jwaimagehlp.pas 135 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401
  1. {******************************************************************************}
  2. { }
  3. { Image Help API interface Unit for Object Pascal }
  4. { }
  5. { Portions created by Microsoft are Copyright (C) 1995-2001 Microsoft }
  6. { Corporation. All Rights Reserved. }
  7. { }
  8. { The original file is: imagehlp.h, released August 2001. The original Pascal }
  9. { code is: ImageHelp.pas, released December 2000. The initial developer of the }
  10. { Pascal code is Marcel van Brakel (brakelm att chello dott nl). }
  11. { }
  12. { Portions created by Marcel van Brakel are Copyright (C) 1999-2001 }
  13. { Marcel van Brakel. All Rights Reserved. }
  14. { }
  15. { Obtained through: Joint Endeavour of Delphi Innovators (Project JEDI) }
  16. { }
  17. { You may retrieve the latest version of this file at the Project JEDI }
  18. { APILIB home page, located at http://jedi-apilib.sourceforge.net }
  19. { }
  20. { The contents of this file are used with permission, subject to the Mozilla }
  21. { Public License Version 1.1 (the "License"); you may not use this file except }
  22. { in compliance with the License. You may obtain a copy of the License at }
  23. { http://www.mozilla.org/MPL/MPL-1.1.html }
  24. { }
  25. { Software distributed under the License is distributed on an "AS IS" basis, }
  26. { WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for }
  27. { the specific language governing rights and limitations under the License. }
  28. { }
  29. { Alternatively, the contents of this file may be used under the terms of the }
  30. { GNU Lesser General Public License (the "LGPL License"), in which case the }
  31. { provisions of the LGPL License are applicable instead of those above. }
  32. { If you wish to allow use of your version of this file only under the terms }
  33. { of the LGPL License and not to allow others to use your version of this file }
  34. { under the MPL, indicate your decision by deleting the provisions above and }
  35. { replace them with the notice and other provisions required by the LGPL }
  36. { License. If you do not delete the provisions above, a recipient may use }
  37. { your version of this file under either the MPL or the LGPL License. }
  38. { }
  39. { For more information about the LGPL: http://www.gnu.org/copyleft/lesser.html }
  40. { }
  41. {******************************************************************************}
  42. unit JwaImageHlp;
  43. {$WEAKPACKAGEUNIT}
  44. {$HPPEMIT ''}
  45. {$HPPEMIT '#include "ImageHlp.h"'}
  46. {$HPPEMIT ''}
  47. {$I jediapilib.inc}
  48. interface
  49. uses
  50. Windows, JwaWinBase, JwaWinNT, JwaWinType;
  51. const
  52. IMAGE_SEPARATION = 64*1024;
  53. {$EXTERNALSYM IMAGE_SEPARATION}
  54. type
  55. PLOADED_IMAGE = ^LOADED_IMAGE;
  56. {$EXTERNALSYM PLOADED_IMAGE}
  57. _LOADED_IMAGE = record
  58. ModuleName: PSTR;
  59. hFile: HANDLE;
  60. MappedAddress: PUCHAR;
  61. FileHeader: PIMAGE_NT_HEADERS32;
  62. LastRvaSection: PIMAGE_SECTION_HEADER;
  63. NumberOfSections: ULONG;
  64. Sections: PIMAGE_SECTION_HEADER;
  65. Characteristics: ULONG;
  66. fSystemImage: ByteBool;
  67. fDOSImage: ByteBool;
  68. Links: LIST_ENTRY;
  69. SizeOfImage: ULONG;
  70. end;
  71. {$EXTERNALSYM _LOADED_IMAGE}
  72. LOADED_IMAGE = _LOADED_IMAGE;
  73. {$EXTERNALSYM LOADED_IMAGE}
  74. TLoadedImage = LOADED_IMAGE;
  75. PLoadedImage = PLOADED_IMAGE;
  76. const
  77. MAX_SYM_NAME = 2000;
  78. {$EXTERNALSYM MAX_SYM_NAME}
  79. function BindImage(ImageName, DllPath, SymbolPath: PSTR): BOOL; stdcall;
  80. {$EXTERNALSYM BindImage}
  81. type
  82. _IMAGEHLP_STATUS_REASON = (
  83. BindOutOfMemory,
  84. BindRvaToVaFailed,
  85. BindNoRoomInImage,
  86. BindImportModuleFailed,
  87. BindImportProcedureFailed,
  88. BindImportModule,
  89. BindImportProcedure,
  90. BindForwarder,
  91. BindForwarderNOT,
  92. BindImageModified,
  93. BindExpandFileHeaders,
  94. BindImageComplete,
  95. BindMismatchedSymbols,
  96. BindSymbolsNotUpdated,
  97. BindImportProcedure32,
  98. BindImportProcedure64,
  99. BindForwarder32,
  100. BindForwarder64,
  101. BindForwarderNOT32,
  102. BindForwarderNOT64);
  103. {$EXTERNALSYM _IMAGEHLP_STATUS_REASON}
  104. IMAGEHLP_STATUS_REASON = _IMAGEHLP_STATUS_REASON;
  105. {$EXTERNALSYM IMAGEHLP_STATUS_REASON}
  106. TImageHlpStatusReason = IMAGEHLP_STATUS_REASON;
  107. PIMAGEHLP_STATUS_ROUTINE = function(Reason: IMAGEHLP_STATUS_REASON;
  108. ImageName, DllName: PSTR; Va, Parameter: ULONG_PTR): BOOL; stdcall;
  109. {$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE}
  110. PImageHlpStatusRoutine = PIMAGEHLP_STATUS_ROUTINE;
  111. PIMAGEHLP_STATUS_ROUTINE32 = function(Reason: IMAGEHLP_STATUS_REASON; ImageName, DllName: PSTR;
  112. Va: ULONG; Parameter: ULONG_PTR): BOOL; stdcall;
  113. {$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE32}
  114. PImageHlpStatusRoutine23 = PIMAGEHLP_STATUS_ROUTINE32;
  115. PIMAGEHLP_STATUS_ROUTINE64 = function(Reason: IMAGEHLP_STATUS_REASON; ImageName, DllName: PSTR;
  116. Va: ULONG64; Parameter: ULONG_PTR): BOOL; stdcall;
  117. {$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE64}
  118. PImageHlpStatusRoutine64 = PIMAGEHLP_STATUS_ROUTINE64;
  119. function BindImageEx(Flags: DWORD; ImageName, DllPath, SymbolPath: PSTR;
  120. StatusRoutine: PIMAGEHLP_STATUS_ROUTINE): BOOL; stdcall;
  121. {$EXTERNALSYM BindImageEx}
  122. const
  123. BIND_NO_BOUND_IMPORTS = $00000001;
  124. {$EXTERNALSYM BIND_NO_BOUND_IMPORTS}
  125. BIND_NO_UPDATE = $00000002;
  126. {$EXTERNALSYM BIND_NO_UPDATE}
  127. BIND_ALL_IMAGES = $00000004;
  128. {$EXTERNALSYM BIND_ALL_IMAGES}
  129. BIND_CACHE_IMPORT_DLLS = $00000008; // Cache dll's across calls to BindImageEx (same as NT 3.1->NT 4.0)
  130. {$EXTERNALSYM BIND_CACHE_IMPORT_DLLS}
  131. BIND_REPORT_64BIT_VA = $00000010;
  132. {$EXTERNALSYM BIND_REPORT_64BIT_VA}
  133. function ReBaseImage(CurrentImageName: PSTR; SymbolPath: PSTR; fReBase: BOOL;
  134. fRebaseSysfileOk: BOOL; fGoingDown: BOOL; CheckImageSize: ULONG;
  135. var OldImageSize: ULONG; var OldImageBase: ULONG_PTR; var NewImageSize: ULONG;
  136. var NewImageBase: ULONG_PTR; TimeStamp: ULONG): BOOL; stdcall;
  137. {$EXTERNALSYM ReBaseImage}
  138. function ReBaseImage64(CurrentImageName: PSTR; SymbolPath: PSTR; fReBase: BOOL;
  139. fRebaseSysfileOk: BOOL; fGoingDown: BOOL; CheckImageSize: ULONG;
  140. var OldImageSize: ULONG; var OldImageBase: ULONG64; var NewImageSize: ULONG;
  141. var NewImageBase: ULONG64; TimeStamp: ULONG): BOOL; stdcall;
  142. {$EXTERNALSYM ReBaseImage64}
  143. //
  144. // Define checksum return codes.
  145. //
  146. const
  147. CHECKSUM_SUCCESS = 0;
  148. {$EXTERNALSYM CHECKSUM_SUCCESS}
  149. CHECKSUM_OPEN_FAILURE = 1;
  150. {$EXTERNALSYM CHECKSUM_OPEN_FAILURE}
  151. CHECKSUM_MAP_FAILURE = 2;
  152. {$EXTERNALSYM CHECKSUM_MAP_FAILURE}
  153. CHECKSUM_MAPVIEW_FAILURE = 3;
  154. {$EXTERNALSYM CHECKSUM_MAPVIEW_FAILURE}
  155. CHECKSUM_UNICODE_FAILURE = 4;
  156. {$EXTERNALSYM CHECKSUM_UNICODE_FAILURE}
  157. // Define Splitsym flags.
  158. SPLITSYM_REMOVE_PRIVATE = $00000001; // Remove CV types/symbols and Fixup debug
  159. {$EXTERNALSYM SPLITSYM_REMOVE_PRIVATE}
  160. // Used for creating .dbg files that ship
  161. // as part of the product.
  162. SPLITSYM_EXTRACT_ALL = $00000002; // Extract all debug info from image.
  163. {$EXTERNALSYM SPLITSYM_EXTRACT_ALL}
  164. // Normally, FPO is left in the image
  165. // to allow stack traces through the code.
  166. // Using this switch is similar to linking
  167. // with -debug:none except the .dbg file
  168. // exists...
  169. SPLITSYM_SYMBOLPATH_IS_SRC = $00000004; // The SymbolFilePath contains an alternate
  170. {$EXTERNALSYM SPLITSYM_SYMBOLPATH_IS_SRC}
  171. // path to locate the pdb.
  172. //
  173. // Define checksum function prototypes.
  174. //
  175. function CheckSumMappedFile(BaseAddress: PVOID; FileLength: DWORD;
  176. var HeaderSum, CheckSum: DWORD): PIMAGE_NT_HEADERS; stdcall;
  177. {$EXTERNALSYM CheckSumMappedFile}
  178. function MapFileAndCheckSumA(Filename: PSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
  179. {$EXTERNALSYM MapFileAndCheckSumA}
  180. function MapFileAndCheckSumW(Filename: PWSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
  181. {$EXTERNALSYM MapFileAndCheckSumW}
  182. function MapFileAndCheckSum(Filename: PTSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
  183. {$EXTERNALSYM MapFileAndCheckSum}
  184. function GetImageConfigInformation(const LoadedImage: LOADED_IMAGE;
  185. var ImageConfigInformation: IMAGE_LOAD_CONFIG_DIRECTORY): BOOL; stdcall;
  186. {$EXTERNALSYM GetImageConfigInformation}
  187. function GetImageUnusedHeaderBytes(const LoadedImage: LOADED_IMAGE;
  188. var SizeUnusedHeaderBytes: DWORD): DWORD; stdcall;
  189. {$EXTERNALSYM GetImageUnusedHeaderBytes}
  190. function SetImageConfigInformation(const LoadedImage: LOADED_IMAGE;
  191. const ImageConfigInformation: IMAGE_LOAD_CONFIG_DIRECTORY): BOOL; stdcall;
  192. {$EXTERNALSYM SetImageConfigInformation}
  193. // Image Integrity API's
  194. const
  195. CERT_PE_IMAGE_DIGEST_DEBUG_INFO = $01;
  196. {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_DEBUG_INFO}
  197. CERT_PE_IMAGE_DIGEST_RESOURCES = $02;
  198. {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_RESOURCES}
  199. CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO = $04;
  200. {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO}
  201. CERT_PE_IMAGE_DIGEST_NON_PE_INFO = $08; // include data outside the PE image
  202. {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_NON_PE_INFO}
  203. CERT_SECTION_TYPE_ANY = $FF; // Any Certificate type
  204. {$EXTERNALSYM CERT_SECTION_TYPE_ANY}
  205. type
  206. DIGEST_HANDLE = PVOID;
  207. {$EXTERNALSYM DIGEST_HANDLE}
  208. TDigestHandle = DIGEST_HANDLE;
  209. DIGEST_FUNCTION = function(refdata: DIGEST_HANDLE; pData: PBYTE; dwLength: DWORD): BOOL; stdcall;
  210. {$EXTERNALSYM DIGEST_FUNCTION}
  211. TDigestFunction = DIGEST_FUNCTION;
  212. function ImageGetDigestStream(FileHandle: HANDLE; DigestLevel: DWORD;
  213. DigestFunction: DIGEST_FUNCTION; DigestHandle: DIGEST_HANDLE): BOOL; stdcall;
  214. {$EXTERNALSYM ImageGetDigestStream}
  215. function ImageAddCertificate(FileHandle: HANDLE; Certificate: PWinCertificate;
  216. var Index: DWORD): BOOL; stdcall;
  217. {$EXTERNALSYM ImageAddCertificate}
  218. function ImageRemoveCertificate(FileHandle: HANDLE; Index: DWORD): BOOL; stdcall;
  219. {$EXTERNALSYM ImageRemoveCertificate}
  220. function ImageEnumerateCertificates(FileHandle: HANDLE; TypeFilter: WORD;
  221. var CertificateCount: DWORD; Indices: PDWORD; IndexCount: DWORD): BOOL; stdcall;
  222. {$EXTERNALSYM ImageEnumerateCertificates}
  223. function ImageGetCertificateData(FileHandle: HANDLE; CertificateIndex: DWORD;
  224. Certificate: PWinCertificate; var RequiredLength: DWORD): BOOL; stdcall;
  225. {$EXTERNALSYM ImageGetCertificateData}
  226. function ImageGetCertificateHeader(FileHandle: HANDLE; CertificateIndex: DWORD;
  227. Certificateheader: PWinCertificate): BOOL; stdcall;
  228. {$EXTERNALSYM ImageGetCertificateHeader}
  229. function ImageLoad(DllName: PSTR; DllPath: PSTR): PLOADED_IMAGE; stdcall;
  230. {$EXTERNALSYM ImageLoad}
  231. function ImageUnload(const LoadedImage: LOADED_IMAGE): BOOL; stdcall;
  232. {$EXTERNALSYM ImageUnload}
  233. function MapAndLoad(ImageName, DllPath: PSTR; var LoadedImage: LOADED_IMAGE;
  234. DotDll: BOOL; ReadOnly: BOOL): BOOL; stdcall;
  235. {$EXTERNALSYM MapAndLoad}
  236. function UnMapAndLoad(const LoadedImage: LOADED_IMAGE): BOOL; stdcall;
  237. {$EXTERNALSYM UnMapAndLoad}
  238. function TouchFileTimes(FileHandle: HANDLE; pSystemTime: PSYSTEMTIME): BOOL; stdcall;
  239. {$EXTERNALSYM TouchFileTimes}
  240. function SplitSymbols(ImageName, SymbolsPath, SymbolFilePath: PSTR; Flags: DWORD): BOOL; stdcall;
  241. {$EXTERNALSYM SplitSymbols}
  242. function UpdateDebugInfoFile(ImageFileName, SymbolPath, DebugFilePath: PSTR;
  243. const NtHeaders: IMAGE_NT_HEADERS32): BOOL; stdcall;
  244. {$EXTERNALSYM UpdateDebugInfoFile}
  245. function UpdateDebugInfoFileEx(ImageFileName, SymbolPath, DebugFilePath: PSTR;
  246. const NtHeaders: IMAGE_NT_HEADERS32; OldChecksum: DWORD): BOOL; stdcall;
  247. {$EXTERNALSYM UpdateDebugInfoFileEx}
  248. function FindDebugInfoFile(FileName, SymbolPath, DebugFilePath: PSTR): HANDLE; stdcall;
  249. {$EXTERNALSYM FindDebugInfoFile}
  250. type
  251. PFIND_DEBUG_FILE_CALLBACK = function(FileHandle: HANDLE; FileName: PSTR;
  252. CallerData: PVOID): BOOL; stdcall;
  253. {$EXTERNALSYM PFIND_DEBUG_FILE_CALLBACK}
  254. PFindDebugFileCallback = PFIND_DEBUG_FILE_CALLBACK;
  255. function FindDebugInfoFileEx(FileName, SymbolPath, DebugFilePath: PSTR;
  256. Callback: PFIND_DEBUG_FILE_CALLBACK; CallerData: PVOID): HANDLE; stdcall;
  257. {$EXTERNALSYM FindDebugInfoFileEx}
  258. type
  259. PFINDFILEINPATHCALLBACK = function(filename: PSTR; context: PVOID): BOOL; stdcall;
  260. {$EXTERNALSYM PFINDFILEINPATHCALLBACK}
  261. function SymFindFileInPath(hprocess: HANDLE; SearchPath, FileName: LPSTR; id: PVOID; two, three, flags: DWORD;
  262. FoundFile: LPSTR; callback: PFINDFILEINPATHCALLBACK; context: PVOID): BOOL; stdcall;
  263. {$EXTERNALSYM SymFindFileInPath}
  264. function FindExecutableImage(FileName, SymbolPath, ImageFilePath: PSTR): HANDLE; stdcall;
  265. {$EXTERNALSYM FindExecutableImage}
  266. type
  267. PFIND_EXE_FILE_CALLBACK = function(FileHandle: HANDLE; FileName: PSTR;
  268. CallerData: PVOID): BOOL; stdcall;
  269. {$EXTERNALSYM PFIND_EXE_FILE_CALLBACK}
  270. PFindExeFileCallback = PFIND_EXE_FILE_CALLBACK;
  271. function FindExecutableImageEx(FileName, SymbolPath, ImageFilePath: PSTR;
  272. Callback: PFIND_EXE_FILE_CALLBACK; CallerData: PVOID): HANDLE; stdcall;
  273. {$EXTERNALSYM FindExecutableImageEx}
  274. function ImageNtHeader(Base: PVOID): PIMAGE_NT_HEADERS; stdcall;
  275. {$EXTERNALSYM ImageNtHeader}
  276. function ImageDirectoryEntryToDataEx(Base: PVOID; MappedAsImage: ByteBool;
  277. DirectoryEntry: USHORT; var Size: ULONG; var FoundHeader: PIMAGE_SECTION_HEADER): PVOID; stdcall;
  278. {$EXTERNALSYM ImageDirectoryEntryToDataEx}
  279. function ImageDirectoryEntryToData(Base: PVOID; MappedAsImage: ByteBool;
  280. DirectoryEntry: USHORT; var Size: ULONG): PVOID; stdcall;
  281. {$EXTERNALSYM ImageDirectoryEntryToData}
  282. function ImageRvaToSection(NtHeaders: PIMAGE_NT_HEADERS; Base: PVOID; Rva: ULONG): PIMAGE_SECTION_HEADER; stdcall;
  283. {$EXTERNALSYM ImageRvaToSection}
  284. function ImageRvaToVa(NtHeaders: PIMAGE_NT_HEADERS; Base: PVOID; Rva: ULONG;
  285. var LastRvaSection: PIMAGE_SECTION_HEADER): PVOID; stdcall;
  286. {$EXTERNALSYM ImageRvaToVa}
  287. // Symbol server exports
  288. type
  289. PSYMBOLSERVERPROC = function(a1, a2: LPCSTR; a3: PVOID; a4, a5: DWORD; a6: LPSTR): BOOL; stdcall;
  290. {$EXTERNALSYM PSYMBOLSERVERPROC}
  291. PSYMBOLSERVEROPENPROC = function: BOOL; stdcall;
  292. {$EXTERNALSYM PSYMBOLSERVEROPENPROC}
  293. PSYMBOLSERVERCLOSEPROC = function: BOOL; stdcall;
  294. {$EXTERNALSYM PSYMBOLSERVERCLOSEPROC}
  295. PSYMBOLSERVERSETOPTIONSPROC = function(a1: UINT_PTR; a2: ULONG64): BOOL; stdcall;
  296. {$EXTERNALSYM PSYMBOLSERVERSETOPTIONSPROC}
  297. PSYMBOLSERVERCALLBACKPROC = function(action: UINT_PTR; data: ULONG64; context: ULONG64): BOOL; stdcall;
  298. {$EXTERNALSYM PSYMBOLSERVERCALLBACKPROC}
  299. PSYMBOLSERVERGETOPTIONSPROC = function: UINT_PTR; stdcall;
  300. {$EXTERNALSYM PSYMBOLSERVERGETOPTIONSPROC}
  301. PSYMBOLSERVERPINGPROC = function(a1: LPCSTR): BOOL; stdcall;
  302. {$EXTERNALSYM PSYMBOLSERVERPINGPROC}
  303. const
  304. SSRVOPT_CALLBACK = $01;
  305. {$EXTERNALSYM SSRVOPT_CALLBACK}
  306. SSRVOPT_DWORD = $02;
  307. {$EXTERNALSYM SSRVOPT_DWORD}
  308. SSRVOPT_DWORDPTR = $04;
  309. {$EXTERNALSYM SSRVOPT_DWORDPTR}
  310. SSRVOPT_GUIDPTR = $08;
  311. {$EXTERNALSYM SSRVOPT_GUIDPTR}
  312. SSRVOPT_OLDGUIDPTR = $10;
  313. {$EXTERNALSYM SSRVOPT_OLDGUIDPTR}
  314. SSRVOPT_UNATTENDED = $20;
  315. {$EXTERNALSYM SSRVOPT_UNATTENDED}
  316. SSRVOPT_RESET = ULONG_PTR(-1);
  317. {$EXTERNALSYM SSRVOPT_RESET}
  318. SSRVACTION_TRACE = 1;
  319. {$EXTERNALSYM SSRVACTION_TRACE}
  320. // This api won't be ported to Win64 - Fix your code.
  321. type
  322. PIMAGE_DEBUG_INFORMATION = ^IMAGE_DEBUG_INFORMATION;
  323. {$EXTERNALSYM PIMAGE_DEBUG_INFORMATION}
  324. _IMAGE_DEBUG_INFORMATION = record
  325. List: LIST_ENTRY;
  326. ReservedSize: DWORD;
  327. ReservedMappedBase: PVOID;
  328. ReservedMachine: USHORT;
  329. ReservedCharacteristics: USHORT;
  330. ReservedCheckSum: DWORD;
  331. ImageBase: DWORD;
  332. SizeOfImage: DWORD;
  333. ReservedNumberOfSections: DWORD;
  334. ReservedSections: PIMAGE_SECTION_HEADER;
  335. ReservedExportedNamesSize: DWORD;
  336. ReservedExportedNames: PSTR;
  337. ReservedNumberOfFunctionTableEntries: DWORD;
  338. ReservedFunctionTableEntries: PIMAGE_FUNCTION_ENTRY;
  339. ReservedLowestFunctionStartingAddress: DWORD;
  340. ReservedHighestFunctionEndingAddress: DWORD;
  341. ReservedNumberOfFpoTableEntries: DWORD;
  342. ReservedFpoTableEntries: PFPO_DATA;
  343. SizeOfCoffSymbols: DWORD;
  344. CoffSymbols: PIMAGE_COFF_SYMBOLS_HEADER;
  345. ReservedSizeOfCodeViewSymbols: DWORD;
  346. ReservedCodeViewSymbols: PVOID;
  347. ImageFilePath: PSTR;
  348. ImageFileName: PSTR;
  349. ReservedDebugFilePath: PSTR;
  350. ReservedTimeDateStamp: DWORD;
  351. ReservedRomImage: BOOL;
  352. ReservedDebugDirectory: PIMAGE_DEBUG_DIRECTORY;
  353. ReservedNumberOfDebugDirectories: DWORD;
  354. ReservedOriginalFunctionTableBaseAddress: DWORD;
  355. Reserved: array [0..1] of DWORD;
  356. end;
  357. {$EXTERNALSYM _IMAGE_DEBUG_INFORMATION}
  358. IMAGE_DEBUG_INFORMATION = _IMAGE_DEBUG_INFORMATION;
  359. {$EXTERNALSYM IMAGE_DEBUG_INFORMATION}
  360. TImageDebugInformation = IMAGE_DEBUG_INFORMATION;
  361. PImageDebugInformation = PIMAGE_DEBUG_INFORMATION;
  362. function MapDebugInformation(FileHandle: HANDLE; FileName, SymbolPath: PSTR;
  363. ImageBase: DWORD): PIMAGE_DEBUG_INFORMATION; stdcall;
  364. {$EXTERNALSYM MapDebugInformation}
  365. function UnmapDebugInformation(DebugInfo: PIMAGE_DEBUG_INFORMATION): BOOL; stdcall;
  366. {$EXTERNALSYM UnmapDebugInformation}
  367. function SearchTreeForFile(RootPath, InputPathName, OutputPathBuffer: PSTR): BOOL; stdcall;
  368. {$EXTERNALSYM SearchTreeForFile}
  369. type
  370. PENUMDIRTREE_CALLBACK = function(FilePath: LPCSTR; CallerData: PVOID): BOOL; stdcall;
  371. {$EXTERNALSYM PENUMDIRTREE_CALLBACK}
  372. PEnumDirTreeCallback = PENUMDIRTREE_CALLBACK;
  373. function EnumDirTree(hProcess: HANDLE; RootPath, InputPathName, OutputPathBuffer: PSTR;
  374. Callback: PENUMDIRTREE_CALLBACK; CallbackData: PVOID): BOOL; stdcall;
  375. {$EXTERNALSYM EnumDirTree}
  376. function MakeSureDirectoryPathExists(DirPath: PCSTR): BOOL; stdcall;
  377. {$EXTERNALSYM MakeSureDirectoryPathExists}
  378. //
  379. // UnDecorateSymbolName Flags
  380. //
  381. const
  382. UNDNAME_COMPLETE = $0000; // Enable full undecoration
  383. {$EXTERNALSYM UNDNAME_COMPLETE}
  384. UNDNAME_NO_LEADING_UNDERSCORES = $0001; // Remove leading underscores from MS extended keywords
  385. {$EXTERNALSYM UNDNAME_NO_LEADING_UNDERSCORES}
  386. UNDNAME_NO_MS_KEYWORDS = $0002; // Disable expansion of MS extended keywords
  387. {$EXTERNALSYM UNDNAME_NO_MS_KEYWORDS}
  388. UNDNAME_NO_FUNCTION_RETURNS = $0004; // Disable expansion of return type for primary declaration
  389. {$EXTERNALSYM UNDNAME_NO_FUNCTION_RETURNS}
  390. UNDNAME_NO_ALLOCATION_MODEL = $0008; // Disable expansion of the declaration model
  391. {$EXTERNALSYM UNDNAME_NO_ALLOCATION_MODEL}
  392. UNDNAME_NO_ALLOCATION_LANGUAGE = $0010; // Disable expansion of the declaration language specifier
  393. {$EXTERNALSYM UNDNAME_NO_ALLOCATION_LANGUAGE}
  394. UNDNAME_NO_MS_THISTYPE = $0020; // NYI Disable expansion of MS keywords on the 'this' type for primary declaration
  395. {$EXTERNALSYM UNDNAME_NO_MS_THISTYPE}
  396. UNDNAME_NO_CV_THISTYPE = $0040; // NYI Disable expansion of CV modifiers on the 'this' type for primary declaration
  397. {$EXTERNALSYM UNDNAME_NO_CV_THISTYPE}
  398. UNDNAME_NO_THISTYPE = $0060; // Disable all modifiers on the 'this' type
  399. {$EXTERNALSYM UNDNAME_NO_THISTYPE}
  400. UNDNAME_NO_ACCESS_SPECIFIERS = $0080; // Disable expansion of access specifiers for members
  401. {$EXTERNALSYM UNDNAME_NO_ACCESS_SPECIFIERS}
  402. UNDNAME_NO_THROW_SIGNATURES = $0100; // Disable expansion of 'throw-signatures' for functions and pointers to functions
  403. {$EXTERNALSYM UNDNAME_NO_THROW_SIGNATURES}
  404. UNDNAME_NO_MEMBER_TYPE = $0200; // Disable expansion of 'static' or 'virtual'ness of members
  405. {$EXTERNALSYM UNDNAME_NO_MEMBER_TYPE}
  406. UNDNAME_NO_RETURN_UDT_MODEL = $0400; // Disable expansion of MS model for UDT returns
  407. {$EXTERNALSYM UNDNAME_NO_RETURN_UDT_MODEL}
  408. UNDNAME_32_BIT_DECODE = $0800; // Undecorate 32-bit decorated names
  409. {$EXTERNALSYM UNDNAME_32_BIT_DECODE}
  410. UNDNAME_NAME_ONLY = $1000; // Crack only the name for primary declaration;
  411. {$EXTERNALSYM UNDNAME_NAME_ONLY}
  412. // return just [scope::]name. Does expand template params
  413. UNDNAME_NO_ARGUMENTS = $2000; // Don't undecorate arguments to function
  414. {$EXTERNALSYM UNDNAME_NO_ARGUMENTS}
  415. UNDNAME_NO_SPECIAL_SYMS = $4000; // Don't undecorate special names (v-table, vcall, vector xxx, metatype, etc)
  416. {$EXTERNALSYM UNDNAME_NO_SPECIAL_SYMS}
  417. function UnDecorateSymbolName(DecoratedName: PCSTR; UnDecoratedName: PSTR;
  418. UndecoratedLength: DWORD; Flags: DWORD): DWORD; stdcall;
  419. {$EXTERNALSYM UnDecorateSymbolName}
  420. //
  421. // these values are used for synthesized file types
  422. // that can be passed in as image headers instead of
  423. // the standard ones from ntimage.h
  424. //
  425. const
  426. DBHHEADER_DEBUGDIRS = $1;
  427. {$EXTERNALSYM DBHHEADER_DEBUGDIRS}
  428. type
  429. _MODLOAD_DATA = record
  430. ssize: DWORD; // size of this struct
  431. ssig: DWORD; // signature identifying the passed data
  432. data: PVOID; // pointer to passed data
  433. size: DWORD; // size of passed data
  434. flags: DWORD; // options
  435. end;
  436. {$EXTERNALSYM _MODLOAD_DATA}
  437. MODLOAD_DATA = _MODLOAD_DATA;
  438. {$EXTERNALSYM MODLOAD_DATA}
  439. PMODLOAD_DATA = ^MODLOAD_DATA;
  440. {$EXTERNALSYM PMODLOAD_DATA}
  441. TModLoadData = MODLOAD_DATA;
  442. PModLoadData = PMODLOAD_DATA;
  443. //
  444. // StackWalking API
  445. //
  446. type
  447. ADDRESS_MODE = (
  448. AddrMode1616,
  449. AddrMode1632,
  450. AddrModeReal,
  451. AddrModeFlat);
  452. {$EXTERNALSYM ADDRESS_MODE}
  453. TAddressMode = ADDRESS_MODE;
  454. LPADDRESS64 = ^ADDRESS64;
  455. {$EXTERNALSYM PADDRESS64}
  456. _tagADDRESS64 = record
  457. Offset: DWORD64;
  458. Segment: WORD;
  459. Mode: ADDRESS_MODE;
  460. end;
  461. {$EXTERNALSYM _tagADDRESS64}
  462. ADDRESS64 = _tagADDRESS64;
  463. {$EXTERNALSYM ADDRESS64}
  464. TAddress64 = ADDRESS64;
  465. PAddress64 = LPADDRESS64;
  466. LPADDRESS = ^ADDRESS;
  467. {$EXTERNALSYM PADDRESS}
  468. _tagADDRESS = record
  469. Offset: DWORD;
  470. Segment: WORD;
  471. Mode: ADDRESS_MODE;
  472. end;
  473. {$EXTERNALSYM _tagADDRESS}
  474. ADDRESS = _tagADDRESS;
  475. {$EXTERNALSYM ADDRESS}
  476. TAddress = ADDRESS;
  477. PAddress = LPADDRESS;
  478. procedure Address32To64(a32: LPADDRESS; a64: LPADDRESS64);
  479. {$EXTERNALSYM Address32To64}
  480. procedure Address64To32(a64: LPADDRESS64; a32: LPADDRESS);
  481. {$EXTERNALSYM Address64To32}
  482. //
  483. // This structure is included in the STACKFRAME structure,
  484. // and is used to trace through usermode callbacks in a thread's
  485. // kernel stack. The values must be copied by the kernel debugger
  486. // from the DBGKD_GET_VERSION and WAIT_STATE_CHANGE packets.
  487. //
  488. //
  489. // New KDHELP structure for 64 bit system support.
  490. // This structure is preferred in new code.
  491. //
  492. type
  493. PKDHELP64 = ^KDHELP64;
  494. {$EXTERNALSYM PKDHELP64}
  495. _KDHELP64 = record
  496. //
  497. // address of kernel thread object, as provided in the
  498. // WAIT_STATE_CHANGE packet.
  499. //
  500. Thread: DWORD64;
  501. //
  502. // offset in thread object to pointer to the current callback frame
  503. // in kernel stack.
  504. //
  505. ThCallbackStack: DWORD;
  506. //
  507. // offset in thread object to pointer to the current callback backing
  508. // store frame in kernel stack.
  509. //
  510. ThCallbackBStore: DWORD;
  511. //
  512. // offsets to values in frame:
  513. //
  514. // address of next callback frame
  515. NextCallback: DWORD;
  516. // address of saved frame pointer (if applicable)
  517. FramePointer: DWORD;
  518. //
  519. // Address of the kernel function that calls out to user mode
  520. //
  521. KiCallUserMode: DWORD64;
  522. //
  523. // Address of the user mode dispatcher function
  524. //
  525. KeUserCallbackDispatcher: DWORD64;
  526. //
  527. // Lowest kernel mode address
  528. //
  529. SystemRangeStart: DWORD64;
  530. Reserved: array [0..7] of DWORD64;
  531. end;
  532. {$EXTERNALSYM _KDHELP64}
  533. KDHELP64 = _KDHELP64;
  534. {$EXTERNALSYM KDHELP64}
  535. TKdHelp64 = KDHELP64;
  536. //PKdHelp64 = PKDHELP64;
  537. PKDHELP = ^KDHELP;
  538. {$EXTERNALSYM PKDHELP}
  539. _KDHELP = record
  540. //
  541. // address of kernel thread object, as provided in the
  542. // WAIT_STATE_CHANGE packet.
  543. //
  544. Thread: DWORD;
  545. //
  546. // offset in thread object to pointer to the current callback frame
  547. // in kernel stack.
  548. //
  549. ThCallbackStack: DWORD;
  550. //
  551. // offsets to values in frame:
  552. //
  553. // address of next callback frame
  554. NextCallback: DWORD;
  555. // address of saved frame pointer (if applicable)
  556. FramePointer: DWORD;
  557. //
  558. // Address of the kernel function that calls out to user mode
  559. //
  560. KiCallUserMode: DWORD;
  561. //
  562. // Address of the user mode dispatcher function
  563. //
  564. KeUserCallbackDispatcher: DWORD;
  565. //
  566. // Lowest kernel mode address
  567. //
  568. SystemRangeStart: DWORD;
  569. //
  570. // offset in thread object to pointer to the current callback backing
  571. // store frame in kernel stack.
  572. //
  573. ThCallbackBStore: DWORD;
  574. Reserved: array [0..7] of DWORD;
  575. end;
  576. {$EXTERNALSYM _KDHELP}
  577. KDHELP = _KDHELP;
  578. {$EXTERNALSYM KDHELP}
  579. TKdHelp = KDHELP;
  580. //PKdHelp = PKDHELP;
  581. procedure KdHelp32To64(p32: PKDHELP; p64: PKDHELP64);
  582. {$EXTERNALSYM KdHelp32To64}
  583. type
  584. LPSTACKFRAME64 = ^STACKFRAME64;
  585. {$EXTERNALSYM LPSTACKFRAME64}
  586. _tagSTACKFRAME64 = record
  587. AddrPC: ADDRESS64; // program counter
  588. AddrReturn: ADDRESS64; // return address
  589. AddrFrame: ADDRESS64; // frame pointer
  590. AddrStack: ADDRESS64; // stack pointer
  591. AddrBStore: ADDRESS64; // backing store pointer
  592. FuncTableEntry: PVOID; // pointer to pdata/fpo or NULL
  593. Params: array [0..3] of DWORD64; // possible arguments to the function
  594. Far: BOOL; // WOW far call
  595. Virtual: BOOL; // is this a virtual frame?
  596. Reserved: array [0..2] of DWORD64;
  597. KdHelp: KDHELP64;
  598. end;
  599. {$EXTERNALSYM _tagSTACKFRAME64}
  600. STACKFRAME64 = _tagSTACKFRAME64;
  601. {$EXTERNALSYM STACKFRAME64}
  602. TStackFrame64 = STACKFRAME64;
  603. PStackFrame64 = LPSTACKFRAME64;
  604. LPSTACKFRAME = ^STACKFRAME;
  605. {$EXTERNALSYM LPSTACKFRAME}
  606. _tagSTACKFRAME = record
  607. AddrPC: ADDRESS; // program counter
  608. AddrReturn: ADDRESS; // return address
  609. AddrFrame: ADDRESS; // frame pointer
  610. AddrStack: ADDRESS; // stack pointer
  611. FuncTableEntry: PVOID; // pointer to pdata/fpo or NULL
  612. Params: array [0..3] of DWORD; // possible arguments to the function
  613. Far: BOOL; // WOW far call
  614. Virtual: BOOL; // is this a virtual frame?
  615. Reserved: array [0..2] of DWORD;
  616. KdHelp: KDHELP;
  617. AddrBStore: ADDRESS; // backing store pointer
  618. end;
  619. {$EXTERNALSYM _tagSTACKFRAME}
  620. STACKFRAME = _tagSTACKFRAME;
  621. {$EXTERNALSYM STACKFRAME}
  622. TStackFrame = STACKFRAME;
  623. PStackFrame = LPSTACKFRAME;
  624. PREAD_PROCESS_MEMORY_ROUTINE64 = function(hProcess: HANDLE; qwBaseAddress: DWORD64;
  625. lpBuffer: PVOID; nSize: DWORD; var lpNumberOfBytesRead: DWORD): BOOL; stdcall;
  626. {$EXTERNALSYM PREAD_PROCESS_MEMORY_ROUTINE64}
  627. PReadProcessMemoryRoutine64 = PREAD_PROCESS_MEMORY_ROUTINE64;
  628. PFUNCTION_TABLE_ACCESS_ROUTINE64 = function(hProcess: HANDLE;
  629. AddrBase: DWORD64): PVOID; stdcall;
  630. {$EXTERNALSYM PFUNCTION_TABLE_ACCESS_ROUTINE64}
  631. PFunctionTableAccessRoutine64 = PFUNCTION_TABLE_ACCESS_ROUTINE64;
  632. PGET_MODULE_BASE_ROUTINE64 = function(hProcess: HANDLE;
  633. Address: DWORD64): DWORD64; stdcall;
  634. {$EXTERNALSYM PGET_MODULE_BASE_ROUTINE64}
  635. PGetModuleBaseRoutine64 = PGET_MODULE_BASE_ROUTINE64;
  636. PTRANSLATE_ADDRESS_ROUTINE64 = function(hProcess: HANDLE; hThread: HANDLE;
  637. const lpaddr: ADDRESS64): DWORD64; stdcall;
  638. {$EXTERNALSYM PTRANSLATE_ADDRESS_ROUTINE64}
  639. PTranslateAddressRoutine64 = PTRANSLATE_ADDRESS_ROUTINE64;
  640. function StackWalk64(MachineType: DWORD; hProcess: HANDLE; hThread: HANDLE;
  641. var StackFrame: STACKFRAME64; ContextRecord: PVOID;
  642. ReadMemoryRoutine: PREAD_PROCESS_MEMORY_ROUTINE64;
  643. FunctionTableAccessRoutine: PFUNCTION_TABLE_ACCESS_ROUTINE64;
  644. GetModuleBaseRoutine: PGET_MODULE_BASE_ROUTINE64;
  645. TranslateAddress: PTRANSLATE_ADDRESS_ROUTINE64): BOOL; stdcall;
  646. {$EXTERNALSYM StackWalk64}
  647. type
  648. PREAD_PROCESS_MEMORY_ROUTINE = function(hProcess: HANDLE;
  649. lpBaseAddress: DWORD; lpBuffer: PVOID; nSize: DWORD;
  650. var lpNumberOfBytesRead: DWORD): BOOL; stdcall;
  651. {$EXTERNALSYM PREAD_PROCESS_MEMORY_ROUTINE}
  652. PreadProcessMemoryRoutine = PREAD_PROCESS_MEMORY_ROUTINE;
  653. PFUNCTION_TABLE_ACCESS_ROUTINE = function(hProcess: HANDLE; AddrBase: DWORD): PVOID; stdcall;
  654. {$EXTERNALSYM PFUNCTION_TABLE_ACCESS_ROUTINE}
  655. PFunctionTableAccessRoutine = PFUNCTION_TABLE_ACCESS_ROUTINE;
  656. PGET_MODULE_BASE_ROUTINE = function(hProcess: HANDLE; Address: DWORD): DWORD; stdcall;
  657. {$EXTERNALSYM PGET_MODULE_BASE_ROUTINE}
  658. PGetModuleBaseRoutine = PGET_MODULE_BASE_ROUTINE;
  659. PTRANSLATE_ADDRESS_ROUTINE = function(hProcess: HANDLE; hThread: HANDLE;
  660. const lpaddr: ADDRESS): DWORD; stdcall;
  661. {$EXTERNALSYM PTRANSLATE_ADDRESS_ROUTINE}
  662. PTranslateAddressRoutine = PTRANSLATE_ADDRESS_ROUTINE;
  663. function StackWalk(MachineType: DWORD; hProcess: HANDLE; hThread: HANDLE;
  664. var StackFrame: STACKFRAME; ContextRecord: PVOID;
  665. ReadMemoryRoutine: PREAD_PROCESS_MEMORY_ROUTINE;
  666. FunctionTableAccessRoutine: PFUNCTION_TABLE_ACCESS_ROUTINE;
  667. GetModuleBaseRoutine: PGET_MODULE_BASE_ROUTINE;
  668. TranslateAddress: PTRANSLATE_ADDRESS_ROUTINE): BOOL; stdcall;
  669. {$EXTERNALSYM StackWalk}
  670. const
  671. API_VERSION_NUMBER = 9;
  672. {$EXTERNALSYM API_VERSION_NUMBER}
  673. type
  674. LPAPI_VERSION = ^API_VERSION;
  675. {$EXTERNALSYM LPAPI_VERSION}
  676. API_VERSION = record
  677. MajorVersion: USHORT;
  678. MinorVersion: USHORT;
  679. Revision: USHORT;
  680. Reserved: USHORT;
  681. end;
  682. {$EXTERNALSYM API_VERSION}
  683. TApiVersion = API_VERSION;
  684. PApiVersion = LPAPI_VERSION;
  685. function ImagehlpApiVersion: LPAPI_VERSION; stdcall;
  686. {$EXTERNALSYM ImagehlpApiVersion}
  687. function ImagehlpApiVersionEx(const AppVersion: API_VERSION): LPAPI_VERSION; stdcall;
  688. {$EXTERNALSYM ImagehlpApiVersionEx}
  689. function GetTimestampForLoadedLibrary(Module: HMODULE): DWORD; stdcall;
  690. {$EXTERNALSYM GetTimestampForLoadedLibrary}
  691. //
  692. // typedefs for function pointers
  693. //
  694. type
  695. PSYM_ENUMMODULES_CALLBACK64 = function(ModuleName: PSTR; BaseOfDll: DWORD64;
  696. UserContext: PVOID): BOOL; stdcall;
  697. {$EXTERNALSYM PSYM_ENUMMODULES_CALLBACK64}
  698. PSymEnummodulesCallback64 = PSYM_ENUMMODULES_CALLBACK64;
  699. PSYM_ENUMSYMBOLS_CALLBACK64 = function(SymbolName: PSTR; SymbolAddress: DWORD64;
  700. SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  701. {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK64}
  702. PSymEnumsymbolsCallback64 = PSYM_ENUMSYMBOLS_CALLBACK64;
  703. PSYM_ENUMSYMBOLS_CALLBACK64W = function(SymbolName: PWSTR;
  704. SymbolAddress: DWORD64; SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  705. {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK64W}
  706. PSymEnumsymbolsCallback64w = PSYM_ENUMSYMBOLS_CALLBACK64W;
  707. PENUMLOADED_MODULES_CALLBACK64 = function(ModuleName: PSTR;
  708. ModuleBase: DWORD64; ModuleSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  709. {$EXTERNALSYM PENUMLOADED_MODULES_CALLBACK64}
  710. PSnumloadedModulesCallback64 = PENUMLOADED_MODULES_CALLBACK64;
  711. PSYMBOL_REGISTERED_CALLBACK64 = function(hProcess: HANDLE; ActionCode: ULONG;
  712. CallbackData: ULONG64; UserContext: ULONG64): BOOL; stdcall;
  713. {$EXTERNALSYM PSYMBOL_REGISTERED_CALLBACK64}
  714. PSymbolRegisteredCallback64 = PSYMBOL_REGISTERED_CALLBACK64;
  715. PSYMBOL_FUNCENTRY_CALLBACK = function(hProcess: HANDLE; AddrBase: DWORD;
  716. UserContext: PVOID): PVOID; stdcall;
  717. {$EXTERNALSYM PSYMBOL_FUNCENTRY_CALLBACK}
  718. PSymbolFuncentryCallback = PSYMBOL_FUNCENTRY_CALLBACK;
  719. PSYMBOL_FUNCENTRY_CALLBACK64 = function(hProcess: HANDLE; AddrBase: ULONG64;
  720. UserContext: ULONG64): PVOID; stdcall;
  721. {$EXTERNALSYM PSYMBOL_FUNCENTRY_CALLBACK64}
  722. PSymbolFuncentryCallback64 = PSYMBOL_FUNCENTRY_CALLBACK64;
  723. PSYM_ENUMMODULES_CALLBACK = function(ModuleName: PSTR; BaseOfDll: ULONG;
  724. UserContext: PVOID): BOOL; stdcall;
  725. {$EXTERNALSYM PSYM_ENUMMODULES_CALLBACK}
  726. PSymEnummodulesCallback = PSYM_ENUMMODULES_CALLBACK;
  727. PSYM_ENUMSYMBOLS_CALLBACK = function(SymbolName: PSTR; SymbolAddress: ULONG;
  728. SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  729. {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK}
  730. PSymEnumsymbolsCallback = PSYM_ENUMSYMBOLS_CALLBACK;
  731. PSYM_ENUMSYMBOLS_CALLBACKW = function(SymbolName: PWSTR; SymbolAddress: ULONG;
  732. SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  733. {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACKW}
  734. PSymEnumsymbolsCallbackw = PSYM_ENUMSYMBOLS_CALLBACKW;
  735. PENUMLOADED_MODULES_CALLBACK = function(ModuleName: PSTR; ModuleBase: ULONG;
  736. ModuleSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  737. {$EXTERNALSYM PENUMLOADED_MODULES_CALLBACK}
  738. PEnumloadedModulesCallback = PENUMLOADED_MODULES_CALLBACK;
  739. PSYMBOL_REGISTERED_CALLBACK = function(hProcess: HANDLE; ActionCode: ULONG;
  740. CallbackData: PVOID; UserContext: PVOID): BOOL; stdcall;
  741. {$EXTERNALSYM PSYMBOL_REGISTERED_CALLBACK}
  742. PSymbolRegisteredCallback = PSYMBOL_REGISTERED_CALLBACK;
  743. //
  744. // flags found in SYMBOL_INFO.Flags
  745. //
  746. const
  747. SYMFLAG_VALUEPRESENT = $00000001;
  748. {$EXTERNALSYM SYMFLAG_VALUEPRESENT}
  749. SYMFLAG_REGISTER = $00000008;
  750. {$EXTERNALSYM SYMFLAG_REGISTER}
  751. SYMFLAG_REGREL = $00000010;
  752. {$EXTERNALSYM SYMFLAG_REGREL}
  753. SYMFLAG_FRAMEREL = $00000020;
  754. {$EXTERNALSYM SYMFLAG_FRAMEREL}
  755. SYMFLAG_PARAMETER = $00000040;
  756. {$EXTERNALSYM SYMFLAG_PARAMETER}
  757. SYMFLAG_LOCAL = $00000080;
  758. {$EXTERNALSYM SYMFLAG_LOCAL}
  759. SYMFLAG_CONSTANT = $00000100;
  760. {$EXTERNALSYM SYMFLAG_CONSTANT}
  761. SYMFLAG_EXPORT = $00000200;
  762. {$EXTERNALSYM SYMFLAG_EXPORT}
  763. SYMFLAG_FORWARDER = $00000400;
  764. {$EXTERNALSYM SYMFLAG_FORWARDER}
  765. SYMFLAG_FUNCTION = $00000800;
  766. {$EXTERNALSYM SYMFLAG_FUNCTION}
  767. SYMFLAG_VIRTUAL = $00001000;
  768. {$EXTERNALSYM SYMFLAG_VIRTUAL}
  769. SYMFLAG_THUNK = $00002000;
  770. {$EXTERNALSYM SYMFLAG_THUNK}
  771. SYMFLAG_TLSREL = $00004000;
  772. {$EXTERNALSYM SYMFLAG_TLSREL}
  773. //
  774. // symbol type enumeration
  775. //
  776. type
  777. SYM_TYPE = (
  778. SymNone,
  779. SymCoff,
  780. SymCv,
  781. SymPdb,
  782. SymExport,
  783. SymDeferred,
  784. SymSym, // .sym file
  785. SymDia,
  786. SymVirtual,
  787. NumSymTypes);
  788. {$EXTERNALSYM SYM_TYPE}
  789. TSymType = SYM_TYPE;
  790. //
  791. // symbol data structure
  792. //
  793. PIMAGEHLP_SYMBOL64 = ^IMAGEHLP_SYMBOL64;
  794. {$EXTERNALSYM PIMAGEHLP_SYMBOL64}
  795. _IMAGEHLP_SYMBOL64 = record
  796. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_SYMBOL64)
  797. Address: DWORD64; // virtual address including dll base address
  798. Size: DWORD; // estimated size of symbol, can be zero
  799. Flags: DWORD; // info about the symbols, see the SYMF defines
  800. MaxNameLength: DWORD; // maximum size of symbol name in 'Name'
  801. Name: array [0..0] of CHAR; // symbol name (null terminated string)
  802. end;
  803. {$EXTERNALSYM _IMAGEHLP_SYMBOL64}
  804. IMAGEHLP_SYMBOL64 = _IMAGEHLP_SYMBOL64;
  805. {$EXTERNALSYM IMAGEHLP_SYMBOL64}
  806. TImageHlpSymbol64 = IMAGEHLP_SYMBOL64;
  807. PImageHlpSymbol64 = PIMAGEHLP_SYMBOL64;
  808. _IMAGEHLP_SYMBOL64_PACKAGE = record
  809. sym: IMAGEHLP_SYMBOL64;
  810. name: array [0..MAX_SYM_NAME] of CHAR;
  811. end;
  812. {$EXTERNALSYM _IMAGEHLP_SYMBOL64_PACKAGE}
  813. IMAGEHLP_SYMBOL64_PACKAGE = _IMAGEHLP_SYMBOL64_PACKAGE;
  814. {$EXTERNALSYM IMAGEHLP_SYMBOL64_PACKAGE}
  815. PIMAGEHLP_SYMBOL64_PACKAGE = ^IMAGEHLP_SYMBOL64_PACKAGE;
  816. {$EXTERNALSYM PIMAGEHLP_SYMBOL64_PACKAGE}
  817. TImageHlpSymbol64Package = IMAGEHLP_SYMBOL64_PACKAGE;
  818. PImageHlpSymbol64Package = PIMAGEHLP_SYMBOL64_PACKAGE;
  819. //#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)
  820. //
  821. //#define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64
  822. //#define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64
  823. //#define IMAGEHLP_SYMBOL_PACKAGE IMAGEHLP_SYMBOL64_PACKAGE
  824. //#define PIMAGEHLP_SYMBOL_PACKAGE PIMAGEHLP_SYMBOL64_PACKAGE
  825. //
  826. //#else
  827. PIMAGEHLP_SYMBOL = ^IMAGEHLP_SYMBOL;
  828. {$EXTERNALSYM PIMAGEHLP_SYMBOL}
  829. _IMAGEHLP_SYMBOL = record
  830. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_SYMBOL)
  831. Address: DWORD; // virtual address including dll base address
  832. Size: DWORD; // estimated size of symbol, can be zero
  833. Flags: DWORD; // info about the symbols, see the SYMF defines
  834. MaxNameLength: DWORD; // maximum size of symbol name in 'Name'
  835. Name: array [0..0] of CHAR; // symbol name (null terminated string)
  836. end;
  837. {$EXTERNALSYM _IMAGEHLP_SYMBOL}
  838. IMAGEHLP_SYMBOL = _IMAGEHLP_SYMBOL;
  839. {$EXTERNALSYM IMAGEHLP_SYMBOL}
  840. TImageHlpSymbol = IMAGEHLP_SYMBOL;
  841. PImageHlpSymbol = PIMAGEHLP_SYMBOL;
  842. _IMAGEHLP_SYMBOL_PACKAGE = record
  843. sym: IMAGEHLP_SYMBOL;
  844. name: array [0..MAX_SYM_NAME] of CHAR;
  845. end;
  846. {$EXTERNALSYM _IMAGEHLP_SYMBOL_PACKAGE}
  847. IMAGEHLP_SYMBOL_PACKAGE = _IMAGEHLP_SYMBOL_PACKAGE;
  848. {$EXTERNALSYM IMAGEHLP_SYMBOL_PACKAGE}
  849. PIMAGEHLP_SYMBOL_PACKAGE = ^IMAGEHLP_SYMBOL_PACKAGE;
  850. {$EXTERNALSYM PIMAGEHLP_SYMBOL_PACKAGE}
  851. TImageHlpSymbolPackage = IMAGEHLP_SYMBOL_PACKAGE;
  852. PImageHlpSymbolPackage = PIMAGEHLP_SYMBOL_PACKAGE;
  853. //#endif
  854. //
  855. // module data structure
  856. //
  857. PIMAGEHLP_MODULE64 = ^IMAGEHLP_MODULE64;
  858. {$EXTERNALSYM PIMAGEHLP_MODULE64}
  859. _IMAGEHLP_MODULE64 = record
  860. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE64)
  861. BaseOfImage: DWORD64; // base load address of module
  862. ImageSize: DWORD; // virtual size of the loaded module
  863. TimeDateStamp: DWORD; // date/time stamp from pe header
  864. CheckSum: DWORD; // checksum from the pe header
  865. NumSyms: DWORD; // number of symbols in the symbol table
  866. SymType: SYM_TYPE; // type of symbols loaded
  867. ModuleName: array [0..3] of CHAR; // module name
  868. ImageName: array [0..255] of CHAR; // image name
  869. LoadedImageName: array [0..255] of CHAR; // symbol file name
  870. end;
  871. {$EXTERNALSYM _IMAGEHLP_MODULE64}
  872. IMAGEHLP_MODULE64 = _IMAGEHLP_MODULE64;
  873. {$EXTERNALSYM IMAGEHLP_MODULE64}
  874. TImageHlpModule64 = IMAGEHLP_MODULE64;
  875. PImageHlpModule64 = PIMAGEHLP_MODULE64;
  876. PIMAGEHLP_MODULEW64 = ^IMAGEHLP_MODULEW64;
  877. {$EXTERNALSYM PIMAGEHLP_MODULEW64}
  878. _IMAGEHLP_MODULE64W = record
  879. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE64)
  880. BaseOfImage: DWORD64; // base load address of module
  881. ImageSize: DWORD; // virtual size of the loaded module
  882. TimeDateStamp: DWORD; // date/time stamp from pe header
  883. CheckSum: DWORD; // checksum from the pe header
  884. NumSyms: DWORD; // number of symbols in the symbol table
  885. SymType: SYM_TYPE; // type of symbols loaded
  886. ModuleName: array [0..31] of WCHAR; // module name
  887. ImageName: array [0..255] of WCHAR; // image name
  888. LoadedImageName: array [0..255] of WCHAR; // symbol file name
  889. end;
  890. {$EXTERNALSYM _IMAGEHLP_MODULE64W}
  891. IMAGEHLP_MODULEW64 = _IMAGEHLP_MODULE64W;
  892. {$EXTERNALSYM IMAGEHLP_MODULEW64}
  893. TImageHlpModuleW64 = IMAGEHLP_MODULEW64;
  894. PImageHlpModuleW64 = PIMAGEHLP_MODULEW64;
  895. PIMAGEHLP_MODULE = ^IMAGEHLP_MODULE;
  896. {$EXTERNALSYM PIMAGEHLP_MODULE}
  897. _IMAGEHLP_MODULE = record
  898. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE)
  899. BaseOfImage: DWORD; // base load address of module
  900. ImageSize: DWORD; // virtual size of the loaded module
  901. TimeDateStamp: DWORD; // date/time stamp from pe header
  902. CheckSum: DWORD; // checksum from the pe header
  903. NumSyms: DWORD; // number of symbols in the symbol table
  904. SymType: SYM_TYPE; // type of symbols loaded
  905. ModuleName: array [0..31] of CHAR; // module name
  906. ImageName: array [0..255] of CHAR; // image name
  907. LoadedImageName: array [0..255] of CHAR; // symbol file name
  908. end;
  909. {$EXTERNALSYM _IMAGEHLP_MODULE}
  910. IMAGEHLP_MODULE = _IMAGEHLP_MODULE;
  911. {$EXTERNALSYM IMAGEHLP_MODULE}
  912. TImageHlpModule = IMAGEHLP_MODULE;
  913. PImageHlpModule = PIMAGEHLP_MODULE;
  914. PIMAGEHLP_MODULEW = ^IMAGEHLP_MODULEW;
  915. {$EXTERNALSYM PIMAGEHLP_MODULEW}
  916. _IMAGEHLP_MODULEW = record
  917. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE)
  918. BaseOfImage: DWORD; // base load address of module
  919. ImageSize: DWORD; // virtual size of the loaded module
  920. TimeDateStamp: DWORD; // date/time stamp from pe header
  921. CheckSum: DWORD; // checksum from the pe header
  922. NumSyms: DWORD; // number of symbols in the symbol table
  923. SymType: SYM_TYPE; // type of symbols loaded
  924. ModuleName: array [0..31] of WCHAR; // module name
  925. ImageName: array [0..255] of WCHAR; // image name
  926. LoadedImageName: array [0..255] of WCHAR; // symbol file name
  927. end;
  928. {$EXTERNALSYM _IMAGEHLP_MODULEW}
  929. IMAGEHLP_MODULEW = _IMAGEHLP_MODULEW;
  930. {$EXTERNALSYM IMAGEHLP_MODULEW}
  931. TImageHlpModuleW = IMAGEHLP_MODULEW;
  932. PImageHlpModuleW = PIMAGEHLP_MODULEW;
  933. //
  934. // source file line data structure
  935. //
  936. PIMAGEHLP_LINE64 = ^IMAGEHLP_LINE64;
  937. {$EXTERNALSYM PIMAGEHLP_LINE64}
  938. _IMAGEHLP_LINE64 = record
  939. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_LINE64)
  940. Key: PVOID; // internal
  941. LineNumber: DWORD; // line number in file
  942. FileName: PCHAR; // full filename
  943. Address: DWORD64; // first instruction of line
  944. end;
  945. {$EXTERNALSYM _IMAGEHLP_LINE64}
  946. IMAGEHLP_LINE64 = _IMAGEHLP_LINE64;
  947. {$EXTERNALSYM IMAGEHLP_LINE64}
  948. TImageHlpLine64 = IMAGEHLP_LINE64;
  949. PImageHlpLine64 = PIMAGEHLP_LINE64;
  950. PIMAGEHLP_LINE = ^IMAGEHLP_LINE;
  951. {$EXTERNALSYM PIMAGEHLP_LINE}
  952. _IMAGEHLP_LINE = record
  953. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_LINE)
  954. Key: PVOID; // internal
  955. LineNumber: DWORD; // line number in file
  956. FileName: PCHAR; // full filename
  957. Address: DWORD; // first instruction of line
  958. end;
  959. {$EXTERNALSYM _IMAGEHLP_LINE}
  960. IMAGEHLP_LINE = _IMAGEHLP_LINE;
  961. {$EXTERNALSYM IMAGEHLP_LINE}
  962. TImageHlpLine = IMAGEHLP_LINE;
  963. PImageHlpLine = PIMAGEHLP_LINE;
  964. //
  965. // source file structure
  966. //
  967. type
  968. _SOURCEFILE = record
  969. ModBase: DWORD64; // base address of loaded module
  970. FileName: PCHAR; // full filename of source
  971. end;
  972. {$EXTERNALSYM _SOURCEFILE}
  973. SOURCEFILE = _SOURCEFILE;
  974. {$EXTERNALSYM SOURCEFILE}
  975. PSOURCEFILE = ^SOURCEFILE;
  976. {$EXTERNALSYM PSOURCEFILE}
  977. TSourceFile = SOURCEFILE;
  978. //
  979. // data structures used for registered symbol callbacks
  980. //
  981. const
  982. CBA_DEFERRED_SYMBOL_LOAD_START = $00000001;
  983. {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_START}
  984. CBA_DEFERRED_SYMBOL_LOAD_COMPLETE = $00000002;
  985. {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_COMPLETE}
  986. CBA_DEFERRED_SYMBOL_LOAD_FAILURE = $00000003;
  987. {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_FAILURE}
  988. CBA_SYMBOLS_UNLOADED = $00000004;
  989. {$EXTERNALSYM CBA_SYMBOLS_UNLOADED}
  990. CBA_DUPLICATE_SYMBOL = $00000005;
  991. {$EXTERNALSYM CBA_DUPLICATE_SYMBOL}
  992. CBA_READ_MEMORY = $00000006;
  993. {$EXTERNALSYM CBA_READ_MEMORY}
  994. CBA_DEFERRED_SYMBOL_LOAD_CANCEL = $00000007;
  995. {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_CANCEL}
  996. CBA_SET_OPTIONS = $00000008;
  997. {$EXTERNALSYM CBA_SET_OPTIONS}
  998. CBA_EVENT = $00000010;
  999. {$EXTERNALSYM CBA_EVENT}
  1000. CBA_DEFERRED_SYMBOL_LOAD_PARTIAL = $00000020;
  1001. {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_PARTIAL}
  1002. CBA_DEBUG_INFO = $10000000;
  1003. {$EXTERNALSYM CBA_DEBUG_INFO}
  1004. type
  1005. PIMAGEHLP_CBA_READ_MEMORY = ^IMAGEHLP_CBA_READ_MEMORY;
  1006. {$EXTERNALSYM PIMAGEHLP_CBA_READ_MEMORY}
  1007. _IMAGEHLP_CBA_READ_MEMORY = record
  1008. addr: DWORD64; // address to read from
  1009. buf: PVOID; // buffer to read to
  1010. bytes: DWORD; // amount of bytes to read
  1011. bytesread: LPDWORD; // pointer to store amount of bytes read
  1012. end;
  1013. {$EXTERNALSYM _IMAGEHLP_CBA_READ_MEMORY}
  1014. IMAGEHLP_CBA_READ_MEMORY = _IMAGEHLP_CBA_READ_MEMORY;
  1015. {$EXTERNALSYM IMAGEHLP_CBA_READ_MEMORY}
  1016. TImageHlpCbaReadMemory = IMAGEHLP_CBA_READ_MEMORY;
  1017. PImageHlpCbaReadMemory = PIMAGEHLP_CBA_READ_MEMORY;
  1018. const
  1019. sevInfo = 0;
  1020. {$EXTERNALSYM sevInfo}
  1021. sevProblem = 1;
  1022. {$EXTERNALSYM sevProblem}
  1023. sevAttn = 2;
  1024. {$EXTERNALSYM sevAttn}
  1025. sevFatal = 3;
  1026. {$EXTERNALSYM sevFatal}
  1027. sevMax = 4; // unused
  1028. {$EXTERNALSYM sevMax}
  1029. type
  1030. _IMAGEHLP_CBA_EVENT = record
  1031. severity: DWORD; // values from sevInfo to sevFatal
  1032. code: DWORD; // numerical code IDs the error
  1033. desc: PCHAR; // may contain a text description of the error
  1034. object_: PVOID; // value dependant upon the error code
  1035. end;
  1036. {$EXTERNALSYM _IMAGEHLP_CBA_EVENT}
  1037. IMAGEHLP_CBA_EVENT = _IMAGEHLP_CBA_EVENT;
  1038. {$EXTERNALSYM IMAGEHLP_CBA_EVENT}
  1039. PIMAGEHLP_CBA_EVENT = ^IMAGEHLP_CBA_EVENT;
  1040. {$EXTERNALSYM PIMAGEHLP_CBA_EVENT}
  1041. TImageHlpCbaEvent = IMAGEHLP_CBA_EVENT;
  1042. PImageHlpCbaEvent = PIMAGEHLP_CBA_EVENT;
  1043. PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 = ^IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
  1044. {$EXTERNALSYM PIMAGEHLP_DEFERRED_SYMBOL_LOAD64}
  1045. _IMAGEHLP_DEFERRED_SYMBOL_LOAD64 = record
  1046. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64)
  1047. BaseOfImage: DWORD64; // base load address of module
  1048. CheckSum: DWORD; // checksum from the pe header
  1049. TimeDateStamp: DWORD; // date/time stamp from pe header
  1050. FileName: array [0..MAX_PATH - 1] of CHAR; // symbols file or image name
  1051. Reparse: ByteBool; // load failure reparse
  1052. hFile: HANDLE; // file handle, if passed
  1053. Flags: DWORD; //
  1054. end;
  1055. {$EXTERNALSYM _IMAGEHLP_DEFERRED_SYMBOL_LOAD64}
  1056. IMAGEHLP_DEFERRED_SYMBOL_LOAD64 = _IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
  1057. {$EXTERNALSYM IMAGEHLP_DEFERRED_SYMBOL_LOAD64}
  1058. TImageHlpDeferredSymbolLoad64 = IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
  1059. PImageHlpDeferredSymbolLoad64 = PIMAGEHLP_DEFERRED_SYMBOL_LOAD64;
  1060. const
  1061. DSLFLAG_MISMATCHED_PDB = $1;
  1062. {$EXTERNALSYM DSLFLAG_MISMATCHED_PDB}
  1063. DSLFLAG_MISMATCHED_DBG = $2;
  1064. {$EXTERNALSYM DSLFLAG_MISMATCHED_DBG}
  1065. type
  1066. PIMAGEHLP_DEFERRED_SYMBOL_LOAD = ^IMAGEHLP_DEFERRED_SYMBOL_LOAD;
  1067. {$EXTERNALSYM PIMAGEHLP_DEFERRED_SYMBOL_LOAD}
  1068. _IMAGEHLP_DEFERRED_SYMBOL_LOAD = record
  1069. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD)
  1070. BaseOfImage: DWORD; // base load address of module
  1071. CheckSum: DWORD; // checksum from the pe header
  1072. TimeDateStamp: DWORD; // date/time stamp from pe header
  1073. FileName: array [0..MAX_PATH - 1] of CHAR; // symbols file or image name
  1074. Reparse: ByteBool; // load failure reparse
  1075. hFile: HANDLE; // file handle, if passed
  1076. end;
  1077. {$EXTERNALSYM _IMAGEHLP_DEFERRED_SYMBOL_LOAD}
  1078. IMAGEHLP_DEFERRED_SYMBOL_LOAD = _IMAGEHLP_DEFERRED_SYMBOL_LOAD;
  1079. {$EXTERNALSYM IMAGEHLP_DEFERRED_SYMBOL_LOAD}
  1080. TImageHlpDeferredSymbolLoad = IMAGEHLP_DEFERRED_SYMBOL_LOAD;
  1081. PImageHlpDeferredSymbolLoad = PIMAGEHLP_DEFERRED_SYMBOL_LOAD;
  1082. PIMAGEHLP_DUPLICATE_SYMBOL64 = ^IMAGEHLP_DUPLICATE_SYMBOL64;
  1083. {$EXTERNALSYM PIMAGEHLP_DUPLICATE_SYMBOL64}
  1084. _IMAGEHLP_DUPLICATE_SYMBOL64 = record
  1085. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL64)
  1086. NumberOfDups: DWORD; // number of duplicates in the Symbol array
  1087. Symbol: PIMAGEHLP_SYMBOL64; // array of duplicate symbols
  1088. SelectedSymbol: DWORD; // symbol selected (-1 to start)
  1089. end;
  1090. {$EXTERNALSYM _IMAGEHLP_DUPLICATE_SYMBOL64}
  1091. IMAGEHLP_DUPLICATE_SYMBOL64 = _IMAGEHLP_DUPLICATE_SYMBOL64;
  1092. {$EXTERNALSYM IMAGEHLP_DUPLICATE_SYMBOL64}
  1093. TImageHlpDuplicateSymbol64 = IMAGEHLP_DUPLICATE_SYMBOL64;
  1094. PImageHlpDuplicateSymbol64 = PIMAGEHLP_DUPLICATE_SYMBOL64;
  1095. PIMAGEHLP_DUPLICATE_SYMBOL = ^IMAGEHLP_DUPLICATE_SYMBOL;
  1096. {$EXTERNALSYM PIMAGEHLP_DUPLICATE_SYMBOL}
  1097. _IMAGEHLP_DUPLICATE_SYMBOL = record
  1098. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL)
  1099. NumberOfDups: DWORD; // number of duplicates in the Symbol array
  1100. Symbol: PIMAGEHLP_SYMBOL; // array of duplicate symbols
  1101. SelectedSymbol: DWORD; // symbol selected (-1 to start)
  1102. end;
  1103. {$EXTERNALSYM _IMAGEHLP_DUPLICATE_SYMBOL}
  1104. IMAGEHLP_DUPLICATE_SYMBOL = _IMAGEHLP_DUPLICATE_SYMBOL;
  1105. {$EXTERNALSYM IMAGEHLP_DUPLICATE_SYMBOL}
  1106. TImageHlpDuplicateSymbol = IMAGEHLP_DUPLICATE_SYMBOL;
  1107. PImageHlpDuplicateSymbol = PIMAGEHLP_DUPLICATE_SYMBOL;
  1108. // If dbghelp ever needs to display graphical UI, it will use this as the parent window.
  1109. //BOOL
  1110. //SymSetParentWindow(
  1111. // HWND hwnd
  1112. // );
  1113. //
  1114. // options that are set/returned by SymSetOptions() & SymGetOptions()
  1115. // these are used as a mask
  1116. //
  1117. const
  1118. SYMOPT_CASE_INSENSITIVE = $00000001;
  1119. {$EXTERNALSYM SYMOPT_CASE_INSENSITIVE}
  1120. SYMOPT_UNDNAME = $00000002;
  1121. {$EXTERNALSYM SYMOPT_UNDNAME}
  1122. SYMOPT_DEFERRED_LOADS = $00000004;
  1123. {$EXTERNALSYM SYMOPT_DEFERRED_LOADS}
  1124. SYMOPT_NO_CPP = $00000008;
  1125. {$EXTERNALSYM SYMOPT_NO_CPP}
  1126. SYMOPT_LOAD_LINES = $00000010;
  1127. {$EXTERNALSYM SYMOPT_LOAD_LINES}
  1128. SYMOPT_OMAP_FIND_NEAREST = $00000020;
  1129. {$EXTERNALSYM SYMOPT_OMAP_FIND_NEAREST}
  1130. SYMOPT_LOAD_ANYTHING = $00000040;
  1131. {$EXTERNALSYM SYMOPT_LOAD_ANYTHING}
  1132. SYMOPT_IGNORE_CVREC = $00000080;
  1133. {$EXTERNALSYM SYMOPT_IGNORE_CVREC}
  1134. SYMOPT_NO_UNQUALIFIED_LOADS = $00000100;
  1135. {$EXTERNALSYM SYMOPT_NO_UNQUALIFIED_LOADS}
  1136. SYMOPT_FAIL_CRITICAL_ERRORS = $00000200;
  1137. {$EXTERNALSYM SYMOPT_FAIL_CRITICAL_ERRORS}
  1138. SYMOPT_EXACT_SYMBOLS = $00000400;
  1139. {$EXTERNALSYM SYMOPT_EXACT_SYMBOLS}
  1140. SYMOPT_ALLOW_ABSOLUTE_SYMBOLS = $00000800;
  1141. {$EXTERNALSYM SYMOPT_ALLOW_ABSOLUTE_SYMBOLS}
  1142. SYMOPT_IGNORE_NT_SYMPATH = $00001000;
  1143. {$EXTERNALSYM SYMOPT_IGNORE_NT_SYMPATH}
  1144. SYMOPT_INCLUDE_32BIT_MODULES = $00002000;
  1145. {$EXTERNALSYM SYMOPT_INCLUDE_32BIT_MODULES}
  1146. SYMOPT_PUBLICS_ONLY = $00004000;
  1147. {$EXTERNALSYM SYMOPT_PUBLICS_ONLY}
  1148. SYMOPT_NO_PUBLICS = $00008000;
  1149. {$EXTERNALSYM SYMOPT_NO_PUBLICS}
  1150. SYMOPT_AUTO_PUBLICS = $00010000;
  1151. {$EXTERNALSYM SYMOPT_AUTO_PUBLICS}
  1152. SYMOPT_NO_IMAGE_SEARCH = $00020000;
  1153. {$EXTERNALSYM SYMOPT_NO_IMAGE_SEARCH}
  1154. SYMOPT_SECURE = $00040000;
  1155. {$EXTERNALSYM SYMOPT_SECURE}
  1156. SYMOPT_DEBUG = DWORD($80000000);
  1157. {$EXTERNALSYM SYMOPT_DEBUG}
  1158. function SymSetOptions(SymOptions: DWORD): DWORD; stdcall;
  1159. {$EXTERNALSYM SymSetOptions}
  1160. function SymGetOptions: DWORD; stdcall;
  1161. {$EXTERNALSYM SymGetOptions}
  1162. function SymCleanup(hProcess: HANDLE): BOOL; stdcall;
  1163. {$EXTERNALSYM SymCleanup}
  1164. function SymMatchString(string_, expression: LPSTR; fCase: BOOL): BOOL; stdcall;
  1165. {$EXTERNALSYM SymMatchString}
  1166. type
  1167. PSYM_ENUMSOURCFILES_CALLBACK = function(pSourceFile: PSOURCEFILE; UserContext: PVOID): BOOL; stdcall;
  1168. {$EXTERNALSYM PSYM_ENUMSOURCFILES_CALLBACK}
  1169. PSymEnumSourceFilesCallback = PSYM_ENUMSOURCFILES_CALLBACK;
  1170. function SymEnumSourceFiles(hProcess: HANDLE; ModBase: ULONG64; Mask: LPSTR;
  1171. cbSrcFiles: PSYM_ENUMSOURCFILES_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1172. {$EXTERNALSYM SymEnumSourceFiles}
  1173. function SymEnumerateModules64(hProcess: HANDLE; EnumModulesCallback: PSYM_ENUMMODULES_CALLBACK64;
  1174. UserContext: PVOID): BOOL; stdcall;
  1175. {$EXTERNALSYM SymEnumerateModules64}
  1176. function SymEnumerateModules(hProcess: HANDLE; EnumModulesCallback: PSYM_ENUMMODULES_CALLBACK;
  1177. UserContext: PVOID): BOOL; stdcall;
  1178. {$EXTERNALSYM SymEnumerateModules}
  1179. function SymEnumerateSymbols64(hProcess: HANDLE; BaseOfDll: DWORD64;
  1180. EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK64; UserContext: PVOID): BOOL; stdcall;
  1181. {$EXTERNALSYM SymEnumerateSymbols64}
  1182. function SymEnumerateSymbolsW64(hProcess: HANDLE; BaseOfDll: DWORD64;
  1183. EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK64W; UserContext: PVOID): BOOL; stdcall;
  1184. {$EXTERNALSYM SymEnumerateSymbolsW64}
  1185. function SymEnumerateSymbols(hProcess: HANDLE; BaseOfDll: DWORD;
  1186. EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1187. {$EXTERNALSYM SymEnumerateSymbols}
  1188. function SymEnumerateSymbolsW(hProcess: HANDLE; BaseOfDll: DWORD;
  1189. EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACKW; UserContext: PVOID): BOOL; stdcall;
  1190. {$EXTERNALSYM SymEnumerateSymbolsW}
  1191. function EnumerateLoadedModules64(hProcess: HANDLE; EnumLoadedModulesCallback: PENUMLOADED_MODULES_CALLBACK64;
  1192. UserContext: PVOID): BOOL; stdcall;
  1193. {$EXTERNALSYM EnumerateLoadedModules64}
  1194. function EnumerateLoadedModules(hProcess: HANDLE; EnumLoadedModulesCallback: PENUMLOADED_MODULES_CALLBACK;
  1195. UserContext: PVOID): BOOL; stdcall;
  1196. {$EXTERNALSYM EnumerateLoadedModules}
  1197. function SymFunctionTableAccess64(hProcess: HANDLE; AddrBase: DWORD64): PVOID; stdcall;
  1198. {$EXTERNALSYM SymFunctionTableAccess64}
  1199. function SymFunctionTableAccess(hProcess: HANDLE; AddrBase: DWORD): PVOID; stdcall;
  1200. {$EXTERNALSYM SymFunctionTableAccess}
  1201. function SymGetModuleInfo64(hProcess: HANDLE; qwAddr: DWORD64;
  1202. var ModuleInfo: IMAGEHLP_MODULE64): BOOL; stdcall;
  1203. {$EXTERNALSYM SymGetModuleInfo64}
  1204. function SymGetModuleInfoW64(hProcess: HANDLE; qwAddr: DWORD64;
  1205. var ModuleInfo: IMAGEHLP_MODULEW64): BOOL; stdcall;
  1206. {$EXTERNALSYM SymGetModuleInfoW64}
  1207. function SymGetModuleInfo(hProcess: HANDLE; dwAddr: DWORD;
  1208. var ModuleInfo: IMAGEHLP_MODULE): BOOL; stdcall;
  1209. {$EXTERNALSYM SymGetModuleInfo}
  1210. function SymGetModuleInfoW(hProcess: HANDLE; dwAddr: DWORD;
  1211. var ModuleInfo: IMAGEHLP_MODULEW): BOOL; stdcall;
  1212. {$EXTERNALSYM SymGetModuleInfoW}
  1213. function SymGetModuleBase64(hProcess: HANDLE; qwAddr: DWORD64): DWORD64; stdcall;
  1214. {$EXTERNALSYM SymGetModuleBase64}
  1215. function SymGetModuleBase(hProcess: HANDLE; dwAddr: DWORD): DWORD; stdcall;
  1216. {$EXTERNALSYM SymGetModuleBase}
  1217. function SymGetSymNext64(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL64): BOOL; stdcall;
  1218. {$EXTERNALSYM SymGetSymNext64}
  1219. function SymGetSymNext(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL): BOOL; stdcall;
  1220. {$EXTERNALSYM SymGetSymNext}
  1221. function SymGetSymPrev64(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL64): BOOL; stdcall;
  1222. {$EXTERNALSYM SymGetSymPrev64}
  1223. function SymGetSymPrev(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL): BOOL; stdcall;
  1224. {$EXTERNALSYM SymGetSymPrev}
  1225. function SymGetLineFromAddr64(hProcess: HANDLE; qwAddr: DWORD64;
  1226. var pdwDisplacement: DWORD; var Line64: IMAGEHLP_LINE64): BOOL; stdcall;
  1227. {$EXTERNALSYM SymGetLineFromAddr64}
  1228. function SymGetLineFromAddr(hProcess: HANDLE; dwAddr: DWORD;
  1229. var pdwDisplacement: DWORD; var Line: IMAGEHLP_LINE): BOOL; stdcall;
  1230. {$EXTERNALSYM SymGetLineFromAddr}
  1231. function SymGetLineFromName64(hProcess: HANDLE; ModuleName: PSTR; FileName: PSTR;
  1232. dwLineNumber: DWORD; var plDisplacement: LONG; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
  1233. {$EXTERNALSYM SymGetLineFromName64}
  1234. function SymGetLineFromName(hProcess: HANDLE; ModuleName: PSTR; FileName: PSTR;
  1235. dwLineNumber: DWORD; var plDisplacement: LONG; var Line: IMAGEHLP_LINE): BOOL; stdcall;
  1236. {$EXTERNALSYM SymGetLineFromName}
  1237. function SymGetLineNext64(hProcess: HANDLE; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
  1238. {$EXTERNALSYM SymGetLineNext64}
  1239. function SymGetLineNext(hProcess: HANDLE; var Line: IMAGEHLP_LINE): BOOL; stdcall;
  1240. {$EXTERNALSYM SymGetLineNext}
  1241. function SymGetLinePrev64(hProcess: HANDLE; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
  1242. {$EXTERNALSYM SymGetLinePrev64}
  1243. function SymGetLinePrev(hProcess: HANDLE; var Line: IMAGEHLP_LINE): BOOL; stdcall;
  1244. {$EXTERNALSYM SymGetLinePrev}
  1245. function SymMatchFileName(FileName, Match: PSTR; var FileNameStop, MatchStop: PSTR): BOOL; stdcall;
  1246. {$EXTERNALSYM SymMatchFileName}
  1247. function SymInitialize(hProcess: HANDLE; UserSearchPath: PSTR; fInvadeProcess: BOOL): BOOL; stdcall;
  1248. {$EXTERNALSYM SymInitialize}
  1249. function SymGetSearchPath(hProcess: HANDLE; SearchPath: PSTR; SearchPathLength: DWORD): BOOL; stdcall;
  1250. {$EXTERNALSYM SymGetSearchPath}
  1251. function SymSetSearchPath(hProcess: HANDLE; SearchPath: PSTR): BOOL; stdcall;
  1252. {$EXTERNALSYM SymSetSearchPath}
  1253. function SymLoadModule64(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR;
  1254. BaseOfDll: DWORD64; SizeOfDll: DWORD): DWORD64; stdcall;
  1255. {$EXTERNALSYM SymLoadModule64}
  1256. const
  1257. SLMFLAG_VIRTUAL = $1;
  1258. {$EXTERNALSYM SLMFLAG_VIRTUAL}
  1259. function SymLoadModuleEx(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR; BaseOfDll: DWORD64;
  1260. DllSize: DWORD; Data: PMODLOAD_DATA; Flag: DWORD): DWORD64; stdcall;
  1261. {$EXTERNALSYM SymLoadModuleEx}
  1262. function SymLoadModule(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR;
  1263. BaseOfDll: DWORD; SizeOfDll: DWORD): DWORD; stdcall;
  1264. {$EXTERNALSYM SymLoadModule}
  1265. function SymUnloadModule64(hProcess: HANDLE; BaseOfDll: DWORD64): BOOL; stdcall;
  1266. {$EXTERNALSYM SymUnloadModule64}
  1267. function SymUnloadModule(hProcess: HANDLE; BaseOfDll: DWORD): BOOL; stdcall;
  1268. {$EXTERNALSYM SymUnloadModule}
  1269. function SymUnDName64(const sym: IMAGEHLP_SYMBOL64; UnDecName: PSTR;
  1270. UnDecNameLength: DWORD): BOOL; stdcall;
  1271. {$EXTERNALSYM SymUnDName64}
  1272. function SymUnDName(const sym: IMAGEHLP_SYMBOL; UnDecName: PSTR;
  1273. UnDecNameLength: DWORD): BOOL; stdcall;
  1274. {$EXTERNALSYM SymUnDName}
  1275. function SymRegisterCallback64(hProcess: HANDLE; CallbackFunction: PSYMBOL_REGISTERED_CALLBACK64;
  1276. UserContext: ULONG64): BOOL; stdcall;
  1277. {$EXTERNALSYM SymRegisterCallback64}
  1278. function SymRegisterFunctionEntryCallback64(hProcess: HANDLE; CallbackFunction: PSYMBOL_FUNCENTRY_CALLBACK64;
  1279. UserContext: ULONG64): BOOL; stdcall;
  1280. {$EXTERNALSYM SymRegisterFunctionEntryCallback64}
  1281. function SymRegisterCallback(hProcess: HANDLE; CallbackFunction: PSYMBOL_REGISTERED_CALLBACK;
  1282. UserContext: PVOID): BOOL; stdcall;
  1283. {$EXTERNALSYM SymRegisterCallback}
  1284. function SymRegisterFunctionEntryCallback(hProcess: HANDLE; CallbackFunction: PSYMBOL_FUNCENTRY_CALLBACK;
  1285. UserContext: PVOID): BOOL; stdcall;
  1286. {$EXTERNALSYM SymRegisterFunctionEntryCallback}
  1287. type
  1288. PIMAGEHLP_SYMBOL_SRC = ^IMAGEHLP_SYMBOL_SRC;
  1289. {$EXTERNALSYM PIMAGEHLP_SYMBOL_SRC}
  1290. _IMAGEHLP_SYMBOL_SRC = record
  1291. sizeofstruct: DWORD;
  1292. type_: DWORD;
  1293. file_: array [0..MAX_PATH - 1] of Char;
  1294. end;
  1295. {$EXTERNALSYM _IMAGEHLP_SYMBOL_SRC}
  1296. IMAGEHLP_SYMBOL_SRC = _IMAGEHLP_SYMBOL_SRC;
  1297. {$EXTERNALSYM IMAGEHLP_SYMBOL_SRC}
  1298. TImageHlpSymbolSrc = IMAGEHLP_SYMBOL_SRC;
  1299. PImageHlpSymbolSrc = PIMAGEHLP_SYMBOL_SRC;
  1300. PMODULE_TYPE_INFO = ^MODULE_TYPE_INFO;
  1301. {$EXTERNALSYM PMODULE_TYPE_INFO}
  1302. _MODULE_TYPE_INFO = record
  1303. dataLength: USHORT;
  1304. leaf: USHORT;
  1305. data: array [0..0] of BYTE;
  1306. end;
  1307. {$EXTERNALSYM _MODULE_TYPE_INFO}
  1308. MODULE_TYPE_INFO = _MODULE_TYPE_INFO;
  1309. {$EXTERNALSYM MODULE_TYPE_INFO}
  1310. TModuleTypeInfo = MODULE_TYPE_INFO;
  1311. PModuleTypeInfo = PMODULE_TYPE_INFO;
  1312. type
  1313. PSYMBOL_INFO = ^SYMBOL_INFO;
  1314. {$EXTERNALSYM PSYMBOL_INFO}
  1315. _SYMBOL_INFO = record
  1316. SizeOfStruct: ULONG;
  1317. TypeIndex: ULONG; // Type Index of symbol
  1318. Reserved: array [0..1] of ULONG64;
  1319. Info: ULONG;
  1320. Size: ULONG;
  1321. ModBase: ULONG64; // Base Address of module comtaining this symbol
  1322. Flags: ULONG;
  1323. Value: ULONG64; // Value of symbol, ValuePresent should be 1
  1324. Address: ULONG64; // Address of symbol including base address of module
  1325. Register_: ULONG; // register holding value or pointer to value
  1326. Scope: ULONG; // scope of the symbol
  1327. Tag: ULONG; // pdb classification
  1328. NameLen: ULONG; // Actual length of name
  1329. MaxNameLen: ULONG;
  1330. Name: array [0..0] of CHAR; // Name of symbol
  1331. end;
  1332. {$EXTERNALSYM _SYMBOL_INFO}
  1333. SYMBOL_INFO = _SYMBOL_INFO;
  1334. {$EXTERNALSYM SYMBOL_INFO}
  1335. TSymbolInfo = SYMBOL_INFO;
  1336. PSymbolInfo = PSYMBOL_INFO;
  1337. _SYMBOL_INFO_PACKAGE = record
  1338. si: SYMBOL_INFO;
  1339. name: array [0..MAX_SYM_NAME] of CHAR;
  1340. end;
  1341. {$EXTERNALSYM _SYMBOL_INFO_PACKAGE}
  1342. SYMBOL_INFO_PACKAGE = _SYMBOL_INFO_PACKAGE;
  1343. {$EXTERNALSYM SYMBOL_INFO_PACKAGE}
  1344. PSYMBOL_INFO_PACKAGE = ^SYMBOL_INFO_PACKAGE;
  1345. {$EXTERNALSYM PSYMBOL_INFO_PACKAGE}
  1346. TSymbolInfoPackage = SYMBOL_INFO_PACKAGE;
  1347. PSymbolInfoPackage = PSYMBOL_INFO_PACKAGE;
  1348. PIMAGEHLP_STACK_FRAME = ^IMAGEHLP_STACK_FRAME;
  1349. {$EXTERNALSYM PIMAGEHLP_STACK_FRAME}
  1350. _IMAGEHLP_STACK_FRAME = record
  1351. InstructionOffset: ULONG64;
  1352. ReturnOffset: ULONG64;
  1353. FrameOffset: ULONG64;
  1354. StackOffset: ULONG64;
  1355. BackingStoreOffset: ULONG64;
  1356. FuncTableEntry: ULONG64;
  1357. Params: array [0..3] of ULONG64;
  1358. Reserved: array [0..4] of ULONG64;
  1359. Virtual_: BOOL;
  1360. Reserved2: ULONG;
  1361. end;
  1362. {$EXTERNALSYM _IMAGEHLP_STACK_FRAME}
  1363. IMAGEHLP_STACK_FRAME = _IMAGEHLP_STACK_FRAME;
  1364. {$EXTERNALSYM IMAGEHLP_STACK_FRAME}
  1365. TImageHlpStackFrame = IMAGEHLP_STACK_FRAME;
  1366. PImageHlpStackFrame = PIMAGEHLP_STACK_FRAME;
  1367. IMAGEHLP_CONTEXT = LPVOID;
  1368. {$EXTERNALSYM IMAGEHLP_CONTEXT}
  1369. PIMAGEHLP_CONTEXT = ^IMAGEHLP_CONTEXT;
  1370. {$EXTERNALSYM PIMAGEHLP_CONTEXT}
  1371. TImageHlpContext = IMAGEHLP_CONTEXT;
  1372. PImageHlpContext = PIMAGEHLP_CONTEXT;
  1373. function SymSetContext(hProcess: HANDLE; StackFrame: PIMAGEHLP_STACK_FRAME; Context: PIMAGEHLP_CONTEXT): BOOL; stdcall;
  1374. {$EXTERNALSYM SymSetContext}
  1375. function SymFromAddr(hProcess: HANDLE; Address: DWORD64; Displacement: PDWORD64; Symbol: PSYMBOL_INFO): BOOL; stdcall;
  1376. {$EXTERNALSYM SymFromAddr}
  1377. // While SymFromName will provide a symbol from a name,
  1378. // SymEnumSymbols can provide the same matching information
  1379. // for ALL symbols with a matching name, even regular
  1380. // expressions. That way you can search across modules
  1381. // and differentiate between identically named symbols.
  1382. function SymFromName(hProcess: HANDLE; Name: LPSTR; Symbol: PSYMBOL_INFO): BOOL; stdcall;
  1383. {$EXTERNALSYM SymFromName}
  1384. type
  1385. PSYM_ENUMERATESYMBOLS_CALLBACK = function(pSymInfo: PSYMBOL_INFO; SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  1386. {$EXTERNALSYM PSYM_ENUMERATESYMBOLS_CALLBACK}
  1387. PSymEnumerateSymbolsCallback = PSYM_ENUMERATESYMBOLS_CALLBACK;
  1388. function SymEnumSymbols(hProcess: HANDLE; BaseOfDll: ULONG64; Mask: PCSTR; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1389. {$EXTERNALSYM SymEnumSymbols}
  1390. function SymEnumSymbolsForAddr(hProcess: HANDLE; Address: DWORD64;
  1391. EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1392. {$EXTERNALSYM SymEnumSymbolsForAddr}
  1393. type
  1394. _IMAGEHLP_SYMBOL_TYPE_INFO = (
  1395. TI_GET_SYMTAG,
  1396. TI_GET_SYMNAME,
  1397. TI_GET_LENGTH,
  1398. TI_GET_TYPE,
  1399. TI_GET_TYPEID,
  1400. TI_GET_BASETYPE,
  1401. TI_GET_ARRAYINDEXTYPEID,
  1402. TI_FINDCHILDREN,
  1403. TI_GET_DATAKIND,
  1404. TI_GET_ADDRESSOFFSET,
  1405. TI_GET_OFFSET,
  1406. TI_GET_VALUE,
  1407. TI_GET_COUNT,
  1408. TI_GET_CHILDRENCOUNT,
  1409. TI_GET_BITPOSITION,
  1410. TI_GET_VIRTUALBASECLASS,
  1411. TI_GET_VIRTUALTABLESHAPEID,
  1412. TI_GET_VIRTUALBASEPOINTEROFFSET,
  1413. TI_GET_CLASSPARENTID,
  1414. TI_GET_NESTED,
  1415. TI_GET_SYMINDEX,
  1416. TI_GET_LEXICALPARENT,
  1417. TI_GET_ADDRESS,
  1418. TI_GET_THISADJUST,
  1419. TI_GET_UDTKIND,
  1420. TI_IS_EQUIV_TO,
  1421. TI_GET_CALLING_CONVENTION);
  1422. {$EXTERNALSYM _IMAGEHLP_SYMBOL_TYPE_INFO}
  1423. IMAGEHLP_SYMBOL_TYPE_INFO = _IMAGEHLP_SYMBOL_TYPE_INFO;
  1424. {$EXTERNALSYM IMAGEHLP_SYMBOL_TYPE_INFO}
  1425. TImageHlpSymbolTypeInfo = IMAGEHLP_SYMBOL_TYPE_INFO;
  1426. PTI_FINDCHILDREN_PARAMS = ^TI_FINDCHILDREN_PARAMS;
  1427. {$EXTERNALSYM PTI_FINDCHILDREN_PARAMS}
  1428. _TI_FINDCHILDREN_PARAMS = record
  1429. Count: ULONG;
  1430. Start: ULONG;
  1431. ChildId: array [0..0] of ULONG;
  1432. end;
  1433. {$EXTERNALSYM _TI_FINDCHILDREN_PARAMS}
  1434. TI_FINDCHILDREN_PARAMS = _TI_FINDCHILDREN_PARAMS;
  1435. {$EXTERNALSYM TI_FINDCHILDREN_PARAMS}
  1436. TTiFindChildrenParams = TI_FINDCHILDREN_PARAMS;
  1437. PTiFindChildrenParams = PTI_FINDCHILDREN_PARAMS;
  1438. function SymGetTypeInfo(hProcess: HANDLE; ModBase: DWORD64; TypeId: ULONG; GetType: IMAGEHLP_SYMBOL_TYPE_INFO; pInfo: PVOID): BOOL; stdcall;
  1439. {$EXTERNALSYM SymGetTypeInfo}
  1440. function SymEnumTypes(hProcess: HANDLE; BaseOfDll: ULONG64; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1441. {$EXTERNALSYM SymEnumTypes}
  1442. function SymGetTypeFromName(hProcess: HANDLE; BaseOfDll: ULONG64; Name: LPSTR; Symbol: PSYMBOL_INFO): BOOL; stdcall;
  1443. {$EXTERNALSYM SymGetTypeFromName}
  1444. function SymAddSymbol(hProcess: HANDLE; BaseOfDll: ULONG64; Name: PCSTR; Address: DWORD64; Size, Flags: DWORD): BOOL; stdcall;
  1445. {$EXTERNALSYM SymAddSymbol}
  1446. function SymDeleteSymbol(hProcess: HANDLE; BaseOfDll: ULONG64; Name: PCSTR; Address: DWORD64; Flags: DWORD): BOOL; stdcall;
  1447. {$EXTERNALSYM SymDeleteSymbol}
  1448. //
  1449. // Full user-mode dump creation.
  1450. //
  1451. type
  1452. PDBGHELP_CREATE_USER_DUMP_CALLBACK = function(DataType: DWORD; var Data: PVOID; DataLength: LPDWORD; UserData: PVOID): BOOL; stdcall;
  1453. {$EXTERNALSYM PDBGHELP_CREATE_USER_DUMP_CALLBACK}
  1454. PDbgHelpCreateUserDumpCallback = PDBGHELP_CREATE_USER_DUMP_CALLBACK;
  1455. function DbgHelpCreateUserDump(FileName: LPSTR; Callback: PDBGHELP_CREATE_USER_DUMP_CALLBACK; UserData: PVOID): BOOL; stdcall;
  1456. {$EXTERNALSYM DbgHelpCreateUserDump}
  1457. function DbgHelpCreateUserDumpW(FileName: LPWSTR; Callback: PDBGHELP_CREATE_USER_DUMP_CALLBACK; UserData: PVOID): BOOL; stdcall;
  1458. {$EXTERNALSYM DbgHelpCreateUserDumpW}
  1459. // -----------------------------------------------------------------
  1460. // The following 4 legacy APIs are fully supported, but newer
  1461. // ones are recommended. SymFromName and SymFromAddr provide
  1462. // much more detailed info on the returned symbol.
  1463. function SymGetSymFromAddr64(hProcess: HANDLE; qwAddr: DWORD64; pdwDisplacement: PDWORD64; Symbol: PIMAGEHLP_SYMBOL64): BOOL; stdcall;
  1464. {$EXTERNALSYM SymGetSymFromAddr64}
  1465. function SymGetSymFromAddr(hProcess: HANDLE; dwAddr: DWORD; pdwDisplacement: PDWORD; Symbol: PIMAGEHLP_SYMBOL): BOOL; stdcall;
  1466. {$EXTERNALSYM SymGetSymFromAddr}
  1467. // While following two APIs will provide a symbol from a name,
  1468. // SymEnumSymbols can provide the same matching information
  1469. // for ALL symbols with a matching name, even regular
  1470. // expressions. That way you can search across modules
  1471. // and differentiate between identically named symbols.
  1472. function SymGetSymFromName64(hProcess: HANDLE; Name: PSTR; Symbol: PIMAGEHLP_SYMBOL64): BOOL; stdcall;
  1473. {$EXTERNALSYM SymGetSymFromName64}
  1474. function SymGetSymFromName(hProcess: HANDLE; Name: PSTR; Symbol: PIMAGEHLP_SYMBOL): BOOL; stdcall;
  1475. {$EXTERNALSYM SymGetSymFromName}
  1476. // -----------------------------------------------------------------
  1477. // The following APIs exist only for backwards compatibility
  1478. // with a pre-release version documented in an MSDN release.
  1479. // You should use SymFindFileInPath if you want to maintain
  1480. // future compatibility.
  1481. function FindFileInPath(hprocess: HANDLE; SearchPath: LPSTR; FileName: LPSTR; id: PVOID; two: DWORD; three: DWORD; flags: DWORD; FilePath: LPSTR): BOOL; stdcall;
  1482. {$EXTERNALSYM FindFileInPath}
  1483. // You should use SymFindFileInPath if you want to maintain
  1484. // future compatibility.
  1485. function FindFileInSearchPath(hprocess: HANDLE; SearchPath: LPSTR; FileName: LPSTR; one: DWORD; two: DWORD; three: DWORD; FilePath: LPSTR): BOOL; stdcall;
  1486. {$EXTERNALSYM FindFileInSearchPath}
  1487. function SymEnumSym(hProcess: HANDLE; BaseOfDll: ULONG64; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1488. {$EXTERNALSYM SymEnumSym}
  1489. // These values should not be used.
  1490. // They have been replaced by SYMFLAG_ values.
  1491. const
  1492. SYMF_OMAP_GENERATED = $00000001;
  1493. SYMF_OMAP_MODIFIED = $00000002;
  1494. SYMF_REGISTER = $00000008;
  1495. SYMF_REGREL = $00000010;
  1496. SYMF_FRAMEREL = $00000020;
  1497. SYMF_PARAMETER = $00000040;
  1498. SYMF_LOCAL = $00000080;
  1499. SYMF_CONSTANT = $00000100;
  1500. SYMF_EXPORT = $00000200;
  1501. SYMF_FORWARDER = $00000400;
  1502. SYMF_FUNCTION = $00000800;
  1503. SYMF_VIRTUAL = $00001000;
  1504. SYMF_THUNK = $00002000;
  1505. SYMF_TLSREL = $00004000;
  1506. // These values should also not be used.
  1507. // They have been replaced by SYMFLAG_ values.
  1508. IMAGEHLP_SYMBOL_INFO_VALUEPRESENT = 1;
  1509. IMAGEHLP_SYMBOL_INFO_REGISTER = SYMF_REGISTER; // 0x0008
  1510. IMAGEHLP_SYMBOL_INFO_REGRELATIVE = SYMF_REGREL; // 0x0010
  1511. IMAGEHLP_SYMBOL_INFO_FRAMERELATIVE = SYMF_FRAMEREL; // 0x0020
  1512. IMAGEHLP_SYMBOL_INFO_PARAMETER = SYMF_PARAMETER; // 0x0040
  1513. IMAGEHLP_SYMBOL_INFO_LOCAL = SYMF_LOCAL; // 0x0080
  1514. IMAGEHLP_SYMBOL_INFO_CONSTANT = SYMF_CONSTANT; // 0x0100
  1515. IMAGEHLP_SYMBOL_FUNCTION = SYMF_FUNCTION; // 0x0800
  1516. IMAGEHLP_SYMBOL_VIRTUAL = SYMF_VIRTUAL; // 0x1000
  1517. IMAGEHLP_SYMBOL_THUNK = SYMF_THUNK; // 0x2000
  1518. IMAGEHLP_SYMBOL_INFO_TLSRELATIVE = SYMF_TLSREL; // 0x4000
  1519. const
  1520. MINIDUMP_SIGNATURE = 'PMDM';
  1521. {$EXTERNALSYM MINIDUMP_SIGNATURE}
  1522. MINIDUMP_VERSION = 42899;
  1523. {$EXTERNALSYM MINIDUMP_VERSION}
  1524. type
  1525. RVA = DWORD;
  1526. {$EXTERNALSYM RVA}
  1527. RVA64 = ULONG64;
  1528. {$EXTERNALSYM RVA64}
  1529. _MINIDUMP_LOCATION_DESCRIPTOR = record
  1530. DataSize: ULONG32;
  1531. Rva: RVA;
  1532. end;
  1533. {$EXTERNALSYM _MINIDUMP_LOCATION_DESCRIPTOR}
  1534. MINIDUMP_LOCATION_DESCRIPTOR = _MINIDUMP_LOCATION_DESCRIPTOR;
  1535. {$EXTERNALSYM MINIDUMP_LOCATION_DESCRIPTOR}
  1536. TMinidumpLocationDescriptor = MINIDUMP_LOCATION_DESCRIPTOR;
  1537. PMinidumpLocationDescriptor = ^MINIDUMP_LOCATION_DESCRIPTOR;
  1538. _MINIDUMP_LOCATION_DESCRIPTOR64 = record
  1539. DataSize: ULONG64;
  1540. Rva: RVA64;
  1541. end;
  1542. {$EXTERNALSYM _MINIDUMP_LOCATION_DESCRIPTOR64}
  1543. MINIDUMP_LOCATION_DESCRIPTOR64 = _MINIDUMP_LOCATION_DESCRIPTOR64;
  1544. {$EXTERNALSYM MINIDUMP_LOCATION_DESCRIPTOR64}
  1545. TMinidumpLocationDescriptor64 = MINIDUMP_LOCATION_DESCRIPTOR64;
  1546. PMinidumpLocationDescriptor64 = ^MINIDUMP_LOCATION_DESCRIPTOR64;
  1547. PMINIDUMP_MEMORY_DESCRIPTOR = ^MINIDUMP_MEMORY_DESCRIPTOR;
  1548. {$EXTERNALSYM PMINIDUMP_MEMORY_DESCRIPTOR}
  1549. _MINIDUMP_MEMORY_DESCRIPTOR = record
  1550. StartOfMemoryRange: ULONG64;
  1551. Memory: MINIDUMP_LOCATION_DESCRIPTOR;
  1552. end;
  1553. {$EXTERNALSYM _MINIDUMP_MEMORY_DESCRIPTOR}
  1554. MINIDUMP_MEMORY_DESCRIPTOR = _MINIDUMP_MEMORY_DESCRIPTOR;
  1555. {$EXTERNALSYM MINIDUMP_MEMORY_DESCRIPTOR}
  1556. TMinidumpMemoryDescriptor = MINIDUMP_MEMORY_DESCRIPTOR;
  1557. PMinidumpMemoryDescriptor = PMINIDUMP_MEMORY_DESCRIPTOR;
  1558. // DESCRIPTOR64 is used for full-memory minidumps where
  1559. // all of the raw memory is laid out sequentially at the
  1560. // end of the dump. There is no need for individual RVAs
  1561. // as the RVA is the base RVA plus the sum of the preceeding
  1562. // data blocks.
  1563. PMINIDUMP_MEMORY_DESCRIPTOR64 = ^MINIDUMP_MEMORY_DESCRIPTOR64;
  1564. {$EXTERNALSYM PMINIDUMP_MEMORY_DESCRIPTOR64}
  1565. _MINIDUMP_MEMORY_DESCRIPTOR64 = record
  1566. StartOfMemoryRange: ULONG64;
  1567. DataSize: ULONG64;
  1568. end;
  1569. {$EXTERNALSYM _MINIDUMP_MEMORY_DESCRIPTOR64}
  1570. MINIDUMP_MEMORY_DESCRIPTOR64 = _MINIDUMP_MEMORY_DESCRIPTOR64;
  1571. {$EXTERNALSYM MINIDUMP_MEMORY_DESCRIPTOR64}
  1572. TMinidumpMemoryDescriptor64 = MINIDUMP_MEMORY_DESCRIPTOR64;
  1573. PMinidumpMemoryDescriptor64 = PMINIDUMP_MEMORY_DESCRIPTOR64;
  1574. PMINIDUMP_HEADER = ^MINIDUMP_HEADER;
  1575. {$EXTERNALSYM PMINIDUMP_HEADER}
  1576. _MINIDUMP_HEADER = record
  1577. Signature: ULONG32;
  1578. Version: ULONG32;
  1579. NumberOfStreams: ULONG32;
  1580. StreamDirectoryRva: RVA;
  1581. CheckSum: ULONG32;
  1582. U: record
  1583. case Integer of
  1584. 0: (Reserved: ULONG32);
  1585. 1: (TimeDateStamp: ULONG32);
  1586. end;
  1587. Flags: ULONG64;
  1588. end;
  1589. {$EXTERNALSYM _MINIDUMP_HEADER}
  1590. MINIDUMP_HEADER = _MINIDUMP_HEADER;
  1591. {$EXTERNALSYM MINIDUMP_HEADER}
  1592. TMinidumpHeader = MINIDUMP_HEADER;
  1593. PMinidumpHeader = PMINIDUMP_HEADER;
  1594. //
  1595. // The MINIDUMP_HEADER field StreamDirectoryRva points to
  1596. // an array of MINIDUMP_DIRECTORY structures.
  1597. //
  1598. PMINIDUMP_DIRECTORY = ^MINIDUMP_DIRECTORY;
  1599. {$EXTERNALSYM PMINIDUMP_DIRECTORY}
  1600. _MINIDUMP_DIRECTORY = record
  1601. StreamType: ULONG32;
  1602. Location: MINIDUMP_LOCATION_DESCRIPTOR;
  1603. end;
  1604. {$EXTERNALSYM _MINIDUMP_DIRECTORY}
  1605. MINIDUMP_DIRECTORY = _MINIDUMP_DIRECTORY;
  1606. {$EXTERNALSYM MINIDUMP_DIRECTORY}
  1607. TMinidumpDirectory = MINIDUMP_DIRECTORY;
  1608. PMinidumpDirectory = PMINIDUMP_DIRECTORY;
  1609. PMINIDUMP_STRING = ^MINIDUMP_STRING;
  1610. {$EXTERNALSYM PMINIDUMP_STRING}
  1611. _MINIDUMP_STRING = record
  1612. Length: ULONG32; // Length in bytes of the string
  1613. Buffer: PWCHAR; // Variable size buffer
  1614. end;
  1615. {$EXTERNALSYM _MINIDUMP_STRING}
  1616. MINIDUMP_STRING = _MINIDUMP_STRING;
  1617. {$EXTERNALSYM MINIDUMP_STRING}
  1618. TMinidumpString = MINIDUMP_STRING;
  1619. PMinidumpString = PMINIDUMP_STRING;
  1620. //
  1621. // The MINIDUMP_DIRECTORY field StreamType may be one of the following types.
  1622. // Types will be added in the future, so if a program reading the minidump
  1623. // header encounters a stream type it does not understand it should ignore
  1624. // the data altogether. Any tag above LastReservedStream will not be used by
  1625. // the system and is reserved for program-specific information.
  1626. //
  1627. const
  1628. UnusedStream = 0;
  1629. {$EXTERNALSYM UnusedStream}
  1630. ReservedStream0 = 1;
  1631. {$EXTERNALSYM ReservedStream0}
  1632. ReservedStream1 = 2;
  1633. {$EXTERNALSYM ReservedStream1}
  1634. ThreadListStream = 3;
  1635. {$EXTERNALSYM ThreadListStream}
  1636. ModuleListStream = 4;
  1637. {$EXTERNALSYM ModuleListStream}
  1638. MemoryListStream = 5;
  1639. {$EXTERNALSYM MemoryListStream}
  1640. ExceptionStream = 6;
  1641. {$EXTERNALSYM ExceptionStream}
  1642. SystemInfoStream = 7;
  1643. {$EXTERNALSYM SystemInfoStream}
  1644. ThreadExListStream = 8;
  1645. {$EXTERNALSYM ThreadExListStream}
  1646. Memory64ListStream = 9;
  1647. {$EXTERNALSYM Memory64ListStream}
  1648. CommentStreamA = 10;
  1649. {$EXTERNALSYM CommentStreamA}
  1650. CommentStreamW = 11;
  1651. {$EXTERNALSYM CommentStreamW}
  1652. HandleDataStream = 12;
  1653. {$EXTERNALSYM HandleDataStream}
  1654. FunctionTableStream = 13;
  1655. {$EXTERNALSYM FunctionTableStream}
  1656. UnloadedModuleListStream = 14;
  1657. {$EXTERNALSYM UnloadedModuleListStream}
  1658. MiscInfoStream = 15;
  1659. {$EXTERNALSYM MiscInfoStream}
  1660. LastReservedStream = $ffff;
  1661. {$EXTERNALSYM LastReservedStream}
  1662. type
  1663. _MINIDUMP_STREAM_TYPE = DWORD;
  1664. {$EXTERNALSYM MINIDUMP_STREAM_TYPE}
  1665. MINIDUMP_STREAM_TYPE = _MINIDUMP_STREAM_TYPE;
  1666. {$EXTERNALSYM _MINIDUMP_STREAM_TYPE}
  1667. TMinidumpStreamType = MINIDUMP_STREAM_TYPE;
  1668. //
  1669. // The minidump system information contains processor and
  1670. // Operating System specific information.
  1671. //
  1672. type
  1673. _CPU_INFORMATION = record
  1674. case Integer of
  1675. //
  1676. // X86 platforms use CPUID function to obtain processor information.
  1677. //
  1678. 0: (
  1679. //
  1680. // CPUID Subfunction 0, register EAX (VendorId [0]),
  1681. // EBX (VendorId [1]) and ECX (VendorId [2]).
  1682. //
  1683. VendorId: array [0..2] of ULONG32;
  1684. //
  1685. // CPUID Subfunction 1, register EAX
  1686. //
  1687. VersionInformation: ULONG32;
  1688. //
  1689. // CPUID Subfunction 1, register EDX
  1690. //
  1691. FeatureInformation: ULONG32;
  1692. //
  1693. // CPUID, Subfunction 80000001, register EBX. This will only
  1694. // be obtained if the vendor id is "AuthenticAMD".
  1695. //
  1696. AMDExtendedCpuFeatures: ULONG32);
  1697. //
  1698. // Non-x86 platforms use processor feature flags.
  1699. //
  1700. 1: (
  1701. ProcessorFeatures: array [0..1] of ULONG64);
  1702. end;
  1703. _MINIDUMP_SYSTEM_INFO = record
  1704. //
  1705. // ProcessorArchitecture, ProcessorLevel and ProcessorRevision are all
  1706. // taken from the SYSTEM_INFO structure obtained by GetSystemInfo( ).
  1707. //
  1708. ProcessorArchitecture: USHORT;
  1709. ProcessorLevel: USHORT;
  1710. ProcessorRevision: USHORT;
  1711. U: record
  1712. case Integer of
  1713. 0: (Reserved0: USHORT);
  1714. 1: (
  1715. NumberOfProcessors: UCHAR;
  1716. ProductType: UCHAR);
  1717. end;
  1718. //
  1719. // MajorVersion, MinorVersion, BuildNumber, PlatformId and
  1720. // CSDVersion are all taken from the OSVERSIONINFO structure
  1721. // returned by GetVersionEx( ).
  1722. //
  1723. MajorVersion: ULONG32;
  1724. MinorVersion: ULONG32;
  1725. BuildNumber: ULONG32;
  1726. PlatformId: ULONG32;
  1727. //
  1728. // RVA to a CSDVersion string in the string table.
  1729. //
  1730. CSDVersionRva: RVA;
  1731. U2: record
  1732. case Integer of
  1733. 0: (Reserved1: ULONG32);
  1734. 1: (
  1735. SuiteMask: USHORT;
  1736. Reserved2: USHORT);
  1737. end;
  1738. //
  1739. // CPU information is obtained from one of two places.
  1740. //
  1741. // 1) On x86 computers, CPU_INFORMATION is obtained from the CPUID
  1742. // instruction. You must use the X86 portion of the union for X86
  1743. // computers.
  1744. //
  1745. // 2) On non-x86 architectures, CPU_INFORMATION is obtained by calling
  1746. // IsProcessorFeatureSupported().
  1747. //
  1748. Cpu: _CPU_INFORMATION;
  1749. end;
  1750. {$EXTERNALSYM _MINIDUMP_SYSTEM_INFO}
  1751. MINIDUMP_SYSTEM_INFO = _MINIDUMP_SYSTEM_INFO;
  1752. {$EXTERNALSYM MINIDUMP_SYSTEM_INFO}
  1753. PMINIDUMP_SYSTEM_INFO = ^MINIDUMP_SYSTEM_INFO;
  1754. {$EXTERNALSYM PMINIDUMP_SYSTEM_INFO}
  1755. TMinidumpSystemInfo = MINIDUMP_SYSTEM_INFO;
  1756. PMinidumpSystemInfo = PMINIDUMP_SYSTEM_INFO;
  1757. CPU_INFORMATION = _CPU_INFORMATION;
  1758. {$EXTERNALSYM CPU_INFORMATION}
  1759. PCPU_INFORMATION = CPU_INFORMATION;
  1760. {$EXTERNALSYM PCPU_INFORMATION}
  1761. //
  1762. // The minidump thread contains standard thread
  1763. // information plus an RVA to the memory for this
  1764. // thread and an RVA to the CONTEXT structure for
  1765. // this thread.
  1766. //
  1767. //
  1768. // ThreadId must be 4 bytes on all architectures.
  1769. //
  1770. // C_ASSERT (sizeof ( ((PPROCESS_INFORMATION)0)->dwThreadId ) == 4);
  1771. type
  1772. PMINIDUMP_THREAD = ^MINIDUMP_THREAD;
  1773. {$EXTERNALSYM PMINIDUMP_THREAD}
  1774. _MINIDUMP_THREAD = record
  1775. ThreadId: ULONG32;
  1776. SuspendCount: ULONG32;
  1777. PriorityClass: ULONG32;
  1778. Priority: ULONG32;
  1779. Teb: ULONG64;
  1780. Stack: MINIDUMP_MEMORY_DESCRIPTOR;
  1781. ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
  1782. end;
  1783. {$EXTERNALSYM _MINIDUMP_THREAD}
  1784. MINIDUMP_THREAD = _MINIDUMP_THREAD;
  1785. {$EXTERNALSYM MINIDUMP_THREAD}
  1786. TMinidumpThread = MINIDUMP_THREAD;
  1787. PMinidumpThread = PMINIDUMP_THREAD;
  1788. //
  1789. // The thread list is a container of threads.
  1790. //
  1791. PMINIDUMP_THREAD_LIST = ^MINIDUMP_THREAD_LIST;
  1792. {$EXTERNALSYM PMINIDUMP_THREAD_LIST}
  1793. _MINIDUMP_THREAD_LIST = record
  1794. NumberOfThreads: ULONG32;
  1795. Threads: array [0..0] of MINIDUMP_THREAD;
  1796. end;
  1797. {$EXTERNALSYM _MINIDUMP_THREAD_LIST}
  1798. MINIDUMP_THREAD_LIST = _MINIDUMP_THREAD_LIST;
  1799. {$EXTERNALSYM MINIDUMP_THREAD_LIST}
  1800. TMinidumpThreadList = MINIDUMP_THREAD_LIST;
  1801. PMinidumpThreadList = PMINIDUMP_THREAD_LIST;
  1802. PMINIDUMP_THREAD_EX = ^MINIDUMP_THREAD_EX;
  1803. {$EXTERNALSYM PMINIDUMP_THREAD_EX}
  1804. _MINIDUMP_THREAD_EX = record
  1805. ThreadId: ULONG32;
  1806. SuspendCount: ULONG32;
  1807. PriorityClass: ULONG32;
  1808. Priority: ULONG32;
  1809. Teb: ULONG64;
  1810. Stack: MINIDUMP_MEMORY_DESCRIPTOR;
  1811. ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
  1812. BackingStore: MINIDUMP_MEMORY_DESCRIPTOR;
  1813. end;
  1814. {$EXTERNALSYM _MINIDUMP_THREAD_EX}
  1815. MINIDUMP_THREAD_EX = _MINIDUMP_THREAD_EX;
  1816. {$EXTERNALSYM MINIDUMP_THREAD_EX}
  1817. TMinidumpThreadEx = MINIDUMP_THREAD_EX;
  1818. PMinidumpThreadEx = PMINIDUMP_THREAD_EX;
  1819. //
  1820. // The thread list is a container of threads.
  1821. //
  1822. PMINIDUMP_THREAD_EX_LIST = ^MINIDUMP_THREAD_EX_LIST;
  1823. {$EXTERNALSYM PMINIDUMP_THREAD_EX_LIST}
  1824. _MINIDUMP_THREAD_EX_LIST = record
  1825. NumberOfThreads: ULONG32;
  1826. Threads: array [0..0] of MINIDUMP_THREAD_EX;
  1827. end;
  1828. {$EXTERNALSYM _MINIDUMP_THREAD_EX_LIST}
  1829. MINIDUMP_THREAD_EX_LIST = _MINIDUMP_THREAD_EX_LIST;
  1830. {$EXTERNALSYM MINIDUMP_THREAD_EX_LIST}
  1831. TMinidumpThreadExList = MINIDUMP_THREAD_EX_LIST;
  1832. PMinidumpThreadExList = PMINIDUMP_THREAD_EX_LIST;
  1833. //
  1834. // The MINIDUMP_EXCEPTION is the same as EXCEPTION on Win64.
  1835. //
  1836. PMINIDUMP_EXCEPTION = ^MINIDUMP_EXCEPTION;
  1837. {$EXTERNALSYM PMINIDUMP_EXCEPTION}
  1838. _MINIDUMP_EXCEPTION = record
  1839. ExceptionCode: ULONG32;
  1840. ExceptionFlags: ULONG32;
  1841. ExceptionRecord: ULONG64;
  1842. ExceptionAddress: ULONG64;
  1843. NumberParameters: ULONG32;
  1844. __unusedAlignment: ULONG32;
  1845. ExceptionInformation: array [0..EXCEPTION_MAXIMUM_PARAMETERS - 1] of ULONG64;
  1846. end;
  1847. {$EXTERNALSYM _MINIDUMP_EXCEPTION}
  1848. MINIDUMP_EXCEPTION = _MINIDUMP_EXCEPTION;
  1849. {$EXTERNALSYM MINIDUMP_EXCEPTION}
  1850. TMinidumpException = MINIDUMP_EXCEPTION;
  1851. PMinidumpException = PMINIDUMP_EXCEPTION;
  1852. //
  1853. // The exception information stream contains the id of the thread that caused
  1854. // the exception (ThreadId), the exception record for the exception
  1855. // (ExceptionRecord) and an RVA to the thread context where the exception
  1856. // occured.
  1857. //
  1858. PMINIDUMP_EXCEPTION_STREAM = ^MINIDUMP_EXCEPTION_STREAM;
  1859. {$EXTERNALSYM PMINIDUMP_EXCEPTION_STREAM}
  1860. _MINIDUMP_EXCEPTION_STREAM = record
  1861. ThreadId: ULONG32;
  1862. __alignment: ULONG32;
  1863. ExceptionRecord: MINIDUMP_EXCEPTION;
  1864. ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
  1865. end;
  1866. {$EXTERNALSYM _MINIDUMP_EXCEPTION_STREAM}
  1867. MINIDUMP_EXCEPTION_STREAM = _MINIDUMP_EXCEPTION_STREAM;
  1868. {$EXTERNALSYM MINIDUMP_EXCEPTION_STREAM}
  1869. TMinidumpExceptionStream = MINIDUMP_EXCEPTION_STREAM;
  1870. PMinidumpExceptionStream = PMINIDUMP_EXCEPTION_STREAM;
  1871. //
  1872. // The MINIDUMP_MODULE contains information about a
  1873. // a specific module. It includes the CheckSum and
  1874. // the TimeDateStamp for the module so the module
  1875. // can be reloaded during the analysis phase.
  1876. //
  1877. PMINIDUMP_MODULE = ^MINIDUMP_MODULE;
  1878. {$EXTERNALSYM PMINIDUMP_MODULE}
  1879. _MINIDUMP_MODULE = record
  1880. BaseOfImage: ULONG64;
  1881. SizeOfImage: ULONG32;
  1882. CheckSum: ULONG32;
  1883. TimeDateStamp: ULONG32;
  1884. ModuleNameRva: RVA;
  1885. VersionInfo: VS_FIXEDFILEINFO;
  1886. CvRecord: MINIDUMP_LOCATION_DESCRIPTOR;
  1887. MiscRecord: MINIDUMP_LOCATION_DESCRIPTOR;
  1888. Reserved0: ULONG64; // Reserved for future use.
  1889. Reserved1: ULONG64; // Reserved for future use.
  1890. end;
  1891. {$EXTERNALSYM _MINIDUMP_MODULE}
  1892. MINIDUMP_MODULE = _MINIDUMP_MODULE;
  1893. {$EXTERNALSYM MINIDUMP_MODULE}
  1894. TMinidumpModule = MINIDUMP_MODULE;
  1895. PMinidumpModule = PMINIDUMP_MODULE;
  1896. //
  1897. // The minidump module list is a container for modules.
  1898. //
  1899. PMINIDUMP_MODULE_LIST = ^MINIDUMP_MODULE_LIST;
  1900. {$EXTERNALSYM PMINIDUMP_MODULE_LIST}
  1901. _MINIDUMP_MODULE_LIST = record
  1902. NumberOfModules: ULONG32;
  1903. Modules: array [0..0] of MINIDUMP_MODULE;
  1904. end;
  1905. {$EXTERNALSYM _MINIDUMP_MODULE_LIST}
  1906. MINIDUMP_MODULE_LIST = _MINIDUMP_MODULE_LIST;
  1907. {$EXTERNALSYM MINIDUMP_MODULE_LIST}
  1908. TMinidumpModuleList = MINIDUMP_MODULE_LIST;
  1909. PMinidumpModuleList = PMINIDUMP_MODULE_LIST;
  1910. //
  1911. // Memory Ranges
  1912. //
  1913. PMINIDUMP_MEMORY_LIST = ^MINIDUMP_MEMORY_LIST;
  1914. {$EXTERNALSYM PMINIDUMP_MEMORY_LIST}
  1915. _MINIDUMP_MEMORY_LIST = record
  1916. NumberOfMemoryRanges: ULONG32;
  1917. MemoryRanges: array [0..0] of MINIDUMP_MEMORY_DESCRIPTOR;
  1918. end;
  1919. {$EXTERNALSYM _MINIDUMP_MEMORY_LIST}
  1920. MINIDUMP_MEMORY_LIST = _MINIDUMP_MEMORY_LIST;
  1921. {$EXTERNALSYM MINIDUMP_MEMORY_LIST}
  1922. TMinidumpMemoryList = MINIDUMP_MEMORY_LIST;
  1923. PMinidumpMemoryList = PMINIDUMP_MEMORY_LIST;
  1924. PMINIDUMP_MEMORY64_LIST = ^MINIDUMP_MEMORY64_LIST;
  1925. {$EXTERNALSYM PMINIDUMP_MEMORY64_LIST}
  1926. _MINIDUMP_MEMORY64_LIST = record
  1927. NumberOfMemoryRanges: ULONG64;
  1928. BaseRva: RVA64;
  1929. MemoryRanges: array [0..0] of MINIDUMP_MEMORY_DESCRIPTOR64;
  1930. end;
  1931. {$EXTERNALSYM _MINIDUMP_MEMORY64_LIST}
  1932. MINIDUMP_MEMORY64_LIST = _MINIDUMP_MEMORY64_LIST;
  1933. {$EXTERNALSYM MINIDUMP_MEMORY64_LIST}
  1934. TMinidumpMemory64List = MINIDUMP_MEMORY64_LIST;
  1935. PMinidumpMemory64List = PMINIDUMP_MEMORY64_LIST;
  1936. //
  1937. // Support for user supplied exception information.
  1938. //
  1939. PMINIDUMP_EXCEPTION_INFORMATION = ^MINIDUMP_EXCEPTION_INFORMATION;
  1940. {$EXTERNALSYM PMINIDUMP_EXCEPTION_INFORMATION}
  1941. _MINIDUMP_EXCEPTION_INFORMATION = record
  1942. ThreadId: DWORD;
  1943. ExceptionPointers: PEXCEPTION_POINTERS;
  1944. ClientPointers: BOOL;
  1945. end;
  1946. {$EXTERNALSYM _MINIDUMP_EXCEPTION_INFORMATION}
  1947. MINIDUMP_EXCEPTION_INFORMATION = _MINIDUMP_EXCEPTION_INFORMATION;
  1948. {$EXTERNALSYM MINIDUMP_EXCEPTION_INFORMATION}
  1949. TMinidumpExceptionInformation = MINIDUMP_EXCEPTION_INFORMATION;
  1950. PMinidumpExceptionInformation = PMINIDUMP_EXCEPTION_INFORMATION;
  1951. //
  1952. // Support for capturing system handle state at the time of the dump.
  1953. //
  1954. PMINIDUMP_HANDLE_DESCRIPTOR = ^MINIDUMP_HANDLE_DESCRIPTOR;
  1955. {$EXTERNALSYM PMINIDUMP_HANDLE_DESCRIPTOR}
  1956. _MINIDUMP_HANDLE_DESCRIPTOR = record
  1957. Handle: ULONG64;
  1958. TypeNameRva: RVA;
  1959. ObjectNameRva: RVA;
  1960. Attributes: ULONG32;
  1961. GrantedAccess: ULONG32;
  1962. HandleCount: ULONG32;
  1963. PointerCount: ULONG32;
  1964. end;
  1965. {$EXTERNALSYM _MINIDUMP_HANDLE_DESCRIPTOR}
  1966. MINIDUMP_HANDLE_DESCRIPTOR = _MINIDUMP_HANDLE_DESCRIPTOR;
  1967. {$EXTERNALSYM MINIDUMP_HANDLE_DESCRIPTOR}
  1968. TMinidumpHandleDescriptor = MINIDUMP_HANDLE_DESCRIPTOR;
  1969. PMinidumpHandleDescriptor = PMINIDUMP_HANDLE_DESCRIPTOR;
  1970. PMINIDUMP_HANDLE_DATA_STREAM = ^MINIDUMP_HANDLE_DATA_STREAM;
  1971. {$EXTERNALSYM PMINIDUMP_HANDLE_DATA_STREAM}
  1972. _MINIDUMP_HANDLE_DATA_STREAM = record
  1973. SizeOfHeader: ULONG32;
  1974. SizeOfDescriptor: ULONG32;
  1975. NumberOfDescriptors: ULONG32;
  1976. Reserved: ULONG32;
  1977. end;
  1978. {$EXTERNALSYM _MINIDUMP_HANDLE_DATA_STREAM}
  1979. MINIDUMP_HANDLE_DATA_STREAM = _MINIDUMP_HANDLE_DATA_STREAM;
  1980. {$EXTERNALSYM MINIDUMP_HANDLE_DATA_STREAM}
  1981. TMinidumpHandleDataStream = MINIDUMP_HANDLE_DATA_STREAM;
  1982. PMinidumpHandleDataStream = PMINIDUMP_HANDLE_DATA_STREAM;
  1983. //
  1984. // Support for capturing dynamic function table state at the time of the dump.
  1985. //
  1986. PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR = ^MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
  1987. {$EXTERNALSYM PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
  1988. _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR = record
  1989. MinimumAddress: ULONG64;
  1990. MaximumAddress: ULONG64;
  1991. BaseAddress: ULONG64;
  1992. EntryCount: ULONG32;
  1993. SizeOfAlignPad: ULONG32;
  1994. end;
  1995. {$EXTERNALSYM _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
  1996. MINIDUMP_FUNCTION_TABLE_DESCRIPTOR = _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
  1997. {$EXTERNALSYM MINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
  1998. TMinidumpFunctionTableDescriptor = MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
  1999. PMinidumpFunctionTableDescriptor = PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
  2000. PMINIDUMP_FUNCTION_TABLE_STREAM = ^MINIDUMP_FUNCTION_TABLE_STREAM;
  2001. {$EXTERNALSYM PMINIDUMP_FUNCTION_TABLE_STREAM}
  2002. _MINIDUMP_FUNCTION_TABLE_STREAM = record
  2003. SizeOfHeader: ULONG32;
  2004. SizeOfDescriptor: ULONG32;
  2005. SizeOfNativeDescriptor: ULONG32;
  2006. SizeOfFunctionEntry: ULONG32;
  2007. NumberOfDescriptors: ULONG32;
  2008. SizeOfAlignPad: ULONG32;
  2009. end;
  2010. {$EXTERNALSYM _MINIDUMP_FUNCTION_TABLE_STREAM}
  2011. MINIDUMP_FUNCTION_TABLE_STREAM = _MINIDUMP_FUNCTION_TABLE_STREAM;
  2012. {$EXTERNALSYM MINIDUMP_FUNCTION_TABLE_STREAM}
  2013. TMinidumpFunctionTableStream = MINIDUMP_FUNCTION_TABLE_STREAM;
  2014. PMinidumpFunctionTableStream = PMINIDUMP_FUNCTION_TABLE_STREAM;
  2015. //
  2016. // The MINIDUMP_UNLOADED_MODULE contains information about a
  2017. // a specific module that was previously loaded but no
  2018. // longer is. This can help with diagnosing problems where
  2019. // callers attempt to call code that is no longer loaded.
  2020. //
  2021. _MINIDUMP_UNLOADED_MODULE = record
  2022. BaseOfImage: ULONG64;
  2023. SizeOfImage: ULONG32;
  2024. CheckSum: ULONG32;
  2025. TimeDateStamp: ULONG32;
  2026. ModuleNameRva: RVA;
  2027. end;
  2028. {$EXTERNALSYM _MINIDUMP_UNLOADED_MODULE}
  2029. MINIDUMP_UNLOADED_MODULE = _MINIDUMP_UNLOADED_MODULE;
  2030. {$EXTERNALSYM MINIDUMP_UNLOADED_MODULE}
  2031. PMINIDUMP_UNLOADED_MODULE = ^MINIDUMP_UNLOADED_MODULE;
  2032. {$EXTERNALSYM PMINIDUMP_UNLOADED_MODULE}
  2033. TMiniDumpUnloadedModule = MINIDUMP_UNLOADED_MODULE;
  2034. PMiniDumpUnloadedModule = PMINIDUMP_UNLOADED_MODULE;
  2035. //
  2036. // The minidump unloaded module list is a container for unloaded modules.
  2037. //
  2038. _MINIDUMP_UNLOADED_MODULE_LIST = record
  2039. SizeOfHeader: ULONG32;
  2040. SizeOfEntry: ULONG32;
  2041. NumberOfEntries: ULONG32;
  2042. end;
  2043. {$EXTERNALSYM _MINIDUMP_UNLOADED_MODULE_LIST}
  2044. MINIDUMP_UNLOADED_MODULE_LIST = _MINIDUMP_UNLOADED_MODULE_LIST;
  2045. {$EXTERNALSYM MINIDUMP_UNLOADED_MODULE_LIST}
  2046. PMINIDUMP_UNLOADED_MODULE_LIST = ^MINIDUMP_UNLOADED_MODULE_LIST;
  2047. {$EXTERNALSYM PMINIDUMP_UNLOADED_MODULE_LIST}
  2048. TMiniDumpUnloadedModuleList = MINIDUMP_UNLOADED_MODULE_LIST;
  2049. PMiniDumpUnloadedModuleList = PMINIDUMP_UNLOADED_MODULE_LIST;
  2050. //
  2051. // The miscellaneous information stream contains a variety
  2052. // of small pieces of information. A member is valid if
  2053. // it's within the available size and its corresponding
  2054. // bit is set.
  2055. //
  2056. const
  2057. MINIDUMP_MISC1_PROCESS_ID = $00000001;
  2058. {$EXTERNALSYM MINIDUMP_MISC1_PROCESS_ID}
  2059. MINIDUMP_MISC1_PROCESS_TIMES = $00000002;
  2060. {$EXTERNALSYM MINIDUMP_MISC1_PROCESS_TIMES}
  2061. type
  2062. _MINIDUMP_MISC_INFO = record
  2063. SizeOfInfo: ULONG32;
  2064. Flags1: ULONG32;
  2065. ProcessId: ULONG32;
  2066. ProcessCreateTime: ULONG32;
  2067. ProcessUserTime: ULONG32;
  2068. ProcessKernelTime: ULONG32;
  2069. end;
  2070. {$EXTERNALSYM _MINIDUMP_MISC_INFO}
  2071. MINIDUMP_MISC_INFO = _MINIDUMP_MISC_INFO;
  2072. {$EXTERNALSYM MINIDUMP_MISC_INFO}
  2073. PMINIDUMP_MISC_INFO = ^MINIDUMP_MISC_INFO;
  2074. {$EXTERNALSYM PMINIDUMP_MISC_INFO}
  2075. TMiniDumpMiscInfo = MINIDUMP_MISC_INFO;
  2076. PMiniDumpMiscInfo = PMINIDUMP_MISC_INFO;
  2077. //
  2078. // Support for arbitrary user-defined information.
  2079. //
  2080. PMINIDUMP_USER_RECORD = ^MINIDUMP_USER_RECORD;
  2081. {$EXTERNALSYM PMINIDUMP_USER_RECORD}
  2082. _MINIDUMP_USER_RECORD = record
  2083. Type_: ULONG32;
  2084. Memory: MINIDUMP_LOCATION_DESCRIPTOR;
  2085. end;
  2086. {$EXTERNALSYM _MINIDUMP_USER_RECORD}
  2087. MINIDUMP_USER_RECORD = _MINIDUMP_USER_RECORD;
  2088. {$EXTERNALSYM MINIDUMP_USER_RECORD}
  2089. TMinidumpUserRecord = MINIDUMP_USER_RECORD;
  2090. PMinidumpUserRecord = PMINIDUMP_USER_RECORD;
  2091. PMINIDUMP_USER_STREAM = ^MINIDUMP_USER_STREAM;
  2092. {$EXTERNALSYM PMINIDUMP_USER_STREAM}
  2093. _MINIDUMP_USER_STREAM = record
  2094. Type_: ULONG32;
  2095. BufferSize: ULONG;
  2096. Buffer: PVOID;
  2097. end;
  2098. {$EXTERNALSYM _MINIDUMP_USER_STREAM}
  2099. MINIDUMP_USER_STREAM = _MINIDUMP_USER_STREAM;
  2100. {$EXTERNALSYM MINIDUMP_USER_STREAM}
  2101. TMinidumpUserStream = MINIDUMP_USER_STREAM;
  2102. PMinidumpUserStream = PMINIDUMP_USER_STREAM;
  2103. PMINIDUMP_USER_STREAM_INFORMATION = ^MINIDUMP_USER_STREAM_INFORMATION;
  2104. {$EXTERNALSYM PMINIDUMP_USER_STREAM_INFORMATION}
  2105. _MINIDUMP_USER_STREAM_INFORMATION = record
  2106. UserStreamCount: ULONG;
  2107. UserStreamArray: PMINIDUMP_USER_STREAM;
  2108. end;
  2109. {$EXTERNALSYM _MINIDUMP_USER_STREAM_INFORMATION}
  2110. MINIDUMP_USER_STREAM_INFORMATION = _MINIDUMP_USER_STREAM_INFORMATION;
  2111. {$EXTERNALSYM MINIDUMP_USER_STREAM_INFORMATION}
  2112. TMinidumpUserStreamInformation = MINIDUMP_USER_STREAM_INFORMATION;
  2113. PMinidumpUserStreamInformation = PMINIDUMP_USER_STREAM_INFORMATION;
  2114. //
  2115. // Callback support.
  2116. //
  2117. _MINIDUMP_CALLBACK_TYPE = (
  2118. ModuleCallback,
  2119. ThreadCallback,
  2120. ThreadExCallback,
  2121. IncludeThreadCallback,
  2122. IncludeModuleCallback);
  2123. {$EXTERNALSYM _MINIDUMP_CALLBACK_TYPE}
  2124. MINIDUMP_CALLBACK_TYPE = _MINIDUMP_CALLBACK_TYPE;
  2125. {$EXTERNALSYM MINIDUMP_CALLBACK_TYPE}
  2126. TMinidumpCallbackType = MINIDUMP_CALLBACK_TYPE;
  2127. PMINIDUMP_THREAD_CALLBACK = ^MINIDUMP_THREAD_CALLBACK;
  2128. {$EXTERNALSYM PMINIDUMP_THREAD_CALLBACK}
  2129. _MINIDUMP_THREAD_CALLBACK = record
  2130. ThreadId: ULONG;
  2131. ThreadHandle: HANDLE;
  2132. Context: CONTEXT;
  2133. SizeOfContext: ULONG;
  2134. StackBase: ULONG64;
  2135. StackEnd: ULONG64;
  2136. end;
  2137. {$EXTERNALSYM _MINIDUMP_THREAD_CALLBACK}
  2138. MINIDUMP_THREAD_CALLBACK = _MINIDUMP_THREAD_CALLBACK;
  2139. {$EXTERNALSYM MINIDUMP_THREAD_CALLBACK}
  2140. TMinidumpThreadCallback = MINIDUMP_THREAD_CALLBACK;
  2141. PMinidumpThreadCallback = PMINIDUMP_THREAD_CALLBACK;
  2142. PMINIDUMP_THREAD_EX_CALLBACK = ^MINIDUMP_THREAD_EX_CALLBACK;
  2143. {$EXTERNALSYM PMINIDUMP_THREAD_EX_CALLBACK}
  2144. _MINIDUMP_THREAD_EX_CALLBACK = record
  2145. ThreadId: ULONG;
  2146. ThreadHandle: HANDLE;
  2147. Context: CONTEXT;
  2148. SizeOfContext: ULONG;
  2149. StackBase: ULONG64;
  2150. StackEnd: ULONG64;
  2151. BackingStoreBase: ULONG64;
  2152. BackingStoreEnd: ULONG64;
  2153. end;
  2154. {$EXTERNALSYM _MINIDUMP_THREAD_EX_CALLBACK}
  2155. MINIDUMP_THREAD_EX_CALLBACK = _MINIDUMP_THREAD_EX_CALLBACK;
  2156. {$EXTERNALSYM MINIDUMP_THREAD_EX_CALLBACK}
  2157. TMinidumpThreadExCallback = MINIDUMP_THREAD_EX_CALLBACK;
  2158. PMinidumpThreadExCallback = PMINIDUMP_THREAD_EX_CALLBACK;
  2159. PMINIDUMP_INCLUDE_THREAD_CALLBACK = ^MINIDUMP_INCLUDE_THREAD_CALLBACK;
  2160. {$EXTERNALSYM PMINIDUMP_INCLUDE_THREAD_CALLBACK}
  2161. _MINIDUMP_INCLUDE_THREAD_CALLBACK = record
  2162. ThreadId: ULONG;
  2163. end;
  2164. {$EXTERNALSYM _MINIDUMP_INCLUDE_THREAD_CALLBACK}
  2165. MINIDUMP_INCLUDE_THREAD_CALLBACK = _MINIDUMP_INCLUDE_THREAD_CALLBACK;
  2166. {$EXTERNALSYM MINIDUMP_INCLUDE_THREAD_CALLBACK}
  2167. TMinidumpIncludeThreadCallback = MINIDUMP_INCLUDE_THREAD_CALLBACK;
  2168. PMinidumpIncludeThreadCallback = PMINIDUMP_INCLUDE_THREAD_CALLBACK;
  2169. const
  2170. ThreadWriteThread = $0001;
  2171. {$EXTERNALSYM ThreadWriteThread}
  2172. ThreadWriteStack = $0002;
  2173. {$EXTERNALSYM ThreadWriteStack}
  2174. ThreadWriteContext = $0004;
  2175. {$EXTERNALSYM ThreadWriteContext}
  2176. ThreadWriteBackingStore = $0008;
  2177. {$EXTERNALSYM ThreadWriteBackingStore}
  2178. ThreadWriteInstructionWindow = $0010;
  2179. {$EXTERNALSYM ThreadWriteInstructionWindow}
  2180. ThreadWriteThreadData = $0020;
  2181. {$EXTERNALSYM ThreadWriteThreadData}
  2182. type
  2183. _THREAD_WRITE_FLAGS = DWORD;
  2184. {$EXTERNALSYM _THREAD_WRITE_FLAGS}
  2185. THREAD_WRITE_FLAGS = _THREAD_WRITE_FLAGS;
  2186. {$EXTERNALSYM THREAD_WRITE_FLAGS}
  2187. TThreadWriteFlags = THREAD_WRITE_FLAGS;
  2188. type
  2189. PMINIDUMP_MODULE_CALLBACK = ^MINIDUMP_MODULE_CALLBACK;
  2190. {$EXTERNALSYM PMINIDUMP_MODULE_CALLBACK}
  2191. _MINIDUMP_MODULE_CALLBACK = record
  2192. FullPath: PWCHAR;
  2193. BaseOfImage: ULONG64;
  2194. SizeOfImage: ULONG;
  2195. CheckSum: ULONG;
  2196. TimeDateStamp: ULONG;
  2197. VersionInfo: VS_FIXEDFILEINFO;
  2198. CvRecord: PVOID;
  2199. SizeOfCvRecord: ULONG;
  2200. MiscRecord: PVOID;
  2201. SizeOfMiscRecord: ULONG;
  2202. end;
  2203. {$EXTERNALSYM _MINIDUMP_MODULE_CALLBACK}
  2204. MINIDUMP_MODULE_CALLBACK = _MINIDUMP_MODULE_CALLBACK;
  2205. {$EXTERNALSYM MINIDUMP_MODULE_CALLBACK}
  2206. TMinidumpModuleCallback = MINIDUMP_MODULE_CALLBACK;
  2207. PMinidumpModuleCallback = PMINIDUMP_MODULE_CALLBACK;
  2208. PMINIDUMP_INCLUDE_MODULE_CALLBACK = ^MINIDUMP_INCLUDE_MODULE_CALLBACK;
  2209. {$EXTERNALSYM PMINIDUMP_INCLUDE_MODULE_CALLBACK}
  2210. _MINIDUMP_INCLUDE_MODULE_CALLBACK = record
  2211. BaseOfImage: ULONG64;
  2212. end;
  2213. {$EXTERNALSYM _MINIDUMP_INCLUDE_MODULE_CALLBACK}
  2214. MINIDUMP_INCLUDE_MODULE_CALLBACK = _MINIDUMP_INCLUDE_MODULE_CALLBACK;
  2215. {$EXTERNALSYM MINIDUMP_INCLUDE_MODULE_CALLBACK}
  2216. TMinidumpIncludeModuleCallback = MINIDUMP_INCLUDE_MODULE_CALLBACK;
  2217. PMinidumpIncludeModuleCallback = PMINIDUMP_INCLUDE_MODULE_CALLBACK;
  2218. const
  2219. ModuleWriteModule = $0001;
  2220. {$EXTERNALSYM ModuleWriteModule}
  2221. ModuleWriteDataSeg = $0002;
  2222. {$EXTERNALSYM ModuleWriteDataSeg}
  2223. ModuleWriteMiscRecord = $0004;
  2224. {$EXTERNALSYM ModuleWriteMiscRecord}
  2225. ModuleWriteCvRecord = $0008;
  2226. {$EXTERNALSYM ModuleWriteCvRecord}
  2227. ModuleReferencedByMemory = $0010;
  2228. {$EXTERNALSYM ModuleReferencedByMemory}
  2229. type
  2230. _MODULE_WRITE_FLAGS = DWORD;
  2231. {$EXTERNALSYM _MODULE_WRITE_FLAGS}
  2232. MODULE_WRITE_FLAGS = _MODULE_WRITE_FLAGS;
  2233. {$EXTERNALSYM MODULE_WRITE_FLAGS}
  2234. TModuleWriteFlags = MODULE_WRITE_FLAGS;
  2235. _MINIDUMP_CALLBACK_INPUT = record
  2236. ProcessId: ULONG;
  2237. ProcessHandle: HANDLE;
  2238. CallbackType: ULONG;
  2239. case Integer of
  2240. 0: (Thread: MINIDUMP_THREAD_CALLBACK);
  2241. 1: (ThreadEx: MINIDUMP_THREAD_EX_CALLBACK);
  2242. 2: (Module: MINIDUMP_MODULE_CALLBACK);
  2243. 3: (IncludeThread: MINIDUMP_INCLUDE_THREAD_CALLBACK);
  2244. 4: (IncludeModule: MINIDUMP_INCLUDE_MODULE_CALLBACK);
  2245. end;
  2246. {$EXTERNALSYM _MINIDUMP_CALLBACK_INPUT}
  2247. MINIDUMP_CALLBACK_INPUT = _MINIDUMP_CALLBACK_INPUT;
  2248. {$EXTERNALSYM MINIDUMP_CALLBACK_INPUT}
  2249. PMINIDUMP_CALLBACK_INPUT = ^MINIDUMP_CALLBACK_INPUT;
  2250. {$EXTERNALSYM PMINIDUMP_CALLBACK_INPUT}
  2251. TminidumpCallbackInput = MINIDUMP_CALLBACK_INPUT;
  2252. PMINIDUMP_CALLBACK_OUTPUT = ^MINIDUMP_CALLBACK_OUTPUT;
  2253. {$EXTERNALSYM PMINIDUMP_CALLBACK_OUTPUT}
  2254. _MINIDUMP_CALLBACK_OUTPUT = record
  2255. case Integer of
  2256. 0: (ModuleWriteFlags: ULONG);
  2257. 1: (ThreadWriteFlags: ULONG);
  2258. end;
  2259. {$EXTERNALSYM _MINIDUMP_CALLBACK_OUTPUT}
  2260. MINIDUMP_CALLBACK_OUTPUT = _MINIDUMP_CALLBACK_OUTPUT;
  2261. {$EXTERNALSYM MINIDUMP_CALLBACK_OUTPUT}
  2262. TMinidumpCallbackOutput = MINIDUMP_CALLBACK_OUTPUT;
  2263. PMinidumpCallbackOutput = PMINIDUMP_CALLBACK_OUTPUT;
  2264. //
  2265. // A normal minidump contains just the information
  2266. // necessary to capture stack traces for all of the
  2267. // existing threads in a process.
  2268. //
  2269. // A minidump with data segments includes all of the data
  2270. // sections from loaded modules in order to capture
  2271. // global variable contents. This can make the dump much
  2272. // larger if many modules have global data.
  2273. //
  2274. // A minidump with full memory includes all of the accessible
  2275. // memory in the process and can be very large. A minidump
  2276. // with full memory always has the raw memory data at the end
  2277. // of the dump so that the initial structures in the dump can
  2278. // be mapped directly without having to include the raw
  2279. // memory information.
  2280. //
  2281. // Stack and backing store memory can be filtered to remove
  2282. // data unnecessary for stack walking. This can improve
  2283. // compression of stacks and also deletes data that may
  2284. // be private and should not be stored in a dump.
  2285. // Memory can also be scanned to see what modules are
  2286. // referenced by stack and backing store memory to allow
  2287. // omission of other modules to reduce dump size.
  2288. // In either of these modes the ModuleReferencedByMemory flag
  2289. // is set for all modules referenced before the base
  2290. // module callbacks occur.
  2291. //
  2292. // On some operating systems a list of modules that were
  2293. // recently unloaded is kept in addition to the currently
  2294. // loaded module list. This information can be saved in
  2295. // the dump if desired.
  2296. //
  2297. // Stack and backing store memory can be scanned for referenced
  2298. // pages in order to pick up data referenced by locals or other
  2299. // stack memory. This can increase the size of a dump significantly.
  2300. //
  2301. // Module paths may contain undesired information such as user names
  2302. // or other important directory names so they can be stripped. This
  2303. // option reduces the ability to locate the proper image later
  2304. // and should only be used in certain situations.
  2305. //
  2306. // Complete operating system per-process and per-thread information can
  2307. // be gathered and stored in the dump.
  2308. //
  2309. // The virtual address space can be scanned for various types
  2310. // of memory to be included in the dump.
  2311. //
  2312. const
  2313. MiniDumpNormal = $0000;
  2314. {$EXTERNALSYM MiniDumpNormal}
  2315. MiniDumpWithDataSegs = $0001;
  2316. {$EXTERNALSYM MiniDumpWithDataSegs}
  2317. MiniDumpWithFullMemory = $0002;
  2318. {$EXTERNALSYM MiniDumpWithFullMemory}
  2319. MiniDumpWithHandleData = $0004;
  2320. {$EXTERNALSYM MiniDumpWithHandleData}
  2321. MiniDumpFilterMemory = $0008;
  2322. {$EXTERNALSYM MiniDumpFilterMemory}
  2323. MiniDumpScanMemory = $0010;
  2324. {$EXTERNALSYM MiniDumpScanMemory}
  2325. MiniDumpWithUnloadedModules = $0020;
  2326. {$EXTERNALSYM MiniDumpWithUnloadedModules}
  2327. MiniDumpWithIndirectlyReferencedMemory = $0040;
  2328. {$EXTERNALSYM MiniDumpWithIndirectlyReferencedMemory}
  2329. MiniDumpFilterModulePaths = $0080;
  2330. {$EXTERNALSYM MiniDumpFilterModulePaths}
  2331. MiniDumpWithProcessThreadData = $0100;
  2332. {$EXTERNALSYM MiniDumpWithProcessThreadData}
  2333. MiniDumpWithPrivateReadWriteMemory = $0200;
  2334. {$EXTERNALSYM MiniDumpWithPrivateReadWriteMemory}
  2335. type
  2336. _MINIDUMP_TYPE = DWORD;
  2337. {$EXTERNALSYM _MINIDUMP_TYPE}
  2338. MINIDUMP_TYPE = _MINIDUMP_TYPE;
  2339. {$EXTERNALSYM MINIDUMP_TYPE}
  2340. TMinidumpType = MINIDUMP_TYPE;
  2341. //
  2342. // The minidump callback should modify the FieldsToWrite parameter to reflect
  2343. // what portions of the specified thread or module should be written to the
  2344. // file.
  2345. //
  2346. MINIDUMP_CALLBACK_ROUTINE = function(CallbackParam: PVOID; CallbackInput: PMINIDUMP_CALLBACK_INPUT;
  2347. CallbackOutput: PMINIDUMP_CALLBACK_OUTPUT): BOOL; stdcall;
  2348. {$EXTERNALSYM MINIDUMP_CALLBACK_ROUTINE}
  2349. TMinidumpCallbackRoutine = MINIDUMP_CALLBACK_ROUTINE;
  2350. PMINIDUMP_CALLBACK_INFORMATION = ^MINIDUMP_CALLBACK_INFORMATION;
  2351. {$EXTERNALSYM PMINIDUMP_CALLBACK_INFORMATION}
  2352. _MINIDUMP_CALLBACK_INFORMATION = record
  2353. CallbackRoutine: MINIDUMP_CALLBACK_ROUTINE;
  2354. CallbackParam: PVOID;
  2355. end;
  2356. {$EXTERNALSYM _MINIDUMP_CALLBACK_INFORMATION}
  2357. MINIDUMP_CALLBACK_INFORMATION = _MINIDUMP_CALLBACK_INFORMATION;
  2358. {$EXTERNALSYM MINIDUMP_CALLBACK_INFORMATION}
  2359. TMinidumpCallbackInformation = MINIDUMP_CALLBACK_INFORMATION;
  2360. PMinidumpCallbackInformation = PMINIDUMP_CALLBACK_INFORMATION;
  2361. //++
  2362. //
  2363. // PVOID
  2364. // RVA_TO_ADDR(
  2365. // PVOID Mapping,
  2366. // ULONG Rva
  2367. // )
  2368. //
  2369. // Routine Description:
  2370. //
  2371. // Map an RVA that is contained within a mapped file to it's associated
  2372. // flat address.
  2373. //
  2374. // Arguments:
  2375. //
  2376. // Mapping - Base address of mapped file containing the RVA.
  2377. //
  2378. // Rva - An Rva to fixup.
  2379. //
  2380. // Return Values:
  2381. //
  2382. // A pointer to the desired data.
  2383. //
  2384. //--
  2385. function RVA_TO_ADDR(Mapping, Rva: Pointer): Pointer;
  2386. {$EXTERNALSYM RVA_TO_ADDR}
  2387. function MiniDumpWriteDump(hProcess: HANDLE; ProcessId: DWORD; hFile: HANDLE; DumpType: MINIDUMP_TYPE; ExceptionParam: PMINIDUMP_EXCEPTION_INFORMATION; UserStreamParam: PMINIDUMP_USER_STREAM_INFORMATION; CallbackParam: PMINIDUMP_CALLBACK_INFORMATION): BOOL; stdcall;
  2388. {$EXTERNALSYM MiniDumpWriteDump}
  2389. function MiniDumpReadDumpStream(BaseOfDump: PVOID; StreamNumber: ULONG; var Dir: PMINIDUMP_DIRECTORY; var StreamPointer: PVOID; var StreamSize: ULONG): BOOL; stdcall;
  2390. {$EXTERNALSYM MiniDumpReadDumpStream}
  2391. implementation
  2392. const
  2393. ImageHlpLib = 'imagehlp.dll';
  2394. {$IFDEF UNICODE}
  2395. AWSuffix = 'W';
  2396. {$ELSE}
  2397. AWSuffix = 'A';
  2398. {$ENDIF UNICODE}
  2399. procedure Address32To64(a32: LPADDRESS; a64: LPADDRESS64);
  2400. begin
  2401. a64^.Offset := {ULONG64(LONG64(LONG(}a32^.Offset{)))};
  2402. a64^.Segment := a32^.Segment;
  2403. a64^.Mode := a32^.Mode;
  2404. end;
  2405. procedure Address64To32(a64: LPADDRESS64; a32: LPADDRESS);
  2406. begin
  2407. a32^.Offset := ULONG(a64^.Offset);
  2408. a32^.Segment := a64^.Segment;
  2409. a32^.Mode := a64^.Mode;
  2410. end;
  2411. procedure KdHelp32To64(p32: PKDHELP; p64: PKDHELP64);
  2412. begin
  2413. p64^.Thread := p32^.Thread;
  2414. p64^.ThCallbackStack := p32^.ThCallbackStack;
  2415. p64^.NextCallback := p32^.NextCallback;
  2416. p64^.FramePointer := p32^.FramePointer;
  2417. p64^.KiCallUserMode := p32^.KiCallUserMode;
  2418. p64^.KeUserCallbackDispatcher := p32^.KeUserCallbackDispatcher;
  2419. p64^.SystemRangeStart := p32^.SystemRangeStart;
  2420. end;
  2421. function RVA_TO_ADDR(Mapping, Rva: Pointer): Pointer;
  2422. begin
  2423. Result := Pointer(Cardinal(Mapping) + Cardinal(Rva));
  2424. end;
  2425. {$IFDEF DYNAMIC_LINK}
  2426. var
  2427. _BindImage: Pointer;
  2428. function BindImage;
  2429. begin
  2430. GetProcedureAddress(_BindImage, ImageHlpLib, 'BindImage');
  2431. asm
  2432. MOV ESP, EBP
  2433. POP EBP
  2434. JMP [_BindImage]
  2435. end;
  2436. end;
  2437. var
  2438. _BindImageEx: Pointer;
  2439. function BindImageEx;
  2440. begin
  2441. GetProcedureAddress(_BindImageEx, ImageHlpLib, 'BindImageEx');
  2442. asm
  2443. MOV ESP, EBP
  2444. POP EBP
  2445. JMP [_BindImageEx]
  2446. end;
  2447. end;
  2448. var
  2449. _ReBaseImage: Pointer;
  2450. function ReBaseImage;
  2451. begin
  2452. GetProcedureAddress(_ReBaseImage, ImageHlpLib, 'ReBaseImage');
  2453. asm
  2454. MOV ESP, EBP
  2455. POP EBP
  2456. JMP [_ReBaseImage]
  2457. end;
  2458. end;
  2459. var
  2460. _ReBaseImage64: Pointer;
  2461. function ReBaseImage64;
  2462. begin
  2463. GetProcedureAddress(_ReBaseImage64, ImageHlpLib, 'ReBaseImage64');
  2464. asm
  2465. MOV ESP, EBP
  2466. POP EBP
  2467. JMP [_ReBaseImage64]
  2468. end;
  2469. end;
  2470. var
  2471. _CheckSumMappedFile: Pointer;
  2472. function CheckSumMappedFile;
  2473. begin
  2474. GetProcedureAddress(_CheckSumMappedFile, ImageHlpLib, 'CheckSumMappedFile');
  2475. asm
  2476. MOV ESP, EBP
  2477. POP EBP
  2478. JMP [_CheckSumMappedFile]
  2479. end;
  2480. end;
  2481. var
  2482. _MapFileAndCheckSumA: Pointer;
  2483. function MapFileAndCheckSumA;
  2484. begin
  2485. GetProcedureAddress(_MapFileAndCheckSumA, ImageHlpLib, 'MapFileAndCheckSumA');
  2486. asm
  2487. MOV ESP, EBP
  2488. POP EBP
  2489. JMP [_MapFileAndCheckSumA]
  2490. end;
  2491. end;
  2492. var
  2493. _MapFileAndCheckSumW: Pointer;
  2494. function MapFileAndCheckSumW;
  2495. begin
  2496. GetProcedureAddress(_MapFileAndCheckSumW, ImageHlpLib, 'MapFileAndCheckSumW');
  2497. asm
  2498. MOV ESP, EBP
  2499. POP EBP
  2500. JMP [_MapFileAndCheckSumW]
  2501. end;
  2502. end;
  2503. var
  2504. _MapFileAndCheckSum: Pointer;
  2505. function MapFileAndCheckSum;
  2506. begin
  2507. GetProcedureAddress(_MapFileAndCheckSum, ImageHlpLib, 'MapFileAndCheckSum' + AWSuffix);
  2508. asm
  2509. MOV ESP, EBP
  2510. POP EBP
  2511. JMP [_MapFileAndCheckSum]
  2512. end;
  2513. end;
  2514. var
  2515. _GetImageConfigInformation: Pointer;
  2516. function GetImageConfigInformation;
  2517. begin
  2518. GetProcedureAddress(_GetImageConfigInformation, ImageHlpLib, 'GetImageConfigInformation');
  2519. asm
  2520. MOV ESP, EBP
  2521. POP EBP
  2522. JMP [_GetImageConfigInformation]
  2523. end;
  2524. end;
  2525. var
  2526. _GetImageUnusedHeaderBytes: Pointer;
  2527. function GetImageUnusedHeaderBytes;
  2528. begin
  2529. GetProcedureAddress(_GetImageUnusedHeaderBytes, ImageHlpLib, 'GetImageUnusedHeaderBytes');
  2530. asm
  2531. MOV ESP, EBP
  2532. POP EBP
  2533. JMP [_GetImageUnusedHeaderBytes]
  2534. end;
  2535. end;
  2536. var
  2537. _SetImageConfigInformation: Pointer;
  2538. function SetImageConfigInformation;
  2539. begin
  2540. GetProcedureAddress(_SetImageConfigInformation, ImageHlpLib, 'SetImageConfigInformation');
  2541. asm
  2542. MOV ESP, EBP
  2543. POP EBP
  2544. JMP [_SetImageConfigInformation]
  2545. end;
  2546. end;
  2547. var
  2548. _ImageGetDigestStream: Pointer;
  2549. function ImageGetDigestStream;
  2550. begin
  2551. GetProcedureAddress(_ImageGetDigestStream, ImageHlpLib, 'ImageGetDigestStream');
  2552. asm
  2553. MOV ESP, EBP
  2554. POP EBP
  2555. JMP [_ImageGetDigestStream]
  2556. end;
  2557. end;
  2558. var
  2559. _ImageAddCertificate: Pointer;
  2560. function ImageAddCertificate;
  2561. begin
  2562. GetProcedureAddress(_ImageAddCertificate, ImageHlpLib, 'ImageAddCertificate');
  2563. asm
  2564. MOV ESP, EBP
  2565. POP EBP
  2566. JMP [_ImageAddCertificate]
  2567. end;
  2568. end;
  2569. var
  2570. _ImageRemoveCertificate: Pointer;
  2571. function ImageRemoveCertificate;
  2572. begin
  2573. GetProcedureAddress(_ImageRemoveCertificate, ImageHlpLib, 'ImageRemoveCertificate');
  2574. asm
  2575. MOV ESP, EBP
  2576. POP EBP
  2577. JMP [_ImageRemoveCertificate]
  2578. end;
  2579. end;
  2580. var
  2581. _ImageEnumerateCertificates: Pointer;
  2582. function ImageEnumerateCertificates;
  2583. begin
  2584. GetProcedureAddress(_ImageEnumerateCertificates, ImageHlpLib, 'ImageEnumerateCertificates');
  2585. asm
  2586. MOV ESP, EBP
  2587. POP EBP
  2588. JMP [_ImageEnumerateCertificates]
  2589. end;
  2590. end;
  2591. var
  2592. _ImageGetCertificateData: Pointer;
  2593. function ImageGetCertificateData;
  2594. begin
  2595. GetProcedureAddress(_ImageGetCertificateData, ImageHlpLib, 'ImageGetCertificateData');
  2596. asm
  2597. MOV ESP, EBP
  2598. POP EBP
  2599. JMP [_ImageGetCertificateData]
  2600. end;
  2601. end;
  2602. var
  2603. _ImageGetCertificateHeader: Pointer;
  2604. function ImageGetCertificateHeader;
  2605. begin
  2606. GetProcedureAddress(_ImageGetCertificateHeader, ImageHlpLib, 'ImageGetCertificateHeader');
  2607. asm
  2608. MOV ESP, EBP
  2609. POP EBP
  2610. JMP [_ImageGetCertificateHeader]
  2611. end;
  2612. end;
  2613. var
  2614. _ImageLoad: Pointer;
  2615. function ImageLoad;
  2616. begin
  2617. GetProcedureAddress(_ImageLoad, ImageHlpLib, 'ImageLoad');
  2618. asm
  2619. MOV ESP, EBP
  2620. POP EBP
  2621. JMP [_ImageLoad]
  2622. end;
  2623. end;
  2624. var
  2625. _ImageUnload: Pointer;
  2626. function ImageUnload;
  2627. begin
  2628. GetProcedureAddress(_ImageUnload, ImageHlpLib, 'ImageUnload');
  2629. asm
  2630. MOV ESP, EBP
  2631. POP EBP
  2632. JMP [_ImageUnload]
  2633. end;
  2634. end;
  2635. var
  2636. _MapAndLoad: Pointer;
  2637. function MapAndLoad;
  2638. begin
  2639. GetProcedureAddress(_MapAndLoad, ImageHlpLib, 'MapAndLoad');
  2640. asm
  2641. MOV ESP, EBP
  2642. POP EBP
  2643. JMP [_MapAndLoad]
  2644. end;
  2645. end;
  2646. var
  2647. _UnMapAndLoad: Pointer;
  2648. function UnMapAndLoad;
  2649. begin
  2650. GetProcedureAddress(_UnMapAndLoad, ImageHlpLib, 'UnMapAndLoad');
  2651. asm
  2652. MOV ESP, EBP
  2653. POP EBP
  2654. JMP [_UnMapAndLoad]
  2655. end;
  2656. end;
  2657. var
  2658. _TouchFileTimes: Pointer;
  2659. function TouchFileTimes;
  2660. begin
  2661. GetProcedureAddress(_TouchFileTimes, ImageHlpLib, 'TouchFileTimes');
  2662. asm
  2663. MOV ESP, EBP
  2664. POP EBP
  2665. JMP [_TouchFileTimes]
  2666. end;
  2667. end;
  2668. var
  2669. _SplitSymbols: Pointer;
  2670. function SplitSymbols;
  2671. begin
  2672. GetProcedureAddress(_SplitSymbols, ImageHlpLib, 'SplitSymbols');
  2673. asm
  2674. MOV ESP, EBP
  2675. POP EBP
  2676. JMP [_SplitSymbols]
  2677. end;
  2678. end;
  2679. var
  2680. _UpdateDebugInfoFile: Pointer;
  2681. function UpdateDebugInfoFile;
  2682. begin
  2683. GetProcedureAddress(_UpdateDebugInfoFile, ImageHlpLib, 'UpdateDebugInfoFile');
  2684. asm
  2685. MOV ESP, EBP
  2686. POP EBP
  2687. JMP [_UpdateDebugInfoFile]
  2688. end;
  2689. end;
  2690. var
  2691. _UpdateDebugInfoFileEx: Pointer;
  2692. function UpdateDebugInfoFileEx;
  2693. begin
  2694. GetProcedureAddress(_UpdateDebugInfoFileEx, ImageHlpLib, 'UpdateDebugInfoFileEx');
  2695. asm
  2696. MOV ESP, EBP
  2697. POP EBP
  2698. JMP [_UpdateDebugInfoFileEx]
  2699. end;
  2700. end;
  2701. var
  2702. _FindDebugInfoFile: Pointer;
  2703. function FindDebugInfoFile;
  2704. begin
  2705. GetProcedureAddress(_FindDebugInfoFile, ImageHlpLib, 'FindDebugInfoFile');
  2706. asm
  2707. MOV ESP, EBP
  2708. POP EBP
  2709. JMP [_FindDebugInfoFile]
  2710. end;
  2711. end;
  2712. var
  2713. _FindDebugInfoFileEx: Pointer;
  2714. function FindDebugInfoFileEx;
  2715. begin
  2716. GetProcedureAddress(_FindDebugInfoFileEx, ImageHlpLib, 'FindDebugInfoFileEx');
  2717. asm
  2718. MOV ESP, EBP
  2719. POP EBP
  2720. JMP [_FindDebugInfoFileEx]
  2721. end;
  2722. end;
  2723. var
  2724. _SymFindFileInPath: Pointer;
  2725. function SymFindFileInPath;
  2726. begin
  2727. GetProcedureAddress(_SymFindFileInPath, ImageHlpLib, 'SymFindFileInPath');
  2728. asm
  2729. MOV ESP, EBP
  2730. POP EBP
  2731. JMP [_SymFindFileInPath]
  2732. end;
  2733. end;
  2734. var
  2735. _FindExecutableImage: Pointer;
  2736. function FindExecutableImage;
  2737. begin
  2738. GetProcedureAddress(_FindExecutableImage, ImageHlpLib, 'FindExecutableImage');
  2739. asm
  2740. MOV ESP, EBP
  2741. POP EBP
  2742. JMP [_FindExecutableImage]
  2743. end;
  2744. end;
  2745. var
  2746. _FindExecutableImageEx: Pointer;
  2747. function FindExecutableImageEx;
  2748. begin
  2749. GetProcedureAddress(_FindExecutableImageEx, ImageHlpLib, 'FindExecutableImageEx');
  2750. asm
  2751. MOV ESP, EBP
  2752. POP EBP
  2753. JMP [_FindExecutableImageEx]
  2754. end;
  2755. end;
  2756. var
  2757. _ImageNtHeader: Pointer;
  2758. function ImageNtHeader;
  2759. begin
  2760. GetProcedureAddress(_ImageNtHeader, ImageHlpLib, 'ImageNtHeader');
  2761. asm
  2762. MOV ESP, EBP
  2763. POP EBP
  2764. JMP [_ImageNtHeader]
  2765. end;
  2766. end;
  2767. var
  2768. _ImageDirectoryEntryToDataEx: Pointer;
  2769. function ImageDirectoryEntryToDataEx;
  2770. begin
  2771. GetProcedureAddress(_ImageDirectoryEntryToDataEx, ImageHlpLib, 'ImageDirectoryEntryToDataEx');
  2772. asm
  2773. MOV ESP, EBP
  2774. POP EBP
  2775. JMP [_ImageDirectoryEntryToDataEx]
  2776. end;
  2777. end;
  2778. var
  2779. _ImageDirectoryEntryToData: Pointer;
  2780. function ImageDirectoryEntryToData;
  2781. begin
  2782. GetProcedureAddress(_ImageDirectoryEntryToData, ImageHlpLib, 'ImageDirectoryEntryToData');
  2783. asm
  2784. MOV ESP, EBP
  2785. POP EBP
  2786. JMP [_ImageDirectoryEntryToData]
  2787. end;
  2788. end;
  2789. var
  2790. _ImageRvaToSection: Pointer;
  2791. function ImageRvaToSection;
  2792. begin
  2793. GetProcedureAddress(_ImageRvaToSection, ImageHlpLib, 'ImageRvaToSection');
  2794. asm
  2795. MOV ESP, EBP
  2796. POP EBP
  2797. JMP [_ImageRvaToSection]
  2798. end;
  2799. end;
  2800. var
  2801. _ImageRvaToVa: Pointer;
  2802. function ImageRvaToVa;
  2803. begin
  2804. GetProcedureAddress(_ImageRvaToVa, ImageHlpLib, 'ImageRvaToVa');
  2805. asm
  2806. MOV ESP, EBP
  2807. POP EBP
  2808. JMP [_ImageRvaToVa]
  2809. end;
  2810. end;
  2811. var
  2812. _MapDebugInformation: Pointer;
  2813. function MapDebugInformation;
  2814. begin
  2815. GetProcedureAddress(_MapDebugInformation, ImageHlpLib, 'MapDebugInformation');
  2816. asm
  2817. MOV ESP, EBP
  2818. POP EBP
  2819. JMP [_MapDebugInformation]
  2820. end;
  2821. end;
  2822. var
  2823. _UnmapDebugInformation: Pointer;
  2824. function UnmapDebugInformation;
  2825. begin
  2826. GetProcedureAddress(_UnmapDebugInformation, ImageHlpLib, 'UnmapDebugInformation');
  2827. asm
  2828. MOV ESP, EBP
  2829. POP EBP
  2830. JMP [_UnmapDebugInformation]
  2831. end;
  2832. end;
  2833. var
  2834. _SearchTreeForFile: Pointer;
  2835. function SearchTreeForFile;
  2836. begin
  2837. GetProcedureAddress(_SearchTreeForFile, ImageHlpLib, 'SearchTreeForFile');
  2838. asm
  2839. MOV ESP, EBP
  2840. POP EBP
  2841. JMP [_SearchTreeForFile]
  2842. end;
  2843. end;
  2844. var
  2845. _EnumDirTree: Pointer;
  2846. function EnumDirTree;
  2847. begin
  2848. GetProcedureAddress(_EnumDirTree, ImageHlpLib, 'EnumDirTree');
  2849. asm
  2850. MOV ESP, EBP
  2851. POP EBP
  2852. JMP [_EnumDirTree]
  2853. end;
  2854. end;
  2855. var
  2856. _MakeSureDirectoryPathExists: Pointer;
  2857. function MakeSureDirectoryPathExists;
  2858. begin
  2859. GetProcedureAddress(_MakeSureDirectoryPathExists, ImageHlpLib, 'MakeSureDirectoryPathExists');
  2860. asm
  2861. MOV ESP, EBP
  2862. POP EBP
  2863. JMP [_MakeSureDirectoryPathExists]
  2864. end;
  2865. end;
  2866. var
  2867. _UnDecorateSymbolName: Pointer;
  2868. function UnDecorateSymbolName;
  2869. begin
  2870. GetProcedureAddress(_UnDecorateSymbolName, ImageHlpLib, 'UnDecorateSymbolName');
  2871. asm
  2872. MOV ESP, EBP
  2873. POP EBP
  2874. JMP [_UnDecorateSymbolName]
  2875. end;
  2876. end;
  2877. var
  2878. _StackWalk64: Pointer;
  2879. function StackWalk64;
  2880. begin
  2881. GetProcedureAddress(_StackWalk64, ImageHlpLib, 'StackWalk64');
  2882. asm
  2883. MOV ESP, EBP
  2884. POP EBP
  2885. JMP [_StackWalk64]
  2886. end;
  2887. end;
  2888. var
  2889. _StackWalk: Pointer;
  2890. function StackWalk;
  2891. begin
  2892. GetProcedureAddress(_StackWalk, ImageHlpLib, 'StackWalk');
  2893. asm
  2894. MOV ESP, EBP
  2895. POP EBP
  2896. JMP [_StackWalk]
  2897. end;
  2898. end;
  2899. var
  2900. _ImagehlpApiVersion: Pointer;
  2901. function ImagehlpApiVersion;
  2902. begin
  2903. GetProcedureAddress(_ImagehlpApiVersion, ImageHlpLib, 'ImagehlpApiVersion');
  2904. asm
  2905. MOV ESP, EBP
  2906. POP EBP
  2907. JMP [_ImagehlpApiVersion]
  2908. end;
  2909. end;
  2910. var
  2911. _ImagehlpApiVersionEx: Pointer;
  2912. function ImagehlpApiVersionEx;
  2913. begin
  2914. GetProcedureAddress(_ImagehlpApiVersionEx, ImageHlpLib, 'ImagehlpApiVersionEx');
  2915. asm
  2916. MOV ESP, EBP
  2917. POP EBP
  2918. JMP [_ImagehlpApiVersionEx]
  2919. end;
  2920. end;
  2921. var
  2922. _GetTimestampForLoadedLibrary: Pointer;
  2923. function GetTimestampForLoadedLibrary;
  2924. begin
  2925. GetProcedureAddress(_GetTimestampForLoadedLibrary, ImageHlpLib, 'GetTimestampForLoadedLibrary');
  2926. asm
  2927. MOV ESP, EBP
  2928. POP EBP
  2929. JMP [_GetTimestampForLoadedLibrary]
  2930. end;
  2931. end;
  2932. var
  2933. _SymSetOptions: Pointer;
  2934. function SymSetOptions;
  2935. begin
  2936. GetProcedureAddress(_SymSetOptions, ImageHlpLib, 'SymSetOptions');
  2937. asm
  2938. MOV ESP, EBP
  2939. POP EBP
  2940. JMP [_SymSetOptions]
  2941. end;
  2942. end;
  2943. var
  2944. _SymGetOptions: Pointer;
  2945. function SymGetOptions;
  2946. begin
  2947. GetProcedureAddress(_SymGetOptions, ImageHlpLib, 'SymGetOptions');
  2948. asm
  2949. MOV ESP, EBP
  2950. POP EBP
  2951. JMP [_SymGetOptions]
  2952. end;
  2953. end;
  2954. var
  2955. _SymCleanup: Pointer;
  2956. function SymCleanup;
  2957. begin
  2958. GetProcedureAddress(_SymCleanup, ImageHlpLib, 'SymCleanup');
  2959. asm
  2960. MOV ESP, EBP
  2961. POP EBP
  2962. JMP [_SymCleanup]
  2963. end;
  2964. end;
  2965. var
  2966. _SymMatchString: Pointer;
  2967. function SymMatchString;
  2968. begin
  2969. GetProcedureAddress(_SymMatchString, ImageHlpLib, 'SymMatchString');
  2970. asm
  2971. MOV ESP, EBP
  2972. POP EBP
  2973. JMP [_SymMatchString]
  2974. end;
  2975. end;
  2976. var
  2977. _SymEnumSourceFiles: Pointer;
  2978. function SymEnumSourceFiles;
  2979. begin
  2980. GetProcedureAddress(_SymEnumSourceFiles, ImageHlpLib, 'SymEnumSourceFiles');
  2981. asm
  2982. MOV ESP, EBP
  2983. POP EBP
  2984. JMP [_SymEnumSourceFiles]
  2985. end;
  2986. end;
  2987. var
  2988. _SymEnumerateModules64: Pointer;
  2989. function SymEnumerateModules64;
  2990. begin
  2991. GetProcedureAddress(_SymEnumerateModules64, ImageHlpLib, 'SymEnumerateModules64');
  2992. asm
  2993. MOV ESP, EBP
  2994. POP EBP
  2995. JMP [_SymEnumerateModules64]
  2996. end;
  2997. end;
  2998. var
  2999. _SymEnumerateModules: Pointer;
  3000. function SymEnumerateModules;
  3001. begin
  3002. GetProcedureAddress(_SymEnumerateModules, ImageHlpLib, 'SymEnumerateModules');
  3003. asm
  3004. MOV ESP, EBP
  3005. POP EBP
  3006. JMP [_SymEnumerateModules]
  3007. end;
  3008. end;
  3009. var
  3010. _SymEnumerateSymbols64: Pointer;
  3011. function SymEnumerateSymbols64;
  3012. begin
  3013. GetProcedureAddress(_SymEnumerateSymbols64, ImageHlpLib, 'SymEnumerateSymbols64');
  3014. asm
  3015. MOV ESP, EBP
  3016. POP EBP
  3017. JMP [_SymEnumerateSymbols64]
  3018. end;
  3019. end;
  3020. var
  3021. _SymEnumerateSymbolsW64: Pointer;
  3022. function SymEnumerateSymbolsW64;
  3023. begin
  3024. GetProcedureAddress(_SymEnumerateSymbolsW64, ImageHlpLib, 'SymEnumerateSymbolsW64');
  3025. asm
  3026. MOV ESP, EBP
  3027. POP EBP
  3028. JMP [_SymEnumerateSymbolsW64]
  3029. end;
  3030. end;
  3031. var
  3032. _SymEnumerateSymbols: Pointer;
  3033. function SymEnumerateSymbols;
  3034. begin
  3035. GetProcedureAddress(_SymEnumerateSymbols, ImageHlpLib, 'SymEnumerateSymbols');
  3036. asm
  3037. MOV ESP, EBP
  3038. POP EBP
  3039. JMP [_SymEnumerateSymbols]
  3040. end;
  3041. end;
  3042. var
  3043. _SymEnumerateSymbolsW: Pointer;
  3044. function SymEnumerateSymbolsW;
  3045. begin
  3046. GetProcedureAddress(_SymEnumerateSymbolsW, ImageHlpLib, 'SymEnumerateSymbolsW');
  3047. asm
  3048. MOV ESP, EBP
  3049. POP EBP
  3050. JMP [_SymEnumerateSymbolsW]
  3051. end;
  3052. end;
  3053. var
  3054. _EnumerateLoadedModules64: Pointer;
  3055. function EnumerateLoadedModules64;
  3056. begin
  3057. GetProcedureAddress(_EnumerateLoadedModules64, ImageHlpLib, 'EnumerateLoadedModules64');
  3058. asm
  3059. MOV ESP, EBP
  3060. POP EBP
  3061. JMP [_EnumerateLoadedModules64]
  3062. end;
  3063. end;
  3064. var
  3065. _EnumerateLoadedModules: Pointer;
  3066. function EnumerateLoadedModules;
  3067. begin
  3068. GetProcedureAddress(_EnumerateLoadedModules, ImageHlpLib, 'EnumerateLoadedModules');
  3069. asm
  3070. MOV ESP, EBP
  3071. POP EBP
  3072. JMP [_EnumerateLoadedModules]
  3073. end;
  3074. end;
  3075. var
  3076. _SymFunctionTableAccess64: Pointer;
  3077. function SymFunctionTableAccess64;
  3078. begin
  3079. GetProcedureAddress(_SymFunctionTableAccess64, ImageHlpLib, 'SymFunctionTableAccess64');
  3080. asm
  3081. MOV ESP, EBP
  3082. POP EBP
  3083. JMP [_SymFunctionTableAccess64]
  3084. end;
  3085. end;
  3086. var
  3087. _SymFunctionTableAccess: Pointer;
  3088. function SymFunctionTableAccess;
  3089. begin
  3090. GetProcedureAddress(_SymFunctionTableAccess, ImageHlpLib, 'SymFunctionTableAccess');
  3091. asm
  3092. MOV ESP, EBP
  3093. POP EBP
  3094. JMP [_SymFunctionTableAccess]
  3095. end;
  3096. end;
  3097. var
  3098. _SymGetModuleInfo64: Pointer;
  3099. function SymGetModuleInfo64;
  3100. begin
  3101. GetProcedureAddress(_SymGetModuleInfo64, ImageHlpLib, 'SymGetModuleInfo64');
  3102. asm
  3103. MOV ESP, EBP
  3104. POP EBP
  3105. JMP [_SymGetModuleInfo64]
  3106. end;
  3107. end;
  3108. var
  3109. _SymGetModuleInfoW64: Pointer;
  3110. function SymGetModuleInfoW64;
  3111. begin
  3112. GetProcedureAddress(_SymGetModuleInfoW64, ImageHlpLib, 'SymGetModuleInfoW64');
  3113. asm
  3114. MOV ESP, EBP
  3115. POP EBP
  3116. JMP [_SymGetModuleInfoW64]
  3117. end;
  3118. end;
  3119. var
  3120. _SymGetModuleInfo: Pointer;
  3121. function SymGetModuleInfo;
  3122. begin
  3123. GetProcedureAddress(_SymGetModuleInfo, ImageHlpLib, 'SymGetModuleInfo');
  3124. asm
  3125. MOV ESP, EBP
  3126. POP EBP
  3127. JMP [_SymGetModuleInfo]
  3128. end;
  3129. end;
  3130. var
  3131. _SymGetModuleInfoW: Pointer;
  3132. function SymGetModuleInfoW;
  3133. begin
  3134. GetProcedureAddress(_SymGetModuleInfoW, ImageHlpLib, 'SymGetModuleInfoW');
  3135. asm
  3136. MOV ESP, EBP
  3137. POP EBP
  3138. JMP [_SymGetModuleInfoW]
  3139. end;
  3140. end;
  3141. var
  3142. _SymGetModuleBase64: Pointer;
  3143. function SymGetModuleBase64;
  3144. begin
  3145. GetProcedureAddress(_SymGetModuleBase64, ImageHlpLib, 'SymGetModuleBase64');
  3146. asm
  3147. MOV ESP, EBP
  3148. POP EBP
  3149. JMP [_SymGetModuleBase64]
  3150. end;
  3151. end;
  3152. var
  3153. _SymGetModuleBase: Pointer;
  3154. function SymGetModuleBase;
  3155. begin
  3156. GetProcedureAddress(_SymGetModuleBase, ImageHlpLib, 'SymGetModuleBase');
  3157. asm
  3158. MOV ESP, EBP
  3159. POP EBP
  3160. JMP [_SymGetModuleBase]
  3161. end;
  3162. end;
  3163. var
  3164. _SymGetSymNext64: Pointer;
  3165. function SymGetSymNext64;
  3166. begin
  3167. GetProcedureAddress(_SymGetSymNext64, ImageHlpLib, 'SymGetSymNext64');
  3168. asm
  3169. MOV ESP, EBP
  3170. POP EBP
  3171. JMP [_SymGetSymNext64]
  3172. end;
  3173. end;
  3174. var
  3175. _SymGetSymNext: Pointer;
  3176. function SymGetSymNext;
  3177. begin
  3178. GetProcedureAddress(_SymGetSymNext, ImageHlpLib, 'SymGetSymNext');
  3179. asm
  3180. MOV ESP, EBP
  3181. POP EBP
  3182. JMP [_SymGetSymNext]
  3183. end;
  3184. end;
  3185. var
  3186. _SymGetSymPrev64: Pointer;
  3187. function SymGetSymPrev64;
  3188. begin
  3189. GetProcedureAddress(_SymGetSymPrev64, ImageHlpLib, 'SymGetSymPrev64');
  3190. asm
  3191. MOV ESP, EBP
  3192. POP EBP
  3193. JMP [_SymGetSymPrev64]
  3194. end;
  3195. end;
  3196. var
  3197. _SymGetSymPrev: Pointer;
  3198. function SymGetSymPrev;
  3199. begin
  3200. GetProcedureAddress(_SymGetSymPrev, ImageHlpLib, 'SymGetSymPrev');
  3201. asm
  3202. MOV ESP, EBP
  3203. POP EBP
  3204. JMP [_SymGetSymPrev]
  3205. end;
  3206. end;
  3207. var
  3208. _SymGetLineFromAddr64: Pointer;
  3209. function SymGetLineFromAddr64;
  3210. begin
  3211. GetProcedureAddress(_SymGetLineFromAddr64, ImageHlpLib, 'SymGetLineFromAddr64');
  3212. asm
  3213. MOV ESP, EBP
  3214. POP EBP
  3215. JMP [_SymGetLineFromAddr64]
  3216. end;
  3217. end;
  3218. var
  3219. _SymGetLineFromAddr: Pointer;
  3220. function SymGetLineFromAddr;
  3221. begin
  3222. GetProcedureAddress(_SymGetLineFromAddr, ImageHlpLib, 'SymGetLineFromAddr');
  3223. asm
  3224. MOV ESP, EBP
  3225. POP EBP
  3226. JMP [_SymGetLineFromAddr]
  3227. end;
  3228. end;
  3229. var
  3230. _SymGetLineFromName64: Pointer;
  3231. function SymGetLineFromName64;
  3232. begin
  3233. GetProcedureAddress(_SymGetLineFromName64, ImageHlpLib, 'SymGetLineFromName64');
  3234. asm
  3235. MOV ESP, EBP
  3236. POP EBP
  3237. JMP [_SymGetLineFromName64]
  3238. end;
  3239. end;
  3240. var
  3241. _SymGetLineFromName: Pointer;
  3242. function SymGetLineFromName;
  3243. begin
  3244. GetProcedureAddress(_SymGetLineFromName, ImageHlpLib, 'SymGetLineFromName');
  3245. asm
  3246. MOV ESP, EBP
  3247. POP EBP
  3248. JMP [_SymGetLineFromName]
  3249. end;
  3250. end;
  3251. var
  3252. _SymGetLineNext64: Pointer;
  3253. function SymGetLineNext64;
  3254. begin
  3255. GetProcedureAddress(_SymGetLineNext64, ImageHlpLib, 'SymGetLineNext64');
  3256. asm
  3257. MOV ESP, EBP
  3258. POP EBP
  3259. JMP [_SymGetLineNext64]
  3260. end;
  3261. end;
  3262. var
  3263. _SymGetLineNext: Pointer;
  3264. function SymGetLineNext;
  3265. begin
  3266. GetProcedureAddress(_SymGetLineNext, ImageHlpLib, 'SymGetLineNext');
  3267. asm
  3268. MOV ESP, EBP
  3269. POP EBP
  3270. JMP [_SymGetLineNext]
  3271. end;
  3272. end;
  3273. var
  3274. _SymGetLinePrev64: Pointer;
  3275. function SymGetLinePrev64;
  3276. begin
  3277. GetProcedureAddress(_SymGetLinePrev64, ImageHlpLib, 'SymGetLinePrev64');
  3278. asm
  3279. MOV ESP, EBP
  3280. POP EBP
  3281. JMP [_SymGetLinePrev64]
  3282. end;
  3283. end;
  3284. var
  3285. _SymGetLinePrev: Pointer;
  3286. function SymGetLinePrev;
  3287. begin
  3288. GetProcedureAddress(_SymGetLinePrev, ImageHlpLib, 'SymGetLinePrev');
  3289. asm
  3290. MOV ESP, EBP
  3291. POP EBP
  3292. JMP [_SymGetLinePrev]
  3293. end;
  3294. end;
  3295. var
  3296. _SymMatchFileName: Pointer;
  3297. function SymMatchFileName;
  3298. begin
  3299. GetProcedureAddress(_SymMatchFileName, ImageHlpLib, 'SymMatchFileName');
  3300. asm
  3301. MOV ESP, EBP
  3302. POP EBP
  3303. JMP [_SymMatchFileName]
  3304. end;
  3305. end;
  3306. var
  3307. _SymInitialize: Pointer;
  3308. function SymInitialize;
  3309. begin
  3310. GetProcedureAddress(_SymInitialize, ImageHlpLib, 'SymInitialize');
  3311. asm
  3312. MOV ESP, EBP
  3313. POP EBP
  3314. JMP [_SymInitialize]
  3315. end;
  3316. end;
  3317. var
  3318. _SymGetSearchPath: Pointer;
  3319. function SymGetSearchPath;
  3320. begin
  3321. GetProcedureAddress(_SymGetSearchPath, ImageHlpLib, 'SymGetSearchPath');
  3322. asm
  3323. MOV ESP, EBP
  3324. POP EBP
  3325. JMP [_SymGetSearchPath]
  3326. end;
  3327. end;
  3328. var
  3329. _SymSetSearchPath: Pointer;
  3330. function SymSetSearchPath;
  3331. begin
  3332. GetProcedureAddress(_SymSetSearchPath, ImageHlpLib, 'SymSetSearchPath');
  3333. asm
  3334. MOV ESP, EBP
  3335. POP EBP
  3336. JMP [_SymSetSearchPath]
  3337. end;
  3338. end;
  3339. var
  3340. _SymLoadModuleEx: Pointer;
  3341. function SymLoadModuleEx;
  3342. begin
  3343. GetProcedureAddress(_SymLoadModuleEx, ImageHlpLib, 'SymLoadModuleEx');
  3344. asm
  3345. MOV ESP, EBP
  3346. POP EBP
  3347. JMP [_SymLoadModuleEx]
  3348. end;
  3349. end;
  3350. var
  3351. _SymLoadModule64: Pointer;
  3352. function SymLoadModule64;
  3353. begin
  3354. GetProcedureAddress(_SymLoadModule64, ImageHlpLib, 'SymLoadModule64');
  3355. asm
  3356. MOV ESP, EBP
  3357. POP EBP
  3358. JMP [_SymLoadModule64]
  3359. end;
  3360. end;
  3361. var
  3362. _SymLoadModule: Pointer;
  3363. function SymLoadModule;
  3364. begin
  3365. GetProcedureAddress(_SymLoadModule, ImageHlpLib, 'SymLoadModule');
  3366. asm
  3367. MOV ESP, EBP
  3368. POP EBP
  3369. JMP [_SymLoadModule]
  3370. end;
  3371. end;
  3372. var
  3373. _SymUnloadModule64: Pointer;
  3374. function SymUnloadModule64;
  3375. begin
  3376. GetProcedureAddress(_SymUnloadModule64, ImageHlpLib, 'SymUnloadModule64');
  3377. asm
  3378. MOV ESP, EBP
  3379. POP EBP
  3380. JMP [_SymUnloadModule64]
  3381. end;
  3382. end;
  3383. var
  3384. _SymUnloadModule: Pointer;
  3385. function SymUnloadModule;
  3386. begin
  3387. GetProcedureAddress(_SymUnloadModule, ImageHlpLib, 'SymUnloadModule');
  3388. asm
  3389. MOV ESP, EBP
  3390. POP EBP
  3391. JMP [_SymUnloadModule]
  3392. end;
  3393. end;
  3394. var
  3395. _SymUnDName64: Pointer;
  3396. function SymUnDName64;
  3397. begin
  3398. GetProcedureAddress(_SymUnDName64, ImageHlpLib, 'SymUnDName64');
  3399. asm
  3400. MOV ESP, EBP
  3401. POP EBP
  3402. JMP [_SymUnDName64]
  3403. end;
  3404. end;
  3405. var
  3406. _SymUnDName: Pointer;
  3407. function SymUnDName;
  3408. begin
  3409. GetProcedureAddress(_SymUnDName, ImageHlpLib, 'SymUnDName');
  3410. asm
  3411. MOV ESP, EBP
  3412. POP EBP
  3413. JMP [_SymUnDName]
  3414. end;
  3415. end;
  3416. var
  3417. _SymRegisterCallback64: Pointer;
  3418. function SymRegisterCallback64;
  3419. begin
  3420. GetProcedureAddress(_SymRegisterCallback64, ImageHlpLib, 'SymRegisterCallback64');
  3421. asm
  3422. MOV ESP, EBP
  3423. POP EBP
  3424. JMP [_SymRegisterCallback64]
  3425. end;
  3426. end;
  3427. var
  3428. _SymRegFuncEntryCallback64: Pointer;
  3429. function SymRegisterFunctionEntryCallback64;
  3430. begin
  3431. GetProcedureAddress(_SymRegFuncEntryCallback64, ImageHlpLib, 'SymRegisterFunctionEntryCallback64');
  3432. asm
  3433. MOV ESP, EBP
  3434. POP EBP
  3435. JMP [_SymRegFuncEntryCallback64]
  3436. end;
  3437. end;
  3438. var
  3439. _SymRegisterCallback: Pointer;
  3440. function SymRegisterCallback;
  3441. begin
  3442. GetProcedureAddress(_SymRegisterCallback, ImageHlpLib, 'SymRegisterCallback');
  3443. asm
  3444. MOV ESP, EBP
  3445. POP EBP
  3446. JMP [_SymRegisterCallback]
  3447. end;
  3448. end;
  3449. var
  3450. _SymRegisterFuncEntryCallback: Pointer;
  3451. function SymRegisterFunctionEntryCallback;
  3452. begin
  3453. GetProcedureAddress(_SymRegisterFuncEntryCallback, ImageHlpLib, 'SymRegisterFunctionEntryCallback');
  3454. asm
  3455. MOV ESP, EBP
  3456. POP EBP
  3457. JMP [_SymRegisterFuncEntryCallback]
  3458. end;
  3459. end;
  3460. var
  3461. _SymSetContext: Pointer;
  3462. function SymSetContext;
  3463. begin
  3464. GetProcedureAddress(_SymSetContext, ImageHlpLib, 'SymSetContext');
  3465. asm
  3466. MOV ESP, EBP
  3467. POP EBP
  3468. JMP [_SymSetContext]
  3469. end;
  3470. end;
  3471. var
  3472. _SymFromAddr: Pointer;
  3473. function SymFromAddr;
  3474. begin
  3475. GetProcedureAddress(_SymFromAddr, ImageHlpLib, 'SymFromAddr');
  3476. asm
  3477. MOV ESP, EBP
  3478. POP EBP
  3479. JMP [_SymFromAddr]
  3480. end;
  3481. end;
  3482. var
  3483. _SymFromName: Pointer;
  3484. function SymFromName;
  3485. begin
  3486. GetProcedureAddress(_SymFromName, ImageHlpLib, 'SymFromName');
  3487. asm
  3488. MOV ESP, EBP
  3489. POP EBP
  3490. JMP [_SymFromName]
  3491. end;
  3492. end;
  3493. var
  3494. _SymEnumSymbolsForAddr: Pointer;
  3495. function SymEnumSymbolsForAddr;
  3496. begin
  3497. GetProcedureAddress(_SymEnumSymbolsForAddr, ImageHlpLib, 'SymEnumSymbolsForAddr');
  3498. asm
  3499. MOV ESP, EBP
  3500. POP EBP
  3501. JMP [_SymEnumSymbolsForAddr]
  3502. end;
  3503. end;
  3504. var
  3505. _SymEnumSymbols: Pointer;
  3506. function SymEnumSymbols;
  3507. begin
  3508. GetProcedureAddress(_SymEnumSymbols, ImageHlpLib, 'SymEnumSymbols');
  3509. asm
  3510. MOV ESP, EBP
  3511. POP EBP
  3512. JMP [_SymEnumSymbols]
  3513. end;
  3514. end;
  3515. var
  3516. _SymGetTypeInfo: Pointer;
  3517. function SymGetTypeInfo;
  3518. begin
  3519. GetProcedureAddress(_SymGetTypeInfo, ImageHlpLib, 'SymGetTypeInfo');
  3520. asm
  3521. MOV ESP, EBP
  3522. POP EBP
  3523. JMP [_SymGetTypeInfo]
  3524. end;
  3525. end;
  3526. var
  3527. _SymEnumTypes: Pointer;
  3528. function SymEnumTypes;
  3529. begin
  3530. GetProcedureAddress(_SymEnumTypes, ImageHlpLib, 'SymEnumTypes');
  3531. asm
  3532. MOV ESP, EBP
  3533. POP EBP
  3534. JMP [_SymEnumTypes]
  3535. end;
  3536. end;
  3537. var
  3538. _SymGetTypeFromName: Pointer;
  3539. function SymGetTypeFromName;
  3540. begin
  3541. GetProcedureAddress(_SymGetTypeFromName, ImageHlpLib, 'SymGetTypeFromName');
  3542. asm
  3543. MOV ESP, EBP
  3544. POP EBP
  3545. JMP [_SymGetTypeFromName]
  3546. end;
  3547. end;
  3548. var
  3549. _SymAddSymbol: Pointer;
  3550. function SymAddSymbol;
  3551. begin
  3552. GetProcedureAddress(_SymAddSymbol, ImageHlpLib, 'SymAddSymbol');
  3553. asm
  3554. MOV ESP, EBP
  3555. POP EBP
  3556. JMP [_SymAddSymbol]
  3557. end;
  3558. end;
  3559. var
  3560. _SymDeleteSymbol: Pointer;
  3561. function SymDeleteSymbol;
  3562. begin
  3563. GetProcedureAddress(_SymDeleteSymbol, ImageHlpLib, 'SymDeleteSymbol');
  3564. asm
  3565. MOV ESP, EBP
  3566. POP EBP
  3567. JMP [_SymDeleteSymbol]
  3568. end;
  3569. end;
  3570. var
  3571. _DbgHelpCreateUserDump: Pointer;
  3572. function DbgHelpCreateUserDump;
  3573. begin
  3574. GetProcedureAddress(_DbgHelpCreateUserDump, ImageHlpLib, 'DbgHelpCreateUserDump');
  3575. asm
  3576. MOV ESP, EBP
  3577. POP EBP
  3578. JMP [_DbgHelpCreateUserDump]
  3579. end;
  3580. end;
  3581. var
  3582. _DbgHelpCreateUserDumpW: Pointer;
  3583. function DbgHelpCreateUserDumpW;
  3584. begin
  3585. GetProcedureAddress(_DbgHelpCreateUserDumpW, ImageHlpLib, 'DbgHelpCreateUserDumpW');
  3586. asm
  3587. MOV ESP, EBP
  3588. POP EBP
  3589. JMP [_DbgHelpCreateUserDumpW]
  3590. end;
  3591. end;
  3592. var
  3593. _SymGetSymFromAddr64: Pointer;
  3594. function SymGetSymFromAddr64;
  3595. begin
  3596. GetProcedureAddress(_SymGetSymFromAddr64, ImageHlpLib, 'SymGetSymFromAddr64');
  3597. asm
  3598. MOV ESP, EBP
  3599. POP EBP
  3600. JMP [_SymGetSymFromAddr64]
  3601. end;
  3602. end;
  3603. var
  3604. _SymGetSymFromAddr: Pointer;
  3605. function SymGetSymFromAddr;
  3606. begin
  3607. GetProcedureAddress(_SymGetSymFromAddr, ImageHlpLib, 'SymGetSymFromAddr');
  3608. asm
  3609. MOV ESP, EBP
  3610. POP EBP
  3611. JMP [_SymGetSymFromAddr]
  3612. end;
  3613. end;
  3614. var
  3615. _SymGetSymFromName64: Pointer;
  3616. function SymGetSymFromName64;
  3617. begin
  3618. GetProcedureAddress(_SymGetSymFromName64, ImageHlpLib, 'SymGetSymFromName64');
  3619. asm
  3620. MOV ESP, EBP
  3621. POP EBP
  3622. JMP [_SymGetSymFromName64]
  3623. end;
  3624. end;
  3625. var
  3626. _SymGetSymFromName: Pointer;
  3627. function SymGetSymFromName;
  3628. begin
  3629. GetProcedureAddress(_SymGetSymFromName, ImageHlpLib, 'SymGetSymFromName');
  3630. asm
  3631. MOV ESP, EBP
  3632. POP EBP
  3633. JMP [_SymGetSymFromName]
  3634. end;
  3635. end;
  3636. var
  3637. _FindFileInPath: Pointer;
  3638. function FindFileInPath;
  3639. begin
  3640. GetProcedureAddress(_FindFileInPath, ImageHlpLib, 'FindFileInPath');
  3641. asm
  3642. MOV ESP, EBP
  3643. POP EBP
  3644. JMP [_FindFileInPath]
  3645. end;
  3646. end;
  3647. var
  3648. _FindFileInSearchPath: Pointer;
  3649. function FindFileInSearchPath;
  3650. begin
  3651. GetProcedureAddress(_FindFileInSearchPath, ImageHlpLib, 'FindFileInSearchPath');
  3652. asm
  3653. MOV ESP, EBP
  3654. POP EBP
  3655. JMP [_FindFileInSearchPath]
  3656. end;
  3657. end;
  3658. var
  3659. _SymEnumSym: Pointer;
  3660. function SymEnumSym;
  3661. begin
  3662. GetProcedureAddress(_SymEnumSym, ImageHlpLib, 'SymEnumSym');
  3663. asm
  3664. MOV ESP, EBP
  3665. POP EBP
  3666. JMP [_SymEnumSym]
  3667. end;
  3668. end;
  3669. var
  3670. _MiniDumpWriteDump: Pointer;
  3671. function MiniDumpWriteDump;
  3672. begin
  3673. GetProcedureAddress(_MiniDumpWriteDump, ImageHlpLib, 'MiniDumpWriteDump');
  3674. asm
  3675. MOV ESP, EBP
  3676. POP EBP
  3677. JMP [_MiniDumpWriteDump]
  3678. end;
  3679. end;
  3680. var
  3681. _MiniDumpReadDumpStream: Pointer;
  3682. function MiniDumpReadDumpStream;
  3683. begin
  3684. GetProcedureAddress(_MiniDumpReadDumpStream, ImageHlpLib, 'MiniDumpReadDumpStream');
  3685. asm
  3686. MOV ESP, EBP
  3687. POP EBP
  3688. JMP [_MiniDumpReadDumpStream]
  3689. end;
  3690. end;
  3691. {$ELSE}
  3692. function BindImage; external ImageHlpLib name 'BindImage';
  3693. function BindImageEx; external ImageHlpLib name 'BindImageEx';
  3694. function ReBaseImage; external ImageHlpLib name 'ReBaseImage';
  3695. function ReBaseImage64; external ImageHlpLib name 'ReBaseImage64';
  3696. function CheckSumMappedFile; external ImageHlpLib name 'CheckSumMappedFile';
  3697. function MapFileAndCheckSumA; external ImageHlpLib name 'MapFileAndCheckSumA';
  3698. function MapFileAndCheckSumW; external ImageHlpLib name 'MapFileAndCheckSumW';
  3699. function MapFileAndCheckSum; external ImageHlpLib name 'MapFileAndCheckSum' + AWSuffix;
  3700. function GetImageConfigInformation; external ImageHlpLib name 'GetImageConfigInformation';
  3701. function GetImageUnusedHeaderBytes; external ImageHlpLib name 'GetImageUnusedHeaderBytes';
  3702. function SetImageConfigInformation; external ImageHlpLib name 'SetImageConfigInformation';
  3703. function ImageGetDigestStream; external ImageHlpLib name 'ImageGetDigestStream';
  3704. function ImageAddCertificate; external ImageHlpLib name 'ImageAddCertificate';
  3705. function ImageRemoveCertificate; external ImageHlpLib name 'ImageRemoveCertificate';
  3706. function ImageEnumerateCertificates; external ImageHlpLib name 'ImageEnumerateCertificates';
  3707. function ImageGetCertificateData; external ImageHlpLib name 'ImageGetCertificateData';
  3708. function ImageGetCertificateHeader; external ImageHlpLib name 'ImageGetCertificateHeader';
  3709. function ImageLoad; external ImageHlpLib name 'ImageLoad';
  3710. function ImageUnload; external ImageHlpLib name 'ImageUnload';
  3711. function MapAndLoad; external ImageHlpLib name 'MapAndLoad';
  3712. function UnMapAndLoad; external ImageHlpLib name 'UnMapAndLoad';
  3713. function TouchFileTimes; external ImageHlpLib name 'TouchFileTimes';
  3714. function SplitSymbols; external ImageHlpLib name 'SplitSymbols';
  3715. function UpdateDebugInfoFile; external ImageHlpLib name 'UpdateDebugInfoFile';
  3716. function UpdateDebugInfoFileEx; external ImageHlpLib name 'UpdateDebugInfoFileEx';
  3717. function FindDebugInfoFile; external ImageHlpLib name 'FindDebugInfoFile';
  3718. function FindDebugInfoFileEx; external ImageHlpLib name 'FindDebugInfoFileEx';
  3719. function SymFindFileInPath; external ImageHlpLib name 'SymFindFileInPath';
  3720. function FindExecutableImage; external ImageHlpLib name 'FindExecutableImage';
  3721. function FindExecutableImageEx; external ImageHlpLib name 'FindExecutableImageEx';
  3722. function ImageNtHeader; external ImageHlpLib name 'ImageNtHeader';
  3723. function ImageDirectoryEntryToDataEx; external ImageHlpLib name 'ImageDirectoryEntryToDataEx';
  3724. function ImageDirectoryEntryToData; external ImageHlpLib name 'ImageDirectoryEntryToData';
  3725. function ImageRvaToSection; external ImageHlpLib name 'ImageRvaToSection';
  3726. function ImageRvaToVa; external ImageHlpLib name 'ImageRvaToVa';
  3727. function MapDebugInformation; external ImageHlpLib name 'MapDebugInformation';
  3728. function UnmapDebugInformation; external ImageHlpLib name 'UnmapDebugInformation';
  3729. function SearchTreeForFile; external ImageHlpLib name 'SearchTreeForFile';
  3730. function EnumDirTree; external ImageHlpLib name 'EnumDirTree';
  3731. function MakeSureDirectoryPathExists; external ImageHlpLib name 'MakeSureDirectoryPathExists';
  3732. function UnDecorateSymbolName; external ImageHlpLib name 'UnDecorateSymbolName';
  3733. function StackWalk64; external ImageHlpLib name 'StackWalk64';
  3734. function StackWalk; external ImageHlpLib name 'StackWalk';
  3735. function ImagehlpApiVersion; external ImageHlpLib name 'ImagehlpApiVersion';
  3736. function ImagehlpApiVersionEx; external ImageHlpLib name 'ImagehlpApiVersionEx';
  3737. function GetTimestampForLoadedLibrary; external ImageHlpLib name 'GetTimestampForLoadedLibrary';
  3738. function SymSetOptions; external ImageHlpLib name 'SymSetOptions';
  3739. function SymGetOptions; external ImageHlpLib name 'SymGetOptions';
  3740. function SymCleanup; external ImageHlpLib name 'SymCleanup';
  3741. function SymMatchString; external ImageHlpLib name 'SymMatchString';
  3742. function SymEnumSourceFiles; external ImageHlpLib name 'SymEnumSourceFiles';
  3743. function SymEnumerateModules64; external ImageHlpLib name 'SymEnumerateModules64';
  3744. function SymEnumerateModules; external ImageHlpLib name 'SymEnumerateModules';
  3745. function SymEnumerateSymbols64; external ImageHlpLib name 'SymEnumerateSymbols64';
  3746. function SymEnumerateSymbolsW64; external ImageHlpLib name 'SymEnumerateSymbolsW64';
  3747. function SymEnumerateSymbols; external ImageHlpLib name 'SymEnumerateSymbols';
  3748. function SymEnumerateSymbolsW; external ImageHlpLib name 'SymEnumerateSymbolsW';
  3749. function EnumerateLoadedModules64; external ImageHlpLib name 'EnumerateLoadedModules64';
  3750. function EnumerateLoadedModules; external ImageHlpLib name 'EnumerateLoadedModules';
  3751. function SymFunctionTableAccess64; external ImageHlpLib name 'SymFunctionTableAccess64';
  3752. function SymFunctionTableAccess; external ImageHlpLib name 'SymFunctionTableAccess';
  3753. function SymGetModuleInfo64; external ImageHlpLib name 'SymGetModuleInfo64';
  3754. function SymGetModuleInfoW64; external ImageHlpLib name 'SymGetModuleInfoW64';
  3755. function SymGetModuleInfo; external ImageHlpLib name 'SymGetModuleInfo';
  3756. function SymGetModuleInfoW; external ImageHlpLib name 'SymGetModuleInfoW';
  3757. function SymGetModuleBase64; external ImageHlpLib name 'SymGetModuleBase64';
  3758. function SymGetModuleBase; external ImageHlpLib name 'SymGetModuleBase';
  3759. function SymGetSymNext64; external ImageHlpLib name 'SymGetSymNext64';
  3760. function SymGetSymNext; external ImageHlpLib name 'SymGetSymNext';
  3761. function SymGetSymPrev64; external ImageHlpLib name 'SymGetSymPrev64';
  3762. function SymGetSymPrev; external ImageHlpLib name 'SymGetSymPrev';
  3763. function SymGetLineFromAddr64; external ImageHlpLib name 'SymGetLineFromAddr64';
  3764. function SymGetLineFromAddr; external ImageHlpLib name 'SymGetLineFromAddr';
  3765. function SymGetLineFromName64; external ImageHlpLib name 'SymGetLineFromName64';
  3766. function SymGetLineFromName; external ImageHlpLib name 'SymGetLineFromName';
  3767. function SymGetLineNext64; external ImageHlpLib name 'SymGetLineNext64';
  3768. function SymGetLineNext; external ImageHlpLib name 'SymGetLineNext';
  3769. function SymGetLinePrev64; external ImageHlpLib name 'SymGetLinePrev64';
  3770. function SymGetLinePrev; external ImageHlpLib name 'SymGetLinePrev';
  3771. function SymMatchFileName; external ImageHlpLib name 'SymMatchFileName';
  3772. function SymInitialize; external ImageHlpLib name 'SymInitialize';
  3773. function SymGetSearchPath; external ImageHlpLib name 'SymGetSearchPath';
  3774. function SymSetSearchPath; external ImageHlpLib name 'SymSetSearchPath';
  3775. function SymLoadModuleEx; external ImageHlpLib name 'SymLoadModuleEx';
  3776. function SymLoadModule64; external ImageHlpLib name 'SymLoadModule64';
  3777. function SymLoadModule; external ImageHlpLib name 'SymLoadModule';
  3778. function SymUnloadModule64; external ImageHlpLib name 'SymUnloadModule64';
  3779. function SymUnloadModule; external ImageHlpLib name 'SymUnloadModule';
  3780. function SymUnDName64; external ImageHlpLib name 'SymUnDName64';
  3781. function SymUnDName; external ImageHlpLib name 'SymUnDName';
  3782. function SymRegisterCallback64; external ImageHlpLib name 'SymRegisterCallback64';
  3783. function SymRegisterFunctionEntryCallback64; external ImageHlpLib name 'SymRegisterFunctionEntryCallback64';
  3784. function SymRegisterCallback; external ImageHlpLib name 'SymRegisterCallback';
  3785. function SymRegisterFunctionEntryCallback; external ImageHlpLib name 'SymRegisterFunctionEntryCallback';
  3786. function SymSetContext; external ImageHlpLib name 'SymSetContext';
  3787. function SymFromAddr; external ImageHlpLib name 'SymFromAddr';
  3788. function SymFromName; external ImageHlpLib name 'SymFromName';
  3789. function SymEnumSymbolsForAddr; external ImageHlpLib name 'SymEnumSymbolsForAddr';
  3790. function SymEnumSymbols; external ImageHlpLib name 'SymEnumSymbols';
  3791. function SymGetTypeInfo; external ImageHlpLib name 'SymGetTypeInfo';
  3792. function SymEnumTypes; external ImageHlpLib name 'SymEnumTypes';
  3793. function SymGetTypeFromName; external ImageHlpLib name 'SymGetTypeFromName';
  3794. function SymAddSymbol; external ImageHlpLib name 'SymAddSymbol';
  3795. function SymDeleteSymbol; external ImageHlpLib name 'SymDeleteSymbol';
  3796. function DbgHelpCreateUserDump; external ImageHlpLib name 'DbgHelpCreateUserDump';
  3797. function DbgHelpCreateUserDumpW; external ImageHlpLib name 'DbgHelpCreateUserDumpW';
  3798. function SymGetSymFromAddr64; external ImageHlpLib name 'SymGetSymFromAddr64';
  3799. function SymGetSymFromAddr; external ImageHlpLib name 'SymGetSymFromAddr';
  3800. function SymGetSymFromName64; external ImageHlpLib name 'SymGetSymFromName64';
  3801. function SymGetSymFromName; external ImageHlpLib name 'SymGetSymFromName';
  3802. function FindFileInPath; external ImageHlpLib name 'FindFileInPath';
  3803. function FindFileInSearchPath; external ImageHlpLib name 'FindFileInSearchPath';
  3804. function SymEnumSym; external ImageHlpLib name 'SymEnumSym';
  3805. function MiniDumpWriteDump; external ImageHlpLib name 'MiniDumpWriteDump';
  3806. function MiniDumpReadDumpStream; external ImageHlpLib name 'MiniDumpReadDumpStream';
  3807. {$ENDIF DYNAMIC_LINK}
  3808. end.