mirror of
https://github.com/keymanapp/keyman.git
synced 2026-08-07 09:25:33 +00:00
4428 lines
136 KiB
ObjectPascal
4428 lines
136 KiB
ObjectPascal
{******************************************************************************}
|
|
{ }
|
|
{ Image Help API interface Unit for Object Pascal }
|
|
{ }
|
|
{ Portions created by Microsoft are Copyright (C) 1995-2001 Microsoft }
|
|
{ Corporation. All Rights Reserved. }
|
|
{ }
|
|
{ The original file is: imagehlp.h, released August 2001. The original Pascal }
|
|
{ code is: ImageHelp.pas, released December 2000. The initial developer of the }
|
|
{ Pascal code is Marcel van Brakel (brakelm att chello dott nl). }
|
|
{ }
|
|
{ Portions created by Marcel van Brakel are Copyright (C) 1999-2001 }
|
|
{ Marcel van Brakel. All Rights Reserved. }
|
|
{ }
|
|
{ Obtained through: Joint Endeavour of Delphi Innovators (Project JEDI) }
|
|
{ }
|
|
{ You may retrieve the latest version of this file at the Project JEDI }
|
|
{ APILIB home page, located at http://jedi-apilib.sourceforge.net }
|
|
{ }
|
|
{ The contents of this file are used with permission, subject to the Mozilla }
|
|
{ Public License Version 1.1 (the "License"); you may not use this file except }
|
|
{ in compliance with the License. You may obtain a copy of the License at }
|
|
{ http://www.mozilla.org/MPL/MPL-1.1.html }
|
|
{ }
|
|
{ Software distributed under the License is distributed on an "AS IS" basis, }
|
|
{ WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for }
|
|
{ the specific language governing rights and limitations under the License. }
|
|
{ }
|
|
{ Alternatively, the contents of this file may be used under the terms of the }
|
|
{ GNU Lesser General Public License (the "LGPL License"), in which case the }
|
|
{ provisions of the LGPL License are applicable instead of those above. }
|
|
{ If you wish to allow use of your version of this file only under the terms }
|
|
{ of the LGPL License and not to allow others to use your version of this file }
|
|
{ under the MPL, indicate your decision by deleting the provisions above and }
|
|
{ replace them with the notice and other provisions required by the LGPL }
|
|
{ License. If you do not delete the provisions above, a recipient may use }
|
|
{ your version of this file under either the MPL or the LGPL License. }
|
|
{ }
|
|
{ For more information about the LGPL: http://www.gnu.org/copyleft/lesser.html }
|
|
{ }
|
|
{******************************************************************************}
|
|
|
|
// $Id: JwaImageHlp.pas,v 1.13 2007/09/14 06:48:45 marquardt Exp $
|
|
|
|
{$IFNDEF JWA_OMIT_SECTIONS}
|
|
unit JwaImageHlp;
|
|
|
|
{$WEAKPACKAGEUNIT}
|
|
{$ENDIF JWA_OMIT_SECTIONS}
|
|
|
|
{$HPPEMIT ''}
|
|
{$HPPEMIT '#include "ImageHlp.h"'}
|
|
{$HPPEMIT ''}
|
|
|
|
{$IFNDEF JWA_OMIT_SECTIONS}
|
|
{$I ..\Includes\JediAPILib.inc}
|
|
|
|
interface
|
|
|
|
uses
|
|
Windows, JwaWinBase, JwaWinNT, JwaWinType;
|
|
{$ENDIF JWA_OMIT_SECTIONS}
|
|
|
|
{$IFNDEF JWA_IMPLEMENTATIONSECTION}
|
|
|
|
const
|
|
IMAGE_SEPARATION = 64*1024;
|
|
{$EXTERNALSYM IMAGE_SEPARATION}
|
|
|
|
type
|
|
PLOADED_IMAGE = ^LOADED_IMAGE;
|
|
{$EXTERNALSYM PLOADED_IMAGE}
|
|
_LOADED_IMAGE = record
|
|
ModuleName: PSTR;
|
|
hFile: HANDLE;
|
|
MappedAddress: PUCHAR;
|
|
FileHeader: PIMAGE_NT_HEADERS32;
|
|
LastRvaSection: PIMAGE_SECTION_HEADER;
|
|
NumberOfSections: ULONG;
|
|
Sections: PIMAGE_SECTION_HEADER;
|
|
Characteristics: ULONG;
|
|
fSystemImage: ByteBool;
|
|
fDOSImage: ByteBool;
|
|
Links: LIST_ENTRY;
|
|
SizeOfImage: ULONG;
|
|
end;
|
|
{$EXTERNALSYM _LOADED_IMAGE}
|
|
LOADED_IMAGE = _LOADED_IMAGE;
|
|
{$EXTERNALSYM LOADED_IMAGE}
|
|
TLoadedImage = LOADED_IMAGE;
|
|
PLoadedImage = PLOADED_IMAGE;
|
|
|
|
const
|
|
MAX_SYM_NAME = 2000;
|
|
{$EXTERNALSYM MAX_SYM_NAME}
|
|
|
|
function BindImage(ImageName, DllPath, SymbolPath: PSTR): BOOL; stdcall;
|
|
{$EXTERNALSYM BindImage}
|
|
|
|
type
|
|
_IMAGEHLP_STATUS_REASON = (
|
|
BindOutOfMemory,
|
|
BindRvaToVaFailed,
|
|
BindNoRoomInImage,
|
|
BindImportModuleFailed,
|
|
BindImportProcedureFailed,
|
|
BindImportModule,
|
|
BindImportProcedure,
|
|
BindForwarder,
|
|
BindForwarderNOT,
|
|
BindImageModified,
|
|
BindExpandFileHeaders,
|
|
BindImageComplete,
|
|
BindMismatchedSymbols,
|
|
BindSymbolsNotUpdated,
|
|
BindImportProcedure32,
|
|
BindImportProcedure64,
|
|
BindForwarder32,
|
|
BindForwarder64,
|
|
BindForwarderNOT32,
|
|
BindForwarderNOT64);
|
|
{$EXTERNALSYM _IMAGEHLP_STATUS_REASON}
|
|
IMAGEHLP_STATUS_REASON = _IMAGEHLP_STATUS_REASON;
|
|
{$EXTERNALSYM IMAGEHLP_STATUS_REASON}
|
|
TImageHlpStatusReason = IMAGEHLP_STATUS_REASON;
|
|
|
|
PIMAGEHLP_STATUS_ROUTINE = function(Reason: IMAGEHLP_STATUS_REASON;
|
|
ImageName, DllName: PSTR; Va, Parameter: ULONG_PTR): BOOL; stdcall;
|
|
{$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE}
|
|
PImageHlpStatusRoutine = PIMAGEHLP_STATUS_ROUTINE;
|
|
|
|
PIMAGEHLP_STATUS_ROUTINE32 = function(Reason: IMAGEHLP_STATUS_REASON; ImageName, DllName: PSTR;
|
|
Va: ULONG; Parameter: ULONG_PTR): BOOL; stdcall;
|
|
{$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE32}
|
|
PImageHlpStatusRoutine23 = PIMAGEHLP_STATUS_ROUTINE32;
|
|
|
|
PIMAGEHLP_STATUS_ROUTINE64 = function(Reason: IMAGEHLP_STATUS_REASON; ImageName, DllName: PSTR;
|
|
Va: ULONG64; Parameter: ULONG_PTR): BOOL; stdcall;
|
|
{$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE64}
|
|
PImageHlpStatusRoutine64 = PIMAGEHLP_STATUS_ROUTINE64;
|
|
|
|
function BindImageEx(Flags: DWORD; ImageName, DllPath, SymbolPath: PSTR;
|
|
StatusRoutine: PIMAGEHLP_STATUS_ROUTINE): BOOL; stdcall;
|
|
{$EXTERNALSYM BindImageEx}
|
|
|
|
const
|
|
BIND_NO_BOUND_IMPORTS = $00000001;
|
|
{$EXTERNALSYM BIND_NO_BOUND_IMPORTS}
|
|
BIND_NO_UPDATE = $00000002;
|
|
{$EXTERNALSYM BIND_NO_UPDATE}
|
|
BIND_ALL_IMAGES = $00000004;
|
|
{$EXTERNALSYM BIND_ALL_IMAGES}
|
|
BIND_CACHE_IMPORT_DLLS = $00000008; // Cache dll's across calls to BindImageEx (same as NT 3.1->NT 4.0)
|
|
{$EXTERNALSYM BIND_CACHE_IMPORT_DLLS}
|
|
|
|
BIND_REPORT_64BIT_VA = $00000010;
|
|
{$EXTERNALSYM BIND_REPORT_64BIT_VA}
|
|
|
|
function ReBaseImage(CurrentImageName: PSTR; SymbolPath: PSTR; fReBase: BOOL;
|
|
fRebaseSysfileOk: BOOL; fGoingDown: BOOL; CheckImageSize: ULONG;
|
|
var OldImageSize: ULONG; var OldImageBase: ULONG_PTR; var NewImageSize: ULONG;
|
|
var NewImageBase: ULONG_PTR; TimeStamp: ULONG): BOOL; stdcall;
|
|
{$EXTERNALSYM ReBaseImage}
|
|
|
|
function ReBaseImage64(CurrentImageName: PSTR; SymbolPath: PSTR; fReBase: BOOL;
|
|
fRebaseSysfileOk: BOOL; fGoingDown: BOOL; CheckImageSize: ULONG;
|
|
var OldImageSize: ULONG; var OldImageBase: ULONG64; var NewImageSize: ULONG;
|
|
var NewImageBase: ULONG64; TimeStamp: ULONG): BOOL; stdcall;
|
|
{$EXTERNALSYM ReBaseImage64}
|
|
|
|
//
|
|
// Define checksum return codes.
|
|
//
|
|
|
|
const
|
|
CHECKSUM_SUCCESS = 0;
|
|
{$EXTERNALSYM CHECKSUM_SUCCESS}
|
|
CHECKSUM_OPEN_FAILURE = 1;
|
|
{$EXTERNALSYM CHECKSUM_OPEN_FAILURE}
|
|
CHECKSUM_MAP_FAILURE = 2;
|
|
{$EXTERNALSYM CHECKSUM_MAP_FAILURE}
|
|
CHECKSUM_MAPVIEW_FAILURE = 3;
|
|
{$EXTERNALSYM CHECKSUM_MAPVIEW_FAILURE}
|
|
CHECKSUM_UNICODE_FAILURE = 4;
|
|
{$EXTERNALSYM CHECKSUM_UNICODE_FAILURE}
|
|
|
|
// Define Splitsym flags.
|
|
|
|
SPLITSYM_REMOVE_PRIVATE = $00000001; // Remove CV types/symbols and Fixup debug
|
|
{$EXTERNALSYM SPLITSYM_REMOVE_PRIVATE}
|
|
// Used for creating .dbg files that ship
|
|
// as part of the product.
|
|
|
|
SPLITSYM_EXTRACT_ALL = $00000002; // Extract all debug info from image.
|
|
{$EXTERNALSYM SPLITSYM_EXTRACT_ALL}
|
|
// Normally, FPO is left in the image
|
|
// to allow stack traces through the code.
|
|
// Using this switch is similar to linking
|
|
// with -debug:none except the .dbg file
|
|
// exists...
|
|
|
|
SPLITSYM_SYMBOLPATH_IS_SRC = $00000004; // The SymbolFilePath contains an alternate
|
|
{$EXTERNALSYM SPLITSYM_SYMBOLPATH_IS_SRC}
|
|
// path to locate the pdb.
|
|
|
|
//
|
|
// Define checksum function prototypes.
|
|
//
|
|
|
|
function CheckSumMappedFile(BaseAddress: PVOID; FileLength: DWORD;
|
|
var HeaderSum, CheckSum: DWORD): PIMAGE_NT_HEADERS; stdcall;
|
|
{$EXTERNALSYM CheckSumMappedFile}
|
|
|
|
function MapFileAndCheckSumA(Filename: PSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
|
|
{$EXTERNALSYM MapFileAndCheckSumA}
|
|
function MapFileAndCheckSumW(Filename: PWSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
|
|
{$EXTERNALSYM MapFileAndCheckSumW}
|
|
function MapFileAndCheckSum(Filename: PTSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
|
|
{$EXTERNALSYM MapFileAndCheckSum}
|
|
|
|
function GetImageConfigInformation(const LoadedImage: LOADED_IMAGE;
|
|
var ImageConfigInformation: IMAGE_LOAD_CONFIG_DIRECTORY): BOOL; stdcall;
|
|
{$EXTERNALSYM GetImageConfigInformation}
|
|
|
|
function GetImageUnusedHeaderBytes(const LoadedImage: LOADED_IMAGE;
|
|
var SizeUnusedHeaderBytes: DWORD): DWORD; stdcall;
|
|
{$EXTERNALSYM GetImageUnusedHeaderBytes}
|
|
|
|
function SetImageConfigInformation(const LoadedImage: LOADED_IMAGE;
|
|
const ImageConfigInformation: IMAGE_LOAD_CONFIG_DIRECTORY): BOOL; stdcall;
|
|
{$EXTERNALSYM SetImageConfigInformation}
|
|
|
|
// Image Integrity API's
|
|
|
|
const
|
|
CERT_PE_IMAGE_DIGEST_DEBUG_INFO = $01;
|
|
{$EXTERNALSYM CERT_PE_IMAGE_DIGEST_DEBUG_INFO}
|
|
CERT_PE_IMAGE_DIGEST_RESOURCES = $02;
|
|
{$EXTERNALSYM CERT_PE_IMAGE_DIGEST_RESOURCES}
|
|
CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO = $04;
|
|
{$EXTERNALSYM CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO}
|
|
CERT_PE_IMAGE_DIGEST_NON_PE_INFO = $08; // include data outside the PE image
|
|
{$EXTERNALSYM CERT_PE_IMAGE_DIGEST_NON_PE_INFO}
|
|
|
|
CERT_SECTION_TYPE_ANY = $FF; // Any Certificate type
|
|
{$EXTERNALSYM CERT_SECTION_TYPE_ANY}
|
|
|
|
type
|
|
DIGEST_HANDLE = PVOID;
|
|
{$EXTERNALSYM DIGEST_HANDLE}
|
|
TDigestHandle = DIGEST_HANDLE;
|
|
|
|
DIGEST_FUNCTION = function(refdata: DIGEST_HANDLE; pData: PBYTE; dwLength: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM DIGEST_FUNCTION}
|
|
TDigestFunction = DIGEST_FUNCTION;
|
|
|
|
function ImageGetDigestStream(FileHandle: HANDLE; DigestLevel: DWORD;
|
|
DigestFunction: DIGEST_FUNCTION; DigestHandle: DIGEST_HANDLE): BOOL; stdcall;
|
|
{$EXTERNALSYM ImageGetDigestStream}
|
|
|
|
function ImageAddCertificate(FileHandle: HANDLE; Certificate: PWinCertificate;
|
|
var Index: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM ImageAddCertificate}
|
|
|
|
function ImageRemoveCertificate(FileHandle: HANDLE; Index: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM ImageRemoveCertificate}
|
|
|
|
function ImageEnumerateCertificates(FileHandle: HANDLE; TypeFilter: WORD;
|
|
var CertificateCount: DWORD; Indices: PDWORD; IndexCount: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM ImageEnumerateCertificates}
|
|
|
|
function ImageGetCertificateData(FileHandle: HANDLE; CertificateIndex: DWORD;
|
|
Certificate: PWinCertificate; var RequiredLength: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM ImageGetCertificateData}
|
|
|
|
function ImageGetCertificateHeader(FileHandle: HANDLE; CertificateIndex: DWORD;
|
|
Certificateheader: PWinCertificate): BOOL; stdcall;
|
|
{$EXTERNALSYM ImageGetCertificateHeader}
|
|
|
|
function ImageLoad(DllName: PSTR; DllPath: PSTR): PLOADED_IMAGE; stdcall;
|
|
{$EXTERNALSYM ImageLoad}
|
|
|
|
function ImageUnload(const LoadedImage: LOADED_IMAGE): BOOL; stdcall;
|
|
{$EXTERNALSYM ImageUnload}
|
|
|
|
function MapAndLoad(ImageName, DllPath: PSTR; var LoadedImage: LOADED_IMAGE;
|
|
DotDll: BOOL; ReadOnly: BOOL): BOOL; stdcall;
|
|
{$EXTERNALSYM MapAndLoad}
|
|
|
|
function UnMapAndLoad(const LoadedImage: LOADED_IMAGE): BOOL; stdcall;
|
|
{$EXTERNALSYM UnMapAndLoad}
|
|
|
|
function TouchFileTimes(FileHandle: HANDLE; pSystemTime: PSYSTEMTIME): BOOL; stdcall;
|
|
{$EXTERNALSYM TouchFileTimes}
|
|
|
|
function SplitSymbols(ImageName, SymbolsPath, SymbolFilePath: PSTR; Flags: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM SplitSymbols}
|
|
|
|
function UpdateDebugInfoFile(ImageFileName, SymbolPath, DebugFilePath: PSTR;
|
|
const NtHeaders: IMAGE_NT_HEADERS32): BOOL; stdcall;
|
|
{$EXTERNALSYM UpdateDebugInfoFile}
|
|
|
|
function UpdateDebugInfoFileEx(ImageFileName, SymbolPath, DebugFilePath: PSTR;
|
|
const NtHeaders: IMAGE_NT_HEADERS32; OldChecksum: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM UpdateDebugInfoFileEx}
|
|
|
|
function FindDebugInfoFile(FileName, SymbolPath, DebugFilePath: PSTR): HANDLE; stdcall;
|
|
{$EXTERNALSYM FindDebugInfoFile}
|
|
|
|
type
|
|
PFIND_DEBUG_FILE_CALLBACK = function(FileHandle: HANDLE; FileName: PSTR;
|
|
CallerData: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PFIND_DEBUG_FILE_CALLBACK}
|
|
PFindDebugFileCallback = PFIND_DEBUG_FILE_CALLBACK;
|
|
|
|
function FindDebugInfoFileEx(FileName, SymbolPath, DebugFilePath: PSTR;
|
|
Callback: PFIND_DEBUG_FILE_CALLBACK; CallerData: PVOID): HANDLE; stdcall;
|
|
{$EXTERNALSYM FindDebugInfoFileEx}
|
|
|
|
type
|
|
PFINDFILEINPATHCALLBACK = function(filename: PSTR; context: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PFINDFILEINPATHCALLBACK}
|
|
|
|
function SymFindFileInPath(hprocess: HANDLE; SearchPath, FileName: LPSTR; id: PVOID; two, three, flags: DWORD;
|
|
FoundFile: LPSTR; callback: PFINDFILEINPATHCALLBACK; context: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymFindFileInPath}
|
|
|
|
function FindExecutableImage(FileName, SymbolPath, ImageFilePath: PSTR): HANDLE; stdcall;
|
|
{$EXTERNALSYM FindExecutableImage}
|
|
|
|
type
|
|
PFIND_EXE_FILE_CALLBACK = function(FileHandle: HANDLE; FileName: PSTR;
|
|
CallerData: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PFIND_EXE_FILE_CALLBACK}
|
|
PFindExeFileCallback = PFIND_EXE_FILE_CALLBACK;
|
|
|
|
function FindExecutableImageEx(FileName, SymbolPath, ImageFilePath: PSTR;
|
|
Callback: PFIND_EXE_FILE_CALLBACK; CallerData: PVOID): HANDLE; stdcall;
|
|
{$EXTERNALSYM FindExecutableImageEx}
|
|
|
|
function ImageNtHeader(Base: PVOID): PIMAGE_NT_HEADERS; stdcall;
|
|
{$EXTERNALSYM ImageNtHeader}
|
|
|
|
function ImageDirectoryEntryToDataEx(Base: PVOID; MappedAsImage: ByteBool;
|
|
DirectoryEntry: USHORT; var Size: ULONG; var FoundHeader: PIMAGE_SECTION_HEADER): PVOID; stdcall;
|
|
{$EXTERNALSYM ImageDirectoryEntryToDataEx}
|
|
|
|
function ImageDirectoryEntryToData(Base: PVOID; MappedAsImage: ByteBool;
|
|
DirectoryEntry: USHORT; var Size: ULONG): PVOID; stdcall;
|
|
{$EXTERNALSYM ImageDirectoryEntryToData}
|
|
|
|
function ImageRvaToSection(NtHeaders: PIMAGE_NT_HEADERS; Base: PVOID; Rva: ULONG): PIMAGE_SECTION_HEADER; stdcall;
|
|
{$EXTERNALSYM ImageRvaToSection}
|
|
|
|
function ImageRvaToVa(NtHeaders: PIMAGE_NT_HEADERS; Base: PVOID; Rva: ULONG;
|
|
var LastRvaSection: PIMAGE_SECTION_HEADER): PVOID; stdcall;
|
|
{$EXTERNALSYM ImageRvaToVa}
|
|
|
|
// Symbol server exports
|
|
|
|
type
|
|
PSYMBOLSERVERPROC = function(a1, a2: LPCSTR; a3: PVOID; a4, a5: DWORD; a6: LPSTR): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYMBOLSERVERPROC}
|
|
PSYMBOLSERVEROPENPROC = function: BOOL; stdcall;
|
|
{$EXTERNALSYM PSYMBOLSERVEROPENPROC}
|
|
PSYMBOLSERVERCLOSEPROC = function: BOOL; stdcall;
|
|
{$EXTERNALSYM PSYMBOLSERVERCLOSEPROC}
|
|
PSYMBOLSERVERSETOPTIONSPROC = function(a1: UINT_PTR; a2: ULONG64): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYMBOLSERVERSETOPTIONSPROC}
|
|
PSYMBOLSERVERCALLBACKPROC = function(action: UINT_PTR; data: ULONG64; context: ULONG64): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYMBOLSERVERCALLBACKPROC}
|
|
PSYMBOLSERVERGETOPTIONSPROC = function: UINT_PTR; stdcall;
|
|
{$EXTERNALSYM PSYMBOLSERVERGETOPTIONSPROC}
|
|
PSYMBOLSERVERPINGPROC = function(a1: LPCSTR): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYMBOLSERVERPINGPROC}
|
|
|
|
const
|
|
SSRVOPT_CALLBACK = $01;
|
|
{$EXTERNALSYM SSRVOPT_CALLBACK}
|
|
SSRVOPT_DWORD = $02;
|
|
{$EXTERNALSYM SSRVOPT_DWORD}
|
|
SSRVOPT_DWORDPTR = $04;
|
|
{$EXTERNALSYM SSRVOPT_DWORDPTR}
|
|
SSRVOPT_GUIDPTR = $08;
|
|
{$EXTERNALSYM SSRVOPT_GUIDPTR}
|
|
SSRVOPT_OLDGUIDPTR = $10;
|
|
{$EXTERNALSYM SSRVOPT_OLDGUIDPTR}
|
|
SSRVOPT_UNATTENDED = $20;
|
|
{$EXTERNALSYM SSRVOPT_UNATTENDED}
|
|
SSRVOPT_RESET = ULONG_PTR(-1);
|
|
{$EXTERNALSYM SSRVOPT_RESET}
|
|
|
|
SSRVACTION_TRACE = 1;
|
|
{$EXTERNALSYM SSRVACTION_TRACE}
|
|
|
|
// This api won't be ported to Win64 - Fix your code.
|
|
|
|
type
|
|
PIMAGE_DEBUG_INFORMATION = ^IMAGE_DEBUG_INFORMATION;
|
|
{$EXTERNALSYM PIMAGE_DEBUG_INFORMATION}
|
|
_IMAGE_DEBUG_INFORMATION = record
|
|
List: LIST_ENTRY;
|
|
ReservedSize: DWORD;
|
|
ReservedMappedBase: PVOID;
|
|
ReservedMachine: USHORT;
|
|
ReservedCharacteristics: USHORT;
|
|
ReservedCheckSum: DWORD;
|
|
ImageBase: DWORD;
|
|
SizeOfImage: DWORD;
|
|
ReservedNumberOfSections: DWORD;
|
|
ReservedSections: PIMAGE_SECTION_HEADER;
|
|
ReservedExportedNamesSize: DWORD;
|
|
ReservedExportedNames: PSTR;
|
|
ReservedNumberOfFunctionTableEntries: DWORD;
|
|
ReservedFunctionTableEntries: PIMAGE_FUNCTION_ENTRY;
|
|
ReservedLowestFunctionStartingAddress: DWORD;
|
|
ReservedHighestFunctionEndingAddress: DWORD;
|
|
ReservedNumberOfFpoTableEntries: DWORD;
|
|
ReservedFpoTableEntries: PFPO_DATA;
|
|
SizeOfCoffSymbols: DWORD;
|
|
CoffSymbols: PIMAGE_COFF_SYMBOLS_HEADER;
|
|
ReservedSizeOfCodeViewSymbols: DWORD;
|
|
ReservedCodeViewSymbols: PVOID;
|
|
ImageFilePath: PSTR;
|
|
ImageFileName: PSTR;
|
|
ReservedDebugFilePath: PSTR;
|
|
ReservedTimeDateStamp: DWORD;
|
|
ReservedRomImage: BOOL;
|
|
ReservedDebugDirectory: PIMAGE_DEBUG_DIRECTORY;
|
|
ReservedNumberOfDebugDirectories: DWORD;
|
|
ReservedOriginalFunctionTableBaseAddress: DWORD;
|
|
Reserved: array [0..1] of DWORD;
|
|
end;
|
|
{$EXTERNALSYM _IMAGE_DEBUG_INFORMATION}
|
|
IMAGE_DEBUG_INFORMATION = _IMAGE_DEBUG_INFORMATION;
|
|
{$EXTERNALSYM IMAGE_DEBUG_INFORMATION}
|
|
TImageDebugInformation = IMAGE_DEBUG_INFORMATION;
|
|
PImageDebugInformation = PIMAGE_DEBUG_INFORMATION;
|
|
|
|
function MapDebugInformation(FileHandle: HANDLE; FileName, SymbolPath: PSTR;
|
|
ImageBase: DWORD): PIMAGE_DEBUG_INFORMATION; stdcall;
|
|
{$EXTERNALSYM MapDebugInformation}
|
|
|
|
function UnmapDebugInformation(DebugInfo: PIMAGE_DEBUG_INFORMATION): BOOL; stdcall;
|
|
{$EXTERNALSYM UnmapDebugInformation}
|
|
|
|
function SearchTreeForFile(RootPath, InputPathName, OutputPathBuffer: PSTR): BOOL; stdcall;
|
|
{$EXTERNALSYM SearchTreeForFile}
|
|
|
|
type
|
|
PENUMDIRTREE_CALLBACK = function(FilePath: LPCSTR; CallerData: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PENUMDIRTREE_CALLBACK}
|
|
PEnumDirTreeCallback = PENUMDIRTREE_CALLBACK;
|
|
|
|
function EnumDirTree(hProcess: HANDLE; RootPath, InputPathName, OutputPathBuffer: PSTR;
|
|
Callback: PENUMDIRTREE_CALLBACK; CallbackData: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM EnumDirTree}
|
|
|
|
function MakeSureDirectoryPathExists(DirPath: PCSTR): BOOL; stdcall;
|
|
{$EXTERNALSYM MakeSureDirectoryPathExists}
|
|
|
|
//
|
|
// UnDecorateSymbolName Flags
|
|
//
|
|
|
|
const
|
|
UNDNAME_COMPLETE = $0000; // Enable full undecoration
|
|
{$EXTERNALSYM UNDNAME_COMPLETE}
|
|
UNDNAME_NO_LEADING_UNDERSCORES = $0001; // Remove leading underscores from MS extended keywords
|
|
{$EXTERNALSYM UNDNAME_NO_LEADING_UNDERSCORES}
|
|
UNDNAME_NO_MS_KEYWORDS = $0002; // Disable expansion of MS extended keywords
|
|
{$EXTERNALSYM UNDNAME_NO_MS_KEYWORDS}
|
|
UNDNAME_NO_FUNCTION_RETURNS = $0004; // Disable expansion of return type for primary declaration
|
|
{$EXTERNALSYM UNDNAME_NO_FUNCTION_RETURNS}
|
|
UNDNAME_NO_ALLOCATION_MODEL = $0008; // Disable expansion of the declaration model
|
|
{$EXTERNALSYM UNDNAME_NO_ALLOCATION_MODEL}
|
|
UNDNAME_NO_ALLOCATION_LANGUAGE = $0010; // Disable expansion of the declaration language specifier
|
|
{$EXTERNALSYM UNDNAME_NO_ALLOCATION_LANGUAGE}
|
|
UNDNAME_NO_MS_THISTYPE = $0020; // NYI Disable expansion of MS keywords on the 'this' type for primary declaration
|
|
{$EXTERNALSYM UNDNAME_NO_MS_THISTYPE}
|
|
UNDNAME_NO_CV_THISTYPE = $0040; // NYI Disable expansion of CV modifiers on the 'this' type for primary declaration
|
|
{$EXTERNALSYM UNDNAME_NO_CV_THISTYPE}
|
|
UNDNAME_NO_THISTYPE = $0060; // Disable all modifiers on the 'this' type
|
|
{$EXTERNALSYM UNDNAME_NO_THISTYPE}
|
|
UNDNAME_NO_ACCESS_SPECIFIERS = $0080; // Disable expansion of access specifiers for members
|
|
{$EXTERNALSYM UNDNAME_NO_ACCESS_SPECIFIERS}
|
|
UNDNAME_NO_THROW_SIGNATURES = $0100; // Disable expansion of 'throw-signatures' for functions and pointers to functions
|
|
{$EXTERNALSYM UNDNAME_NO_THROW_SIGNATURES}
|
|
UNDNAME_NO_MEMBER_TYPE = $0200; // Disable expansion of 'static' or 'virtual'ness of members
|
|
{$EXTERNALSYM UNDNAME_NO_MEMBER_TYPE}
|
|
UNDNAME_NO_RETURN_UDT_MODEL = $0400; // Disable expansion of MS model for UDT returns
|
|
{$EXTERNALSYM UNDNAME_NO_RETURN_UDT_MODEL}
|
|
UNDNAME_32_BIT_DECODE = $0800; // Undecorate 32-bit decorated names
|
|
{$EXTERNALSYM UNDNAME_32_BIT_DECODE}
|
|
UNDNAME_NAME_ONLY = $1000; // Crack only the name for primary declaration;
|
|
{$EXTERNALSYM UNDNAME_NAME_ONLY}
|
|
// return just [scope::]name. Does expand template params
|
|
UNDNAME_NO_ARGUMENTS = $2000; // Don't undecorate arguments to function
|
|
{$EXTERNALSYM UNDNAME_NO_ARGUMENTS}
|
|
UNDNAME_NO_SPECIAL_SYMS = $4000; // Don't undecorate special names (v-table, vcall, vector xxx, metatype, etc)
|
|
{$EXTERNALSYM UNDNAME_NO_SPECIAL_SYMS}
|
|
|
|
function UnDecorateSymbolName(DecoratedName: PCSTR; UnDecoratedName: PSTR;
|
|
UndecoratedLength: DWORD; Flags: DWORD): DWORD; stdcall;
|
|
{$EXTERNALSYM UnDecorateSymbolName}
|
|
|
|
//
|
|
// these values are used for synthesized file types
|
|
// that can be passed in as image headers instead of
|
|
// the standard ones from ntimage.h
|
|
//
|
|
|
|
const
|
|
DBHHEADER_DEBUGDIRS = $1;
|
|
{$EXTERNALSYM DBHHEADER_DEBUGDIRS}
|
|
|
|
type
|
|
_MODLOAD_DATA = record
|
|
ssize: DWORD; // size of this struct
|
|
ssig: DWORD; // signature identifying the passed data
|
|
data: PVOID; // pointer to passed data
|
|
size: DWORD; // size of passed data
|
|
flags: DWORD; // options
|
|
end;
|
|
{$EXTERNALSYM _MODLOAD_DATA}
|
|
MODLOAD_DATA = _MODLOAD_DATA;
|
|
{$EXTERNALSYM MODLOAD_DATA}
|
|
PMODLOAD_DATA = ^MODLOAD_DATA;
|
|
{$EXTERNALSYM PMODLOAD_DATA}
|
|
TModLoadData = MODLOAD_DATA;
|
|
PModLoadData = PMODLOAD_DATA;
|
|
|
|
//
|
|
// StackWalking API
|
|
//
|
|
|
|
type
|
|
ADDRESS_MODE = (
|
|
AddrMode1616,
|
|
AddrMode1632,
|
|
AddrModeReal,
|
|
AddrModeFlat);
|
|
{$EXTERNALSYM ADDRESS_MODE}
|
|
TAddressMode = ADDRESS_MODE;
|
|
|
|
LPADDRESS64 = ^ADDRESS64;
|
|
{$EXTERNALSYM PADDRESS64}
|
|
_tagADDRESS64 = record
|
|
Offset: DWORD64;
|
|
Segment: WORD;
|
|
Mode: ADDRESS_MODE;
|
|
end;
|
|
{$EXTERNALSYM _tagADDRESS64}
|
|
ADDRESS64 = _tagADDRESS64;
|
|
{$EXTERNALSYM ADDRESS64}
|
|
TAddress64 = ADDRESS64;
|
|
PAddress64 = LPADDRESS64;
|
|
|
|
LPADDRESS = ^ADDRESS;
|
|
{$EXTERNALSYM PADDRESS}
|
|
_tagADDRESS = record
|
|
Offset: DWORD;
|
|
Segment: WORD;
|
|
Mode: ADDRESS_MODE;
|
|
end;
|
|
{$EXTERNALSYM _tagADDRESS}
|
|
ADDRESS = _tagADDRESS;
|
|
{$EXTERNALSYM ADDRESS}
|
|
TAddress = ADDRESS;
|
|
PAddress = LPADDRESS;
|
|
|
|
procedure Address32To64(a32: LPADDRESS; a64: LPADDRESS64);
|
|
{$EXTERNALSYM Address32To64}
|
|
|
|
procedure Address64To32(a64: LPADDRESS64; a32: LPADDRESS);
|
|
{$EXTERNALSYM Address64To32}
|
|
|
|
//
|
|
// This structure is included in the STACKFRAME structure,
|
|
// and is used to trace through usermode callbacks in a thread's
|
|
// kernel stack. The values must be copied by the kernel debugger
|
|
// from the DBGKD_GET_VERSION and WAIT_STATE_CHANGE packets.
|
|
//
|
|
|
|
//
|
|
// New KDHELP structure for 64 bit system support.
|
|
// This structure is preferred in new code.
|
|
//
|
|
|
|
type
|
|
PKDHELP64 = ^KDHELP64;
|
|
{$EXTERNALSYM PKDHELP64}
|
|
_KDHELP64 = record
|
|
//
|
|
// address of kernel thread object, as provided in the
|
|
// WAIT_STATE_CHANGE packet.
|
|
//
|
|
Thread: DWORD64;
|
|
//
|
|
// offset in thread object to pointer to the current callback frame
|
|
// in kernel stack.
|
|
//
|
|
ThCallbackStack: DWORD;
|
|
//
|
|
// offset in thread object to pointer to the current callback backing
|
|
// store frame in kernel stack.
|
|
//
|
|
ThCallbackBStore: DWORD;
|
|
//
|
|
// offsets to values in frame:
|
|
//
|
|
// address of next callback frame
|
|
NextCallback: DWORD;
|
|
// address of saved frame pointer (if applicable)
|
|
FramePointer: DWORD;
|
|
//
|
|
// Address of the kernel function that calls out to user mode
|
|
//
|
|
KiCallUserMode: DWORD64;
|
|
//
|
|
// Address of the user mode dispatcher function
|
|
//
|
|
KeUserCallbackDispatcher: DWORD64;
|
|
//
|
|
// Lowest kernel mode address
|
|
//
|
|
SystemRangeStart: DWORD64;
|
|
Reserved: array [0..7] of DWORD64;
|
|
end;
|
|
{$EXTERNALSYM _KDHELP64}
|
|
KDHELP64 = _KDHELP64;
|
|
{$EXTERNALSYM KDHELP64}
|
|
TKdHelp64 = KDHELP64;
|
|
//PKdHelp64 = PKDHELP64;
|
|
|
|
PKDHELP = ^KDHELP;
|
|
{$EXTERNALSYM PKDHELP}
|
|
_KDHELP = record
|
|
//
|
|
// address of kernel thread object, as provided in the
|
|
// WAIT_STATE_CHANGE packet.
|
|
//
|
|
Thread: DWORD;
|
|
//
|
|
// offset in thread object to pointer to the current callback frame
|
|
// in kernel stack.
|
|
//
|
|
ThCallbackStack: DWORD;
|
|
//
|
|
// offsets to values in frame:
|
|
//
|
|
// address of next callback frame
|
|
NextCallback: DWORD;
|
|
// address of saved frame pointer (if applicable)
|
|
FramePointer: DWORD;
|
|
//
|
|
// Address of the kernel function that calls out to user mode
|
|
//
|
|
KiCallUserMode: DWORD;
|
|
//
|
|
// Address of the user mode dispatcher function
|
|
//
|
|
KeUserCallbackDispatcher: DWORD;
|
|
//
|
|
// Lowest kernel mode address
|
|
//
|
|
SystemRangeStart: DWORD;
|
|
//
|
|
// offset in thread object to pointer to the current callback backing
|
|
// store frame in kernel stack.
|
|
//
|
|
ThCallbackBStore: DWORD;
|
|
Reserved: array [0..7] of DWORD;
|
|
end;
|
|
{$EXTERNALSYM _KDHELP}
|
|
KDHELP = _KDHELP;
|
|
{$EXTERNALSYM KDHELP}
|
|
TKdHelp = KDHELP;
|
|
//PKdHelp = PKDHELP;
|
|
|
|
procedure KdHelp32To64(p32: PKDHELP; p64: PKDHELP64);
|
|
{$EXTERNALSYM KdHelp32To64}
|
|
|
|
type
|
|
LPSTACKFRAME64 = ^STACKFRAME64;
|
|
{$EXTERNALSYM LPSTACKFRAME64}
|
|
_tagSTACKFRAME64 = record
|
|
AddrPC: ADDRESS64; // program counter
|
|
AddrReturn: ADDRESS64; // return address
|
|
AddrFrame: ADDRESS64; // frame pointer
|
|
AddrStack: ADDRESS64; // stack pointer
|
|
AddrBStore: ADDRESS64; // backing store pointer
|
|
FuncTableEntry: PVOID; // pointer to pdata/fpo or NULL
|
|
Params: array [0..3] of DWORD64; // possible arguments to the function
|
|
Far: BOOL; // WOW far call
|
|
Virtual: BOOL; // is this a virtual frame?
|
|
Reserved: array [0..2] of DWORD64;
|
|
KdHelp: KDHELP64;
|
|
end;
|
|
{$EXTERNALSYM _tagSTACKFRAME64}
|
|
STACKFRAME64 = _tagSTACKFRAME64;
|
|
{$EXTERNALSYM STACKFRAME64}
|
|
TStackFrame64 = STACKFRAME64;
|
|
PStackFrame64 = LPSTACKFRAME64;
|
|
|
|
LPSTACKFRAME = ^STACKFRAME;
|
|
{$EXTERNALSYM LPSTACKFRAME}
|
|
_tagSTACKFRAME = record
|
|
AddrPC: ADDRESS; // program counter
|
|
AddrReturn: ADDRESS; // return address
|
|
AddrFrame: ADDRESS; // frame pointer
|
|
AddrStack: ADDRESS; // stack pointer
|
|
FuncTableEntry: PVOID; // pointer to pdata/fpo or NULL
|
|
Params: array [0..3] of DWORD; // possible arguments to the function
|
|
Far: BOOL; // WOW far call
|
|
Virtual: BOOL; // is this a virtual frame?
|
|
Reserved: array [0..2] of DWORD;
|
|
KdHelp: KDHELP;
|
|
AddrBStore: ADDRESS; // backing store pointer
|
|
end;
|
|
{$EXTERNALSYM _tagSTACKFRAME}
|
|
STACKFRAME = _tagSTACKFRAME;
|
|
{$EXTERNALSYM STACKFRAME}
|
|
TStackFrame = STACKFRAME;
|
|
PStackFrame = LPSTACKFRAME;
|
|
|
|
PREAD_PROCESS_MEMORY_ROUTINE64 = function(hProcess: HANDLE; qwBaseAddress: DWORD64;
|
|
lpBuffer: PVOID; nSize: DWORD; var lpNumberOfBytesRead: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM PREAD_PROCESS_MEMORY_ROUTINE64}
|
|
PReadProcessMemoryRoutine64 = PREAD_PROCESS_MEMORY_ROUTINE64;
|
|
|
|
PFUNCTION_TABLE_ACCESS_ROUTINE64 = function(hProcess: HANDLE;
|
|
AddrBase: DWORD64): PVOID; stdcall;
|
|
{$EXTERNALSYM PFUNCTION_TABLE_ACCESS_ROUTINE64}
|
|
PFunctionTableAccessRoutine64 = PFUNCTION_TABLE_ACCESS_ROUTINE64;
|
|
|
|
PGET_MODULE_BASE_ROUTINE64 = function(hProcess: HANDLE;
|
|
Address: DWORD64): DWORD64; stdcall;
|
|
{$EXTERNALSYM PGET_MODULE_BASE_ROUTINE64}
|
|
PGetModuleBaseRoutine64 = PGET_MODULE_BASE_ROUTINE64;
|
|
|
|
PTRANSLATE_ADDRESS_ROUTINE64 = function(hProcess: HANDLE; hThread: HANDLE;
|
|
const lpaddr: ADDRESS64): DWORD64; stdcall;
|
|
{$EXTERNALSYM PTRANSLATE_ADDRESS_ROUTINE64}
|
|
PTranslateAddressRoutine64 = PTRANSLATE_ADDRESS_ROUTINE64;
|
|
|
|
function StackWalk64(MachineType: DWORD; hProcess: HANDLE; hThread: HANDLE;
|
|
var StackFrame: STACKFRAME64; ContextRecord: PVOID;
|
|
ReadMemoryRoutine: PREAD_PROCESS_MEMORY_ROUTINE64;
|
|
FunctionTableAccessRoutine: PFUNCTION_TABLE_ACCESS_ROUTINE64;
|
|
GetModuleBaseRoutine: PGET_MODULE_BASE_ROUTINE64;
|
|
TranslateAddress: PTRANSLATE_ADDRESS_ROUTINE64): BOOL; stdcall;
|
|
{$EXTERNALSYM StackWalk64}
|
|
|
|
type
|
|
PREAD_PROCESS_MEMORY_ROUTINE = function(hProcess: HANDLE;
|
|
lpBaseAddress: DWORD; lpBuffer: PVOID; nSize: DWORD;
|
|
var lpNumberOfBytesRead: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM PREAD_PROCESS_MEMORY_ROUTINE}
|
|
PreadProcessMemoryRoutine = PREAD_PROCESS_MEMORY_ROUTINE;
|
|
|
|
PFUNCTION_TABLE_ACCESS_ROUTINE = function(hProcess: HANDLE; AddrBase: DWORD): PVOID; stdcall;
|
|
{$EXTERNALSYM PFUNCTION_TABLE_ACCESS_ROUTINE}
|
|
PFunctionTableAccessRoutine = PFUNCTION_TABLE_ACCESS_ROUTINE;
|
|
|
|
PGET_MODULE_BASE_ROUTINE = function(hProcess: HANDLE; Address: DWORD): DWORD; stdcall;
|
|
{$EXTERNALSYM PGET_MODULE_BASE_ROUTINE}
|
|
PGetModuleBaseRoutine = PGET_MODULE_BASE_ROUTINE;
|
|
|
|
PTRANSLATE_ADDRESS_ROUTINE = function(hProcess: HANDLE; hThread: HANDLE;
|
|
const lpaddr: ADDRESS): DWORD; stdcall;
|
|
{$EXTERNALSYM PTRANSLATE_ADDRESS_ROUTINE}
|
|
PTranslateAddressRoutine = PTRANSLATE_ADDRESS_ROUTINE;
|
|
|
|
function StackWalk(MachineType: DWORD; hProcess: HANDLE; hThread: HANDLE;
|
|
var StackFrame: STACKFRAME; ContextRecord: PVOID;
|
|
ReadMemoryRoutine: PREAD_PROCESS_MEMORY_ROUTINE;
|
|
FunctionTableAccessRoutine: PFUNCTION_TABLE_ACCESS_ROUTINE;
|
|
GetModuleBaseRoutine: PGET_MODULE_BASE_ROUTINE;
|
|
TranslateAddress: PTRANSLATE_ADDRESS_ROUTINE): BOOL; stdcall;
|
|
{$EXTERNALSYM StackWalk}
|
|
|
|
const
|
|
API_VERSION_NUMBER = 9;
|
|
{$EXTERNALSYM API_VERSION_NUMBER}
|
|
|
|
type
|
|
LPAPI_VERSION = ^API_VERSION;
|
|
{$EXTERNALSYM LPAPI_VERSION}
|
|
API_VERSION = record
|
|
MajorVersion: USHORT;
|
|
MinorVersion: USHORT;
|
|
Revision: USHORT;
|
|
Reserved: USHORT;
|
|
end;
|
|
{$EXTERNALSYM API_VERSION}
|
|
TApiVersion = API_VERSION;
|
|
PApiVersion = LPAPI_VERSION;
|
|
|
|
function ImagehlpApiVersion: LPAPI_VERSION; stdcall;
|
|
{$EXTERNALSYM ImagehlpApiVersion}
|
|
|
|
function ImagehlpApiVersionEx(const AppVersion: API_VERSION): LPAPI_VERSION; stdcall;
|
|
{$EXTERNALSYM ImagehlpApiVersionEx}
|
|
|
|
function GetTimestampForLoadedLibrary(Module: HMODULE): DWORD; stdcall;
|
|
{$EXTERNALSYM GetTimestampForLoadedLibrary}
|
|
|
|
//
|
|
// typedefs for function pointers
|
|
//
|
|
|
|
type
|
|
PSYM_ENUMMODULES_CALLBACK64 = function(ModuleName: PSTR; BaseOfDll: DWORD64;
|
|
UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYM_ENUMMODULES_CALLBACK64}
|
|
PSymEnummodulesCallback64 = PSYM_ENUMMODULES_CALLBACK64;
|
|
|
|
PSYM_ENUMSYMBOLS_CALLBACK64 = function(SymbolName: PSTR; SymbolAddress: DWORD64;
|
|
SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK64}
|
|
PSymEnumsymbolsCallback64 = PSYM_ENUMSYMBOLS_CALLBACK64;
|
|
|
|
PSYM_ENUMSYMBOLS_CALLBACK64W = function(SymbolName: PWSTR;
|
|
SymbolAddress: DWORD64; SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK64W}
|
|
PSymEnumsymbolsCallback64w = PSYM_ENUMSYMBOLS_CALLBACK64W;
|
|
|
|
PENUMLOADED_MODULES_CALLBACK64 = function(ModuleName: PSTR;
|
|
ModuleBase: DWORD64; ModuleSize: ULONG; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PENUMLOADED_MODULES_CALLBACK64}
|
|
PSnumloadedModulesCallback64 = PENUMLOADED_MODULES_CALLBACK64;
|
|
|
|
PSYMBOL_REGISTERED_CALLBACK64 = function(hProcess: HANDLE; ActionCode: ULONG;
|
|
CallbackData: ULONG64; UserContext: ULONG64): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYMBOL_REGISTERED_CALLBACK64}
|
|
PSymbolRegisteredCallback64 = PSYMBOL_REGISTERED_CALLBACK64;
|
|
|
|
PSYMBOL_FUNCENTRY_CALLBACK = function(hProcess: HANDLE; AddrBase: DWORD;
|
|
UserContext: PVOID): PVOID; stdcall;
|
|
{$EXTERNALSYM PSYMBOL_FUNCENTRY_CALLBACK}
|
|
PSymbolFuncentryCallback = PSYMBOL_FUNCENTRY_CALLBACK;
|
|
|
|
PSYMBOL_FUNCENTRY_CALLBACK64 = function(hProcess: HANDLE; AddrBase: ULONG64;
|
|
UserContext: ULONG64): PVOID; stdcall;
|
|
{$EXTERNALSYM PSYMBOL_FUNCENTRY_CALLBACK64}
|
|
PSymbolFuncentryCallback64 = PSYMBOL_FUNCENTRY_CALLBACK64;
|
|
|
|
PSYM_ENUMMODULES_CALLBACK = function(ModuleName: PSTR; BaseOfDll: ULONG;
|
|
UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYM_ENUMMODULES_CALLBACK}
|
|
PSymEnummodulesCallback = PSYM_ENUMMODULES_CALLBACK;
|
|
|
|
PSYM_ENUMSYMBOLS_CALLBACK = function(SymbolName: PSTR; SymbolAddress: ULONG;
|
|
SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK}
|
|
PSymEnumsymbolsCallback = PSYM_ENUMSYMBOLS_CALLBACK;
|
|
|
|
PSYM_ENUMSYMBOLS_CALLBACKW = function(SymbolName: PWSTR; SymbolAddress: ULONG;
|
|
SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACKW}
|
|
PSymEnumsymbolsCallbackw = PSYM_ENUMSYMBOLS_CALLBACKW;
|
|
|
|
PENUMLOADED_MODULES_CALLBACK = function(ModuleName: PSTR; ModuleBase: ULONG;
|
|
ModuleSize: ULONG; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PENUMLOADED_MODULES_CALLBACK}
|
|
PEnumloadedModulesCallback = PENUMLOADED_MODULES_CALLBACK;
|
|
|
|
PSYMBOL_REGISTERED_CALLBACK = function(hProcess: HANDLE; ActionCode: ULONG;
|
|
CallbackData: PVOID; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYMBOL_REGISTERED_CALLBACK}
|
|
PSymbolRegisteredCallback = PSYMBOL_REGISTERED_CALLBACK;
|
|
|
|
//
|
|
// flags found in SYMBOL_INFO.Flags
|
|
//
|
|
|
|
const
|
|
SYMFLAG_VALUEPRESENT = $00000001;
|
|
{$EXTERNALSYM SYMFLAG_VALUEPRESENT}
|
|
SYMFLAG_REGISTER = $00000008;
|
|
{$EXTERNALSYM SYMFLAG_REGISTER}
|
|
SYMFLAG_REGREL = $00000010;
|
|
{$EXTERNALSYM SYMFLAG_REGREL}
|
|
SYMFLAG_FRAMEREL = $00000020;
|
|
{$EXTERNALSYM SYMFLAG_FRAMEREL}
|
|
SYMFLAG_PARAMETER = $00000040;
|
|
{$EXTERNALSYM SYMFLAG_PARAMETER}
|
|
SYMFLAG_LOCAL = $00000080;
|
|
{$EXTERNALSYM SYMFLAG_LOCAL}
|
|
SYMFLAG_CONSTANT = $00000100;
|
|
{$EXTERNALSYM SYMFLAG_CONSTANT}
|
|
SYMFLAG_EXPORT = $00000200;
|
|
{$EXTERNALSYM SYMFLAG_EXPORT}
|
|
SYMFLAG_FORWARDER = $00000400;
|
|
{$EXTERNALSYM SYMFLAG_FORWARDER}
|
|
SYMFLAG_FUNCTION = $00000800;
|
|
{$EXTERNALSYM SYMFLAG_FUNCTION}
|
|
SYMFLAG_VIRTUAL = $00001000;
|
|
{$EXTERNALSYM SYMFLAG_VIRTUAL}
|
|
SYMFLAG_THUNK = $00002000;
|
|
{$EXTERNALSYM SYMFLAG_THUNK}
|
|
SYMFLAG_TLSREL = $00004000;
|
|
{$EXTERNALSYM SYMFLAG_TLSREL}
|
|
|
|
//
|
|
// symbol type enumeration
|
|
//
|
|
|
|
type
|
|
SYM_TYPE = (
|
|
SymNone,
|
|
SymCoff,
|
|
SymCv,
|
|
SymPdb,
|
|
SymExport,
|
|
SymDeferred,
|
|
SymSym, // .sym file
|
|
SymDia,
|
|
SymVirtual,
|
|
NumSymTypes);
|
|
{$EXTERNALSYM SYM_TYPE}
|
|
TSymType = SYM_TYPE;
|
|
|
|
//
|
|
// symbol data structure
|
|
//
|
|
|
|
PIMAGEHLP_SYMBOL64 = ^IMAGEHLP_SYMBOL64;
|
|
{$EXTERNALSYM PIMAGEHLP_SYMBOL64}
|
|
_IMAGEHLP_SYMBOL64 = record
|
|
SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_SYMBOL64)
|
|
Address: DWORD64; // virtual address including dll base address
|
|
Size: DWORD; // estimated size of symbol, can be zero
|
|
Flags: DWORD; // info about the symbols, see the SYMF defines
|
|
MaxNameLength: DWORD; // maximum size of symbol name in 'Name'
|
|
Name: array [0..0] of AnsiChar; // symbol name (null terminated string)
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_SYMBOL64}
|
|
IMAGEHLP_SYMBOL64 = _IMAGEHLP_SYMBOL64;
|
|
{$EXTERNALSYM IMAGEHLP_SYMBOL64}
|
|
TImageHlpSymbol64 = IMAGEHLP_SYMBOL64;
|
|
PImageHlpSymbol64 = PIMAGEHLP_SYMBOL64;
|
|
|
|
_IMAGEHLP_SYMBOL64_PACKAGE = record
|
|
sym: IMAGEHLP_SYMBOL64;
|
|
name: array [0..MAX_SYM_NAME] of AnsiChar;
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_SYMBOL64_PACKAGE}
|
|
IMAGEHLP_SYMBOL64_PACKAGE = _IMAGEHLP_SYMBOL64_PACKAGE;
|
|
{$EXTERNALSYM IMAGEHLP_SYMBOL64_PACKAGE}
|
|
PIMAGEHLP_SYMBOL64_PACKAGE = ^IMAGEHLP_SYMBOL64_PACKAGE;
|
|
{$EXTERNALSYM PIMAGEHLP_SYMBOL64_PACKAGE}
|
|
TImageHlpSymbol64Package = IMAGEHLP_SYMBOL64_PACKAGE;
|
|
PImageHlpSymbol64Package = PIMAGEHLP_SYMBOL64_PACKAGE;
|
|
|
|
//#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)
|
|
//
|
|
//#define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64
|
|
//#define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64
|
|
//#define IMAGEHLP_SYMBOL_PACKAGE IMAGEHLP_SYMBOL64_PACKAGE
|
|
//#define PIMAGEHLP_SYMBOL_PACKAGE PIMAGEHLP_SYMBOL64_PACKAGE
|
|
//
|
|
//#else
|
|
|
|
PIMAGEHLP_SYMBOL = ^IMAGEHLP_SYMBOL;
|
|
{$EXTERNALSYM PIMAGEHLP_SYMBOL}
|
|
_IMAGEHLP_SYMBOL = record
|
|
SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_SYMBOL)
|
|
Address: DWORD; // virtual address including dll base address
|
|
Size: DWORD; // estimated size of symbol, can be zero
|
|
Flags: DWORD; // info about the symbols, see the SYMF defines
|
|
MaxNameLength: DWORD; // maximum size of symbol name in 'Name'
|
|
Name: array [0..0] of AnsiChar; // symbol name (null terminated string)
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_SYMBOL}
|
|
IMAGEHLP_SYMBOL = _IMAGEHLP_SYMBOL;
|
|
{$EXTERNALSYM IMAGEHLP_SYMBOL}
|
|
TImageHlpSymbol = IMAGEHLP_SYMBOL;
|
|
PImageHlpSymbol = PIMAGEHLP_SYMBOL;
|
|
|
|
_IMAGEHLP_SYMBOL_PACKAGE = record
|
|
sym: IMAGEHLP_SYMBOL;
|
|
name: array [0..MAX_SYM_NAME] of AnsiChar;
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_SYMBOL_PACKAGE}
|
|
IMAGEHLP_SYMBOL_PACKAGE = _IMAGEHLP_SYMBOL_PACKAGE;
|
|
{$EXTERNALSYM IMAGEHLP_SYMBOL_PACKAGE}
|
|
PIMAGEHLP_SYMBOL_PACKAGE = ^IMAGEHLP_SYMBOL_PACKAGE;
|
|
{$EXTERNALSYM PIMAGEHLP_SYMBOL_PACKAGE}
|
|
TImageHlpSymbolPackage = IMAGEHLP_SYMBOL_PACKAGE;
|
|
PImageHlpSymbolPackage = PIMAGEHLP_SYMBOL_PACKAGE;
|
|
|
|
//#endif
|
|
|
|
//
|
|
// module data structure
|
|
//
|
|
|
|
PIMAGEHLP_MODULE64 = ^IMAGEHLP_MODULE64;
|
|
{$EXTERNALSYM PIMAGEHLP_MODULE64}
|
|
_IMAGEHLP_MODULE64 = record
|
|
SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE64)
|
|
BaseOfImage: DWORD64; // base load address of module
|
|
ImageSize: DWORD; // virtual size of the loaded module
|
|
TimeDateStamp: DWORD; // date/time stamp from pe header
|
|
CheckSum: DWORD; // checksum from the pe header
|
|
NumSyms: DWORD; // number of symbols in the symbol table
|
|
SymType: SYM_TYPE; // type of symbols loaded
|
|
ModuleName: array [0..3] of AnsiChar; // module name
|
|
ImageName: array [0..255] of AnsiChar; // image name
|
|
LoadedImageName: array [0..255] of AnsiChar; // symbol file name
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_MODULE64}
|
|
IMAGEHLP_MODULE64 = _IMAGEHLP_MODULE64;
|
|
{$EXTERNALSYM IMAGEHLP_MODULE64}
|
|
TImageHlpModule64 = IMAGEHLP_MODULE64;
|
|
PImageHlpModule64 = PIMAGEHLP_MODULE64;
|
|
|
|
PIMAGEHLP_MODULEW64 = ^IMAGEHLP_MODULEW64;
|
|
{$EXTERNALSYM PIMAGEHLP_MODULEW64}
|
|
_IMAGEHLP_MODULE64W = record
|
|
SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE64)
|
|
BaseOfImage: DWORD64; // base load address of module
|
|
ImageSize: DWORD; // virtual size of the loaded module
|
|
TimeDateStamp: DWORD; // date/time stamp from pe header
|
|
CheckSum: DWORD; // checksum from the pe header
|
|
NumSyms: DWORD; // number of symbols in the symbol table
|
|
SymType: SYM_TYPE; // type of symbols loaded
|
|
ModuleName: array [0..31] of WCHAR; // module name
|
|
ImageName: array [0..255] of WCHAR; // image name
|
|
LoadedImageName: array [0..255] of WCHAR; // symbol file name
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_MODULE64W}
|
|
IMAGEHLP_MODULEW64 = _IMAGEHLP_MODULE64W;
|
|
{$EXTERNALSYM IMAGEHLP_MODULEW64}
|
|
TImageHlpModuleW64 = IMAGEHLP_MODULEW64;
|
|
PImageHlpModuleW64 = PIMAGEHLP_MODULEW64;
|
|
|
|
PIMAGEHLP_MODULE = ^IMAGEHLP_MODULE;
|
|
{$EXTERNALSYM PIMAGEHLP_MODULE}
|
|
_IMAGEHLP_MODULE = record
|
|
SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE)
|
|
BaseOfImage: DWORD; // base load address of module
|
|
ImageSize: DWORD; // virtual size of the loaded module
|
|
TimeDateStamp: DWORD; // date/time stamp from pe header
|
|
CheckSum: DWORD; // checksum from the pe header
|
|
NumSyms: DWORD; // number of symbols in the symbol table
|
|
SymType: SYM_TYPE; // type of symbols loaded
|
|
ModuleName: array [0..31] of AnsiChar; // module name
|
|
ImageName: array [0..255] of AnsiChar; // image name
|
|
LoadedImageName: array [0..255] of AnsiChar; // symbol file name
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_MODULE}
|
|
IMAGEHLP_MODULE = _IMAGEHLP_MODULE;
|
|
{$EXTERNALSYM IMAGEHLP_MODULE}
|
|
TImageHlpModule = IMAGEHLP_MODULE;
|
|
PImageHlpModule = PIMAGEHLP_MODULE;
|
|
|
|
PIMAGEHLP_MODULEW = ^IMAGEHLP_MODULEW;
|
|
{$EXTERNALSYM PIMAGEHLP_MODULEW}
|
|
_IMAGEHLP_MODULEW = record
|
|
SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE)
|
|
BaseOfImage: DWORD; // base load address of module
|
|
ImageSize: DWORD; // virtual size of the loaded module
|
|
TimeDateStamp: DWORD; // date/time stamp from pe header
|
|
CheckSum: DWORD; // checksum from the pe header
|
|
NumSyms: DWORD; // number of symbols in the symbol table
|
|
SymType: SYM_TYPE; // type of symbols loaded
|
|
ModuleName: array [0..31] of WCHAR; // module name
|
|
ImageName: array [0..255] of WCHAR; // image name
|
|
LoadedImageName: array [0..255] of WCHAR; // symbol file name
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_MODULEW}
|
|
IMAGEHLP_MODULEW = _IMAGEHLP_MODULEW;
|
|
{$EXTERNALSYM IMAGEHLP_MODULEW}
|
|
TImageHlpModuleW = IMAGEHLP_MODULEW;
|
|
PImageHlpModuleW = PIMAGEHLP_MODULEW;
|
|
|
|
//
|
|
// source file line data structure
|
|
//
|
|
|
|
PIMAGEHLP_LINE64 = ^IMAGEHLP_LINE64;
|
|
{$EXTERNALSYM PIMAGEHLP_LINE64}
|
|
_IMAGEHLP_LINE64 = record
|
|
SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_LINE64)
|
|
Key: PVOID; // internal
|
|
LineNumber: DWORD; // line number in file
|
|
FileName: PAnsiChar; // full filename
|
|
Address: DWORD64; // first instruction of line
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_LINE64}
|
|
IMAGEHLP_LINE64 = _IMAGEHLP_LINE64;
|
|
{$EXTERNALSYM IMAGEHLP_LINE64}
|
|
TImageHlpLine64 = IMAGEHLP_LINE64;
|
|
PImageHlpLine64 = PIMAGEHLP_LINE64;
|
|
|
|
PIMAGEHLP_LINE = ^IMAGEHLP_LINE;
|
|
{$EXTERNALSYM PIMAGEHLP_LINE}
|
|
_IMAGEHLP_LINE = record
|
|
SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_LINE)
|
|
Key: PVOID; // internal
|
|
LineNumber: DWORD; // line number in file
|
|
FileName: PAnsiChar; // full filename
|
|
Address: DWORD; // first instruction of line
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_LINE}
|
|
IMAGEHLP_LINE = _IMAGEHLP_LINE;
|
|
{$EXTERNALSYM IMAGEHLP_LINE}
|
|
TImageHlpLine = IMAGEHLP_LINE;
|
|
PImageHlpLine = PIMAGEHLP_LINE;
|
|
|
|
//
|
|
// source file structure
|
|
//
|
|
|
|
type
|
|
_SOURCEFILE = record
|
|
ModBase: DWORD64; // base address of loaded module
|
|
FileName: PAnsiChar; // full filename of source
|
|
end;
|
|
{$EXTERNALSYM _SOURCEFILE}
|
|
SOURCEFILE = _SOURCEFILE;
|
|
{$EXTERNALSYM SOURCEFILE}
|
|
PSOURCEFILE = ^SOURCEFILE;
|
|
{$EXTERNALSYM PSOURCEFILE}
|
|
TSourceFile = SOURCEFILE;
|
|
|
|
//
|
|
// data structures used for registered symbol callbacks
|
|
//
|
|
|
|
const
|
|
CBA_DEFERRED_SYMBOL_LOAD_START = $00000001;
|
|
{$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_START}
|
|
CBA_DEFERRED_SYMBOL_LOAD_COMPLETE = $00000002;
|
|
{$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_COMPLETE}
|
|
CBA_DEFERRED_SYMBOL_LOAD_FAILURE = $00000003;
|
|
{$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_FAILURE}
|
|
CBA_SYMBOLS_UNLOADED = $00000004;
|
|
{$EXTERNALSYM CBA_SYMBOLS_UNLOADED}
|
|
CBA_DUPLICATE_SYMBOL = $00000005;
|
|
{$EXTERNALSYM CBA_DUPLICATE_SYMBOL}
|
|
CBA_READ_MEMORY = $00000006;
|
|
{$EXTERNALSYM CBA_READ_MEMORY}
|
|
CBA_DEFERRED_SYMBOL_LOAD_CANCEL = $00000007;
|
|
{$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_CANCEL}
|
|
CBA_SET_OPTIONS = $00000008;
|
|
{$EXTERNALSYM CBA_SET_OPTIONS}
|
|
CBA_EVENT = $00000010;
|
|
{$EXTERNALSYM CBA_EVENT}
|
|
CBA_DEFERRED_SYMBOL_LOAD_PARTIAL = $00000020;
|
|
{$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_PARTIAL}
|
|
CBA_DEBUG_INFO = $10000000;
|
|
{$EXTERNALSYM CBA_DEBUG_INFO}
|
|
|
|
type
|
|
PIMAGEHLP_CBA_READ_MEMORY = ^IMAGEHLP_CBA_READ_MEMORY;
|
|
{$EXTERNALSYM PIMAGEHLP_CBA_READ_MEMORY}
|
|
_IMAGEHLP_CBA_READ_MEMORY = record
|
|
addr: DWORD64; // address to read from
|
|
buf: PVOID; // buffer to read to
|
|
bytes: DWORD; // amount of bytes to read
|
|
bytesread: LPDWORD; // pointer to store amount of bytes read
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_CBA_READ_MEMORY}
|
|
IMAGEHLP_CBA_READ_MEMORY = _IMAGEHLP_CBA_READ_MEMORY;
|
|
{$EXTERNALSYM IMAGEHLP_CBA_READ_MEMORY}
|
|
TImageHlpCbaReadMemory = IMAGEHLP_CBA_READ_MEMORY;
|
|
PImageHlpCbaReadMemory = PIMAGEHLP_CBA_READ_MEMORY;
|
|
|
|
const
|
|
sevInfo = 0;
|
|
{$EXTERNALSYM sevInfo}
|
|
sevProblem = 1;
|
|
{$EXTERNALSYM sevProblem}
|
|
sevAttn = 2;
|
|
{$EXTERNALSYM sevAttn}
|
|
sevFatal = 3;
|
|
{$EXTERNALSYM sevFatal}
|
|
sevMax = 4; // unused
|
|
{$EXTERNALSYM sevMax}
|
|
|
|
type
|
|
_IMAGEHLP_CBA_EVENT = record
|
|
severity: DWORD; // values from sevInfo to sevFatal
|
|
code: DWORD; // numerical code IDs the error
|
|
desc: PAnsiChar; // may contain a text description of the error
|
|
object_: PVOID; // value dependant upon the error code
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_CBA_EVENT}
|
|
IMAGEHLP_CBA_EVENT = _IMAGEHLP_CBA_EVENT;
|
|
{$EXTERNALSYM IMAGEHLP_CBA_EVENT}
|
|
PIMAGEHLP_CBA_EVENT = ^IMAGEHLP_CBA_EVENT;
|
|
{$EXTERNALSYM PIMAGEHLP_CBA_EVENT}
|
|
TImageHlpCbaEvent = IMAGEHLP_CBA_EVENT;
|
|
PImageHlpCbaEvent = PIMAGEHLP_CBA_EVENT;
|
|
|
|
PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 = ^IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
|
|
{$EXTERNALSYM PIMAGEHLP_DEFERRED_SYMBOL_LOAD64}
|
|
_IMAGEHLP_DEFERRED_SYMBOL_LOAD64 = record
|
|
SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64)
|
|
BaseOfImage: DWORD64; // base load address of module
|
|
CheckSum: DWORD; // checksum from the pe header
|
|
TimeDateStamp: DWORD; // date/time stamp from pe header
|
|
FileName: array [0..MAX_PATH - 1] of AnsiChar; // symbols file or image name
|
|
Reparse: ByteBool; // load failure reparse
|
|
hFile: HANDLE; // file handle, if passed
|
|
Flags: DWORD; //
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_DEFERRED_SYMBOL_LOAD64}
|
|
IMAGEHLP_DEFERRED_SYMBOL_LOAD64 = _IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
|
|
{$EXTERNALSYM IMAGEHLP_DEFERRED_SYMBOL_LOAD64}
|
|
TImageHlpDeferredSymbolLoad64 = IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
|
|
PImageHlpDeferredSymbolLoad64 = PIMAGEHLP_DEFERRED_SYMBOL_LOAD64;
|
|
|
|
const
|
|
DSLFLAG_MISMATCHED_PDB = $1;
|
|
{$EXTERNALSYM DSLFLAG_MISMATCHED_PDB}
|
|
DSLFLAG_MISMATCHED_DBG = $2;
|
|
{$EXTERNALSYM DSLFLAG_MISMATCHED_DBG}
|
|
|
|
type
|
|
PIMAGEHLP_DEFERRED_SYMBOL_LOAD = ^IMAGEHLP_DEFERRED_SYMBOL_LOAD;
|
|
{$EXTERNALSYM PIMAGEHLP_DEFERRED_SYMBOL_LOAD}
|
|
_IMAGEHLP_DEFERRED_SYMBOL_LOAD = record
|
|
SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD)
|
|
BaseOfImage: DWORD; // base load address of module
|
|
CheckSum: DWORD; // checksum from the pe header
|
|
TimeDateStamp: DWORD; // date/time stamp from pe header
|
|
FileName: array [0..MAX_PATH - 1] of AnsiChar; // symbols file or image name
|
|
Reparse: ByteBool; // load failure reparse
|
|
hFile: HANDLE; // file handle, if passed
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_DEFERRED_SYMBOL_LOAD}
|
|
IMAGEHLP_DEFERRED_SYMBOL_LOAD = _IMAGEHLP_DEFERRED_SYMBOL_LOAD;
|
|
{$EXTERNALSYM IMAGEHLP_DEFERRED_SYMBOL_LOAD}
|
|
TImageHlpDeferredSymbolLoad = IMAGEHLP_DEFERRED_SYMBOL_LOAD;
|
|
PImageHlpDeferredSymbolLoad = PIMAGEHLP_DEFERRED_SYMBOL_LOAD;
|
|
|
|
PIMAGEHLP_DUPLICATE_SYMBOL64 = ^IMAGEHLP_DUPLICATE_SYMBOL64;
|
|
{$EXTERNALSYM PIMAGEHLP_DUPLICATE_SYMBOL64}
|
|
_IMAGEHLP_DUPLICATE_SYMBOL64 = record
|
|
SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL64)
|
|
NumberOfDups: DWORD; // number of duplicates in the Symbol array
|
|
Symbol: PIMAGEHLP_SYMBOL64; // array of duplicate symbols
|
|
SelectedSymbol: DWORD; // symbol selected (-1 to start)
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_DUPLICATE_SYMBOL64}
|
|
IMAGEHLP_DUPLICATE_SYMBOL64 = _IMAGEHLP_DUPLICATE_SYMBOL64;
|
|
{$EXTERNALSYM IMAGEHLP_DUPLICATE_SYMBOL64}
|
|
TImageHlpDuplicateSymbol64 = IMAGEHLP_DUPLICATE_SYMBOL64;
|
|
PImageHlpDuplicateSymbol64 = PIMAGEHLP_DUPLICATE_SYMBOL64;
|
|
|
|
PIMAGEHLP_DUPLICATE_SYMBOL = ^IMAGEHLP_DUPLICATE_SYMBOL;
|
|
{$EXTERNALSYM PIMAGEHLP_DUPLICATE_SYMBOL}
|
|
_IMAGEHLP_DUPLICATE_SYMBOL = record
|
|
SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL)
|
|
NumberOfDups: DWORD; // number of duplicates in the Symbol array
|
|
Symbol: PIMAGEHLP_SYMBOL; // array of duplicate symbols
|
|
SelectedSymbol: DWORD; // symbol selected (-1 to start)
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_DUPLICATE_SYMBOL}
|
|
IMAGEHLP_DUPLICATE_SYMBOL = _IMAGEHLP_DUPLICATE_SYMBOL;
|
|
{$EXTERNALSYM IMAGEHLP_DUPLICATE_SYMBOL}
|
|
TImageHlpDuplicateSymbol = IMAGEHLP_DUPLICATE_SYMBOL;
|
|
PImageHlpDuplicateSymbol = PIMAGEHLP_DUPLICATE_SYMBOL;
|
|
|
|
// If dbghelp ever needs to display graphical UI, it will use this as the parent window.
|
|
|
|
//BOOL
|
|
//SymSetParentWindow(
|
|
// HWND hwnd
|
|
// );
|
|
|
|
//
|
|
// options that are set/returned by SymSetOptions() & SymGetOptions()
|
|
// these are used as a mask
|
|
//
|
|
|
|
const
|
|
SYMOPT_CASE_INSENSITIVE = $00000001;
|
|
{$EXTERNALSYM SYMOPT_CASE_INSENSITIVE}
|
|
SYMOPT_UNDNAME = $00000002;
|
|
{$EXTERNALSYM SYMOPT_UNDNAME}
|
|
SYMOPT_DEFERRED_LOADS = $00000004;
|
|
{$EXTERNALSYM SYMOPT_DEFERRED_LOADS}
|
|
SYMOPT_NO_CPP = $00000008;
|
|
{$EXTERNALSYM SYMOPT_NO_CPP}
|
|
SYMOPT_LOAD_LINES = $00000010;
|
|
{$EXTERNALSYM SYMOPT_LOAD_LINES}
|
|
SYMOPT_OMAP_FIND_NEAREST = $00000020;
|
|
{$EXTERNALSYM SYMOPT_OMAP_FIND_NEAREST}
|
|
SYMOPT_LOAD_ANYTHING = $00000040;
|
|
{$EXTERNALSYM SYMOPT_LOAD_ANYTHING}
|
|
SYMOPT_IGNORE_CVREC = $00000080;
|
|
{$EXTERNALSYM SYMOPT_IGNORE_CVREC}
|
|
SYMOPT_NO_UNQUALIFIED_LOADS = $00000100;
|
|
{$EXTERNALSYM SYMOPT_NO_UNQUALIFIED_LOADS}
|
|
SYMOPT_FAIL_CRITICAL_ERRORS = $00000200;
|
|
{$EXTERNALSYM SYMOPT_FAIL_CRITICAL_ERRORS}
|
|
SYMOPT_EXACT_SYMBOLS = $00000400;
|
|
{$EXTERNALSYM SYMOPT_EXACT_SYMBOLS}
|
|
SYMOPT_ALLOW_ABSOLUTE_SYMBOLS = $00000800;
|
|
{$EXTERNALSYM SYMOPT_ALLOW_ABSOLUTE_SYMBOLS}
|
|
SYMOPT_IGNORE_NT_SYMPATH = $00001000;
|
|
{$EXTERNALSYM SYMOPT_IGNORE_NT_SYMPATH}
|
|
SYMOPT_INCLUDE_32BIT_MODULES = $00002000;
|
|
{$EXTERNALSYM SYMOPT_INCLUDE_32BIT_MODULES}
|
|
SYMOPT_PUBLICS_ONLY = $00004000;
|
|
{$EXTERNALSYM SYMOPT_PUBLICS_ONLY}
|
|
SYMOPT_NO_PUBLICS = $00008000;
|
|
{$EXTERNALSYM SYMOPT_NO_PUBLICS}
|
|
SYMOPT_AUTO_PUBLICS = $00010000;
|
|
{$EXTERNALSYM SYMOPT_AUTO_PUBLICS}
|
|
SYMOPT_NO_IMAGE_SEARCH = $00020000;
|
|
{$EXTERNALSYM SYMOPT_NO_IMAGE_SEARCH}
|
|
SYMOPT_SECURE = $00040000;
|
|
{$EXTERNALSYM SYMOPT_SECURE}
|
|
|
|
SYMOPT_DEBUG = DWORD($80000000);
|
|
{$EXTERNALSYM SYMOPT_DEBUG}
|
|
|
|
function SymSetOptions(SymOptions: DWORD): DWORD; stdcall;
|
|
{$EXTERNALSYM SymSetOptions}
|
|
|
|
function SymGetOptions: DWORD; stdcall;
|
|
{$EXTERNALSYM SymGetOptions}
|
|
|
|
function SymCleanup(hProcess: HANDLE): BOOL; stdcall;
|
|
{$EXTERNALSYM SymCleanup}
|
|
|
|
function SymMatchString(string_, expression: LPSTR; fCase: BOOL): BOOL; stdcall;
|
|
{$EXTERNALSYM SymMatchString}
|
|
|
|
type
|
|
PSYM_ENUMSOURCFILES_CALLBACK = function(pSourceFile: PSOURCEFILE; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYM_ENUMSOURCFILES_CALLBACK}
|
|
PSymEnumSourceFilesCallback = PSYM_ENUMSOURCFILES_CALLBACK;
|
|
|
|
function SymEnumSourceFiles(hProcess: HANDLE; ModBase: ULONG64; Mask: LPSTR;
|
|
cbSrcFiles: PSYM_ENUMSOURCFILES_CALLBACK; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymEnumSourceFiles}
|
|
|
|
function SymEnumerateModules64(hProcess: HANDLE; EnumModulesCallback: PSYM_ENUMMODULES_CALLBACK64;
|
|
UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymEnumerateModules64}
|
|
|
|
function SymEnumerateModules(hProcess: HANDLE; EnumModulesCallback: PSYM_ENUMMODULES_CALLBACK;
|
|
UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymEnumerateModules}
|
|
|
|
function SymEnumerateSymbols64(hProcess: HANDLE; BaseOfDll: DWORD64;
|
|
EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK64; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymEnumerateSymbols64}
|
|
|
|
function SymEnumerateSymbolsW64(hProcess: HANDLE; BaseOfDll: DWORD64;
|
|
EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK64W; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymEnumerateSymbolsW64}
|
|
|
|
function SymEnumerateSymbols(hProcess: HANDLE; BaseOfDll: DWORD;
|
|
EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymEnumerateSymbols}
|
|
|
|
function SymEnumerateSymbolsW(hProcess: HANDLE; BaseOfDll: DWORD;
|
|
EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACKW; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymEnumerateSymbolsW}
|
|
|
|
function EnumerateLoadedModules64(hProcess: HANDLE; EnumLoadedModulesCallback: PENUMLOADED_MODULES_CALLBACK64;
|
|
UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM EnumerateLoadedModules64}
|
|
|
|
function EnumerateLoadedModules(hProcess: HANDLE; EnumLoadedModulesCallback: PENUMLOADED_MODULES_CALLBACK;
|
|
UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM EnumerateLoadedModules}
|
|
|
|
function SymFunctionTableAccess64(hProcess: HANDLE; AddrBase: DWORD64): PVOID; stdcall;
|
|
{$EXTERNALSYM SymFunctionTableAccess64}
|
|
|
|
function SymFunctionTableAccess(hProcess: HANDLE; AddrBase: DWORD): PVOID; stdcall;
|
|
{$EXTERNALSYM SymFunctionTableAccess}
|
|
|
|
function SymGetModuleInfo64(hProcess: HANDLE; qwAddr: DWORD64;
|
|
var ModuleInfo: IMAGEHLP_MODULE64): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetModuleInfo64}
|
|
|
|
function SymGetModuleInfoW64(hProcess: HANDLE; qwAddr: DWORD64;
|
|
var ModuleInfo: IMAGEHLP_MODULEW64): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetModuleInfoW64}
|
|
|
|
function SymGetModuleInfo(hProcess: HANDLE; dwAddr: DWORD;
|
|
var ModuleInfo: IMAGEHLP_MODULE): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetModuleInfo}
|
|
|
|
function SymGetModuleInfoW(hProcess: HANDLE; dwAddr: DWORD;
|
|
var ModuleInfo: IMAGEHLP_MODULEW): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetModuleInfoW}
|
|
|
|
function SymGetModuleBase64(hProcess: HANDLE; qwAddr: DWORD64): DWORD64; stdcall;
|
|
{$EXTERNALSYM SymGetModuleBase64}
|
|
|
|
function SymGetModuleBase(hProcess: HANDLE; dwAddr: DWORD): DWORD; stdcall;
|
|
{$EXTERNALSYM SymGetModuleBase}
|
|
|
|
function SymGetSymNext64(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL64): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetSymNext64}
|
|
|
|
function SymGetSymNext(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetSymNext}
|
|
|
|
function SymGetSymPrev64(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL64): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetSymPrev64}
|
|
|
|
function SymGetSymPrev(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetSymPrev}
|
|
|
|
function SymGetLineFromAddr64(hProcess: HANDLE; qwAddr: DWORD64;
|
|
var pdwDisplacement: DWORD; var Line64: IMAGEHLP_LINE64): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetLineFromAddr64}
|
|
|
|
function SymGetLineFromAddr(hProcess: HANDLE; dwAddr: DWORD;
|
|
var pdwDisplacement: DWORD; var Line: IMAGEHLP_LINE): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetLineFromAddr}
|
|
|
|
function SymGetLineFromName64(hProcess: HANDLE; ModuleName: PSTR; FileName: PSTR;
|
|
dwLineNumber: DWORD; var plDisplacement: LONG; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetLineFromName64}
|
|
|
|
function SymGetLineFromName(hProcess: HANDLE; ModuleName: PSTR; FileName: PSTR;
|
|
dwLineNumber: DWORD; var plDisplacement: LONG; var Line: IMAGEHLP_LINE): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetLineFromName}
|
|
|
|
function SymGetLineNext64(hProcess: HANDLE; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetLineNext64}
|
|
|
|
function SymGetLineNext(hProcess: HANDLE; var Line: IMAGEHLP_LINE): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetLineNext}
|
|
|
|
function SymGetLinePrev64(hProcess: HANDLE; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetLinePrev64}
|
|
|
|
function SymGetLinePrev(hProcess: HANDLE; var Line: IMAGEHLP_LINE): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetLinePrev}
|
|
|
|
function SymMatchFileName(FileName, Match: PSTR; var FileNameStop, MatchStop: PSTR): BOOL; stdcall;
|
|
{$EXTERNALSYM SymMatchFileName}
|
|
|
|
function SymInitialize(hProcess: HANDLE; UserSearchPath: PSTR; fInvadeProcess: BOOL): BOOL; stdcall;
|
|
{$EXTERNALSYM SymInitialize}
|
|
|
|
function SymGetSearchPath(hProcess: HANDLE; SearchPath: PSTR; SearchPathLength: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetSearchPath}
|
|
|
|
function SymSetSearchPath(hProcess: HANDLE; SearchPath: PSTR): BOOL; stdcall;
|
|
{$EXTERNALSYM SymSetSearchPath}
|
|
|
|
function SymLoadModule64(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR;
|
|
BaseOfDll: DWORD64; SizeOfDll: DWORD): DWORD64; stdcall;
|
|
{$EXTERNALSYM SymLoadModule64}
|
|
|
|
const
|
|
SLMFLAG_VIRTUAL = $1;
|
|
{$EXTERNALSYM SLMFLAG_VIRTUAL}
|
|
|
|
function SymLoadModuleEx(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR; BaseOfDll: DWORD64;
|
|
DllSize: DWORD; Data: PMODLOAD_DATA; Flag: DWORD): DWORD64; stdcall;
|
|
{$EXTERNALSYM SymLoadModuleEx}
|
|
|
|
function SymLoadModule(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR;
|
|
BaseOfDll: DWORD; SizeOfDll: DWORD): DWORD; stdcall;
|
|
{$EXTERNALSYM SymLoadModule}
|
|
|
|
function SymUnloadModule64(hProcess: HANDLE; BaseOfDll: DWORD64): BOOL; stdcall;
|
|
{$EXTERNALSYM SymUnloadModule64}
|
|
|
|
function SymUnloadModule(hProcess: HANDLE; BaseOfDll: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM SymUnloadModule}
|
|
|
|
function SymUnDName64(const sym: IMAGEHLP_SYMBOL64; UnDecName: PSTR;
|
|
UnDecNameLength: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM SymUnDName64}
|
|
|
|
function SymUnDName(const sym: IMAGEHLP_SYMBOL; UnDecName: PSTR;
|
|
UnDecNameLength: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM SymUnDName}
|
|
|
|
function SymRegisterCallback64(hProcess: HANDLE; CallbackFunction: PSYMBOL_REGISTERED_CALLBACK64;
|
|
UserContext: ULONG64): BOOL; stdcall;
|
|
{$EXTERNALSYM SymRegisterCallback64}
|
|
|
|
function SymRegisterFunctionEntryCallback64(hProcess: HANDLE; CallbackFunction: PSYMBOL_FUNCENTRY_CALLBACK64;
|
|
UserContext: ULONG64): BOOL; stdcall;
|
|
{$EXTERNALSYM SymRegisterFunctionEntryCallback64}
|
|
|
|
function SymRegisterCallback(hProcess: HANDLE; CallbackFunction: PSYMBOL_REGISTERED_CALLBACK;
|
|
UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymRegisterCallback}
|
|
|
|
function SymRegisterFunctionEntryCallback(hProcess: HANDLE; CallbackFunction: PSYMBOL_FUNCENTRY_CALLBACK;
|
|
UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymRegisterFunctionEntryCallback}
|
|
|
|
type
|
|
PIMAGEHLP_SYMBOL_SRC = ^IMAGEHLP_SYMBOL_SRC;
|
|
{$EXTERNALSYM PIMAGEHLP_SYMBOL_SRC}
|
|
_IMAGEHLP_SYMBOL_SRC = record
|
|
sizeofstruct: DWORD;
|
|
type_: DWORD;
|
|
file_: array [0..MAX_PATH - 1] of AnsiChar;
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_SYMBOL_SRC}
|
|
IMAGEHLP_SYMBOL_SRC = _IMAGEHLP_SYMBOL_SRC;
|
|
{$EXTERNALSYM IMAGEHLP_SYMBOL_SRC}
|
|
TImageHlpSymbolSrc = IMAGEHLP_SYMBOL_SRC;
|
|
PImageHlpSymbolSrc = PIMAGEHLP_SYMBOL_SRC;
|
|
|
|
PMODULE_TYPE_INFO = ^MODULE_TYPE_INFO;
|
|
{$EXTERNALSYM PMODULE_TYPE_INFO}
|
|
_MODULE_TYPE_INFO = record
|
|
dataLength: USHORT;
|
|
leaf: USHORT;
|
|
data: array [0..0] of BYTE;
|
|
end;
|
|
{$EXTERNALSYM _MODULE_TYPE_INFO}
|
|
MODULE_TYPE_INFO = _MODULE_TYPE_INFO;
|
|
{$EXTERNALSYM MODULE_TYPE_INFO}
|
|
TModuleTypeInfo = MODULE_TYPE_INFO;
|
|
PModuleTypeInfo = PMODULE_TYPE_INFO;
|
|
|
|
type
|
|
PSYMBOL_INFO = ^SYMBOL_INFO;
|
|
{$EXTERNALSYM PSYMBOL_INFO}
|
|
_SYMBOL_INFO = record
|
|
SizeOfStruct: ULONG;
|
|
TypeIndex: ULONG; // Type Index of symbol
|
|
Reserved: array [0..1] of ULONG64;
|
|
Info: ULONG;
|
|
Size: ULONG;
|
|
ModBase: ULONG64; // Base Address of module comtaining this symbol
|
|
Flags: ULONG;
|
|
Value: ULONG64; // Value of symbol, ValuePresent should be 1
|
|
Address: ULONG64; // Address of symbol including base address of module
|
|
Register_: ULONG; // register holding value or pointer to value
|
|
Scope: ULONG; // scope of the symbol
|
|
Tag: ULONG; // pdb classification
|
|
NameLen: ULONG; // Actual length of name
|
|
MaxNameLen: ULONG;
|
|
Name: array [0..0] of AnsiChar; // Name of symbol
|
|
end;
|
|
{$EXTERNALSYM _SYMBOL_INFO}
|
|
SYMBOL_INFO = _SYMBOL_INFO;
|
|
{$EXTERNALSYM SYMBOL_INFO}
|
|
TSymbolInfo = SYMBOL_INFO;
|
|
PSymbolInfo = PSYMBOL_INFO;
|
|
|
|
_SYMBOL_INFO_PACKAGE = record
|
|
si: SYMBOL_INFO;
|
|
name: array [0..MAX_SYM_NAME] of AnsiChar;
|
|
end;
|
|
{$EXTERNALSYM _SYMBOL_INFO_PACKAGE}
|
|
SYMBOL_INFO_PACKAGE = _SYMBOL_INFO_PACKAGE;
|
|
{$EXTERNALSYM SYMBOL_INFO_PACKAGE}
|
|
PSYMBOL_INFO_PACKAGE = ^SYMBOL_INFO_PACKAGE;
|
|
{$EXTERNALSYM PSYMBOL_INFO_PACKAGE}
|
|
TSymbolInfoPackage = SYMBOL_INFO_PACKAGE;
|
|
PSymbolInfoPackage = PSYMBOL_INFO_PACKAGE;
|
|
|
|
PIMAGEHLP_STACK_FRAME = ^IMAGEHLP_STACK_FRAME;
|
|
{$EXTERNALSYM PIMAGEHLP_STACK_FRAME}
|
|
_IMAGEHLP_STACK_FRAME = record
|
|
InstructionOffset: ULONG64;
|
|
ReturnOffset: ULONG64;
|
|
FrameOffset: ULONG64;
|
|
StackOffset: ULONG64;
|
|
BackingStoreOffset: ULONG64;
|
|
FuncTableEntry: ULONG64;
|
|
Params: array [0..3] of ULONG64;
|
|
Reserved: array [0..4] of ULONG64;
|
|
Virtual_: BOOL;
|
|
Reserved2: ULONG;
|
|
end;
|
|
{$EXTERNALSYM _IMAGEHLP_STACK_FRAME}
|
|
IMAGEHLP_STACK_FRAME = _IMAGEHLP_STACK_FRAME;
|
|
{$EXTERNALSYM IMAGEHLP_STACK_FRAME}
|
|
TImageHlpStackFrame = IMAGEHLP_STACK_FRAME;
|
|
PImageHlpStackFrame = PIMAGEHLP_STACK_FRAME;
|
|
|
|
IMAGEHLP_CONTEXT = LPVOID;
|
|
{$EXTERNALSYM IMAGEHLP_CONTEXT}
|
|
PIMAGEHLP_CONTEXT = ^IMAGEHLP_CONTEXT;
|
|
{$EXTERNALSYM PIMAGEHLP_CONTEXT}
|
|
TImageHlpContext = IMAGEHLP_CONTEXT;
|
|
PImageHlpContext = PIMAGEHLP_CONTEXT;
|
|
|
|
function SymSetContext(hProcess: HANDLE; StackFrame: PIMAGEHLP_STACK_FRAME; Context: PIMAGEHLP_CONTEXT): BOOL; stdcall;
|
|
{$EXTERNALSYM SymSetContext}
|
|
|
|
function SymFromAddr(hProcess: HANDLE; Address: DWORD64; Displacement: PDWORD64; Symbol: PSYMBOL_INFO): BOOL; stdcall;
|
|
{$EXTERNALSYM SymFromAddr}
|
|
|
|
// While SymFromName will provide a symbol from a name,
|
|
// SymEnumSymbols can provide the same matching information
|
|
// for ALL symbols with a matching name, even regular
|
|
// expressions. That way you can search across modules
|
|
// and differentiate between identically named symbols.
|
|
|
|
function SymFromName(hProcess: HANDLE; Name: LPSTR; Symbol: PSYMBOL_INFO): BOOL; stdcall;
|
|
{$EXTERNALSYM SymFromName}
|
|
|
|
type
|
|
PSYM_ENUMERATESYMBOLS_CALLBACK = function(pSymInfo: PSYMBOL_INFO; SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PSYM_ENUMERATESYMBOLS_CALLBACK}
|
|
PSymEnumerateSymbolsCallback = PSYM_ENUMERATESYMBOLS_CALLBACK;
|
|
|
|
function SymEnumSymbols(hProcess: HANDLE; BaseOfDll: ULONG64; Mask: PCSTR; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymEnumSymbols}
|
|
|
|
function SymEnumSymbolsForAddr(hProcess: HANDLE; Address: DWORD64;
|
|
EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymEnumSymbolsForAddr}
|
|
|
|
type
|
|
_IMAGEHLP_SYMBOL_TYPE_INFO = (
|
|
TI_GET_SYMTAG,
|
|
TI_GET_SYMNAME,
|
|
TI_GET_LENGTH,
|
|
TI_GET_TYPE,
|
|
TI_GET_TYPEID,
|
|
TI_GET_BASETYPE,
|
|
TI_GET_ARRAYINDEXTYPEID,
|
|
TI_FINDCHILDREN,
|
|
TI_GET_DATAKIND,
|
|
TI_GET_ADDRESSOFFSET,
|
|
TI_GET_OFFSET,
|
|
TI_GET_VALUE,
|
|
TI_GET_COUNT,
|
|
TI_GET_CHILDRENCOUNT,
|
|
TI_GET_BITPOSITION,
|
|
TI_GET_VIRTUALBASECLASS,
|
|
TI_GET_VIRTUALTABLESHAPEID,
|
|
TI_GET_VIRTUALBASEPOINTEROFFSET,
|
|
TI_GET_CLASSPARENTID,
|
|
TI_GET_NESTED,
|
|
TI_GET_SYMINDEX,
|
|
TI_GET_LEXICALPARENT,
|
|
TI_GET_ADDRESS,
|
|
TI_GET_THISADJUST,
|
|
TI_GET_UDTKIND,
|
|
TI_IS_EQUIV_TO,
|
|
TI_GET_CALLING_CONVENTION);
|
|
{$EXTERNALSYM _IMAGEHLP_SYMBOL_TYPE_INFO}
|
|
IMAGEHLP_SYMBOL_TYPE_INFO = _IMAGEHLP_SYMBOL_TYPE_INFO;
|
|
{$EXTERNALSYM IMAGEHLP_SYMBOL_TYPE_INFO}
|
|
TImageHlpSymbolTypeInfo = IMAGEHLP_SYMBOL_TYPE_INFO;
|
|
|
|
PTI_FINDCHILDREN_PARAMS = ^TI_FINDCHILDREN_PARAMS;
|
|
{$EXTERNALSYM PTI_FINDCHILDREN_PARAMS}
|
|
_TI_FINDCHILDREN_PARAMS = record
|
|
Count: ULONG;
|
|
Start: ULONG;
|
|
ChildId: array [0..0] of ULONG;
|
|
end;
|
|
{$EXTERNALSYM _TI_FINDCHILDREN_PARAMS}
|
|
TI_FINDCHILDREN_PARAMS = _TI_FINDCHILDREN_PARAMS;
|
|
{$EXTERNALSYM TI_FINDCHILDREN_PARAMS}
|
|
TTiFindChildrenParams = TI_FINDCHILDREN_PARAMS;
|
|
PTiFindChildrenParams = PTI_FINDCHILDREN_PARAMS;
|
|
|
|
function SymGetTypeInfo(hProcess: HANDLE; ModBase: DWORD64; TypeId: ULONG; GetType: IMAGEHLP_SYMBOL_TYPE_INFO; pInfo: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetTypeInfo}
|
|
|
|
function SymEnumTypes(hProcess: HANDLE; BaseOfDll: ULONG64; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymEnumTypes}
|
|
|
|
function SymGetTypeFromName(hProcess: HANDLE; BaseOfDll: ULONG64; Name: LPSTR; Symbol: PSYMBOL_INFO): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetTypeFromName}
|
|
|
|
function SymAddSymbol(hProcess: HANDLE; BaseOfDll: ULONG64; Name: PCSTR; Address: DWORD64; Size, Flags: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM SymAddSymbol}
|
|
|
|
function SymDeleteSymbol(hProcess: HANDLE; BaseOfDll: ULONG64; Name: PCSTR; Address: DWORD64; Flags: DWORD): BOOL; stdcall;
|
|
{$EXTERNALSYM SymDeleteSymbol}
|
|
|
|
//
|
|
// Full user-mode dump creation.
|
|
//
|
|
|
|
type
|
|
PDBGHELP_CREATE_USER_DUMP_CALLBACK = function(DataType: DWORD; var Data: PVOID; DataLength: LPDWORD; UserData: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM PDBGHELP_CREATE_USER_DUMP_CALLBACK}
|
|
PDbgHelpCreateUserDumpCallback = PDBGHELP_CREATE_USER_DUMP_CALLBACK;
|
|
|
|
function DbgHelpCreateUserDump(FileName: LPSTR; Callback: PDBGHELP_CREATE_USER_DUMP_CALLBACK; UserData: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM DbgHelpCreateUserDump}
|
|
|
|
function DbgHelpCreateUserDumpW(FileName: LPWSTR; Callback: PDBGHELP_CREATE_USER_DUMP_CALLBACK; UserData: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM DbgHelpCreateUserDumpW}
|
|
|
|
// -----------------------------------------------------------------
|
|
// The following 4 legacy APIs are fully supported, but newer
|
|
// ones are recommended. SymFromName and SymFromAddr provide
|
|
// much more detailed info on the returned symbol.
|
|
|
|
function SymGetSymFromAddr64(hProcess: HANDLE; qwAddr: DWORD64; pdwDisplacement: PDWORD64; Symbol: PIMAGEHLP_SYMBOL64): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetSymFromAddr64}
|
|
|
|
function SymGetSymFromAddr(hProcess: HANDLE; dwAddr: DWORD; pdwDisplacement: PDWORD; Symbol: PIMAGEHLP_SYMBOL): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetSymFromAddr}
|
|
|
|
// While following two APIs will provide a symbol from a name,
|
|
// SymEnumSymbols can provide the same matching information
|
|
// for ALL symbols with a matching name, even regular
|
|
// expressions. That way you can search across modules
|
|
// and differentiate between identically named symbols.
|
|
|
|
function SymGetSymFromName64(hProcess: HANDLE; Name: PSTR; Symbol: PIMAGEHLP_SYMBOL64): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetSymFromName64}
|
|
|
|
function SymGetSymFromName(hProcess: HANDLE; Name: PSTR; Symbol: PIMAGEHLP_SYMBOL): BOOL; stdcall;
|
|
{$EXTERNALSYM SymGetSymFromName}
|
|
|
|
// -----------------------------------------------------------------
|
|
// The following APIs exist only for backwards compatibility
|
|
// with a pre-release version documented in an MSDN release.
|
|
|
|
// You should use SymFindFileInPath if you want to maintain
|
|
// future compatibility.
|
|
|
|
function FindFileInPath(hprocess: HANDLE; SearchPath: LPSTR; FileName: LPSTR; id: PVOID; two: DWORD; three: DWORD; flags: DWORD; FilePath: LPSTR): BOOL; stdcall;
|
|
{$EXTERNALSYM FindFileInPath}
|
|
|
|
// You should use SymFindFileInPath if you want to maintain
|
|
// future compatibility.
|
|
|
|
function FindFileInSearchPath(hprocess: HANDLE; SearchPath: LPSTR; FileName: LPSTR; one: DWORD; two: DWORD; three: DWORD; FilePath: LPSTR): BOOL; stdcall;
|
|
{$EXTERNALSYM FindFileInSearchPath}
|
|
|
|
function SymEnumSym(hProcess: HANDLE; BaseOfDll: ULONG64; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
|
|
{$EXTERNALSYM SymEnumSym}
|
|
|
|
// These values should not be used.
|
|
// They have been replaced by SYMFLAG_ values.
|
|
|
|
const
|
|
SYMF_OMAP_GENERATED = $00000001;
|
|
SYMF_OMAP_MODIFIED = $00000002;
|
|
SYMF_REGISTER = $00000008;
|
|
SYMF_REGREL = $00000010;
|
|
SYMF_FRAMEREL = $00000020;
|
|
SYMF_PARAMETER = $00000040;
|
|
SYMF_LOCAL = $00000080;
|
|
SYMF_CONSTANT = $00000100;
|
|
SYMF_EXPORT = $00000200;
|
|
SYMF_FORWARDER = $00000400;
|
|
SYMF_FUNCTION = $00000800;
|
|
SYMF_VIRTUAL = $00001000;
|
|
SYMF_THUNK = $00002000;
|
|
SYMF_TLSREL = $00004000;
|
|
|
|
// These values should also not be used.
|
|
// They have been replaced by SYMFLAG_ values.
|
|
|
|
IMAGEHLP_SYMBOL_INFO_VALUEPRESENT = 1;
|
|
IMAGEHLP_SYMBOL_INFO_REGISTER = SYMF_REGISTER; // 0x0008
|
|
IMAGEHLP_SYMBOL_INFO_REGRELATIVE = SYMF_REGREL; // 0x0010
|
|
IMAGEHLP_SYMBOL_INFO_FRAMERELATIVE = SYMF_FRAMEREL; // 0x0020
|
|
IMAGEHLP_SYMBOL_INFO_PARAMETER = SYMF_PARAMETER; // 0x0040
|
|
IMAGEHLP_SYMBOL_INFO_LOCAL = SYMF_LOCAL; // 0x0080
|
|
IMAGEHLP_SYMBOL_INFO_CONSTANT = SYMF_CONSTANT; // 0x0100
|
|
IMAGEHLP_SYMBOL_FUNCTION = SYMF_FUNCTION; // 0x0800
|
|
IMAGEHLP_SYMBOL_VIRTUAL = SYMF_VIRTUAL; // 0x1000
|
|
IMAGEHLP_SYMBOL_THUNK = SYMF_THUNK; // 0x2000
|
|
IMAGEHLP_SYMBOL_INFO_TLSRELATIVE = SYMF_TLSREL; // 0x4000
|
|
|
|
const
|
|
MINIDUMP_SIGNATURE = 'PMDM';
|
|
{$EXTERNALSYM MINIDUMP_SIGNATURE}
|
|
MINIDUMP_VERSION = 42899;
|
|
{$EXTERNALSYM MINIDUMP_VERSION}
|
|
|
|
type
|
|
RVA = DWORD;
|
|
{$EXTERNALSYM RVA}
|
|
RVA64 = ULONG64;
|
|
{$EXTERNALSYM RVA64}
|
|
|
|
_MINIDUMP_LOCATION_DESCRIPTOR = record
|
|
DataSize: ULONG32;
|
|
Rva: RVA;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_LOCATION_DESCRIPTOR}
|
|
MINIDUMP_LOCATION_DESCRIPTOR = _MINIDUMP_LOCATION_DESCRIPTOR;
|
|
{$EXTERNALSYM MINIDUMP_LOCATION_DESCRIPTOR}
|
|
TMinidumpLocationDescriptor = MINIDUMP_LOCATION_DESCRIPTOR;
|
|
PMinidumpLocationDescriptor = ^MINIDUMP_LOCATION_DESCRIPTOR;
|
|
|
|
_MINIDUMP_LOCATION_DESCRIPTOR64 = record
|
|
DataSize: ULONG64;
|
|
Rva: RVA64;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_LOCATION_DESCRIPTOR64}
|
|
MINIDUMP_LOCATION_DESCRIPTOR64 = _MINIDUMP_LOCATION_DESCRIPTOR64;
|
|
{$EXTERNALSYM MINIDUMP_LOCATION_DESCRIPTOR64}
|
|
TMinidumpLocationDescriptor64 = MINIDUMP_LOCATION_DESCRIPTOR64;
|
|
PMinidumpLocationDescriptor64 = ^MINIDUMP_LOCATION_DESCRIPTOR64;
|
|
|
|
PMINIDUMP_MEMORY_DESCRIPTOR = ^MINIDUMP_MEMORY_DESCRIPTOR;
|
|
{$EXTERNALSYM PMINIDUMP_MEMORY_DESCRIPTOR}
|
|
_MINIDUMP_MEMORY_DESCRIPTOR = record
|
|
StartOfMemoryRange: ULONG64;
|
|
Memory: MINIDUMP_LOCATION_DESCRIPTOR;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_MEMORY_DESCRIPTOR}
|
|
MINIDUMP_MEMORY_DESCRIPTOR = _MINIDUMP_MEMORY_DESCRIPTOR;
|
|
{$EXTERNALSYM MINIDUMP_MEMORY_DESCRIPTOR}
|
|
TMinidumpMemoryDescriptor = MINIDUMP_MEMORY_DESCRIPTOR;
|
|
PMinidumpMemoryDescriptor = PMINIDUMP_MEMORY_DESCRIPTOR;
|
|
|
|
// DESCRIPTOR64 is used for full-memory minidumps where
|
|
// all of the raw memory is laid out sequentially at the
|
|
// end of the dump. There is no need for individual RVAs
|
|
// as the RVA is the base RVA plus the sum of the preceeding
|
|
// data blocks.
|
|
|
|
PMINIDUMP_MEMORY_DESCRIPTOR64 = ^MINIDUMP_MEMORY_DESCRIPTOR64;
|
|
{$EXTERNALSYM PMINIDUMP_MEMORY_DESCRIPTOR64}
|
|
_MINIDUMP_MEMORY_DESCRIPTOR64 = record
|
|
StartOfMemoryRange: ULONG64;
|
|
DataSize: ULONG64;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_MEMORY_DESCRIPTOR64}
|
|
MINIDUMP_MEMORY_DESCRIPTOR64 = _MINIDUMP_MEMORY_DESCRIPTOR64;
|
|
{$EXTERNALSYM MINIDUMP_MEMORY_DESCRIPTOR64}
|
|
TMinidumpMemoryDescriptor64 = MINIDUMP_MEMORY_DESCRIPTOR64;
|
|
PMinidumpMemoryDescriptor64 = PMINIDUMP_MEMORY_DESCRIPTOR64;
|
|
|
|
PMINIDUMP_HEADER = ^MINIDUMP_HEADER;
|
|
{$EXTERNALSYM PMINIDUMP_HEADER}
|
|
_MINIDUMP_HEADER = record
|
|
Signature: ULONG32;
|
|
Version: ULONG32;
|
|
NumberOfStreams: ULONG32;
|
|
StreamDirectoryRva: RVA;
|
|
CheckSum: ULONG32;
|
|
U: record
|
|
case Integer of
|
|
0: (Reserved: ULONG32);
|
|
1: (TimeDateStamp: ULONG32);
|
|
end;
|
|
Flags: ULONG64;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_HEADER}
|
|
MINIDUMP_HEADER = _MINIDUMP_HEADER;
|
|
{$EXTERNALSYM MINIDUMP_HEADER}
|
|
TMinidumpHeader = MINIDUMP_HEADER;
|
|
PMinidumpHeader = PMINIDUMP_HEADER;
|
|
|
|
//
|
|
// The MINIDUMP_HEADER field StreamDirectoryRva points to
|
|
// an array of MINIDUMP_DIRECTORY structures.
|
|
//
|
|
|
|
PMINIDUMP_DIRECTORY = ^MINIDUMP_DIRECTORY;
|
|
{$EXTERNALSYM PMINIDUMP_DIRECTORY}
|
|
_MINIDUMP_DIRECTORY = record
|
|
StreamType: ULONG32;
|
|
Location: MINIDUMP_LOCATION_DESCRIPTOR;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_DIRECTORY}
|
|
MINIDUMP_DIRECTORY = _MINIDUMP_DIRECTORY;
|
|
{$EXTERNALSYM MINIDUMP_DIRECTORY}
|
|
TMinidumpDirectory = MINIDUMP_DIRECTORY;
|
|
PMinidumpDirectory = PMINIDUMP_DIRECTORY;
|
|
|
|
PMINIDUMP_STRING = ^MINIDUMP_STRING;
|
|
{$EXTERNALSYM PMINIDUMP_STRING}
|
|
_MINIDUMP_STRING = record
|
|
Length: ULONG32; // Length in bytes of the string
|
|
Buffer: PWCHAR; // Variable size buffer
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_STRING}
|
|
MINIDUMP_STRING = _MINIDUMP_STRING;
|
|
{$EXTERNALSYM MINIDUMP_STRING}
|
|
TMinidumpString = MINIDUMP_STRING;
|
|
PMinidumpString = PMINIDUMP_STRING;
|
|
|
|
//
|
|
// The MINIDUMP_DIRECTORY field StreamType may be one of the following types.
|
|
// Types will be added in the future, so if a program reading the minidump
|
|
// header encounters a stream type it does not understand it should ignore
|
|
// the data altogether. Any tag above LastReservedStream will not be used by
|
|
// the system and is reserved for program-specific information.
|
|
//
|
|
|
|
const
|
|
UnusedStream = 0;
|
|
{$EXTERNALSYM UnusedStream}
|
|
ReservedStream0 = 1;
|
|
{$EXTERNALSYM ReservedStream0}
|
|
ReservedStream1 = 2;
|
|
{$EXTERNALSYM ReservedStream1}
|
|
ThreadListStream = 3;
|
|
{$EXTERNALSYM ThreadListStream}
|
|
ModuleListStream = 4;
|
|
{$EXTERNALSYM ModuleListStream}
|
|
MemoryListStream = 5;
|
|
{$EXTERNALSYM MemoryListStream}
|
|
ExceptionStream = 6;
|
|
{$EXTERNALSYM ExceptionStream}
|
|
SystemInfoStream = 7;
|
|
{$EXTERNALSYM SystemInfoStream}
|
|
ThreadExListStream = 8;
|
|
{$EXTERNALSYM ThreadExListStream}
|
|
Memory64ListStream = 9;
|
|
{$EXTERNALSYM Memory64ListStream}
|
|
CommentStreamA = 10;
|
|
{$EXTERNALSYM CommentStreamA}
|
|
CommentStreamW = 11;
|
|
{$EXTERNALSYM CommentStreamW}
|
|
HandleDataStream = 12;
|
|
{$EXTERNALSYM HandleDataStream}
|
|
FunctionTableStream = 13;
|
|
{$EXTERNALSYM FunctionTableStream}
|
|
UnloadedModuleListStream = 14;
|
|
{$EXTERNALSYM UnloadedModuleListStream}
|
|
MiscInfoStream = 15;
|
|
{$EXTERNALSYM MiscInfoStream}
|
|
|
|
LastReservedStream = $ffff;
|
|
{$EXTERNALSYM LastReservedStream}
|
|
|
|
type
|
|
_MINIDUMP_STREAM_TYPE = DWORD;
|
|
{$EXTERNALSYM MINIDUMP_STREAM_TYPE}
|
|
MINIDUMP_STREAM_TYPE = _MINIDUMP_STREAM_TYPE;
|
|
{$EXTERNALSYM _MINIDUMP_STREAM_TYPE}
|
|
TMinidumpStreamType = MINIDUMP_STREAM_TYPE;
|
|
|
|
//
|
|
// The minidump system information contains processor and
|
|
// Operating System specific information.
|
|
//
|
|
|
|
type
|
|
_CPU_INFORMATION = record
|
|
case Integer of
|
|
|
|
//
|
|
// X86 platforms use CPUID function to obtain processor information.
|
|
//
|
|
|
|
0: (
|
|
|
|
//
|
|
// CPUID Subfunction 0, register EAX (VendorId [0]),
|
|
// EBX (VendorId [1]) and ECX (VendorId [2]).
|
|
//
|
|
|
|
VendorId: array [0..2] of ULONG32;
|
|
|
|
//
|
|
// CPUID Subfunction 1, register EAX
|
|
//
|
|
|
|
VersionInformation: ULONG32;
|
|
|
|
//
|
|
// CPUID Subfunction 1, register EDX
|
|
//
|
|
|
|
FeatureInformation: ULONG32;
|
|
|
|
//
|
|
// CPUID, Subfunction 80000001, register EBX. This will only
|
|
// be obtained if the vendor id is "AuthenticAMD".
|
|
//
|
|
|
|
AMDExtendedCpuFeatures: ULONG32);
|
|
|
|
//
|
|
// Non-x86 platforms use processor feature flags.
|
|
//
|
|
|
|
1: (
|
|
ProcessorFeatures: array [0..1] of ULONG64);
|
|
end;
|
|
|
|
_MINIDUMP_SYSTEM_INFO = record
|
|
|
|
//
|
|
// ProcessorArchitecture, ProcessorLevel and ProcessorRevision are all
|
|
// taken from the SYSTEM_INFO structure obtained by GetSystemInfo( ).
|
|
//
|
|
|
|
ProcessorArchitecture: USHORT;
|
|
ProcessorLevel: USHORT;
|
|
ProcessorRevision: USHORT;
|
|
|
|
U: record
|
|
case Integer of
|
|
0: (Reserved0: USHORT);
|
|
1: (
|
|
NumberOfProcessors: UCHAR;
|
|
ProductType: UCHAR);
|
|
end;
|
|
|
|
//
|
|
// MajorVersion, MinorVersion, BuildNumber, PlatformId and
|
|
// CSDVersion are all taken from the OSVERSIONINFO structure
|
|
// returned by GetVersionEx( ).
|
|
//
|
|
|
|
MajorVersion: ULONG32;
|
|
MinorVersion: ULONG32;
|
|
BuildNumber: ULONG32;
|
|
PlatformId: ULONG32;
|
|
|
|
//
|
|
// RVA to a CSDVersion string in the string table.
|
|
//
|
|
|
|
CSDVersionRva: RVA;
|
|
|
|
U2: record
|
|
case Integer of
|
|
0: (Reserved1: ULONG32);
|
|
1: (
|
|
SuiteMask: USHORT;
|
|
Reserved2: USHORT);
|
|
end;
|
|
|
|
//
|
|
// CPU information is obtained from one of two places.
|
|
//
|
|
// 1) On x86 computers, CPU_INFORMATION is obtained from the CPUID
|
|
// instruction. You must use the X86 portion of the union for X86
|
|
// computers.
|
|
//
|
|
// 2) On non-x86 architectures, CPU_INFORMATION is obtained by calling
|
|
// IsProcessorFeatureSupported().
|
|
//
|
|
|
|
Cpu: _CPU_INFORMATION;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_SYSTEM_INFO}
|
|
MINIDUMP_SYSTEM_INFO = _MINIDUMP_SYSTEM_INFO;
|
|
{$EXTERNALSYM MINIDUMP_SYSTEM_INFO}
|
|
PMINIDUMP_SYSTEM_INFO = ^MINIDUMP_SYSTEM_INFO;
|
|
{$EXTERNALSYM PMINIDUMP_SYSTEM_INFO}
|
|
TMinidumpSystemInfo = MINIDUMP_SYSTEM_INFO;
|
|
PMinidumpSystemInfo = PMINIDUMP_SYSTEM_INFO;
|
|
|
|
CPU_INFORMATION = _CPU_INFORMATION;
|
|
{$EXTERNALSYM CPU_INFORMATION}
|
|
PCPU_INFORMATION = CPU_INFORMATION;
|
|
{$EXTERNALSYM PCPU_INFORMATION}
|
|
|
|
//
|
|
// The minidump thread contains standard thread
|
|
// information plus an RVA to the memory for this
|
|
// thread and an RVA to the CONTEXT structure for
|
|
// this thread.
|
|
//
|
|
|
|
//
|
|
// ThreadId must be 4 bytes on all architectures.
|
|
//
|
|
|
|
// C_ASSERT (sizeof ( ((PPROCESS_INFORMATION)0)->dwThreadId ) == 4);
|
|
|
|
type
|
|
PMINIDUMP_THREAD = ^MINIDUMP_THREAD;
|
|
{$EXTERNALSYM PMINIDUMP_THREAD}
|
|
_MINIDUMP_THREAD = record
|
|
ThreadId: ULONG32;
|
|
SuspendCount: ULONG32;
|
|
PriorityClass: ULONG32;
|
|
Priority: ULONG32;
|
|
Teb: ULONG64;
|
|
Stack: MINIDUMP_MEMORY_DESCRIPTOR;
|
|
ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_THREAD}
|
|
MINIDUMP_THREAD = _MINIDUMP_THREAD;
|
|
{$EXTERNALSYM MINIDUMP_THREAD}
|
|
TMinidumpThread = MINIDUMP_THREAD;
|
|
PMinidumpThread = PMINIDUMP_THREAD;
|
|
|
|
//
|
|
// The thread list is a container of threads.
|
|
//
|
|
|
|
PMINIDUMP_THREAD_LIST = ^MINIDUMP_THREAD_LIST;
|
|
{$EXTERNALSYM PMINIDUMP_THREAD_LIST}
|
|
_MINIDUMP_THREAD_LIST = record
|
|
NumberOfThreads: ULONG32;
|
|
Threads: array [0..0] of MINIDUMP_THREAD;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_THREAD_LIST}
|
|
MINIDUMP_THREAD_LIST = _MINIDUMP_THREAD_LIST;
|
|
{$EXTERNALSYM MINIDUMP_THREAD_LIST}
|
|
TMinidumpThreadList = MINIDUMP_THREAD_LIST;
|
|
PMinidumpThreadList = PMINIDUMP_THREAD_LIST;
|
|
|
|
PMINIDUMP_THREAD_EX = ^MINIDUMP_THREAD_EX;
|
|
{$EXTERNALSYM PMINIDUMP_THREAD_EX}
|
|
_MINIDUMP_THREAD_EX = record
|
|
ThreadId: ULONG32;
|
|
SuspendCount: ULONG32;
|
|
PriorityClass: ULONG32;
|
|
Priority: ULONG32;
|
|
Teb: ULONG64;
|
|
Stack: MINIDUMP_MEMORY_DESCRIPTOR;
|
|
ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
|
|
BackingStore: MINIDUMP_MEMORY_DESCRIPTOR;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_THREAD_EX}
|
|
MINIDUMP_THREAD_EX = _MINIDUMP_THREAD_EX;
|
|
{$EXTERNALSYM MINIDUMP_THREAD_EX}
|
|
TMinidumpThreadEx = MINIDUMP_THREAD_EX;
|
|
PMinidumpThreadEx = PMINIDUMP_THREAD_EX;
|
|
|
|
//
|
|
// The thread list is a container of threads.
|
|
//
|
|
|
|
PMINIDUMP_THREAD_EX_LIST = ^MINIDUMP_THREAD_EX_LIST;
|
|
{$EXTERNALSYM PMINIDUMP_THREAD_EX_LIST}
|
|
_MINIDUMP_THREAD_EX_LIST = record
|
|
NumberOfThreads: ULONG32;
|
|
Threads: array [0..0] of MINIDUMP_THREAD_EX;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_THREAD_EX_LIST}
|
|
MINIDUMP_THREAD_EX_LIST = _MINIDUMP_THREAD_EX_LIST;
|
|
{$EXTERNALSYM MINIDUMP_THREAD_EX_LIST}
|
|
TMinidumpThreadExList = MINIDUMP_THREAD_EX_LIST;
|
|
PMinidumpThreadExList = PMINIDUMP_THREAD_EX_LIST;
|
|
|
|
//
|
|
// The MINIDUMP_EXCEPTION is the same as EXCEPTION on Win64.
|
|
//
|
|
|
|
PMINIDUMP_EXCEPTION = ^MINIDUMP_EXCEPTION;
|
|
{$EXTERNALSYM PMINIDUMP_EXCEPTION}
|
|
_MINIDUMP_EXCEPTION = record
|
|
ExceptionCode: ULONG32;
|
|
ExceptionFlags: ULONG32;
|
|
ExceptionRecord: ULONG64;
|
|
ExceptionAddress: ULONG64;
|
|
NumberParameters: ULONG32;
|
|
__unusedAlignment: ULONG32;
|
|
ExceptionInformation: array [0..EXCEPTION_MAXIMUM_PARAMETERS - 1] of ULONG64;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_EXCEPTION}
|
|
MINIDUMP_EXCEPTION = _MINIDUMP_EXCEPTION;
|
|
{$EXTERNALSYM MINIDUMP_EXCEPTION}
|
|
TMinidumpException = MINIDUMP_EXCEPTION;
|
|
PMinidumpException = PMINIDUMP_EXCEPTION;
|
|
|
|
//
|
|
// The exception information stream contains the id of the thread that caused
|
|
// the exception (ThreadId), the exception record for the exception
|
|
// (ExceptionRecord) and an RVA to the thread context where the exception
|
|
// occured.
|
|
//
|
|
|
|
PMINIDUMP_EXCEPTION_STREAM = ^MINIDUMP_EXCEPTION_STREAM;
|
|
{$EXTERNALSYM PMINIDUMP_EXCEPTION_STREAM}
|
|
_MINIDUMP_EXCEPTION_STREAM = record
|
|
ThreadId: ULONG32;
|
|
__alignment: ULONG32;
|
|
ExceptionRecord: MINIDUMP_EXCEPTION;
|
|
ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_EXCEPTION_STREAM}
|
|
MINIDUMP_EXCEPTION_STREAM = _MINIDUMP_EXCEPTION_STREAM;
|
|
{$EXTERNALSYM MINIDUMP_EXCEPTION_STREAM}
|
|
TMinidumpExceptionStream = MINIDUMP_EXCEPTION_STREAM;
|
|
PMinidumpExceptionStream = PMINIDUMP_EXCEPTION_STREAM;
|
|
|
|
//
|
|
// The MINIDUMP_MODULE contains information about a
|
|
// a specific module. It includes the CheckSum and
|
|
// the TimeDateStamp for the module so the module
|
|
// can be reloaded during the analysis phase.
|
|
//
|
|
|
|
PMINIDUMP_MODULE = ^MINIDUMP_MODULE;
|
|
{$EXTERNALSYM PMINIDUMP_MODULE}
|
|
_MINIDUMP_MODULE = record
|
|
BaseOfImage: ULONG64;
|
|
SizeOfImage: ULONG32;
|
|
CheckSum: ULONG32;
|
|
TimeDateStamp: ULONG32;
|
|
ModuleNameRva: RVA;
|
|
VersionInfo: VS_FIXEDFILEINFO;
|
|
CvRecord: MINIDUMP_LOCATION_DESCRIPTOR;
|
|
MiscRecord: MINIDUMP_LOCATION_DESCRIPTOR;
|
|
Reserved0: ULONG64; // Reserved for future use.
|
|
Reserved1: ULONG64; // Reserved for future use.
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_MODULE}
|
|
MINIDUMP_MODULE = _MINIDUMP_MODULE;
|
|
{$EXTERNALSYM MINIDUMP_MODULE}
|
|
TMinidumpModule = MINIDUMP_MODULE;
|
|
PMinidumpModule = PMINIDUMP_MODULE;
|
|
|
|
//
|
|
// The minidump module list is a container for modules.
|
|
//
|
|
|
|
PMINIDUMP_MODULE_LIST = ^MINIDUMP_MODULE_LIST;
|
|
{$EXTERNALSYM PMINIDUMP_MODULE_LIST}
|
|
_MINIDUMP_MODULE_LIST = record
|
|
NumberOfModules: ULONG32;
|
|
Modules: array [0..0] of MINIDUMP_MODULE;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_MODULE_LIST}
|
|
MINIDUMP_MODULE_LIST = _MINIDUMP_MODULE_LIST;
|
|
{$EXTERNALSYM MINIDUMP_MODULE_LIST}
|
|
TMinidumpModuleList = MINIDUMP_MODULE_LIST;
|
|
PMinidumpModuleList = PMINIDUMP_MODULE_LIST;
|
|
|
|
//
|
|
// Memory Ranges
|
|
//
|
|
|
|
PMINIDUMP_MEMORY_LIST = ^MINIDUMP_MEMORY_LIST;
|
|
{$EXTERNALSYM PMINIDUMP_MEMORY_LIST}
|
|
_MINIDUMP_MEMORY_LIST = record
|
|
NumberOfMemoryRanges: ULONG32;
|
|
MemoryRanges: array [0..0] of MINIDUMP_MEMORY_DESCRIPTOR;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_MEMORY_LIST}
|
|
MINIDUMP_MEMORY_LIST = _MINIDUMP_MEMORY_LIST;
|
|
{$EXTERNALSYM MINIDUMP_MEMORY_LIST}
|
|
TMinidumpMemoryList = MINIDUMP_MEMORY_LIST;
|
|
PMinidumpMemoryList = PMINIDUMP_MEMORY_LIST;
|
|
|
|
PMINIDUMP_MEMORY64_LIST = ^MINIDUMP_MEMORY64_LIST;
|
|
{$EXTERNALSYM PMINIDUMP_MEMORY64_LIST}
|
|
_MINIDUMP_MEMORY64_LIST = record
|
|
NumberOfMemoryRanges: ULONG64;
|
|
BaseRva: RVA64;
|
|
MemoryRanges: array [0..0] of MINIDUMP_MEMORY_DESCRIPTOR64;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_MEMORY64_LIST}
|
|
MINIDUMP_MEMORY64_LIST = _MINIDUMP_MEMORY64_LIST;
|
|
{$EXTERNALSYM MINIDUMP_MEMORY64_LIST}
|
|
TMinidumpMemory64List = MINIDUMP_MEMORY64_LIST;
|
|
PMinidumpMemory64List = PMINIDUMP_MEMORY64_LIST;
|
|
|
|
//
|
|
// Support for user supplied exception information.
|
|
//
|
|
|
|
PMINIDUMP_EXCEPTION_INFORMATION = ^MINIDUMP_EXCEPTION_INFORMATION;
|
|
{$EXTERNALSYM PMINIDUMP_EXCEPTION_INFORMATION}
|
|
_MINIDUMP_EXCEPTION_INFORMATION = record
|
|
ThreadId: DWORD;
|
|
ExceptionPointers: PEXCEPTION_POINTERS;
|
|
ClientPointers: BOOL;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_EXCEPTION_INFORMATION}
|
|
MINIDUMP_EXCEPTION_INFORMATION = _MINIDUMP_EXCEPTION_INFORMATION;
|
|
{$EXTERNALSYM MINIDUMP_EXCEPTION_INFORMATION}
|
|
TMinidumpExceptionInformation = MINIDUMP_EXCEPTION_INFORMATION;
|
|
PMinidumpExceptionInformation = PMINIDUMP_EXCEPTION_INFORMATION;
|
|
|
|
//
|
|
// Support for capturing system handle state at the time of the dump.
|
|
//
|
|
|
|
PMINIDUMP_HANDLE_DESCRIPTOR = ^MINIDUMP_HANDLE_DESCRIPTOR;
|
|
{$EXTERNALSYM PMINIDUMP_HANDLE_DESCRIPTOR}
|
|
_MINIDUMP_HANDLE_DESCRIPTOR = record
|
|
Handle: ULONG64;
|
|
TypeNameRva: RVA;
|
|
ObjectNameRva: RVA;
|
|
Attributes: ULONG32;
|
|
GrantedAccess: ULONG32;
|
|
HandleCount: ULONG32;
|
|
PointerCount: ULONG32;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_HANDLE_DESCRIPTOR}
|
|
MINIDUMP_HANDLE_DESCRIPTOR = _MINIDUMP_HANDLE_DESCRIPTOR;
|
|
{$EXTERNALSYM MINIDUMP_HANDLE_DESCRIPTOR}
|
|
TMinidumpHandleDescriptor = MINIDUMP_HANDLE_DESCRIPTOR;
|
|
PMinidumpHandleDescriptor = PMINIDUMP_HANDLE_DESCRIPTOR;
|
|
|
|
PMINIDUMP_HANDLE_DATA_STREAM = ^MINIDUMP_HANDLE_DATA_STREAM;
|
|
{$EXTERNALSYM PMINIDUMP_HANDLE_DATA_STREAM}
|
|
_MINIDUMP_HANDLE_DATA_STREAM = record
|
|
SizeOfHeader: ULONG32;
|
|
SizeOfDescriptor: ULONG32;
|
|
NumberOfDescriptors: ULONG32;
|
|
Reserved: ULONG32;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_HANDLE_DATA_STREAM}
|
|
MINIDUMP_HANDLE_DATA_STREAM = _MINIDUMP_HANDLE_DATA_STREAM;
|
|
{$EXTERNALSYM MINIDUMP_HANDLE_DATA_STREAM}
|
|
TMinidumpHandleDataStream = MINIDUMP_HANDLE_DATA_STREAM;
|
|
PMinidumpHandleDataStream = PMINIDUMP_HANDLE_DATA_STREAM;
|
|
|
|
//
|
|
// Support for capturing dynamic function table state at the time of the dump.
|
|
//
|
|
|
|
PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR = ^MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
|
|
{$EXTERNALSYM PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
|
|
_MINIDUMP_FUNCTION_TABLE_DESCRIPTOR = record
|
|
MinimumAddress: ULONG64;
|
|
MaximumAddress: ULONG64;
|
|
BaseAddress: ULONG64;
|
|
EntryCount: ULONG32;
|
|
SizeOfAlignPad: ULONG32;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
|
|
MINIDUMP_FUNCTION_TABLE_DESCRIPTOR = _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
|
|
{$EXTERNALSYM MINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
|
|
TMinidumpFunctionTableDescriptor = MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
|
|
PMinidumpFunctionTableDescriptor = PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
|
|
|
|
PMINIDUMP_FUNCTION_TABLE_STREAM = ^MINIDUMP_FUNCTION_TABLE_STREAM;
|
|
{$EXTERNALSYM PMINIDUMP_FUNCTION_TABLE_STREAM}
|
|
_MINIDUMP_FUNCTION_TABLE_STREAM = record
|
|
SizeOfHeader: ULONG32;
|
|
SizeOfDescriptor: ULONG32;
|
|
SizeOfNativeDescriptor: ULONG32;
|
|
SizeOfFunctionEntry: ULONG32;
|
|
NumberOfDescriptors: ULONG32;
|
|
SizeOfAlignPad: ULONG32;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_FUNCTION_TABLE_STREAM}
|
|
MINIDUMP_FUNCTION_TABLE_STREAM = _MINIDUMP_FUNCTION_TABLE_STREAM;
|
|
{$EXTERNALSYM MINIDUMP_FUNCTION_TABLE_STREAM}
|
|
TMinidumpFunctionTableStream = MINIDUMP_FUNCTION_TABLE_STREAM;
|
|
PMinidumpFunctionTableStream = PMINIDUMP_FUNCTION_TABLE_STREAM;
|
|
|
|
//
|
|
// The MINIDUMP_UNLOADED_MODULE contains information about a
|
|
// a specific module that was previously loaded but no
|
|
// longer is. This can help with diagnosing problems where
|
|
// callers attempt to call code that is no longer loaded.
|
|
//
|
|
|
|
_MINIDUMP_UNLOADED_MODULE = record
|
|
BaseOfImage: ULONG64;
|
|
SizeOfImage: ULONG32;
|
|
CheckSum: ULONG32;
|
|
TimeDateStamp: ULONG32;
|
|
ModuleNameRva: RVA;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_UNLOADED_MODULE}
|
|
MINIDUMP_UNLOADED_MODULE = _MINIDUMP_UNLOADED_MODULE;
|
|
{$EXTERNALSYM MINIDUMP_UNLOADED_MODULE}
|
|
PMINIDUMP_UNLOADED_MODULE = ^MINIDUMP_UNLOADED_MODULE;
|
|
{$EXTERNALSYM PMINIDUMP_UNLOADED_MODULE}
|
|
TMiniDumpUnloadedModule = MINIDUMP_UNLOADED_MODULE;
|
|
PMiniDumpUnloadedModule = PMINIDUMP_UNLOADED_MODULE;
|
|
|
|
//
|
|
// The minidump unloaded module list is a container for unloaded modules.
|
|
//
|
|
|
|
_MINIDUMP_UNLOADED_MODULE_LIST = record
|
|
SizeOfHeader: ULONG32;
|
|
SizeOfEntry: ULONG32;
|
|
NumberOfEntries: ULONG32;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_UNLOADED_MODULE_LIST}
|
|
MINIDUMP_UNLOADED_MODULE_LIST = _MINIDUMP_UNLOADED_MODULE_LIST;
|
|
{$EXTERNALSYM MINIDUMP_UNLOADED_MODULE_LIST}
|
|
PMINIDUMP_UNLOADED_MODULE_LIST = ^MINIDUMP_UNLOADED_MODULE_LIST;
|
|
{$EXTERNALSYM PMINIDUMP_UNLOADED_MODULE_LIST}
|
|
TMiniDumpUnloadedModuleList = MINIDUMP_UNLOADED_MODULE_LIST;
|
|
PMiniDumpUnloadedModuleList = PMINIDUMP_UNLOADED_MODULE_LIST;
|
|
|
|
//
|
|
// The miscellaneous information stream contains a variety
|
|
// of small pieces of information. A member is valid if
|
|
// it's within the available size and its corresponding
|
|
// bit is set.
|
|
//
|
|
|
|
const
|
|
MINIDUMP_MISC1_PROCESS_ID = $00000001;
|
|
{$EXTERNALSYM MINIDUMP_MISC1_PROCESS_ID}
|
|
MINIDUMP_MISC1_PROCESS_TIMES = $00000002;
|
|
{$EXTERNALSYM MINIDUMP_MISC1_PROCESS_TIMES}
|
|
|
|
type
|
|
_MINIDUMP_MISC_INFO = record
|
|
SizeOfInfo: ULONG32;
|
|
Flags1: ULONG32;
|
|
ProcessId: ULONG32;
|
|
ProcessCreateTime: ULONG32;
|
|
ProcessUserTime: ULONG32;
|
|
ProcessKernelTime: ULONG32;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_MISC_INFO}
|
|
MINIDUMP_MISC_INFO = _MINIDUMP_MISC_INFO;
|
|
{$EXTERNALSYM MINIDUMP_MISC_INFO}
|
|
PMINIDUMP_MISC_INFO = ^MINIDUMP_MISC_INFO;
|
|
{$EXTERNALSYM PMINIDUMP_MISC_INFO}
|
|
TMiniDumpMiscInfo = MINIDUMP_MISC_INFO;
|
|
PMiniDumpMiscInfo = PMINIDUMP_MISC_INFO;
|
|
|
|
//
|
|
// Support for arbitrary user-defined information.
|
|
//
|
|
|
|
PMINIDUMP_USER_RECORD = ^MINIDUMP_USER_RECORD;
|
|
{$EXTERNALSYM PMINIDUMP_USER_RECORD}
|
|
_MINIDUMP_USER_RECORD = record
|
|
Type_: ULONG32;
|
|
Memory: MINIDUMP_LOCATION_DESCRIPTOR;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_USER_RECORD}
|
|
MINIDUMP_USER_RECORD = _MINIDUMP_USER_RECORD;
|
|
{$EXTERNALSYM MINIDUMP_USER_RECORD}
|
|
TMinidumpUserRecord = MINIDUMP_USER_RECORD;
|
|
PMinidumpUserRecord = PMINIDUMP_USER_RECORD;
|
|
|
|
PMINIDUMP_USER_STREAM = ^MINIDUMP_USER_STREAM;
|
|
{$EXTERNALSYM PMINIDUMP_USER_STREAM}
|
|
_MINIDUMP_USER_STREAM = record
|
|
Type_: ULONG32;
|
|
BufferSize: ULONG;
|
|
Buffer: PVOID;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_USER_STREAM}
|
|
MINIDUMP_USER_STREAM = _MINIDUMP_USER_STREAM;
|
|
{$EXTERNALSYM MINIDUMP_USER_STREAM}
|
|
TMinidumpUserStream = MINIDUMP_USER_STREAM;
|
|
PMinidumpUserStream = PMINIDUMP_USER_STREAM;
|
|
|
|
PMINIDUMP_USER_STREAM_INFORMATION = ^MINIDUMP_USER_STREAM_INFORMATION;
|
|
{$EXTERNALSYM PMINIDUMP_USER_STREAM_INFORMATION}
|
|
_MINIDUMP_USER_STREAM_INFORMATION = record
|
|
UserStreamCount: ULONG;
|
|
UserStreamArray: PMINIDUMP_USER_STREAM;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_USER_STREAM_INFORMATION}
|
|
MINIDUMP_USER_STREAM_INFORMATION = _MINIDUMP_USER_STREAM_INFORMATION;
|
|
{$EXTERNALSYM MINIDUMP_USER_STREAM_INFORMATION}
|
|
TMinidumpUserStreamInformation = MINIDUMP_USER_STREAM_INFORMATION;
|
|
PMinidumpUserStreamInformation = PMINIDUMP_USER_STREAM_INFORMATION;
|
|
|
|
//
|
|
// Callback support.
|
|
//
|
|
|
|
_MINIDUMP_CALLBACK_TYPE = (
|
|
ModuleCallback,
|
|
ThreadCallback,
|
|
ThreadExCallback,
|
|
IncludeThreadCallback,
|
|
IncludeModuleCallback);
|
|
{$EXTERNALSYM _MINIDUMP_CALLBACK_TYPE}
|
|
MINIDUMP_CALLBACK_TYPE = _MINIDUMP_CALLBACK_TYPE;
|
|
{$EXTERNALSYM MINIDUMP_CALLBACK_TYPE}
|
|
TMinidumpCallbackType = MINIDUMP_CALLBACK_TYPE;
|
|
|
|
PMINIDUMP_THREAD_CALLBACK = ^MINIDUMP_THREAD_CALLBACK;
|
|
{$EXTERNALSYM PMINIDUMP_THREAD_CALLBACK}
|
|
_MINIDUMP_THREAD_CALLBACK = record
|
|
ThreadId: ULONG;
|
|
ThreadHandle: HANDLE;
|
|
Context: CONTEXT;
|
|
SizeOfContext: ULONG;
|
|
StackBase: ULONG64;
|
|
StackEnd: ULONG64;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_THREAD_CALLBACK}
|
|
MINIDUMP_THREAD_CALLBACK = _MINIDUMP_THREAD_CALLBACK;
|
|
{$EXTERNALSYM MINIDUMP_THREAD_CALLBACK}
|
|
TMinidumpThreadCallback = MINIDUMP_THREAD_CALLBACK;
|
|
PMinidumpThreadCallback = PMINIDUMP_THREAD_CALLBACK;
|
|
|
|
PMINIDUMP_THREAD_EX_CALLBACK = ^MINIDUMP_THREAD_EX_CALLBACK;
|
|
{$EXTERNALSYM PMINIDUMP_THREAD_EX_CALLBACK}
|
|
_MINIDUMP_THREAD_EX_CALLBACK = record
|
|
ThreadId: ULONG;
|
|
ThreadHandle: HANDLE;
|
|
Context: CONTEXT;
|
|
SizeOfContext: ULONG;
|
|
StackBase: ULONG64;
|
|
StackEnd: ULONG64;
|
|
BackingStoreBase: ULONG64;
|
|
BackingStoreEnd: ULONG64;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_THREAD_EX_CALLBACK}
|
|
MINIDUMP_THREAD_EX_CALLBACK = _MINIDUMP_THREAD_EX_CALLBACK;
|
|
{$EXTERNALSYM MINIDUMP_THREAD_EX_CALLBACK}
|
|
TMinidumpThreadExCallback = MINIDUMP_THREAD_EX_CALLBACK;
|
|
PMinidumpThreadExCallback = PMINIDUMP_THREAD_EX_CALLBACK;
|
|
|
|
PMINIDUMP_INCLUDE_THREAD_CALLBACK = ^MINIDUMP_INCLUDE_THREAD_CALLBACK;
|
|
{$EXTERNALSYM PMINIDUMP_INCLUDE_THREAD_CALLBACK}
|
|
_MINIDUMP_INCLUDE_THREAD_CALLBACK = record
|
|
ThreadId: ULONG;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_INCLUDE_THREAD_CALLBACK}
|
|
MINIDUMP_INCLUDE_THREAD_CALLBACK = _MINIDUMP_INCLUDE_THREAD_CALLBACK;
|
|
{$EXTERNALSYM MINIDUMP_INCLUDE_THREAD_CALLBACK}
|
|
TMinidumpIncludeThreadCallback = MINIDUMP_INCLUDE_THREAD_CALLBACK;
|
|
PMinidumpIncludeThreadCallback = PMINIDUMP_INCLUDE_THREAD_CALLBACK;
|
|
|
|
const
|
|
ThreadWriteThread = $0001;
|
|
{$EXTERNALSYM ThreadWriteThread}
|
|
ThreadWriteStack = $0002;
|
|
{$EXTERNALSYM ThreadWriteStack}
|
|
ThreadWriteContext = $0004;
|
|
{$EXTERNALSYM ThreadWriteContext}
|
|
ThreadWriteBackingStore = $0008;
|
|
{$EXTERNALSYM ThreadWriteBackingStore}
|
|
ThreadWriteInstructionWindow = $0010;
|
|
{$EXTERNALSYM ThreadWriteInstructionWindow}
|
|
ThreadWriteThreadData = $0020;
|
|
{$EXTERNALSYM ThreadWriteThreadData}
|
|
|
|
type
|
|
_THREAD_WRITE_FLAGS = DWORD;
|
|
{$EXTERNALSYM _THREAD_WRITE_FLAGS}
|
|
THREAD_WRITE_FLAGS = _THREAD_WRITE_FLAGS;
|
|
{$EXTERNALSYM THREAD_WRITE_FLAGS}
|
|
TThreadWriteFlags = THREAD_WRITE_FLAGS;
|
|
|
|
type
|
|
PMINIDUMP_MODULE_CALLBACK = ^MINIDUMP_MODULE_CALLBACK;
|
|
{$EXTERNALSYM PMINIDUMP_MODULE_CALLBACK}
|
|
_MINIDUMP_MODULE_CALLBACK = record
|
|
FullPath: PWCHAR;
|
|
BaseOfImage: ULONG64;
|
|
SizeOfImage: ULONG;
|
|
CheckSum: ULONG;
|
|
TimeDateStamp: ULONG;
|
|
VersionInfo: VS_FIXEDFILEINFO;
|
|
CvRecord: PVOID;
|
|
SizeOfCvRecord: ULONG;
|
|
MiscRecord: PVOID;
|
|
SizeOfMiscRecord: ULONG;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_MODULE_CALLBACK}
|
|
MINIDUMP_MODULE_CALLBACK = _MINIDUMP_MODULE_CALLBACK;
|
|
{$EXTERNALSYM MINIDUMP_MODULE_CALLBACK}
|
|
TMinidumpModuleCallback = MINIDUMP_MODULE_CALLBACK;
|
|
PMinidumpModuleCallback = PMINIDUMP_MODULE_CALLBACK;
|
|
|
|
PMINIDUMP_INCLUDE_MODULE_CALLBACK = ^MINIDUMP_INCLUDE_MODULE_CALLBACK;
|
|
{$EXTERNALSYM PMINIDUMP_INCLUDE_MODULE_CALLBACK}
|
|
_MINIDUMP_INCLUDE_MODULE_CALLBACK = record
|
|
BaseOfImage: ULONG64;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_INCLUDE_MODULE_CALLBACK}
|
|
MINIDUMP_INCLUDE_MODULE_CALLBACK = _MINIDUMP_INCLUDE_MODULE_CALLBACK;
|
|
{$EXTERNALSYM MINIDUMP_INCLUDE_MODULE_CALLBACK}
|
|
TMinidumpIncludeModuleCallback = MINIDUMP_INCLUDE_MODULE_CALLBACK;
|
|
PMinidumpIncludeModuleCallback = PMINIDUMP_INCLUDE_MODULE_CALLBACK;
|
|
|
|
const
|
|
ModuleWriteModule = $0001;
|
|
{$EXTERNALSYM ModuleWriteModule}
|
|
ModuleWriteDataSeg = $0002;
|
|
{$EXTERNALSYM ModuleWriteDataSeg}
|
|
ModuleWriteMiscRecord = $0004;
|
|
{$EXTERNALSYM ModuleWriteMiscRecord}
|
|
ModuleWriteCvRecord = $0008;
|
|
{$EXTERNALSYM ModuleWriteCvRecord}
|
|
ModuleReferencedByMemory = $0010;
|
|
{$EXTERNALSYM ModuleReferencedByMemory}
|
|
|
|
type
|
|
_MODULE_WRITE_FLAGS = DWORD;
|
|
{$EXTERNALSYM _MODULE_WRITE_FLAGS}
|
|
MODULE_WRITE_FLAGS = _MODULE_WRITE_FLAGS;
|
|
{$EXTERNALSYM MODULE_WRITE_FLAGS}
|
|
TModuleWriteFlags = MODULE_WRITE_FLAGS;
|
|
|
|
_MINIDUMP_CALLBACK_INPUT = record
|
|
ProcessId: ULONG;
|
|
ProcessHandle: HANDLE;
|
|
CallbackType: ULONG;
|
|
case Integer of
|
|
0: (Thread: MINIDUMP_THREAD_CALLBACK);
|
|
1: (ThreadEx: MINIDUMP_THREAD_EX_CALLBACK);
|
|
2: (Module: MINIDUMP_MODULE_CALLBACK);
|
|
3: (IncludeThread: MINIDUMP_INCLUDE_THREAD_CALLBACK);
|
|
4: (IncludeModule: MINIDUMP_INCLUDE_MODULE_CALLBACK);
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_CALLBACK_INPUT}
|
|
MINIDUMP_CALLBACK_INPUT = _MINIDUMP_CALLBACK_INPUT;
|
|
{$EXTERNALSYM MINIDUMP_CALLBACK_INPUT}
|
|
PMINIDUMP_CALLBACK_INPUT = ^MINIDUMP_CALLBACK_INPUT;
|
|
{$EXTERNALSYM PMINIDUMP_CALLBACK_INPUT}
|
|
TminidumpCallbackInput = MINIDUMP_CALLBACK_INPUT;
|
|
|
|
PMINIDUMP_CALLBACK_OUTPUT = ^MINIDUMP_CALLBACK_OUTPUT;
|
|
{$EXTERNALSYM PMINIDUMP_CALLBACK_OUTPUT}
|
|
_MINIDUMP_CALLBACK_OUTPUT = record
|
|
case Integer of
|
|
0: (ModuleWriteFlags: ULONG);
|
|
1: (ThreadWriteFlags: ULONG);
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_CALLBACK_OUTPUT}
|
|
MINIDUMP_CALLBACK_OUTPUT = _MINIDUMP_CALLBACK_OUTPUT;
|
|
{$EXTERNALSYM MINIDUMP_CALLBACK_OUTPUT}
|
|
TMinidumpCallbackOutput = MINIDUMP_CALLBACK_OUTPUT;
|
|
PMinidumpCallbackOutput = PMINIDUMP_CALLBACK_OUTPUT;
|
|
|
|
//
|
|
// A normal minidump contains just the information
|
|
// necessary to capture stack traces for all of the
|
|
// existing threads in a process.
|
|
//
|
|
// A minidump with data segments includes all of the data
|
|
// sections from loaded modules in order to capture
|
|
// global variable contents. This can make the dump much
|
|
// larger if many modules have global data.
|
|
//
|
|
// A minidump with full memory includes all of the accessible
|
|
// memory in the process and can be very large. A minidump
|
|
// with full memory always has the raw memory data at the end
|
|
// of the dump so that the initial structures in the dump can
|
|
// be mapped directly without having to include the raw
|
|
// memory information.
|
|
//
|
|
// Stack and backing store memory can be filtered to remove
|
|
// data unnecessary for stack walking. This can improve
|
|
// compression of stacks and also deletes data that may
|
|
// be private and should not be stored in a dump.
|
|
// Memory can also be scanned to see what modules are
|
|
// referenced by stack and backing store memory to allow
|
|
// omission of other modules to reduce dump size.
|
|
// In either of these modes the ModuleReferencedByMemory flag
|
|
// is set for all modules referenced before the base
|
|
// module callbacks occur.
|
|
//
|
|
// On some operating systems a list of modules that were
|
|
// recently unloaded is kept in addition to the currently
|
|
// loaded module list. This information can be saved in
|
|
// the dump if desired.
|
|
//
|
|
// Stack and backing store memory can be scanned for referenced
|
|
// pages in order to pick up data referenced by locals or other
|
|
// stack memory. This can increase the size of a dump significantly.
|
|
//
|
|
// Module paths may contain undesired information such as user names
|
|
// or other important directory names so they can be stripped. This
|
|
// option reduces the ability to locate the proper image later
|
|
// and should only be used in certain situations.
|
|
//
|
|
// Complete operating system per-process and per-thread information can
|
|
// be gathered and stored in the dump.
|
|
//
|
|
// The virtual address space can be scanned for various types
|
|
// of memory to be included in the dump.
|
|
//
|
|
|
|
const
|
|
MiniDumpNormal = $0000;
|
|
{$EXTERNALSYM MiniDumpNormal}
|
|
MiniDumpWithDataSegs = $0001;
|
|
{$EXTERNALSYM MiniDumpWithDataSegs}
|
|
MiniDumpWithFullMemory = $0002;
|
|
{$EXTERNALSYM MiniDumpWithFullMemory}
|
|
MiniDumpWithHandleData = $0004;
|
|
{$EXTERNALSYM MiniDumpWithHandleData}
|
|
MiniDumpFilterMemory = $0008;
|
|
{$EXTERNALSYM MiniDumpFilterMemory}
|
|
MiniDumpScanMemory = $0010;
|
|
{$EXTERNALSYM MiniDumpScanMemory}
|
|
MiniDumpWithUnloadedModules = $0020;
|
|
{$EXTERNALSYM MiniDumpWithUnloadedModules}
|
|
MiniDumpWithIndirectlyReferencedMemory = $0040;
|
|
{$EXTERNALSYM MiniDumpWithIndirectlyReferencedMemory}
|
|
MiniDumpFilterModulePaths = $0080;
|
|
{$EXTERNALSYM MiniDumpFilterModulePaths}
|
|
MiniDumpWithProcessThreadData = $0100;
|
|
{$EXTERNALSYM MiniDumpWithProcessThreadData}
|
|
MiniDumpWithPrivateReadWriteMemory = $0200;
|
|
{$EXTERNALSYM MiniDumpWithPrivateReadWriteMemory}
|
|
|
|
type
|
|
_MINIDUMP_TYPE = DWORD;
|
|
{$EXTERNALSYM _MINIDUMP_TYPE}
|
|
MINIDUMP_TYPE = _MINIDUMP_TYPE;
|
|
{$EXTERNALSYM MINIDUMP_TYPE}
|
|
TMinidumpType = MINIDUMP_TYPE;
|
|
|
|
//
|
|
// The minidump callback should modify the FieldsToWrite parameter to reflect
|
|
// what portions of the specified thread or module should be written to the
|
|
// file.
|
|
//
|
|
|
|
MINIDUMP_CALLBACK_ROUTINE = function(CallbackParam: PVOID; CallbackInput: PMINIDUMP_CALLBACK_INPUT;
|
|
CallbackOutput: PMINIDUMP_CALLBACK_OUTPUT): BOOL; stdcall;
|
|
{$EXTERNALSYM MINIDUMP_CALLBACK_ROUTINE}
|
|
TMinidumpCallbackRoutine = MINIDUMP_CALLBACK_ROUTINE;
|
|
|
|
PMINIDUMP_CALLBACK_INFORMATION = ^MINIDUMP_CALLBACK_INFORMATION;
|
|
{$EXTERNALSYM PMINIDUMP_CALLBACK_INFORMATION}
|
|
_MINIDUMP_CALLBACK_INFORMATION = record
|
|
CallbackRoutine: MINIDUMP_CALLBACK_ROUTINE;
|
|
CallbackParam: PVOID;
|
|
end;
|
|
{$EXTERNALSYM _MINIDUMP_CALLBACK_INFORMATION}
|
|
MINIDUMP_CALLBACK_INFORMATION = _MINIDUMP_CALLBACK_INFORMATION;
|
|
{$EXTERNALSYM MINIDUMP_CALLBACK_INFORMATION}
|
|
TMinidumpCallbackInformation = MINIDUMP_CALLBACK_INFORMATION;
|
|
PMinidumpCallbackInformation = PMINIDUMP_CALLBACK_INFORMATION;
|
|
|
|
//++
|
|
//
|
|
// PVOID
|
|
// RVA_TO_ADDR(
|
|
// PVOID Mapping,
|
|
// ULONG Rva
|
|
// )
|
|
//
|
|
// Routine Description:
|
|
//
|
|
// Map an RVA that is contained within a mapped file to it's associated
|
|
// flat address.
|
|
//
|
|
// Arguments:
|
|
//
|
|
// Mapping - Base address of mapped file containing the RVA.
|
|
//
|
|
// Rva - An Rva to fixup.
|
|
//
|
|
// Return Values:
|
|
//
|
|
// A pointer to the desired data.
|
|
//
|
|
//--
|
|
|
|
|
|
function RVA_TO_ADDR(Mapping, Rva: Pointer): Pointer;
|
|
{$EXTERNALSYM RVA_TO_ADDR}
|
|
|
|
|
|
function MiniDumpWriteDump(hProcess: HANDLE; ProcessId: DWORD; hFile: HANDLE; DumpType: MINIDUMP_TYPE; ExceptionParam: PMINIDUMP_EXCEPTION_INFORMATION; UserStreamParam: PMINIDUMP_USER_STREAM_INFORMATION; CallbackParam: PMINIDUMP_CALLBACK_INFORMATION): BOOL; stdcall;
|
|
{$EXTERNALSYM MiniDumpWriteDump}
|
|
|
|
function MiniDumpReadDumpStream(BaseOfDump: PVOID; StreamNumber: ULONG; var Dir: PMINIDUMP_DIRECTORY; var StreamPointer: PVOID; var StreamSize: ULONG): BOOL; stdcall;
|
|
{$EXTERNALSYM MiniDumpReadDumpStream}
|
|
|
|
{$ENDIF JWA_IMPLEMENTATIONSECTION}
|
|
|
|
{$IFNDEF JWA_OMIT_SECTIONS}
|
|
implementation
|
|
//uses ...
|
|
{$ENDIF JWA_OMIT_SECTIONS}
|
|
|
|
{$IFNDEF JWA_INTERFACESECTION}
|
|
|
|
{$IFNDEF JWA_INCLUDEMODE}
|
|
const
|
|
ImageHlpLib = 'imagehlp.dll';
|
|
{$IFDEF UNICODE}
|
|
AWSuffix = 'W';
|
|
{$ELSE}
|
|
AWSuffix = 'A';
|
|
{$ENDIF UNICODE}
|
|
{$ENDIF JWA_INCLUDEMODE}
|
|
|
|
procedure Address32To64(a32: LPADDRESS; a64: LPADDRESS64);
|
|
begin
|
|
a64^.Offset := {ULONG64(LONG64(LONG(}a32^.Offset{)))};
|
|
a64^.Segment := a32^.Segment;
|
|
a64^.Mode := a32^.Mode;
|
|
end;
|
|
|
|
procedure Address64To32(a64: LPADDRESS64; a32: LPADDRESS);
|
|
begin
|
|
a32^.Offset := ULONG(a64^.Offset);
|
|
a32^.Segment := a64^.Segment;
|
|
a32^.Mode := a64^.Mode;
|
|
end;
|
|
|
|
procedure KdHelp32To64(p32: PKDHELP; p64: PKDHELP64);
|
|
begin
|
|
p64^.Thread := p32^.Thread;
|
|
p64^.ThCallbackStack := p32^.ThCallbackStack;
|
|
p64^.NextCallback := p32^.NextCallback;
|
|
p64^.FramePointer := p32^.FramePointer;
|
|
p64^.KiCallUserMode := p32^.KiCallUserMode;
|
|
p64^.KeUserCallbackDispatcher := p32^.KeUserCallbackDispatcher;
|
|
p64^.SystemRangeStart := p32^.SystemRangeStart;
|
|
end;
|
|
|
|
function RVA_TO_ADDR(Mapping, Rva: Pointer): Pointer;
|
|
begin
|
|
//64bit Warning: Converting a pointer to Cardinal may conflict with 64bit
|
|
Result := Pointer(DWORD_PTR(Mapping) + DWORD_PTR(Rva));
|
|
end;
|
|
|
|
|
|
{$IFDEF DYNAMIC_LINK}
|
|
|
|
|
|
var
|
|
_BindImage: Pointer;
|
|
|
|
function BindImage;
|
|
begin
|
|
GetProcedureAddress(_BindImage, ImageHlpLib, 'BindImage');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_BindImage]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_BindImageEx: Pointer;
|
|
|
|
function BindImageEx;
|
|
begin
|
|
GetProcedureAddress(_BindImageEx, ImageHlpLib, 'BindImageEx');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_BindImageEx]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ReBaseImage: Pointer;
|
|
|
|
function ReBaseImage;
|
|
begin
|
|
GetProcedureAddress(_ReBaseImage, ImageHlpLib, 'ReBaseImage');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ReBaseImage]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ReBaseImage64: Pointer;
|
|
|
|
function ReBaseImage64;
|
|
begin
|
|
GetProcedureAddress(_ReBaseImage64, ImageHlpLib, 'ReBaseImage64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ReBaseImage64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_CheckSumMappedFile: Pointer;
|
|
|
|
function CheckSumMappedFile;
|
|
begin
|
|
GetProcedureAddress(_CheckSumMappedFile, ImageHlpLib, 'CheckSumMappedFile');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_CheckSumMappedFile]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_MapFileAndCheckSumA: Pointer;
|
|
|
|
function MapFileAndCheckSumA;
|
|
begin
|
|
GetProcedureAddress(_MapFileAndCheckSumA, ImageHlpLib, 'MapFileAndCheckSumA');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_MapFileAndCheckSumA]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_MapFileAndCheckSumW: Pointer;
|
|
|
|
function MapFileAndCheckSumW;
|
|
begin
|
|
GetProcedureAddress(_MapFileAndCheckSumW, ImageHlpLib, 'MapFileAndCheckSumW');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_MapFileAndCheckSumW]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_MapFileAndCheckSum: Pointer;
|
|
|
|
function MapFileAndCheckSum;
|
|
begin
|
|
GetProcedureAddress(_MapFileAndCheckSum, ImageHlpLib, 'MapFileAndCheckSum' + AWSuffix);
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_MapFileAndCheckSum]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_GetImageConfigInformation: Pointer;
|
|
|
|
function GetImageConfigInformation;
|
|
begin
|
|
GetProcedureAddress(_GetImageConfigInformation, ImageHlpLib, 'GetImageConfigInformation');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_GetImageConfigInformation]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_GetImageUnusedHeaderBytes: Pointer;
|
|
|
|
function GetImageUnusedHeaderBytes;
|
|
begin
|
|
GetProcedureAddress(_GetImageUnusedHeaderBytes, ImageHlpLib, 'GetImageUnusedHeaderBytes');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_GetImageUnusedHeaderBytes]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SetImageConfigInformation: Pointer;
|
|
|
|
function SetImageConfigInformation;
|
|
begin
|
|
GetProcedureAddress(_SetImageConfigInformation, ImageHlpLib, 'SetImageConfigInformation');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SetImageConfigInformation]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImageGetDigestStream: Pointer;
|
|
|
|
function ImageGetDigestStream;
|
|
begin
|
|
GetProcedureAddress(_ImageGetDigestStream, ImageHlpLib, 'ImageGetDigestStream');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImageGetDigestStream]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImageAddCertificate: Pointer;
|
|
|
|
function ImageAddCertificate;
|
|
begin
|
|
GetProcedureAddress(_ImageAddCertificate, ImageHlpLib, 'ImageAddCertificate');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImageAddCertificate]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImageRemoveCertificate: Pointer;
|
|
|
|
function ImageRemoveCertificate;
|
|
begin
|
|
GetProcedureAddress(_ImageRemoveCertificate, ImageHlpLib, 'ImageRemoveCertificate');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImageRemoveCertificate]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImageEnumerateCertificates: Pointer;
|
|
|
|
function ImageEnumerateCertificates;
|
|
begin
|
|
GetProcedureAddress(_ImageEnumerateCertificates, ImageHlpLib, 'ImageEnumerateCertificates');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImageEnumerateCertificates]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImageGetCertificateData: Pointer;
|
|
|
|
function ImageGetCertificateData;
|
|
begin
|
|
GetProcedureAddress(_ImageGetCertificateData, ImageHlpLib, 'ImageGetCertificateData');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImageGetCertificateData]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImageGetCertificateHeader: Pointer;
|
|
|
|
function ImageGetCertificateHeader;
|
|
begin
|
|
GetProcedureAddress(_ImageGetCertificateHeader, ImageHlpLib, 'ImageGetCertificateHeader');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImageGetCertificateHeader]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImageLoad: Pointer;
|
|
|
|
function ImageLoad;
|
|
begin
|
|
GetProcedureAddress(_ImageLoad, ImageHlpLib, 'ImageLoad');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImageLoad]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImageUnload: Pointer;
|
|
|
|
function ImageUnload;
|
|
begin
|
|
GetProcedureAddress(_ImageUnload, ImageHlpLib, 'ImageUnload');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImageUnload]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_MapAndLoad: Pointer;
|
|
|
|
function MapAndLoad;
|
|
begin
|
|
GetProcedureAddress(_MapAndLoad, ImageHlpLib, 'MapAndLoad');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_MapAndLoad]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_UnMapAndLoad: Pointer;
|
|
|
|
function UnMapAndLoad;
|
|
begin
|
|
GetProcedureAddress(_UnMapAndLoad, ImageHlpLib, 'UnMapAndLoad');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_UnMapAndLoad]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_TouchFileTimes: Pointer;
|
|
|
|
function TouchFileTimes;
|
|
begin
|
|
GetProcedureAddress(_TouchFileTimes, ImageHlpLib, 'TouchFileTimes');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_TouchFileTimes]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SplitSymbols: Pointer;
|
|
|
|
function SplitSymbols;
|
|
begin
|
|
GetProcedureAddress(_SplitSymbols, ImageHlpLib, 'SplitSymbols');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SplitSymbols]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_UpdateDebugInfoFile: Pointer;
|
|
|
|
function UpdateDebugInfoFile;
|
|
begin
|
|
GetProcedureAddress(_UpdateDebugInfoFile, ImageHlpLib, 'UpdateDebugInfoFile');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_UpdateDebugInfoFile]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_UpdateDebugInfoFileEx: Pointer;
|
|
|
|
function UpdateDebugInfoFileEx;
|
|
begin
|
|
GetProcedureAddress(_UpdateDebugInfoFileEx, ImageHlpLib, 'UpdateDebugInfoFileEx');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_UpdateDebugInfoFileEx]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_FindDebugInfoFile: Pointer;
|
|
|
|
function FindDebugInfoFile;
|
|
begin
|
|
GetProcedureAddress(_FindDebugInfoFile, ImageHlpLib, 'FindDebugInfoFile');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_FindDebugInfoFile]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_FindDebugInfoFileEx: Pointer;
|
|
|
|
function FindDebugInfoFileEx;
|
|
begin
|
|
GetProcedureAddress(_FindDebugInfoFileEx, ImageHlpLib, 'FindDebugInfoFileEx');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_FindDebugInfoFileEx]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymFindFileInPath: Pointer;
|
|
|
|
function SymFindFileInPath;
|
|
begin
|
|
GetProcedureAddress(_SymFindFileInPath, ImageHlpLib, 'SymFindFileInPath');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymFindFileInPath]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_FindExecutableImage: Pointer;
|
|
|
|
function FindExecutableImage;
|
|
begin
|
|
GetProcedureAddress(_FindExecutableImage, ImageHlpLib, 'FindExecutableImage');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_FindExecutableImage]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_FindExecutableImageEx: Pointer;
|
|
|
|
function FindExecutableImageEx;
|
|
begin
|
|
GetProcedureAddress(_FindExecutableImageEx, ImageHlpLib, 'FindExecutableImageEx');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_FindExecutableImageEx]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImageNtHeader: Pointer;
|
|
|
|
function ImageNtHeader;
|
|
begin
|
|
GetProcedureAddress(_ImageNtHeader, ImageHlpLib, 'ImageNtHeader');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImageNtHeader]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImageDirectoryEntryToDataEx: Pointer;
|
|
|
|
function ImageDirectoryEntryToDataEx;
|
|
begin
|
|
GetProcedureAddress(_ImageDirectoryEntryToDataEx, ImageHlpLib, 'ImageDirectoryEntryToDataEx');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImageDirectoryEntryToDataEx]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImageDirectoryEntryToData: Pointer;
|
|
|
|
function ImageDirectoryEntryToData;
|
|
begin
|
|
GetProcedureAddress(_ImageDirectoryEntryToData, ImageHlpLib, 'ImageDirectoryEntryToData');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImageDirectoryEntryToData]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImageRvaToSection: Pointer;
|
|
|
|
function ImageRvaToSection;
|
|
begin
|
|
GetProcedureAddress(_ImageRvaToSection, ImageHlpLib, 'ImageRvaToSection');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImageRvaToSection]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImageRvaToVa: Pointer;
|
|
|
|
function ImageRvaToVa;
|
|
begin
|
|
GetProcedureAddress(_ImageRvaToVa, ImageHlpLib, 'ImageRvaToVa');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImageRvaToVa]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_MapDebugInformation: Pointer;
|
|
|
|
function MapDebugInformation;
|
|
begin
|
|
GetProcedureAddress(_MapDebugInformation, ImageHlpLib, 'MapDebugInformation');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_MapDebugInformation]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_UnmapDebugInformation: Pointer;
|
|
|
|
function UnmapDebugInformation;
|
|
begin
|
|
GetProcedureAddress(_UnmapDebugInformation, ImageHlpLib, 'UnmapDebugInformation');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_UnmapDebugInformation]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SearchTreeForFile: Pointer;
|
|
|
|
function SearchTreeForFile;
|
|
begin
|
|
GetProcedureAddress(_SearchTreeForFile, ImageHlpLib, 'SearchTreeForFile');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SearchTreeForFile]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_EnumDirTree: Pointer;
|
|
|
|
function EnumDirTree;
|
|
begin
|
|
GetProcedureAddress(_EnumDirTree, ImageHlpLib, 'EnumDirTree');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_EnumDirTree]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_MakeSureDirectoryPathExists: Pointer;
|
|
|
|
function MakeSureDirectoryPathExists;
|
|
begin
|
|
GetProcedureAddress(_MakeSureDirectoryPathExists, ImageHlpLib, 'MakeSureDirectoryPathExists');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_MakeSureDirectoryPathExists]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_UnDecorateSymbolName: Pointer;
|
|
|
|
function UnDecorateSymbolName;
|
|
begin
|
|
GetProcedureAddress(_UnDecorateSymbolName, ImageHlpLib, 'UnDecorateSymbolName');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_UnDecorateSymbolName]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_StackWalk64: Pointer;
|
|
|
|
function StackWalk64;
|
|
begin
|
|
GetProcedureAddress(_StackWalk64, ImageHlpLib, 'StackWalk64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_StackWalk64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_StackWalk: Pointer;
|
|
|
|
function StackWalk;
|
|
begin
|
|
GetProcedureAddress(_StackWalk, ImageHlpLib, 'StackWalk');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_StackWalk]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImagehlpApiVersion: Pointer;
|
|
|
|
function ImagehlpApiVersion;
|
|
begin
|
|
GetProcedureAddress(_ImagehlpApiVersion, ImageHlpLib, 'ImagehlpApiVersion');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImagehlpApiVersion]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_ImagehlpApiVersionEx: Pointer;
|
|
|
|
function ImagehlpApiVersionEx;
|
|
begin
|
|
GetProcedureAddress(_ImagehlpApiVersionEx, ImageHlpLib, 'ImagehlpApiVersionEx');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_ImagehlpApiVersionEx]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_GetTimestampForLoadedLibrary: Pointer;
|
|
|
|
function GetTimestampForLoadedLibrary;
|
|
begin
|
|
GetProcedureAddress(_GetTimestampForLoadedLibrary, ImageHlpLib, 'GetTimestampForLoadedLibrary');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_GetTimestampForLoadedLibrary]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymSetOptions: Pointer;
|
|
|
|
function SymSetOptions;
|
|
begin
|
|
GetProcedureAddress(_SymSetOptions, ImageHlpLib, 'SymSetOptions');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymSetOptions]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetOptions: Pointer;
|
|
|
|
function SymGetOptions;
|
|
begin
|
|
GetProcedureAddress(_SymGetOptions, ImageHlpLib, 'SymGetOptions');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetOptions]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymCleanup: Pointer;
|
|
|
|
function SymCleanup;
|
|
begin
|
|
GetProcedureAddress(_SymCleanup, ImageHlpLib, 'SymCleanup');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymCleanup]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymMatchString: Pointer;
|
|
|
|
function SymMatchString;
|
|
begin
|
|
GetProcedureAddress(_SymMatchString, ImageHlpLib, 'SymMatchString');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymMatchString]
|
|
end;
|
|
end;
|
|
|
|
|
|
var
|
|
_SymEnumSourceFiles: Pointer;
|
|
|
|
function SymEnumSourceFiles;
|
|
begin
|
|
GetProcedureAddress(_SymEnumSourceFiles, ImageHlpLib, 'SymEnumSourceFiles');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymEnumSourceFiles]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymEnumerateModules64: Pointer;
|
|
|
|
function SymEnumerateModules64;
|
|
begin
|
|
GetProcedureAddress(_SymEnumerateModules64, ImageHlpLib, 'SymEnumerateModules64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymEnumerateModules64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymEnumerateModules: Pointer;
|
|
|
|
function SymEnumerateModules;
|
|
begin
|
|
GetProcedureAddress(_SymEnumerateModules, ImageHlpLib, 'SymEnumerateModules');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymEnumerateModules]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymEnumerateSymbols64: Pointer;
|
|
|
|
function SymEnumerateSymbols64;
|
|
begin
|
|
GetProcedureAddress(_SymEnumerateSymbols64, ImageHlpLib, 'SymEnumerateSymbols64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymEnumerateSymbols64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymEnumerateSymbolsW64: Pointer;
|
|
|
|
function SymEnumerateSymbolsW64;
|
|
begin
|
|
GetProcedureAddress(_SymEnumerateSymbolsW64, ImageHlpLib, 'SymEnumerateSymbolsW64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymEnumerateSymbolsW64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymEnumerateSymbols: Pointer;
|
|
|
|
function SymEnumerateSymbols;
|
|
begin
|
|
GetProcedureAddress(_SymEnumerateSymbols, ImageHlpLib, 'SymEnumerateSymbols');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymEnumerateSymbols]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymEnumerateSymbolsW: Pointer;
|
|
|
|
function SymEnumerateSymbolsW;
|
|
begin
|
|
GetProcedureAddress(_SymEnumerateSymbolsW, ImageHlpLib, 'SymEnumerateSymbolsW');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymEnumerateSymbolsW]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_EnumerateLoadedModules64: Pointer;
|
|
|
|
function EnumerateLoadedModules64;
|
|
begin
|
|
GetProcedureAddress(_EnumerateLoadedModules64, ImageHlpLib, 'EnumerateLoadedModules64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_EnumerateLoadedModules64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_EnumerateLoadedModules: Pointer;
|
|
|
|
function EnumerateLoadedModules;
|
|
begin
|
|
GetProcedureAddress(_EnumerateLoadedModules, ImageHlpLib, 'EnumerateLoadedModules');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_EnumerateLoadedModules]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymFunctionTableAccess64: Pointer;
|
|
|
|
function SymFunctionTableAccess64;
|
|
begin
|
|
GetProcedureAddress(_SymFunctionTableAccess64, ImageHlpLib, 'SymFunctionTableAccess64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymFunctionTableAccess64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymFunctionTableAccess: Pointer;
|
|
|
|
function SymFunctionTableAccess;
|
|
begin
|
|
GetProcedureAddress(_SymFunctionTableAccess, ImageHlpLib, 'SymFunctionTableAccess');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymFunctionTableAccess]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetModuleInfo64: Pointer;
|
|
|
|
function SymGetModuleInfo64;
|
|
begin
|
|
GetProcedureAddress(_SymGetModuleInfo64, ImageHlpLib, 'SymGetModuleInfo64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetModuleInfo64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetModuleInfoW64: Pointer;
|
|
|
|
function SymGetModuleInfoW64;
|
|
begin
|
|
GetProcedureAddress(_SymGetModuleInfoW64, ImageHlpLib, 'SymGetModuleInfoW64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetModuleInfoW64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetModuleInfo: Pointer;
|
|
|
|
function SymGetModuleInfo;
|
|
begin
|
|
GetProcedureAddress(_SymGetModuleInfo, ImageHlpLib, 'SymGetModuleInfo');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetModuleInfo]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetModuleInfoW: Pointer;
|
|
|
|
function SymGetModuleInfoW;
|
|
begin
|
|
GetProcedureAddress(_SymGetModuleInfoW, ImageHlpLib, 'SymGetModuleInfoW');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetModuleInfoW]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetModuleBase64: Pointer;
|
|
|
|
function SymGetModuleBase64;
|
|
begin
|
|
GetProcedureAddress(_SymGetModuleBase64, ImageHlpLib, 'SymGetModuleBase64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetModuleBase64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetModuleBase: Pointer;
|
|
|
|
function SymGetModuleBase;
|
|
begin
|
|
GetProcedureAddress(_SymGetModuleBase, ImageHlpLib, 'SymGetModuleBase');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetModuleBase]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetSymNext64: Pointer;
|
|
|
|
function SymGetSymNext64;
|
|
begin
|
|
GetProcedureAddress(_SymGetSymNext64, ImageHlpLib, 'SymGetSymNext64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetSymNext64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetSymNext: Pointer;
|
|
|
|
function SymGetSymNext;
|
|
begin
|
|
GetProcedureAddress(_SymGetSymNext, ImageHlpLib, 'SymGetSymNext');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetSymNext]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetSymPrev64: Pointer;
|
|
|
|
function SymGetSymPrev64;
|
|
begin
|
|
GetProcedureAddress(_SymGetSymPrev64, ImageHlpLib, 'SymGetSymPrev64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetSymPrev64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetSymPrev: Pointer;
|
|
|
|
function SymGetSymPrev;
|
|
begin
|
|
GetProcedureAddress(_SymGetSymPrev, ImageHlpLib, 'SymGetSymPrev');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetSymPrev]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetLineFromAddr64: Pointer;
|
|
|
|
function SymGetLineFromAddr64;
|
|
begin
|
|
GetProcedureAddress(_SymGetLineFromAddr64, ImageHlpLib, 'SymGetLineFromAddr64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetLineFromAddr64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetLineFromAddr: Pointer;
|
|
|
|
function SymGetLineFromAddr;
|
|
begin
|
|
GetProcedureAddress(_SymGetLineFromAddr, ImageHlpLib, 'SymGetLineFromAddr');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetLineFromAddr]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetLineFromName64: Pointer;
|
|
|
|
function SymGetLineFromName64;
|
|
begin
|
|
GetProcedureAddress(_SymGetLineFromName64, ImageHlpLib, 'SymGetLineFromName64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetLineFromName64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetLineFromName: Pointer;
|
|
|
|
function SymGetLineFromName;
|
|
begin
|
|
GetProcedureAddress(_SymGetLineFromName, ImageHlpLib, 'SymGetLineFromName');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetLineFromName]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetLineNext64: Pointer;
|
|
|
|
function SymGetLineNext64;
|
|
begin
|
|
GetProcedureAddress(_SymGetLineNext64, ImageHlpLib, 'SymGetLineNext64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetLineNext64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetLineNext: Pointer;
|
|
|
|
function SymGetLineNext;
|
|
begin
|
|
GetProcedureAddress(_SymGetLineNext, ImageHlpLib, 'SymGetLineNext');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetLineNext]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetLinePrev64: Pointer;
|
|
|
|
function SymGetLinePrev64;
|
|
begin
|
|
GetProcedureAddress(_SymGetLinePrev64, ImageHlpLib, 'SymGetLinePrev64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetLinePrev64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetLinePrev: Pointer;
|
|
|
|
function SymGetLinePrev;
|
|
begin
|
|
GetProcedureAddress(_SymGetLinePrev, ImageHlpLib, 'SymGetLinePrev');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetLinePrev]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymMatchFileName: Pointer;
|
|
|
|
function SymMatchFileName;
|
|
begin
|
|
GetProcedureAddress(_SymMatchFileName, ImageHlpLib, 'SymMatchFileName');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymMatchFileName]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymInitialize: Pointer;
|
|
|
|
function SymInitialize;
|
|
begin
|
|
GetProcedureAddress(_SymInitialize, ImageHlpLib, 'SymInitialize');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymInitialize]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetSearchPath: Pointer;
|
|
|
|
function SymGetSearchPath;
|
|
begin
|
|
GetProcedureAddress(_SymGetSearchPath, ImageHlpLib, 'SymGetSearchPath');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetSearchPath]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymSetSearchPath: Pointer;
|
|
|
|
function SymSetSearchPath;
|
|
begin
|
|
GetProcedureAddress(_SymSetSearchPath, ImageHlpLib, 'SymSetSearchPath');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymSetSearchPath]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymLoadModuleEx: Pointer;
|
|
|
|
function SymLoadModuleEx;
|
|
begin
|
|
GetProcedureAddress(_SymLoadModuleEx, ImageHlpLib, 'SymLoadModuleEx');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymLoadModuleEx]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymLoadModule64: Pointer;
|
|
|
|
function SymLoadModule64;
|
|
begin
|
|
GetProcedureAddress(_SymLoadModule64, ImageHlpLib, 'SymLoadModule64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymLoadModule64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymLoadModule: Pointer;
|
|
|
|
function SymLoadModule;
|
|
begin
|
|
GetProcedureAddress(_SymLoadModule, ImageHlpLib, 'SymLoadModule');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymLoadModule]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymUnloadModule64: Pointer;
|
|
|
|
function SymUnloadModule64;
|
|
begin
|
|
GetProcedureAddress(_SymUnloadModule64, ImageHlpLib, 'SymUnloadModule64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymUnloadModule64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymUnloadModule: Pointer;
|
|
|
|
function SymUnloadModule;
|
|
begin
|
|
GetProcedureAddress(_SymUnloadModule, ImageHlpLib, 'SymUnloadModule');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymUnloadModule]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymUnDName64: Pointer;
|
|
|
|
function SymUnDName64;
|
|
begin
|
|
GetProcedureAddress(_SymUnDName64, ImageHlpLib, 'SymUnDName64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymUnDName64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymUnDName: Pointer;
|
|
|
|
function SymUnDName;
|
|
begin
|
|
GetProcedureAddress(_SymUnDName, ImageHlpLib, 'SymUnDName');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymUnDName]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymRegisterCallback64: Pointer;
|
|
|
|
function SymRegisterCallback64;
|
|
begin
|
|
GetProcedureAddress(_SymRegisterCallback64, ImageHlpLib, 'SymRegisterCallback64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymRegisterCallback64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymRegFuncEntryCallback64: Pointer;
|
|
|
|
function SymRegisterFunctionEntryCallback64;
|
|
begin
|
|
GetProcedureAddress(_SymRegFuncEntryCallback64, ImageHlpLib, 'SymRegisterFunctionEntryCallback64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymRegFuncEntryCallback64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymRegisterCallback: Pointer;
|
|
|
|
function SymRegisterCallback;
|
|
begin
|
|
GetProcedureAddress(_SymRegisterCallback, ImageHlpLib, 'SymRegisterCallback');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymRegisterCallback]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymRegisterFuncEntryCallback: Pointer;
|
|
|
|
function SymRegisterFunctionEntryCallback;
|
|
begin
|
|
GetProcedureAddress(_SymRegisterFuncEntryCallback, ImageHlpLib, 'SymRegisterFunctionEntryCallback');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymRegisterFuncEntryCallback]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymSetContext: Pointer;
|
|
|
|
function SymSetContext;
|
|
begin
|
|
GetProcedureAddress(_SymSetContext, ImageHlpLib, 'SymSetContext');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymSetContext]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymFromAddr: Pointer;
|
|
|
|
function SymFromAddr;
|
|
begin
|
|
GetProcedureAddress(_SymFromAddr, ImageHlpLib, 'SymFromAddr');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymFromAddr]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymFromName: Pointer;
|
|
|
|
function SymFromName;
|
|
begin
|
|
GetProcedureAddress(_SymFromName, ImageHlpLib, 'SymFromName');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymFromName]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymEnumSymbolsForAddr: Pointer;
|
|
|
|
function SymEnumSymbolsForAddr;
|
|
begin
|
|
GetProcedureAddress(_SymEnumSymbolsForAddr, ImageHlpLib, 'SymEnumSymbolsForAddr');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymEnumSymbolsForAddr]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymEnumSymbols: Pointer;
|
|
|
|
function SymEnumSymbols;
|
|
begin
|
|
GetProcedureAddress(_SymEnumSymbols, ImageHlpLib, 'SymEnumSymbols');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymEnumSymbols]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetTypeInfo: Pointer;
|
|
|
|
function SymGetTypeInfo;
|
|
begin
|
|
GetProcedureAddress(_SymGetTypeInfo, ImageHlpLib, 'SymGetTypeInfo');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetTypeInfo]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymEnumTypes: Pointer;
|
|
|
|
function SymEnumTypes;
|
|
begin
|
|
GetProcedureAddress(_SymEnumTypes, ImageHlpLib, 'SymEnumTypes');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymEnumTypes]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetTypeFromName: Pointer;
|
|
|
|
function SymGetTypeFromName;
|
|
begin
|
|
GetProcedureAddress(_SymGetTypeFromName, ImageHlpLib, 'SymGetTypeFromName');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetTypeFromName]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymAddSymbol: Pointer;
|
|
|
|
function SymAddSymbol;
|
|
begin
|
|
GetProcedureAddress(_SymAddSymbol, ImageHlpLib, 'SymAddSymbol');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymAddSymbol]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymDeleteSymbol: Pointer;
|
|
|
|
function SymDeleteSymbol;
|
|
begin
|
|
GetProcedureAddress(_SymDeleteSymbol, ImageHlpLib, 'SymDeleteSymbol');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymDeleteSymbol]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_DbgHelpCreateUserDump: Pointer;
|
|
|
|
function DbgHelpCreateUserDump;
|
|
begin
|
|
GetProcedureAddress(_DbgHelpCreateUserDump, ImageHlpLib, 'DbgHelpCreateUserDump');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_DbgHelpCreateUserDump]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_DbgHelpCreateUserDumpW: Pointer;
|
|
|
|
function DbgHelpCreateUserDumpW;
|
|
begin
|
|
GetProcedureAddress(_DbgHelpCreateUserDumpW, ImageHlpLib, 'DbgHelpCreateUserDumpW');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_DbgHelpCreateUserDumpW]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetSymFromAddr64: Pointer;
|
|
|
|
function SymGetSymFromAddr64;
|
|
begin
|
|
GetProcedureAddress(_SymGetSymFromAddr64, ImageHlpLib, 'SymGetSymFromAddr64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetSymFromAddr64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetSymFromAddr: Pointer;
|
|
|
|
function SymGetSymFromAddr;
|
|
begin
|
|
GetProcedureAddress(_SymGetSymFromAddr, ImageHlpLib, 'SymGetSymFromAddr');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetSymFromAddr]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetSymFromName64: Pointer;
|
|
|
|
function SymGetSymFromName64;
|
|
begin
|
|
GetProcedureAddress(_SymGetSymFromName64, ImageHlpLib, 'SymGetSymFromName64');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetSymFromName64]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymGetSymFromName: Pointer;
|
|
|
|
function SymGetSymFromName;
|
|
begin
|
|
GetProcedureAddress(_SymGetSymFromName, ImageHlpLib, 'SymGetSymFromName');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymGetSymFromName]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_FindFileInPath: Pointer;
|
|
|
|
function FindFileInPath;
|
|
begin
|
|
GetProcedureAddress(_FindFileInPath, ImageHlpLib, 'FindFileInPath');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_FindFileInPath]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_FindFileInSearchPath: Pointer;
|
|
|
|
function FindFileInSearchPath;
|
|
begin
|
|
GetProcedureAddress(_FindFileInSearchPath, ImageHlpLib, 'FindFileInSearchPath');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_FindFileInSearchPath]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_SymEnumSym: Pointer;
|
|
|
|
function SymEnumSym;
|
|
begin
|
|
GetProcedureAddress(_SymEnumSym, ImageHlpLib, 'SymEnumSym');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_SymEnumSym]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_MiniDumpWriteDump: Pointer;
|
|
|
|
function MiniDumpWriteDump;
|
|
begin
|
|
GetProcedureAddress(_MiniDumpWriteDump, ImageHlpLib, 'MiniDumpWriteDump');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_MiniDumpWriteDump]
|
|
end;
|
|
end;
|
|
|
|
var
|
|
_MiniDumpReadDumpStream: Pointer;
|
|
|
|
function MiniDumpReadDumpStream;
|
|
begin
|
|
GetProcedureAddress(_MiniDumpReadDumpStream, ImageHlpLib, 'MiniDumpReadDumpStream');
|
|
asm
|
|
MOV ESP, EBP
|
|
POP EBP
|
|
JMP [_MiniDumpReadDumpStream]
|
|
end;
|
|
end;
|
|
|
|
|
|
{$ELSE}
|
|
|
|
function BindImage; external ImageHlpLib name 'BindImage';
|
|
function BindImageEx; external ImageHlpLib name 'BindImageEx';
|
|
function ReBaseImage; external ImageHlpLib name 'ReBaseImage';
|
|
function ReBaseImage64; external ImageHlpLib name 'ReBaseImage64';
|
|
function CheckSumMappedFile; external ImageHlpLib name 'CheckSumMappedFile';
|
|
function MapFileAndCheckSumA; external ImageHlpLib name 'MapFileAndCheckSumA';
|
|
function MapFileAndCheckSumW; external ImageHlpLib name 'MapFileAndCheckSumW';
|
|
function MapFileAndCheckSum; external ImageHlpLib name 'MapFileAndCheckSum' + AWSuffix;
|
|
function GetImageConfigInformation; external ImageHlpLib name 'GetImageConfigInformation';
|
|
function GetImageUnusedHeaderBytes; external ImageHlpLib name 'GetImageUnusedHeaderBytes';
|
|
function SetImageConfigInformation; external ImageHlpLib name 'SetImageConfigInformation';
|
|
function ImageGetDigestStream; external ImageHlpLib name 'ImageGetDigestStream';
|
|
function ImageAddCertificate; external ImageHlpLib name 'ImageAddCertificate';
|
|
function ImageRemoveCertificate; external ImageHlpLib name 'ImageRemoveCertificate';
|
|
function ImageEnumerateCertificates; external ImageHlpLib name 'ImageEnumerateCertificates';
|
|
function ImageGetCertificateData; external ImageHlpLib name 'ImageGetCertificateData';
|
|
function ImageGetCertificateHeader; external ImageHlpLib name 'ImageGetCertificateHeader';
|
|
function ImageLoad; external ImageHlpLib name 'ImageLoad';
|
|
function ImageUnload; external ImageHlpLib name 'ImageUnload';
|
|
function MapAndLoad; external ImageHlpLib name 'MapAndLoad';
|
|
function UnMapAndLoad; external ImageHlpLib name 'UnMapAndLoad';
|
|
function TouchFileTimes; external ImageHlpLib name 'TouchFileTimes';
|
|
function SplitSymbols; external ImageHlpLib name 'SplitSymbols';
|
|
function UpdateDebugInfoFile; external ImageHlpLib name 'UpdateDebugInfoFile';
|
|
function UpdateDebugInfoFileEx; external ImageHlpLib name 'UpdateDebugInfoFileEx';
|
|
function FindDebugInfoFile; external ImageHlpLib name 'FindDebugInfoFile';
|
|
function FindDebugInfoFileEx; external ImageHlpLib name 'FindDebugInfoFileEx';
|
|
function SymFindFileInPath; external ImageHlpLib name 'SymFindFileInPath';
|
|
function FindExecutableImage; external ImageHlpLib name 'FindExecutableImage';
|
|
function FindExecutableImageEx; external ImageHlpLib name 'FindExecutableImageEx';
|
|
function ImageNtHeader; external ImageHlpLib name 'ImageNtHeader';
|
|
function ImageDirectoryEntryToDataEx; external ImageHlpLib name 'ImageDirectoryEntryToDataEx';
|
|
function ImageDirectoryEntryToData; external ImageHlpLib name 'ImageDirectoryEntryToData';
|
|
function ImageRvaToSection; external ImageHlpLib name 'ImageRvaToSection';
|
|
function ImageRvaToVa; external ImageHlpLib name 'ImageRvaToVa';
|
|
function MapDebugInformation; external ImageHlpLib name 'MapDebugInformation';
|
|
function UnmapDebugInformation; external ImageHlpLib name 'UnmapDebugInformation';
|
|
function SearchTreeForFile; external ImageHlpLib name 'SearchTreeForFile';
|
|
function EnumDirTree; external ImageHlpLib name 'EnumDirTree';
|
|
function MakeSureDirectoryPathExists; external ImageHlpLib name 'MakeSureDirectoryPathExists';
|
|
function UnDecorateSymbolName; external ImageHlpLib name 'UnDecorateSymbolName';
|
|
function StackWalk64; external ImageHlpLib name 'StackWalk64';
|
|
function StackWalk; external ImageHlpLib name 'StackWalk';
|
|
function ImagehlpApiVersion; external ImageHlpLib name 'ImagehlpApiVersion';
|
|
function ImagehlpApiVersionEx; external ImageHlpLib name 'ImagehlpApiVersionEx';
|
|
function GetTimestampForLoadedLibrary; external ImageHlpLib name 'GetTimestampForLoadedLibrary';
|
|
function SymSetOptions; external ImageHlpLib name 'SymSetOptions';
|
|
function SymGetOptions; external ImageHlpLib name 'SymGetOptions';
|
|
function SymCleanup; external ImageHlpLib name 'SymCleanup';
|
|
function SymMatchString; external ImageHlpLib name 'SymMatchString';
|
|
function SymEnumSourceFiles; external ImageHlpLib name 'SymEnumSourceFiles';
|
|
function SymEnumerateModules64; external ImageHlpLib name 'SymEnumerateModules64';
|
|
function SymEnumerateModules; external ImageHlpLib name 'SymEnumerateModules';
|
|
function SymEnumerateSymbols64; external ImageHlpLib name 'SymEnumerateSymbols64';
|
|
function SymEnumerateSymbolsW64; external ImageHlpLib name 'SymEnumerateSymbolsW64';
|
|
function SymEnumerateSymbols; external ImageHlpLib name 'SymEnumerateSymbols';
|
|
function SymEnumerateSymbolsW; external ImageHlpLib name 'SymEnumerateSymbolsW';
|
|
function EnumerateLoadedModules64; external ImageHlpLib name 'EnumerateLoadedModules64';
|
|
function EnumerateLoadedModules; external ImageHlpLib name 'EnumerateLoadedModules';
|
|
function SymFunctionTableAccess64; external ImageHlpLib name 'SymFunctionTableAccess64';
|
|
function SymFunctionTableAccess; external ImageHlpLib name 'SymFunctionTableAccess';
|
|
function SymGetModuleInfo64; external ImageHlpLib name 'SymGetModuleInfo64';
|
|
function SymGetModuleInfoW64; external ImageHlpLib name 'SymGetModuleInfoW64';
|
|
function SymGetModuleInfo; external ImageHlpLib name 'SymGetModuleInfo';
|
|
function SymGetModuleInfoW; external ImageHlpLib name 'SymGetModuleInfoW';
|
|
function SymGetModuleBase64; external ImageHlpLib name 'SymGetModuleBase64';
|
|
function SymGetModuleBase; external ImageHlpLib name 'SymGetModuleBase';
|
|
function SymGetSymNext64; external ImageHlpLib name 'SymGetSymNext64';
|
|
function SymGetSymNext; external ImageHlpLib name 'SymGetSymNext';
|
|
function SymGetSymPrev64; external ImageHlpLib name 'SymGetSymPrev64';
|
|
function SymGetSymPrev; external ImageHlpLib name 'SymGetSymPrev';
|
|
function SymGetLineFromAddr64; external ImageHlpLib name 'SymGetLineFromAddr64';
|
|
function SymGetLineFromAddr; external ImageHlpLib name 'SymGetLineFromAddr';
|
|
function SymGetLineFromName64; external ImageHlpLib name 'SymGetLineFromName64';
|
|
function SymGetLineFromName; external ImageHlpLib name 'SymGetLineFromName';
|
|
function SymGetLineNext64; external ImageHlpLib name 'SymGetLineNext64';
|
|
function SymGetLineNext; external ImageHlpLib name 'SymGetLineNext';
|
|
function SymGetLinePrev64; external ImageHlpLib name 'SymGetLinePrev64';
|
|
function SymGetLinePrev; external ImageHlpLib name 'SymGetLinePrev';
|
|
function SymMatchFileName; external ImageHlpLib name 'SymMatchFileName';
|
|
function SymInitialize; external ImageHlpLib name 'SymInitialize';
|
|
function SymGetSearchPath; external ImageHlpLib name 'SymGetSearchPath';
|
|
function SymSetSearchPath; external ImageHlpLib name 'SymSetSearchPath';
|
|
function SymLoadModuleEx; external ImageHlpLib name 'SymLoadModuleEx';
|
|
function SymLoadModule64; external ImageHlpLib name 'SymLoadModule64';
|
|
function SymLoadModule; external ImageHlpLib name 'SymLoadModule';
|
|
function SymUnloadModule64; external ImageHlpLib name 'SymUnloadModule64';
|
|
function SymUnloadModule; external ImageHlpLib name 'SymUnloadModule';
|
|
function SymUnDName64; external ImageHlpLib name 'SymUnDName64';
|
|
function SymUnDName; external ImageHlpLib name 'SymUnDName';
|
|
function SymRegisterCallback64; external ImageHlpLib name 'SymRegisterCallback64';
|
|
function SymRegisterFunctionEntryCallback64; external ImageHlpLib name 'SymRegisterFunctionEntryCallback64';
|
|
function SymRegisterCallback; external ImageHlpLib name 'SymRegisterCallback';
|
|
function SymRegisterFunctionEntryCallback; external ImageHlpLib name 'SymRegisterFunctionEntryCallback';
|
|
function SymSetContext; external ImageHlpLib name 'SymSetContext';
|
|
function SymFromAddr; external ImageHlpLib name 'SymFromAddr';
|
|
function SymFromName; external ImageHlpLib name 'SymFromName';
|
|
function SymEnumSymbolsForAddr; external ImageHlpLib name 'SymEnumSymbolsForAddr';
|
|
function SymEnumSymbols; external ImageHlpLib name 'SymEnumSymbols';
|
|
function SymGetTypeInfo; external ImageHlpLib name 'SymGetTypeInfo';
|
|
function SymEnumTypes; external ImageHlpLib name 'SymEnumTypes';
|
|
function SymGetTypeFromName; external ImageHlpLib name 'SymGetTypeFromName';
|
|
function SymAddSymbol; external ImageHlpLib name 'SymAddSymbol';
|
|
function SymDeleteSymbol; external ImageHlpLib name 'SymDeleteSymbol';
|
|
function DbgHelpCreateUserDump; external ImageHlpLib name 'DbgHelpCreateUserDump';
|
|
function DbgHelpCreateUserDumpW; external ImageHlpLib name 'DbgHelpCreateUserDumpW';
|
|
function SymGetSymFromAddr64; external ImageHlpLib name 'SymGetSymFromAddr64';
|
|
function SymGetSymFromAddr; external ImageHlpLib name 'SymGetSymFromAddr';
|
|
function SymGetSymFromName64; external ImageHlpLib name 'SymGetSymFromName64';
|
|
function SymGetSymFromName; external ImageHlpLib name 'SymGetSymFromName';
|
|
function FindFileInPath; external ImageHlpLib name 'FindFileInPath';
|
|
function FindFileInSearchPath; external ImageHlpLib name 'FindFileInSearchPath';
|
|
function SymEnumSym; external ImageHlpLib name 'SymEnumSym';
|
|
function MiniDumpWriteDump; external ImageHlpLib name 'MiniDumpWriteDump';
|
|
function MiniDumpReadDumpStream; external ImageHlpLib name 'MiniDumpReadDumpStream';
|
|
|
|
{$ENDIF DYNAMIC_LINK}
|
|
|
|
{$ENDIF JWA_INTERFACESECTION}
|
|
|
|
{$IFNDEF JWA_OMIT_SECTIONS}
|
|
end.
|
|
{$ENDIF JWA_OMIT_SECTIONS}
|