123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401 |
- {******************************************************************************}
- { }
- { Image Help API interface Unit for Object Pascal }
- { }
- { Portions created by Microsoft are Copyright (C) 1995-2001 Microsoft }
- { Corporation. All Rights Reserved. }
- { }
- { The original file is: imagehlp.h, released August 2001. The original Pascal }
- { code is: ImageHelp.pas, released December 2000. The initial developer of the }
- { Pascal code is Marcel van Brakel (brakelm att chello dott nl). }
- { }
- { Portions created by Marcel van Brakel are Copyright (C) 1999-2001 }
- { Marcel van Brakel. All Rights Reserved. }
- { }
- { Obtained through: Joint Endeavour of Delphi Innovators (Project JEDI) }
- { }
- { You may retrieve the latest version of this file at the Project JEDI }
- { APILIB home page, located at http://jedi-apilib.sourceforge.net }
- { }
- { The contents of this file are used with permission, subject to the Mozilla }
- { Public License Version 1.1 (the "License"); you may not use this file except }
- { in compliance with the License. You may obtain a copy of the License at }
- { http://www.mozilla.org/MPL/MPL-1.1.html }
- { }
- { Software distributed under the License is distributed on an "AS IS" basis, }
- { WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for }
- { the specific language governing rights and limitations under the License. }
- { }
- { Alternatively, the contents of this file may be used under the terms of the }
- { GNU Lesser General Public License (the "LGPL License"), in which case the }
- { provisions of the LGPL License are applicable instead of those above. }
- { If you wish to allow use of your version of this file only under the terms }
- { of the LGPL License and not to allow others to use your version of this file }
- { under the MPL, indicate your decision by deleting the provisions above and }
- { replace them with the notice and other provisions required by the LGPL }
- { License. If you do not delete the provisions above, a recipient may use }
- { your version of this file under either the MPL or the LGPL License. }
- { }
- { For more information about the LGPL: http://www.gnu.org/copyleft/lesser.html }
- { }
- {******************************************************************************}
- unit JwaImageHlp;
- {$WEAKPACKAGEUNIT}
- {$HPPEMIT ''}
- {$HPPEMIT '#include "ImageHlp.h"'}
- {$HPPEMIT ''}
- {$I jediapilib.inc}
- interface
- uses
- Windows, JwaWinBase, JwaWinNT, JwaWinType;
- const
- IMAGE_SEPARATION = 64*1024;
- {$EXTERNALSYM IMAGE_SEPARATION}
- type
- PLOADED_IMAGE = ^LOADED_IMAGE;
- {$EXTERNALSYM PLOADED_IMAGE}
- _LOADED_IMAGE = record
- ModuleName: PSTR;
- hFile: HANDLE;
- MappedAddress: PUCHAR;
- FileHeader: PIMAGE_NT_HEADERS32;
- LastRvaSection: PIMAGE_SECTION_HEADER;
- NumberOfSections: ULONG;
- Sections: PIMAGE_SECTION_HEADER;
- Characteristics: ULONG;
- fSystemImage: ByteBool;
- fDOSImage: ByteBool;
- Links: LIST_ENTRY;
- SizeOfImage: ULONG;
- end;
- {$EXTERNALSYM _LOADED_IMAGE}
- LOADED_IMAGE = _LOADED_IMAGE;
- {$EXTERNALSYM LOADED_IMAGE}
- TLoadedImage = LOADED_IMAGE;
- PLoadedImage = PLOADED_IMAGE;
- const
- MAX_SYM_NAME = 2000;
- {$EXTERNALSYM MAX_SYM_NAME}
- function BindImage(ImageName, DllPath, SymbolPath: PSTR): BOOL; stdcall;
- {$EXTERNALSYM BindImage}
- type
- _IMAGEHLP_STATUS_REASON = (
- BindOutOfMemory,
- BindRvaToVaFailed,
- BindNoRoomInImage,
- BindImportModuleFailed,
- BindImportProcedureFailed,
- BindImportModule,
- BindImportProcedure,
- BindForwarder,
- BindForwarderNOT,
- BindImageModified,
- BindExpandFileHeaders,
- BindImageComplete,
- BindMismatchedSymbols,
- BindSymbolsNotUpdated,
- BindImportProcedure32,
- BindImportProcedure64,
- BindForwarder32,
- BindForwarder64,
- BindForwarderNOT32,
- BindForwarderNOT64);
- {$EXTERNALSYM _IMAGEHLP_STATUS_REASON}
- IMAGEHLP_STATUS_REASON = _IMAGEHLP_STATUS_REASON;
- {$EXTERNALSYM IMAGEHLP_STATUS_REASON}
- TImageHlpStatusReason = IMAGEHLP_STATUS_REASON;
- PIMAGEHLP_STATUS_ROUTINE = function(Reason: IMAGEHLP_STATUS_REASON;
- ImageName, DllName: PSTR; Va, Parameter: ULONG_PTR): BOOL; stdcall;
- {$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE}
- PImageHlpStatusRoutine = PIMAGEHLP_STATUS_ROUTINE;
- PIMAGEHLP_STATUS_ROUTINE32 = function(Reason: IMAGEHLP_STATUS_REASON; ImageName, DllName: PSTR;
- Va: ULONG; Parameter: ULONG_PTR): BOOL; stdcall;
- {$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE32}
- PImageHlpStatusRoutine23 = PIMAGEHLP_STATUS_ROUTINE32;
- PIMAGEHLP_STATUS_ROUTINE64 = function(Reason: IMAGEHLP_STATUS_REASON; ImageName, DllName: PSTR;
- Va: ULONG64; Parameter: ULONG_PTR): BOOL; stdcall;
- {$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE64}
- PImageHlpStatusRoutine64 = PIMAGEHLP_STATUS_ROUTINE64;
- function BindImageEx(Flags: DWORD; ImageName, DllPath, SymbolPath: PSTR;
- StatusRoutine: PIMAGEHLP_STATUS_ROUTINE): BOOL; stdcall;
- {$EXTERNALSYM BindImageEx}
- const
- BIND_NO_BOUND_IMPORTS = $00000001;
- {$EXTERNALSYM BIND_NO_BOUND_IMPORTS}
- BIND_NO_UPDATE = $00000002;
- {$EXTERNALSYM BIND_NO_UPDATE}
- BIND_ALL_IMAGES = $00000004;
- {$EXTERNALSYM BIND_ALL_IMAGES}
- BIND_CACHE_IMPORT_DLLS = $00000008; // Cache dll's across calls to BindImageEx (same as NT 3.1->NT 4.0)
- {$EXTERNALSYM BIND_CACHE_IMPORT_DLLS}
- BIND_REPORT_64BIT_VA = $00000010;
- {$EXTERNALSYM BIND_REPORT_64BIT_VA}
- function ReBaseImage(CurrentImageName: PSTR; SymbolPath: PSTR; fReBase: BOOL;
- fRebaseSysfileOk: BOOL; fGoingDown: BOOL; CheckImageSize: ULONG;
- var OldImageSize: ULONG; var OldImageBase: ULONG_PTR; var NewImageSize: ULONG;
- var NewImageBase: ULONG_PTR; TimeStamp: ULONG): BOOL; stdcall;
- {$EXTERNALSYM ReBaseImage}
- function ReBaseImage64(CurrentImageName: PSTR; SymbolPath: PSTR; fReBase: BOOL;
- fRebaseSysfileOk: BOOL; fGoingDown: BOOL; CheckImageSize: ULONG;
- var OldImageSize: ULONG; var OldImageBase: ULONG64; var NewImageSize: ULONG;
- var NewImageBase: ULONG64; TimeStamp: ULONG): BOOL; stdcall;
- {$EXTERNALSYM ReBaseImage64}
- //
- // Define checksum return codes.
- //
- const
- CHECKSUM_SUCCESS = 0;
- {$EXTERNALSYM CHECKSUM_SUCCESS}
- CHECKSUM_OPEN_FAILURE = 1;
- {$EXTERNALSYM CHECKSUM_OPEN_FAILURE}
- CHECKSUM_MAP_FAILURE = 2;
- {$EXTERNALSYM CHECKSUM_MAP_FAILURE}
- CHECKSUM_MAPVIEW_FAILURE = 3;
- {$EXTERNALSYM CHECKSUM_MAPVIEW_FAILURE}
- CHECKSUM_UNICODE_FAILURE = 4;
- {$EXTERNALSYM CHECKSUM_UNICODE_FAILURE}
- // Define Splitsym flags.
- SPLITSYM_REMOVE_PRIVATE = $00000001; // Remove CV types/symbols and Fixup debug
- {$EXTERNALSYM SPLITSYM_REMOVE_PRIVATE}
- // Used for creating .dbg files that ship
- // as part of the product.
- SPLITSYM_EXTRACT_ALL = $00000002; // Extract all debug info from image.
- {$EXTERNALSYM SPLITSYM_EXTRACT_ALL}
- // Normally, FPO is left in the image
- // to allow stack traces through the code.
- // Using this switch is similar to linking
- // with -debug:none except the .dbg file
- // exists...
- SPLITSYM_SYMBOLPATH_IS_SRC = $00000004; // The SymbolFilePath contains an alternate
- {$EXTERNALSYM SPLITSYM_SYMBOLPATH_IS_SRC}
- // path to locate the pdb.
- //
- // Define checksum function prototypes.
- //
- function CheckSumMappedFile(BaseAddress: PVOID; FileLength: DWORD;
- var HeaderSum, CheckSum: DWORD): PIMAGE_NT_HEADERS; stdcall;
- {$EXTERNALSYM CheckSumMappedFile}
- function MapFileAndCheckSumA(Filename: PSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
- {$EXTERNALSYM MapFileAndCheckSumA}
- function MapFileAndCheckSumW(Filename: PWSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
- {$EXTERNALSYM MapFileAndCheckSumW}
- function MapFileAndCheckSum(Filename: PTSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
- {$EXTERNALSYM MapFileAndCheckSum}
- function GetImageConfigInformation(const LoadedImage: LOADED_IMAGE;
- var ImageConfigInformation: IMAGE_LOAD_CONFIG_DIRECTORY): BOOL; stdcall;
- {$EXTERNALSYM GetImageConfigInformation}
- function GetImageUnusedHeaderBytes(const LoadedImage: LOADED_IMAGE;
- var SizeUnusedHeaderBytes: DWORD): DWORD; stdcall;
- {$EXTERNALSYM GetImageUnusedHeaderBytes}
- function SetImageConfigInformation(const LoadedImage: LOADED_IMAGE;
- const ImageConfigInformation: IMAGE_LOAD_CONFIG_DIRECTORY): BOOL; stdcall;
- {$EXTERNALSYM SetImageConfigInformation}
- // Image Integrity API's
- const
- CERT_PE_IMAGE_DIGEST_DEBUG_INFO = $01;
- {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_DEBUG_INFO}
- CERT_PE_IMAGE_DIGEST_RESOURCES = $02;
- {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_RESOURCES}
- CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO = $04;
- {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO}
- CERT_PE_IMAGE_DIGEST_NON_PE_INFO = $08; // include data outside the PE image
- {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_NON_PE_INFO}
- CERT_SECTION_TYPE_ANY = $FF; // Any Certificate type
- {$EXTERNALSYM CERT_SECTION_TYPE_ANY}
- type
- DIGEST_HANDLE = PVOID;
- {$EXTERNALSYM DIGEST_HANDLE}
- TDigestHandle = DIGEST_HANDLE;
- DIGEST_FUNCTION = function(refdata: DIGEST_HANDLE; pData: PBYTE; dwLength: DWORD): BOOL; stdcall;
- {$EXTERNALSYM DIGEST_FUNCTION}
- TDigestFunction = DIGEST_FUNCTION;
- function ImageGetDigestStream(FileHandle: HANDLE; DigestLevel: DWORD;
- DigestFunction: DIGEST_FUNCTION; DigestHandle: DIGEST_HANDLE): BOOL; stdcall;
- {$EXTERNALSYM ImageGetDigestStream}
- function ImageAddCertificate(FileHandle: HANDLE; Certificate: PWinCertificate;
- var Index: DWORD): BOOL; stdcall;
- {$EXTERNALSYM ImageAddCertificate}
- function ImageRemoveCertificate(FileHandle: HANDLE; Index: DWORD): BOOL; stdcall;
- {$EXTERNALSYM ImageRemoveCertificate}
- function ImageEnumerateCertificates(FileHandle: HANDLE; TypeFilter: WORD;
- var CertificateCount: DWORD; Indices: PDWORD; IndexCount: DWORD): BOOL; stdcall;
- {$EXTERNALSYM ImageEnumerateCertificates}
- function ImageGetCertificateData(FileHandle: HANDLE; CertificateIndex: DWORD;
- Certificate: PWinCertificate; var RequiredLength: DWORD): BOOL; stdcall;
- {$EXTERNALSYM ImageGetCertificateData}
- function ImageGetCertificateHeader(FileHandle: HANDLE; CertificateIndex: DWORD;
- Certificateheader: PWinCertificate): BOOL; stdcall;
- {$EXTERNALSYM ImageGetCertificateHeader}
- function ImageLoad(DllName: PSTR; DllPath: PSTR): PLOADED_IMAGE; stdcall;
- {$EXTERNALSYM ImageLoad}
- function ImageUnload(const LoadedImage: LOADED_IMAGE): BOOL; stdcall;
- {$EXTERNALSYM ImageUnload}
- function MapAndLoad(ImageName, DllPath: PSTR; var LoadedImage: LOADED_IMAGE;
- DotDll: BOOL; ReadOnly: BOOL): BOOL; stdcall;
- {$EXTERNALSYM MapAndLoad}
- function UnMapAndLoad(const LoadedImage: LOADED_IMAGE): BOOL; stdcall;
- {$EXTERNALSYM UnMapAndLoad}
- function TouchFileTimes(FileHandle: HANDLE; pSystemTime: PSYSTEMTIME): BOOL; stdcall;
- {$EXTERNALSYM TouchFileTimes}
- function SplitSymbols(ImageName, SymbolsPath, SymbolFilePath: PSTR; Flags: DWORD): BOOL; stdcall;
- {$EXTERNALSYM SplitSymbols}
- function UpdateDebugInfoFile(ImageFileName, SymbolPath, DebugFilePath: PSTR;
- const NtHeaders: IMAGE_NT_HEADERS32): BOOL; stdcall;
- {$EXTERNALSYM UpdateDebugInfoFile}
- function UpdateDebugInfoFileEx(ImageFileName, SymbolPath, DebugFilePath: PSTR;
- const NtHeaders: IMAGE_NT_HEADERS32; OldChecksum: DWORD): BOOL; stdcall;
- {$EXTERNALSYM UpdateDebugInfoFileEx}
- function FindDebugInfoFile(FileName, SymbolPath, DebugFilePath: PSTR): HANDLE; stdcall;
- {$EXTERNALSYM FindDebugInfoFile}
- type
- PFIND_DEBUG_FILE_CALLBACK = function(FileHandle: HANDLE; FileName: PSTR;
- CallerData: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PFIND_DEBUG_FILE_CALLBACK}
- PFindDebugFileCallback = PFIND_DEBUG_FILE_CALLBACK;
- function FindDebugInfoFileEx(FileName, SymbolPath, DebugFilePath: PSTR;
- Callback: PFIND_DEBUG_FILE_CALLBACK; CallerData: PVOID): HANDLE; stdcall;
- {$EXTERNALSYM FindDebugInfoFileEx}
- type
- PFINDFILEINPATHCALLBACK = function(filename: PSTR; context: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PFINDFILEINPATHCALLBACK}
- function SymFindFileInPath(hprocess: HANDLE; SearchPath, FileName: LPSTR; id: PVOID; two, three, flags: DWORD;
- FoundFile: LPSTR; callback: PFINDFILEINPATHCALLBACK; context: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymFindFileInPath}
- function FindExecutableImage(FileName, SymbolPath, ImageFilePath: PSTR): HANDLE; stdcall;
- {$EXTERNALSYM FindExecutableImage}
- type
- PFIND_EXE_FILE_CALLBACK = function(FileHandle: HANDLE; FileName: PSTR;
- CallerData: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PFIND_EXE_FILE_CALLBACK}
- PFindExeFileCallback = PFIND_EXE_FILE_CALLBACK;
- function FindExecutableImageEx(FileName, SymbolPath, ImageFilePath: PSTR;
- Callback: PFIND_EXE_FILE_CALLBACK; CallerData: PVOID): HANDLE; stdcall;
- {$EXTERNALSYM FindExecutableImageEx}
- function ImageNtHeader(Base: PVOID): PIMAGE_NT_HEADERS; stdcall;
- {$EXTERNALSYM ImageNtHeader}
- function ImageDirectoryEntryToDataEx(Base: PVOID; MappedAsImage: ByteBool;
- DirectoryEntry: USHORT; var Size: ULONG; var FoundHeader: PIMAGE_SECTION_HEADER): PVOID; stdcall;
- {$EXTERNALSYM ImageDirectoryEntryToDataEx}
- function ImageDirectoryEntryToData(Base: PVOID; MappedAsImage: ByteBool;
- DirectoryEntry: USHORT; var Size: ULONG): PVOID; stdcall;
- {$EXTERNALSYM ImageDirectoryEntryToData}
- function ImageRvaToSection(NtHeaders: PIMAGE_NT_HEADERS; Base: PVOID; Rva: ULONG): PIMAGE_SECTION_HEADER; stdcall;
- {$EXTERNALSYM ImageRvaToSection}
- function ImageRvaToVa(NtHeaders: PIMAGE_NT_HEADERS; Base: PVOID; Rva: ULONG;
- var LastRvaSection: PIMAGE_SECTION_HEADER): PVOID; stdcall;
- {$EXTERNALSYM ImageRvaToVa}
- // Symbol server exports
- type
- PSYMBOLSERVERPROC = function(a1, a2: LPCSTR; a3: PVOID; a4, a5: DWORD; a6: LPSTR): BOOL; stdcall;
- {$EXTERNALSYM PSYMBOLSERVERPROC}
- PSYMBOLSERVEROPENPROC = function: BOOL; stdcall;
- {$EXTERNALSYM PSYMBOLSERVEROPENPROC}
- PSYMBOLSERVERCLOSEPROC = function: BOOL; stdcall;
- {$EXTERNALSYM PSYMBOLSERVERCLOSEPROC}
- PSYMBOLSERVERSETOPTIONSPROC = function(a1: UINT_PTR; a2: ULONG64): BOOL; stdcall;
- {$EXTERNALSYM PSYMBOLSERVERSETOPTIONSPROC}
- PSYMBOLSERVERCALLBACKPROC = function(action: UINT_PTR; data: ULONG64; context: ULONG64): BOOL; stdcall;
- {$EXTERNALSYM PSYMBOLSERVERCALLBACKPROC}
- PSYMBOLSERVERGETOPTIONSPROC = function: UINT_PTR; stdcall;
- {$EXTERNALSYM PSYMBOLSERVERGETOPTIONSPROC}
- PSYMBOLSERVERPINGPROC = function(a1: LPCSTR): BOOL; stdcall;
- {$EXTERNALSYM PSYMBOLSERVERPINGPROC}
- const
- SSRVOPT_CALLBACK = $01;
- {$EXTERNALSYM SSRVOPT_CALLBACK}
- SSRVOPT_DWORD = $02;
- {$EXTERNALSYM SSRVOPT_DWORD}
- SSRVOPT_DWORDPTR = $04;
- {$EXTERNALSYM SSRVOPT_DWORDPTR}
- SSRVOPT_GUIDPTR = $08;
- {$EXTERNALSYM SSRVOPT_GUIDPTR}
- SSRVOPT_OLDGUIDPTR = $10;
- {$EXTERNALSYM SSRVOPT_OLDGUIDPTR}
- SSRVOPT_UNATTENDED = $20;
- {$EXTERNALSYM SSRVOPT_UNATTENDED}
- SSRVOPT_RESET = ULONG_PTR(-1);
- {$EXTERNALSYM SSRVOPT_RESET}
- SSRVACTION_TRACE = 1;
- {$EXTERNALSYM SSRVACTION_TRACE}
- // This api won't be ported to Win64 - Fix your code.
- type
- PIMAGE_DEBUG_INFORMATION = ^IMAGE_DEBUG_INFORMATION;
- {$EXTERNALSYM PIMAGE_DEBUG_INFORMATION}
- _IMAGE_DEBUG_INFORMATION = record
- List: LIST_ENTRY;
- ReservedSize: DWORD;
- ReservedMappedBase: PVOID;
- ReservedMachine: USHORT;
- ReservedCharacteristics: USHORT;
- ReservedCheckSum: DWORD;
- ImageBase: DWORD;
- SizeOfImage: DWORD;
- ReservedNumberOfSections: DWORD;
- ReservedSections: PIMAGE_SECTION_HEADER;
- ReservedExportedNamesSize: DWORD;
- ReservedExportedNames: PSTR;
- ReservedNumberOfFunctionTableEntries: DWORD;
- ReservedFunctionTableEntries: PIMAGE_FUNCTION_ENTRY;
- ReservedLowestFunctionStartingAddress: DWORD;
- ReservedHighestFunctionEndingAddress: DWORD;
- ReservedNumberOfFpoTableEntries: DWORD;
- ReservedFpoTableEntries: PFPO_DATA;
- SizeOfCoffSymbols: DWORD;
- CoffSymbols: PIMAGE_COFF_SYMBOLS_HEADER;
- ReservedSizeOfCodeViewSymbols: DWORD;
- ReservedCodeViewSymbols: PVOID;
- ImageFilePath: PSTR;
- ImageFileName: PSTR;
- ReservedDebugFilePath: PSTR;
- ReservedTimeDateStamp: DWORD;
- ReservedRomImage: BOOL;
- ReservedDebugDirectory: PIMAGE_DEBUG_DIRECTORY;
- ReservedNumberOfDebugDirectories: DWORD;
- ReservedOriginalFunctionTableBaseAddress: DWORD;
- Reserved: array [0..1] of DWORD;
- end;
- {$EXTERNALSYM _IMAGE_DEBUG_INFORMATION}
- IMAGE_DEBUG_INFORMATION = _IMAGE_DEBUG_INFORMATION;
- {$EXTERNALSYM IMAGE_DEBUG_INFORMATION}
- TImageDebugInformation = IMAGE_DEBUG_INFORMATION;
- PImageDebugInformation = PIMAGE_DEBUG_INFORMATION;
- function MapDebugInformation(FileHandle: HANDLE; FileName, SymbolPath: PSTR;
- ImageBase: DWORD): PIMAGE_DEBUG_INFORMATION; stdcall;
- {$EXTERNALSYM MapDebugInformation}
- function UnmapDebugInformation(DebugInfo: PIMAGE_DEBUG_INFORMATION): BOOL; stdcall;
- {$EXTERNALSYM UnmapDebugInformation}
- function SearchTreeForFile(RootPath, InputPathName, OutputPathBuffer: PSTR): BOOL; stdcall;
- {$EXTERNALSYM SearchTreeForFile}
- type
- PENUMDIRTREE_CALLBACK = function(FilePath: LPCSTR; CallerData: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PENUMDIRTREE_CALLBACK}
- PEnumDirTreeCallback = PENUMDIRTREE_CALLBACK;
- function EnumDirTree(hProcess: HANDLE; RootPath, InputPathName, OutputPathBuffer: PSTR;
- Callback: PENUMDIRTREE_CALLBACK; CallbackData: PVOID): BOOL; stdcall;
- {$EXTERNALSYM EnumDirTree}
- function MakeSureDirectoryPathExists(DirPath: PCSTR): BOOL; stdcall;
- {$EXTERNALSYM MakeSureDirectoryPathExists}
- //
- // UnDecorateSymbolName Flags
- //
- const
- UNDNAME_COMPLETE = $0000; // Enable full undecoration
- {$EXTERNALSYM UNDNAME_COMPLETE}
- UNDNAME_NO_LEADING_UNDERSCORES = $0001; // Remove leading underscores from MS extended keywords
- {$EXTERNALSYM UNDNAME_NO_LEADING_UNDERSCORES}
- UNDNAME_NO_MS_KEYWORDS = $0002; // Disable expansion of MS extended keywords
- {$EXTERNALSYM UNDNAME_NO_MS_KEYWORDS}
- UNDNAME_NO_FUNCTION_RETURNS = $0004; // Disable expansion of return type for primary declaration
- {$EXTERNALSYM UNDNAME_NO_FUNCTION_RETURNS}
- UNDNAME_NO_ALLOCATION_MODEL = $0008; // Disable expansion of the declaration model
- {$EXTERNALSYM UNDNAME_NO_ALLOCATION_MODEL}
- UNDNAME_NO_ALLOCATION_LANGUAGE = $0010; // Disable expansion of the declaration language specifier
- {$EXTERNALSYM UNDNAME_NO_ALLOCATION_LANGUAGE}
- UNDNAME_NO_MS_THISTYPE = $0020; // NYI Disable expansion of MS keywords on the 'this' type for primary declaration
- {$EXTERNALSYM UNDNAME_NO_MS_THISTYPE}
- UNDNAME_NO_CV_THISTYPE = $0040; // NYI Disable expansion of CV modifiers on the 'this' type for primary declaration
- {$EXTERNALSYM UNDNAME_NO_CV_THISTYPE}
- UNDNAME_NO_THISTYPE = $0060; // Disable all modifiers on the 'this' type
- {$EXTERNALSYM UNDNAME_NO_THISTYPE}
- UNDNAME_NO_ACCESS_SPECIFIERS = $0080; // Disable expansion of access specifiers for members
- {$EXTERNALSYM UNDNAME_NO_ACCESS_SPECIFIERS}
- UNDNAME_NO_THROW_SIGNATURES = $0100; // Disable expansion of 'throw-signatures' for functions and pointers to functions
- {$EXTERNALSYM UNDNAME_NO_THROW_SIGNATURES}
- UNDNAME_NO_MEMBER_TYPE = $0200; // Disable expansion of 'static' or 'virtual'ness of members
- {$EXTERNALSYM UNDNAME_NO_MEMBER_TYPE}
- UNDNAME_NO_RETURN_UDT_MODEL = $0400; // Disable expansion of MS model for UDT returns
- {$EXTERNALSYM UNDNAME_NO_RETURN_UDT_MODEL}
- UNDNAME_32_BIT_DECODE = $0800; // Undecorate 32-bit decorated names
- {$EXTERNALSYM UNDNAME_32_BIT_DECODE}
- UNDNAME_NAME_ONLY = $1000; // Crack only the name for primary declaration;
- {$EXTERNALSYM UNDNAME_NAME_ONLY}
- // return just [scope::]name. Does expand template params
- UNDNAME_NO_ARGUMENTS = $2000; // Don't undecorate arguments to function
- {$EXTERNALSYM UNDNAME_NO_ARGUMENTS}
- UNDNAME_NO_SPECIAL_SYMS = $4000; // Don't undecorate special names (v-table, vcall, vector xxx, metatype, etc)
- {$EXTERNALSYM UNDNAME_NO_SPECIAL_SYMS}
- function UnDecorateSymbolName(DecoratedName: PCSTR; UnDecoratedName: PSTR;
- UndecoratedLength: DWORD; Flags: DWORD): DWORD; stdcall;
- {$EXTERNALSYM UnDecorateSymbolName}
- //
- // these values are used for synthesized file types
- // that can be passed in as image headers instead of
- // the standard ones from ntimage.h
- //
- const
- DBHHEADER_DEBUGDIRS = $1;
- {$EXTERNALSYM DBHHEADER_DEBUGDIRS}
- type
- _MODLOAD_DATA = record
- ssize: DWORD; // size of this struct
- ssig: DWORD; // signature identifying the passed data
- data: PVOID; // pointer to passed data
- size: DWORD; // size of passed data
- flags: DWORD; // options
- end;
- {$EXTERNALSYM _MODLOAD_DATA}
- MODLOAD_DATA = _MODLOAD_DATA;
- {$EXTERNALSYM MODLOAD_DATA}
- PMODLOAD_DATA = ^MODLOAD_DATA;
- {$EXTERNALSYM PMODLOAD_DATA}
- TModLoadData = MODLOAD_DATA;
- PModLoadData = PMODLOAD_DATA;
- //
- // StackWalking API
- //
- type
- ADDRESS_MODE = (
- AddrMode1616,
- AddrMode1632,
- AddrModeReal,
- AddrModeFlat);
- {$EXTERNALSYM ADDRESS_MODE}
- TAddressMode = ADDRESS_MODE;
- LPADDRESS64 = ^ADDRESS64;
- {$EXTERNALSYM PADDRESS64}
- _tagADDRESS64 = record
- Offset: DWORD64;
- Segment: WORD;
- Mode: ADDRESS_MODE;
- end;
- {$EXTERNALSYM _tagADDRESS64}
- ADDRESS64 = _tagADDRESS64;
- {$EXTERNALSYM ADDRESS64}
- TAddress64 = ADDRESS64;
- PAddress64 = LPADDRESS64;
- LPADDRESS = ^ADDRESS;
- {$EXTERNALSYM PADDRESS}
- _tagADDRESS = record
- Offset: DWORD;
- Segment: WORD;
- Mode: ADDRESS_MODE;
- end;
- {$EXTERNALSYM _tagADDRESS}
- ADDRESS = _tagADDRESS;
- {$EXTERNALSYM ADDRESS}
- TAddress = ADDRESS;
- PAddress = LPADDRESS;
- procedure Address32To64(a32: LPADDRESS; a64: LPADDRESS64);
- {$EXTERNALSYM Address32To64}
- procedure Address64To32(a64: LPADDRESS64; a32: LPADDRESS);
- {$EXTERNALSYM Address64To32}
- //
- // This structure is included in the STACKFRAME structure,
- // and is used to trace through usermode callbacks in a thread's
- // kernel stack. The values must be copied by the kernel debugger
- // from the DBGKD_GET_VERSION and WAIT_STATE_CHANGE packets.
- //
- //
- // New KDHELP structure for 64 bit system support.
- // This structure is preferred in new code.
- //
- type
- PKDHELP64 = ^KDHELP64;
- {$EXTERNALSYM PKDHELP64}
- _KDHELP64 = record
- //
- // address of kernel thread object, as provided in the
- // WAIT_STATE_CHANGE packet.
- //
- Thread: DWORD64;
- //
- // offset in thread object to pointer to the current callback frame
- // in kernel stack.
- //
- ThCallbackStack: DWORD;
- //
- // offset in thread object to pointer to the current callback backing
- // store frame in kernel stack.
- //
- ThCallbackBStore: DWORD;
- //
- // offsets to values in frame:
- //
- // address of next callback frame
- NextCallback: DWORD;
- // address of saved frame pointer (if applicable)
- FramePointer: DWORD;
- //
- // Address of the kernel function that calls out to user mode
- //
- KiCallUserMode: DWORD64;
- //
- // Address of the user mode dispatcher function
- //
- KeUserCallbackDispatcher: DWORD64;
- //
- // Lowest kernel mode address
- //
- SystemRangeStart: DWORD64;
- Reserved: array [0..7] of DWORD64;
- end;
- {$EXTERNALSYM _KDHELP64}
- KDHELP64 = _KDHELP64;
- {$EXTERNALSYM KDHELP64}
- TKdHelp64 = KDHELP64;
- //PKdHelp64 = PKDHELP64;
- PKDHELP = ^KDHELP;
- {$EXTERNALSYM PKDHELP}
- _KDHELP = record
- //
- // address of kernel thread object, as provided in the
- // WAIT_STATE_CHANGE packet.
- //
- Thread: DWORD;
- //
- // offset in thread object to pointer to the current callback frame
- // in kernel stack.
- //
- ThCallbackStack: DWORD;
- //
- // offsets to values in frame:
- //
- // address of next callback frame
- NextCallback: DWORD;
- // address of saved frame pointer (if applicable)
- FramePointer: DWORD;
- //
- // Address of the kernel function that calls out to user mode
- //
- KiCallUserMode: DWORD;
- //
- // Address of the user mode dispatcher function
- //
- KeUserCallbackDispatcher: DWORD;
- //
- // Lowest kernel mode address
- //
- SystemRangeStart: DWORD;
- //
- // offset in thread object to pointer to the current callback backing
- // store frame in kernel stack.
- //
- ThCallbackBStore: DWORD;
- Reserved: array [0..7] of DWORD;
- end;
- {$EXTERNALSYM _KDHELP}
- KDHELP = _KDHELP;
- {$EXTERNALSYM KDHELP}
- TKdHelp = KDHELP;
- //PKdHelp = PKDHELP;
- procedure KdHelp32To64(p32: PKDHELP; p64: PKDHELP64);
- {$EXTERNALSYM KdHelp32To64}
- type
- LPSTACKFRAME64 = ^STACKFRAME64;
- {$EXTERNALSYM LPSTACKFRAME64}
- _tagSTACKFRAME64 = record
- AddrPC: ADDRESS64; // program counter
- AddrReturn: ADDRESS64; // return address
- AddrFrame: ADDRESS64; // frame pointer
- AddrStack: ADDRESS64; // stack pointer
- AddrBStore: ADDRESS64; // backing store pointer
- FuncTableEntry: PVOID; // pointer to pdata/fpo or NULL
- Params: array [0..3] of DWORD64; // possible arguments to the function
- Far: BOOL; // WOW far call
- Virtual: BOOL; // is this a virtual frame?
- Reserved: array [0..2] of DWORD64;
- KdHelp: KDHELP64;
- end;
- {$EXTERNALSYM _tagSTACKFRAME64}
- STACKFRAME64 = _tagSTACKFRAME64;
- {$EXTERNALSYM STACKFRAME64}
- TStackFrame64 = STACKFRAME64;
- PStackFrame64 = LPSTACKFRAME64;
- LPSTACKFRAME = ^STACKFRAME;
- {$EXTERNALSYM LPSTACKFRAME}
- _tagSTACKFRAME = record
- AddrPC: ADDRESS; // program counter
- AddrReturn: ADDRESS; // return address
- AddrFrame: ADDRESS; // frame pointer
- AddrStack: ADDRESS; // stack pointer
- FuncTableEntry: PVOID; // pointer to pdata/fpo or NULL
- Params: array [0..3] of DWORD; // possible arguments to the function
- Far: BOOL; // WOW far call
- Virtual: BOOL; // is this a virtual frame?
- Reserved: array [0..2] of DWORD;
- KdHelp: KDHELP;
- AddrBStore: ADDRESS; // backing store pointer
- end;
- {$EXTERNALSYM _tagSTACKFRAME}
- STACKFRAME = _tagSTACKFRAME;
- {$EXTERNALSYM STACKFRAME}
- TStackFrame = STACKFRAME;
- PStackFrame = LPSTACKFRAME;
- PREAD_PROCESS_MEMORY_ROUTINE64 = function(hProcess: HANDLE; qwBaseAddress: DWORD64;
- lpBuffer: PVOID; nSize: DWORD; var lpNumberOfBytesRead: DWORD): BOOL; stdcall;
- {$EXTERNALSYM PREAD_PROCESS_MEMORY_ROUTINE64}
- PReadProcessMemoryRoutine64 = PREAD_PROCESS_MEMORY_ROUTINE64;
- PFUNCTION_TABLE_ACCESS_ROUTINE64 = function(hProcess: HANDLE;
- AddrBase: DWORD64): PVOID; stdcall;
- {$EXTERNALSYM PFUNCTION_TABLE_ACCESS_ROUTINE64}
- PFunctionTableAccessRoutine64 = PFUNCTION_TABLE_ACCESS_ROUTINE64;
- PGET_MODULE_BASE_ROUTINE64 = function(hProcess: HANDLE;
- Address: DWORD64): DWORD64; stdcall;
- {$EXTERNALSYM PGET_MODULE_BASE_ROUTINE64}
- PGetModuleBaseRoutine64 = PGET_MODULE_BASE_ROUTINE64;
- PTRANSLATE_ADDRESS_ROUTINE64 = function(hProcess: HANDLE; hThread: HANDLE;
- const lpaddr: ADDRESS64): DWORD64; stdcall;
- {$EXTERNALSYM PTRANSLATE_ADDRESS_ROUTINE64}
- PTranslateAddressRoutine64 = PTRANSLATE_ADDRESS_ROUTINE64;
- function StackWalk64(MachineType: DWORD; hProcess: HANDLE; hThread: HANDLE;
- var StackFrame: STACKFRAME64; ContextRecord: PVOID;
- ReadMemoryRoutine: PREAD_PROCESS_MEMORY_ROUTINE64;
- FunctionTableAccessRoutine: PFUNCTION_TABLE_ACCESS_ROUTINE64;
- GetModuleBaseRoutine: PGET_MODULE_BASE_ROUTINE64;
- TranslateAddress: PTRANSLATE_ADDRESS_ROUTINE64): BOOL; stdcall;
- {$EXTERNALSYM StackWalk64}
- type
- PREAD_PROCESS_MEMORY_ROUTINE = function(hProcess: HANDLE;
- lpBaseAddress: DWORD; lpBuffer: PVOID; nSize: DWORD;
- var lpNumberOfBytesRead: DWORD): BOOL; stdcall;
- {$EXTERNALSYM PREAD_PROCESS_MEMORY_ROUTINE}
- PreadProcessMemoryRoutine = PREAD_PROCESS_MEMORY_ROUTINE;
- PFUNCTION_TABLE_ACCESS_ROUTINE = function(hProcess: HANDLE; AddrBase: DWORD): PVOID; stdcall;
- {$EXTERNALSYM PFUNCTION_TABLE_ACCESS_ROUTINE}
- PFunctionTableAccessRoutine = PFUNCTION_TABLE_ACCESS_ROUTINE;
- PGET_MODULE_BASE_ROUTINE = function(hProcess: HANDLE; Address: DWORD): DWORD; stdcall;
- {$EXTERNALSYM PGET_MODULE_BASE_ROUTINE}
- PGetModuleBaseRoutine = PGET_MODULE_BASE_ROUTINE;
- PTRANSLATE_ADDRESS_ROUTINE = function(hProcess: HANDLE; hThread: HANDLE;
- const lpaddr: ADDRESS): DWORD; stdcall;
- {$EXTERNALSYM PTRANSLATE_ADDRESS_ROUTINE}
- PTranslateAddressRoutine = PTRANSLATE_ADDRESS_ROUTINE;
- function StackWalk(MachineType: DWORD; hProcess: HANDLE; hThread: HANDLE;
- var StackFrame: STACKFRAME; ContextRecord: PVOID;
- ReadMemoryRoutine: PREAD_PROCESS_MEMORY_ROUTINE;
- FunctionTableAccessRoutine: PFUNCTION_TABLE_ACCESS_ROUTINE;
- GetModuleBaseRoutine: PGET_MODULE_BASE_ROUTINE;
- TranslateAddress: PTRANSLATE_ADDRESS_ROUTINE): BOOL; stdcall;
- {$EXTERNALSYM StackWalk}
- const
- API_VERSION_NUMBER = 9;
- {$EXTERNALSYM API_VERSION_NUMBER}
- type
- LPAPI_VERSION = ^API_VERSION;
- {$EXTERNALSYM LPAPI_VERSION}
- API_VERSION = record
- MajorVersion: USHORT;
- MinorVersion: USHORT;
- Revision: USHORT;
- Reserved: USHORT;
- end;
- {$EXTERNALSYM API_VERSION}
- TApiVersion = API_VERSION;
- PApiVersion = LPAPI_VERSION;
- function ImagehlpApiVersion: LPAPI_VERSION; stdcall;
- {$EXTERNALSYM ImagehlpApiVersion}
- function ImagehlpApiVersionEx(const AppVersion: API_VERSION): LPAPI_VERSION; stdcall;
- {$EXTERNALSYM ImagehlpApiVersionEx}
- function GetTimestampForLoadedLibrary(Module: HMODULE): DWORD; stdcall;
- {$EXTERNALSYM GetTimestampForLoadedLibrary}
- //
- // typedefs for function pointers
- //
- type
- PSYM_ENUMMODULES_CALLBACK64 = function(ModuleName: PSTR; BaseOfDll: DWORD64;
- UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PSYM_ENUMMODULES_CALLBACK64}
- PSymEnummodulesCallback64 = PSYM_ENUMMODULES_CALLBACK64;
- PSYM_ENUMSYMBOLS_CALLBACK64 = function(SymbolName: PSTR; SymbolAddress: DWORD64;
- SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK64}
- PSymEnumsymbolsCallback64 = PSYM_ENUMSYMBOLS_CALLBACK64;
- PSYM_ENUMSYMBOLS_CALLBACK64W = function(SymbolName: PWSTR;
- SymbolAddress: DWORD64; SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK64W}
- PSymEnumsymbolsCallback64w = PSYM_ENUMSYMBOLS_CALLBACK64W;
- PENUMLOADED_MODULES_CALLBACK64 = function(ModuleName: PSTR;
- ModuleBase: DWORD64; ModuleSize: ULONG; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PENUMLOADED_MODULES_CALLBACK64}
- PSnumloadedModulesCallback64 = PENUMLOADED_MODULES_CALLBACK64;
- PSYMBOL_REGISTERED_CALLBACK64 = function(hProcess: HANDLE; ActionCode: ULONG;
- CallbackData: ULONG64; UserContext: ULONG64): BOOL; stdcall;
- {$EXTERNALSYM PSYMBOL_REGISTERED_CALLBACK64}
- PSymbolRegisteredCallback64 = PSYMBOL_REGISTERED_CALLBACK64;
- PSYMBOL_FUNCENTRY_CALLBACK = function(hProcess: HANDLE; AddrBase: DWORD;
- UserContext: PVOID): PVOID; stdcall;
- {$EXTERNALSYM PSYMBOL_FUNCENTRY_CALLBACK}
- PSymbolFuncentryCallback = PSYMBOL_FUNCENTRY_CALLBACK;
- PSYMBOL_FUNCENTRY_CALLBACK64 = function(hProcess: HANDLE; AddrBase: ULONG64;
- UserContext: ULONG64): PVOID; stdcall;
- {$EXTERNALSYM PSYMBOL_FUNCENTRY_CALLBACK64}
- PSymbolFuncentryCallback64 = PSYMBOL_FUNCENTRY_CALLBACK64;
- PSYM_ENUMMODULES_CALLBACK = function(ModuleName: PSTR; BaseOfDll: ULONG;
- UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PSYM_ENUMMODULES_CALLBACK}
- PSymEnummodulesCallback = PSYM_ENUMMODULES_CALLBACK;
- PSYM_ENUMSYMBOLS_CALLBACK = function(SymbolName: PSTR; SymbolAddress: ULONG;
- SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK}
- PSymEnumsymbolsCallback = PSYM_ENUMSYMBOLS_CALLBACK;
- PSYM_ENUMSYMBOLS_CALLBACKW = function(SymbolName: PWSTR; SymbolAddress: ULONG;
- SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACKW}
- PSymEnumsymbolsCallbackw = PSYM_ENUMSYMBOLS_CALLBACKW;
- PENUMLOADED_MODULES_CALLBACK = function(ModuleName: PSTR; ModuleBase: ULONG;
- ModuleSize: ULONG; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PENUMLOADED_MODULES_CALLBACK}
- PEnumloadedModulesCallback = PENUMLOADED_MODULES_CALLBACK;
- PSYMBOL_REGISTERED_CALLBACK = function(hProcess: HANDLE; ActionCode: ULONG;
- CallbackData: PVOID; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PSYMBOL_REGISTERED_CALLBACK}
- PSymbolRegisteredCallback = PSYMBOL_REGISTERED_CALLBACK;
- //
- // flags found in SYMBOL_INFO.Flags
- //
- const
- SYMFLAG_VALUEPRESENT = $00000001;
- {$EXTERNALSYM SYMFLAG_VALUEPRESENT}
- SYMFLAG_REGISTER = $00000008;
- {$EXTERNALSYM SYMFLAG_REGISTER}
- SYMFLAG_REGREL = $00000010;
- {$EXTERNALSYM SYMFLAG_REGREL}
- SYMFLAG_FRAMEREL = $00000020;
- {$EXTERNALSYM SYMFLAG_FRAMEREL}
- SYMFLAG_PARAMETER = $00000040;
- {$EXTERNALSYM SYMFLAG_PARAMETER}
- SYMFLAG_LOCAL = $00000080;
- {$EXTERNALSYM SYMFLAG_LOCAL}
- SYMFLAG_CONSTANT = $00000100;
- {$EXTERNALSYM SYMFLAG_CONSTANT}
- SYMFLAG_EXPORT = $00000200;
- {$EXTERNALSYM SYMFLAG_EXPORT}
- SYMFLAG_FORWARDER = $00000400;
- {$EXTERNALSYM SYMFLAG_FORWARDER}
- SYMFLAG_FUNCTION = $00000800;
- {$EXTERNALSYM SYMFLAG_FUNCTION}
- SYMFLAG_VIRTUAL = $00001000;
- {$EXTERNALSYM SYMFLAG_VIRTUAL}
- SYMFLAG_THUNK = $00002000;
- {$EXTERNALSYM SYMFLAG_THUNK}
- SYMFLAG_TLSREL = $00004000;
- {$EXTERNALSYM SYMFLAG_TLSREL}
- //
- // symbol type enumeration
- //
- type
- SYM_TYPE = (
- SymNone,
- SymCoff,
- SymCv,
- SymPdb,
- SymExport,
- SymDeferred,
- SymSym, // .sym file
- SymDia,
- SymVirtual,
- NumSymTypes);
- {$EXTERNALSYM SYM_TYPE}
- TSymType = SYM_TYPE;
- //
- // symbol data structure
- //
- PIMAGEHLP_SYMBOL64 = ^IMAGEHLP_SYMBOL64;
- {$EXTERNALSYM PIMAGEHLP_SYMBOL64}
- _IMAGEHLP_SYMBOL64 = record
- SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_SYMBOL64)
- Address: DWORD64; // virtual address including dll base address
- Size: DWORD; // estimated size of symbol, can be zero
- Flags: DWORD; // info about the symbols, see the SYMF defines
- MaxNameLength: DWORD; // maximum size of symbol name in 'Name'
- Name: array [0..0] of CHAR; // symbol name (null terminated string)
- end;
- {$EXTERNALSYM _IMAGEHLP_SYMBOL64}
- IMAGEHLP_SYMBOL64 = _IMAGEHLP_SYMBOL64;
- {$EXTERNALSYM IMAGEHLP_SYMBOL64}
- TImageHlpSymbol64 = IMAGEHLP_SYMBOL64;
- PImageHlpSymbol64 = PIMAGEHLP_SYMBOL64;
- _IMAGEHLP_SYMBOL64_PACKAGE = record
- sym: IMAGEHLP_SYMBOL64;
- name: array [0..MAX_SYM_NAME] of CHAR;
- end;
- {$EXTERNALSYM _IMAGEHLP_SYMBOL64_PACKAGE}
- IMAGEHLP_SYMBOL64_PACKAGE = _IMAGEHLP_SYMBOL64_PACKAGE;
- {$EXTERNALSYM IMAGEHLP_SYMBOL64_PACKAGE}
- PIMAGEHLP_SYMBOL64_PACKAGE = ^IMAGEHLP_SYMBOL64_PACKAGE;
- {$EXTERNALSYM PIMAGEHLP_SYMBOL64_PACKAGE}
- TImageHlpSymbol64Package = IMAGEHLP_SYMBOL64_PACKAGE;
- PImageHlpSymbol64Package = PIMAGEHLP_SYMBOL64_PACKAGE;
- //#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)
- //
- //#define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64
- //#define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64
- //#define IMAGEHLP_SYMBOL_PACKAGE IMAGEHLP_SYMBOL64_PACKAGE
- //#define PIMAGEHLP_SYMBOL_PACKAGE PIMAGEHLP_SYMBOL64_PACKAGE
- //
- //#else
- PIMAGEHLP_SYMBOL = ^IMAGEHLP_SYMBOL;
- {$EXTERNALSYM PIMAGEHLP_SYMBOL}
- _IMAGEHLP_SYMBOL = record
- SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_SYMBOL)
- Address: DWORD; // virtual address including dll base address
- Size: DWORD; // estimated size of symbol, can be zero
- Flags: DWORD; // info about the symbols, see the SYMF defines
- MaxNameLength: DWORD; // maximum size of symbol name in 'Name'
- Name: array [0..0] of CHAR; // symbol name (null terminated string)
- end;
- {$EXTERNALSYM _IMAGEHLP_SYMBOL}
- IMAGEHLP_SYMBOL = _IMAGEHLP_SYMBOL;
- {$EXTERNALSYM IMAGEHLP_SYMBOL}
- TImageHlpSymbol = IMAGEHLP_SYMBOL;
- PImageHlpSymbol = PIMAGEHLP_SYMBOL;
- _IMAGEHLP_SYMBOL_PACKAGE = record
- sym: IMAGEHLP_SYMBOL;
- name: array [0..MAX_SYM_NAME] of CHAR;
- end;
- {$EXTERNALSYM _IMAGEHLP_SYMBOL_PACKAGE}
- IMAGEHLP_SYMBOL_PACKAGE = _IMAGEHLP_SYMBOL_PACKAGE;
- {$EXTERNALSYM IMAGEHLP_SYMBOL_PACKAGE}
- PIMAGEHLP_SYMBOL_PACKAGE = ^IMAGEHLP_SYMBOL_PACKAGE;
- {$EXTERNALSYM PIMAGEHLP_SYMBOL_PACKAGE}
- TImageHlpSymbolPackage = IMAGEHLP_SYMBOL_PACKAGE;
- PImageHlpSymbolPackage = PIMAGEHLP_SYMBOL_PACKAGE;
- //#endif
- //
- // module data structure
- //
- PIMAGEHLP_MODULE64 = ^IMAGEHLP_MODULE64;
- {$EXTERNALSYM PIMAGEHLP_MODULE64}
- _IMAGEHLP_MODULE64 = record
- SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE64)
- BaseOfImage: DWORD64; // base load address of module
- ImageSize: DWORD; // virtual size of the loaded module
- TimeDateStamp: DWORD; // date/time stamp from pe header
- CheckSum: DWORD; // checksum from the pe header
- NumSyms: DWORD; // number of symbols in the symbol table
- SymType: SYM_TYPE; // type of symbols loaded
- ModuleName: array [0..3] of CHAR; // module name
- ImageName: array [0..255] of CHAR; // image name
- LoadedImageName: array [0..255] of CHAR; // symbol file name
- end;
- {$EXTERNALSYM _IMAGEHLP_MODULE64}
- IMAGEHLP_MODULE64 = _IMAGEHLP_MODULE64;
- {$EXTERNALSYM IMAGEHLP_MODULE64}
- TImageHlpModule64 = IMAGEHLP_MODULE64;
- PImageHlpModule64 = PIMAGEHLP_MODULE64;
- PIMAGEHLP_MODULEW64 = ^IMAGEHLP_MODULEW64;
- {$EXTERNALSYM PIMAGEHLP_MODULEW64}
- _IMAGEHLP_MODULE64W = record
- SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE64)
- BaseOfImage: DWORD64; // base load address of module
- ImageSize: DWORD; // virtual size of the loaded module
- TimeDateStamp: DWORD; // date/time stamp from pe header
- CheckSum: DWORD; // checksum from the pe header
- NumSyms: DWORD; // number of symbols in the symbol table
- SymType: SYM_TYPE; // type of symbols loaded
- ModuleName: array [0..31] of WCHAR; // module name
- ImageName: array [0..255] of WCHAR; // image name
- LoadedImageName: array [0..255] of WCHAR; // symbol file name
- end;
- {$EXTERNALSYM _IMAGEHLP_MODULE64W}
- IMAGEHLP_MODULEW64 = _IMAGEHLP_MODULE64W;
- {$EXTERNALSYM IMAGEHLP_MODULEW64}
- TImageHlpModuleW64 = IMAGEHLP_MODULEW64;
- PImageHlpModuleW64 = PIMAGEHLP_MODULEW64;
- PIMAGEHLP_MODULE = ^IMAGEHLP_MODULE;
- {$EXTERNALSYM PIMAGEHLP_MODULE}
- _IMAGEHLP_MODULE = record
- SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE)
- BaseOfImage: DWORD; // base load address of module
- ImageSize: DWORD; // virtual size of the loaded module
- TimeDateStamp: DWORD; // date/time stamp from pe header
- CheckSum: DWORD; // checksum from the pe header
- NumSyms: DWORD; // number of symbols in the symbol table
- SymType: SYM_TYPE; // type of symbols loaded
- ModuleName: array [0..31] of CHAR; // module name
- ImageName: array [0..255] of CHAR; // image name
- LoadedImageName: array [0..255] of CHAR; // symbol file name
- end;
- {$EXTERNALSYM _IMAGEHLP_MODULE}
- IMAGEHLP_MODULE = _IMAGEHLP_MODULE;
- {$EXTERNALSYM IMAGEHLP_MODULE}
- TImageHlpModule = IMAGEHLP_MODULE;
- PImageHlpModule = PIMAGEHLP_MODULE;
- PIMAGEHLP_MODULEW = ^IMAGEHLP_MODULEW;
- {$EXTERNALSYM PIMAGEHLP_MODULEW}
- _IMAGEHLP_MODULEW = record
- SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE)
- BaseOfImage: DWORD; // base load address of module
- ImageSize: DWORD; // virtual size of the loaded module
- TimeDateStamp: DWORD; // date/time stamp from pe header
- CheckSum: DWORD; // checksum from the pe header
- NumSyms: DWORD; // number of symbols in the symbol table
- SymType: SYM_TYPE; // type of symbols loaded
- ModuleName: array [0..31] of WCHAR; // module name
- ImageName: array [0..255] of WCHAR; // image name
- LoadedImageName: array [0..255] of WCHAR; // symbol file name
- end;
- {$EXTERNALSYM _IMAGEHLP_MODULEW}
- IMAGEHLP_MODULEW = _IMAGEHLP_MODULEW;
- {$EXTERNALSYM IMAGEHLP_MODULEW}
- TImageHlpModuleW = IMAGEHLP_MODULEW;
- PImageHlpModuleW = PIMAGEHLP_MODULEW;
- //
- // source file line data structure
- //
- PIMAGEHLP_LINE64 = ^IMAGEHLP_LINE64;
- {$EXTERNALSYM PIMAGEHLP_LINE64}
- _IMAGEHLP_LINE64 = record
- SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_LINE64)
- Key: PVOID; // internal
- LineNumber: DWORD; // line number in file
- FileName: PCHAR; // full filename
- Address: DWORD64; // first instruction of line
- end;
- {$EXTERNALSYM _IMAGEHLP_LINE64}
- IMAGEHLP_LINE64 = _IMAGEHLP_LINE64;
- {$EXTERNALSYM IMAGEHLP_LINE64}
- TImageHlpLine64 = IMAGEHLP_LINE64;
- PImageHlpLine64 = PIMAGEHLP_LINE64;
- PIMAGEHLP_LINE = ^IMAGEHLP_LINE;
- {$EXTERNALSYM PIMAGEHLP_LINE}
- _IMAGEHLP_LINE = record
- SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_LINE)
- Key: PVOID; // internal
- LineNumber: DWORD; // line number in file
- FileName: PCHAR; // full filename
- Address: DWORD; // first instruction of line
- end;
- {$EXTERNALSYM _IMAGEHLP_LINE}
- IMAGEHLP_LINE = _IMAGEHLP_LINE;
- {$EXTERNALSYM IMAGEHLP_LINE}
- TImageHlpLine = IMAGEHLP_LINE;
- PImageHlpLine = PIMAGEHLP_LINE;
- //
- // source file structure
- //
- type
- _SOURCEFILE = record
- ModBase: DWORD64; // base address of loaded module
- FileName: PCHAR; // full filename of source
- end;
- {$EXTERNALSYM _SOURCEFILE}
- SOURCEFILE = _SOURCEFILE;
- {$EXTERNALSYM SOURCEFILE}
- PSOURCEFILE = ^SOURCEFILE;
- {$EXTERNALSYM PSOURCEFILE}
- TSourceFile = SOURCEFILE;
- //
- // data structures used for registered symbol callbacks
- //
- const
- CBA_DEFERRED_SYMBOL_LOAD_START = $00000001;
- {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_START}
- CBA_DEFERRED_SYMBOL_LOAD_COMPLETE = $00000002;
- {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_COMPLETE}
- CBA_DEFERRED_SYMBOL_LOAD_FAILURE = $00000003;
- {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_FAILURE}
- CBA_SYMBOLS_UNLOADED = $00000004;
- {$EXTERNALSYM CBA_SYMBOLS_UNLOADED}
- CBA_DUPLICATE_SYMBOL = $00000005;
- {$EXTERNALSYM CBA_DUPLICATE_SYMBOL}
- CBA_READ_MEMORY = $00000006;
- {$EXTERNALSYM CBA_READ_MEMORY}
- CBA_DEFERRED_SYMBOL_LOAD_CANCEL = $00000007;
- {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_CANCEL}
- CBA_SET_OPTIONS = $00000008;
- {$EXTERNALSYM CBA_SET_OPTIONS}
- CBA_EVENT = $00000010;
- {$EXTERNALSYM CBA_EVENT}
- CBA_DEFERRED_SYMBOL_LOAD_PARTIAL = $00000020;
- {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_PARTIAL}
- CBA_DEBUG_INFO = $10000000;
- {$EXTERNALSYM CBA_DEBUG_INFO}
- type
- PIMAGEHLP_CBA_READ_MEMORY = ^IMAGEHLP_CBA_READ_MEMORY;
- {$EXTERNALSYM PIMAGEHLP_CBA_READ_MEMORY}
- _IMAGEHLP_CBA_READ_MEMORY = record
- addr: DWORD64; // address to read from
- buf: PVOID; // buffer to read to
- bytes: DWORD; // amount of bytes to read
- bytesread: LPDWORD; // pointer to store amount of bytes read
- end;
- {$EXTERNALSYM _IMAGEHLP_CBA_READ_MEMORY}
- IMAGEHLP_CBA_READ_MEMORY = _IMAGEHLP_CBA_READ_MEMORY;
- {$EXTERNALSYM IMAGEHLP_CBA_READ_MEMORY}
- TImageHlpCbaReadMemory = IMAGEHLP_CBA_READ_MEMORY;
- PImageHlpCbaReadMemory = PIMAGEHLP_CBA_READ_MEMORY;
- const
- sevInfo = 0;
- {$EXTERNALSYM sevInfo}
- sevProblem = 1;
- {$EXTERNALSYM sevProblem}
- sevAttn = 2;
- {$EXTERNALSYM sevAttn}
- sevFatal = 3;
- {$EXTERNALSYM sevFatal}
- sevMax = 4; // unused
- {$EXTERNALSYM sevMax}
- type
- _IMAGEHLP_CBA_EVENT = record
- severity: DWORD; // values from sevInfo to sevFatal
- code: DWORD; // numerical code IDs the error
- desc: PCHAR; // may contain a text description of the error
- object_: PVOID; // value dependant upon the error code
- end;
- {$EXTERNALSYM _IMAGEHLP_CBA_EVENT}
- IMAGEHLP_CBA_EVENT = _IMAGEHLP_CBA_EVENT;
- {$EXTERNALSYM IMAGEHLP_CBA_EVENT}
- PIMAGEHLP_CBA_EVENT = ^IMAGEHLP_CBA_EVENT;
- {$EXTERNALSYM PIMAGEHLP_CBA_EVENT}
- TImageHlpCbaEvent = IMAGEHLP_CBA_EVENT;
- PImageHlpCbaEvent = PIMAGEHLP_CBA_EVENT;
- PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 = ^IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
- {$EXTERNALSYM PIMAGEHLP_DEFERRED_SYMBOL_LOAD64}
- _IMAGEHLP_DEFERRED_SYMBOL_LOAD64 = record
- SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64)
- BaseOfImage: DWORD64; // base load address of module
- CheckSum: DWORD; // checksum from the pe header
- TimeDateStamp: DWORD; // date/time stamp from pe header
- FileName: array [0..MAX_PATH - 1] of CHAR; // symbols file or image name
- Reparse: ByteBool; // load failure reparse
- hFile: HANDLE; // file handle, if passed
- Flags: DWORD; //
- end;
- {$EXTERNALSYM _IMAGEHLP_DEFERRED_SYMBOL_LOAD64}
- IMAGEHLP_DEFERRED_SYMBOL_LOAD64 = _IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
- {$EXTERNALSYM IMAGEHLP_DEFERRED_SYMBOL_LOAD64}
- TImageHlpDeferredSymbolLoad64 = IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
- PImageHlpDeferredSymbolLoad64 = PIMAGEHLP_DEFERRED_SYMBOL_LOAD64;
- const
- DSLFLAG_MISMATCHED_PDB = $1;
- {$EXTERNALSYM DSLFLAG_MISMATCHED_PDB}
- DSLFLAG_MISMATCHED_DBG = $2;
- {$EXTERNALSYM DSLFLAG_MISMATCHED_DBG}
- type
- PIMAGEHLP_DEFERRED_SYMBOL_LOAD = ^IMAGEHLP_DEFERRED_SYMBOL_LOAD;
- {$EXTERNALSYM PIMAGEHLP_DEFERRED_SYMBOL_LOAD}
- _IMAGEHLP_DEFERRED_SYMBOL_LOAD = record
- SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD)
- BaseOfImage: DWORD; // base load address of module
- CheckSum: DWORD; // checksum from the pe header
- TimeDateStamp: DWORD; // date/time stamp from pe header
- FileName: array [0..MAX_PATH - 1] of CHAR; // symbols file or image name
- Reparse: ByteBool; // load failure reparse
- hFile: HANDLE; // file handle, if passed
- end;
- {$EXTERNALSYM _IMAGEHLP_DEFERRED_SYMBOL_LOAD}
- IMAGEHLP_DEFERRED_SYMBOL_LOAD = _IMAGEHLP_DEFERRED_SYMBOL_LOAD;
- {$EXTERNALSYM IMAGEHLP_DEFERRED_SYMBOL_LOAD}
- TImageHlpDeferredSymbolLoad = IMAGEHLP_DEFERRED_SYMBOL_LOAD;
- PImageHlpDeferredSymbolLoad = PIMAGEHLP_DEFERRED_SYMBOL_LOAD;
- PIMAGEHLP_DUPLICATE_SYMBOL64 = ^IMAGEHLP_DUPLICATE_SYMBOL64;
- {$EXTERNALSYM PIMAGEHLP_DUPLICATE_SYMBOL64}
- _IMAGEHLP_DUPLICATE_SYMBOL64 = record
- SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL64)
- NumberOfDups: DWORD; // number of duplicates in the Symbol array
- Symbol: PIMAGEHLP_SYMBOL64; // array of duplicate symbols
- SelectedSymbol: DWORD; // symbol selected (-1 to start)
- end;
- {$EXTERNALSYM _IMAGEHLP_DUPLICATE_SYMBOL64}
- IMAGEHLP_DUPLICATE_SYMBOL64 = _IMAGEHLP_DUPLICATE_SYMBOL64;
- {$EXTERNALSYM IMAGEHLP_DUPLICATE_SYMBOL64}
- TImageHlpDuplicateSymbol64 = IMAGEHLP_DUPLICATE_SYMBOL64;
- PImageHlpDuplicateSymbol64 = PIMAGEHLP_DUPLICATE_SYMBOL64;
- PIMAGEHLP_DUPLICATE_SYMBOL = ^IMAGEHLP_DUPLICATE_SYMBOL;
- {$EXTERNALSYM PIMAGEHLP_DUPLICATE_SYMBOL}
- _IMAGEHLP_DUPLICATE_SYMBOL = record
- SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL)
- NumberOfDups: DWORD; // number of duplicates in the Symbol array
- Symbol: PIMAGEHLP_SYMBOL; // array of duplicate symbols
- SelectedSymbol: DWORD; // symbol selected (-1 to start)
- end;
- {$EXTERNALSYM _IMAGEHLP_DUPLICATE_SYMBOL}
- IMAGEHLP_DUPLICATE_SYMBOL = _IMAGEHLP_DUPLICATE_SYMBOL;
- {$EXTERNALSYM IMAGEHLP_DUPLICATE_SYMBOL}
- TImageHlpDuplicateSymbol = IMAGEHLP_DUPLICATE_SYMBOL;
- PImageHlpDuplicateSymbol = PIMAGEHLP_DUPLICATE_SYMBOL;
- // If dbghelp ever needs to display graphical UI, it will use this as the parent window.
- //BOOL
- //SymSetParentWindow(
- // HWND hwnd
- // );
- //
- // options that are set/returned by SymSetOptions() & SymGetOptions()
- // these are used as a mask
- //
- const
- SYMOPT_CASE_INSENSITIVE = $00000001;
- {$EXTERNALSYM SYMOPT_CASE_INSENSITIVE}
- SYMOPT_UNDNAME = $00000002;
- {$EXTERNALSYM SYMOPT_UNDNAME}
- SYMOPT_DEFERRED_LOADS = $00000004;
- {$EXTERNALSYM SYMOPT_DEFERRED_LOADS}
- SYMOPT_NO_CPP = $00000008;
- {$EXTERNALSYM SYMOPT_NO_CPP}
- SYMOPT_LOAD_LINES = $00000010;
- {$EXTERNALSYM SYMOPT_LOAD_LINES}
- SYMOPT_OMAP_FIND_NEAREST = $00000020;
- {$EXTERNALSYM SYMOPT_OMAP_FIND_NEAREST}
- SYMOPT_LOAD_ANYTHING = $00000040;
- {$EXTERNALSYM SYMOPT_LOAD_ANYTHING}
- SYMOPT_IGNORE_CVREC = $00000080;
- {$EXTERNALSYM SYMOPT_IGNORE_CVREC}
- SYMOPT_NO_UNQUALIFIED_LOADS = $00000100;
- {$EXTERNALSYM SYMOPT_NO_UNQUALIFIED_LOADS}
- SYMOPT_FAIL_CRITICAL_ERRORS = $00000200;
- {$EXTERNALSYM SYMOPT_FAIL_CRITICAL_ERRORS}
- SYMOPT_EXACT_SYMBOLS = $00000400;
- {$EXTERNALSYM SYMOPT_EXACT_SYMBOLS}
- SYMOPT_ALLOW_ABSOLUTE_SYMBOLS = $00000800;
- {$EXTERNALSYM SYMOPT_ALLOW_ABSOLUTE_SYMBOLS}
- SYMOPT_IGNORE_NT_SYMPATH = $00001000;
- {$EXTERNALSYM SYMOPT_IGNORE_NT_SYMPATH}
- SYMOPT_INCLUDE_32BIT_MODULES = $00002000;
- {$EXTERNALSYM SYMOPT_INCLUDE_32BIT_MODULES}
- SYMOPT_PUBLICS_ONLY = $00004000;
- {$EXTERNALSYM SYMOPT_PUBLICS_ONLY}
- SYMOPT_NO_PUBLICS = $00008000;
- {$EXTERNALSYM SYMOPT_NO_PUBLICS}
- SYMOPT_AUTO_PUBLICS = $00010000;
- {$EXTERNALSYM SYMOPT_AUTO_PUBLICS}
- SYMOPT_NO_IMAGE_SEARCH = $00020000;
- {$EXTERNALSYM SYMOPT_NO_IMAGE_SEARCH}
- SYMOPT_SECURE = $00040000;
- {$EXTERNALSYM SYMOPT_SECURE}
- SYMOPT_DEBUG = DWORD($80000000);
- {$EXTERNALSYM SYMOPT_DEBUG}
- function SymSetOptions(SymOptions: DWORD): DWORD; stdcall;
- {$EXTERNALSYM SymSetOptions}
- function SymGetOptions: DWORD; stdcall;
- {$EXTERNALSYM SymGetOptions}
- function SymCleanup(hProcess: HANDLE): BOOL; stdcall;
- {$EXTERNALSYM SymCleanup}
- function SymMatchString(string_, expression: LPSTR; fCase: BOOL): BOOL; stdcall;
- {$EXTERNALSYM SymMatchString}
- type
- PSYM_ENUMSOURCFILES_CALLBACK = function(pSourceFile: PSOURCEFILE; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PSYM_ENUMSOURCFILES_CALLBACK}
- PSymEnumSourceFilesCallback = PSYM_ENUMSOURCFILES_CALLBACK;
- function SymEnumSourceFiles(hProcess: HANDLE; ModBase: ULONG64; Mask: LPSTR;
- cbSrcFiles: PSYM_ENUMSOURCFILES_CALLBACK; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymEnumSourceFiles}
- function SymEnumerateModules64(hProcess: HANDLE; EnumModulesCallback: PSYM_ENUMMODULES_CALLBACK64;
- UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymEnumerateModules64}
- function SymEnumerateModules(hProcess: HANDLE; EnumModulesCallback: PSYM_ENUMMODULES_CALLBACK;
- UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymEnumerateModules}
- function SymEnumerateSymbols64(hProcess: HANDLE; BaseOfDll: DWORD64;
- EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK64; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymEnumerateSymbols64}
- function SymEnumerateSymbolsW64(hProcess: HANDLE; BaseOfDll: DWORD64;
- EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK64W; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymEnumerateSymbolsW64}
- function SymEnumerateSymbols(hProcess: HANDLE; BaseOfDll: DWORD;
- EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymEnumerateSymbols}
- function SymEnumerateSymbolsW(hProcess: HANDLE; BaseOfDll: DWORD;
- EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACKW; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymEnumerateSymbolsW}
- function EnumerateLoadedModules64(hProcess: HANDLE; EnumLoadedModulesCallback: PENUMLOADED_MODULES_CALLBACK64;
- UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM EnumerateLoadedModules64}
- function EnumerateLoadedModules(hProcess: HANDLE; EnumLoadedModulesCallback: PENUMLOADED_MODULES_CALLBACK;
- UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM EnumerateLoadedModules}
- function SymFunctionTableAccess64(hProcess: HANDLE; AddrBase: DWORD64): PVOID; stdcall;
- {$EXTERNALSYM SymFunctionTableAccess64}
- function SymFunctionTableAccess(hProcess: HANDLE; AddrBase: DWORD): PVOID; stdcall;
- {$EXTERNALSYM SymFunctionTableAccess}
- function SymGetModuleInfo64(hProcess: HANDLE; qwAddr: DWORD64;
- var ModuleInfo: IMAGEHLP_MODULE64): BOOL; stdcall;
- {$EXTERNALSYM SymGetModuleInfo64}
- function SymGetModuleInfoW64(hProcess: HANDLE; qwAddr: DWORD64;
- var ModuleInfo: IMAGEHLP_MODULEW64): BOOL; stdcall;
- {$EXTERNALSYM SymGetModuleInfoW64}
- function SymGetModuleInfo(hProcess: HANDLE; dwAddr: DWORD;
- var ModuleInfo: IMAGEHLP_MODULE): BOOL; stdcall;
- {$EXTERNALSYM SymGetModuleInfo}
- function SymGetModuleInfoW(hProcess: HANDLE; dwAddr: DWORD;
- var ModuleInfo: IMAGEHLP_MODULEW): BOOL; stdcall;
- {$EXTERNALSYM SymGetModuleInfoW}
- function SymGetModuleBase64(hProcess: HANDLE; qwAddr: DWORD64): DWORD64; stdcall;
- {$EXTERNALSYM SymGetModuleBase64}
- function SymGetModuleBase(hProcess: HANDLE; dwAddr: DWORD): DWORD; stdcall;
- {$EXTERNALSYM SymGetModuleBase}
- function SymGetSymNext64(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL64): BOOL; stdcall;
- {$EXTERNALSYM SymGetSymNext64}
- function SymGetSymNext(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL): BOOL; stdcall;
- {$EXTERNALSYM SymGetSymNext}
- function SymGetSymPrev64(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL64): BOOL; stdcall;
- {$EXTERNALSYM SymGetSymPrev64}
- function SymGetSymPrev(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL): BOOL; stdcall;
- {$EXTERNALSYM SymGetSymPrev}
- function SymGetLineFromAddr64(hProcess: HANDLE; qwAddr: DWORD64;
- var pdwDisplacement: DWORD; var Line64: IMAGEHLP_LINE64): BOOL; stdcall;
- {$EXTERNALSYM SymGetLineFromAddr64}
- function SymGetLineFromAddr(hProcess: HANDLE; dwAddr: DWORD;
- var pdwDisplacement: DWORD; var Line: IMAGEHLP_LINE): BOOL; stdcall;
- {$EXTERNALSYM SymGetLineFromAddr}
- function SymGetLineFromName64(hProcess: HANDLE; ModuleName: PSTR; FileName: PSTR;
- dwLineNumber: DWORD; var plDisplacement: LONG; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
- {$EXTERNALSYM SymGetLineFromName64}
- function SymGetLineFromName(hProcess: HANDLE; ModuleName: PSTR; FileName: PSTR;
- dwLineNumber: DWORD; var plDisplacement: LONG; var Line: IMAGEHLP_LINE): BOOL; stdcall;
- {$EXTERNALSYM SymGetLineFromName}
- function SymGetLineNext64(hProcess: HANDLE; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
- {$EXTERNALSYM SymGetLineNext64}
- function SymGetLineNext(hProcess: HANDLE; var Line: IMAGEHLP_LINE): BOOL; stdcall;
- {$EXTERNALSYM SymGetLineNext}
- function SymGetLinePrev64(hProcess: HANDLE; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
- {$EXTERNALSYM SymGetLinePrev64}
- function SymGetLinePrev(hProcess: HANDLE; var Line: IMAGEHLP_LINE): BOOL; stdcall;
- {$EXTERNALSYM SymGetLinePrev}
- function SymMatchFileName(FileName, Match: PSTR; var FileNameStop, MatchStop: PSTR): BOOL; stdcall;
- {$EXTERNALSYM SymMatchFileName}
- function SymInitialize(hProcess: HANDLE; UserSearchPath: PSTR; fInvadeProcess: BOOL): BOOL; stdcall;
- {$EXTERNALSYM SymInitialize}
- function SymGetSearchPath(hProcess: HANDLE; SearchPath: PSTR; SearchPathLength: DWORD): BOOL; stdcall;
- {$EXTERNALSYM SymGetSearchPath}
- function SymSetSearchPath(hProcess: HANDLE; SearchPath: PSTR): BOOL; stdcall;
- {$EXTERNALSYM SymSetSearchPath}
- function SymLoadModule64(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR;
- BaseOfDll: DWORD64; SizeOfDll: DWORD): DWORD64; stdcall;
- {$EXTERNALSYM SymLoadModule64}
- const
- SLMFLAG_VIRTUAL = $1;
- {$EXTERNALSYM SLMFLAG_VIRTUAL}
- function SymLoadModuleEx(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR; BaseOfDll: DWORD64;
- DllSize: DWORD; Data: PMODLOAD_DATA; Flag: DWORD): DWORD64; stdcall;
- {$EXTERNALSYM SymLoadModuleEx}
- function SymLoadModule(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR;
- BaseOfDll: DWORD; SizeOfDll: DWORD): DWORD; stdcall;
- {$EXTERNALSYM SymLoadModule}
- function SymUnloadModule64(hProcess: HANDLE; BaseOfDll: DWORD64): BOOL; stdcall;
- {$EXTERNALSYM SymUnloadModule64}
- function SymUnloadModule(hProcess: HANDLE; BaseOfDll: DWORD): BOOL; stdcall;
- {$EXTERNALSYM SymUnloadModule}
- function SymUnDName64(const sym: IMAGEHLP_SYMBOL64; UnDecName: PSTR;
- UnDecNameLength: DWORD): BOOL; stdcall;
- {$EXTERNALSYM SymUnDName64}
- function SymUnDName(const sym: IMAGEHLP_SYMBOL; UnDecName: PSTR;
- UnDecNameLength: DWORD): BOOL; stdcall;
- {$EXTERNALSYM SymUnDName}
- function SymRegisterCallback64(hProcess: HANDLE; CallbackFunction: PSYMBOL_REGISTERED_CALLBACK64;
- UserContext: ULONG64): BOOL; stdcall;
- {$EXTERNALSYM SymRegisterCallback64}
- function SymRegisterFunctionEntryCallback64(hProcess: HANDLE; CallbackFunction: PSYMBOL_FUNCENTRY_CALLBACK64;
- UserContext: ULONG64): BOOL; stdcall;
- {$EXTERNALSYM SymRegisterFunctionEntryCallback64}
- function SymRegisterCallback(hProcess: HANDLE; CallbackFunction: PSYMBOL_REGISTERED_CALLBACK;
- UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymRegisterCallback}
- function SymRegisterFunctionEntryCallback(hProcess: HANDLE; CallbackFunction: PSYMBOL_FUNCENTRY_CALLBACK;
- UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymRegisterFunctionEntryCallback}
- type
- PIMAGEHLP_SYMBOL_SRC = ^IMAGEHLP_SYMBOL_SRC;
- {$EXTERNALSYM PIMAGEHLP_SYMBOL_SRC}
- _IMAGEHLP_SYMBOL_SRC = record
- sizeofstruct: DWORD;
- type_: DWORD;
- file_: array [0..MAX_PATH - 1] of Char;
- end;
- {$EXTERNALSYM _IMAGEHLP_SYMBOL_SRC}
- IMAGEHLP_SYMBOL_SRC = _IMAGEHLP_SYMBOL_SRC;
- {$EXTERNALSYM IMAGEHLP_SYMBOL_SRC}
- TImageHlpSymbolSrc = IMAGEHLP_SYMBOL_SRC;
- PImageHlpSymbolSrc = PIMAGEHLP_SYMBOL_SRC;
- PMODULE_TYPE_INFO = ^MODULE_TYPE_INFO;
- {$EXTERNALSYM PMODULE_TYPE_INFO}
- _MODULE_TYPE_INFO = record
- dataLength: USHORT;
- leaf: USHORT;
- data: array [0..0] of BYTE;
- end;
- {$EXTERNALSYM _MODULE_TYPE_INFO}
- MODULE_TYPE_INFO = _MODULE_TYPE_INFO;
- {$EXTERNALSYM MODULE_TYPE_INFO}
- TModuleTypeInfo = MODULE_TYPE_INFO;
- PModuleTypeInfo = PMODULE_TYPE_INFO;
- type
- PSYMBOL_INFO = ^SYMBOL_INFO;
- {$EXTERNALSYM PSYMBOL_INFO}
- _SYMBOL_INFO = record
- SizeOfStruct: ULONG;
- TypeIndex: ULONG; // Type Index of symbol
- Reserved: array [0..1] of ULONG64;
- Info: ULONG;
- Size: ULONG;
- ModBase: ULONG64; // Base Address of module comtaining this symbol
- Flags: ULONG;
- Value: ULONG64; // Value of symbol, ValuePresent should be 1
- Address: ULONG64; // Address of symbol including base address of module
- Register_: ULONG; // register holding value or pointer to value
- Scope: ULONG; // scope of the symbol
- Tag: ULONG; // pdb classification
- NameLen: ULONG; // Actual length of name
- MaxNameLen: ULONG;
- Name: array [0..0] of CHAR; // Name of symbol
- end;
- {$EXTERNALSYM _SYMBOL_INFO}
- SYMBOL_INFO = _SYMBOL_INFO;
- {$EXTERNALSYM SYMBOL_INFO}
- TSymbolInfo = SYMBOL_INFO;
- PSymbolInfo = PSYMBOL_INFO;
- _SYMBOL_INFO_PACKAGE = record
- si: SYMBOL_INFO;
- name: array [0..MAX_SYM_NAME] of CHAR;
- end;
- {$EXTERNALSYM _SYMBOL_INFO_PACKAGE}
- SYMBOL_INFO_PACKAGE = _SYMBOL_INFO_PACKAGE;
- {$EXTERNALSYM SYMBOL_INFO_PACKAGE}
- PSYMBOL_INFO_PACKAGE = ^SYMBOL_INFO_PACKAGE;
- {$EXTERNALSYM PSYMBOL_INFO_PACKAGE}
- TSymbolInfoPackage = SYMBOL_INFO_PACKAGE;
- PSymbolInfoPackage = PSYMBOL_INFO_PACKAGE;
- PIMAGEHLP_STACK_FRAME = ^IMAGEHLP_STACK_FRAME;
- {$EXTERNALSYM PIMAGEHLP_STACK_FRAME}
- _IMAGEHLP_STACK_FRAME = record
- InstructionOffset: ULONG64;
- ReturnOffset: ULONG64;
- FrameOffset: ULONG64;
- StackOffset: ULONG64;
- BackingStoreOffset: ULONG64;
- FuncTableEntry: ULONG64;
- Params: array [0..3] of ULONG64;
- Reserved: array [0..4] of ULONG64;
- Virtual_: BOOL;
- Reserved2: ULONG;
- end;
- {$EXTERNALSYM _IMAGEHLP_STACK_FRAME}
- IMAGEHLP_STACK_FRAME = _IMAGEHLP_STACK_FRAME;
- {$EXTERNALSYM IMAGEHLP_STACK_FRAME}
- TImageHlpStackFrame = IMAGEHLP_STACK_FRAME;
- PImageHlpStackFrame = PIMAGEHLP_STACK_FRAME;
- IMAGEHLP_CONTEXT = LPVOID;
- {$EXTERNALSYM IMAGEHLP_CONTEXT}
- PIMAGEHLP_CONTEXT = ^IMAGEHLP_CONTEXT;
- {$EXTERNALSYM PIMAGEHLP_CONTEXT}
- TImageHlpContext = IMAGEHLP_CONTEXT;
- PImageHlpContext = PIMAGEHLP_CONTEXT;
- function SymSetContext(hProcess: HANDLE; StackFrame: PIMAGEHLP_STACK_FRAME; Context: PIMAGEHLP_CONTEXT): BOOL; stdcall;
- {$EXTERNALSYM SymSetContext}
- function SymFromAddr(hProcess: HANDLE; Address: DWORD64; Displacement: PDWORD64; Symbol: PSYMBOL_INFO): BOOL; stdcall;
- {$EXTERNALSYM SymFromAddr}
- // While SymFromName will provide a symbol from a name,
- // SymEnumSymbols can provide the same matching information
- // for ALL symbols with a matching name, even regular
- // expressions. That way you can search across modules
- // and differentiate between identically named symbols.
- function SymFromName(hProcess: HANDLE; Name: LPSTR; Symbol: PSYMBOL_INFO): BOOL; stdcall;
- {$EXTERNALSYM SymFromName}
- type
- PSYM_ENUMERATESYMBOLS_CALLBACK = function(pSymInfo: PSYMBOL_INFO; SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PSYM_ENUMERATESYMBOLS_CALLBACK}
- PSymEnumerateSymbolsCallback = PSYM_ENUMERATESYMBOLS_CALLBACK;
- function SymEnumSymbols(hProcess: HANDLE; BaseOfDll: ULONG64; Mask: PCSTR; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymEnumSymbols}
- function SymEnumSymbolsForAddr(hProcess: HANDLE; Address: DWORD64;
- EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymEnumSymbolsForAddr}
- type
- _IMAGEHLP_SYMBOL_TYPE_INFO = (
- TI_GET_SYMTAG,
- TI_GET_SYMNAME,
- TI_GET_LENGTH,
- TI_GET_TYPE,
- TI_GET_TYPEID,
- TI_GET_BASETYPE,
- TI_GET_ARRAYINDEXTYPEID,
- TI_FINDCHILDREN,
- TI_GET_DATAKIND,
- TI_GET_ADDRESSOFFSET,
- TI_GET_OFFSET,
- TI_GET_VALUE,
- TI_GET_COUNT,
- TI_GET_CHILDRENCOUNT,
- TI_GET_BITPOSITION,
- TI_GET_VIRTUALBASECLASS,
- TI_GET_VIRTUALTABLESHAPEID,
- TI_GET_VIRTUALBASEPOINTEROFFSET,
- TI_GET_CLASSPARENTID,
- TI_GET_NESTED,
- TI_GET_SYMINDEX,
- TI_GET_LEXICALPARENT,
- TI_GET_ADDRESS,
- TI_GET_THISADJUST,
- TI_GET_UDTKIND,
- TI_IS_EQUIV_TO,
- TI_GET_CALLING_CONVENTION);
- {$EXTERNALSYM _IMAGEHLP_SYMBOL_TYPE_INFO}
- IMAGEHLP_SYMBOL_TYPE_INFO = _IMAGEHLP_SYMBOL_TYPE_INFO;
- {$EXTERNALSYM IMAGEHLP_SYMBOL_TYPE_INFO}
- TImageHlpSymbolTypeInfo = IMAGEHLP_SYMBOL_TYPE_INFO;
- PTI_FINDCHILDREN_PARAMS = ^TI_FINDCHILDREN_PARAMS;
- {$EXTERNALSYM PTI_FINDCHILDREN_PARAMS}
- _TI_FINDCHILDREN_PARAMS = record
- Count: ULONG;
- Start: ULONG;
- ChildId: array [0..0] of ULONG;
- end;
- {$EXTERNALSYM _TI_FINDCHILDREN_PARAMS}
- TI_FINDCHILDREN_PARAMS = _TI_FINDCHILDREN_PARAMS;
- {$EXTERNALSYM TI_FINDCHILDREN_PARAMS}
- TTiFindChildrenParams = TI_FINDCHILDREN_PARAMS;
- PTiFindChildrenParams = PTI_FINDCHILDREN_PARAMS;
- function SymGetTypeInfo(hProcess: HANDLE; ModBase: DWORD64; TypeId: ULONG; GetType: IMAGEHLP_SYMBOL_TYPE_INFO; pInfo: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymGetTypeInfo}
- function SymEnumTypes(hProcess: HANDLE; BaseOfDll: ULONG64; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymEnumTypes}
- function SymGetTypeFromName(hProcess: HANDLE; BaseOfDll: ULONG64; Name: LPSTR; Symbol: PSYMBOL_INFO): BOOL; stdcall;
- {$EXTERNALSYM SymGetTypeFromName}
- function SymAddSymbol(hProcess: HANDLE; BaseOfDll: ULONG64; Name: PCSTR; Address: DWORD64; Size, Flags: DWORD): BOOL; stdcall;
- {$EXTERNALSYM SymAddSymbol}
- function SymDeleteSymbol(hProcess: HANDLE; BaseOfDll: ULONG64; Name: PCSTR; Address: DWORD64; Flags: DWORD): BOOL; stdcall;
- {$EXTERNALSYM SymDeleteSymbol}
- //
- // Full user-mode dump creation.
- //
- type
- PDBGHELP_CREATE_USER_DUMP_CALLBACK = function(DataType: DWORD; var Data: PVOID; DataLength: LPDWORD; UserData: PVOID): BOOL; stdcall;
- {$EXTERNALSYM PDBGHELP_CREATE_USER_DUMP_CALLBACK}
- PDbgHelpCreateUserDumpCallback = PDBGHELP_CREATE_USER_DUMP_CALLBACK;
- function DbgHelpCreateUserDump(FileName: LPSTR; Callback: PDBGHELP_CREATE_USER_DUMP_CALLBACK; UserData: PVOID): BOOL; stdcall;
- {$EXTERNALSYM DbgHelpCreateUserDump}
- function DbgHelpCreateUserDumpW(FileName: LPWSTR; Callback: PDBGHELP_CREATE_USER_DUMP_CALLBACK; UserData: PVOID): BOOL; stdcall;
- {$EXTERNALSYM DbgHelpCreateUserDumpW}
- // -----------------------------------------------------------------
- // The following 4 legacy APIs are fully supported, but newer
- // ones are recommended. SymFromName and SymFromAddr provide
- // much more detailed info on the returned symbol.
- function SymGetSymFromAddr64(hProcess: HANDLE; qwAddr: DWORD64; pdwDisplacement: PDWORD64; Symbol: PIMAGEHLP_SYMBOL64): BOOL; stdcall;
- {$EXTERNALSYM SymGetSymFromAddr64}
- function SymGetSymFromAddr(hProcess: HANDLE; dwAddr: DWORD; pdwDisplacement: PDWORD; Symbol: PIMAGEHLP_SYMBOL): BOOL; stdcall;
- {$EXTERNALSYM SymGetSymFromAddr}
- // While following two APIs will provide a symbol from a name,
- // SymEnumSymbols can provide the same matching information
- // for ALL symbols with a matching name, even regular
- // expressions. That way you can search across modules
- // and differentiate between identically named symbols.
- function SymGetSymFromName64(hProcess: HANDLE; Name: PSTR; Symbol: PIMAGEHLP_SYMBOL64): BOOL; stdcall;
- {$EXTERNALSYM SymGetSymFromName64}
- function SymGetSymFromName(hProcess: HANDLE; Name: PSTR; Symbol: PIMAGEHLP_SYMBOL): BOOL; stdcall;
- {$EXTERNALSYM SymGetSymFromName}
- // -----------------------------------------------------------------
- // The following APIs exist only for backwards compatibility
- // with a pre-release version documented in an MSDN release.
- // You should use SymFindFileInPath if you want to maintain
- // future compatibility.
- function FindFileInPath(hprocess: HANDLE; SearchPath: LPSTR; FileName: LPSTR; id: PVOID; two: DWORD; three: DWORD; flags: DWORD; FilePath: LPSTR): BOOL; stdcall;
- {$EXTERNALSYM FindFileInPath}
- // You should use SymFindFileInPath if you want to maintain
- // future compatibility.
- function FindFileInSearchPath(hprocess: HANDLE; SearchPath: LPSTR; FileName: LPSTR; one: DWORD; two: DWORD; three: DWORD; FilePath: LPSTR): BOOL; stdcall;
- {$EXTERNALSYM FindFileInSearchPath}
- function SymEnumSym(hProcess: HANDLE; BaseOfDll: ULONG64; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
- {$EXTERNALSYM SymEnumSym}
- // These values should not be used.
- // They have been replaced by SYMFLAG_ values.
- const
- SYMF_OMAP_GENERATED = $00000001;
- SYMF_OMAP_MODIFIED = $00000002;
- SYMF_REGISTER = $00000008;
- SYMF_REGREL = $00000010;
- SYMF_FRAMEREL = $00000020;
- SYMF_PARAMETER = $00000040;
- SYMF_LOCAL = $00000080;
- SYMF_CONSTANT = $00000100;
- SYMF_EXPORT = $00000200;
- SYMF_FORWARDER = $00000400;
- SYMF_FUNCTION = $00000800;
- SYMF_VIRTUAL = $00001000;
- SYMF_THUNK = $00002000;
- SYMF_TLSREL = $00004000;
- // These values should also not be used.
- // They have been replaced by SYMFLAG_ values.
- IMAGEHLP_SYMBOL_INFO_VALUEPRESENT = 1;
- IMAGEHLP_SYMBOL_INFO_REGISTER = SYMF_REGISTER; // 0x0008
- IMAGEHLP_SYMBOL_INFO_REGRELATIVE = SYMF_REGREL; // 0x0010
- IMAGEHLP_SYMBOL_INFO_FRAMERELATIVE = SYMF_FRAMEREL; // 0x0020
- IMAGEHLP_SYMBOL_INFO_PARAMETER = SYMF_PARAMETER; // 0x0040
- IMAGEHLP_SYMBOL_INFO_LOCAL = SYMF_LOCAL; // 0x0080
- IMAGEHLP_SYMBOL_INFO_CONSTANT = SYMF_CONSTANT; // 0x0100
- IMAGEHLP_SYMBOL_FUNCTION = SYMF_FUNCTION; // 0x0800
- IMAGEHLP_SYMBOL_VIRTUAL = SYMF_VIRTUAL; // 0x1000
- IMAGEHLP_SYMBOL_THUNK = SYMF_THUNK; // 0x2000
- IMAGEHLP_SYMBOL_INFO_TLSRELATIVE = SYMF_TLSREL; // 0x4000
- const
- MINIDUMP_SIGNATURE = 'PMDM';
- {$EXTERNALSYM MINIDUMP_SIGNATURE}
- MINIDUMP_VERSION = 42899;
- {$EXTERNALSYM MINIDUMP_VERSION}
- type
- RVA = DWORD;
- {$EXTERNALSYM RVA}
- RVA64 = ULONG64;
- {$EXTERNALSYM RVA64}
- _MINIDUMP_LOCATION_DESCRIPTOR = record
- DataSize: ULONG32;
- Rva: RVA;
- end;
- {$EXTERNALSYM _MINIDUMP_LOCATION_DESCRIPTOR}
- MINIDUMP_LOCATION_DESCRIPTOR = _MINIDUMP_LOCATION_DESCRIPTOR;
- {$EXTERNALSYM MINIDUMP_LOCATION_DESCRIPTOR}
- TMinidumpLocationDescriptor = MINIDUMP_LOCATION_DESCRIPTOR;
- PMinidumpLocationDescriptor = ^MINIDUMP_LOCATION_DESCRIPTOR;
- _MINIDUMP_LOCATION_DESCRIPTOR64 = record
- DataSize: ULONG64;
- Rva: RVA64;
- end;
- {$EXTERNALSYM _MINIDUMP_LOCATION_DESCRIPTOR64}
- MINIDUMP_LOCATION_DESCRIPTOR64 = _MINIDUMP_LOCATION_DESCRIPTOR64;
- {$EXTERNALSYM MINIDUMP_LOCATION_DESCRIPTOR64}
- TMinidumpLocationDescriptor64 = MINIDUMP_LOCATION_DESCRIPTOR64;
- PMinidumpLocationDescriptor64 = ^MINIDUMP_LOCATION_DESCRIPTOR64;
- PMINIDUMP_MEMORY_DESCRIPTOR = ^MINIDUMP_MEMORY_DESCRIPTOR;
- {$EXTERNALSYM PMINIDUMP_MEMORY_DESCRIPTOR}
- _MINIDUMP_MEMORY_DESCRIPTOR = record
- StartOfMemoryRange: ULONG64;
- Memory: MINIDUMP_LOCATION_DESCRIPTOR;
- end;
- {$EXTERNALSYM _MINIDUMP_MEMORY_DESCRIPTOR}
- MINIDUMP_MEMORY_DESCRIPTOR = _MINIDUMP_MEMORY_DESCRIPTOR;
- {$EXTERNALSYM MINIDUMP_MEMORY_DESCRIPTOR}
- TMinidumpMemoryDescriptor = MINIDUMP_MEMORY_DESCRIPTOR;
- PMinidumpMemoryDescriptor = PMINIDUMP_MEMORY_DESCRIPTOR;
- // DESCRIPTOR64 is used for full-memory minidumps where
- // all of the raw memory is laid out sequentially at the
- // end of the dump. There is no need for individual RVAs
- // as the RVA is the base RVA plus the sum of the preceeding
- // data blocks.
- PMINIDUMP_MEMORY_DESCRIPTOR64 = ^MINIDUMP_MEMORY_DESCRIPTOR64;
- {$EXTERNALSYM PMINIDUMP_MEMORY_DESCRIPTOR64}
- _MINIDUMP_MEMORY_DESCRIPTOR64 = record
- StartOfMemoryRange: ULONG64;
- DataSize: ULONG64;
- end;
- {$EXTERNALSYM _MINIDUMP_MEMORY_DESCRIPTOR64}
- MINIDUMP_MEMORY_DESCRIPTOR64 = _MINIDUMP_MEMORY_DESCRIPTOR64;
- {$EXTERNALSYM MINIDUMP_MEMORY_DESCRIPTOR64}
- TMinidumpMemoryDescriptor64 = MINIDUMP_MEMORY_DESCRIPTOR64;
- PMinidumpMemoryDescriptor64 = PMINIDUMP_MEMORY_DESCRIPTOR64;
- PMINIDUMP_HEADER = ^MINIDUMP_HEADER;
- {$EXTERNALSYM PMINIDUMP_HEADER}
- _MINIDUMP_HEADER = record
- Signature: ULONG32;
- Version: ULONG32;
- NumberOfStreams: ULONG32;
- StreamDirectoryRva: RVA;
- CheckSum: ULONG32;
- U: record
- case Integer of
- 0: (Reserved: ULONG32);
- 1: (TimeDateStamp: ULONG32);
- end;
- Flags: ULONG64;
- end;
- {$EXTERNALSYM _MINIDUMP_HEADER}
- MINIDUMP_HEADER = _MINIDUMP_HEADER;
- {$EXTERNALSYM MINIDUMP_HEADER}
- TMinidumpHeader = MINIDUMP_HEADER;
- PMinidumpHeader = PMINIDUMP_HEADER;
- //
- // The MINIDUMP_HEADER field StreamDirectoryRva points to
- // an array of MINIDUMP_DIRECTORY structures.
- //
- PMINIDUMP_DIRECTORY = ^MINIDUMP_DIRECTORY;
- {$EXTERNALSYM PMINIDUMP_DIRECTORY}
- _MINIDUMP_DIRECTORY = record
- StreamType: ULONG32;
- Location: MINIDUMP_LOCATION_DESCRIPTOR;
- end;
- {$EXTERNALSYM _MINIDUMP_DIRECTORY}
- MINIDUMP_DIRECTORY = _MINIDUMP_DIRECTORY;
- {$EXTERNALSYM MINIDUMP_DIRECTORY}
- TMinidumpDirectory = MINIDUMP_DIRECTORY;
- PMinidumpDirectory = PMINIDUMP_DIRECTORY;
- PMINIDUMP_STRING = ^MINIDUMP_STRING;
- {$EXTERNALSYM PMINIDUMP_STRING}
- _MINIDUMP_STRING = record
- Length: ULONG32; // Length in bytes of the string
- Buffer: PWCHAR; // Variable size buffer
- end;
- {$EXTERNALSYM _MINIDUMP_STRING}
- MINIDUMP_STRING = _MINIDUMP_STRING;
- {$EXTERNALSYM MINIDUMP_STRING}
- TMinidumpString = MINIDUMP_STRING;
- PMinidumpString = PMINIDUMP_STRING;
- //
- // The MINIDUMP_DIRECTORY field StreamType may be one of the following types.
- // Types will be added in the future, so if a program reading the minidump
- // header encounters a stream type it does not understand it should ignore
- // the data altogether. Any tag above LastReservedStream will not be used by
- // the system and is reserved for program-specific information.
- //
- const
- UnusedStream = 0;
- {$EXTERNALSYM UnusedStream}
- ReservedStream0 = 1;
- {$EXTERNALSYM ReservedStream0}
- ReservedStream1 = 2;
- {$EXTERNALSYM ReservedStream1}
- ThreadListStream = 3;
- {$EXTERNALSYM ThreadListStream}
- ModuleListStream = 4;
- {$EXTERNALSYM ModuleListStream}
- MemoryListStream = 5;
- {$EXTERNALSYM MemoryListStream}
- ExceptionStream = 6;
- {$EXTERNALSYM ExceptionStream}
- SystemInfoStream = 7;
- {$EXTERNALSYM SystemInfoStream}
- ThreadExListStream = 8;
- {$EXTERNALSYM ThreadExListStream}
- Memory64ListStream = 9;
- {$EXTERNALSYM Memory64ListStream}
- CommentStreamA = 10;
- {$EXTERNALSYM CommentStreamA}
- CommentStreamW = 11;
- {$EXTERNALSYM CommentStreamW}
- HandleDataStream = 12;
- {$EXTERNALSYM HandleDataStream}
- FunctionTableStream = 13;
- {$EXTERNALSYM FunctionTableStream}
- UnloadedModuleListStream = 14;
- {$EXTERNALSYM UnloadedModuleListStream}
- MiscInfoStream = 15;
- {$EXTERNALSYM MiscInfoStream}
- LastReservedStream = $ffff;
- {$EXTERNALSYM LastReservedStream}
- type
- _MINIDUMP_STREAM_TYPE = DWORD;
- {$EXTERNALSYM MINIDUMP_STREAM_TYPE}
- MINIDUMP_STREAM_TYPE = _MINIDUMP_STREAM_TYPE;
- {$EXTERNALSYM _MINIDUMP_STREAM_TYPE}
- TMinidumpStreamType = MINIDUMP_STREAM_TYPE;
- //
- // The minidump system information contains processor and
- // Operating System specific information.
- //
- type
- _CPU_INFORMATION = record
- case Integer of
- //
- // X86 platforms use CPUID function to obtain processor information.
- //
- 0: (
- //
- // CPUID Subfunction 0, register EAX (VendorId [0]),
- // EBX (VendorId [1]) and ECX (VendorId [2]).
- //
- VendorId: array [0..2] of ULONG32;
- //
- // CPUID Subfunction 1, register EAX
- //
- VersionInformation: ULONG32;
- //
- // CPUID Subfunction 1, register EDX
- //
- FeatureInformation: ULONG32;
- //
- // CPUID, Subfunction 80000001, register EBX. This will only
- // be obtained if the vendor id is "AuthenticAMD".
- //
- AMDExtendedCpuFeatures: ULONG32);
- //
- // Non-x86 platforms use processor feature flags.
- //
- 1: (
- ProcessorFeatures: array [0..1] of ULONG64);
- end;
- _MINIDUMP_SYSTEM_INFO = record
- //
- // ProcessorArchitecture, ProcessorLevel and ProcessorRevision are all
- // taken from the SYSTEM_INFO structure obtained by GetSystemInfo( ).
- //
- ProcessorArchitecture: USHORT;
- ProcessorLevel: USHORT;
- ProcessorRevision: USHORT;
- U: record
- case Integer of
- 0: (Reserved0: USHORT);
- 1: (
- NumberOfProcessors: UCHAR;
- ProductType: UCHAR);
- end;
- //
- // MajorVersion, MinorVersion, BuildNumber, PlatformId and
- // CSDVersion are all taken from the OSVERSIONINFO structure
- // returned by GetVersionEx( ).
- //
- MajorVersion: ULONG32;
- MinorVersion: ULONG32;
- BuildNumber: ULONG32;
- PlatformId: ULONG32;
- //
- // RVA to a CSDVersion string in the string table.
- //
- CSDVersionRva: RVA;
- U2: record
- case Integer of
- 0: (Reserved1: ULONG32);
- 1: (
- SuiteMask: USHORT;
- Reserved2: USHORT);
- end;
-
- //
- // CPU information is obtained from one of two places.
- //
- // 1) On x86 computers, CPU_INFORMATION is obtained from the CPUID
- // instruction. You must use the X86 portion of the union for X86
- // computers.
- //
- // 2) On non-x86 architectures, CPU_INFORMATION is obtained by calling
- // IsProcessorFeatureSupported().
- //
- Cpu: _CPU_INFORMATION;
- end;
- {$EXTERNALSYM _MINIDUMP_SYSTEM_INFO}
- MINIDUMP_SYSTEM_INFO = _MINIDUMP_SYSTEM_INFO;
- {$EXTERNALSYM MINIDUMP_SYSTEM_INFO}
- PMINIDUMP_SYSTEM_INFO = ^MINIDUMP_SYSTEM_INFO;
- {$EXTERNALSYM PMINIDUMP_SYSTEM_INFO}
- TMinidumpSystemInfo = MINIDUMP_SYSTEM_INFO;
- PMinidumpSystemInfo = PMINIDUMP_SYSTEM_INFO;
- CPU_INFORMATION = _CPU_INFORMATION;
- {$EXTERNALSYM CPU_INFORMATION}
- PCPU_INFORMATION = CPU_INFORMATION;
- {$EXTERNALSYM PCPU_INFORMATION}
- //
- // The minidump thread contains standard thread
- // information plus an RVA to the memory for this
- // thread and an RVA to the CONTEXT structure for
- // this thread.
- //
- //
- // ThreadId must be 4 bytes on all architectures.
- //
- // C_ASSERT (sizeof ( ((PPROCESS_INFORMATION)0)->dwThreadId ) == 4);
- type
- PMINIDUMP_THREAD = ^MINIDUMP_THREAD;
- {$EXTERNALSYM PMINIDUMP_THREAD}
- _MINIDUMP_THREAD = record
- ThreadId: ULONG32;
- SuspendCount: ULONG32;
- PriorityClass: ULONG32;
- Priority: ULONG32;
- Teb: ULONG64;
- Stack: MINIDUMP_MEMORY_DESCRIPTOR;
- ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
- end;
- {$EXTERNALSYM _MINIDUMP_THREAD}
- MINIDUMP_THREAD = _MINIDUMP_THREAD;
- {$EXTERNALSYM MINIDUMP_THREAD}
- TMinidumpThread = MINIDUMP_THREAD;
- PMinidumpThread = PMINIDUMP_THREAD;
- //
- // The thread list is a container of threads.
- //
- PMINIDUMP_THREAD_LIST = ^MINIDUMP_THREAD_LIST;
- {$EXTERNALSYM PMINIDUMP_THREAD_LIST}
- _MINIDUMP_THREAD_LIST = record
- NumberOfThreads: ULONG32;
- Threads: array [0..0] of MINIDUMP_THREAD;
- end;
- {$EXTERNALSYM _MINIDUMP_THREAD_LIST}
- MINIDUMP_THREAD_LIST = _MINIDUMP_THREAD_LIST;
- {$EXTERNALSYM MINIDUMP_THREAD_LIST}
- TMinidumpThreadList = MINIDUMP_THREAD_LIST;
- PMinidumpThreadList = PMINIDUMP_THREAD_LIST;
- PMINIDUMP_THREAD_EX = ^MINIDUMP_THREAD_EX;
- {$EXTERNALSYM PMINIDUMP_THREAD_EX}
- _MINIDUMP_THREAD_EX = record
- ThreadId: ULONG32;
- SuspendCount: ULONG32;
- PriorityClass: ULONG32;
- Priority: ULONG32;
- Teb: ULONG64;
- Stack: MINIDUMP_MEMORY_DESCRIPTOR;
- ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
- BackingStore: MINIDUMP_MEMORY_DESCRIPTOR;
- end;
- {$EXTERNALSYM _MINIDUMP_THREAD_EX}
- MINIDUMP_THREAD_EX = _MINIDUMP_THREAD_EX;
- {$EXTERNALSYM MINIDUMP_THREAD_EX}
- TMinidumpThreadEx = MINIDUMP_THREAD_EX;
- PMinidumpThreadEx = PMINIDUMP_THREAD_EX;
- //
- // The thread list is a container of threads.
- //
- PMINIDUMP_THREAD_EX_LIST = ^MINIDUMP_THREAD_EX_LIST;
- {$EXTERNALSYM PMINIDUMP_THREAD_EX_LIST}
- _MINIDUMP_THREAD_EX_LIST = record
- NumberOfThreads: ULONG32;
- Threads: array [0..0] of MINIDUMP_THREAD_EX;
- end;
- {$EXTERNALSYM _MINIDUMP_THREAD_EX_LIST}
- MINIDUMP_THREAD_EX_LIST = _MINIDUMP_THREAD_EX_LIST;
- {$EXTERNALSYM MINIDUMP_THREAD_EX_LIST}
- TMinidumpThreadExList = MINIDUMP_THREAD_EX_LIST;
- PMinidumpThreadExList = PMINIDUMP_THREAD_EX_LIST;
- //
- // The MINIDUMP_EXCEPTION is the same as EXCEPTION on Win64.
- //
- PMINIDUMP_EXCEPTION = ^MINIDUMP_EXCEPTION;
- {$EXTERNALSYM PMINIDUMP_EXCEPTION}
- _MINIDUMP_EXCEPTION = record
- ExceptionCode: ULONG32;
- ExceptionFlags: ULONG32;
- ExceptionRecord: ULONG64;
- ExceptionAddress: ULONG64;
- NumberParameters: ULONG32;
- __unusedAlignment: ULONG32;
- ExceptionInformation: array [0..EXCEPTION_MAXIMUM_PARAMETERS - 1] of ULONG64;
- end;
- {$EXTERNALSYM _MINIDUMP_EXCEPTION}
- MINIDUMP_EXCEPTION = _MINIDUMP_EXCEPTION;
- {$EXTERNALSYM MINIDUMP_EXCEPTION}
- TMinidumpException = MINIDUMP_EXCEPTION;
- PMinidumpException = PMINIDUMP_EXCEPTION;
- //
- // The exception information stream contains the id of the thread that caused
- // the exception (ThreadId), the exception record for the exception
- // (ExceptionRecord) and an RVA to the thread context where the exception
- // occured.
- //
- PMINIDUMP_EXCEPTION_STREAM = ^MINIDUMP_EXCEPTION_STREAM;
- {$EXTERNALSYM PMINIDUMP_EXCEPTION_STREAM}
- _MINIDUMP_EXCEPTION_STREAM = record
- ThreadId: ULONG32;
- __alignment: ULONG32;
- ExceptionRecord: MINIDUMP_EXCEPTION;
- ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
- end;
- {$EXTERNALSYM _MINIDUMP_EXCEPTION_STREAM}
- MINIDUMP_EXCEPTION_STREAM = _MINIDUMP_EXCEPTION_STREAM;
- {$EXTERNALSYM MINIDUMP_EXCEPTION_STREAM}
- TMinidumpExceptionStream = MINIDUMP_EXCEPTION_STREAM;
- PMinidumpExceptionStream = PMINIDUMP_EXCEPTION_STREAM;
- //
- // The MINIDUMP_MODULE contains information about a
- // a specific module. It includes the CheckSum and
- // the TimeDateStamp for the module so the module
- // can be reloaded during the analysis phase.
- //
- PMINIDUMP_MODULE = ^MINIDUMP_MODULE;
- {$EXTERNALSYM PMINIDUMP_MODULE}
- _MINIDUMP_MODULE = record
- BaseOfImage: ULONG64;
- SizeOfImage: ULONG32;
- CheckSum: ULONG32;
- TimeDateStamp: ULONG32;
- ModuleNameRva: RVA;
- VersionInfo: VS_FIXEDFILEINFO;
- CvRecord: MINIDUMP_LOCATION_DESCRIPTOR;
- MiscRecord: MINIDUMP_LOCATION_DESCRIPTOR;
- Reserved0: ULONG64; // Reserved for future use.
- Reserved1: ULONG64; // Reserved for future use.
- end;
- {$EXTERNALSYM _MINIDUMP_MODULE}
- MINIDUMP_MODULE = _MINIDUMP_MODULE;
- {$EXTERNALSYM MINIDUMP_MODULE}
- TMinidumpModule = MINIDUMP_MODULE;
- PMinidumpModule = PMINIDUMP_MODULE;
- //
- // The minidump module list is a container for modules.
- //
- PMINIDUMP_MODULE_LIST = ^MINIDUMP_MODULE_LIST;
- {$EXTERNALSYM PMINIDUMP_MODULE_LIST}
- _MINIDUMP_MODULE_LIST = record
- NumberOfModules: ULONG32;
- Modules: array [0..0] of MINIDUMP_MODULE;
- end;
- {$EXTERNALSYM _MINIDUMP_MODULE_LIST}
- MINIDUMP_MODULE_LIST = _MINIDUMP_MODULE_LIST;
- {$EXTERNALSYM MINIDUMP_MODULE_LIST}
- TMinidumpModuleList = MINIDUMP_MODULE_LIST;
- PMinidumpModuleList = PMINIDUMP_MODULE_LIST;
- //
- // Memory Ranges
- //
- PMINIDUMP_MEMORY_LIST = ^MINIDUMP_MEMORY_LIST;
- {$EXTERNALSYM PMINIDUMP_MEMORY_LIST}
- _MINIDUMP_MEMORY_LIST = record
- NumberOfMemoryRanges: ULONG32;
- MemoryRanges: array [0..0] of MINIDUMP_MEMORY_DESCRIPTOR;
- end;
- {$EXTERNALSYM _MINIDUMP_MEMORY_LIST}
- MINIDUMP_MEMORY_LIST = _MINIDUMP_MEMORY_LIST;
- {$EXTERNALSYM MINIDUMP_MEMORY_LIST}
- TMinidumpMemoryList = MINIDUMP_MEMORY_LIST;
- PMinidumpMemoryList = PMINIDUMP_MEMORY_LIST;
- PMINIDUMP_MEMORY64_LIST = ^MINIDUMP_MEMORY64_LIST;
- {$EXTERNALSYM PMINIDUMP_MEMORY64_LIST}
- _MINIDUMP_MEMORY64_LIST = record
- NumberOfMemoryRanges: ULONG64;
- BaseRva: RVA64;
- MemoryRanges: array [0..0] of MINIDUMP_MEMORY_DESCRIPTOR64;
- end;
- {$EXTERNALSYM _MINIDUMP_MEMORY64_LIST}
- MINIDUMP_MEMORY64_LIST = _MINIDUMP_MEMORY64_LIST;
- {$EXTERNALSYM MINIDUMP_MEMORY64_LIST}
- TMinidumpMemory64List = MINIDUMP_MEMORY64_LIST;
- PMinidumpMemory64List = PMINIDUMP_MEMORY64_LIST;
- //
- // Support for user supplied exception information.
- //
- PMINIDUMP_EXCEPTION_INFORMATION = ^MINIDUMP_EXCEPTION_INFORMATION;
- {$EXTERNALSYM PMINIDUMP_EXCEPTION_INFORMATION}
- _MINIDUMP_EXCEPTION_INFORMATION = record
- ThreadId: DWORD;
- ExceptionPointers: PEXCEPTION_POINTERS;
- ClientPointers: BOOL;
- end;
- {$EXTERNALSYM _MINIDUMP_EXCEPTION_INFORMATION}
- MINIDUMP_EXCEPTION_INFORMATION = _MINIDUMP_EXCEPTION_INFORMATION;
- {$EXTERNALSYM MINIDUMP_EXCEPTION_INFORMATION}
- TMinidumpExceptionInformation = MINIDUMP_EXCEPTION_INFORMATION;
- PMinidumpExceptionInformation = PMINIDUMP_EXCEPTION_INFORMATION;
- //
- // Support for capturing system handle state at the time of the dump.
- //
- PMINIDUMP_HANDLE_DESCRIPTOR = ^MINIDUMP_HANDLE_DESCRIPTOR;
- {$EXTERNALSYM PMINIDUMP_HANDLE_DESCRIPTOR}
- _MINIDUMP_HANDLE_DESCRIPTOR = record
- Handle: ULONG64;
- TypeNameRva: RVA;
- ObjectNameRva: RVA;
- Attributes: ULONG32;
- GrantedAccess: ULONG32;
- HandleCount: ULONG32;
- PointerCount: ULONG32;
- end;
- {$EXTERNALSYM _MINIDUMP_HANDLE_DESCRIPTOR}
- MINIDUMP_HANDLE_DESCRIPTOR = _MINIDUMP_HANDLE_DESCRIPTOR;
- {$EXTERNALSYM MINIDUMP_HANDLE_DESCRIPTOR}
- TMinidumpHandleDescriptor = MINIDUMP_HANDLE_DESCRIPTOR;
- PMinidumpHandleDescriptor = PMINIDUMP_HANDLE_DESCRIPTOR;
- PMINIDUMP_HANDLE_DATA_STREAM = ^MINIDUMP_HANDLE_DATA_STREAM;
- {$EXTERNALSYM PMINIDUMP_HANDLE_DATA_STREAM}
- _MINIDUMP_HANDLE_DATA_STREAM = record
- SizeOfHeader: ULONG32;
- SizeOfDescriptor: ULONG32;
- NumberOfDescriptors: ULONG32;
- Reserved: ULONG32;
- end;
- {$EXTERNALSYM _MINIDUMP_HANDLE_DATA_STREAM}
- MINIDUMP_HANDLE_DATA_STREAM = _MINIDUMP_HANDLE_DATA_STREAM;
- {$EXTERNALSYM MINIDUMP_HANDLE_DATA_STREAM}
- TMinidumpHandleDataStream = MINIDUMP_HANDLE_DATA_STREAM;
- PMinidumpHandleDataStream = PMINIDUMP_HANDLE_DATA_STREAM;
- //
- // Support for capturing dynamic function table state at the time of the dump.
- //
- PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR = ^MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
- {$EXTERNALSYM PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
- _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR = record
- MinimumAddress: ULONG64;
- MaximumAddress: ULONG64;
- BaseAddress: ULONG64;
- EntryCount: ULONG32;
- SizeOfAlignPad: ULONG32;
- end;
- {$EXTERNALSYM _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
- MINIDUMP_FUNCTION_TABLE_DESCRIPTOR = _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
- {$EXTERNALSYM MINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
- TMinidumpFunctionTableDescriptor = MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
- PMinidumpFunctionTableDescriptor = PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
- PMINIDUMP_FUNCTION_TABLE_STREAM = ^MINIDUMP_FUNCTION_TABLE_STREAM;
- {$EXTERNALSYM PMINIDUMP_FUNCTION_TABLE_STREAM}
- _MINIDUMP_FUNCTION_TABLE_STREAM = record
- SizeOfHeader: ULONG32;
- SizeOfDescriptor: ULONG32;
- SizeOfNativeDescriptor: ULONG32;
- SizeOfFunctionEntry: ULONG32;
- NumberOfDescriptors: ULONG32;
- SizeOfAlignPad: ULONG32;
- end;
- {$EXTERNALSYM _MINIDUMP_FUNCTION_TABLE_STREAM}
- MINIDUMP_FUNCTION_TABLE_STREAM = _MINIDUMP_FUNCTION_TABLE_STREAM;
- {$EXTERNALSYM MINIDUMP_FUNCTION_TABLE_STREAM}
- TMinidumpFunctionTableStream = MINIDUMP_FUNCTION_TABLE_STREAM;
- PMinidumpFunctionTableStream = PMINIDUMP_FUNCTION_TABLE_STREAM;
- //
- // The MINIDUMP_UNLOADED_MODULE contains information about a
- // a specific module that was previously loaded but no
- // longer is. This can help with diagnosing problems where
- // callers attempt to call code that is no longer loaded.
- //
- _MINIDUMP_UNLOADED_MODULE = record
- BaseOfImage: ULONG64;
- SizeOfImage: ULONG32;
- CheckSum: ULONG32;
- TimeDateStamp: ULONG32;
- ModuleNameRva: RVA;
- end;
- {$EXTERNALSYM _MINIDUMP_UNLOADED_MODULE}
- MINIDUMP_UNLOADED_MODULE = _MINIDUMP_UNLOADED_MODULE;
- {$EXTERNALSYM MINIDUMP_UNLOADED_MODULE}
- PMINIDUMP_UNLOADED_MODULE = ^MINIDUMP_UNLOADED_MODULE;
- {$EXTERNALSYM PMINIDUMP_UNLOADED_MODULE}
- TMiniDumpUnloadedModule = MINIDUMP_UNLOADED_MODULE;
- PMiniDumpUnloadedModule = PMINIDUMP_UNLOADED_MODULE;
- //
- // The minidump unloaded module list is a container for unloaded modules.
- //
- _MINIDUMP_UNLOADED_MODULE_LIST = record
- SizeOfHeader: ULONG32;
- SizeOfEntry: ULONG32;
- NumberOfEntries: ULONG32;
- end;
- {$EXTERNALSYM _MINIDUMP_UNLOADED_MODULE_LIST}
- MINIDUMP_UNLOADED_MODULE_LIST = _MINIDUMP_UNLOADED_MODULE_LIST;
- {$EXTERNALSYM MINIDUMP_UNLOADED_MODULE_LIST}
- PMINIDUMP_UNLOADED_MODULE_LIST = ^MINIDUMP_UNLOADED_MODULE_LIST;
- {$EXTERNALSYM PMINIDUMP_UNLOADED_MODULE_LIST}
- TMiniDumpUnloadedModuleList = MINIDUMP_UNLOADED_MODULE_LIST;
- PMiniDumpUnloadedModuleList = PMINIDUMP_UNLOADED_MODULE_LIST;
- //
- // The miscellaneous information stream contains a variety
- // of small pieces of information. A member is valid if
- // it's within the available size and its corresponding
- // bit is set.
- //
- const
- MINIDUMP_MISC1_PROCESS_ID = $00000001;
- {$EXTERNALSYM MINIDUMP_MISC1_PROCESS_ID}
- MINIDUMP_MISC1_PROCESS_TIMES = $00000002;
- {$EXTERNALSYM MINIDUMP_MISC1_PROCESS_TIMES}
- type
- _MINIDUMP_MISC_INFO = record
- SizeOfInfo: ULONG32;
- Flags1: ULONG32;
- ProcessId: ULONG32;
- ProcessCreateTime: ULONG32;
- ProcessUserTime: ULONG32;
- ProcessKernelTime: ULONG32;
- end;
- {$EXTERNALSYM _MINIDUMP_MISC_INFO}
- MINIDUMP_MISC_INFO = _MINIDUMP_MISC_INFO;
- {$EXTERNALSYM MINIDUMP_MISC_INFO}
- PMINIDUMP_MISC_INFO = ^MINIDUMP_MISC_INFO;
- {$EXTERNALSYM PMINIDUMP_MISC_INFO}
- TMiniDumpMiscInfo = MINIDUMP_MISC_INFO;
- PMiniDumpMiscInfo = PMINIDUMP_MISC_INFO;
- //
- // Support for arbitrary user-defined information.
- //
- PMINIDUMP_USER_RECORD = ^MINIDUMP_USER_RECORD;
- {$EXTERNALSYM PMINIDUMP_USER_RECORD}
- _MINIDUMP_USER_RECORD = record
- Type_: ULONG32;
- Memory: MINIDUMP_LOCATION_DESCRIPTOR;
- end;
- {$EXTERNALSYM _MINIDUMP_USER_RECORD}
- MINIDUMP_USER_RECORD = _MINIDUMP_USER_RECORD;
- {$EXTERNALSYM MINIDUMP_USER_RECORD}
- TMinidumpUserRecord = MINIDUMP_USER_RECORD;
- PMinidumpUserRecord = PMINIDUMP_USER_RECORD;
- PMINIDUMP_USER_STREAM = ^MINIDUMP_USER_STREAM;
- {$EXTERNALSYM PMINIDUMP_USER_STREAM}
- _MINIDUMP_USER_STREAM = record
- Type_: ULONG32;
- BufferSize: ULONG;
- Buffer: PVOID;
- end;
- {$EXTERNALSYM _MINIDUMP_USER_STREAM}
- MINIDUMP_USER_STREAM = _MINIDUMP_USER_STREAM;
- {$EXTERNALSYM MINIDUMP_USER_STREAM}
- TMinidumpUserStream = MINIDUMP_USER_STREAM;
- PMinidumpUserStream = PMINIDUMP_USER_STREAM;
- PMINIDUMP_USER_STREAM_INFORMATION = ^MINIDUMP_USER_STREAM_INFORMATION;
- {$EXTERNALSYM PMINIDUMP_USER_STREAM_INFORMATION}
- _MINIDUMP_USER_STREAM_INFORMATION = record
- UserStreamCount: ULONG;
- UserStreamArray: PMINIDUMP_USER_STREAM;
- end;
- {$EXTERNALSYM _MINIDUMP_USER_STREAM_INFORMATION}
- MINIDUMP_USER_STREAM_INFORMATION = _MINIDUMP_USER_STREAM_INFORMATION;
- {$EXTERNALSYM MINIDUMP_USER_STREAM_INFORMATION}
- TMinidumpUserStreamInformation = MINIDUMP_USER_STREAM_INFORMATION;
- PMinidumpUserStreamInformation = PMINIDUMP_USER_STREAM_INFORMATION;
- //
- // Callback support.
- //
- _MINIDUMP_CALLBACK_TYPE = (
- ModuleCallback,
- ThreadCallback,
- ThreadExCallback,
- IncludeThreadCallback,
- IncludeModuleCallback);
- {$EXTERNALSYM _MINIDUMP_CALLBACK_TYPE}
- MINIDUMP_CALLBACK_TYPE = _MINIDUMP_CALLBACK_TYPE;
- {$EXTERNALSYM MINIDUMP_CALLBACK_TYPE}
- TMinidumpCallbackType = MINIDUMP_CALLBACK_TYPE;
- PMINIDUMP_THREAD_CALLBACK = ^MINIDUMP_THREAD_CALLBACK;
- {$EXTERNALSYM PMINIDUMP_THREAD_CALLBACK}
- _MINIDUMP_THREAD_CALLBACK = record
- ThreadId: ULONG;
- ThreadHandle: HANDLE;
- Context: CONTEXT;
- SizeOfContext: ULONG;
- StackBase: ULONG64;
- StackEnd: ULONG64;
- end;
- {$EXTERNALSYM _MINIDUMP_THREAD_CALLBACK}
- MINIDUMP_THREAD_CALLBACK = _MINIDUMP_THREAD_CALLBACK;
- {$EXTERNALSYM MINIDUMP_THREAD_CALLBACK}
- TMinidumpThreadCallback = MINIDUMP_THREAD_CALLBACK;
- PMinidumpThreadCallback = PMINIDUMP_THREAD_CALLBACK;
- PMINIDUMP_THREAD_EX_CALLBACK = ^MINIDUMP_THREAD_EX_CALLBACK;
- {$EXTERNALSYM PMINIDUMP_THREAD_EX_CALLBACK}
- _MINIDUMP_THREAD_EX_CALLBACK = record
- ThreadId: ULONG;
- ThreadHandle: HANDLE;
- Context: CONTEXT;
- SizeOfContext: ULONG;
- StackBase: ULONG64;
- StackEnd: ULONG64;
- BackingStoreBase: ULONG64;
- BackingStoreEnd: ULONG64;
- end;
- {$EXTERNALSYM _MINIDUMP_THREAD_EX_CALLBACK}
- MINIDUMP_THREAD_EX_CALLBACK = _MINIDUMP_THREAD_EX_CALLBACK;
- {$EXTERNALSYM MINIDUMP_THREAD_EX_CALLBACK}
- TMinidumpThreadExCallback = MINIDUMP_THREAD_EX_CALLBACK;
- PMinidumpThreadExCallback = PMINIDUMP_THREAD_EX_CALLBACK;
- PMINIDUMP_INCLUDE_THREAD_CALLBACK = ^MINIDUMP_INCLUDE_THREAD_CALLBACK;
- {$EXTERNALSYM PMINIDUMP_INCLUDE_THREAD_CALLBACK}
- _MINIDUMP_INCLUDE_THREAD_CALLBACK = record
- ThreadId: ULONG;
- end;
- {$EXTERNALSYM _MINIDUMP_INCLUDE_THREAD_CALLBACK}
- MINIDUMP_INCLUDE_THREAD_CALLBACK = _MINIDUMP_INCLUDE_THREAD_CALLBACK;
- {$EXTERNALSYM MINIDUMP_INCLUDE_THREAD_CALLBACK}
- TMinidumpIncludeThreadCallback = MINIDUMP_INCLUDE_THREAD_CALLBACK;
- PMinidumpIncludeThreadCallback = PMINIDUMP_INCLUDE_THREAD_CALLBACK;
- const
- ThreadWriteThread = $0001;
- {$EXTERNALSYM ThreadWriteThread}
- ThreadWriteStack = $0002;
- {$EXTERNALSYM ThreadWriteStack}
- ThreadWriteContext = $0004;
- {$EXTERNALSYM ThreadWriteContext}
- ThreadWriteBackingStore = $0008;
- {$EXTERNALSYM ThreadWriteBackingStore}
- ThreadWriteInstructionWindow = $0010;
- {$EXTERNALSYM ThreadWriteInstructionWindow}
- ThreadWriteThreadData = $0020;
- {$EXTERNALSYM ThreadWriteThreadData}
- type
- _THREAD_WRITE_FLAGS = DWORD;
- {$EXTERNALSYM _THREAD_WRITE_FLAGS}
- THREAD_WRITE_FLAGS = _THREAD_WRITE_FLAGS;
- {$EXTERNALSYM THREAD_WRITE_FLAGS}
- TThreadWriteFlags = THREAD_WRITE_FLAGS;
- type
- PMINIDUMP_MODULE_CALLBACK = ^MINIDUMP_MODULE_CALLBACK;
- {$EXTERNALSYM PMINIDUMP_MODULE_CALLBACK}
- _MINIDUMP_MODULE_CALLBACK = record
- FullPath: PWCHAR;
- BaseOfImage: ULONG64;
- SizeOfImage: ULONG;
- CheckSum: ULONG;
- TimeDateStamp: ULONG;
- VersionInfo: VS_FIXEDFILEINFO;
- CvRecord: PVOID;
- SizeOfCvRecord: ULONG;
- MiscRecord: PVOID;
- SizeOfMiscRecord: ULONG;
- end;
- {$EXTERNALSYM _MINIDUMP_MODULE_CALLBACK}
- MINIDUMP_MODULE_CALLBACK = _MINIDUMP_MODULE_CALLBACK;
- {$EXTERNALSYM MINIDUMP_MODULE_CALLBACK}
- TMinidumpModuleCallback = MINIDUMP_MODULE_CALLBACK;
- PMinidumpModuleCallback = PMINIDUMP_MODULE_CALLBACK;
- PMINIDUMP_INCLUDE_MODULE_CALLBACK = ^MINIDUMP_INCLUDE_MODULE_CALLBACK;
- {$EXTERNALSYM PMINIDUMP_INCLUDE_MODULE_CALLBACK}
- _MINIDUMP_INCLUDE_MODULE_CALLBACK = record
- BaseOfImage: ULONG64;
- end;
- {$EXTERNALSYM _MINIDUMP_INCLUDE_MODULE_CALLBACK}
- MINIDUMP_INCLUDE_MODULE_CALLBACK = _MINIDUMP_INCLUDE_MODULE_CALLBACK;
- {$EXTERNALSYM MINIDUMP_INCLUDE_MODULE_CALLBACK}
- TMinidumpIncludeModuleCallback = MINIDUMP_INCLUDE_MODULE_CALLBACK;
- PMinidumpIncludeModuleCallback = PMINIDUMP_INCLUDE_MODULE_CALLBACK;
- const
- ModuleWriteModule = $0001;
- {$EXTERNALSYM ModuleWriteModule}
- ModuleWriteDataSeg = $0002;
- {$EXTERNALSYM ModuleWriteDataSeg}
- ModuleWriteMiscRecord = $0004;
- {$EXTERNALSYM ModuleWriteMiscRecord}
- ModuleWriteCvRecord = $0008;
- {$EXTERNALSYM ModuleWriteCvRecord}
- ModuleReferencedByMemory = $0010;
- {$EXTERNALSYM ModuleReferencedByMemory}
- type
- _MODULE_WRITE_FLAGS = DWORD;
- {$EXTERNALSYM _MODULE_WRITE_FLAGS}
- MODULE_WRITE_FLAGS = _MODULE_WRITE_FLAGS;
- {$EXTERNALSYM MODULE_WRITE_FLAGS}
- TModuleWriteFlags = MODULE_WRITE_FLAGS;
- _MINIDUMP_CALLBACK_INPUT = record
- ProcessId: ULONG;
- ProcessHandle: HANDLE;
- CallbackType: ULONG;
- case Integer of
- 0: (Thread: MINIDUMP_THREAD_CALLBACK);
- 1: (ThreadEx: MINIDUMP_THREAD_EX_CALLBACK);
- 2: (Module: MINIDUMP_MODULE_CALLBACK);
- 3: (IncludeThread: MINIDUMP_INCLUDE_THREAD_CALLBACK);
- 4: (IncludeModule: MINIDUMP_INCLUDE_MODULE_CALLBACK);
- end;
- {$EXTERNALSYM _MINIDUMP_CALLBACK_INPUT}
- MINIDUMP_CALLBACK_INPUT = _MINIDUMP_CALLBACK_INPUT;
- {$EXTERNALSYM MINIDUMP_CALLBACK_INPUT}
- PMINIDUMP_CALLBACK_INPUT = ^MINIDUMP_CALLBACK_INPUT;
- {$EXTERNALSYM PMINIDUMP_CALLBACK_INPUT}
- TminidumpCallbackInput = MINIDUMP_CALLBACK_INPUT;
- PMINIDUMP_CALLBACK_OUTPUT = ^MINIDUMP_CALLBACK_OUTPUT;
- {$EXTERNALSYM PMINIDUMP_CALLBACK_OUTPUT}
- _MINIDUMP_CALLBACK_OUTPUT = record
- case Integer of
- 0: (ModuleWriteFlags: ULONG);
- 1: (ThreadWriteFlags: ULONG);
- end;
- {$EXTERNALSYM _MINIDUMP_CALLBACK_OUTPUT}
- MINIDUMP_CALLBACK_OUTPUT = _MINIDUMP_CALLBACK_OUTPUT;
- {$EXTERNALSYM MINIDUMP_CALLBACK_OUTPUT}
- TMinidumpCallbackOutput = MINIDUMP_CALLBACK_OUTPUT;
- PMinidumpCallbackOutput = PMINIDUMP_CALLBACK_OUTPUT;
- //
- // A normal minidump contains just the information
- // necessary to capture stack traces for all of the
- // existing threads in a process.
- //
- // A minidump with data segments includes all of the data
- // sections from loaded modules in order to capture
- // global variable contents. This can make the dump much
- // larger if many modules have global data.
- //
- // A minidump with full memory includes all of the accessible
- // memory in the process and can be very large. A minidump
- // with full memory always has the raw memory data at the end
- // of the dump so that the initial structures in the dump can
- // be mapped directly without having to include the raw
- // memory information.
- //
- // Stack and backing store memory can be filtered to remove
- // data unnecessary for stack walking. This can improve
- // compression of stacks and also deletes data that may
- // be private and should not be stored in a dump.
- // Memory can also be scanned to see what modules are
- // referenced by stack and backing store memory to allow
- // omission of other modules to reduce dump size.
- // In either of these modes the ModuleReferencedByMemory flag
- // is set for all modules referenced before the base
- // module callbacks occur.
- //
- // On some operating systems a list of modules that were
- // recently unloaded is kept in addition to the currently
- // loaded module list. This information can be saved in
- // the dump if desired.
- //
- // Stack and backing store memory can be scanned for referenced
- // pages in order to pick up data referenced by locals or other
- // stack memory. This can increase the size of a dump significantly.
- //
- // Module paths may contain undesired information such as user names
- // or other important directory names so they can be stripped. This
- // option reduces the ability to locate the proper image later
- // and should only be used in certain situations.
- //
- // Complete operating system per-process and per-thread information can
- // be gathered and stored in the dump.
- //
- // The virtual address space can be scanned for various types
- // of memory to be included in the dump.
- //
- const
- MiniDumpNormal = $0000;
- {$EXTERNALSYM MiniDumpNormal}
- MiniDumpWithDataSegs = $0001;
- {$EXTERNALSYM MiniDumpWithDataSegs}
- MiniDumpWithFullMemory = $0002;
- {$EXTERNALSYM MiniDumpWithFullMemory}
- MiniDumpWithHandleData = $0004;
- {$EXTERNALSYM MiniDumpWithHandleData}
- MiniDumpFilterMemory = $0008;
- {$EXTERNALSYM MiniDumpFilterMemory}
- MiniDumpScanMemory = $0010;
- {$EXTERNALSYM MiniDumpScanMemory}
- MiniDumpWithUnloadedModules = $0020;
- {$EXTERNALSYM MiniDumpWithUnloadedModules}
- MiniDumpWithIndirectlyReferencedMemory = $0040;
- {$EXTERNALSYM MiniDumpWithIndirectlyReferencedMemory}
- MiniDumpFilterModulePaths = $0080;
- {$EXTERNALSYM MiniDumpFilterModulePaths}
- MiniDumpWithProcessThreadData = $0100;
- {$EXTERNALSYM MiniDumpWithProcessThreadData}
- MiniDumpWithPrivateReadWriteMemory = $0200;
- {$EXTERNALSYM MiniDumpWithPrivateReadWriteMemory}
- type
- _MINIDUMP_TYPE = DWORD;
- {$EXTERNALSYM _MINIDUMP_TYPE}
- MINIDUMP_TYPE = _MINIDUMP_TYPE;
- {$EXTERNALSYM MINIDUMP_TYPE}
- TMinidumpType = MINIDUMP_TYPE;
- //
- // The minidump callback should modify the FieldsToWrite parameter to reflect
- // what portions of the specified thread or module should be written to the
- // file.
- //
- MINIDUMP_CALLBACK_ROUTINE = function(CallbackParam: PVOID; CallbackInput: PMINIDUMP_CALLBACK_INPUT;
- CallbackOutput: PMINIDUMP_CALLBACK_OUTPUT): BOOL; stdcall;
- {$EXTERNALSYM MINIDUMP_CALLBACK_ROUTINE}
- TMinidumpCallbackRoutine = MINIDUMP_CALLBACK_ROUTINE;
- PMINIDUMP_CALLBACK_INFORMATION = ^MINIDUMP_CALLBACK_INFORMATION;
- {$EXTERNALSYM PMINIDUMP_CALLBACK_INFORMATION}
- _MINIDUMP_CALLBACK_INFORMATION = record
- CallbackRoutine: MINIDUMP_CALLBACK_ROUTINE;
- CallbackParam: PVOID;
- end;
- {$EXTERNALSYM _MINIDUMP_CALLBACK_INFORMATION}
- MINIDUMP_CALLBACK_INFORMATION = _MINIDUMP_CALLBACK_INFORMATION;
- {$EXTERNALSYM MINIDUMP_CALLBACK_INFORMATION}
- TMinidumpCallbackInformation = MINIDUMP_CALLBACK_INFORMATION;
- PMinidumpCallbackInformation = PMINIDUMP_CALLBACK_INFORMATION;
- //++
- //
- // PVOID
- // RVA_TO_ADDR(
- // PVOID Mapping,
- // ULONG Rva
- // )
- //
- // Routine Description:
- //
- // Map an RVA that is contained within a mapped file to it's associated
- // flat address.
- //
- // Arguments:
- //
- // Mapping - Base address of mapped file containing the RVA.
- //
- // Rva - An Rva to fixup.
- //
- // Return Values:
- //
- // A pointer to the desired data.
- //
- //--
- function RVA_TO_ADDR(Mapping, Rva: Pointer): Pointer;
- {$EXTERNALSYM RVA_TO_ADDR}
- function MiniDumpWriteDump(hProcess: HANDLE; ProcessId: DWORD; hFile: HANDLE; DumpType: MINIDUMP_TYPE; ExceptionParam: PMINIDUMP_EXCEPTION_INFORMATION; UserStreamParam: PMINIDUMP_USER_STREAM_INFORMATION; CallbackParam: PMINIDUMP_CALLBACK_INFORMATION): BOOL; stdcall;
- {$EXTERNALSYM MiniDumpWriteDump}
- function MiniDumpReadDumpStream(BaseOfDump: PVOID; StreamNumber: ULONG; var Dir: PMINIDUMP_DIRECTORY; var StreamPointer: PVOID; var StreamSize: ULONG): BOOL; stdcall;
- {$EXTERNALSYM MiniDumpReadDumpStream}
- implementation
- const
- ImageHlpLib = 'imagehlp.dll';
- {$IFDEF UNICODE}
- AWSuffix = 'W';
- {$ELSE}
- AWSuffix = 'A';
- {$ENDIF UNICODE}
- procedure Address32To64(a32: LPADDRESS; a64: LPADDRESS64);
- begin
- a64^.Offset := {ULONG64(LONG64(LONG(}a32^.Offset{)))};
- a64^.Segment := a32^.Segment;
- a64^.Mode := a32^.Mode;
- end;
- procedure Address64To32(a64: LPADDRESS64; a32: LPADDRESS);
- begin
- a32^.Offset := ULONG(a64^.Offset);
- a32^.Segment := a64^.Segment;
- a32^.Mode := a64^.Mode;
- end;
- procedure KdHelp32To64(p32: PKDHELP; p64: PKDHELP64);
- begin
- p64^.Thread := p32^.Thread;
- p64^.ThCallbackStack := p32^.ThCallbackStack;
- p64^.NextCallback := p32^.NextCallback;
- p64^.FramePointer := p32^.FramePointer;
- p64^.KiCallUserMode := p32^.KiCallUserMode;
- p64^.KeUserCallbackDispatcher := p32^.KeUserCallbackDispatcher;
- p64^.SystemRangeStart := p32^.SystemRangeStart;
- end;
- function RVA_TO_ADDR(Mapping, Rva: Pointer): Pointer;
- begin
- Result := Pointer(Cardinal(Mapping) + Cardinal(Rva));
- end;
- {$IFDEF DYNAMIC_LINK}
- var
- _BindImage: Pointer;
- function BindImage;
- begin
- GetProcedureAddress(_BindImage, ImageHlpLib, 'BindImage');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_BindImage]
- end;
- end;
- var
- _BindImageEx: Pointer;
- function BindImageEx;
- begin
- GetProcedureAddress(_BindImageEx, ImageHlpLib, 'BindImageEx');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_BindImageEx]
- end;
- end;
- var
- _ReBaseImage: Pointer;
- function ReBaseImage;
- begin
- GetProcedureAddress(_ReBaseImage, ImageHlpLib, 'ReBaseImage');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ReBaseImage]
- end;
- end;
- var
- _ReBaseImage64: Pointer;
- function ReBaseImage64;
- begin
- GetProcedureAddress(_ReBaseImage64, ImageHlpLib, 'ReBaseImage64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ReBaseImage64]
- end;
- end;
- var
- _CheckSumMappedFile: Pointer;
- function CheckSumMappedFile;
- begin
- GetProcedureAddress(_CheckSumMappedFile, ImageHlpLib, 'CheckSumMappedFile');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_CheckSumMappedFile]
- end;
- end;
- var
- _MapFileAndCheckSumA: Pointer;
- function MapFileAndCheckSumA;
- begin
- GetProcedureAddress(_MapFileAndCheckSumA, ImageHlpLib, 'MapFileAndCheckSumA');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_MapFileAndCheckSumA]
- end;
- end;
- var
- _MapFileAndCheckSumW: Pointer;
- function MapFileAndCheckSumW;
- begin
- GetProcedureAddress(_MapFileAndCheckSumW, ImageHlpLib, 'MapFileAndCheckSumW');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_MapFileAndCheckSumW]
- end;
- end;
- var
- _MapFileAndCheckSum: Pointer;
- function MapFileAndCheckSum;
- begin
- GetProcedureAddress(_MapFileAndCheckSum, ImageHlpLib, 'MapFileAndCheckSum' + AWSuffix);
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_MapFileAndCheckSum]
- end;
- end;
- var
- _GetImageConfigInformation: Pointer;
- function GetImageConfigInformation;
- begin
- GetProcedureAddress(_GetImageConfigInformation, ImageHlpLib, 'GetImageConfigInformation');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_GetImageConfigInformation]
- end;
- end;
- var
- _GetImageUnusedHeaderBytes: Pointer;
- function GetImageUnusedHeaderBytes;
- begin
- GetProcedureAddress(_GetImageUnusedHeaderBytes, ImageHlpLib, 'GetImageUnusedHeaderBytes');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_GetImageUnusedHeaderBytes]
- end;
- end;
- var
- _SetImageConfigInformation: Pointer;
- function SetImageConfigInformation;
- begin
- GetProcedureAddress(_SetImageConfigInformation, ImageHlpLib, 'SetImageConfigInformation');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SetImageConfigInformation]
- end;
- end;
- var
- _ImageGetDigestStream: Pointer;
- function ImageGetDigestStream;
- begin
- GetProcedureAddress(_ImageGetDigestStream, ImageHlpLib, 'ImageGetDigestStream');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImageGetDigestStream]
- end;
- end;
- var
- _ImageAddCertificate: Pointer;
- function ImageAddCertificate;
- begin
- GetProcedureAddress(_ImageAddCertificate, ImageHlpLib, 'ImageAddCertificate');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImageAddCertificate]
- end;
- end;
- var
- _ImageRemoveCertificate: Pointer;
- function ImageRemoveCertificate;
- begin
- GetProcedureAddress(_ImageRemoveCertificate, ImageHlpLib, 'ImageRemoveCertificate');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImageRemoveCertificate]
- end;
- end;
- var
- _ImageEnumerateCertificates: Pointer;
- function ImageEnumerateCertificates;
- begin
- GetProcedureAddress(_ImageEnumerateCertificates, ImageHlpLib, 'ImageEnumerateCertificates');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImageEnumerateCertificates]
- end;
- end;
- var
- _ImageGetCertificateData: Pointer;
- function ImageGetCertificateData;
- begin
- GetProcedureAddress(_ImageGetCertificateData, ImageHlpLib, 'ImageGetCertificateData');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImageGetCertificateData]
- end;
- end;
- var
- _ImageGetCertificateHeader: Pointer;
- function ImageGetCertificateHeader;
- begin
- GetProcedureAddress(_ImageGetCertificateHeader, ImageHlpLib, 'ImageGetCertificateHeader');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImageGetCertificateHeader]
- end;
- end;
- var
- _ImageLoad: Pointer;
- function ImageLoad;
- begin
- GetProcedureAddress(_ImageLoad, ImageHlpLib, 'ImageLoad');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImageLoad]
- end;
- end;
- var
- _ImageUnload: Pointer;
- function ImageUnload;
- begin
- GetProcedureAddress(_ImageUnload, ImageHlpLib, 'ImageUnload');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImageUnload]
- end;
- end;
- var
- _MapAndLoad: Pointer;
- function MapAndLoad;
- begin
- GetProcedureAddress(_MapAndLoad, ImageHlpLib, 'MapAndLoad');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_MapAndLoad]
- end;
- end;
- var
- _UnMapAndLoad: Pointer;
- function UnMapAndLoad;
- begin
- GetProcedureAddress(_UnMapAndLoad, ImageHlpLib, 'UnMapAndLoad');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_UnMapAndLoad]
- end;
- end;
- var
- _TouchFileTimes: Pointer;
- function TouchFileTimes;
- begin
- GetProcedureAddress(_TouchFileTimes, ImageHlpLib, 'TouchFileTimes');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_TouchFileTimes]
- end;
- end;
- var
- _SplitSymbols: Pointer;
- function SplitSymbols;
- begin
- GetProcedureAddress(_SplitSymbols, ImageHlpLib, 'SplitSymbols');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SplitSymbols]
- end;
- end;
- var
- _UpdateDebugInfoFile: Pointer;
- function UpdateDebugInfoFile;
- begin
- GetProcedureAddress(_UpdateDebugInfoFile, ImageHlpLib, 'UpdateDebugInfoFile');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_UpdateDebugInfoFile]
- end;
- end;
- var
- _UpdateDebugInfoFileEx: Pointer;
- function UpdateDebugInfoFileEx;
- begin
- GetProcedureAddress(_UpdateDebugInfoFileEx, ImageHlpLib, 'UpdateDebugInfoFileEx');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_UpdateDebugInfoFileEx]
- end;
- end;
- var
- _FindDebugInfoFile: Pointer;
- function FindDebugInfoFile;
- begin
- GetProcedureAddress(_FindDebugInfoFile, ImageHlpLib, 'FindDebugInfoFile');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_FindDebugInfoFile]
- end;
- end;
- var
- _FindDebugInfoFileEx: Pointer;
- function FindDebugInfoFileEx;
- begin
- GetProcedureAddress(_FindDebugInfoFileEx, ImageHlpLib, 'FindDebugInfoFileEx');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_FindDebugInfoFileEx]
- end;
- end;
- var
- _SymFindFileInPath: Pointer;
- function SymFindFileInPath;
- begin
- GetProcedureAddress(_SymFindFileInPath, ImageHlpLib, 'SymFindFileInPath');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymFindFileInPath]
- end;
- end;
- var
- _FindExecutableImage: Pointer;
- function FindExecutableImage;
- begin
- GetProcedureAddress(_FindExecutableImage, ImageHlpLib, 'FindExecutableImage');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_FindExecutableImage]
- end;
- end;
- var
- _FindExecutableImageEx: Pointer;
- function FindExecutableImageEx;
- begin
- GetProcedureAddress(_FindExecutableImageEx, ImageHlpLib, 'FindExecutableImageEx');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_FindExecutableImageEx]
- end;
- end;
- var
- _ImageNtHeader: Pointer;
- function ImageNtHeader;
- begin
- GetProcedureAddress(_ImageNtHeader, ImageHlpLib, 'ImageNtHeader');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImageNtHeader]
- end;
- end;
- var
- _ImageDirectoryEntryToDataEx: Pointer;
- function ImageDirectoryEntryToDataEx;
- begin
- GetProcedureAddress(_ImageDirectoryEntryToDataEx, ImageHlpLib, 'ImageDirectoryEntryToDataEx');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImageDirectoryEntryToDataEx]
- end;
- end;
- var
- _ImageDirectoryEntryToData: Pointer;
- function ImageDirectoryEntryToData;
- begin
- GetProcedureAddress(_ImageDirectoryEntryToData, ImageHlpLib, 'ImageDirectoryEntryToData');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImageDirectoryEntryToData]
- end;
- end;
- var
- _ImageRvaToSection: Pointer;
- function ImageRvaToSection;
- begin
- GetProcedureAddress(_ImageRvaToSection, ImageHlpLib, 'ImageRvaToSection');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImageRvaToSection]
- end;
- end;
- var
- _ImageRvaToVa: Pointer;
- function ImageRvaToVa;
- begin
- GetProcedureAddress(_ImageRvaToVa, ImageHlpLib, 'ImageRvaToVa');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImageRvaToVa]
- end;
- end;
- var
- _MapDebugInformation: Pointer;
- function MapDebugInformation;
- begin
- GetProcedureAddress(_MapDebugInformation, ImageHlpLib, 'MapDebugInformation');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_MapDebugInformation]
- end;
- end;
- var
- _UnmapDebugInformation: Pointer;
- function UnmapDebugInformation;
- begin
- GetProcedureAddress(_UnmapDebugInformation, ImageHlpLib, 'UnmapDebugInformation');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_UnmapDebugInformation]
- end;
- end;
- var
- _SearchTreeForFile: Pointer;
- function SearchTreeForFile;
- begin
- GetProcedureAddress(_SearchTreeForFile, ImageHlpLib, 'SearchTreeForFile');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SearchTreeForFile]
- end;
- end;
- var
- _EnumDirTree: Pointer;
- function EnumDirTree;
- begin
- GetProcedureAddress(_EnumDirTree, ImageHlpLib, 'EnumDirTree');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_EnumDirTree]
- end;
- end;
- var
- _MakeSureDirectoryPathExists: Pointer;
- function MakeSureDirectoryPathExists;
- begin
- GetProcedureAddress(_MakeSureDirectoryPathExists, ImageHlpLib, 'MakeSureDirectoryPathExists');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_MakeSureDirectoryPathExists]
- end;
- end;
- var
- _UnDecorateSymbolName: Pointer;
- function UnDecorateSymbolName;
- begin
- GetProcedureAddress(_UnDecorateSymbolName, ImageHlpLib, 'UnDecorateSymbolName');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_UnDecorateSymbolName]
- end;
- end;
- var
- _StackWalk64: Pointer;
- function StackWalk64;
- begin
- GetProcedureAddress(_StackWalk64, ImageHlpLib, 'StackWalk64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_StackWalk64]
- end;
- end;
- var
- _StackWalk: Pointer;
- function StackWalk;
- begin
- GetProcedureAddress(_StackWalk, ImageHlpLib, 'StackWalk');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_StackWalk]
- end;
- end;
- var
- _ImagehlpApiVersion: Pointer;
- function ImagehlpApiVersion;
- begin
- GetProcedureAddress(_ImagehlpApiVersion, ImageHlpLib, 'ImagehlpApiVersion');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImagehlpApiVersion]
- end;
- end;
- var
- _ImagehlpApiVersionEx: Pointer;
- function ImagehlpApiVersionEx;
- begin
- GetProcedureAddress(_ImagehlpApiVersionEx, ImageHlpLib, 'ImagehlpApiVersionEx');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_ImagehlpApiVersionEx]
- end;
- end;
- var
- _GetTimestampForLoadedLibrary: Pointer;
- function GetTimestampForLoadedLibrary;
- begin
- GetProcedureAddress(_GetTimestampForLoadedLibrary, ImageHlpLib, 'GetTimestampForLoadedLibrary');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_GetTimestampForLoadedLibrary]
- end;
- end;
- var
- _SymSetOptions: Pointer;
- function SymSetOptions;
- begin
- GetProcedureAddress(_SymSetOptions, ImageHlpLib, 'SymSetOptions');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymSetOptions]
- end;
- end;
- var
- _SymGetOptions: Pointer;
- function SymGetOptions;
- begin
- GetProcedureAddress(_SymGetOptions, ImageHlpLib, 'SymGetOptions');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetOptions]
- end;
- end;
- var
- _SymCleanup: Pointer;
- function SymCleanup;
- begin
- GetProcedureAddress(_SymCleanup, ImageHlpLib, 'SymCleanup');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymCleanup]
- end;
- end;
- var
- _SymMatchString: Pointer;
- function SymMatchString;
- begin
- GetProcedureAddress(_SymMatchString, ImageHlpLib, 'SymMatchString');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymMatchString]
- end;
- end;
- var
- _SymEnumSourceFiles: Pointer;
- function SymEnumSourceFiles;
- begin
- GetProcedureAddress(_SymEnumSourceFiles, ImageHlpLib, 'SymEnumSourceFiles');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymEnumSourceFiles]
- end;
- end;
- var
- _SymEnumerateModules64: Pointer;
- function SymEnumerateModules64;
- begin
- GetProcedureAddress(_SymEnumerateModules64, ImageHlpLib, 'SymEnumerateModules64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymEnumerateModules64]
- end;
- end;
- var
- _SymEnumerateModules: Pointer;
- function SymEnumerateModules;
- begin
- GetProcedureAddress(_SymEnumerateModules, ImageHlpLib, 'SymEnumerateModules');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymEnumerateModules]
- end;
- end;
- var
- _SymEnumerateSymbols64: Pointer;
- function SymEnumerateSymbols64;
- begin
- GetProcedureAddress(_SymEnumerateSymbols64, ImageHlpLib, 'SymEnumerateSymbols64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymEnumerateSymbols64]
- end;
- end;
- var
- _SymEnumerateSymbolsW64: Pointer;
- function SymEnumerateSymbolsW64;
- begin
- GetProcedureAddress(_SymEnumerateSymbolsW64, ImageHlpLib, 'SymEnumerateSymbolsW64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymEnumerateSymbolsW64]
- end;
- end;
- var
- _SymEnumerateSymbols: Pointer;
- function SymEnumerateSymbols;
- begin
- GetProcedureAddress(_SymEnumerateSymbols, ImageHlpLib, 'SymEnumerateSymbols');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymEnumerateSymbols]
- end;
- end;
- var
- _SymEnumerateSymbolsW: Pointer;
- function SymEnumerateSymbolsW;
- begin
- GetProcedureAddress(_SymEnumerateSymbolsW, ImageHlpLib, 'SymEnumerateSymbolsW');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymEnumerateSymbolsW]
- end;
- end;
- var
- _EnumerateLoadedModules64: Pointer;
- function EnumerateLoadedModules64;
- begin
- GetProcedureAddress(_EnumerateLoadedModules64, ImageHlpLib, 'EnumerateLoadedModules64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_EnumerateLoadedModules64]
- end;
- end;
- var
- _EnumerateLoadedModules: Pointer;
- function EnumerateLoadedModules;
- begin
- GetProcedureAddress(_EnumerateLoadedModules, ImageHlpLib, 'EnumerateLoadedModules');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_EnumerateLoadedModules]
- end;
- end;
- var
- _SymFunctionTableAccess64: Pointer;
- function SymFunctionTableAccess64;
- begin
- GetProcedureAddress(_SymFunctionTableAccess64, ImageHlpLib, 'SymFunctionTableAccess64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymFunctionTableAccess64]
- end;
- end;
- var
- _SymFunctionTableAccess: Pointer;
- function SymFunctionTableAccess;
- begin
- GetProcedureAddress(_SymFunctionTableAccess, ImageHlpLib, 'SymFunctionTableAccess');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymFunctionTableAccess]
- end;
- end;
- var
- _SymGetModuleInfo64: Pointer;
- function SymGetModuleInfo64;
- begin
- GetProcedureAddress(_SymGetModuleInfo64, ImageHlpLib, 'SymGetModuleInfo64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetModuleInfo64]
- end;
- end;
- var
- _SymGetModuleInfoW64: Pointer;
- function SymGetModuleInfoW64;
- begin
- GetProcedureAddress(_SymGetModuleInfoW64, ImageHlpLib, 'SymGetModuleInfoW64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetModuleInfoW64]
- end;
- end;
- var
- _SymGetModuleInfo: Pointer;
- function SymGetModuleInfo;
- begin
- GetProcedureAddress(_SymGetModuleInfo, ImageHlpLib, 'SymGetModuleInfo');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetModuleInfo]
- end;
- end;
- var
- _SymGetModuleInfoW: Pointer;
- function SymGetModuleInfoW;
- begin
- GetProcedureAddress(_SymGetModuleInfoW, ImageHlpLib, 'SymGetModuleInfoW');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetModuleInfoW]
- end;
- end;
- var
- _SymGetModuleBase64: Pointer;
- function SymGetModuleBase64;
- begin
- GetProcedureAddress(_SymGetModuleBase64, ImageHlpLib, 'SymGetModuleBase64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetModuleBase64]
- end;
- end;
- var
- _SymGetModuleBase: Pointer;
- function SymGetModuleBase;
- begin
- GetProcedureAddress(_SymGetModuleBase, ImageHlpLib, 'SymGetModuleBase');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetModuleBase]
- end;
- end;
- var
- _SymGetSymNext64: Pointer;
- function SymGetSymNext64;
- begin
- GetProcedureAddress(_SymGetSymNext64, ImageHlpLib, 'SymGetSymNext64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetSymNext64]
- end;
- end;
- var
- _SymGetSymNext: Pointer;
- function SymGetSymNext;
- begin
- GetProcedureAddress(_SymGetSymNext, ImageHlpLib, 'SymGetSymNext');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetSymNext]
- end;
- end;
- var
- _SymGetSymPrev64: Pointer;
- function SymGetSymPrev64;
- begin
- GetProcedureAddress(_SymGetSymPrev64, ImageHlpLib, 'SymGetSymPrev64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetSymPrev64]
- end;
- end;
- var
- _SymGetSymPrev: Pointer;
- function SymGetSymPrev;
- begin
- GetProcedureAddress(_SymGetSymPrev, ImageHlpLib, 'SymGetSymPrev');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetSymPrev]
- end;
- end;
- var
- _SymGetLineFromAddr64: Pointer;
- function SymGetLineFromAddr64;
- begin
- GetProcedureAddress(_SymGetLineFromAddr64, ImageHlpLib, 'SymGetLineFromAddr64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetLineFromAddr64]
- end;
- end;
- var
- _SymGetLineFromAddr: Pointer;
- function SymGetLineFromAddr;
- begin
- GetProcedureAddress(_SymGetLineFromAddr, ImageHlpLib, 'SymGetLineFromAddr');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetLineFromAddr]
- end;
- end;
- var
- _SymGetLineFromName64: Pointer;
- function SymGetLineFromName64;
- begin
- GetProcedureAddress(_SymGetLineFromName64, ImageHlpLib, 'SymGetLineFromName64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetLineFromName64]
- end;
- end;
- var
- _SymGetLineFromName: Pointer;
- function SymGetLineFromName;
- begin
- GetProcedureAddress(_SymGetLineFromName, ImageHlpLib, 'SymGetLineFromName');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetLineFromName]
- end;
- end;
- var
- _SymGetLineNext64: Pointer;
- function SymGetLineNext64;
- begin
- GetProcedureAddress(_SymGetLineNext64, ImageHlpLib, 'SymGetLineNext64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetLineNext64]
- end;
- end;
- var
- _SymGetLineNext: Pointer;
- function SymGetLineNext;
- begin
- GetProcedureAddress(_SymGetLineNext, ImageHlpLib, 'SymGetLineNext');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetLineNext]
- end;
- end;
- var
- _SymGetLinePrev64: Pointer;
- function SymGetLinePrev64;
- begin
- GetProcedureAddress(_SymGetLinePrev64, ImageHlpLib, 'SymGetLinePrev64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetLinePrev64]
- end;
- end;
- var
- _SymGetLinePrev: Pointer;
- function SymGetLinePrev;
- begin
- GetProcedureAddress(_SymGetLinePrev, ImageHlpLib, 'SymGetLinePrev');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetLinePrev]
- end;
- end;
- var
- _SymMatchFileName: Pointer;
- function SymMatchFileName;
- begin
- GetProcedureAddress(_SymMatchFileName, ImageHlpLib, 'SymMatchFileName');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymMatchFileName]
- end;
- end;
- var
- _SymInitialize: Pointer;
- function SymInitialize;
- begin
- GetProcedureAddress(_SymInitialize, ImageHlpLib, 'SymInitialize');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymInitialize]
- end;
- end;
- var
- _SymGetSearchPath: Pointer;
- function SymGetSearchPath;
- begin
- GetProcedureAddress(_SymGetSearchPath, ImageHlpLib, 'SymGetSearchPath');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetSearchPath]
- end;
- end;
- var
- _SymSetSearchPath: Pointer;
- function SymSetSearchPath;
- begin
- GetProcedureAddress(_SymSetSearchPath, ImageHlpLib, 'SymSetSearchPath');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymSetSearchPath]
- end;
- end;
- var
- _SymLoadModuleEx: Pointer;
- function SymLoadModuleEx;
- begin
- GetProcedureAddress(_SymLoadModuleEx, ImageHlpLib, 'SymLoadModuleEx');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymLoadModuleEx]
- end;
- end;
- var
- _SymLoadModule64: Pointer;
- function SymLoadModule64;
- begin
- GetProcedureAddress(_SymLoadModule64, ImageHlpLib, 'SymLoadModule64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymLoadModule64]
- end;
- end;
- var
- _SymLoadModule: Pointer;
- function SymLoadModule;
- begin
- GetProcedureAddress(_SymLoadModule, ImageHlpLib, 'SymLoadModule');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymLoadModule]
- end;
- end;
- var
- _SymUnloadModule64: Pointer;
- function SymUnloadModule64;
- begin
- GetProcedureAddress(_SymUnloadModule64, ImageHlpLib, 'SymUnloadModule64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymUnloadModule64]
- end;
- end;
- var
- _SymUnloadModule: Pointer;
- function SymUnloadModule;
- begin
- GetProcedureAddress(_SymUnloadModule, ImageHlpLib, 'SymUnloadModule');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymUnloadModule]
- end;
- end;
- var
- _SymUnDName64: Pointer;
- function SymUnDName64;
- begin
- GetProcedureAddress(_SymUnDName64, ImageHlpLib, 'SymUnDName64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymUnDName64]
- end;
- end;
- var
- _SymUnDName: Pointer;
- function SymUnDName;
- begin
- GetProcedureAddress(_SymUnDName, ImageHlpLib, 'SymUnDName');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymUnDName]
- end;
- end;
- var
- _SymRegisterCallback64: Pointer;
- function SymRegisterCallback64;
- begin
- GetProcedureAddress(_SymRegisterCallback64, ImageHlpLib, 'SymRegisterCallback64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymRegisterCallback64]
- end;
- end;
- var
- _SymRegFuncEntryCallback64: Pointer;
- function SymRegisterFunctionEntryCallback64;
- begin
- GetProcedureAddress(_SymRegFuncEntryCallback64, ImageHlpLib, 'SymRegisterFunctionEntryCallback64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymRegFuncEntryCallback64]
- end;
- end;
- var
- _SymRegisterCallback: Pointer;
- function SymRegisterCallback;
- begin
- GetProcedureAddress(_SymRegisterCallback, ImageHlpLib, 'SymRegisterCallback');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymRegisterCallback]
- end;
- end;
- var
- _SymRegisterFuncEntryCallback: Pointer;
- function SymRegisterFunctionEntryCallback;
- begin
- GetProcedureAddress(_SymRegisterFuncEntryCallback, ImageHlpLib, 'SymRegisterFunctionEntryCallback');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymRegisterFuncEntryCallback]
- end;
- end;
- var
- _SymSetContext: Pointer;
- function SymSetContext;
- begin
- GetProcedureAddress(_SymSetContext, ImageHlpLib, 'SymSetContext');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymSetContext]
- end;
- end;
- var
- _SymFromAddr: Pointer;
- function SymFromAddr;
- begin
- GetProcedureAddress(_SymFromAddr, ImageHlpLib, 'SymFromAddr');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymFromAddr]
- end;
- end;
- var
- _SymFromName: Pointer;
- function SymFromName;
- begin
- GetProcedureAddress(_SymFromName, ImageHlpLib, 'SymFromName');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymFromName]
- end;
- end;
- var
- _SymEnumSymbolsForAddr: Pointer;
- function SymEnumSymbolsForAddr;
- begin
- GetProcedureAddress(_SymEnumSymbolsForAddr, ImageHlpLib, 'SymEnumSymbolsForAddr');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymEnumSymbolsForAddr]
- end;
- end;
- var
- _SymEnumSymbols: Pointer;
- function SymEnumSymbols;
- begin
- GetProcedureAddress(_SymEnumSymbols, ImageHlpLib, 'SymEnumSymbols');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymEnumSymbols]
- end;
- end;
- var
- _SymGetTypeInfo: Pointer;
- function SymGetTypeInfo;
- begin
- GetProcedureAddress(_SymGetTypeInfo, ImageHlpLib, 'SymGetTypeInfo');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetTypeInfo]
- end;
- end;
- var
- _SymEnumTypes: Pointer;
- function SymEnumTypes;
- begin
- GetProcedureAddress(_SymEnumTypes, ImageHlpLib, 'SymEnumTypes');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymEnumTypes]
- end;
- end;
- var
- _SymGetTypeFromName: Pointer;
- function SymGetTypeFromName;
- begin
- GetProcedureAddress(_SymGetTypeFromName, ImageHlpLib, 'SymGetTypeFromName');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetTypeFromName]
- end;
- end;
- var
- _SymAddSymbol: Pointer;
- function SymAddSymbol;
- begin
- GetProcedureAddress(_SymAddSymbol, ImageHlpLib, 'SymAddSymbol');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymAddSymbol]
- end;
- end;
- var
- _SymDeleteSymbol: Pointer;
- function SymDeleteSymbol;
- begin
- GetProcedureAddress(_SymDeleteSymbol, ImageHlpLib, 'SymDeleteSymbol');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymDeleteSymbol]
- end;
- end;
- var
- _DbgHelpCreateUserDump: Pointer;
- function DbgHelpCreateUserDump;
- begin
- GetProcedureAddress(_DbgHelpCreateUserDump, ImageHlpLib, 'DbgHelpCreateUserDump');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_DbgHelpCreateUserDump]
- end;
- end;
- var
- _DbgHelpCreateUserDumpW: Pointer;
- function DbgHelpCreateUserDumpW;
- begin
- GetProcedureAddress(_DbgHelpCreateUserDumpW, ImageHlpLib, 'DbgHelpCreateUserDumpW');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_DbgHelpCreateUserDumpW]
- end;
- end;
- var
- _SymGetSymFromAddr64: Pointer;
- function SymGetSymFromAddr64;
- begin
- GetProcedureAddress(_SymGetSymFromAddr64, ImageHlpLib, 'SymGetSymFromAddr64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetSymFromAddr64]
- end;
- end;
- var
- _SymGetSymFromAddr: Pointer;
- function SymGetSymFromAddr;
- begin
- GetProcedureAddress(_SymGetSymFromAddr, ImageHlpLib, 'SymGetSymFromAddr');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetSymFromAddr]
- end;
- end;
- var
- _SymGetSymFromName64: Pointer;
- function SymGetSymFromName64;
- begin
- GetProcedureAddress(_SymGetSymFromName64, ImageHlpLib, 'SymGetSymFromName64');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetSymFromName64]
- end;
- end;
- var
- _SymGetSymFromName: Pointer;
- function SymGetSymFromName;
- begin
- GetProcedureAddress(_SymGetSymFromName, ImageHlpLib, 'SymGetSymFromName');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymGetSymFromName]
- end;
- end;
- var
- _FindFileInPath: Pointer;
- function FindFileInPath;
- begin
- GetProcedureAddress(_FindFileInPath, ImageHlpLib, 'FindFileInPath');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_FindFileInPath]
- end;
- end;
- var
- _FindFileInSearchPath: Pointer;
- function FindFileInSearchPath;
- begin
- GetProcedureAddress(_FindFileInSearchPath, ImageHlpLib, 'FindFileInSearchPath');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_FindFileInSearchPath]
- end;
- end;
- var
- _SymEnumSym: Pointer;
- function SymEnumSym;
- begin
- GetProcedureAddress(_SymEnumSym, ImageHlpLib, 'SymEnumSym');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_SymEnumSym]
- end;
- end;
- var
- _MiniDumpWriteDump: Pointer;
- function MiniDumpWriteDump;
- begin
- GetProcedureAddress(_MiniDumpWriteDump, ImageHlpLib, 'MiniDumpWriteDump');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_MiniDumpWriteDump]
- end;
- end;
- var
- _MiniDumpReadDumpStream: Pointer;
- function MiniDumpReadDumpStream;
- begin
- GetProcedureAddress(_MiniDumpReadDumpStream, ImageHlpLib, 'MiniDumpReadDumpStream');
- asm
- MOV ESP, EBP
- POP EBP
- JMP [_MiniDumpReadDumpStream]
- end;
- end;
- {$ELSE}
- function BindImage; external ImageHlpLib name 'BindImage';
- function BindImageEx; external ImageHlpLib name 'BindImageEx';
- function ReBaseImage; external ImageHlpLib name 'ReBaseImage';
- function ReBaseImage64; external ImageHlpLib name 'ReBaseImage64';
- function CheckSumMappedFile; external ImageHlpLib name 'CheckSumMappedFile';
- function MapFileAndCheckSumA; external ImageHlpLib name 'MapFileAndCheckSumA';
- function MapFileAndCheckSumW; external ImageHlpLib name 'MapFileAndCheckSumW';
- function MapFileAndCheckSum; external ImageHlpLib name 'MapFileAndCheckSum' + AWSuffix;
- function GetImageConfigInformation; external ImageHlpLib name 'GetImageConfigInformation';
- function GetImageUnusedHeaderBytes; external ImageHlpLib name 'GetImageUnusedHeaderBytes';
- function SetImageConfigInformation; external ImageHlpLib name 'SetImageConfigInformation';
- function ImageGetDigestStream; external ImageHlpLib name 'ImageGetDigestStream';
- function ImageAddCertificate; external ImageHlpLib name 'ImageAddCertificate';
- function ImageRemoveCertificate; external ImageHlpLib name 'ImageRemoveCertificate';
- function ImageEnumerateCertificates; external ImageHlpLib name 'ImageEnumerateCertificates';
- function ImageGetCertificateData; external ImageHlpLib name 'ImageGetCertificateData';
- function ImageGetCertificateHeader; external ImageHlpLib name 'ImageGetCertificateHeader';
- function ImageLoad; external ImageHlpLib name 'ImageLoad';
- function ImageUnload; external ImageHlpLib name 'ImageUnload';
- function MapAndLoad; external ImageHlpLib name 'MapAndLoad';
- function UnMapAndLoad; external ImageHlpLib name 'UnMapAndLoad';
- function TouchFileTimes; external ImageHlpLib name 'TouchFileTimes';
- function SplitSymbols; external ImageHlpLib name 'SplitSymbols';
- function UpdateDebugInfoFile; external ImageHlpLib name 'UpdateDebugInfoFile';
- function UpdateDebugInfoFileEx; external ImageHlpLib name 'UpdateDebugInfoFileEx';
- function FindDebugInfoFile; external ImageHlpLib name 'FindDebugInfoFile';
- function FindDebugInfoFileEx; external ImageHlpLib name 'FindDebugInfoFileEx';
- function SymFindFileInPath; external ImageHlpLib name 'SymFindFileInPath';
- function FindExecutableImage; external ImageHlpLib name 'FindExecutableImage';
- function FindExecutableImageEx; external ImageHlpLib name 'FindExecutableImageEx';
- function ImageNtHeader; external ImageHlpLib name 'ImageNtHeader';
- function ImageDirectoryEntryToDataEx; external ImageHlpLib name 'ImageDirectoryEntryToDataEx';
- function ImageDirectoryEntryToData; external ImageHlpLib name 'ImageDirectoryEntryToData';
- function ImageRvaToSection; external ImageHlpLib name 'ImageRvaToSection';
- function ImageRvaToVa; external ImageHlpLib name 'ImageRvaToVa';
- function MapDebugInformation; external ImageHlpLib name 'MapDebugInformation';
- function UnmapDebugInformation; external ImageHlpLib name 'UnmapDebugInformation';
- function SearchTreeForFile; external ImageHlpLib name 'SearchTreeForFile';
- function EnumDirTree; external ImageHlpLib name 'EnumDirTree';
- function MakeSureDirectoryPathExists; external ImageHlpLib name 'MakeSureDirectoryPathExists';
- function UnDecorateSymbolName; external ImageHlpLib name 'UnDecorateSymbolName';
- function StackWalk64; external ImageHlpLib name 'StackWalk64';
- function StackWalk; external ImageHlpLib name 'StackWalk';
- function ImagehlpApiVersion; external ImageHlpLib name 'ImagehlpApiVersion';
- function ImagehlpApiVersionEx; external ImageHlpLib name 'ImagehlpApiVersionEx';
- function GetTimestampForLoadedLibrary; external ImageHlpLib name 'GetTimestampForLoadedLibrary';
- function SymSetOptions; external ImageHlpLib name 'SymSetOptions';
- function SymGetOptions; external ImageHlpLib name 'SymGetOptions';
- function SymCleanup; external ImageHlpLib name 'SymCleanup';
- function SymMatchString; external ImageHlpLib name 'SymMatchString';
- function SymEnumSourceFiles; external ImageHlpLib name 'SymEnumSourceFiles';
- function SymEnumerateModules64; external ImageHlpLib name 'SymEnumerateModules64';
- function SymEnumerateModules; external ImageHlpLib name 'SymEnumerateModules';
- function SymEnumerateSymbols64; external ImageHlpLib name 'SymEnumerateSymbols64';
- function SymEnumerateSymbolsW64; external ImageHlpLib name 'SymEnumerateSymbolsW64';
- function SymEnumerateSymbols; external ImageHlpLib name 'SymEnumerateSymbols';
- function SymEnumerateSymbolsW; external ImageHlpLib name 'SymEnumerateSymbolsW';
- function EnumerateLoadedModules64; external ImageHlpLib name 'EnumerateLoadedModules64';
- function EnumerateLoadedModules; external ImageHlpLib name 'EnumerateLoadedModules';
- function SymFunctionTableAccess64; external ImageHlpLib name 'SymFunctionTableAccess64';
- function SymFunctionTableAccess; external ImageHlpLib name 'SymFunctionTableAccess';
- function SymGetModuleInfo64; external ImageHlpLib name 'SymGetModuleInfo64';
- function SymGetModuleInfoW64; external ImageHlpLib name 'SymGetModuleInfoW64';
- function SymGetModuleInfo; external ImageHlpLib name 'SymGetModuleInfo';
- function SymGetModuleInfoW; external ImageHlpLib name 'SymGetModuleInfoW';
- function SymGetModuleBase64; external ImageHlpLib name 'SymGetModuleBase64';
- function SymGetModuleBase; external ImageHlpLib name 'SymGetModuleBase';
- function SymGetSymNext64; external ImageHlpLib name 'SymGetSymNext64';
- function SymGetSymNext; external ImageHlpLib name 'SymGetSymNext';
- function SymGetSymPrev64; external ImageHlpLib name 'SymGetSymPrev64';
- function SymGetSymPrev; external ImageHlpLib name 'SymGetSymPrev';
- function SymGetLineFromAddr64; external ImageHlpLib name 'SymGetLineFromAddr64';
- function SymGetLineFromAddr; external ImageHlpLib name 'SymGetLineFromAddr';
- function SymGetLineFromName64; external ImageHlpLib name 'SymGetLineFromName64';
- function SymGetLineFromName; external ImageHlpLib name 'SymGetLineFromName';
- function SymGetLineNext64; external ImageHlpLib name 'SymGetLineNext64';
- function SymGetLineNext; external ImageHlpLib name 'SymGetLineNext';
- function SymGetLinePrev64; external ImageHlpLib name 'SymGetLinePrev64';
- function SymGetLinePrev; external ImageHlpLib name 'SymGetLinePrev';
- function SymMatchFileName; external ImageHlpLib name 'SymMatchFileName';
- function SymInitialize; external ImageHlpLib name 'SymInitialize';
- function SymGetSearchPath; external ImageHlpLib name 'SymGetSearchPath';
- function SymSetSearchPath; external ImageHlpLib name 'SymSetSearchPath';
- function SymLoadModuleEx; external ImageHlpLib name 'SymLoadModuleEx';
- function SymLoadModule64; external ImageHlpLib name 'SymLoadModule64';
- function SymLoadModule; external ImageHlpLib name 'SymLoadModule';
- function SymUnloadModule64; external ImageHlpLib name 'SymUnloadModule64';
- function SymUnloadModule; external ImageHlpLib name 'SymUnloadModule';
- function SymUnDName64; external ImageHlpLib name 'SymUnDName64';
- function SymUnDName; external ImageHlpLib name 'SymUnDName';
- function SymRegisterCallback64; external ImageHlpLib name 'SymRegisterCallback64';
- function SymRegisterFunctionEntryCallback64; external ImageHlpLib name 'SymRegisterFunctionEntryCallback64';
- function SymRegisterCallback; external ImageHlpLib name 'SymRegisterCallback';
- function SymRegisterFunctionEntryCallback; external ImageHlpLib name 'SymRegisterFunctionEntryCallback';
- function SymSetContext; external ImageHlpLib name 'SymSetContext';
- function SymFromAddr; external ImageHlpLib name 'SymFromAddr';
- function SymFromName; external ImageHlpLib name 'SymFromName';
- function SymEnumSymbolsForAddr; external ImageHlpLib name 'SymEnumSymbolsForAddr';
- function SymEnumSymbols; external ImageHlpLib name 'SymEnumSymbols';
- function SymGetTypeInfo; external ImageHlpLib name 'SymGetTypeInfo';
- function SymEnumTypes; external ImageHlpLib name 'SymEnumTypes';
- function SymGetTypeFromName; external ImageHlpLib name 'SymGetTypeFromName';
- function SymAddSymbol; external ImageHlpLib name 'SymAddSymbol';
- function SymDeleteSymbol; external ImageHlpLib name 'SymDeleteSymbol';
- function DbgHelpCreateUserDump; external ImageHlpLib name 'DbgHelpCreateUserDump';
- function DbgHelpCreateUserDumpW; external ImageHlpLib name 'DbgHelpCreateUserDumpW';
- function SymGetSymFromAddr64; external ImageHlpLib name 'SymGetSymFromAddr64';
- function SymGetSymFromAddr; external ImageHlpLib name 'SymGetSymFromAddr';
- function SymGetSymFromName64; external ImageHlpLib name 'SymGetSymFromName64';
- function SymGetSymFromName; external ImageHlpLib name 'SymGetSymFromName';
- function FindFileInPath; external ImageHlpLib name 'FindFileInPath';
- function FindFileInSearchPath; external ImageHlpLib name 'FindFileInSearchPath';
- function SymEnumSym; external ImageHlpLib name 'SymEnumSym';
- function MiniDumpWriteDump; external ImageHlpLib name 'MiniDumpWriteDump';
- function MiniDumpReadDumpStream; external ImageHlpLib name 'MiniDumpReadDumpStream';
- {$ENDIF DYNAMIC_LINK}
- end.
|