data stream. For more information, see MINIDUMP_STREAM_TYPE.
public uint Type;
/// The size of the user-defined data stream buffer, in bytes.
public uint BufferSize;
/// A pointer to a buffer that contains the user-defined data stream.
public IntPtr Buffer;
}
/// Contains a list of user data streams used by the MiniDumpWriteDump function.
/// In this context, a data stream refers to a block of data within a minidump file.
// https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_user_stream_information typedef
// struct _MINIDUMP_USER_STREAM_INFORMATION { ULONG UserStreamCount; PMINIDUMP_USER_STREAM UserStreamArray; }
// MINIDUMP_USER_STREAM_INFORMATION, *PMINIDUMP_USER_STREAM_INFORMATION;
[PInvokeData("minidumpapiset.h", MSDNShortId = "NS:minidumpapiset._MINIDUMP_USER_STREAM_INFORMATION")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_USER_STREAM_INFORMATION
{
/// The number of user streams.
public uint UserStreamCount;
/// An array of MINIDUMP_USER_STREAM structures.
public MINIDUMP_USER_STREAM[] UserStreamArray;
}
#pragma warning disable CS1591 // Missing XML comment for publicly visible type or member
[PInvokeData("minidumpapiset.h")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_VM_POST_READ_CALLBACK
{
public ulong Offset;
public IntPtr Buffer;
public uint Size;
public uint Completed;
public HRESULT Status;
}
[PInvokeData("minidumpapiset.h")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_VM_PRE_READ_CALLBACK
{
public ulong Offset;
public IntPtr Buffer;
public uint Size;
}
[PInvokeData("minidumpapiset.h")]
[StructLayout(LayoutKind.Sequential)]
public struct MINIDUMP_VM_QUERY_CALLBACK
{
public ulong Offset;
}
#pragma warning restore CS1591 // Missing XML comment for publicly visible type or member
}
}