jwaimagehlp.pas 135 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929393039313932393339343935393639373938393939403941394239433944394539463947394839493950395139523953395439553956395739583959396039613962396339643965396639673968396939703971397239733974397539763977397839793980398139823983398439853986398739883989399039913992399339943995399639973998399940004001400240034004400540064007400840094010401140124013401440154016401740184019402040214022402340244025402640274028402940304031403240334034403540364037403840394040404140424043404440454046404740484049405040514052405340544055405640574058405940604061406240634064406540664067406840694070407140724073407440754076407740784079408040814082408340844085408640874088408940904091409240934094409540964097409840994100410141024103410441054106410741084109411041114112411341144115411641174118411941204121412241234124412541264127412841294130413141324133413441354136413741384139414041414142414341444145414641474148414941504151415241534154415541564157415841594160416141624163416441654166416741684169417041714172417341744175417641774178417941804181418241834184418541864187418841894190419141924193419441954196419741984199420042014202420342044205420642074208420942104211421242134214421542164217421842194220422142224223422442254226422742284229423042314232423342344235423642374238423942404241424242434244424542464247424842494250425142524253425442554256425742584259426042614262426342644265426642674268426942704271427242734274427542764277427842794280428142824283428442854286428742884289429042914292429342944295429642974298429943004301430243034304430543064307430843094310431143124313431443154316431743184319432043214322432343244325432643274328432943304331433243334334433543364337433843394340434143424343434443454346434743484349435043514352435343544355435643574358435943604361436243634364436543664367436843694370437143724373437443754376437743784379438043814382438343844385438643874388438943904391439243934394439543964397
  1. {******************************************************************************}
  2. { }
  3. { Image Help API interface Unit for Object Pascal }
  4. { }
  5. { Portions created by Microsoft are Copyright (C) 1995-2001 Microsoft }
  6. { Corporation. All Rights Reserved. }
  7. { }
  8. { The original file is: imagehlp.h, released August 2001. The original Pascal }
  9. { code is: ImageHelp.pas, released December 2000. The initial developer of the }
  10. { Pascal code is Marcel van Brakel (brakelm att chello dott nl). }
  11. { }
  12. { Portions created by Marcel van Brakel are Copyright (C) 1999-2001 }
  13. { Marcel van Brakel. All Rights Reserved. }
  14. { }
  15. { Obtained through: Joint Endeavour of Delphi Innovators (Project JEDI) }
  16. { }
  17. { You may retrieve the latest version of this file at the Project JEDI }
  18. { APILIB home page, located at http://jedi-apilib.sourceforge.net }
  19. { }
  20. { The contents of this file are used with permission, subject to the Mozilla }
  21. { Public License Version 1.1 (the "License"); you may not use this file except }
  22. { in compliance with the License. You may obtain a copy of the License at }
  23. { http://www.mozilla.org/MPL/MPL-1.1.html }
  24. { }
  25. { Software distributed under the License is distributed on an "AS IS" basis, }
  26. { WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for }
  27. { the specific language governing rights and limitations under the License. }
  28. { }
  29. { Alternatively, the contents of this file may be used under the terms of the }
  30. { GNU Lesser General Public License (the "LGPL License"), in which case the }
  31. { provisions of the LGPL License are applicable instead of those above. }
  32. { If you wish to allow use of your version of this file only under the terms }
  33. { of the LGPL License and not to allow others to use your version of this file }
  34. { under the MPL, indicate your decision by deleting the provisions above and }
  35. { replace them with the notice and other provisions required by the LGPL }
  36. { License. If you do not delete the provisions above, a recipient may use }
  37. { your version of this file under either the MPL or the LGPL License. }
  38. { }
  39. { For more information about the LGPL: http://www.gnu.org/copyleft/lesser.html }
  40. { }
  41. {******************************************************************************}
  42. // $Id: JwaImageHlp.pas,v 1.10 2005/09/06 16:36:50 marquardt Exp $
  43. unit JwaImageHlp;
  44. {$WEAKPACKAGEUNIT}
  45. {$HPPEMIT ''}
  46. {$HPPEMIT '#include "ImageHlp.h"'}
  47. {$HPPEMIT ''}
  48. {$I jediapilib.inc}
  49. interface
  50. uses
  51. Windows, JwaWindows;
  52. const
  53. IMAGE_SEPARATION = 64*1024;
  54. {$EXTERNALSYM IMAGE_SEPARATION}
  55. type
  56. PLOADED_IMAGE = ^LOADED_IMAGE;
  57. {$EXTERNALSYM PLOADED_IMAGE}
  58. _LOADED_IMAGE = record
  59. ModuleName: PSTR;
  60. hFile: HANDLE;
  61. MappedAddress: PUCHAR;
  62. FileHeader: PIMAGE_NT_HEADERS32;
  63. LastRvaSection: PIMAGE_SECTION_HEADER;
  64. NumberOfSections: ULONG;
  65. Sections: PIMAGE_SECTION_HEADER;
  66. Characteristics: ULONG;
  67. fSystemImage: ByteBool;
  68. fDOSImage: ByteBool;
  69. Links: LIST_ENTRY;
  70. SizeOfImage: ULONG;
  71. end;
  72. {$EXTERNALSYM _LOADED_IMAGE}
  73. LOADED_IMAGE = _LOADED_IMAGE;
  74. {$EXTERNALSYM LOADED_IMAGE}
  75. TLoadedImage = LOADED_IMAGE;
  76. PLoadedImage = PLOADED_IMAGE;
  77. const
  78. MAX_SYM_NAME = 2000;
  79. {$EXTERNALSYM MAX_SYM_NAME}
  80. function BindImage(ImageName, DllPath, SymbolPath: PSTR): BOOL; stdcall;
  81. {$EXTERNALSYM BindImage}
  82. type
  83. _IMAGEHLP_STATUS_REASON = (
  84. BindOutOfMemory,
  85. BindRvaToVaFailed,
  86. BindNoRoomInImage,
  87. BindImportModuleFailed,
  88. BindImportProcedureFailed,
  89. BindImportModule,
  90. BindImportProcedure,
  91. BindForwarder,
  92. BindForwarderNOT,
  93. BindImageModified,
  94. BindExpandFileHeaders,
  95. BindImageComplete,
  96. BindMismatchedSymbols,
  97. BindSymbolsNotUpdated,
  98. BindImportProcedure32,
  99. BindImportProcedure64,
  100. BindForwarder32,
  101. BindForwarder64,
  102. BindForwarderNOT32,
  103. BindForwarderNOT64);
  104. {$EXTERNALSYM _IMAGEHLP_STATUS_REASON}
  105. IMAGEHLP_STATUS_REASON = _IMAGEHLP_STATUS_REASON;
  106. {$EXTERNALSYM IMAGEHLP_STATUS_REASON}
  107. TImageHlpStatusReason = IMAGEHLP_STATUS_REASON;
  108. PIMAGEHLP_STATUS_ROUTINE = function(Reason: IMAGEHLP_STATUS_REASON;
  109. ImageName, DllName: PSTR; Va, Parameter: ULONG_PTR): BOOL; stdcall;
  110. {$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE}
  111. PImageHlpStatusRoutine = PIMAGEHLP_STATUS_ROUTINE;
  112. PIMAGEHLP_STATUS_ROUTINE32 = function(Reason: IMAGEHLP_STATUS_REASON; ImageName, DllName: PSTR;
  113. Va: ULONG; Parameter: ULONG_PTR): BOOL; stdcall;
  114. {$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE32}
  115. PImageHlpStatusRoutine23 = PIMAGEHLP_STATUS_ROUTINE32;
  116. PIMAGEHLP_STATUS_ROUTINE64 = function(Reason: IMAGEHLP_STATUS_REASON; ImageName, DllName: PSTR;
  117. Va: ULONG64; Parameter: ULONG_PTR): BOOL; stdcall;
  118. {$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE64}
  119. PImageHlpStatusRoutine64 = PIMAGEHLP_STATUS_ROUTINE64;
  120. function BindImageEx(Flags: DWORD; ImageName, DllPath, SymbolPath: PSTR;
  121. StatusRoutine: PIMAGEHLP_STATUS_ROUTINE): BOOL; stdcall;
  122. {$EXTERNALSYM BindImageEx}
  123. const
  124. BIND_NO_BOUND_IMPORTS = $00000001;
  125. {$EXTERNALSYM BIND_NO_BOUND_IMPORTS}
  126. BIND_NO_UPDATE = $00000002;
  127. {$EXTERNALSYM BIND_NO_UPDATE}
  128. BIND_ALL_IMAGES = $00000004;
  129. {$EXTERNALSYM BIND_ALL_IMAGES}
  130. BIND_CACHE_IMPORT_DLLS = $00000008; // Cache dll's across calls to BindImageEx (same as NT 3.1->NT 4.0)
  131. {$EXTERNALSYM BIND_CACHE_IMPORT_DLLS}
  132. BIND_REPORT_64BIT_VA = $00000010;
  133. {$EXTERNALSYM BIND_REPORT_64BIT_VA}
  134. function ReBaseImage(CurrentImageName: PSTR; SymbolPath: PSTR; fReBase: BOOL;
  135. fRebaseSysfileOk: BOOL; fGoingDown: BOOL; CheckImageSize: ULONG;
  136. var OldImageSize: ULONG; var OldImageBase: ULONG_PTR; var NewImageSize: ULONG;
  137. var NewImageBase: ULONG_PTR; TimeStamp: ULONG): BOOL; stdcall;
  138. {$EXTERNALSYM ReBaseImage}
  139. function ReBaseImage64(CurrentImageName: PSTR; SymbolPath: PSTR; fReBase: BOOL;
  140. fRebaseSysfileOk: BOOL; fGoingDown: BOOL; CheckImageSize: ULONG;
  141. var OldImageSize: ULONG; var OldImageBase: ULONG64; var NewImageSize: ULONG;
  142. var NewImageBase: ULONG64; TimeStamp: ULONG): BOOL; stdcall;
  143. {$EXTERNALSYM ReBaseImage64}
  144. //
  145. // Define checksum return codes.
  146. //
  147. const
  148. CHECKSUM_SUCCESS = 0;
  149. {$EXTERNALSYM CHECKSUM_SUCCESS}
  150. CHECKSUM_OPEN_FAILURE = 1;
  151. {$EXTERNALSYM CHECKSUM_OPEN_FAILURE}
  152. CHECKSUM_MAP_FAILURE = 2;
  153. {$EXTERNALSYM CHECKSUM_MAP_FAILURE}
  154. CHECKSUM_MAPVIEW_FAILURE = 3;
  155. {$EXTERNALSYM CHECKSUM_MAPVIEW_FAILURE}
  156. CHECKSUM_UNICODE_FAILURE = 4;
  157. {$EXTERNALSYM CHECKSUM_UNICODE_FAILURE}
  158. // Define Splitsym flags.
  159. SPLITSYM_REMOVE_PRIVATE = $00000001; // Remove CV types/symbols and Fixup debug
  160. {$EXTERNALSYM SPLITSYM_REMOVE_PRIVATE}
  161. // Used for creating .dbg files that ship
  162. // as part of the product.
  163. SPLITSYM_EXTRACT_ALL = $00000002; // Extract all debug info from image.
  164. {$EXTERNALSYM SPLITSYM_EXTRACT_ALL}
  165. // Normally, FPO is left in the image
  166. // to allow stack traces through the code.
  167. // Using this switch is similar to linking
  168. // with -debug:none except the .dbg file
  169. // exists...
  170. SPLITSYM_SYMBOLPATH_IS_SRC = $00000004; // The SymbolFilePath contains an alternate
  171. {$EXTERNALSYM SPLITSYM_SYMBOLPATH_IS_SRC}
  172. // path to locate the pdb.
  173. //
  174. // Define checksum function prototypes.
  175. //
  176. function CheckSumMappedFile(BaseAddress: PVOID; FileLength: DWORD;
  177. var HeaderSum, CheckSum: DWORD): PIMAGE_NT_HEADERS; stdcall;
  178. {$EXTERNALSYM CheckSumMappedFile}
  179. function MapFileAndCheckSumA(Filename: PSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
  180. {$EXTERNALSYM MapFileAndCheckSumA}
  181. function MapFileAndCheckSumW(Filename: PWSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
  182. {$EXTERNALSYM MapFileAndCheckSumW}
  183. function MapFileAndCheckSum(Filename: PTSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
  184. {$EXTERNALSYM MapFileAndCheckSum}
  185. function GetImageConfigInformation(const LoadedImage: LOADED_IMAGE;
  186. var ImageConfigInformation: IMAGE_LOAD_CONFIG_DIRECTORY): BOOL; stdcall;
  187. {$EXTERNALSYM GetImageConfigInformation}
  188. function GetImageUnusedHeaderBytes(const LoadedImage: LOADED_IMAGE;
  189. var SizeUnusedHeaderBytes: DWORD): DWORD; stdcall;
  190. {$EXTERNALSYM GetImageUnusedHeaderBytes}
  191. function SetImageConfigInformation(const LoadedImage: LOADED_IMAGE;
  192. const ImageConfigInformation: IMAGE_LOAD_CONFIG_DIRECTORY): BOOL; stdcall;
  193. {$EXTERNALSYM SetImageConfigInformation}
  194. // Image Integrity API's
  195. const
  196. CERT_PE_IMAGE_DIGEST_DEBUG_INFO = $01;
  197. {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_DEBUG_INFO}
  198. CERT_PE_IMAGE_DIGEST_RESOURCES = $02;
  199. {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_RESOURCES}
  200. CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO = $04;
  201. {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO}
  202. CERT_PE_IMAGE_DIGEST_NON_PE_INFO = $08; // include data outside the PE image
  203. {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_NON_PE_INFO}
  204. CERT_SECTION_TYPE_ANY = $FF; // Any Certificate type
  205. {$EXTERNALSYM CERT_SECTION_TYPE_ANY}
  206. type
  207. DIGEST_HANDLE = PVOID;
  208. {$EXTERNALSYM DIGEST_HANDLE}
  209. TDigestHandle = DIGEST_HANDLE;
  210. DIGEST_FUNCTION = function(refdata: DIGEST_HANDLE; pData: PBYTE; dwLength: DWORD): BOOL; stdcall;
  211. {$EXTERNALSYM DIGEST_FUNCTION}
  212. TDigestFunction = DIGEST_FUNCTION;
  213. function ImageGetDigestStream(FileHandle: HANDLE; DigestLevel: DWORD;
  214. DigestFunction: DIGEST_FUNCTION; DigestHandle: DIGEST_HANDLE): BOOL; stdcall;
  215. {$EXTERNALSYM ImageGetDigestStream}
  216. function ImageAddCertificate(FileHandle: HANDLE; Certificate: PWinCertificate;
  217. var Index: DWORD): BOOL; stdcall;
  218. {$EXTERNALSYM ImageAddCertificate}
  219. function ImageRemoveCertificate(FileHandle: HANDLE; Index: DWORD): BOOL; stdcall;
  220. {$EXTERNALSYM ImageRemoveCertificate}
  221. function ImageEnumerateCertificates(FileHandle: HANDLE; TypeFilter: WORD;
  222. var CertificateCount: DWORD; Indices: PDWORD; IndexCount: DWORD): BOOL; stdcall;
  223. {$EXTERNALSYM ImageEnumerateCertificates}
  224. function ImageGetCertificateData(FileHandle: HANDLE; CertificateIndex: DWORD;
  225. Certificate: PWinCertificate; var RequiredLength: DWORD): BOOL; stdcall;
  226. {$EXTERNALSYM ImageGetCertificateData}
  227. function ImageGetCertificateHeader(FileHandle: HANDLE; CertificateIndex: DWORD;
  228. Certificateheader: PWinCertificate): BOOL; stdcall;
  229. {$EXTERNALSYM ImageGetCertificateHeader}
  230. function ImageLoad(DllName: PSTR; DllPath: PSTR): PLOADED_IMAGE; stdcall;
  231. {$EXTERNALSYM ImageLoad}
  232. function ImageUnload(const LoadedImage: LOADED_IMAGE): BOOL; stdcall;
  233. {$EXTERNALSYM ImageUnload}
  234. function MapAndLoad(ImageName, DllPath: PSTR; var LoadedImage: LOADED_IMAGE;
  235. DotDll: BOOL; ReadOnly: BOOL): BOOL; stdcall;
  236. {$EXTERNALSYM MapAndLoad}
  237. function UnMapAndLoad(const LoadedImage: LOADED_IMAGE): BOOL; stdcall;
  238. {$EXTERNALSYM UnMapAndLoad}
  239. function TouchFileTimes(FileHandle: HANDLE; pSystemTime: PSYSTEMTIME): BOOL; stdcall;
  240. {$EXTERNALSYM TouchFileTimes}
  241. function SplitSymbols(ImageName, SymbolsPath, SymbolFilePath: PSTR; Flags: DWORD): BOOL; stdcall;
  242. {$EXTERNALSYM SplitSymbols}
  243. function UpdateDebugInfoFile(ImageFileName, SymbolPath, DebugFilePath: PSTR;
  244. const NtHeaders: IMAGE_NT_HEADERS32): BOOL; stdcall;
  245. {$EXTERNALSYM UpdateDebugInfoFile}
  246. function UpdateDebugInfoFileEx(ImageFileName, SymbolPath, DebugFilePath: PSTR;
  247. const NtHeaders: IMAGE_NT_HEADERS32; OldChecksum: DWORD): BOOL; stdcall;
  248. {$EXTERNALSYM UpdateDebugInfoFileEx}
  249. function FindDebugInfoFile(FileName, SymbolPath, DebugFilePath: PSTR): HANDLE; stdcall;
  250. {$EXTERNALSYM FindDebugInfoFile}
  251. type
  252. PFIND_DEBUG_FILE_CALLBACK = function(FileHandle: HANDLE; FileName: PSTR;
  253. CallerData: PVOID): BOOL; stdcall;
  254. {$EXTERNALSYM PFIND_DEBUG_FILE_CALLBACK}
  255. PFindDebugFileCallback = PFIND_DEBUG_FILE_CALLBACK;
  256. function FindDebugInfoFileEx(FileName, SymbolPath, DebugFilePath: PSTR;
  257. Callback: PFIND_DEBUG_FILE_CALLBACK; CallerData: PVOID): HANDLE; stdcall;
  258. {$EXTERNALSYM FindDebugInfoFileEx}
  259. type
  260. PFINDFILEINPATHCALLBACK = function(filename: PSTR; context: PVOID): BOOL; stdcall;
  261. {$EXTERNALSYM PFINDFILEINPATHCALLBACK}
  262. function SymFindFileInPath(hprocess: HANDLE; SearchPath, FileName: LPSTR; id: PVOID; two, three, flags: DWORD;
  263. FoundFile: LPSTR; callback: PFINDFILEINPATHCALLBACK; context: PVOID): BOOL; stdcall;
  264. {$EXTERNALSYM SymFindFileInPath}
  265. function FindExecutableImage(FileName, SymbolPath, ImageFilePath: PSTR): HANDLE; stdcall;
  266. {$EXTERNALSYM FindExecutableImage}
  267. type
  268. PFIND_EXE_FILE_CALLBACK = function(FileHandle: HANDLE; FileName: PSTR;
  269. CallerData: PVOID): BOOL; stdcall;
  270. {$EXTERNALSYM PFIND_EXE_FILE_CALLBACK}
  271. PFindExeFileCallback = PFIND_EXE_FILE_CALLBACK;
  272. function FindExecutableImageEx(FileName, SymbolPath, ImageFilePath: PSTR;
  273. Callback: PFIND_EXE_FILE_CALLBACK; CallerData: PVOID): HANDLE; stdcall;
  274. {$EXTERNALSYM FindExecutableImageEx}
  275. function ImageNtHeader(Base: PVOID): PIMAGE_NT_HEADERS; stdcall;
  276. {$EXTERNALSYM ImageNtHeader}
  277. function ImageDirectoryEntryToDataEx(Base: PVOID; MappedAsImage: ByteBool;
  278. DirectoryEntry: USHORT; var Size: ULONG; var FoundHeader: PIMAGE_SECTION_HEADER): PVOID; stdcall;
  279. {$EXTERNALSYM ImageDirectoryEntryToDataEx}
  280. function ImageDirectoryEntryToData(Base: PVOID; MappedAsImage: ByteBool;
  281. DirectoryEntry: USHORT; var Size: ULONG): PVOID; stdcall;
  282. {$EXTERNALSYM ImageDirectoryEntryToData}
  283. function ImageRvaToSection(NtHeaders: PIMAGE_NT_HEADERS; Base: PVOID; Rva: ULONG): PIMAGE_SECTION_HEADER; stdcall;
  284. {$EXTERNALSYM ImageRvaToSection}
  285. function ImageRvaToVa(NtHeaders: PIMAGE_NT_HEADERS; Base: PVOID; Rva: ULONG;
  286. var LastRvaSection: PIMAGE_SECTION_HEADER): PVOID; stdcall;
  287. {$EXTERNALSYM ImageRvaToVa}
  288. // Symbol server exports
  289. type
  290. PSYMBOLSERVERPROC = function(a1, a2: LPCSTR; a3: PVOID; a4, a5: DWORD; a6: LPSTR): BOOL; stdcall;
  291. {$EXTERNALSYM PSYMBOLSERVERPROC}
  292. PSYMBOLSERVEROPENPROC = function: BOOL; stdcall;
  293. {$EXTERNALSYM PSYMBOLSERVEROPENPROC}
  294. PSYMBOLSERVERCLOSEPROC = function: BOOL; stdcall;
  295. {$EXTERNALSYM PSYMBOLSERVERCLOSEPROC}
  296. PSYMBOLSERVERSETOPTIONSPROC = function(a1: UINT_PTR; a2: ULONG64): BOOL; stdcall;
  297. {$EXTERNALSYM PSYMBOLSERVERSETOPTIONSPROC}
  298. PSYMBOLSERVERCALLBACKPROC = function(action: UINT_PTR; data: ULONG64; context: ULONG64): BOOL; stdcall;
  299. {$EXTERNALSYM PSYMBOLSERVERCALLBACKPROC}
  300. PSYMBOLSERVERGETOPTIONSPROC = function: UINT_PTR; stdcall;
  301. {$EXTERNALSYM PSYMBOLSERVERGETOPTIONSPROC}
  302. PSYMBOLSERVERPINGPROC = function(a1: LPCSTR): BOOL; stdcall;
  303. {$EXTERNALSYM PSYMBOLSERVERPINGPROC}
  304. const
  305. SSRVOPT_CALLBACK = $01;
  306. {$EXTERNALSYM SSRVOPT_CALLBACK}
  307. SSRVOPT_DWORD = $02;
  308. {$EXTERNALSYM SSRVOPT_DWORD}
  309. SSRVOPT_DWORDPTR = $04;
  310. {$EXTERNALSYM SSRVOPT_DWORDPTR}
  311. SSRVOPT_GUIDPTR = $08;
  312. {$EXTERNALSYM SSRVOPT_GUIDPTR}
  313. SSRVOPT_OLDGUIDPTR = $10;
  314. {$EXTERNALSYM SSRVOPT_OLDGUIDPTR}
  315. SSRVOPT_UNATTENDED = $20;
  316. {$EXTERNALSYM SSRVOPT_UNATTENDED}
  317. SSRVOPT_RESET = ULONG_PTR(-1);
  318. {$EXTERNALSYM SSRVOPT_RESET}
  319. SSRVACTION_TRACE = 1;
  320. {$EXTERNALSYM SSRVACTION_TRACE}
  321. // This api won't be ported to Win64 - Fix your code.
  322. type
  323. PIMAGE_DEBUG_INFORMATION = ^IMAGE_DEBUG_INFORMATION;
  324. {$EXTERNALSYM PIMAGE_DEBUG_INFORMATION}
  325. _IMAGE_DEBUG_INFORMATION = record
  326. List: LIST_ENTRY;
  327. ReservedSize: DWORD;
  328. ReservedMappedBase: PVOID;
  329. ReservedMachine: USHORT;
  330. ReservedCharacteristics: USHORT;
  331. ReservedCheckSum: DWORD;
  332. ImageBase: DWORD;
  333. SizeOfImage: DWORD;
  334. ReservedNumberOfSections: DWORD;
  335. ReservedSections: PIMAGE_SECTION_HEADER;
  336. ReservedExportedNamesSize: DWORD;
  337. ReservedExportedNames: PSTR;
  338. ReservedNumberOfFunctionTableEntries: DWORD;
  339. ReservedFunctionTableEntries: PIMAGE_FUNCTION_ENTRY;
  340. ReservedLowestFunctionStartingAddress: DWORD;
  341. ReservedHighestFunctionEndingAddress: DWORD;
  342. ReservedNumberOfFpoTableEntries: DWORD;
  343. ReservedFpoTableEntries: PFPO_DATA;
  344. SizeOfCoffSymbols: DWORD;
  345. CoffSymbols: PIMAGE_COFF_SYMBOLS_HEADER;
  346. ReservedSizeOfCodeViewSymbols: DWORD;
  347. ReservedCodeViewSymbols: PVOID;
  348. ImageFilePath: PSTR;
  349. ImageFileName: PSTR;
  350. ReservedDebugFilePath: PSTR;
  351. ReservedTimeDateStamp: DWORD;
  352. ReservedRomImage: BOOL;
  353. ReservedDebugDirectory: PIMAGE_DEBUG_DIRECTORY;
  354. ReservedNumberOfDebugDirectories: DWORD;
  355. ReservedOriginalFunctionTableBaseAddress: DWORD;
  356. Reserved: array [0..1] of DWORD;
  357. end;
  358. {$EXTERNALSYM _IMAGE_DEBUG_INFORMATION}
  359. IMAGE_DEBUG_INFORMATION = _IMAGE_DEBUG_INFORMATION;
  360. {$EXTERNALSYM IMAGE_DEBUG_INFORMATION}
  361. TImageDebugInformation = IMAGE_DEBUG_INFORMATION;
  362. PImageDebugInformation = PIMAGE_DEBUG_INFORMATION;
  363. function MapDebugInformation(FileHandle: HANDLE; FileName, SymbolPath: PSTR;
  364. ImageBase: DWORD): PIMAGE_DEBUG_INFORMATION; stdcall;
  365. {$EXTERNALSYM MapDebugInformation}
  366. function UnmapDebugInformation(DebugInfo: PIMAGE_DEBUG_INFORMATION): BOOL; stdcall;
  367. {$EXTERNALSYM UnmapDebugInformation}
  368. function SearchTreeForFile(RootPath, InputPathName, OutputPathBuffer: PSTR): BOOL; stdcall;
  369. {$EXTERNALSYM SearchTreeForFile}
  370. type
  371. PENUMDIRTREE_CALLBACK = function(FilePath: LPCSTR; CallerData: PVOID): BOOL; stdcall;
  372. {$EXTERNALSYM PENUMDIRTREE_CALLBACK}
  373. PEnumDirTreeCallback = PENUMDIRTREE_CALLBACK;
  374. function EnumDirTree(hProcess: HANDLE; RootPath, InputPathName, OutputPathBuffer: PSTR;
  375. Callback: PENUMDIRTREE_CALLBACK; CallbackData: PVOID): BOOL; stdcall;
  376. {$EXTERNALSYM EnumDirTree}
  377. function MakeSureDirectoryPathExists(DirPath: PCSTR): BOOL; stdcall;
  378. {$EXTERNALSYM MakeSureDirectoryPathExists}
  379. //
  380. // UnDecorateSymbolName Flags
  381. //
  382. const
  383. UNDNAME_COMPLETE = $0000; // Enable full undecoration
  384. {$EXTERNALSYM UNDNAME_COMPLETE}
  385. UNDNAME_NO_LEADING_UNDERSCORES = $0001; // Remove leading underscores from MS extended keywords
  386. {$EXTERNALSYM UNDNAME_NO_LEADING_UNDERSCORES}
  387. UNDNAME_NO_MS_KEYWORDS = $0002; // Disable expansion of MS extended keywords
  388. {$EXTERNALSYM UNDNAME_NO_MS_KEYWORDS}
  389. UNDNAME_NO_FUNCTION_RETURNS = $0004; // Disable expansion of return type for primary declaration
  390. {$EXTERNALSYM UNDNAME_NO_FUNCTION_RETURNS}
  391. UNDNAME_NO_ALLOCATION_MODEL = $0008; // Disable expansion of the declaration model
  392. {$EXTERNALSYM UNDNAME_NO_ALLOCATION_MODEL}
  393. UNDNAME_NO_ALLOCATION_LANGUAGE = $0010; // Disable expansion of the declaration language specifier
  394. {$EXTERNALSYM UNDNAME_NO_ALLOCATION_LANGUAGE}
  395. UNDNAME_NO_MS_THISTYPE = $0020; // NYI Disable expansion of MS keywords on the 'this' type for primary declaration
  396. {$EXTERNALSYM UNDNAME_NO_MS_THISTYPE}
  397. UNDNAME_NO_CV_THISTYPE = $0040; // NYI Disable expansion of CV modifiers on the 'this' type for primary declaration
  398. {$EXTERNALSYM UNDNAME_NO_CV_THISTYPE}
  399. UNDNAME_NO_THISTYPE = $0060; // Disable all modifiers on the 'this' type
  400. {$EXTERNALSYM UNDNAME_NO_THISTYPE}
  401. UNDNAME_NO_ACCESS_SPECIFIERS = $0080; // Disable expansion of access specifiers for members
  402. {$EXTERNALSYM UNDNAME_NO_ACCESS_SPECIFIERS}
  403. UNDNAME_NO_THROW_SIGNATURES = $0100; // Disable expansion of 'throw-signatures' for functions and pointers to functions
  404. {$EXTERNALSYM UNDNAME_NO_THROW_SIGNATURES}
  405. UNDNAME_NO_MEMBER_TYPE = $0200; // Disable expansion of 'static' or 'virtual'ness of members
  406. {$EXTERNALSYM UNDNAME_NO_MEMBER_TYPE}
  407. UNDNAME_NO_RETURN_UDT_MODEL = $0400; // Disable expansion of MS model for UDT returns
  408. {$EXTERNALSYM UNDNAME_NO_RETURN_UDT_MODEL}
  409. UNDNAME_32_BIT_DECODE = $0800; // Undecorate 32-bit decorated names
  410. {$EXTERNALSYM UNDNAME_32_BIT_DECODE}
  411. UNDNAME_NAME_ONLY = $1000; // Crack only the name for primary declaration;
  412. {$EXTERNALSYM UNDNAME_NAME_ONLY}
  413. // return just [scope::]name. Does expand template params
  414. UNDNAME_NO_ARGUMENTS = $2000; // Don't undecorate arguments to function
  415. {$EXTERNALSYM UNDNAME_NO_ARGUMENTS}
  416. UNDNAME_NO_SPECIAL_SYMS = $4000; // Don't undecorate special names (v-table, vcall, vector xxx, metatype, etc)
  417. {$EXTERNALSYM UNDNAME_NO_SPECIAL_SYMS}
  418. function UnDecorateSymbolName(DecoratedName: PCSTR; UnDecoratedName: PSTR;
  419. UndecoratedLength: DWORD; Flags: DWORD): DWORD; stdcall;
  420. {$EXTERNALSYM UnDecorateSymbolName}
  421. //
  422. // these values are used for synthesized file types
  423. // that can be passed in as image headers instead of
  424. // the standard ones from ntimage.h
  425. //
  426. const
  427. DBHHEADER_DEBUGDIRS = $1;
  428. {$EXTERNALSYM DBHHEADER_DEBUGDIRS}
  429. type
  430. _MODLOAD_DATA = record
  431. ssize: DWORD; // size of this struct
  432. ssig: DWORD; // signature identifying the passed data
  433. data: PVOID; // pointer to passed data
  434. size: DWORD; // size of passed data
  435. flags: DWORD; // options
  436. end;
  437. {$EXTERNALSYM _MODLOAD_DATA}
  438. MODLOAD_DATA = _MODLOAD_DATA;
  439. {$EXTERNALSYM MODLOAD_DATA}
  440. PMODLOAD_DATA = ^MODLOAD_DATA;
  441. {$EXTERNALSYM PMODLOAD_DATA}
  442. TModLoadData = MODLOAD_DATA;
  443. PModLoadData = PMODLOAD_DATA;
  444. //
  445. // StackWalking API
  446. //
  447. type
  448. ADDRESS_MODE = (
  449. AddrMode1616,
  450. AddrMode1632,
  451. AddrModeReal,
  452. AddrModeFlat);
  453. {$EXTERNALSYM ADDRESS_MODE}
  454. TAddressMode = ADDRESS_MODE;
  455. LPADDRESS64 = ^ADDRESS64;
  456. {$EXTERNALSYM PADDRESS64}
  457. _tagADDRESS64 = record
  458. Offset: DWORD64;
  459. Segment: WORD;
  460. Mode: ADDRESS_MODE;
  461. end;
  462. {$EXTERNALSYM _tagADDRESS64}
  463. ADDRESS64 = _tagADDRESS64;
  464. {$EXTERNALSYM ADDRESS64}
  465. TAddress64 = ADDRESS64;
  466. PAddress64 = LPADDRESS64;
  467. LPADDRESS = ^ADDRESS;
  468. {$EXTERNALSYM PADDRESS}
  469. _tagADDRESS = record
  470. Offset: DWORD;
  471. Segment: WORD;
  472. Mode: ADDRESS_MODE;
  473. end;
  474. {$EXTERNALSYM _tagADDRESS}
  475. ADDRESS = _tagADDRESS;
  476. {$EXTERNALSYM ADDRESS}
  477. TAddress = ADDRESS;
  478. PAddress = LPADDRESS;
  479. procedure Address32To64(a32: LPADDRESS; a64: LPADDRESS64);
  480. {$EXTERNALSYM Address32To64}
  481. procedure Address64To32(a64: LPADDRESS64; a32: LPADDRESS);
  482. {$EXTERNALSYM Address64To32}
  483. //
  484. // This structure is included in the STACKFRAME structure,
  485. // and is used to trace through usermode callbacks in a thread's
  486. // kernel stack. The values must be copied by the kernel debugger
  487. // from the DBGKD_GET_VERSION and WAIT_STATE_CHANGE packets.
  488. //
  489. //
  490. // New KDHELP structure for 64 bit system support.
  491. // This structure is preferred in new code.
  492. //
  493. type
  494. PKDHELP64 = ^KDHELP64;
  495. {$EXTERNALSYM PKDHELP64}
  496. _KDHELP64 = record
  497. //
  498. // address of kernel thread object, as provided in the
  499. // WAIT_STATE_CHANGE packet.
  500. //
  501. Thread: DWORD64;
  502. //
  503. // offset in thread object to pointer to the current callback frame
  504. // in kernel stack.
  505. //
  506. ThCallbackStack: DWORD;
  507. //
  508. // offset in thread object to pointer to the current callback backing
  509. // store frame in kernel stack.
  510. //
  511. ThCallbackBStore: DWORD;
  512. //
  513. // offsets to values in frame:
  514. //
  515. // address of next callback frame
  516. NextCallback: DWORD;
  517. // address of saved frame pointer (if applicable)
  518. FramePointer: DWORD;
  519. //
  520. // Address of the kernel function that calls out to user mode
  521. //
  522. KiCallUserMode: DWORD64;
  523. //
  524. // Address of the user mode dispatcher function
  525. //
  526. KeUserCallbackDispatcher: DWORD64;
  527. //
  528. // Lowest kernel mode address
  529. //
  530. SystemRangeStart: DWORD64;
  531. Reserved: array [0..7] of DWORD64;
  532. end;
  533. {$EXTERNALSYM _KDHELP64}
  534. KDHELP64 = _KDHELP64;
  535. {$EXTERNALSYM KDHELP64}
  536. TKdHelp64 = KDHELP64;
  537. //PKdHelp64 = PKDHELP64;
  538. PKDHELP = ^KDHELP;
  539. {$EXTERNALSYM PKDHELP}
  540. _KDHELP = record
  541. //
  542. // address of kernel thread object, as provided in the
  543. // WAIT_STATE_CHANGE packet.
  544. //
  545. Thread: DWORD;
  546. //
  547. // offset in thread object to pointer to the current callback frame
  548. // in kernel stack.
  549. //
  550. ThCallbackStack: DWORD;
  551. //
  552. // offsets to values in frame:
  553. //
  554. // address of next callback frame
  555. NextCallback: DWORD;
  556. // address of saved frame pointer (if applicable)
  557. FramePointer: DWORD;
  558. //
  559. // Address of the kernel function that calls out to user mode
  560. //
  561. KiCallUserMode: DWORD;
  562. //
  563. // Address of the user mode dispatcher function
  564. //
  565. KeUserCallbackDispatcher: DWORD;
  566. //
  567. // Lowest kernel mode address
  568. //
  569. SystemRangeStart: DWORD;
  570. //
  571. // offset in thread object to pointer to the current callback backing
  572. // store frame in kernel stack.
  573. //
  574. ThCallbackBStore: DWORD;
  575. Reserved: array [0..7] of DWORD;
  576. end;
  577. {$EXTERNALSYM _KDHELP}
  578. KDHELP = _KDHELP;
  579. {$EXTERNALSYM KDHELP}
  580. TKdHelp = KDHELP;
  581. //PKdHelp = PKDHELP;
  582. procedure KdHelp32To64(p32: PKDHELP; p64: PKDHELP64);
  583. {$EXTERNALSYM KdHelp32To64}
  584. type
  585. LPSTACKFRAME64 = ^STACKFRAME64;
  586. {$EXTERNALSYM LPSTACKFRAME64}
  587. _tagSTACKFRAME64 = record
  588. AddrPC: ADDRESS64; // program counter
  589. AddrReturn: ADDRESS64; // return address
  590. AddrFrame: ADDRESS64; // frame pointer
  591. AddrStack: ADDRESS64; // stack pointer
  592. AddrBStore: ADDRESS64; // backing store pointer
  593. FuncTableEntry: PVOID; // pointer to pdata/fpo or NULL
  594. Params: array [0..3] of DWORD64; // possible arguments to the function
  595. Far: BOOL; // WOW far call
  596. Virtual: BOOL; // is this a virtual frame?
  597. Reserved: array [0..2] of DWORD64;
  598. KdHelp: KDHELP64;
  599. end;
  600. {$EXTERNALSYM _tagSTACKFRAME64}
  601. STACKFRAME64 = _tagSTACKFRAME64;
  602. {$EXTERNALSYM STACKFRAME64}
  603. TStackFrame64 = STACKFRAME64;
  604. PStackFrame64 = LPSTACKFRAME64;
  605. LPSTACKFRAME = ^STACKFRAME;
  606. {$EXTERNALSYM LPSTACKFRAME}
  607. _tagSTACKFRAME = record
  608. AddrPC: ADDRESS; // program counter
  609. AddrReturn: ADDRESS; // return address
  610. AddrFrame: ADDRESS; // frame pointer
  611. AddrStack: ADDRESS; // stack pointer
  612. FuncTableEntry: PVOID; // pointer to pdata/fpo or NULL
  613. Params: array [0..3] of DWORD; // possible arguments to the function
  614. Far: BOOL; // WOW far call
  615. Virtual: BOOL; // is this a virtual frame?
  616. Reserved: array [0..2] of DWORD;
  617. KdHelp: KDHELP;
  618. AddrBStore: ADDRESS; // backing store pointer
  619. end;
  620. {$EXTERNALSYM _tagSTACKFRAME}
  621. STACKFRAME = _tagSTACKFRAME;
  622. {$EXTERNALSYM STACKFRAME}
  623. TStackFrame = STACKFRAME;
  624. PStackFrame = LPSTACKFRAME;
  625. PREAD_PROCESS_MEMORY_ROUTINE64 = function(hProcess: HANDLE; qwBaseAddress: DWORD64;
  626. lpBuffer: PVOID; nSize: DWORD; var lpNumberOfBytesRead: DWORD): BOOL; stdcall;
  627. {$EXTERNALSYM PREAD_PROCESS_MEMORY_ROUTINE64}
  628. PReadProcessMemoryRoutine64 = PREAD_PROCESS_MEMORY_ROUTINE64;
  629. PFUNCTION_TABLE_ACCESS_ROUTINE64 = function(hProcess: HANDLE;
  630. AddrBase: DWORD64): PVOID; stdcall;
  631. {$EXTERNALSYM PFUNCTION_TABLE_ACCESS_ROUTINE64}
  632. PFunctionTableAccessRoutine64 = PFUNCTION_TABLE_ACCESS_ROUTINE64;
  633. PGET_MODULE_BASE_ROUTINE64 = function(hProcess: HANDLE;
  634. Address: DWORD64): DWORD64; stdcall;
  635. {$EXTERNALSYM PGET_MODULE_BASE_ROUTINE64}
  636. PGetModuleBaseRoutine64 = PGET_MODULE_BASE_ROUTINE64;
  637. PTRANSLATE_ADDRESS_ROUTINE64 = function(hProcess: HANDLE; hThread: HANDLE;
  638. const lpaddr: ADDRESS64): DWORD64; stdcall;
  639. {$EXTERNALSYM PTRANSLATE_ADDRESS_ROUTINE64}
  640. PTranslateAddressRoutine64 = PTRANSLATE_ADDRESS_ROUTINE64;
  641. function StackWalk64(MachineType: DWORD; hProcess: HANDLE; hThread: HANDLE;
  642. var StackFrame: STACKFRAME64; ContextRecord: PVOID;
  643. ReadMemoryRoutine: PREAD_PROCESS_MEMORY_ROUTINE64;
  644. FunctionTableAccessRoutine: PFUNCTION_TABLE_ACCESS_ROUTINE64;
  645. GetModuleBaseRoutine: PGET_MODULE_BASE_ROUTINE64;
  646. TranslateAddress: PTRANSLATE_ADDRESS_ROUTINE64): BOOL; stdcall;
  647. {$EXTERNALSYM StackWalk64}
  648. type
  649. PREAD_PROCESS_MEMORY_ROUTINE = function(hProcess: HANDLE;
  650. lpBaseAddress: DWORD; lpBuffer: PVOID; nSize: DWORD;
  651. var lpNumberOfBytesRead: DWORD): BOOL; stdcall;
  652. {$EXTERNALSYM PREAD_PROCESS_MEMORY_ROUTINE}
  653. PreadProcessMemoryRoutine = PREAD_PROCESS_MEMORY_ROUTINE;
  654. PFUNCTION_TABLE_ACCESS_ROUTINE = function(hProcess: HANDLE; AddrBase: DWORD): PVOID; stdcall;
  655. {$EXTERNALSYM PFUNCTION_TABLE_ACCESS_ROUTINE}
  656. PFunctionTableAccessRoutine = PFUNCTION_TABLE_ACCESS_ROUTINE;
  657. PGET_MODULE_BASE_ROUTINE = function(hProcess: HANDLE; Address: DWORD): DWORD; stdcall;
  658. {$EXTERNALSYM PGET_MODULE_BASE_ROUTINE}
  659. PGetModuleBaseRoutine = PGET_MODULE_BASE_ROUTINE;
  660. PTRANSLATE_ADDRESS_ROUTINE = function(hProcess: HANDLE; hThread: HANDLE;
  661. const lpaddr: ADDRESS): DWORD; stdcall;
  662. {$EXTERNALSYM PTRANSLATE_ADDRESS_ROUTINE}
  663. PTranslateAddressRoutine = PTRANSLATE_ADDRESS_ROUTINE;
  664. function StackWalk(MachineType: DWORD; hProcess: HANDLE; hThread: HANDLE;
  665. var StackFrame: STACKFRAME; ContextRecord: PVOID;
  666. ReadMemoryRoutine: PREAD_PROCESS_MEMORY_ROUTINE;
  667. FunctionTableAccessRoutine: PFUNCTION_TABLE_ACCESS_ROUTINE;
  668. GetModuleBaseRoutine: PGET_MODULE_BASE_ROUTINE;
  669. TranslateAddress: PTRANSLATE_ADDRESS_ROUTINE): BOOL; stdcall;
  670. {$EXTERNALSYM StackWalk}
  671. const
  672. API_VERSION_NUMBER = 9;
  673. {$EXTERNALSYM API_VERSION_NUMBER}
  674. type
  675. LPAPI_VERSION = ^API_VERSION;
  676. {$EXTERNALSYM LPAPI_VERSION}
  677. API_VERSION = record
  678. MajorVersion: USHORT;
  679. MinorVersion: USHORT;
  680. Revision: USHORT;
  681. Reserved: USHORT;
  682. end;
  683. {$EXTERNALSYM API_VERSION}
  684. TApiVersion = API_VERSION;
  685. PApiVersion = LPAPI_VERSION;
  686. function ImagehlpApiVersion: LPAPI_VERSION; stdcall;
  687. {$EXTERNALSYM ImagehlpApiVersion}
  688. function ImagehlpApiVersionEx(const AppVersion: API_VERSION): LPAPI_VERSION; stdcall;
  689. {$EXTERNALSYM ImagehlpApiVersionEx}
  690. function GetTimestampForLoadedLibrary(Module: HMODULE): DWORD; stdcall;
  691. {$EXTERNALSYM GetTimestampForLoadedLibrary}
  692. //
  693. // typedefs for function pointers
  694. //
  695. type
  696. PSYM_ENUMMODULES_CALLBACK64 = function(ModuleName: PSTR; BaseOfDll: DWORD64;
  697. UserContext: PVOID): BOOL; stdcall;
  698. {$EXTERNALSYM PSYM_ENUMMODULES_CALLBACK64}
  699. PSymEnummodulesCallback64 = PSYM_ENUMMODULES_CALLBACK64;
  700. PSYM_ENUMSYMBOLS_CALLBACK64 = function(SymbolName: PSTR; SymbolAddress: DWORD64;
  701. SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  702. {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK64}
  703. PSymEnumsymbolsCallback64 = PSYM_ENUMSYMBOLS_CALLBACK64;
  704. PSYM_ENUMSYMBOLS_CALLBACK64W = function(SymbolName: PWSTR;
  705. SymbolAddress: DWORD64; SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  706. {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK64W}
  707. PSymEnumsymbolsCallback64w = PSYM_ENUMSYMBOLS_CALLBACK64W;
  708. PENUMLOADED_MODULES_CALLBACK64 = function(ModuleName: PSTR;
  709. ModuleBase: DWORD64; ModuleSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  710. {$EXTERNALSYM PENUMLOADED_MODULES_CALLBACK64}
  711. PSnumloadedModulesCallback64 = PENUMLOADED_MODULES_CALLBACK64;
  712. PSYMBOL_REGISTERED_CALLBACK64 = function(hProcess: HANDLE; ActionCode: ULONG;
  713. CallbackData: ULONG64; UserContext: ULONG64): BOOL; stdcall;
  714. {$EXTERNALSYM PSYMBOL_REGISTERED_CALLBACK64}
  715. PSymbolRegisteredCallback64 = PSYMBOL_REGISTERED_CALLBACK64;
  716. PSYMBOL_FUNCENTRY_CALLBACK = function(hProcess: HANDLE; AddrBase: DWORD;
  717. UserContext: PVOID): PVOID; stdcall;
  718. {$EXTERNALSYM PSYMBOL_FUNCENTRY_CALLBACK}
  719. PSymbolFuncentryCallback = PSYMBOL_FUNCENTRY_CALLBACK;
  720. PSYMBOL_FUNCENTRY_CALLBACK64 = function(hProcess: HANDLE; AddrBase: ULONG64;
  721. UserContext: ULONG64): PVOID; stdcall;
  722. {$EXTERNALSYM PSYMBOL_FUNCENTRY_CALLBACK64}
  723. PSymbolFuncentryCallback64 = PSYMBOL_FUNCENTRY_CALLBACK64;
  724. PSYM_ENUMMODULES_CALLBACK = function(ModuleName: PSTR; BaseOfDll: ULONG;
  725. UserContext: PVOID): BOOL; stdcall;
  726. {$EXTERNALSYM PSYM_ENUMMODULES_CALLBACK}
  727. PSymEnummodulesCallback = PSYM_ENUMMODULES_CALLBACK;
  728. PSYM_ENUMSYMBOLS_CALLBACK = function(SymbolName: PSTR; SymbolAddress: ULONG;
  729. SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  730. {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK}
  731. PSymEnumsymbolsCallback = PSYM_ENUMSYMBOLS_CALLBACK;
  732. PSYM_ENUMSYMBOLS_CALLBACKW = function(SymbolName: PWSTR; SymbolAddress: ULONG;
  733. SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  734. {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACKW}
  735. PSymEnumsymbolsCallbackw = PSYM_ENUMSYMBOLS_CALLBACKW;
  736. PENUMLOADED_MODULES_CALLBACK = function(ModuleName: PSTR; ModuleBase: ULONG;
  737. ModuleSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  738. {$EXTERNALSYM PENUMLOADED_MODULES_CALLBACK}
  739. PEnumloadedModulesCallback = PENUMLOADED_MODULES_CALLBACK;
  740. PSYMBOL_REGISTERED_CALLBACK = function(hProcess: HANDLE; ActionCode: ULONG;
  741. CallbackData: PVOID; UserContext: PVOID): BOOL; stdcall;
  742. {$EXTERNALSYM PSYMBOL_REGISTERED_CALLBACK}
  743. PSymbolRegisteredCallback = PSYMBOL_REGISTERED_CALLBACK;
  744. //
  745. // flags found in SYMBOL_INFO.Flags
  746. //
  747. const
  748. SYMFLAG_VALUEPRESENT = $00000001;
  749. {$EXTERNALSYM SYMFLAG_VALUEPRESENT}
  750. SYMFLAG_REGISTER = $00000008;
  751. {$EXTERNALSYM SYMFLAG_REGISTER}
  752. SYMFLAG_REGREL = $00000010;
  753. {$EXTERNALSYM SYMFLAG_REGREL}
  754. SYMFLAG_FRAMEREL = $00000020;
  755. {$EXTERNALSYM SYMFLAG_FRAMEREL}
  756. SYMFLAG_PARAMETER = $00000040;
  757. {$EXTERNALSYM SYMFLAG_PARAMETER}
  758. SYMFLAG_LOCAL = $00000080;
  759. {$EXTERNALSYM SYMFLAG_LOCAL}
  760. SYMFLAG_CONSTANT = $00000100;
  761. {$EXTERNALSYM SYMFLAG_CONSTANT}
  762. SYMFLAG_EXPORT = $00000200;
  763. {$EXTERNALSYM SYMFLAG_EXPORT}
  764. SYMFLAG_FORWARDER = $00000400;
  765. {$EXTERNALSYM SYMFLAG_FORWARDER}
  766. SYMFLAG_FUNCTION = $00000800;
  767. {$EXTERNALSYM SYMFLAG_FUNCTION}
  768. SYMFLAG_VIRTUAL = $00001000;
  769. {$EXTERNALSYM SYMFLAG_VIRTUAL}
  770. SYMFLAG_THUNK = $00002000;
  771. {$EXTERNALSYM SYMFLAG_THUNK}
  772. SYMFLAG_TLSREL = $00004000;
  773. {$EXTERNALSYM SYMFLAG_TLSREL}
  774. //
  775. // symbol type enumeration
  776. //
  777. type
  778. SYM_TYPE = (
  779. SymNone,
  780. SymCoff,
  781. SymCv,
  782. SymPdb,
  783. SymExport,
  784. SymDeferred,
  785. SymSym, // .sym file
  786. SymDia,
  787. SymVirtual,
  788. NumSymTypes);
  789. {$EXTERNALSYM SYM_TYPE}
  790. TSymType = SYM_TYPE;
  791. //
  792. // symbol data structure
  793. //
  794. PIMAGEHLP_SYMBOL64 = ^IMAGEHLP_SYMBOL64;
  795. {$EXTERNALSYM PIMAGEHLP_SYMBOL64}
  796. _IMAGEHLP_SYMBOL64 = record
  797. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_SYMBOL64)
  798. Address: DWORD64; // virtual address including dll base address
  799. Size: DWORD; // estimated size of symbol, can be zero
  800. Flags: DWORD; // info about the symbols, see the SYMF defines
  801. MaxNameLength: DWORD; // maximum size of symbol name in 'Name'
  802. Name: array [0..0] of CHAR; // symbol name (null terminated string)
  803. end;
  804. {$EXTERNALSYM _IMAGEHLP_SYMBOL64}
  805. IMAGEHLP_SYMBOL64 = _IMAGEHLP_SYMBOL64;
  806. {$EXTERNALSYM IMAGEHLP_SYMBOL64}
  807. TImageHlpSymbol64 = IMAGEHLP_SYMBOL64;
  808. PImageHlpSymbol64 = PIMAGEHLP_SYMBOL64;
  809. _IMAGEHLP_SYMBOL64_PACKAGE = record
  810. sym: IMAGEHLP_SYMBOL64;
  811. name: array [0..MAX_SYM_NAME] of CHAR;
  812. end;
  813. {$EXTERNALSYM _IMAGEHLP_SYMBOL64_PACKAGE}
  814. IMAGEHLP_SYMBOL64_PACKAGE = _IMAGEHLP_SYMBOL64_PACKAGE;
  815. {$EXTERNALSYM IMAGEHLP_SYMBOL64_PACKAGE}
  816. PIMAGEHLP_SYMBOL64_PACKAGE = ^IMAGEHLP_SYMBOL64_PACKAGE;
  817. {$EXTERNALSYM PIMAGEHLP_SYMBOL64_PACKAGE}
  818. TImageHlpSymbol64Package = IMAGEHLP_SYMBOL64_PACKAGE;
  819. PImageHlpSymbol64Package = PIMAGEHLP_SYMBOL64_PACKAGE;
  820. //#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)
  821. //
  822. //#define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64
  823. //#define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64
  824. //#define IMAGEHLP_SYMBOL_PACKAGE IMAGEHLP_SYMBOL64_PACKAGE
  825. //#define PIMAGEHLP_SYMBOL_PACKAGE PIMAGEHLP_SYMBOL64_PACKAGE
  826. //
  827. //#else
  828. PIMAGEHLP_SYMBOL = ^IMAGEHLP_SYMBOL;
  829. {$EXTERNALSYM PIMAGEHLP_SYMBOL}
  830. _IMAGEHLP_SYMBOL = record
  831. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_SYMBOL)
  832. Address: DWORD; // virtual address including dll base address
  833. Size: DWORD; // estimated size of symbol, can be zero
  834. Flags: DWORD; // info about the symbols, see the SYMF defines
  835. MaxNameLength: DWORD; // maximum size of symbol name in 'Name'
  836. Name: array [0..0] of CHAR; // symbol name (null terminated string)
  837. end;
  838. {$EXTERNALSYM _IMAGEHLP_SYMBOL}
  839. IMAGEHLP_SYMBOL = _IMAGEHLP_SYMBOL;
  840. {$EXTERNALSYM IMAGEHLP_SYMBOL}
  841. TImageHlpSymbol = IMAGEHLP_SYMBOL;
  842. PImageHlpSymbol = PIMAGEHLP_SYMBOL;
  843. _IMAGEHLP_SYMBOL_PACKAGE = record
  844. sym: IMAGEHLP_SYMBOL;
  845. name: array [0..MAX_SYM_NAME] of CHAR;
  846. end;
  847. {$EXTERNALSYM _IMAGEHLP_SYMBOL_PACKAGE}
  848. IMAGEHLP_SYMBOL_PACKAGE = _IMAGEHLP_SYMBOL_PACKAGE;
  849. {$EXTERNALSYM IMAGEHLP_SYMBOL_PACKAGE}
  850. PIMAGEHLP_SYMBOL_PACKAGE = ^IMAGEHLP_SYMBOL_PACKAGE;
  851. {$EXTERNALSYM PIMAGEHLP_SYMBOL_PACKAGE}
  852. TImageHlpSymbolPackage = IMAGEHLP_SYMBOL_PACKAGE;
  853. PImageHlpSymbolPackage = PIMAGEHLP_SYMBOL_PACKAGE;
  854. //#endif
  855. //
  856. // module data structure
  857. //
  858. PIMAGEHLP_MODULE64 = ^IMAGEHLP_MODULE64;
  859. {$EXTERNALSYM PIMAGEHLP_MODULE64}
  860. _IMAGEHLP_MODULE64 = record
  861. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE64)
  862. BaseOfImage: DWORD64; // base load address of module
  863. ImageSize: DWORD; // virtual size of the loaded module
  864. TimeDateStamp: DWORD; // date/time stamp from pe header
  865. CheckSum: DWORD; // checksum from the pe header
  866. NumSyms: DWORD; // number of symbols in the symbol table
  867. SymType: SYM_TYPE; // type of symbols loaded
  868. ModuleName: array [0..3] of CHAR; // module name
  869. ImageName: array [0..255] of CHAR; // image name
  870. LoadedImageName: array [0..255] of CHAR; // symbol file name
  871. end;
  872. {$EXTERNALSYM _IMAGEHLP_MODULE64}
  873. IMAGEHLP_MODULE64 = _IMAGEHLP_MODULE64;
  874. {$EXTERNALSYM IMAGEHLP_MODULE64}
  875. TImageHlpModule64 = IMAGEHLP_MODULE64;
  876. PImageHlpModule64 = PIMAGEHLP_MODULE64;
  877. PIMAGEHLP_MODULEW64 = ^IMAGEHLP_MODULEW64;
  878. {$EXTERNALSYM PIMAGEHLP_MODULEW64}
  879. _IMAGEHLP_MODULE64W = record
  880. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE64)
  881. BaseOfImage: DWORD64; // base load address of module
  882. ImageSize: DWORD; // virtual size of the loaded module
  883. TimeDateStamp: DWORD; // date/time stamp from pe header
  884. CheckSum: DWORD; // checksum from the pe header
  885. NumSyms: DWORD; // number of symbols in the symbol table
  886. SymType: SYM_TYPE; // type of symbols loaded
  887. ModuleName: array [0..31] of WCHAR; // module name
  888. ImageName: array [0..255] of WCHAR; // image name
  889. LoadedImageName: array [0..255] of WCHAR; // symbol file name
  890. end;
  891. {$EXTERNALSYM _IMAGEHLP_MODULE64W}
  892. IMAGEHLP_MODULEW64 = _IMAGEHLP_MODULE64W;
  893. {$EXTERNALSYM IMAGEHLP_MODULEW64}
  894. TImageHlpModuleW64 = IMAGEHLP_MODULEW64;
  895. PImageHlpModuleW64 = PIMAGEHLP_MODULEW64;
  896. PIMAGEHLP_MODULE = ^IMAGEHLP_MODULE;
  897. {$EXTERNALSYM PIMAGEHLP_MODULE}
  898. _IMAGEHLP_MODULE = record
  899. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE)
  900. BaseOfImage: DWORD; // base load address of module
  901. ImageSize: DWORD; // virtual size of the loaded module
  902. TimeDateStamp: DWORD; // date/time stamp from pe header
  903. CheckSum: DWORD; // checksum from the pe header
  904. NumSyms: DWORD; // number of symbols in the symbol table
  905. SymType: SYM_TYPE; // type of symbols loaded
  906. ModuleName: array [0..31] of CHAR; // module name
  907. ImageName: array [0..255] of CHAR; // image name
  908. LoadedImageName: array [0..255] of CHAR; // symbol file name
  909. end;
  910. {$EXTERNALSYM _IMAGEHLP_MODULE}
  911. IMAGEHLP_MODULE = _IMAGEHLP_MODULE;
  912. {$EXTERNALSYM IMAGEHLP_MODULE}
  913. TImageHlpModule = IMAGEHLP_MODULE;
  914. PImageHlpModule = PIMAGEHLP_MODULE;
  915. PIMAGEHLP_MODULEW = ^IMAGEHLP_MODULEW;
  916. {$EXTERNALSYM PIMAGEHLP_MODULEW}
  917. _IMAGEHLP_MODULEW = record
  918. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE)
  919. BaseOfImage: DWORD; // base load address of module
  920. ImageSize: DWORD; // virtual size of the loaded module
  921. TimeDateStamp: DWORD; // date/time stamp from pe header
  922. CheckSum: DWORD; // checksum from the pe header
  923. NumSyms: DWORD; // number of symbols in the symbol table
  924. SymType: SYM_TYPE; // type of symbols loaded
  925. ModuleName: array [0..31] of WCHAR; // module name
  926. ImageName: array [0..255] of WCHAR; // image name
  927. LoadedImageName: array [0..255] of WCHAR; // symbol file name
  928. end;
  929. {$EXTERNALSYM _IMAGEHLP_MODULEW}
  930. IMAGEHLP_MODULEW = _IMAGEHLP_MODULEW;
  931. {$EXTERNALSYM IMAGEHLP_MODULEW}
  932. TImageHlpModuleW = IMAGEHLP_MODULEW;
  933. PImageHlpModuleW = PIMAGEHLP_MODULEW;
  934. //
  935. // source file line data structure
  936. //
  937. PIMAGEHLP_LINE64 = ^IMAGEHLP_LINE64;
  938. {$EXTERNALSYM PIMAGEHLP_LINE64}
  939. _IMAGEHLP_LINE64 = record
  940. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_LINE64)
  941. Key: PVOID; // internal
  942. LineNumber: DWORD; // line number in file
  943. FileName: PCHAR; // full filename
  944. Address: DWORD64; // first instruction of line
  945. end;
  946. {$EXTERNALSYM _IMAGEHLP_LINE64}
  947. IMAGEHLP_LINE64 = _IMAGEHLP_LINE64;
  948. {$EXTERNALSYM IMAGEHLP_LINE64}
  949. TImageHlpLine64 = IMAGEHLP_LINE64;
  950. PImageHlpLine64 = PIMAGEHLP_LINE64;
  951. PIMAGEHLP_LINE = ^IMAGEHLP_LINE;
  952. {$EXTERNALSYM PIMAGEHLP_LINE}
  953. _IMAGEHLP_LINE = record
  954. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_LINE)
  955. Key: PVOID; // internal
  956. LineNumber: DWORD; // line number in file
  957. FileName: PCHAR; // full filename
  958. Address: DWORD; // first instruction of line
  959. end;
  960. {$EXTERNALSYM _IMAGEHLP_LINE}
  961. IMAGEHLP_LINE = _IMAGEHLP_LINE;
  962. {$EXTERNALSYM IMAGEHLP_LINE}
  963. TImageHlpLine = IMAGEHLP_LINE;
  964. PImageHlpLine = PIMAGEHLP_LINE;
  965. //
  966. // source file structure
  967. //
  968. type
  969. _SOURCEFILE = record
  970. ModBase: DWORD64; // base address of loaded module
  971. FileName: PCHAR; // full filename of source
  972. end;
  973. {$EXTERNALSYM _SOURCEFILE}
  974. SOURCEFILE = _SOURCEFILE;
  975. {$EXTERNALSYM SOURCEFILE}
  976. PSOURCEFILE = ^SOURCEFILE;
  977. {$EXTERNALSYM PSOURCEFILE}
  978. TSourceFile = SOURCEFILE;
  979. //
  980. // data structures used for registered symbol callbacks
  981. //
  982. const
  983. CBA_DEFERRED_SYMBOL_LOAD_START = $00000001;
  984. {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_START}
  985. CBA_DEFERRED_SYMBOL_LOAD_COMPLETE = $00000002;
  986. {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_COMPLETE}
  987. CBA_DEFERRED_SYMBOL_LOAD_FAILURE = $00000003;
  988. {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_FAILURE}
  989. CBA_SYMBOLS_UNLOADED = $00000004;
  990. {$EXTERNALSYM CBA_SYMBOLS_UNLOADED}
  991. CBA_DUPLICATE_SYMBOL = $00000005;
  992. {$EXTERNALSYM CBA_DUPLICATE_SYMBOL}
  993. CBA_READ_MEMORY = $00000006;
  994. {$EXTERNALSYM CBA_READ_MEMORY}
  995. CBA_DEFERRED_SYMBOL_LOAD_CANCEL = $00000007;
  996. {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_CANCEL}
  997. CBA_SET_OPTIONS = $00000008;
  998. {$EXTERNALSYM CBA_SET_OPTIONS}
  999. CBA_EVENT = $00000010;
  1000. {$EXTERNALSYM CBA_EVENT}
  1001. CBA_DEFERRED_SYMBOL_LOAD_PARTIAL = $00000020;
  1002. {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_PARTIAL}
  1003. CBA_DEBUG_INFO = $10000000;
  1004. {$EXTERNALSYM CBA_DEBUG_INFO}
  1005. type
  1006. PIMAGEHLP_CBA_READ_MEMORY = ^IMAGEHLP_CBA_READ_MEMORY;
  1007. {$EXTERNALSYM PIMAGEHLP_CBA_READ_MEMORY}
  1008. _IMAGEHLP_CBA_READ_MEMORY = record
  1009. addr: DWORD64; // address to read from
  1010. buf: PVOID; // buffer to read to
  1011. bytes: DWORD; // amount of bytes to read
  1012. bytesread: LPDWORD; // pointer to store amount of bytes read
  1013. end;
  1014. {$EXTERNALSYM _IMAGEHLP_CBA_READ_MEMORY}
  1015. IMAGEHLP_CBA_READ_MEMORY = _IMAGEHLP_CBA_READ_MEMORY;
  1016. {$EXTERNALSYM IMAGEHLP_CBA_READ_MEMORY}
  1017. TImageHlpCbaReadMemory = IMAGEHLP_CBA_READ_MEMORY;
  1018. PImageHlpCbaReadMemory = PIMAGEHLP_CBA_READ_MEMORY;
  1019. const
  1020. sevInfo = 0;
  1021. {$EXTERNALSYM sevInfo}
  1022. sevProblem = 1;
  1023. {$EXTERNALSYM sevProblem}
  1024. sevAttn = 2;
  1025. {$EXTERNALSYM sevAttn}
  1026. sevFatal = 3;
  1027. {$EXTERNALSYM sevFatal}
  1028. sevMax = 4; // unused
  1029. {$EXTERNALSYM sevMax}
  1030. type
  1031. _IMAGEHLP_CBA_EVENT = record
  1032. severity: DWORD; // values from sevInfo to sevFatal
  1033. code: DWORD; // numerical code IDs the error
  1034. desc: PCHAR; // may contain a text description of the error
  1035. object_: PVOID; // value dependant upon the error code
  1036. end;
  1037. {$EXTERNALSYM _IMAGEHLP_CBA_EVENT}
  1038. IMAGEHLP_CBA_EVENT = _IMAGEHLP_CBA_EVENT;
  1039. {$EXTERNALSYM IMAGEHLP_CBA_EVENT}
  1040. PIMAGEHLP_CBA_EVENT = ^IMAGEHLP_CBA_EVENT;
  1041. {$EXTERNALSYM PIMAGEHLP_CBA_EVENT}
  1042. TImageHlpCbaEvent = IMAGEHLP_CBA_EVENT;
  1043. PImageHlpCbaEvent = PIMAGEHLP_CBA_EVENT;
  1044. PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 = ^IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
  1045. {$EXTERNALSYM PIMAGEHLP_DEFERRED_SYMBOL_LOAD64}
  1046. _IMAGEHLP_DEFERRED_SYMBOL_LOAD64 = record
  1047. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64)
  1048. BaseOfImage: DWORD64; // base load address of module
  1049. CheckSum: DWORD; // checksum from the pe header
  1050. TimeDateStamp: DWORD; // date/time stamp from pe header
  1051. FileName: array [0..MAX_PATH - 1] of CHAR; // symbols file or image name
  1052. Reparse: ByteBool; // load failure reparse
  1053. hFile: HANDLE; // file handle, if passed
  1054. Flags: DWORD; //
  1055. end;
  1056. {$EXTERNALSYM _IMAGEHLP_DEFERRED_SYMBOL_LOAD64}
  1057. IMAGEHLP_DEFERRED_SYMBOL_LOAD64 = _IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
  1058. {$EXTERNALSYM IMAGEHLP_DEFERRED_SYMBOL_LOAD64}
  1059. TImageHlpDeferredSymbolLoad64 = IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
  1060. PImageHlpDeferredSymbolLoad64 = PIMAGEHLP_DEFERRED_SYMBOL_LOAD64;
  1061. const
  1062. DSLFLAG_MISMATCHED_PDB = $1;
  1063. {$EXTERNALSYM DSLFLAG_MISMATCHED_PDB}
  1064. DSLFLAG_MISMATCHED_DBG = $2;
  1065. {$EXTERNALSYM DSLFLAG_MISMATCHED_DBG}
  1066. type
  1067. PIMAGEHLP_DEFERRED_SYMBOL_LOAD = ^IMAGEHLP_DEFERRED_SYMBOL_LOAD;
  1068. {$EXTERNALSYM PIMAGEHLP_DEFERRED_SYMBOL_LOAD}
  1069. _IMAGEHLP_DEFERRED_SYMBOL_LOAD = record
  1070. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD)
  1071. BaseOfImage: DWORD; // base load address of module
  1072. CheckSum: DWORD; // checksum from the pe header
  1073. TimeDateStamp: DWORD; // date/time stamp from pe header
  1074. FileName: array [0..MAX_PATH - 1] of CHAR; // symbols file or image name
  1075. Reparse: ByteBool; // load failure reparse
  1076. hFile: HANDLE; // file handle, if passed
  1077. end;
  1078. {$EXTERNALSYM _IMAGEHLP_DEFERRED_SYMBOL_LOAD}
  1079. IMAGEHLP_DEFERRED_SYMBOL_LOAD = _IMAGEHLP_DEFERRED_SYMBOL_LOAD;
  1080. {$EXTERNALSYM IMAGEHLP_DEFERRED_SYMBOL_LOAD}
  1081. TImageHlpDeferredSymbolLoad = IMAGEHLP_DEFERRED_SYMBOL_LOAD;
  1082. PImageHlpDeferredSymbolLoad = PIMAGEHLP_DEFERRED_SYMBOL_LOAD;
  1083. PIMAGEHLP_DUPLICATE_SYMBOL64 = ^IMAGEHLP_DUPLICATE_SYMBOL64;
  1084. {$EXTERNALSYM PIMAGEHLP_DUPLICATE_SYMBOL64}
  1085. _IMAGEHLP_DUPLICATE_SYMBOL64 = record
  1086. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL64)
  1087. NumberOfDups: DWORD; // number of duplicates in the Symbol array
  1088. Symbol: PIMAGEHLP_SYMBOL64; // array of duplicate symbols
  1089. SelectedSymbol: DWORD; // symbol selected (-1 to start)
  1090. end;
  1091. {$EXTERNALSYM _IMAGEHLP_DUPLICATE_SYMBOL64}
  1092. IMAGEHLP_DUPLICATE_SYMBOL64 = _IMAGEHLP_DUPLICATE_SYMBOL64;
  1093. {$EXTERNALSYM IMAGEHLP_DUPLICATE_SYMBOL64}
  1094. TImageHlpDuplicateSymbol64 = IMAGEHLP_DUPLICATE_SYMBOL64;
  1095. PImageHlpDuplicateSymbol64 = PIMAGEHLP_DUPLICATE_SYMBOL64;
  1096. PIMAGEHLP_DUPLICATE_SYMBOL = ^IMAGEHLP_DUPLICATE_SYMBOL;
  1097. {$EXTERNALSYM PIMAGEHLP_DUPLICATE_SYMBOL}
  1098. _IMAGEHLP_DUPLICATE_SYMBOL = record
  1099. SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL)
  1100. NumberOfDups: DWORD; // number of duplicates in the Symbol array
  1101. Symbol: PIMAGEHLP_SYMBOL; // array of duplicate symbols
  1102. SelectedSymbol: DWORD; // symbol selected (-1 to start)
  1103. end;
  1104. {$EXTERNALSYM _IMAGEHLP_DUPLICATE_SYMBOL}
  1105. IMAGEHLP_DUPLICATE_SYMBOL = _IMAGEHLP_DUPLICATE_SYMBOL;
  1106. {$EXTERNALSYM IMAGEHLP_DUPLICATE_SYMBOL}
  1107. TImageHlpDuplicateSymbol = IMAGEHLP_DUPLICATE_SYMBOL;
  1108. PImageHlpDuplicateSymbol = PIMAGEHLP_DUPLICATE_SYMBOL;
  1109. // If dbghelp ever needs to display graphical UI, it will use this as the parent window.
  1110. //BOOL
  1111. //SymSetParentWindow(
  1112. // HWND hwnd
  1113. // );
  1114. //
  1115. // options that are set/returned by SymSetOptions() & SymGetOptions()
  1116. // these are used as a mask
  1117. //
  1118. const
  1119. SYMOPT_CASE_INSENSITIVE = $00000001;
  1120. {$EXTERNALSYM SYMOPT_CASE_INSENSITIVE}
  1121. SYMOPT_UNDNAME = $00000002;
  1122. {$EXTERNALSYM SYMOPT_UNDNAME}
  1123. SYMOPT_DEFERRED_LOADS = $00000004;
  1124. {$EXTERNALSYM SYMOPT_DEFERRED_LOADS}
  1125. SYMOPT_NO_CPP = $00000008;
  1126. {$EXTERNALSYM SYMOPT_NO_CPP}
  1127. SYMOPT_LOAD_LINES = $00000010;
  1128. {$EXTERNALSYM SYMOPT_LOAD_LINES}
  1129. SYMOPT_OMAP_FIND_NEAREST = $00000020;
  1130. {$EXTERNALSYM SYMOPT_OMAP_FIND_NEAREST}
  1131. SYMOPT_LOAD_ANYTHING = $00000040;
  1132. {$EXTERNALSYM SYMOPT_LOAD_ANYTHING}
  1133. SYMOPT_IGNORE_CVREC = $00000080;
  1134. {$EXTERNALSYM SYMOPT_IGNORE_CVREC}
  1135. SYMOPT_NO_UNQUALIFIED_LOADS = $00000100;
  1136. {$EXTERNALSYM SYMOPT_NO_UNQUALIFIED_LOADS}
  1137. SYMOPT_FAIL_CRITICAL_ERRORS = $00000200;
  1138. {$EXTERNALSYM SYMOPT_FAIL_CRITICAL_ERRORS}
  1139. SYMOPT_EXACT_SYMBOLS = $00000400;
  1140. {$EXTERNALSYM SYMOPT_EXACT_SYMBOLS}
  1141. SYMOPT_ALLOW_ABSOLUTE_SYMBOLS = $00000800;
  1142. {$EXTERNALSYM SYMOPT_ALLOW_ABSOLUTE_SYMBOLS}
  1143. SYMOPT_IGNORE_NT_SYMPATH = $00001000;
  1144. {$EXTERNALSYM SYMOPT_IGNORE_NT_SYMPATH}
  1145. SYMOPT_INCLUDE_32BIT_MODULES = $00002000;
  1146. {$EXTERNALSYM SYMOPT_INCLUDE_32BIT_MODULES}
  1147. SYMOPT_PUBLICS_ONLY = $00004000;
  1148. {$EXTERNALSYM SYMOPT_PUBLICS_ONLY}
  1149. SYMOPT_NO_PUBLICS = $00008000;
  1150. {$EXTERNALSYM SYMOPT_NO_PUBLICS}
  1151. SYMOPT_AUTO_PUBLICS = $00010000;
  1152. {$EXTERNALSYM SYMOPT_AUTO_PUBLICS}
  1153. SYMOPT_NO_IMAGE_SEARCH = $00020000;
  1154. {$EXTERNALSYM SYMOPT_NO_IMAGE_SEARCH}
  1155. SYMOPT_SECURE = $00040000;
  1156. {$EXTERNALSYM SYMOPT_SECURE}
  1157. SYMOPT_DEBUG = DWORD($80000000);
  1158. {$EXTERNALSYM SYMOPT_DEBUG}
  1159. function SymSetOptions(SymOptions: DWORD): DWORD; stdcall;
  1160. {$EXTERNALSYM SymSetOptions}
  1161. function SymGetOptions: DWORD; stdcall;
  1162. {$EXTERNALSYM SymGetOptions}
  1163. function SymCleanup(hProcess: HANDLE): BOOL; stdcall;
  1164. {$EXTERNALSYM SymCleanup}
  1165. function SymMatchString(string_, expression: LPSTR; fCase: BOOL): BOOL; stdcall;
  1166. {$EXTERNALSYM SymMatchString}
  1167. type
  1168. PSYM_ENUMSOURCFILES_CALLBACK = function(pSourceFile: PSOURCEFILE; UserContext: PVOID): BOOL; stdcall;
  1169. {$EXTERNALSYM PSYM_ENUMSOURCFILES_CALLBACK}
  1170. PSymEnumSourceFilesCallback = PSYM_ENUMSOURCFILES_CALLBACK;
  1171. function SymEnumSourceFiles(hProcess: HANDLE; ModBase: ULONG64; Mask: LPSTR;
  1172. cbSrcFiles: PSYM_ENUMSOURCFILES_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1173. {$EXTERNALSYM SymEnumSourceFiles}
  1174. function SymEnumerateModules64(hProcess: HANDLE; EnumModulesCallback: PSYM_ENUMMODULES_CALLBACK64;
  1175. UserContext: PVOID): BOOL; stdcall;
  1176. {$EXTERNALSYM SymEnumerateModules64}
  1177. function SymEnumerateModules(hProcess: HANDLE; EnumModulesCallback: PSYM_ENUMMODULES_CALLBACK;
  1178. UserContext: PVOID): BOOL; stdcall;
  1179. {$EXTERNALSYM SymEnumerateModules}
  1180. function SymEnumerateSymbols64(hProcess: HANDLE; BaseOfDll: DWORD64;
  1181. EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK64; UserContext: PVOID): BOOL; stdcall;
  1182. {$EXTERNALSYM SymEnumerateSymbols64}
  1183. function SymEnumerateSymbolsW64(hProcess: HANDLE; BaseOfDll: DWORD64;
  1184. EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK64W; UserContext: PVOID): BOOL; stdcall;
  1185. {$EXTERNALSYM SymEnumerateSymbolsW64}
  1186. function SymEnumerateSymbols(hProcess: HANDLE; BaseOfDll: DWORD;
  1187. EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1188. {$EXTERNALSYM SymEnumerateSymbols}
  1189. function SymEnumerateSymbolsW(hProcess: HANDLE; BaseOfDll: DWORD;
  1190. EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACKW; UserContext: PVOID): BOOL; stdcall;
  1191. {$EXTERNALSYM SymEnumerateSymbolsW}
  1192. function EnumerateLoadedModules64(hProcess: HANDLE; EnumLoadedModulesCallback: PENUMLOADED_MODULES_CALLBACK64;
  1193. UserContext: PVOID): BOOL; stdcall;
  1194. {$EXTERNALSYM EnumerateLoadedModules64}
  1195. function EnumerateLoadedModules(hProcess: HANDLE; EnumLoadedModulesCallback: PENUMLOADED_MODULES_CALLBACK;
  1196. UserContext: PVOID): BOOL; stdcall;
  1197. {$EXTERNALSYM EnumerateLoadedModules}
  1198. function SymFunctionTableAccess64(hProcess: HANDLE; AddrBase: DWORD64): PVOID; stdcall;
  1199. {$EXTERNALSYM SymFunctionTableAccess64}
  1200. function SymFunctionTableAccess(hProcess: HANDLE; AddrBase: DWORD): PVOID; stdcall;
  1201. {$EXTERNALSYM SymFunctionTableAccess}
  1202. function SymGetModuleInfo64(hProcess: HANDLE; qwAddr: DWORD64;
  1203. var ModuleInfo: IMAGEHLP_MODULE64): BOOL; stdcall;
  1204. {$EXTERNALSYM SymGetModuleInfo64}
  1205. function SymGetModuleInfoW64(hProcess: HANDLE; qwAddr: DWORD64;
  1206. var ModuleInfo: IMAGEHLP_MODULEW64): BOOL; stdcall;
  1207. {$EXTERNALSYM SymGetModuleInfoW64}
  1208. function SymGetModuleInfo(hProcess: HANDLE; dwAddr: DWORD;
  1209. var ModuleInfo: IMAGEHLP_MODULE): BOOL; stdcall;
  1210. {$EXTERNALSYM SymGetModuleInfo}
  1211. function SymGetModuleInfoW(hProcess: HANDLE; dwAddr: DWORD;
  1212. var ModuleInfo: IMAGEHLP_MODULEW): BOOL; stdcall;
  1213. {$EXTERNALSYM SymGetModuleInfoW}
  1214. function SymGetModuleBase64(hProcess: HANDLE; qwAddr: DWORD64): DWORD64; stdcall;
  1215. {$EXTERNALSYM SymGetModuleBase64}
  1216. function SymGetModuleBase(hProcess: HANDLE; dwAddr: DWORD): DWORD; stdcall;
  1217. {$EXTERNALSYM SymGetModuleBase}
  1218. function SymGetSymNext64(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL64): BOOL; stdcall;
  1219. {$EXTERNALSYM SymGetSymNext64}
  1220. function SymGetSymNext(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL): BOOL; stdcall;
  1221. {$EXTERNALSYM SymGetSymNext}
  1222. function SymGetSymPrev64(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL64): BOOL; stdcall;
  1223. {$EXTERNALSYM SymGetSymPrev64}
  1224. function SymGetSymPrev(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL): BOOL; stdcall;
  1225. {$EXTERNALSYM SymGetSymPrev}
  1226. function SymGetLineFromAddr64(hProcess: HANDLE; qwAddr: DWORD64;
  1227. var pdwDisplacement: DWORD; var Line64: IMAGEHLP_LINE64): BOOL; stdcall;
  1228. {$EXTERNALSYM SymGetLineFromAddr64}
  1229. function SymGetLineFromAddr(hProcess: HANDLE; dwAddr: DWORD;
  1230. var pdwDisplacement: DWORD; var Line: IMAGEHLP_LINE): BOOL; stdcall;
  1231. {$EXTERNALSYM SymGetLineFromAddr}
  1232. function SymGetLineFromName64(hProcess: HANDLE; ModuleName: PSTR; FileName: PSTR;
  1233. dwLineNumber: DWORD; var plDisplacement: LONG; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
  1234. {$EXTERNALSYM SymGetLineFromName64}
  1235. function SymGetLineFromName(hProcess: HANDLE; ModuleName: PSTR; FileName: PSTR;
  1236. dwLineNumber: DWORD; var plDisplacement: LONG; var Line: IMAGEHLP_LINE): BOOL; stdcall;
  1237. {$EXTERNALSYM SymGetLineFromName}
  1238. function SymGetLineNext64(hProcess: HANDLE; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
  1239. {$EXTERNALSYM SymGetLineNext64}
  1240. function SymGetLineNext(hProcess: HANDLE; var Line: IMAGEHLP_LINE): BOOL; stdcall;
  1241. {$EXTERNALSYM SymGetLineNext}
  1242. function SymGetLinePrev64(hProcess: HANDLE; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
  1243. {$EXTERNALSYM SymGetLinePrev64}
  1244. function SymGetLinePrev(hProcess: HANDLE; var Line: IMAGEHLP_LINE): BOOL; stdcall;
  1245. {$EXTERNALSYM SymGetLinePrev}
  1246. function SymMatchFileName(FileName, Match: PSTR; var FileNameStop, MatchStop: PSTR): BOOL; stdcall;
  1247. {$EXTERNALSYM SymMatchFileName}
  1248. function SymInitialize(hProcess: HANDLE; UserSearchPath: PSTR; fInvadeProcess: BOOL): BOOL; stdcall;
  1249. {$EXTERNALSYM SymInitialize}
  1250. function SymGetSearchPath(hProcess: HANDLE; SearchPath: PSTR; SearchPathLength: DWORD): BOOL; stdcall;
  1251. {$EXTERNALSYM SymGetSearchPath}
  1252. function SymSetSearchPath(hProcess: HANDLE; SearchPath: PSTR): BOOL; stdcall;
  1253. {$EXTERNALSYM SymSetSearchPath}
  1254. function SymLoadModule64(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR;
  1255. BaseOfDll: DWORD64; SizeOfDll: DWORD): DWORD64; stdcall;
  1256. {$EXTERNALSYM SymLoadModule64}
  1257. const
  1258. SLMFLAG_VIRTUAL = $1;
  1259. {$EXTERNALSYM SLMFLAG_VIRTUAL}
  1260. function SymLoadModuleEx(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR; BaseOfDll: DWORD64;
  1261. DllSize: DWORD; Data: PMODLOAD_DATA; Flag: DWORD): DWORD64; stdcall;
  1262. {$EXTERNALSYM SymLoadModuleEx}
  1263. function SymLoadModule(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR;
  1264. BaseOfDll: DWORD; SizeOfDll: DWORD): DWORD; stdcall;
  1265. {$EXTERNALSYM SymLoadModule}
  1266. function SymUnloadModule64(hProcess: HANDLE; BaseOfDll: DWORD64): BOOL; stdcall;
  1267. {$EXTERNALSYM SymUnloadModule64}
  1268. function SymUnloadModule(hProcess: HANDLE; BaseOfDll: DWORD): BOOL; stdcall;
  1269. {$EXTERNALSYM SymUnloadModule}
  1270. function SymUnDName64(const sym: IMAGEHLP_SYMBOL64; UnDecName: PSTR;
  1271. UnDecNameLength: DWORD): BOOL; stdcall;
  1272. {$EXTERNALSYM SymUnDName64}
  1273. function SymUnDName(const sym: IMAGEHLP_SYMBOL; UnDecName: PSTR;
  1274. UnDecNameLength: DWORD): BOOL; stdcall;
  1275. {$EXTERNALSYM SymUnDName}
  1276. function SymRegisterCallback64(hProcess: HANDLE; CallbackFunction: PSYMBOL_REGISTERED_CALLBACK64;
  1277. UserContext: ULONG64): BOOL; stdcall;
  1278. {$EXTERNALSYM SymRegisterCallback64}
  1279. function SymRegisterFunctionEntryCallback64(hProcess: HANDLE; CallbackFunction: PSYMBOL_FUNCENTRY_CALLBACK64;
  1280. UserContext: ULONG64): BOOL; stdcall;
  1281. {$EXTERNALSYM SymRegisterFunctionEntryCallback64}
  1282. function SymRegisterCallback(hProcess: HANDLE; CallbackFunction: PSYMBOL_REGISTERED_CALLBACK;
  1283. UserContext: PVOID): BOOL; stdcall;
  1284. {$EXTERNALSYM SymRegisterCallback}
  1285. function SymRegisterFunctionEntryCallback(hProcess: HANDLE; CallbackFunction: PSYMBOL_FUNCENTRY_CALLBACK;
  1286. UserContext: PVOID): BOOL; stdcall;
  1287. {$EXTERNALSYM SymRegisterFunctionEntryCallback}
  1288. type
  1289. PIMAGEHLP_SYMBOL_SRC = ^IMAGEHLP_SYMBOL_SRC;
  1290. {$EXTERNALSYM PIMAGEHLP_SYMBOL_SRC}
  1291. _IMAGEHLP_SYMBOL_SRC = record
  1292. sizeofstruct: DWORD;
  1293. type_: DWORD;
  1294. file_: array [0..MAX_PATH - 1] of Char;
  1295. end;
  1296. {$EXTERNALSYM _IMAGEHLP_SYMBOL_SRC}
  1297. IMAGEHLP_SYMBOL_SRC = _IMAGEHLP_SYMBOL_SRC;
  1298. {$EXTERNALSYM IMAGEHLP_SYMBOL_SRC}
  1299. TImageHlpSymbolSrc = IMAGEHLP_SYMBOL_SRC;
  1300. PImageHlpSymbolSrc = PIMAGEHLP_SYMBOL_SRC;
  1301. PMODULE_TYPE_INFO = ^MODULE_TYPE_INFO;
  1302. {$EXTERNALSYM PMODULE_TYPE_INFO}
  1303. _MODULE_TYPE_INFO = record
  1304. dataLength: USHORT;
  1305. leaf: USHORT;
  1306. data: array [0..0] of BYTE;
  1307. end;
  1308. {$EXTERNALSYM _MODULE_TYPE_INFO}
  1309. MODULE_TYPE_INFO = _MODULE_TYPE_INFO;
  1310. {$EXTERNALSYM MODULE_TYPE_INFO}
  1311. TModuleTypeInfo = MODULE_TYPE_INFO;
  1312. PModuleTypeInfo = PMODULE_TYPE_INFO;
  1313. type
  1314. PSYMBOL_INFO = ^SYMBOL_INFO;
  1315. {$EXTERNALSYM PSYMBOL_INFO}
  1316. _SYMBOL_INFO = record
  1317. SizeOfStruct: ULONG;
  1318. TypeIndex: ULONG; // Type Index of symbol
  1319. Reserved: array [0..1] of ULONG64;
  1320. Info: ULONG;
  1321. Size: ULONG;
  1322. ModBase: ULONG64; // Base Address of module comtaining this symbol
  1323. Flags: ULONG;
  1324. Value: ULONG64; // Value of symbol, ValuePresent should be 1
  1325. Address: ULONG64; // Address of symbol including base address of module
  1326. Register_: ULONG; // register holding value or pointer to value
  1327. Scope: ULONG; // scope of the symbol
  1328. Tag: ULONG; // pdb classification
  1329. NameLen: ULONG; // Actual length of name
  1330. MaxNameLen: ULONG;
  1331. Name: array [0..0] of CHAR; // Name of symbol
  1332. end;
  1333. {$EXTERNALSYM _SYMBOL_INFO}
  1334. SYMBOL_INFO = _SYMBOL_INFO;
  1335. {$EXTERNALSYM SYMBOL_INFO}
  1336. TSymbolInfo = SYMBOL_INFO;
  1337. PSymbolInfo = PSYMBOL_INFO;
  1338. _SYMBOL_INFO_PACKAGE = record
  1339. si: SYMBOL_INFO;
  1340. name: array [0..MAX_SYM_NAME] of CHAR;
  1341. end;
  1342. {$EXTERNALSYM _SYMBOL_INFO_PACKAGE}
  1343. SYMBOL_INFO_PACKAGE = _SYMBOL_INFO_PACKAGE;
  1344. {$EXTERNALSYM SYMBOL_INFO_PACKAGE}
  1345. PSYMBOL_INFO_PACKAGE = ^SYMBOL_INFO_PACKAGE;
  1346. {$EXTERNALSYM PSYMBOL_INFO_PACKAGE}
  1347. TSymbolInfoPackage = SYMBOL_INFO_PACKAGE;
  1348. PSymbolInfoPackage = PSYMBOL_INFO_PACKAGE;
  1349. PIMAGEHLP_STACK_FRAME = ^IMAGEHLP_STACK_FRAME;
  1350. {$EXTERNALSYM PIMAGEHLP_STACK_FRAME}
  1351. _IMAGEHLP_STACK_FRAME = record
  1352. InstructionOffset: ULONG64;
  1353. ReturnOffset: ULONG64;
  1354. FrameOffset: ULONG64;
  1355. StackOffset: ULONG64;
  1356. BackingStoreOffset: ULONG64;
  1357. FuncTableEntry: ULONG64;
  1358. Params: array [0..3] of ULONG64;
  1359. Reserved: array [0..4] of ULONG64;
  1360. Virtual_: BOOL;
  1361. Reserved2: ULONG;
  1362. end;
  1363. {$EXTERNALSYM _IMAGEHLP_STACK_FRAME}
  1364. IMAGEHLP_STACK_FRAME = _IMAGEHLP_STACK_FRAME;
  1365. {$EXTERNALSYM IMAGEHLP_STACK_FRAME}
  1366. TImageHlpStackFrame = IMAGEHLP_STACK_FRAME;
  1367. PImageHlpStackFrame = PIMAGEHLP_STACK_FRAME;
  1368. IMAGEHLP_CONTEXT = LPVOID;
  1369. {$EXTERNALSYM IMAGEHLP_CONTEXT}
  1370. PIMAGEHLP_CONTEXT = ^IMAGEHLP_CONTEXT;
  1371. {$EXTERNALSYM PIMAGEHLP_CONTEXT}
  1372. TImageHlpContext = IMAGEHLP_CONTEXT;
  1373. PImageHlpContext = PIMAGEHLP_CONTEXT;
  1374. function SymSetContext(hProcess: HANDLE; StackFrame: PIMAGEHLP_STACK_FRAME; Context: PIMAGEHLP_CONTEXT): BOOL; stdcall;
  1375. {$EXTERNALSYM SymSetContext}
  1376. function SymFromAddr(hProcess: HANDLE; Address: DWORD64; Displacement: PDWORD64; Symbol: PSYMBOL_INFO): BOOL; stdcall;
  1377. {$EXTERNALSYM SymFromAddr}
  1378. // While SymFromName will provide a symbol from a name,
  1379. // SymEnumSymbols can provide the same matching information
  1380. // for ALL symbols with a matching name, even regular
  1381. // expressions. That way you can search across modules
  1382. // and differentiate between identically named symbols.
  1383. function SymFromName(hProcess: HANDLE; Name: LPSTR; Symbol: PSYMBOL_INFO): BOOL; stdcall;
  1384. {$EXTERNALSYM SymFromName}
  1385. type
  1386. PSYM_ENUMERATESYMBOLS_CALLBACK = function(pSymInfo: PSYMBOL_INFO; SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  1387. {$EXTERNALSYM PSYM_ENUMERATESYMBOLS_CALLBACK}
  1388. PSymEnumerateSymbolsCallback = PSYM_ENUMERATESYMBOLS_CALLBACK;
  1389. function SymEnumSymbols(hProcess: HANDLE; BaseOfDll: ULONG64; Mask: PCSTR; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1390. {$EXTERNALSYM SymEnumSymbols}
  1391. function SymEnumSymbolsForAddr(hProcess: HANDLE; Address: DWORD64;
  1392. EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1393. {$EXTERNALSYM SymEnumSymbolsForAddr}
  1394. type
  1395. _IMAGEHLP_SYMBOL_TYPE_INFO = (
  1396. TI_GET_SYMTAG,
  1397. TI_GET_SYMNAME,
  1398. TI_GET_LENGTH,
  1399. TI_GET_TYPE,
  1400. TI_GET_TYPEID,
  1401. TI_GET_BASETYPE,
  1402. TI_GET_ARRAYINDEXTYPEID,
  1403. TI_FINDCHILDREN,
  1404. TI_GET_DATAKIND,
  1405. TI_GET_ADDRESSOFFSET,
  1406. TI_GET_OFFSET,
  1407. TI_GET_VALUE,
  1408. TI_GET_COUNT,
  1409. TI_GET_CHILDRENCOUNT,
  1410. TI_GET_BITPOSITION,
  1411. TI_GET_VIRTUALBASECLASS,
  1412. TI_GET_VIRTUALTABLESHAPEID,
  1413. TI_GET_VIRTUALBASEPOINTEROFFSET,
  1414. TI_GET_CLASSPARENTID,
  1415. TI_GET_NESTED,
  1416. TI_GET_SYMINDEX,
  1417. TI_GET_LEXICALPARENT,
  1418. TI_GET_ADDRESS,
  1419. TI_GET_THISADJUST,
  1420. TI_GET_UDTKIND,
  1421. TI_IS_EQUIV_TO,
  1422. TI_GET_CALLING_CONVENTION);
  1423. {$EXTERNALSYM _IMAGEHLP_SYMBOL_TYPE_INFO}
  1424. IMAGEHLP_SYMBOL_TYPE_INFO = _IMAGEHLP_SYMBOL_TYPE_INFO;
  1425. {$EXTERNALSYM IMAGEHLP_SYMBOL_TYPE_INFO}
  1426. TImageHlpSymbolTypeInfo = IMAGEHLP_SYMBOL_TYPE_INFO;
  1427. PTI_FINDCHILDREN_PARAMS = ^TI_FINDCHILDREN_PARAMS;
  1428. {$EXTERNALSYM PTI_FINDCHILDREN_PARAMS}
  1429. _TI_FINDCHILDREN_PARAMS = record
  1430. Count: ULONG;
  1431. Start: ULONG;
  1432. ChildId: array [0..0] of ULONG;
  1433. end;
  1434. {$EXTERNALSYM _TI_FINDCHILDREN_PARAMS}
  1435. TI_FINDCHILDREN_PARAMS = _TI_FINDCHILDREN_PARAMS;
  1436. {$EXTERNALSYM TI_FINDCHILDREN_PARAMS}
  1437. TTiFindChildrenParams = TI_FINDCHILDREN_PARAMS;
  1438. PTiFindChildrenParams = PTI_FINDCHILDREN_PARAMS;
  1439. function SymGetTypeInfo(hProcess: HANDLE; ModBase: DWORD64; TypeId: ULONG; GetType: IMAGEHLP_SYMBOL_TYPE_INFO; pInfo: PVOID): BOOL; stdcall;
  1440. {$EXTERNALSYM SymGetTypeInfo}
  1441. function SymEnumTypes(hProcess: HANDLE; BaseOfDll: ULONG64; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1442. {$EXTERNALSYM SymEnumTypes}
  1443. function SymGetTypeFromName(hProcess: HANDLE; BaseOfDll: ULONG64; Name: LPSTR; Symbol: PSYMBOL_INFO): BOOL; stdcall;
  1444. {$EXTERNALSYM SymGetTypeFromName}
  1445. function SymAddSymbol(hProcess: HANDLE; BaseOfDll: ULONG64; Name: PCSTR; Address: DWORD64; Size, Flags: DWORD): BOOL; stdcall;
  1446. {$EXTERNALSYM SymAddSymbol}
  1447. function SymDeleteSymbol(hProcess: HANDLE; BaseOfDll: ULONG64; Name: PCSTR; Address: DWORD64; Flags: DWORD): BOOL; stdcall;
  1448. {$EXTERNALSYM SymDeleteSymbol}
  1449. //
  1450. // Full user-mode dump creation.
  1451. //
  1452. type
  1453. PDBGHELP_CREATE_USER_DUMP_CALLBACK = function(DataType: DWORD; var Data: PVOID; DataLength: LPDWORD; UserData: PVOID): BOOL; stdcall;
  1454. {$EXTERNALSYM PDBGHELP_CREATE_USER_DUMP_CALLBACK}
  1455. PDbgHelpCreateUserDumpCallback = PDBGHELP_CREATE_USER_DUMP_CALLBACK;
  1456. function DbgHelpCreateUserDump(FileName: LPSTR; Callback: PDBGHELP_CREATE_USER_DUMP_CALLBACK; UserData: PVOID): BOOL; stdcall;
  1457. {$EXTERNALSYM DbgHelpCreateUserDump}
  1458. function DbgHelpCreateUserDumpW(FileName: LPWSTR; Callback: PDBGHELP_CREATE_USER_DUMP_CALLBACK; UserData: PVOID): BOOL; stdcall;
  1459. {$EXTERNALSYM DbgHelpCreateUserDumpW}
  1460. // -----------------------------------------------------------------
  1461. // The following 4 legacy APIs are fully supported, but newer
  1462. // ones are recommended. SymFromName and SymFromAddr provide
  1463. // much more detailed info on the returned symbol.
  1464. function SymGetSymFromAddr64(hProcess: HANDLE; qwAddr: DWORD64; pdwDisplacement: PDWORD64; Symbol: PIMAGEHLP_SYMBOL64): BOOL; stdcall;
  1465. {$EXTERNALSYM SymGetSymFromAddr64}
  1466. function SymGetSymFromAddr(hProcess: HANDLE; dwAddr: DWORD; pdwDisplacement: PDWORD; Symbol: PIMAGEHLP_SYMBOL): BOOL; stdcall;
  1467. {$EXTERNALSYM SymGetSymFromAddr}
  1468. // While following two APIs will provide a symbol from a name,
  1469. // SymEnumSymbols can provide the same matching information
  1470. // for ALL symbols with a matching name, even regular
  1471. // expressions. That way you can search across modules
  1472. // and differentiate between identically named symbols.
  1473. function SymGetSymFromName64(hProcess: HANDLE; Name: PSTR; Symbol: PIMAGEHLP_SYMBOL64): BOOL; stdcall;
  1474. {$EXTERNALSYM SymGetSymFromName64}
  1475. function SymGetSymFromName(hProcess: HANDLE; Name: PSTR; Symbol: PIMAGEHLP_SYMBOL): BOOL; stdcall;
  1476. {$EXTERNALSYM SymGetSymFromName}
  1477. // -----------------------------------------------------------------
  1478. // The following APIs exist only for backwards compatibility
  1479. // with a pre-release version documented in an MSDN release.
  1480. // You should use SymFindFileInPath if you want to maintain
  1481. // future compatibility.
  1482. function FindFileInPath(hprocess: HANDLE; SearchPath: LPSTR; FileName: LPSTR; id: PVOID; two: DWORD; three: DWORD; flags: DWORD; FilePath: LPSTR): BOOL; stdcall;
  1483. {$EXTERNALSYM FindFileInPath}
  1484. // You should use SymFindFileInPath if you want to maintain
  1485. // future compatibility.
  1486. function FindFileInSearchPath(hprocess: HANDLE; SearchPath: LPSTR; FileName: LPSTR; one: DWORD; two: DWORD; three: DWORD; FilePath: LPSTR): BOOL; stdcall;
  1487. {$EXTERNALSYM FindFileInSearchPath}
  1488. function SymEnumSym(hProcess: HANDLE; BaseOfDll: ULONG64; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1489. {$EXTERNALSYM SymEnumSym}
  1490. // These values should not be used.
  1491. // They have been replaced by SYMFLAG_ values.
  1492. const
  1493. SYMF_OMAP_GENERATED = $00000001;
  1494. SYMF_OMAP_MODIFIED = $00000002;
  1495. SYMF_REGISTER = $00000008;
  1496. SYMF_REGREL = $00000010;
  1497. SYMF_FRAMEREL = $00000020;
  1498. SYMF_PARAMETER = $00000040;
  1499. SYMF_LOCAL = $00000080;
  1500. SYMF_CONSTANT = $00000100;
  1501. SYMF_EXPORT = $00000200;
  1502. SYMF_FORWARDER = $00000400;
  1503. SYMF_FUNCTION = $00000800;
  1504. SYMF_VIRTUAL = $00001000;
  1505. SYMF_THUNK = $00002000;
  1506. SYMF_TLSREL = $00004000;
  1507. // These values should also not be used.
  1508. // They have been replaced by SYMFLAG_ values.
  1509. IMAGEHLP_SYMBOL_INFO_VALUEPRESENT = 1;
  1510. IMAGEHLP_SYMBOL_INFO_REGISTER = SYMF_REGISTER; // 0x0008
  1511. IMAGEHLP_SYMBOL_INFO_REGRELATIVE = SYMF_REGREL; // 0x0010
  1512. IMAGEHLP_SYMBOL_INFO_FRAMERELATIVE = SYMF_FRAMEREL; // 0x0020
  1513. IMAGEHLP_SYMBOL_INFO_PARAMETER = SYMF_PARAMETER; // 0x0040
  1514. IMAGEHLP_SYMBOL_INFO_LOCAL = SYMF_LOCAL; // 0x0080
  1515. IMAGEHLP_SYMBOL_INFO_CONSTANT = SYMF_CONSTANT; // 0x0100
  1516. IMAGEHLP_SYMBOL_FUNCTION = SYMF_FUNCTION; // 0x0800
  1517. IMAGEHLP_SYMBOL_VIRTUAL = SYMF_VIRTUAL; // 0x1000
  1518. IMAGEHLP_SYMBOL_THUNK = SYMF_THUNK; // 0x2000
  1519. IMAGEHLP_SYMBOL_INFO_TLSRELATIVE = SYMF_TLSREL; // 0x4000
  1520. const
  1521. MINIDUMP_SIGNATURE = 'PMDM';
  1522. {$EXTERNALSYM MINIDUMP_SIGNATURE}
  1523. MINIDUMP_VERSION = 42899;
  1524. {$EXTERNALSYM MINIDUMP_VERSION}
  1525. type
  1526. RVA = DWORD;
  1527. {$EXTERNALSYM RVA}
  1528. RVA64 = ULONG64;
  1529. {$EXTERNALSYM RVA64}
  1530. _MINIDUMP_LOCATION_DESCRIPTOR = record
  1531. DataSize: ULONG32;
  1532. Rva: RVA;
  1533. end;
  1534. {$EXTERNALSYM _MINIDUMP_LOCATION_DESCRIPTOR}
  1535. MINIDUMP_LOCATION_DESCRIPTOR = _MINIDUMP_LOCATION_DESCRIPTOR;
  1536. {$EXTERNALSYM MINIDUMP_LOCATION_DESCRIPTOR}
  1537. TMinidumpLocationDescriptor = MINIDUMP_LOCATION_DESCRIPTOR;
  1538. PMinidumpLocationDescriptor = ^MINIDUMP_LOCATION_DESCRIPTOR;
  1539. _MINIDUMP_LOCATION_DESCRIPTOR64 = record
  1540. DataSize: ULONG64;
  1541. Rva: RVA64;
  1542. end;
  1543. {$EXTERNALSYM _MINIDUMP_LOCATION_DESCRIPTOR64}
  1544. MINIDUMP_LOCATION_DESCRIPTOR64 = _MINIDUMP_LOCATION_DESCRIPTOR64;
  1545. {$EXTERNALSYM MINIDUMP_LOCATION_DESCRIPTOR64}
  1546. TMinidumpLocationDescriptor64 = MINIDUMP_LOCATION_DESCRIPTOR64;
  1547. PMinidumpLocationDescriptor64 = ^MINIDUMP_LOCATION_DESCRIPTOR64;
  1548. PMINIDUMP_MEMORY_DESCRIPTOR = ^MINIDUMP_MEMORY_DESCRIPTOR;
  1549. {$EXTERNALSYM PMINIDUMP_MEMORY_DESCRIPTOR}
  1550. _MINIDUMP_MEMORY_DESCRIPTOR = record
  1551. StartOfMemoryRange: ULONG64;
  1552. Memory: MINIDUMP_LOCATION_DESCRIPTOR;
  1553. end;
  1554. {$EXTERNALSYM _MINIDUMP_MEMORY_DESCRIPTOR}
  1555. MINIDUMP_MEMORY_DESCRIPTOR = _MINIDUMP_MEMORY_DESCRIPTOR;
  1556. {$EXTERNALSYM MINIDUMP_MEMORY_DESCRIPTOR}
  1557. TMinidumpMemoryDescriptor = MINIDUMP_MEMORY_DESCRIPTOR;
  1558. PMinidumpMemoryDescriptor = PMINIDUMP_MEMORY_DESCRIPTOR;
  1559. // DESCRIPTOR64 is used for full-memory minidumps where
  1560. // all of the raw memory is laid out sequentially at the
  1561. // end of the dump. There is no need for individual RVAs
  1562. // as the RVA is the base RVA plus the sum of the preceeding
  1563. // data blocks.
  1564. PMINIDUMP_MEMORY_DESCRIPTOR64 = ^MINIDUMP_MEMORY_DESCRIPTOR64;
  1565. {$EXTERNALSYM PMINIDUMP_MEMORY_DESCRIPTOR64}
  1566. _MINIDUMP_MEMORY_DESCRIPTOR64 = record
  1567. StartOfMemoryRange: ULONG64;
  1568. DataSize: ULONG64;
  1569. end;
  1570. {$EXTERNALSYM _MINIDUMP_MEMORY_DESCRIPTOR64}
  1571. MINIDUMP_MEMORY_DESCRIPTOR64 = _MINIDUMP_MEMORY_DESCRIPTOR64;
  1572. {$EXTERNALSYM MINIDUMP_MEMORY_DESCRIPTOR64}
  1573. TMinidumpMemoryDescriptor64 = MINIDUMP_MEMORY_DESCRIPTOR64;
  1574. PMinidumpMemoryDescriptor64 = PMINIDUMP_MEMORY_DESCRIPTOR64;
  1575. PMINIDUMP_HEADER = ^MINIDUMP_HEADER;
  1576. {$EXTERNALSYM PMINIDUMP_HEADER}
  1577. _MINIDUMP_HEADER = record
  1578. Signature: ULONG32;
  1579. Version: ULONG32;
  1580. NumberOfStreams: ULONG32;
  1581. StreamDirectoryRva: RVA;
  1582. CheckSum: ULONG32;
  1583. U: record
  1584. case Integer of
  1585. 0: (Reserved: ULONG32);
  1586. 1: (TimeDateStamp: ULONG32);
  1587. end;
  1588. Flags: ULONG64;
  1589. end;
  1590. {$EXTERNALSYM _MINIDUMP_HEADER}
  1591. MINIDUMP_HEADER = _MINIDUMP_HEADER;
  1592. {$EXTERNALSYM MINIDUMP_HEADER}
  1593. TMinidumpHeader = MINIDUMP_HEADER;
  1594. PMinidumpHeader = PMINIDUMP_HEADER;
  1595. //
  1596. // The MINIDUMP_HEADER field StreamDirectoryRva points to
  1597. // an array of MINIDUMP_DIRECTORY structures.
  1598. //
  1599. PMINIDUMP_DIRECTORY = ^MINIDUMP_DIRECTORY;
  1600. {$EXTERNALSYM PMINIDUMP_DIRECTORY}
  1601. _MINIDUMP_DIRECTORY = record
  1602. StreamType: ULONG32;
  1603. Location: MINIDUMP_LOCATION_DESCRIPTOR;
  1604. end;
  1605. {$EXTERNALSYM _MINIDUMP_DIRECTORY}
  1606. MINIDUMP_DIRECTORY = _MINIDUMP_DIRECTORY;
  1607. {$EXTERNALSYM MINIDUMP_DIRECTORY}
  1608. TMinidumpDirectory = MINIDUMP_DIRECTORY;
  1609. PMinidumpDirectory = PMINIDUMP_DIRECTORY;
  1610. PMINIDUMP_STRING = ^MINIDUMP_STRING;
  1611. {$EXTERNALSYM PMINIDUMP_STRING}
  1612. _MINIDUMP_STRING = record
  1613. Length: ULONG32; // Length in bytes of the string
  1614. Buffer: PWCHAR; // Variable size buffer
  1615. end;
  1616. {$EXTERNALSYM _MINIDUMP_STRING}
  1617. MINIDUMP_STRING = _MINIDUMP_STRING;
  1618. {$EXTERNALSYM MINIDUMP_STRING}
  1619. TMinidumpString = MINIDUMP_STRING;
  1620. PMinidumpString = PMINIDUMP_STRING;
  1621. //
  1622. // The MINIDUMP_DIRECTORY field StreamType may be one of the following types.
  1623. // Types will be added in the future, so if a program reading the minidump
  1624. // header encounters a stream type it does not understand it should ignore
  1625. // the data altogether. Any tag above LastReservedStream will not be used by
  1626. // the system and is reserved for program-specific information.
  1627. //
  1628. const
  1629. UnusedStream = 0;
  1630. {$EXTERNALSYM UnusedStream}
  1631. ReservedStream0 = 1;
  1632. {$EXTERNALSYM ReservedStream0}
  1633. ReservedStream1 = 2;
  1634. {$EXTERNALSYM ReservedStream1}
  1635. ThreadListStream = 3;
  1636. {$EXTERNALSYM ThreadListStream}
  1637. ModuleListStream = 4;
  1638. {$EXTERNALSYM ModuleListStream}
  1639. MemoryListStream = 5;
  1640. {$EXTERNALSYM MemoryListStream}
  1641. ExceptionStream = 6;
  1642. {$EXTERNALSYM ExceptionStream}
  1643. SystemInfoStream = 7;
  1644. {$EXTERNALSYM SystemInfoStream}
  1645. ThreadExListStream = 8;
  1646. {$EXTERNALSYM ThreadExListStream}
  1647. Memory64ListStream = 9;
  1648. {$EXTERNALSYM Memory64ListStream}
  1649. CommentStreamA = 10;
  1650. {$EXTERNALSYM CommentStreamA}
  1651. CommentStreamW = 11;
  1652. {$EXTERNALSYM CommentStreamW}
  1653. HandleDataStream = 12;
  1654. {$EXTERNALSYM HandleDataStream}
  1655. FunctionTableStream = 13;
  1656. {$EXTERNALSYM FunctionTableStream}
  1657. UnloadedModuleListStream = 14;
  1658. {$EXTERNALSYM UnloadedModuleListStream}
  1659. MiscInfoStream = 15;
  1660. {$EXTERNALSYM MiscInfoStream}
  1661. LastReservedStream = $ffff;
  1662. {$EXTERNALSYM LastReservedStream}
  1663. type
  1664. _MINIDUMP_STREAM_TYPE = DWORD;
  1665. {$EXTERNALSYM MINIDUMP_STREAM_TYPE}
  1666. MINIDUMP_STREAM_TYPE = _MINIDUMP_STREAM_TYPE;
  1667. {$EXTERNALSYM _MINIDUMP_STREAM_TYPE}
  1668. TMinidumpStreamType = MINIDUMP_STREAM_TYPE;
  1669. //
  1670. // The minidump system information contains processor and
  1671. // Operating System specific information.
  1672. //
  1673. type
  1674. _CPU_INFORMATION = record
  1675. case Integer of
  1676. //
  1677. // X86 platforms use CPUID function to obtain processor information.
  1678. //
  1679. 0: (
  1680. //
  1681. // CPUID Subfunction 0, register EAX (VendorId [0]),
  1682. // EBX (VendorId [1]) and ECX (VendorId [2]).
  1683. //
  1684. VendorId: array [0..2] of ULONG32;
  1685. //
  1686. // CPUID Subfunction 1, register EAX
  1687. //
  1688. VersionInformation: ULONG32;
  1689. //
  1690. // CPUID Subfunction 1, register EDX
  1691. //
  1692. FeatureInformation: ULONG32;
  1693. //
  1694. // CPUID, Subfunction 80000001, register EBX. This will only
  1695. // be obtained if the vendor id is "AuthenticAMD".
  1696. //
  1697. AMDExtendedCpuFeatures: ULONG32);
  1698. //
  1699. // Non-x86 platforms use processor feature flags.
  1700. //
  1701. 1: (
  1702. ProcessorFeatures: array [0..1] of ULONG64);
  1703. end;
  1704. _MINIDUMP_SYSTEM_INFO = record
  1705. //
  1706. // ProcessorArchitecture, ProcessorLevel and ProcessorRevision are all
  1707. // taken from the SYSTEM_INFO structure obtained by GetSystemInfo( ).
  1708. //
  1709. ProcessorArchitecture: USHORT;
  1710. ProcessorLevel: USHORT;
  1711. ProcessorRevision: USHORT;
  1712. U: record
  1713. case Integer of
  1714. 0: (Reserved0: USHORT);
  1715. 1: (
  1716. NumberOfProcessors: UCHAR;
  1717. ProductType: UCHAR);
  1718. end;
  1719. //
  1720. // MajorVersion, MinorVersion, BuildNumber, PlatformId and
  1721. // CSDVersion are all taken from the OSVERSIONINFO structure
  1722. // returned by GetVersionEx( ).
  1723. //
  1724. MajorVersion: ULONG32;
  1725. MinorVersion: ULONG32;
  1726. BuildNumber: ULONG32;
  1727. PlatformId: ULONG32;
  1728. //
  1729. // RVA to a CSDVersion string in the string table.
  1730. //
  1731. CSDVersionRva: RVA;
  1732. U2: record
  1733. case Integer of
  1734. 0: (Reserved1: ULONG32);
  1735. 1: (
  1736. SuiteMask: USHORT;
  1737. Reserved2: USHORT);
  1738. end;
  1739. //
  1740. // CPU information is obtained from one of two places.
  1741. //
  1742. // 1) On x86 computers, CPU_INFORMATION is obtained from the CPUID
  1743. // instruction. You must use the X86 portion of the union for X86
  1744. // computers.
  1745. //
  1746. // 2) On non-x86 architectures, CPU_INFORMATION is obtained by calling
  1747. // IsProcessorFeatureSupported().
  1748. //
  1749. Cpu: _CPU_INFORMATION;
  1750. end;
  1751. {$EXTERNALSYM _MINIDUMP_SYSTEM_INFO}
  1752. MINIDUMP_SYSTEM_INFO = _MINIDUMP_SYSTEM_INFO;
  1753. {$EXTERNALSYM MINIDUMP_SYSTEM_INFO}
  1754. PMINIDUMP_SYSTEM_INFO = ^MINIDUMP_SYSTEM_INFO;
  1755. {$EXTERNALSYM PMINIDUMP_SYSTEM_INFO}
  1756. TMinidumpSystemInfo = MINIDUMP_SYSTEM_INFO;
  1757. PMinidumpSystemInfo = PMINIDUMP_SYSTEM_INFO;
  1758. CPU_INFORMATION = _CPU_INFORMATION;
  1759. {$EXTERNALSYM CPU_INFORMATION}
  1760. PCPU_INFORMATION = CPU_INFORMATION;
  1761. {$EXTERNALSYM PCPU_INFORMATION}
  1762. //
  1763. // The minidump thread contains standard thread
  1764. // information plus an RVA to the memory for this
  1765. // thread and an RVA to the CONTEXT structure for
  1766. // this thread.
  1767. //
  1768. //
  1769. // ThreadId must be 4 bytes on all architectures.
  1770. //
  1771. // C_ASSERT (sizeof ( ((PPROCESS_INFORMATION)0)->dwThreadId ) == 4);
  1772. type
  1773. PMINIDUMP_THREAD = ^MINIDUMP_THREAD;
  1774. {$EXTERNALSYM PMINIDUMP_THREAD}
  1775. _MINIDUMP_THREAD = record
  1776. ThreadId: ULONG32;
  1777. SuspendCount: ULONG32;
  1778. PriorityClass: ULONG32;
  1779. Priority: ULONG32;
  1780. Teb: ULONG64;
  1781. Stack: MINIDUMP_MEMORY_DESCRIPTOR;
  1782. ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
  1783. end;
  1784. {$EXTERNALSYM _MINIDUMP_THREAD}
  1785. MINIDUMP_THREAD = _MINIDUMP_THREAD;
  1786. {$EXTERNALSYM MINIDUMP_THREAD}
  1787. TMinidumpThread = MINIDUMP_THREAD;
  1788. PMinidumpThread = PMINIDUMP_THREAD;
  1789. //
  1790. // The thread list is a container of threads.
  1791. //
  1792. PMINIDUMP_THREAD_LIST = ^MINIDUMP_THREAD_LIST;
  1793. {$EXTERNALSYM PMINIDUMP_THREAD_LIST}
  1794. _MINIDUMP_THREAD_LIST = record
  1795. NumberOfThreads: ULONG32;
  1796. Threads: array [0..0] of MINIDUMP_THREAD;
  1797. end;
  1798. {$EXTERNALSYM _MINIDUMP_THREAD_LIST}
  1799. MINIDUMP_THREAD_LIST = _MINIDUMP_THREAD_LIST;
  1800. {$EXTERNALSYM MINIDUMP_THREAD_LIST}
  1801. TMinidumpThreadList = MINIDUMP_THREAD_LIST;
  1802. PMinidumpThreadList = PMINIDUMP_THREAD_LIST;
  1803. PMINIDUMP_THREAD_EX = ^MINIDUMP_THREAD_EX;
  1804. {$EXTERNALSYM PMINIDUMP_THREAD_EX}
  1805. _MINIDUMP_THREAD_EX = record
  1806. ThreadId: ULONG32;
  1807. SuspendCount: ULONG32;
  1808. PriorityClass: ULONG32;
  1809. Priority: ULONG32;
  1810. Teb: ULONG64;
  1811. Stack: MINIDUMP_MEMORY_DESCRIPTOR;
  1812. ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
  1813. BackingStore: MINIDUMP_MEMORY_DESCRIPTOR;
  1814. end;
  1815. {$EXTERNALSYM _MINIDUMP_THREAD_EX}
  1816. MINIDUMP_THREAD_EX = _MINIDUMP_THREAD_EX;
  1817. {$EXTERNALSYM MINIDUMP_THREAD_EX}
  1818. TMinidumpThreadEx = MINIDUMP_THREAD_EX;
  1819. PMinidumpThreadEx = PMINIDUMP_THREAD_EX;
  1820. //
  1821. // The thread list is a container of threads.
  1822. //
  1823. PMINIDUMP_THREAD_EX_LIST = ^MINIDUMP_THREAD_EX_LIST;
  1824. {$EXTERNALSYM PMINIDUMP_THREAD_EX_LIST}
  1825. _MINIDUMP_THREAD_EX_LIST = record
  1826. NumberOfThreads: ULONG32;
  1827. Threads: array [0..0] of MINIDUMP_THREAD_EX;
  1828. end;
  1829. {$EXTERNALSYM _MINIDUMP_THREAD_EX_LIST}
  1830. MINIDUMP_THREAD_EX_LIST = _MINIDUMP_THREAD_EX_LIST;
  1831. {$EXTERNALSYM MINIDUMP_THREAD_EX_LIST}
  1832. TMinidumpThreadExList = MINIDUMP_THREAD_EX_LIST;
  1833. PMinidumpThreadExList = PMINIDUMP_THREAD_EX_LIST;
  1834. //
  1835. // The MINIDUMP_EXCEPTION is the same as EXCEPTION on Win64.
  1836. //
  1837. PMINIDUMP_EXCEPTION = ^MINIDUMP_EXCEPTION;
  1838. {$EXTERNALSYM PMINIDUMP_EXCEPTION}
  1839. _MINIDUMP_EXCEPTION = record
  1840. ExceptionCode: ULONG32;
  1841. ExceptionFlags: ULONG32;
  1842. ExceptionRecord: ULONG64;
  1843. ExceptionAddress: ULONG64;
  1844. NumberParameters: ULONG32;
  1845. __unusedAlignment: ULONG32;
  1846. ExceptionInformation: array [0..EXCEPTION_MAXIMUM_PARAMETERS - 1] of ULONG64;
  1847. end;
  1848. {$EXTERNALSYM _MINIDUMP_EXCEPTION}
  1849. MINIDUMP_EXCEPTION = _MINIDUMP_EXCEPTION;
  1850. {$EXTERNALSYM MINIDUMP_EXCEPTION}
  1851. TMinidumpException = MINIDUMP_EXCEPTION;
  1852. PMinidumpException = PMINIDUMP_EXCEPTION;
  1853. //
  1854. // The exception information stream contains the id of the thread that caused
  1855. // the exception (ThreadId), the exception record for the exception
  1856. // (ExceptionRecord) and an RVA to the thread context where the exception
  1857. // occured.
  1858. //
  1859. PMINIDUMP_EXCEPTION_STREAM = ^MINIDUMP_EXCEPTION_STREAM;
  1860. {$EXTERNALSYM PMINIDUMP_EXCEPTION_STREAM}
  1861. _MINIDUMP_EXCEPTION_STREAM = record
  1862. ThreadId: ULONG32;
  1863. __alignment: ULONG32;
  1864. ExceptionRecord: MINIDUMP_EXCEPTION;
  1865. ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
  1866. end;
  1867. {$EXTERNALSYM _MINIDUMP_EXCEPTION_STREAM}
  1868. MINIDUMP_EXCEPTION_STREAM = _MINIDUMP_EXCEPTION_STREAM;
  1869. {$EXTERNALSYM MINIDUMP_EXCEPTION_STREAM}
  1870. TMinidumpExceptionStream = MINIDUMP_EXCEPTION_STREAM;
  1871. PMinidumpExceptionStream = PMINIDUMP_EXCEPTION_STREAM;
  1872. //
  1873. // The MINIDUMP_MODULE contains information about a
  1874. // a specific module. It includes the CheckSum and
  1875. // the TimeDateStamp for the module so the module
  1876. // can be reloaded during the analysis phase.
  1877. //
  1878. PMINIDUMP_MODULE = ^MINIDUMP_MODULE;
  1879. {$EXTERNALSYM PMINIDUMP_MODULE}
  1880. _MINIDUMP_MODULE = record
  1881. BaseOfImage: ULONG64;
  1882. SizeOfImage: ULONG32;
  1883. CheckSum: ULONG32;
  1884. TimeDateStamp: ULONG32;
  1885. ModuleNameRva: RVA;
  1886. VersionInfo: VS_FIXEDFILEINFO;
  1887. CvRecord: MINIDUMP_LOCATION_DESCRIPTOR;
  1888. MiscRecord: MINIDUMP_LOCATION_DESCRIPTOR;
  1889. Reserved0: ULONG64; // Reserved for future use.
  1890. Reserved1: ULONG64; // Reserved for future use.
  1891. end;
  1892. {$EXTERNALSYM _MINIDUMP_MODULE}
  1893. MINIDUMP_MODULE = _MINIDUMP_MODULE;
  1894. {$EXTERNALSYM MINIDUMP_MODULE}
  1895. TMinidumpModule = MINIDUMP_MODULE;
  1896. PMinidumpModule = PMINIDUMP_MODULE;
  1897. //
  1898. // The minidump module list is a container for modules.
  1899. //
  1900. PMINIDUMP_MODULE_LIST = ^MINIDUMP_MODULE_LIST;
  1901. {$EXTERNALSYM PMINIDUMP_MODULE_LIST}
  1902. _MINIDUMP_MODULE_LIST = record
  1903. NumberOfModules: ULONG32;
  1904. Modules: array [0..0] of MINIDUMP_MODULE;
  1905. end;
  1906. {$EXTERNALSYM _MINIDUMP_MODULE_LIST}
  1907. MINIDUMP_MODULE_LIST = _MINIDUMP_MODULE_LIST;
  1908. {$EXTERNALSYM MINIDUMP_MODULE_LIST}
  1909. TMinidumpModuleList = MINIDUMP_MODULE_LIST;
  1910. PMinidumpModuleList = PMINIDUMP_MODULE_LIST;
  1911. //
  1912. // Memory Ranges
  1913. //
  1914. PMINIDUMP_MEMORY_LIST = ^MINIDUMP_MEMORY_LIST;
  1915. {$EXTERNALSYM PMINIDUMP_MEMORY_LIST}
  1916. _MINIDUMP_MEMORY_LIST = record
  1917. NumberOfMemoryRanges: ULONG32;
  1918. MemoryRanges: array [0..0] of MINIDUMP_MEMORY_DESCRIPTOR;
  1919. end;
  1920. {$EXTERNALSYM _MINIDUMP_MEMORY_LIST}
  1921. MINIDUMP_MEMORY_LIST = _MINIDUMP_MEMORY_LIST;
  1922. {$EXTERNALSYM MINIDUMP_MEMORY_LIST}
  1923. TMinidumpMemoryList = MINIDUMP_MEMORY_LIST;
  1924. PMinidumpMemoryList = PMINIDUMP_MEMORY_LIST;
  1925. PMINIDUMP_MEMORY64_LIST = ^MINIDUMP_MEMORY64_LIST;
  1926. {$EXTERNALSYM PMINIDUMP_MEMORY64_LIST}
  1927. _MINIDUMP_MEMORY64_LIST = record
  1928. NumberOfMemoryRanges: ULONG64;
  1929. BaseRva: RVA64;
  1930. MemoryRanges: array [0..0] of MINIDUMP_MEMORY_DESCRIPTOR64;
  1931. end;
  1932. {$EXTERNALSYM _MINIDUMP_MEMORY64_LIST}
  1933. MINIDUMP_MEMORY64_LIST = _MINIDUMP_MEMORY64_LIST;
  1934. {$EXTERNALSYM MINIDUMP_MEMORY64_LIST}
  1935. TMinidumpMemory64List = MINIDUMP_MEMORY64_LIST;
  1936. PMinidumpMemory64List = PMINIDUMP_MEMORY64_LIST;
  1937. //
  1938. // Support for user supplied exception information.
  1939. //
  1940. PMINIDUMP_EXCEPTION_INFORMATION = ^MINIDUMP_EXCEPTION_INFORMATION;
  1941. {$EXTERNALSYM PMINIDUMP_EXCEPTION_INFORMATION}
  1942. _MINIDUMP_EXCEPTION_INFORMATION = record
  1943. ThreadId: DWORD;
  1944. ExceptionPointers: PEXCEPTION_POINTERS;
  1945. ClientPointers: BOOL;
  1946. end;
  1947. {$EXTERNALSYM _MINIDUMP_EXCEPTION_INFORMATION}
  1948. MINIDUMP_EXCEPTION_INFORMATION = _MINIDUMP_EXCEPTION_INFORMATION;
  1949. {$EXTERNALSYM MINIDUMP_EXCEPTION_INFORMATION}
  1950. TMinidumpExceptionInformation = MINIDUMP_EXCEPTION_INFORMATION;
  1951. PMinidumpExceptionInformation = PMINIDUMP_EXCEPTION_INFORMATION;
  1952. //
  1953. // Support for capturing system handle state at the time of the dump.
  1954. //
  1955. PMINIDUMP_HANDLE_DESCRIPTOR = ^MINIDUMP_HANDLE_DESCRIPTOR;
  1956. {$EXTERNALSYM PMINIDUMP_HANDLE_DESCRIPTOR}
  1957. _MINIDUMP_HANDLE_DESCRIPTOR = record
  1958. Handle: ULONG64;
  1959. TypeNameRva: RVA;
  1960. ObjectNameRva: RVA;
  1961. Attributes: ULONG32;
  1962. GrantedAccess: ULONG32;
  1963. HandleCount: ULONG32;
  1964. PointerCount: ULONG32;
  1965. end;
  1966. {$EXTERNALSYM _MINIDUMP_HANDLE_DESCRIPTOR}
  1967. MINIDUMP_HANDLE_DESCRIPTOR = _MINIDUMP_HANDLE_DESCRIPTOR;
  1968. {$EXTERNALSYM MINIDUMP_HANDLE_DESCRIPTOR}
  1969. TMinidumpHandleDescriptor = MINIDUMP_HANDLE_DESCRIPTOR;
  1970. PMinidumpHandleDescriptor = PMINIDUMP_HANDLE_DESCRIPTOR;
  1971. PMINIDUMP_HANDLE_DATA_STREAM = ^MINIDUMP_HANDLE_DATA_STREAM;
  1972. {$EXTERNALSYM PMINIDUMP_HANDLE_DATA_STREAM}
  1973. _MINIDUMP_HANDLE_DATA_STREAM = record
  1974. SizeOfHeader: ULONG32;
  1975. SizeOfDescriptor: ULONG32;
  1976. NumberOfDescriptors: ULONG32;
  1977. Reserved: ULONG32;
  1978. end;
  1979. {$EXTERNALSYM _MINIDUMP_HANDLE_DATA_STREAM}
  1980. MINIDUMP_HANDLE_DATA_STREAM = _MINIDUMP_HANDLE_DATA_STREAM;
  1981. {$EXTERNALSYM MINIDUMP_HANDLE_DATA_STREAM}
  1982. TMinidumpHandleDataStream = MINIDUMP_HANDLE_DATA_STREAM;
  1983. PMinidumpHandleDataStream = PMINIDUMP_HANDLE_DATA_STREAM;
  1984. //
  1985. // Support for capturing dynamic function table state at the time of the dump.
  1986. //
  1987. PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR = ^MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
  1988. {$EXTERNALSYM PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
  1989. _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR = record
  1990. MinimumAddress: ULONG64;
  1991. MaximumAddress: ULONG64;
  1992. BaseAddress: ULONG64;
  1993. EntryCount: ULONG32;
  1994. SizeOfAlignPad: ULONG32;
  1995. end;
  1996. {$EXTERNALSYM _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
  1997. MINIDUMP_FUNCTION_TABLE_DESCRIPTOR = _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
  1998. {$EXTERNALSYM MINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
  1999. TMinidumpFunctionTableDescriptor = MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
  2000. PMinidumpFunctionTableDescriptor = PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
  2001. PMINIDUMP_FUNCTION_TABLE_STREAM = ^MINIDUMP_FUNCTION_TABLE_STREAM;
  2002. {$EXTERNALSYM PMINIDUMP_FUNCTION_TABLE_STREAM}
  2003. _MINIDUMP_FUNCTION_TABLE_STREAM = record
  2004. SizeOfHeader: ULONG32;
  2005. SizeOfDescriptor: ULONG32;
  2006. SizeOfNativeDescriptor: ULONG32;
  2007. SizeOfFunctionEntry: ULONG32;
  2008. NumberOfDescriptors: ULONG32;
  2009. SizeOfAlignPad: ULONG32;
  2010. end;
  2011. {$EXTERNALSYM _MINIDUMP_FUNCTION_TABLE_STREAM}
  2012. MINIDUMP_FUNCTION_TABLE_STREAM = _MINIDUMP_FUNCTION_TABLE_STREAM;
  2013. {$EXTERNALSYM MINIDUMP_FUNCTION_TABLE_STREAM}
  2014. TMinidumpFunctionTableStream = MINIDUMP_FUNCTION_TABLE_STREAM;
  2015. PMinidumpFunctionTableStream = PMINIDUMP_FUNCTION_TABLE_STREAM;
  2016. //
  2017. // The MINIDUMP_UNLOADED_MODULE contains information about a
  2018. // a specific module that was previously loaded but no
  2019. // longer is. This can help with diagnosing problems where
  2020. // callers attempt to call code that is no longer loaded.
  2021. //
  2022. _MINIDUMP_UNLOADED_MODULE = record
  2023. BaseOfImage: ULONG64;
  2024. SizeOfImage: ULONG32;
  2025. CheckSum: ULONG32;
  2026. TimeDateStamp: ULONG32;
  2027. ModuleNameRva: RVA;
  2028. end;
  2029. {$EXTERNALSYM _MINIDUMP_UNLOADED_MODULE}
  2030. MINIDUMP_UNLOADED_MODULE = _MINIDUMP_UNLOADED_MODULE;
  2031. {$EXTERNALSYM MINIDUMP_UNLOADED_MODULE}
  2032. PMINIDUMP_UNLOADED_MODULE = ^MINIDUMP_UNLOADED_MODULE;
  2033. {$EXTERNALSYM PMINIDUMP_UNLOADED_MODULE}
  2034. TMiniDumpUnloadedModule = MINIDUMP_UNLOADED_MODULE;
  2035. PMiniDumpUnloadedModule = PMINIDUMP_UNLOADED_MODULE;
  2036. //
  2037. // The minidump unloaded module list is a container for unloaded modules.
  2038. //
  2039. _MINIDUMP_UNLOADED_MODULE_LIST = record
  2040. SizeOfHeader: ULONG32;
  2041. SizeOfEntry: ULONG32;
  2042. NumberOfEntries: ULONG32;
  2043. end;
  2044. {$EXTERNALSYM _MINIDUMP_UNLOADED_MODULE_LIST}
  2045. MINIDUMP_UNLOADED_MODULE_LIST = _MINIDUMP_UNLOADED_MODULE_LIST;
  2046. {$EXTERNALSYM MINIDUMP_UNLOADED_MODULE_LIST}
  2047. PMINIDUMP_UNLOADED_MODULE_LIST = ^MINIDUMP_UNLOADED_MODULE_LIST;
  2048. {$EXTERNALSYM PMINIDUMP_UNLOADED_MODULE_LIST}
  2049. TMiniDumpUnloadedModuleList = MINIDUMP_UNLOADED_MODULE_LIST;
  2050. PMiniDumpUnloadedModuleList = PMINIDUMP_UNLOADED_MODULE_LIST;
  2051. //
  2052. // The miscellaneous information stream contains a variety
  2053. // of small pieces of information. A member is valid if
  2054. // it's within the available size and its corresponding
  2055. // bit is set.
  2056. //
  2057. const
  2058. MINIDUMP_MISC1_PROCESS_ID = $00000001;
  2059. {$EXTERNALSYM MINIDUMP_MISC1_PROCESS_ID}
  2060. MINIDUMP_MISC1_PROCESS_TIMES = $00000002;
  2061. {$EXTERNALSYM MINIDUMP_MISC1_PROCESS_TIMES}
  2062. type
  2063. _MINIDUMP_MISC_INFO = record
  2064. SizeOfInfo: ULONG32;
  2065. Flags1: ULONG32;
  2066. ProcessId: ULONG32;
  2067. ProcessCreateTime: ULONG32;
  2068. ProcessUserTime: ULONG32;
  2069. ProcessKernelTime: ULONG32;
  2070. end;
  2071. {$EXTERNALSYM _MINIDUMP_MISC_INFO}
  2072. MINIDUMP_MISC_INFO = _MINIDUMP_MISC_INFO;
  2073. {$EXTERNALSYM MINIDUMP_MISC_INFO}
  2074. PMINIDUMP_MISC_INFO = ^MINIDUMP_MISC_INFO;
  2075. {$EXTERNALSYM PMINIDUMP_MISC_INFO}
  2076. TMiniDumpMiscInfo = MINIDUMP_MISC_INFO;
  2077. PMiniDumpMiscInfo = PMINIDUMP_MISC_INFO;
  2078. //
  2079. // Support for arbitrary user-defined information.
  2080. //
  2081. PMINIDUMP_USER_RECORD = ^MINIDUMP_USER_RECORD;
  2082. {$EXTERNALSYM PMINIDUMP_USER_RECORD}
  2083. _MINIDUMP_USER_RECORD = record
  2084. Type_: ULONG32;
  2085. Memory: MINIDUMP_LOCATION_DESCRIPTOR;
  2086. end;
  2087. {$EXTERNALSYM _MINIDUMP_USER_RECORD}
  2088. MINIDUMP_USER_RECORD = _MINIDUMP_USER_RECORD;
  2089. {$EXTERNALSYM MINIDUMP_USER_RECORD}
  2090. TMinidumpUserRecord = MINIDUMP_USER_RECORD;
  2091. PMinidumpUserRecord = PMINIDUMP_USER_RECORD;
  2092. PMINIDUMP_USER_STREAM = ^MINIDUMP_USER_STREAM;
  2093. {$EXTERNALSYM PMINIDUMP_USER_STREAM}
  2094. _MINIDUMP_USER_STREAM = record
  2095. Type_: ULONG32;
  2096. BufferSize: ULONG;
  2097. Buffer: PVOID;
  2098. end;
  2099. {$EXTERNALSYM _MINIDUMP_USER_STREAM}
  2100. MINIDUMP_USER_STREAM = _MINIDUMP_USER_STREAM;
  2101. {$EXTERNALSYM MINIDUMP_USER_STREAM}
  2102. TMinidumpUserStream = MINIDUMP_USER_STREAM;
  2103. PMinidumpUserStream = PMINIDUMP_USER_STREAM;
  2104. PMINIDUMP_USER_STREAM_INFORMATION = ^MINIDUMP_USER_STREAM_INFORMATION;
  2105. {$EXTERNALSYM PMINIDUMP_USER_STREAM_INFORMATION}
  2106. _MINIDUMP_USER_STREAM_INFORMATION = record
  2107. UserStreamCount: ULONG;
  2108. UserStreamArray: PMINIDUMP_USER_STREAM;
  2109. end;
  2110. {$EXTERNALSYM _MINIDUMP_USER_STREAM_INFORMATION}
  2111. MINIDUMP_USER_STREAM_INFORMATION = _MINIDUMP_USER_STREAM_INFORMATION;
  2112. {$EXTERNALSYM MINIDUMP_USER_STREAM_INFORMATION}
  2113. TMinidumpUserStreamInformation = MINIDUMP_USER_STREAM_INFORMATION;
  2114. PMinidumpUserStreamInformation = PMINIDUMP_USER_STREAM_INFORMATION;
  2115. //
  2116. // Callback support.
  2117. //
  2118. _MINIDUMP_CALLBACK_TYPE = (
  2119. ModuleCallback,
  2120. ThreadCallback,
  2121. ThreadExCallback,
  2122. IncludeThreadCallback,
  2123. IncludeModuleCallback);
  2124. {$EXTERNALSYM _MINIDUMP_CALLBACK_TYPE}
  2125. MINIDUMP_CALLBACK_TYPE = _MINIDUMP_CALLBACK_TYPE;
  2126. {$EXTERNALSYM MINIDUMP_CALLBACK_TYPE}
  2127. TMinidumpCallbackType = MINIDUMP_CALLBACK_TYPE;
  2128. PMINIDUMP_THREAD_CALLBACK = ^MINIDUMP_THREAD_CALLBACK;
  2129. {$EXTERNALSYM PMINIDUMP_THREAD_CALLBACK}
  2130. _MINIDUMP_THREAD_CALLBACK = record
  2131. ThreadId: ULONG;
  2132. ThreadHandle: HANDLE;
  2133. Context: CONTEXT;
  2134. SizeOfContext: ULONG;
  2135. StackBase: ULONG64;
  2136. StackEnd: ULONG64;
  2137. end;
  2138. {$EXTERNALSYM _MINIDUMP_THREAD_CALLBACK}
  2139. MINIDUMP_THREAD_CALLBACK = _MINIDUMP_THREAD_CALLBACK;
  2140. {$EXTERNALSYM MINIDUMP_THREAD_CALLBACK}
  2141. TMinidumpThreadCallback = MINIDUMP_THREAD_CALLBACK;
  2142. PMinidumpThreadCallback = PMINIDUMP_THREAD_CALLBACK;
  2143. PMINIDUMP_THREAD_EX_CALLBACK = ^MINIDUMP_THREAD_EX_CALLBACK;
  2144. {$EXTERNALSYM PMINIDUMP_THREAD_EX_CALLBACK}
  2145. _MINIDUMP_THREAD_EX_CALLBACK = record
  2146. ThreadId: ULONG;
  2147. ThreadHandle: HANDLE;
  2148. Context: CONTEXT;
  2149. SizeOfContext: ULONG;
  2150. StackBase: ULONG64;
  2151. StackEnd: ULONG64;
  2152. BackingStoreBase: ULONG64;
  2153. BackingStoreEnd: ULONG64;
  2154. end;
  2155. {$EXTERNALSYM _MINIDUMP_THREAD_EX_CALLBACK}
  2156. MINIDUMP_THREAD_EX_CALLBACK = _MINIDUMP_THREAD_EX_CALLBACK;
  2157. {$EXTERNALSYM MINIDUMP_THREAD_EX_CALLBACK}
  2158. TMinidumpThreadExCallback = MINIDUMP_THREAD_EX_CALLBACK;
  2159. PMinidumpThreadExCallback = PMINIDUMP_THREAD_EX_CALLBACK;
  2160. PMINIDUMP_INCLUDE_THREAD_CALLBACK = ^MINIDUMP_INCLUDE_THREAD_CALLBACK;
  2161. {$EXTERNALSYM PMINIDUMP_INCLUDE_THREAD_CALLBACK}
  2162. _MINIDUMP_INCLUDE_THREAD_CALLBACK = record
  2163. ThreadId: ULONG;
  2164. end;
  2165. {$EXTERNALSYM _MINIDUMP_INCLUDE_THREAD_CALLBACK}
  2166. MINIDUMP_INCLUDE_THREAD_CALLBACK = _MINIDUMP_INCLUDE_THREAD_CALLBACK;
  2167. {$EXTERNALSYM MINIDUMP_INCLUDE_THREAD_CALLBACK}
  2168. TMinidumpIncludeThreadCallback = MINIDUMP_INCLUDE_THREAD_CALLBACK;
  2169. PMinidumpIncludeThreadCallback = PMINIDUMP_INCLUDE_THREAD_CALLBACK;
  2170. const
  2171. ThreadWriteThread = $0001;
  2172. {$EXTERNALSYM ThreadWriteThread}
  2173. ThreadWriteStack = $0002;
  2174. {$EXTERNALSYM ThreadWriteStack}
  2175. ThreadWriteContext = $0004;
  2176. {$EXTERNALSYM ThreadWriteContext}
  2177. ThreadWriteBackingStore = $0008;
  2178. {$EXTERNALSYM ThreadWriteBackingStore}
  2179. ThreadWriteInstructionWindow = $0010;
  2180. {$EXTERNALSYM ThreadWriteInstructionWindow}
  2181. ThreadWriteThreadData = $0020;
  2182. {$EXTERNALSYM ThreadWriteThreadData}
  2183. type
  2184. _THREAD_WRITE_FLAGS = DWORD;
  2185. {$EXTERNALSYM _THREAD_WRITE_FLAGS}
  2186. THREAD_WRITE_FLAGS = _THREAD_WRITE_FLAGS;
  2187. {$EXTERNALSYM THREAD_WRITE_FLAGS}
  2188. TThreadWriteFlags = THREAD_WRITE_FLAGS;
  2189. type
  2190. PMINIDUMP_MODULE_CALLBACK = ^MINIDUMP_MODULE_CALLBACK;
  2191. {$EXTERNALSYM PMINIDUMP_MODULE_CALLBACK}
  2192. _MINIDUMP_MODULE_CALLBACK = record
  2193. FullPath: PWCHAR;
  2194. BaseOfImage: ULONG64;
  2195. SizeOfImage: ULONG;
  2196. CheckSum: ULONG;
  2197. TimeDateStamp: ULONG;
  2198. VersionInfo: VS_FIXEDFILEINFO;
  2199. CvRecord: PVOID;
  2200. SizeOfCvRecord: ULONG;
  2201. MiscRecord: PVOID;
  2202. SizeOfMiscRecord: ULONG;
  2203. end;
  2204. {$EXTERNALSYM _MINIDUMP_MODULE_CALLBACK}
  2205. MINIDUMP_MODULE_CALLBACK = _MINIDUMP_MODULE_CALLBACK;
  2206. {$EXTERNALSYM MINIDUMP_MODULE_CALLBACK}
  2207. TMinidumpModuleCallback = MINIDUMP_MODULE_CALLBACK;
  2208. PMinidumpModuleCallback = PMINIDUMP_MODULE_CALLBACK;
  2209. PMINIDUMP_INCLUDE_MODULE_CALLBACK = ^MINIDUMP_INCLUDE_MODULE_CALLBACK;
  2210. {$EXTERNALSYM PMINIDUMP_INCLUDE_MODULE_CALLBACK}
  2211. _MINIDUMP_INCLUDE_MODULE_CALLBACK = record
  2212. BaseOfImage: ULONG64;
  2213. end;
  2214. {$EXTERNALSYM _MINIDUMP_INCLUDE_MODULE_CALLBACK}
  2215. MINIDUMP_INCLUDE_MODULE_CALLBACK = _MINIDUMP_INCLUDE_MODULE_CALLBACK;
  2216. {$EXTERNALSYM MINIDUMP_INCLUDE_MODULE_CALLBACK}
  2217. TMinidumpIncludeModuleCallback = MINIDUMP_INCLUDE_MODULE_CALLBACK;
  2218. PMinidumpIncludeModuleCallback = PMINIDUMP_INCLUDE_MODULE_CALLBACK;
  2219. const
  2220. ModuleWriteModule = $0001;
  2221. {$EXTERNALSYM ModuleWriteModule}
  2222. ModuleWriteDataSeg = $0002;
  2223. {$EXTERNALSYM ModuleWriteDataSeg}
  2224. ModuleWriteMiscRecord = $0004;
  2225. {$EXTERNALSYM ModuleWriteMiscRecord}
  2226. ModuleWriteCvRecord = $0008;
  2227. {$EXTERNALSYM ModuleWriteCvRecord}
  2228. ModuleReferencedByMemory = $0010;
  2229. {$EXTERNALSYM ModuleReferencedByMemory}
  2230. type
  2231. _MODULE_WRITE_FLAGS = DWORD;
  2232. {$EXTERNALSYM _MODULE_WRITE_FLAGS}
  2233. MODULE_WRITE_FLAGS = _MODULE_WRITE_FLAGS;
  2234. {$EXTERNALSYM MODULE_WRITE_FLAGS}
  2235. TModuleWriteFlags = MODULE_WRITE_FLAGS;
  2236. _MINIDUMP_CALLBACK_INPUT = record
  2237. ProcessId: ULONG;
  2238. ProcessHandle: HANDLE;
  2239. CallbackType: ULONG;
  2240. case Integer of
  2241. 0: (Thread: MINIDUMP_THREAD_CALLBACK);
  2242. 1: (ThreadEx: MINIDUMP_THREAD_EX_CALLBACK);
  2243. 2: (Module: MINIDUMP_MODULE_CALLBACK);
  2244. 3: (IncludeThread: MINIDUMP_INCLUDE_THREAD_CALLBACK);
  2245. 4: (IncludeModule: MINIDUMP_INCLUDE_MODULE_CALLBACK);
  2246. end;
  2247. {$EXTERNALSYM _MINIDUMP_CALLBACK_INPUT}
  2248. MINIDUMP_CALLBACK_INPUT = _MINIDUMP_CALLBACK_INPUT;
  2249. {$EXTERNALSYM MINIDUMP_CALLBACK_INPUT}
  2250. PMINIDUMP_CALLBACK_INPUT = ^MINIDUMP_CALLBACK_INPUT;
  2251. {$EXTERNALSYM PMINIDUMP_CALLBACK_INPUT}
  2252. TminidumpCallbackInput = MINIDUMP_CALLBACK_INPUT;
  2253. PMINIDUMP_CALLBACK_OUTPUT = ^MINIDUMP_CALLBACK_OUTPUT;
  2254. {$EXTERNALSYM PMINIDUMP_CALLBACK_OUTPUT}
  2255. _MINIDUMP_CALLBACK_OUTPUT = record
  2256. case Integer of
  2257. 0: (ModuleWriteFlags: ULONG);
  2258. 1: (ThreadWriteFlags: ULONG);
  2259. end;
  2260. {$EXTERNALSYM _MINIDUMP_CALLBACK_OUTPUT}
  2261. MINIDUMP_CALLBACK_OUTPUT = _MINIDUMP_CALLBACK_OUTPUT;
  2262. {$EXTERNALSYM MINIDUMP_CALLBACK_OUTPUT}
  2263. TMinidumpCallbackOutput = MINIDUMP_CALLBACK_OUTPUT;
  2264. PMinidumpCallbackOutput = PMINIDUMP_CALLBACK_OUTPUT;
  2265. //
  2266. // A normal minidump contains just the information
  2267. // necessary to capture stack traces for all of the
  2268. // existing threads in a process.
  2269. //
  2270. // A minidump with data segments includes all of the data
  2271. // sections from loaded modules in order to capture
  2272. // global variable contents. This can make the dump much
  2273. // larger if many modules have global data.
  2274. //
  2275. // A minidump with full memory includes all of the accessible
  2276. // memory in the process and can be very large. A minidump
  2277. // with full memory always has the raw memory data at the end
  2278. // of the dump so that the initial structures in the dump can
  2279. // be mapped directly without having to include the raw
  2280. // memory information.
  2281. //
  2282. // Stack and backing store memory can be filtered to remove
  2283. // data unnecessary for stack walking. This can improve
  2284. // compression of stacks and also deletes data that may
  2285. // be private and should not be stored in a dump.
  2286. // Memory can also be scanned to see what modules are
  2287. // referenced by stack and backing store memory to allow
  2288. // omission of other modules to reduce dump size.
  2289. // In either of these modes the ModuleReferencedByMemory flag
  2290. // is set for all modules referenced before the base
  2291. // module callbacks occur.
  2292. //
  2293. // On some operating systems a list of modules that were
  2294. // recently unloaded is kept in addition to the currently
  2295. // loaded module list. This information can be saved in
  2296. // the dump if desired.
  2297. //
  2298. // Stack and backing store memory can be scanned for referenced
  2299. // pages in order to pick up data referenced by locals or other
  2300. // stack memory. This can increase the size of a dump significantly.
  2301. //
  2302. // Module paths may contain undesired information such as user names
  2303. // or other important directory names so they can be stripped. This
  2304. // option reduces the ability to locate the proper image later
  2305. // and should only be used in certain situations.
  2306. //
  2307. // Complete operating system per-process and per-thread information can
  2308. // be gathered and stored in the dump.
  2309. //
  2310. // The virtual address space can be scanned for various types
  2311. // of memory to be included in the dump.
  2312. //
  2313. const
  2314. MiniDumpNormal = $0000;
  2315. {$EXTERNALSYM MiniDumpNormal}
  2316. MiniDumpWithDataSegs = $0001;
  2317. {$EXTERNALSYM MiniDumpWithDataSegs}
  2318. MiniDumpWithFullMemory = $0002;
  2319. {$EXTERNALSYM MiniDumpWithFullMemory}
  2320. MiniDumpWithHandleData = $0004;
  2321. {$EXTERNALSYM MiniDumpWithHandleData}
  2322. MiniDumpFilterMemory = $0008;
  2323. {$EXTERNALSYM MiniDumpFilterMemory}
  2324. MiniDumpScanMemory = $0010;
  2325. {$EXTERNALSYM MiniDumpScanMemory}
  2326. MiniDumpWithUnloadedModules = $0020;
  2327. {$EXTERNALSYM MiniDumpWithUnloadedModules}
  2328. MiniDumpWithIndirectlyReferencedMemory = $0040;
  2329. {$EXTERNALSYM MiniDumpWithIndirectlyReferencedMemory}
  2330. MiniDumpFilterModulePaths = $0080;
  2331. {$EXTERNALSYM MiniDumpFilterModulePaths}
  2332. MiniDumpWithProcessThreadData = $0100;
  2333. {$EXTERNALSYM MiniDumpWithProcessThreadData}
  2334. MiniDumpWithPrivateReadWriteMemory = $0200;
  2335. {$EXTERNALSYM MiniDumpWithPrivateReadWriteMemory}
  2336. type
  2337. _MINIDUMP_TYPE = DWORD;
  2338. {$EXTERNALSYM _MINIDUMP_TYPE}
  2339. MINIDUMP_TYPE = _MINIDUMP_TYPE;
  2340. {$EXTERNALSYM MINIDUMP_TYPE}
  2341. TMinidumpType = MINIDUMP_TYPE;
  2342. //
  2343. // The minidump callback should modify the FieldsToWrite parameter to reflect
  2344. // what portions of the specified thread or module should be written to the
  2345. // file.
  2346. //
  2347. MINIDUMP_CALLBACK_ROUTINE = function(CallbackParam: PVOID; CallbackInput: PMINIDUMP_CALLBACK_INPUT;
  2348. CallbackOutput: PMINIDUMP_CALLBACK_OUTPUT): BOOL; stdcall;
  2349. {$EXTERNALSYM MINIDUMP_CALLBACK_ROUTINE}
  2350. TMinidumpCallbackRoutine = MINIDUMP_CALLBACK_ROUTINE;
  2351. PMINIDUMP_CALLBACK_INFORMATION = ^MINIDUMP_CALLBACK_INFORMATION;
  2352. {$EXTERNALSYM PMINIDUMP_CALLBACK_INFORMATION}
  2353. _MINIDUMP_CALLBACK_INFORMATION = record
  2354. CallbackRoutine: MINIDUMP_CALLBACK_ROUTINE;
  2355. CallbackParam: PVOID;
  2356. end;
  2357. {$EXTERNALSYM _MINIDUMP_CALLBACK_INFORMATION}
  2358. MINIDUMP_CALLBACK_INFORMATION = _MINIDUMP_CALLBACK_INFORMATION;
  2359. {$EXTERNALSYM MINIDUMP_CALLBACK_INFORMATION}
  2360. TMinidumpCallbackInformation = MINIDUMP_CALLBACK_INFORMATION;
  2361. PMinidumpCallbackInformation = PMINIDUMP_CALLBACK_INFORMATION;
  2362. //++
  2363. //
  2364. // PVOID
  2365. // RVA_TO_ADDR(
  2366. // PVOID Mapping,
  2367. // ULONG Rva
  2368. // )
  2369. //
  2370. // Routine Description:
  2371. //
  2372. // Map an RVA that is contained within a mapped file to it's associated
  2373. // flat address.
  2374. //
  2375. // Arguments:
  2376. //
  2377. // Mapping - Base address of mapped file containing the RVA.
  2378. //
  2379. // Rva - An Rva to fixup.
  2380. //
  2381. // Return Values:
  2382. //
  2383. // A pointer to the desired data.
  2384. //
  2385. //--
  2386. function RVA_TO_ADDR(Mapping, Rva: Pointer): Pointer;
  2387. {$EXTERNALSYM RVA_TO_ADDR}
  2388. function MiniDumpWriteDump(hProcess: HANDLE; ProcessId: DWORD; hFile: HANDLE; DumpType: MINIDUMP_TYPE; ExceptionParam: PMINIDUMP_EXCEPTION_INFORMATION; UserStreamParam: PMINIDUMP_USER_STREAM_INFORMATION; CallbackParam: PMINIDUMP_CALLBACK_INFORMATION): BOOL; stdcall;
  2389. {$EXTERNALSYM MiniDumpWriteDump}
  2390. function MiniDumpReadDumpStream(BaseOfDump: PVOID; StreamNumber: ULONG; var Dir: PMINIDUMP_DIRECTORY; var StreamPointer: PVOID; var StreamSize: ULONG): BOOL; stdcall;
  2391. {$EXTERNALSYM MiniDumpReadDumpStream}
  2392. implementation
  2393. uses
  2394. JwaWinDLLNames;
  2395. procedure Address32To64(a32: LPADDRESS; a64: LPADDRESS64);
  2396. begin
  2397. a64^.Offset := {ULONG64(LONG64(LONG(}a32^.Offset{)))};
  2398. a64^.Segment := a32^.Segment;
  2399. a64^.Mode := a32^.Mode;
  2400. end;
  2401. procedure Address64To32(a64: LPADDRESS64; a32: LPADDRESS);
  2402. begin
  2403. a32^.Offset := ULONG(a64^.Offset);
  2404. a32^.Segment := a64^.Segment;
  2405. a32^.Mode := a64^.Mode;
  2406. end;
  2407. procedure KdHelp32To64(p32: PKDHELP; p64: PKDHELP64);
  2408. begin
  2409. p64^.Thread := p32^.Thread;
  2410. p64^.ThCallbackStack := p32^.ThCallbackStack;
  2411. p64^.NextCallback := p32^.NextCallback;
  2412. p64^.FramePointer := p32^.FramePointer;
  2413. p64^.KiCallUserMode := p32^.KiCallUserMode;
  2414. p64^.KeUserCallbackDispatcher := p32^.KeUserCallbackDispatcher;
  2415. p64^.SystemRangeStart := p32^.SystemRangeStart;
  2416. end;
  2417. function RVA_TO_ADDR(Mapping, Rva: Pointer): Pointer;
  2418. begin
  2419. Result := Pointer(Cardinal(Mapping) + Cardinal(Rva));
  2420. end;
  2421. {$IFDEF DYNAMIC_LINK}
  2422. var
  2423. _BindImage: Pointer;
  2424. function BindImage;
  2425. begin
  2426. GetProcedureAddress(_BindImage, ImageHlpLib, 'BindImage');
  2427. asm
  2428. MOV ESP, EBP
  2429. POP EBP
  2430. JMP [_BindImage]
  2431. end;
  2432. end;
  2433. var
  2434. _BindImageEx: Pointer;
  2435. function BindImageEx;
  2436. begin
  2437. GetProcedureAddress(_BindImageEx, ImageHlpLib, 'BindImageEx');
  2438. asm
  2439. MOV ESP, EBP
  2440. POP EBP
  2441. JMP [_BindImageEx]
  2442. end;
  2443. end;
  2444. var
  2445. _ReBaseImage: Pointer;
  2446. function ReBaseImage;
  2447. begin
  2448. GetProcedureAddress(_ReBaseImage, ImageHlpLib, 'ReBaseImage');
  2449. asm
  2450. MOV ESP, EBP
  2451. POP EBP
  2452. JMP [_ReBaseImage]
  2453. end;
  2454. end;
  2455. var
  2456. _ReBaseImage64: Pointer;
  2457. function ReBaseImage64;
  2458. begin
  2459. GetProcedureAddress(_ReBaseImage64, ImageHlpLib, 'ReBaseImage64');
  2460. asm
  2461. MOV ESP, EBP
  2462. POP EBP
  2463. JMP [_ReBaseImage64]
  2464. end;
  2465. end;
  2466. var
  2467. _CheckSumMappedFile: Pointer;
  2468. function CheckSumMappedFile;
  2469. begin
  2470. GetProcedureAddress(_CheckSumMappedFile, ImageHlpLib, 'CheckSumMappedFile');
  2471. asm
  2472. MOV ESP, EBP
  2473. POP EBP
  2474. JMP [_CheckSumMappedFile]
  2475. end;
  2476. end;
  2477. var
  2478. _MapFileAndCheckSumA: Pointer;
  2479. function MapFileAndCheckSumA;
  2480. begin
  2481. GetProcedureAddress(_MapFileAndCheckSumA, ImageHlpLib, 'MapFileAndCheckSumA');
  2482. asm
  2483. MOV ESP, EBP
  2484. POP EBP
  2485. JMP [_MapFileAndCheckSumA]
  2486. end;
  2487. end;
  2488. var
  2489. _MapFileAndCheckSumW: Pointer;
  2490. function MapFileAndCheckSumW;
  2491. begin
  2492. GetProcedureAddress(_MapFileAndCheckSumW, ImageHlpLib, 'MapFileAndCheckSumW');
  2493. asm
  2494. MOV ESP, EBP
  2495. POP EBP
  2496. JMP [_MapFileAndCheckSumW]
  2497. end;
  2498. end;
  2499. var
  2500. _MapFileAndCheckSum: Pointer;
  2501. function MapFileAndCheckSum;
  2502. begin
  2503. GetProcedureAddress(_MapFileAndCheckSum, ImageHlpLib, 'MapFileAndCheckSum' + AWSuffix);
  2504. asm
  2505. MOV ESP, EBP
  2506. POP EBP
  2507. JMP [_MapFileAndCheckSum]
  2508. end;
  2509. end;
  2510. var
  2511. _GetImageConfigInformation: Pointer;
  2512. function GetImageConfigInformation;
  2513. begin
  2514. GetProcedureAddress(_GetImageConfigInformation, ImageHlpLib, 'GetImageConfigInformation');
  2515. asm
  2516. MOV ESP, EBP
  2517. POP EBP
  2518. JMP [_GetImageConfigInformation]
  2519. end;
  2520. end;
  2521. var
  2522. _GetImageUnusedHeaderBytes: Pointer;
  2523. function GetImageUnusedHeaderBytes;
  2524. begin
  2525. GetProcedureAddress(_GetImageUnusedHeaderBytes, ImageHlpLib, 'GetImageUnusedHeaderBytes');
  2526. asm
  2527. MOV ESP, EBP
  2528. POP EBP
  2529. JMP [_GetImageUnusedHeaderBytes]
  2530. end;
  2531. end;
  2532. var
  2533. _SetImageConfigInformation: Pointer;
  2534. function SetImageConfigInformation;
  2535. begin
  2536. GetProcedureAddress(_SetImageConfigInformation, ImageHlpLib, 'SetImageConfigInformation');
  2537. asm
  2538. MOV ESP, EBP
  2539. POP EBP
  2540. JMP [_SetImageConfigInformation]
  2541. end;
  2542. end;
  2543. var
  2544. _ImageGetDigestStream: Pointer;
  2545. function ImageGetDigestStream;
  2546. begin
  2547. GetProcedureAddress(_ImageGetDigestStream, ImageHlpLib, 'ImageGetDigestStream');
  2548. asm
  2549. MOV ESP, EBP
  2550. POP EBP
  2551. JMP [_ImageGetDigestStream]
  2552. end;
  2553. end;
  2554. var
  2555. _ImageAddCertificate: Pointer;
  2556. function ImageAddCertificate;
  2557. begin
  2558. GetProcedureAddress(_ImageAddCertificate, ImageHlpLib, 'ImageAddCertificate');
  2559. asm
  2560. MOV ESP, EBP
  2561. POP EBP
  2562. JMP [_ImageAddCertificate]
  2563. end;
  2564. end;
  2565. var
  2566. _ImageRemoveCertificate: Pointer;
  2567. function ImageRemoveCertificate;
  2568. begin
  2569. GetProcedureAddress(_ImageRemoveCertificate, ImageHlpLib, 'ImageRemoveCertificate');
  2570. asm
  2571. MOV ESP, EBP
  2572. POP EBP
  2573. JMP [_ImageRemoveCertificate]
  2574. end;
  2575. end;
  2576. var
  2577. _ImageEnumerateCertificates: Pointer;
  2578. function ImageEnumerateCertificates;
  2579. begin
  2580. GetProcedureAddress(_ImageEnumerateCertificates, ImageHlpLib, 'ImageEnumerateCertificates');
  2581. asm
  2582. MOV ESP, EBP
  2583. POP EBP
  2584. JMP [_ImageEnumerateCertificates]
  2585. end;
  2586. end;
  2587. var
  2588. _ImageGetCertificateData: Pointer;
  2589. function ImageGetCertificateData;
  2590. begin
  2591. GetProcedureAddress(_ImageGetCertificateData, ImageHlpLib, 'ImageGetCertificateData');
  2592. asm
  2593. MOV ESP, EBP
  2594. POP EBP
  2595. JMP [_ImageGetCertificateData]
  2596. end;
  2597. end;
  2598. var
  2599. _ImageGetCertificateHeader: Pointer;
  2600. function ImageGetCertificateHeader;
  2601. begin
  2602. GetProcedureAddress(_ImageGetCertificateHeader, ImageHlpLib, 'ImageGetCertificateHeader');
  2603. asm
  2604. MOV ESP, EBP
  2605. POP EBP
  2606. JMP [_ImageGetCertificateHeader]
  2607. end;
  2608. end;
  2609. var
  2610. _ImageLoad: Pointer;
  2611. function ImageLoad;
  2612. begin
  2613. GetProcedureAddress(_ImageLoad, ImageHlpLib, 'ImageLoad');
  2614. asm
  2615. MOV ESP, EBP
  2616. POP EBP
  2617. JMP [_ImageLoad]
  2618. end;
  2619. end;
  2620. var
  2621. _ImageUnload: Pointer;
  2622. function ImageUnload;
  2623. begin
  2624. GetProcedureAddress(_ImageUnload, ImageHlpLib, 'ImageUnload');
  2625. asm
  2626. MOV ESP, EBP
  2627. POP EBP
  2628. JMP [_ImageUnload]
  2629. end;
  2630. end;
  2631. var
  2632. _MapAndLoad: Pointer;
  2633. function MapAndLoad;
  2634. begin
  2635. GetProcedureAddress(_MapAndLoad, ImageHlpLib, 'MapAndLoad');
  2636. asm
  2637. MOV ESP, EBP
  2638. POP EBP
  2639. JMP [_MapAndLoad]
  2640. end;
  2641. end;
  2642. var
  2643. _UnMapAndLoad: Pointer;
  2644. function UnMapAndLoad;
  2645. begin
  2646. GetProcedureAddress(_UnMapAndLoad, ImageHlpLib, 'UnMapAndLoad');
  2647. asm
  2648. MOV ESP, EBP
  2649. POP EBP
  2650. JMP [_UnMapAndLoad]
  2651. end;
  2652. end;
  2653. var
  2654. _TouchFileTimes: Pointer;
  2655. function TouchFileTimes;
  2656. begin
  2657. GetProcedureAddress(_TouchFileTimes, ImageHlpLib, 'TouchFileTimes');
  2658. asm
  2659. MOV ESP, EBP
  2660. POP EBP
  2661. JMP [_TouchFileTimes]
  2662. end;
  2663. end;
  2664. var
  2665. _SplitSymbols: Pointer;
  2666. function SplitSymbols;
  2667. begin
  2668. GetProcedureAddress(_SplitSymbols, ImageHlpLib, 'SplitSymbols');
  2669. asm
  2670. MOV ESP, EBP
  2671. POP EBP
  2672. JMP [_SplitSymbols]
  2673. end;
  2674. end;
  2675. var
  2676. _UpdateDebugInfoFile: Pointer;
  2677. function UpdateDebugInfoFile;
  2678. begin
  2679. GetProcedureAddress(_UpdateDebugInfoFile, ImageHlpLib, 'UpdateDebugInfoFile');
  2680. asm
  2681. MOV ESP, EBP
  2682. POP EBP
  2683. JMP [_UpdateDebugInfoFile]
  2684. end;
  2685. end;
  2686. var
  2687. _UpdateDebugInfoFileEx: Pointer;
  2688. function UpdateDebugInfoFileEx;
  2689. begin
  2690. GetProcedureAddress(_UpdateDebugInfoFileEx, ImageHlpLib, 'UpdateDebugInfoFileEx');
  2691. asm
  2692. MOV ESP, EBP
  2693. POP EBP
  2694. JMP [_UpdateDebugInfoFileEx]
  2695. end;
  2696. end;
  2697. var
  2698. _FindDebugInfoFile: Pointer;
  2699. function FindDebugInfoFile;
  2700. begin
  2701. GetProcedureAddress(_FindDebugInfoFile, ImageHlpLib, 'FindDebugInfoFile');
  2702. asm
  2703. MOV ESP, EBP
  2704. POP EBP
  2705. JMP [_FindDebugInfoFile]
  2706. end;
  2707. end;
  2708. var
  2709. _FindDebugInfoFileEx: Pointer;
  2710. function FindDebugInfoFileEx;
  2711. begin
  2712. GetProcedureAddress(_FindDebugInfoFileEx, ImageHlpLib, 'FindDebugInfoFileEx');
  2713. asm
  2714. MOV ESP, EBP
  2715. POP EBP
  2716. JMP [_FindDebugInfoFileEx]
  2717. end;
  2718. end;
  2719. var
  2720. _SymFindFileInPath: Pointer;
  2721. function SymFindFileInPath;
  2722. begin
  2723. GetProcedureAddress(_SymFindFileInPath, ImageHlpLib, 'SymFindFileInPath');
  2724. asm
  2725. MOV ESP, EBP
  2726. POP EBP
  2727. JMP [_SymFindFileInPath]
  2728. end;
  2729. end;
  2730. var
  2731. _FindExecutableImage: Pointer;
  2732. function FindExecutableImage;
  2733. begin
  2734. GetProcedureAddress(_FindExecutableImage, ImageHlpLib, 'FindExecutableImage');
  2735. asm
  2736. MOV ESP, EBP
  2737. POP EBP
  2738. JMP [_FindExecutableImage]
  2739. end;
  2740. end;
  2741. var
  2742. _FindExecutableImageEx: Pointer;
  2743. function FindExecutableImageEx;
  2744. begin
  2745. GetProcedureAddress(_FindExecutableImageEx, ImageHlpLib, 'FindExecutableImageEx');
  2746. asm
  2747. MOV ESP, EBP
  2748. POP EBP
  2749. JMP [_FindExecutableImageEx]
  2750. end;
  2751. end;
  2752. var
  2753. _ImageNtHeader: Pointer;
  2754. function ImageNtHeader;
  2755. begin
  2756. GetProcedureAddress(_ImageNtHeader, ImageHlpLib, 'ImageNtHeader');
  2757. asm
  2758. MOV ESP, EBP
  2759. POP EBP
  2760. JMP [_ImageNtHeader]
  2761. end;
  2762. end;
  2763. var
  2764. _ImageDirectoryEntryToDataEx: Pointer;
  2765. function ImageDirectoryEntryToDataEx;
  2766. begin
  2767. GetProcedureAddress(_ImageDirectoryEntryToDataEx, ImageHlpLib, 'ImageDirectoryEntryToDataEx');
  2768. asm
  2769. MOV ESP, EBP
  2770. POP EBP
  2771. JMP [_ImageDirectoryEntryToDataEx]
  2772. end;
  2773. end;
  2774. var
  2775. _ImageDirectoryEntryToData: Pointer;
  2776. function ImageDirectoryEntryToData;
  2777. begin
  2778. GetProcedureAddress(_ImageDirectoryEntryToData, ImageHlpLib, 'ImageDirectoryEntryToData');
  2779. asm
  2780. MOV ESP, EBP
  2781. POP EBP
  2782. JMP [_ImageDirectoryEntryToData]
  2783. end;
  2784. end;
  2785. var
  2786. _ImageRvaToSection: Pointer;
  2787. function ImageRvaToSection;
  2788. begin
  2789. GetProcedureAddress(_ImageRvaToSection, ImageHlpLib, 'ImageRvaToSection');
  2790. asm
  2791. MOV ESP, EBP
  2792. POP EBP
  2793. JMP [_ImageRvaToSection]
  2794. end;
  2795. end;
  2796. var
  2797. _ImageRvaToVa: Pointer;
  2798. function ImageRvaToVa;
  2799. begin
  2800. GetProcedureAddress(_ImageRvaToVa, ImageHlpLib, 'ImageRvaToVa');
  2801. asm
  2802. MOV ESP, EBP
  2803. POP EBP
  2804. JMP [_ImageRvaToVa]
  2805. end;
  2806. end;
  2807. var
  2808. _MapDebugInformation: Pointer;
  2809. function MapDebugInformation;
  2810. begin
  2811. GetProcedureAddress(_MapDebugInformation, ImageHlpLib, 'MapDebugInformation');
  2812. asm
  2813. MOV ESP, EBP
  2814. POP EBP
  2815. JMP [_MapDebugInformation]
  2816. end;
  2817. end;
  2818. var
  2819. _UnmapDebugInformation: Pointer;
  2820. function UnmapDebugInformation;
  2821. begin
  2822. GetProcedureAddress(_UnmapDebugInformation, ImageHlpLib, 'UnmapDebugInformation');
  2823. asm
  2824. MOV ESP, EBP
  2825. POP EBP
  2826. JMP [_UnmapDebugInformation]
  2827. end;
  2828. end;
  2829. var
  2830. _SearchTreeForFile: Pointer;
  2831. function SearchTreeForFile;
  2832. begin
  2833. GetProcedureAddress(_SearchTreeForFile, ImageHlpLib, 'SearchTreeForFile');
  2834. asm
  2835. MOV ESP, EBP
  2836. POP EBP
  2837. JMP [_SearchTreeForFile]
  2838. end;
  2839. end;
  2840. var
  2841. _EnumDirTree: Pointer;
  2842. function EnumDirTree;
  2843. begin
  2844. GetProcedureAddress(_EnumDirTree, ImageHlpLib, 'EnumDirTree');
  2845. asm
  2846. MOV ESP, EBP
  2847. POP EBP
  2848. JMP [_EnumDirTree]
  2849. end;
  2850. end;
  2851. var
  2852. _MakeSureDirectoryPathExists: Pointer;
  2853. function MakeSureDirectoryPathExists;
  2854. begin
  2855. GetProcedureAddress(_MakeSureDirectoryPathExists, ImageHlpLib, 'MakeSureDirectoryPathExists');
  2856. asm
  2857. MOV ESP, EBP
  2858. POP EBP
  2859. JMP [_MakeSureDirectoryPathExists]
  2860. end;
  2861. end;
  2862. var
  2863. _UnDecorateSymbolName: Pointer;
  2864. function UnDecorateSymbolName;
  2865. begin
  2866. GetProcedureAddress(_UnDecorateSymbolName, ImageHlpLib, 'UnDecorateSymbolName');
  2867. asm
  2868. MOV ESP, EBP
  2869. POP EBP
  2870. JMP [_UnDecorateSymbolName]
  2871. end;
  2872. end;
  2873. var
  2874. _StackWalk64: Pointer;
  2875. function StackWalk64;
  2876. begin
  2877. GetProcedureAddress(_StackWalk64, ImageHlpLib, 'StackWalk64');
  2878. asm
  2879. MOV ESP, EBP
  2880. POP EBP
  2881. JMP [_StackWalk64]
  2882. end;
  2883. end;
  2884. var
  2885. _StackWalk: Pointer;
  2886. function StackWalk;
  2887. begin
  2888. GetProcedureAddress(_StackWalk, ImageHlpLib, 'StackWalk');
  2889. asm
  2890. MOV ESP, EBP
  2891. POP EBP
  2892. JMP [_StackWalk]
  2893. end;
  2894. end;
  2895. var
  2896. _ImagehlpApiVersion: Pointer;
  2897. function ImagehlpApiVersion;
  2898. begin
  2899. GetProcedureAddress(_ImagehlpApiVersion, ImageHlpLib, 'ImagehlpApiVersion');
  2900. asm
  2901. MOV ESP, EBP
  2902. POP EBP
  2903. JMP [_ImagehlpApiVersion]
  2904. end;
  2905. end;
  2906. var
  2907. _ImagehlpApiVersionEx: Pointer;
  2908. function ImagehlpApiVersionEx;
  2909. begin
  2910. GetProcedureAddress(_ImagehlpApiVersionEx, ImageHlpLib, 'ImagehlpApiVersionEx');
  2911. asm
  2912. MOV ESP, EBP
  2913. POP EBP
  2914. JMP [_ImagehlpApiVersionEx]
  2915. end;
  2916. end;
  2917. var
  2918. _GetTimestampForLoadedLibrary: Pointer;
  2919. function GetTimestampForLoadedLibrary;
  2920. begin
  2921. GetProcedureAddress(_GetTimestampForLoadedLibrary, ImageHlpLib, 'GetTimestampForLoadedLibrary');
  2922. asm
  2923. MOV ESP, EBP
  2924. POP EBP
  2925. JMP [_GetTimestampForLoadedLibrary]
  2926. end;
  2927. end;
  2928. var
  2929. _SymSetOptions: Pointer;
  2930. function SymSetOptions;
  2931. begin
  2932. GetProcedureAddress(_SymSetOptions, ImageHlpLib, 'SymSetOptions');
  2933. asm
  2934. MOV ESP, EBP
  2935. POP EBP
  2936. JMP [_SymSetOptions]
  2937. end;
  2938. end;
  2939. var
  2940. _SymGetOptions: Pointer;
  2941. function SymGetOptions;
  2942. begin
  2943. GetProcedureAddress(_SymGetOptions, ImageHlpLib, 'SymGetOptions');
  2944. asm
  2945. MOV ESP, EBP
  2946. POP EBP
  2947. JMP [_SymGetOptions]
  2948. end;
  2949. end;
  2950. var
  2951. _SymCleanup: Pointer;
  2952. function SymCleanup;
  2953. begin
  2954. GetProcedureAddress(_SymCleanup, ImageHlpLib, 'SymCleanup');
  2955. asm
  2956. MOV ESP, EBP
  2957. POP EBP
  2958. JMP [_SymCleanup]
  2959. end;
  2960. end;
  2961. var
  2962. _SymMatchString: Pointer;
  2963. function SymMatchString;
  2964. begin
  2965. GetProcedureAddress(_SymMatchString, ImageHlpLib, 'SymMatchString');
  2966. asm
  2967. MOV ESP, EBP
  2968. POP EBP
  2969. JMP [_SymMatchString]
  2970. end;
  2971. end;
  2972. var
  2973. _SymEnumSourceFiles: Pointer;
  2974. function SymEnumSourceFiles;
  2975. begin
  2976. GetProcedureAddress(_SymEnumSourceFiles, ImageHlpLib, 'SymEnumSourceFiles');
  2977. asm
  2978. MOV ESP, EBP
  2979. POP EBP
  2980. JMP [_SymEnumSourceFiles]
  2981. end;
  2982. end;
  2983. var
  2984. _SymEnumerateModules64: Pointer;
  2985. function SymEnumerateModules64;
  2986. begin
  2987. GetProcedureAddress(_SymEnumerateModules64, ImageHlpLib, 'SymEnumerateModules64');
  2988. asm
  2989. MOV ESP, EBP
  2990. POP EBP
  2991. JMP [_SymEnumerateModules64]
  2992. end;
  2993. end;
  2994. var
  2995. _SymEnumerateModules: Pointer;
  2996. function SymEnumerateModules;
  2997. begin
  2998. GetProcedureAddress(_SymEnumerateModules, ImageHlpLib, 'SymEnumerateModules');
  2999. asm
  3000. MOV ESP, EBP
  3001. POP EBP
  3002. JMP [_SymEnumerateModules]
  3003. end;
  3004. end;
  3005. var
  3006. _SymEnumerateSymbols64: Pointer;
  3007. function SymEnumerateSymbols64;
  3008. begin
  3009. GetProcedureAddress(_SymEnumerateSymbols64, ImageHlpLib, 'SymEnumerateSymbols64');
  3010. asm
  3011. MOV ESP, EBP
  3012. POP EBP
  3013. JMP [_SymEnumerateSymbols64]
  3014. end;
  3015. end;
  3016. var
  3017. _SymEnumerateSymbolsW64: Pointer;
  3018. function SymEnumerateSymbolsW64;
  3019. begin
  3020. GetProcedureAddress(_SymEnumerateSymbolsW64, ImageHlpLib, 'SymEnumerateSymbolsW64');
  3021. asm
  3022. MOV ESP, EBP
  3023. POP EBP
  3024. JMP [_SymEnumerateSymbolsW64]
  3025. end;
  3026. end;
  3027. var
  3028. _SymEnumerateSymbols: Pointer;
  3029. function SymEnumerateSymbols;
  3030. begin
  3031. GetProcedureAddress(_SymEnumerateSymbols, ImageHlpLib, 'SymEnumerateSymbols');
  3032. asm
  3033. MOV ESP, EBP
  3034. POP EBP
  3035. JMP [_SymEnumerateSymbols]
  3036. end;
  3037. end;
  3038. var
  3039. _SymEnumerateSymbolsW: Pointer;
  3040. function SymEnumerateSymbolsW;
  3041. begin
  3042. GetProcedureAddress(_SymEnumerateSymbolsW, ImageHlpLib, 'SymEnumerateSymbolsW');
  3043. asm
  3044. MOV ESP, EBP
  3045. POP EBP
  3046. JMP [_SymEnumerateSymbolsW]
  3047. end;
  3048. end;
  3049. var
  3050. _EnumerateLoadedModules64: Pointer;
  3051. function EnumerateLoadedModules64;
  3052. begin
  3053. GetProcedureAddress(_EnumerateLoadedModules64, ImageHlpLib, 'EnumerateLoadedModules64');
  3054. asm
  3055. MOV ESP, EBP
  3056. POP EBP
  3057. JMP [_EnumerateLoadedModules64]
  3058. end;
  3059. end;
  3060. var
  3061. _EnumerateLoadedModules: Pointer;
  3062. function EnumerateLoadedModules;
  3063. begin
  3064. GetProcedureAddress(_EnumerateLoadedModules, ImageHlpLib, 'EnumerateLoadedModules');
  3065. asm
  3066. MOV ESP, EBP
  3067. POP EBP
  3068. JMP [_EnumerateLoadedModules]
  3069. end;
  3070. end;
  3071. var
  3072. _SymFunctionTableAccess64: Pointer;
  3073. function SymFunctionTableAccess64;
  3074. begin
  3075. GetProcedureAddress(_SymFunctionTableAccess64, ImageHlpLib, 'SymFunctionTableAccess64');
  3076. asm
  3077. MOV ESP, EBP
  3078. POP EBP
  3079. JMP [_SymFunctionTableAccess64]
  3080. end;
  3081. end;
  3082. var
  3083. _SymFunctionTableAccess: Pointer;
  3084. function SymFunctionTableAccess;
  3085. begin
  3086. GetProcedureAddress(_SymFunctionTableAccess, ImageHlpLib, 'SymFunctionTableAccess');
  3087. asm
  3088. MOV ESP, EBP
  3089. POP EBP
  3090. JMP [_SymFunctionTableAccess]
  3091. end;
  3092. end;
  3093. var
  3094. _SymGetModuleInfo64: Pointer;
  3095. function SymGetModuleInfo64;
  3096. begin
  3097. GetProcedureAddress(_SymGetModuleInfo64, ImageHlpLib, 'SymGetModuleInfo64');
  3098. asm
  3099. MOV ESP, EBP
  3100. POP EBP
  3101. JMP [_SymGetModuleInfo64]
  3102. end;
  3103. end;
  3104. var
  3105. _SymGetModuleInfoW64: Pointer;
  3106. function SymGetModuleInfoW64;
  3107. begin
  3108. GetProcedureAddress(_SymGetModuleInfoW64, ImageHlpLib, 'SymGetModuleInfoW64');
  3109. asm
  3110. MOV ESP, EBP
  3111. POP EBP
  3112. JMP [_SymGetModuleInfoW64]
  3113. end;
  3114. end;
  3115. var
  3116. _SymGetModuleInfo: Pointer;
  3117. function SymGetModuleInfo;
  3118. begin
  3119. GetProcedureAddress(_SymGetModuleInfo, ImageHlpLib, 'SymGetModuleInfo');
  3120. asm
  3121. MOV ESP, EBP
  3122. POP EBP
  3123. JMP [_SymGetModuleInfo]
  3124. end;
  3125. end;
  3126. var
  3127. _SymGetModuleInfoW: Pointer;
  3128. function SymGetModuleInfoW;
  3129. begin
  3130. GetProcedureAddress(_SymGetModuleInfoW, ImageHlpLib, 'SymGetModuleInfoW');
  3131. asm
  3132. MOV ESP, EBP
  3133. POP EBP
  3134. JMP [_SymGetModuleInfoW]
  3135. end;
  3136. end;
  3137. var
  3138. _SymGetModuleBase64: Pointer;
  3139. function SymGetModuleBase64;
  3140. begin
  3141. GetProcedureAddress(_SymGetModuleBase64, ImageHlpLib, 'SymGetModuleBase64');
  3142. asm
  3143. MOV ESP, EBP
  3144. POP EBP
  3145. JMP [_SymGetModuleBase64]
  3146. end;
  3147. end;
  3148. var
  3149. _SymGetModuleBase: Pointer;
  3150. function SymGetModuleBase;
  3151. begin
  3152. GetProcedureAddress(_SymGetModuleBase, ImageHlpLib, 'SymGetModuleBase');
  3153. asm
  3154. MOV ESP, EBP
  3155. POP EBP
  3156. JMP [_SymGetModuleBase]
  3157. end;
  3158. end;
  3159. var
  3160. _SymGetSymNext64: Pointer;
  3161. function SymGetSymNext64;
  3162. begin
  3163. GetProcedureAddress(_SymGetSymNext64, ImageHlpLib, 'SymGetSymNext64');
  3164. asm
  3165. MOV ESP, EBP
  3166. POP EBP
  3167. JMP [_SymGetSymNext64]
  3168. end;
  3169. end;
  3170. var
  3171. _SymGetSymNext: Pointer;
  3172. function SymGetSymNext;
  3173. begin
  3174. GetProcedureAddress(_SymGetSymNext, ImageHlpLib, 'SymGetSymNext');
  3175. asm
  3176. MOV ESP, EBP
  3177. POP EBP
  3178. JMP [_SymGetSymNext]
  3179. end;
  3180. end;
  3181. var
  3182. _SymGetSymPrev64: Pointer;
  3183. function SymGetSymPrev64;
  3184. begin
  3185. GetProcedureAddress(_SymGetSymPrev64, ImageHlpLib, 'SymGetSymPrev64');
  3186. asm
  3187. MOV ESP, EBP
  3188. POP EBP
  3189. JMP [_SymGetSymPrev64]
  3190. end;
  3191. end;
  3192. var
  3193. _SymGetSymPrev: Pointer;
  3194. function SymGetSymPrev;
  3195. begin
  3196. GetProcedureAddress(_SymGetSymPrev, ImageHlpLib, 'SymGetSymPrev');
  3197. asm
  3198. MOV ESP, EBP
  3199. POP EBP
  3200. JMP [_SymGetSymPrev]
  3201. end;
  3202. end;
  3203. var
  3204. _SymGetLineFromAddr64: Pointer;
  3205. function SymGetLineFromAddr64;
  3206. begin
  3207. GetProcedureAddress(_SymGetLineFromAddr64, ImageHlpLib, 'SymGetLineFromAddr64');
  3208. asm
  3209. MOV ESP, EBP
  3210. POP EBP
  3211. JMP [_SymGetLineFromAddr64]
  3212. end;
  3213. end;
  3214. var
  3215. _SymGetLineFromAddr: Pointer;
  3216. function SymGetLineFromAddr;
  3217. begin
  3218. GetProcedureAddress(_SymGetLineFromAddr, ImageHlpLib, 'SymGetLineFromAddr');
  3219. asm
  3220. MOV ESP, EBP
  3221. POP EBP
  3222. JMP [_SymGetLineFromAddr]
  3223. end;
  3224. end;
  3225. var
  3226. _SymGetLineFromName64: Pointer;
  3227. function SymGetLineFromName64;
  3228. begin
  3229. GetProcedureAddress(_SymGetLineFromName64, ImageHlpLib, 'SymGetLineFromName64');
  3230. asm
  3231. MOV ESP, EBP
  3232. POP EBP
  3233. JMP [_SymGetLineFromName64]
  3234. end;
  3235. end;
  3236. var
  3237. _SymGetLineFromName: Pointer;
  3238. function SymGetLineFromName;
  3239. begin
  3240. GetProcedureAddress(_SymGetLineFromName, ImageHlpLib, 'SymGetLineFromName');
  3241. asm
  3242. MOV ESP, EBP
  3243. POP EBP
  3244. JMP [_SymGetLineFromName]
  3245. end;
  3246. end;
  3247. var
  3248. _SymGetLineNext64: Pointer;
  3249. function SymGetLineNext64;
  3250. begin
  3251. GetProcedureAddress(_SymGetLineNext64, ImageHlpLib, 'SymGetLineNext64');
  3252. asm
  3253. MOV ESP, EBP
  3254. POP EBP
  3255. JMP [_SymGetLineNext64]
  3256. end;
  3257. end;
  3258. var
  3259. _SymGetLineNext: Pointer;
  3260. function SymGetLineNext;
  3261. begin
  3262. GetProcedureAddress(_SymGetLineNext, ImageHlpLib, 'SymGetLineNext');
  3263. asm
  3264. MOV ESP, EBP
  3265. POP EBP
  3266. JMP [_SymGetLineNext]
  3267. end;
  3268. end;
  3269. var
  3270. _SymGetLinePrev64: Pointer;
  3271. function SymGetLinePrev64;
  3272. begin
  3273. GetProcedureAddress(_SymGetLinePrev64, ImageHlpLib, 'SymGetLinePrev64');
  3274. asm
  3275. MOV ESP, EBP
  3276. POP EBP
  3277. JMP [_SymGetLinePrev64]
  3278. end;
  3279. end;
  3280. var
  3281. _SymGetLinePrev: Pointer;
  3282. function SymGetLinePrev;
  3283. begin
  3284. GetProcedureAddress(_SymGetLinePrev, ImageHlpLib, 'SymGetLinePrev');
  3285. asm
  3286. MOV ESP, EBP
  3287. POP EBP
  3288. JMP [_SymGetLinePrev]
  3289. end;
  3290. end;
  3291. var
  3292. _SymMatchFileName: Pointer;
  3293. function SymMatchFileName;
  3294. begin
  3295. GetProcedureAddress(_SymMatchFileName, ImageHlpLib, 'SymMatchFileName');
  3296. asm
  3297. MOV ESP, EBP
  3298. POP EBP
  3299. JMP [_SymMatchFileName]
  3300. end;
  3301. end;
  3302. var
  3303. _SymInitialize: Pointer;
  3304. function SymInitialize;
  3305. begin
  3306. GetProcedureAddress(_SymInitialize, ImageHlpLib, 'SymInitialize');
  3307. asm
  3308. MOV ESP, EBP
  3309. POP EBP
  3310. JMP [_SymInitialize]
  3311. end;
  3312. end;
  3313. var
  3314. _SymGetSearchPath: Pointer;
  3315. function SymGetSearchPath;
  3316. begin
  3317. GetProcedureAddress(_SymGetSearchPath, ImageHlpLib, 'SymGetSearchPath');
  3318. asm
  3319. MOV ESP, EBP
  3320. POP EBP
  3321. JMP [_SymGetSearchPath]
  3322. end;
  3323. end;
  3324. var
  3325. _SymSetSearchPath: Pointer;
  3326. function SymSetSearchPath;
  3327. begin
  3328. GetProcedureAddress(_SymSetSearchPath, ImageHlpLib, 'SymSetSearchPath');
  3329. asm
  3330. MOV ESP, EBP
  3331. POP EBP
  3332. JMP [_SymSetSearchPath]
  3333. end;
  3334. end;
  3335. var
  3336. _SymLoadModuleEx: Pointer;
  3337. function SymLoadModuleEx;
  3338. begin
  3339. GetProcedureAddress(_SymLoadModuleEx, ImageHlpLib, 'SymLoadModuleEx');
  3340. asm
  3341. MOV ESP, EBP
  3342. POP EBP
  3343. JMP [_SymLoadModuleEx]
  3344. end;
  3345. end;
  3346. var
  3347. _SymLoadModule64: Pointer;
  3348. function SymLoadModule64;
  3349. begin
  3350. GetProcedureAddress(_SymLoadModule64, ImageHlpLib, 'SymLoadModule64');
  3351. asm
  3352. MOV ESP, EBP
  3353. POP EBP
  3354. JMP [_SymLoadModule64]
  3355. end;
  3356. end;
  3357. var
  3358. _SymLoadModule: Pointer;
  3359. function SymLoadModule;
  3360. begin
  3361. GetProcedureAddress(_SymLoadModule, ImageHlpLib, 'SymLoadModule');
  3362. asm
  3363. MOV ESP, EBP
  3364. POP EBP
  3365. JMP [_SymLoadModule]
  3366. end;
  3367. end;
  3368. var
  3369. _SymUnloadModule64: Pointer;
  3370. function SymUnloadModule64;
  3371. begin
  3372. GetProcedureAddress(_SymUnloadModule64, ImageHlpLib, 'SymUnloadModule64');
  3373. asm
  3374. MOV ESP, EBP
  3375. POP EBP
  3376. JMP [_SymUnloadModule64]
  3377. end;
  3378. end;
  3379. var
  3380. _SymUnloadModule: Pointer;
  3381. function SymUnloadModule;
  3382. begin
  3383. GetProcedureAddress(_SymUnloadModule, ImageHlpLib, 'SymUnloadModule');
  3384. asm
  3385. MOV ESP, EBP
  3386. POP EBP
  3387. JMP [_SymUnloadModule]
  3388. end;
  3389. end;
  3390. var
  3391. _SymUnDName64: Pointer;
  3392. function SymUnDName64;
  3393. begin
  3394. GetProcedureAddress(_SymUnDName64, ImageHlpLib, 'SymUnDName64');
  3395. asm
  3396. MOV ESP, EBP
  3397. POP EBP
  3398. JMP [_SymUnDName64]
  3399. end;
  3400. end;
  3401. var
  3402. _SymUnDName: Pointer;
  3403. function SymUnDName;
  3404. begin
  3405. GetProcedureAddress(_SymUnDName, ImageHlpLib, 'SymUnDName');
  3406. asm
  3407. MOV ESP, EBP
  3408. POP EBP
  3409. JMP [_SymUnDName]
  3410. end;
  3411. end;
  3412. var
  3413. _SymRegisterCallback64: Pointer;
  3414. function SymRegisterCallback64;
  3415. begin
  3416. GetProcedureAddress(_SymRegisterCallback64, ImageHlpLib, 'SymRegisterCallback64');
  3417. asm
  3418. MOV ESP, EBP
  3419. POP EBP
  3420. JMP [_SymRegisterCallback64]
  3421. end;
  3422. end;
  3423. var
  3424. _SymRegFuncEntryCallback64: Pointer;
  3425. function SymRegisterFunctionEntryCallback64;
  3426. begin
  3427. GetProcedureAddress(_SymRegFuncEntryCallback64, ImageHlpLib, 'SymRegisterFunctionEntryCallback64');
  3428. asm
  3429. MOV ESP, EBP
  3430. POP EBP
  3431. JMP [_SymRegFuncEntryCallback64]
  3432. end;
  3433. end;
  3434. var
  3435. _SymRegisterCallback: Pointer;
  3436. function SymRegisterCallback;
  3437. begin
  3438. GetProcedureAddress(_SymRegisterCallback, ImageHlpLib, 'SymRegisterCallback');
  3439. asm
  3440. MOV ESP, EBP
  3441. POP EBP
  3442. JMP [_SymRegisterCallback]
  3443. end;
  3444. end;
  3445. var
  3446. _SymRegisterFuncEntryCallback: Pointer;
  3447. function SymRegisterFunctionEntryCallback;
  3448. begin
  3449. GetProcedureAddress(_SymRegisterFuncEntryCallback, ImageHlpLib, 'SymRegisterFunctionEntryCallback');
  3450. asm
  3451. MOV ESP, EBP
  3452. POP EBP
  3453. JMP [_SymRegisterFuncEntryCallback]
  3454. end;
  3455. end;
  3456. var
  3457. _SymSetContext: Pointer;
  3458. function SymSetContext;
  3459. begin
  3460. GetProcedureAddress(_SymSetContext, ImageHlpLib, 'SymSetContext');
  3461. asm
  3462. MOV ESP, EBP
  3463. POP EBP
  3464. JMP [_SymSetContext]
  3465. end;
  3466. end;
  3467. var
  3468. _SymFromAddr: Pointer;
  3469. function SymFromAddr;
  3470. begin
  3471. GetProcedureAddress(_SymFromAddr, ImageHlpLib, 'SymFromAddr');
  3472. asm
  3473. MOV ESP, EBP
  3474. POP EBP
  3475. JMP [_SymFromAddr]
  3476. end;
  3477. end;
  3478. var
  3479. _SymFromName: Pointer;
  3480. function SymFromName;
  3481. begin
  3482. GetProcedureAddress(_SymFromName, ImageHlpLib, 'SymFromName');
  3483. asm
  3484. MOV ESP, EBP
  3485. POP EBP
  3486. JMP [_SymFromName]
  3487. end;
  3488. end;
  3489. var
  3490. _SymEnumSymbolsForAddr: Pointer;
  3491. function SymEnumSymbolsForAddr;
  3492. begin
  3493. GetProcedureAddress(_SymEnumSymbolsForAddr, ImageHlpLib, 'SymEnumSymbolsForAddr');
  3494. asm
  3495. MOV ESP, EBP
  3496. POP EBP
  3497. JMP [_SymEnumSymbolsForAddr]
  3498. end;
  3499. end;
  3500. var
  3501. _SymEnumSymbols: Pointer;
  3502. function SymEnumSymbols;
  3503. begin
  3504. GetProcedureAddress(_SymEnumSymbols, ImageHlpLib, 'SymEnumSymbols');
  3505. asm
  3506. MOV ESP, EBP
  3507. POP EBP
  3508. JMP [_SymEnumSymbols]
  3509. end;
  3510. end;
  3511. var
  3512. _SymGetTypeInfo: Pointer;
  3513. function SymGetTypeInfo;
  3514. begin
  3515. GetProcedureAddress(_SymGetTypeInfo, ImageHlpLib, 'SymGetTypeInfo');
  3516. asm
  3517. MOV ESP, EBP
  3518. POP EBP
  3519. JMP [_SymGetTypeInfo]
  3520. end;
  3521. end;
  3522. var
  3523. _SymEnumTypes: Pointer;
  3524. function SymEnumTypes;
  3525. begin
  3526. GetProcedureAddress(_SymEnumTypes, ImageHlpLib, 'SymEnumTypes');
  3527. asm
  3528. MOV ESP, EBP
  3529. POP EBP
  3530. JMP [_SymEnumTypes]
  3531. end;
  3532. end;
  3533. var
  3534. _SymGetTypeFromName: Pointer;
  3535. function SymGetTypeFromName;
  3536. begin
  3537. GetProcedureAddress(_SymGetTypeFromName, ImageHlpLib, 'SymGetTypeFromName');
  3538. asm
  3539. MOV ESP, EBP
  3540. POP EBP
  3541. JMP [_SymGetTypeFromName]
  3542. end;
  3543. end;
  3544. var
  3545. _SymAddSymbol: Pointer;
  3546. function SymAddSymbol;
  3547. begin
  3548. GetProcedureAddress(_SymAddSymbol, ImageHlpLib, 'SymAddSymbol');
  3549. asm
  3550. MOV ESP, EBP
  3551. POP EBP
  3552. JMP [_SymAddSymbol]
  3553. end;
  3554. end;
  3555. var
  3556. _SymDeleteSymbol: Pointer;
  3557. function SymDeleteSymbol;
  3558. begin
  3559. GetProcedureAddress(_SymDeleteSymbol, ImageHlpLib, 'SymDeleteSymbol');
  3560. asm
  3561. MOV ESP, EBP
  3562. POP EBP
  3563. JMP [_SymDeleteSymbol]
  3564. end;
  3565. end;
  3566. var
  3567. _DbgHelpCreateUserDump: Pointer;
  3568. function DbgHelpCreateUserDump;
  3569. begin
  3570. GetProcedureAddress(_DbgHelpCreateUserDump, ImageHlpLib, 'DbgHelpCreateUserDump');
  3571. asm
  3572. MOV ESP, EBP
  3573. POP EBP
  3574. JMP [_DbgHelpCreateUserDump]
  3575. end;
  3576. end;
  3577. var
  3578. _DbgHelpCreateUserDumpW: Pointer;
  3579. function DbgHelpCreateUserDumpW;
  3580. begin
  3581. GetProcedureAddress(_DbgHelpCreateUserDumpW, ImageHlpLib, 'DbgHelpCreateUserDumpW');
  3582. asm
  3583. MOV ESP, EBP
  3584. POP EBP
  3585. JMP [_DbgHelpCreateUserDumpW]
  3586. end;
  3587. end;
  3588. var
  3589. _SymGetSymFromAddr64: Pointer;
  3590. function SymGetSymFromAddr64;
  3591. begin
  3592. GetProcedureAddress(_SymGetSymFromAddr64, ImageHlpLib, 'SymGetSymFromAddr64');
  3593. asm
  3594. MOV ESP, EBP
  3595. POP EBP
  3596. JMP [_SymGetSymFromAddr64]
  3597. end;
  3598. end;
  3599. var
  3600. _SymGetSymFromAddr: Pointer;
  3601. function SymGetSymFromAddr;
  3602. begin
  3603. GetProcedureAddress(_SymGetSymFromAddr, ImageHlpLib, 'SymGetSymFromAddr');
  3604. asm
  3605. MOV ESP, EBP
  3606. POP EBP
  3607. JMP [_SymGetSymFromAddr]
  3608. end;
  3609. end;
  3610. var
  3611. _SymGetSymFromName64: Pointer;
  3612. function SymGetSymFromName64;
  3613. begin
  3614. GetProcedureAddress(_SymGetSymFromName64, ImageHlpLib, 'SymGetSymFromName64');
  3615. asm
  3616. MOV ESP, EBP
  3617. POP EBP
  3618. JMP [_SymGetSymFromName64]
  3619. end;
  3620. end;
  3621. var
  3622. _SymGetSymFromName: Pointer;
  3623. function SymGetSymFromName;
  3624. begin
  3625. GetProcedureAddress(_SymGetSymFromName, ImageHlpLib, 'SymGetSymFromName');
  3626. asm
  3627. MOV ESP, EBP
  3628. POP EBP
  3629. JMP [_SymGetSymFromName]
  3630. end;
  3631. end;
  3632. var
  3633. _FindFileInPath: Pointer;
  3634. function FindFileInPath;
  3635. begin
  3636. GetProcedureAddress(_FindFileInPath, ImageHlpLib, 'FindFileInPath');
  3637. asm
  3638. MOV ESP, EBP
  3639. POP EBP
  3640. JMP [_FindFileInPath]
  3641. end;
  3642. end;
  3643. var
  3644. _FindFileInSearchPath: Pointer;
  3645. function FindFileInSearchPath;
  3646. begin
  3647. GetProcedureAddress(_FindFileInSearchPath, ImageHlpLib, 'FindFileInSearchPath');
  3648. asm
  3649. MOV ESP, EBP
  3650. POP EBP
  3651. JMP [_FindFileInSearchPath]
  3652. end;
  3653. end;
  3654. var
  3655. _SymEnumSym: Pointer;
  3656. function SymEnumSym;
  3657. begin
  3658. GetProcedureAddress(_SymEnumSym, ImageHlpLib, 'SymEnumSym');
  3659. asm
  3660. MOV ESP, EBP
  3661. POP EBP
  3662. JMP [_SymEnumSym]
  3663. end;
  3664. end;
  3665. var
  3666. _MiniDumpWriteDump: Pointer;
  3667. function MiniDumpWriteDump;
  3668. begin
  3669. GetProcedureAddress(_MiniDumpWriteDump, ImageHlpLib, 'MiniDumpWriteDump');
  3670. asm
  3671. MOV ESP, EBP
  3672. POP EBP
  3673. JMP [_MiniDumpWriteDump]
  3674. end;
  3675. end;
  3676. var
  3677. _MiniDumpReadDumpStream: Pointer;
  3678. function MiniDumpReadDumpStream;
  3679. begin
  3680. GetProcedureAddress(_MiniDumpReadDumpStream, ImageHlpLib, 'MiniDumpReadDumpStream');
  3681. asm
  3682. MOV ESP, EBP
  3683. POP EBP
  3684. JMP [_MiniDumpReadDumpStream]
  3685. end;
  3686. end;
  3687. {$ELSE}
  3688. function BindImage; external ImageHlpLib name 'BindImage';
  3689. function BindImageEx; external ImageHlpLib name 'BindImageEx';
  3690. function ReBaseImage; external ImageHlpLib name 'ReBaseImage';
  3691. function ReBaseImage64; external ImageHlpLib name 'ReBaseImage64';
  3692. function CheckSumMappedFile; external ImageHlpLib name 'CheckSumMappedFile';
  3693. function MapFileAndCheckSumA; external ImageHlpLib name 'MapFileAndCheckSumA';
  3694. function MapFileAndCheckSumW; external ImageHlpLib name 'MapFileAndCheckSumW';
  3695. function MapFileAndCheckSum; external ImageHlpLib name 'MapFileAndCheckSum' + AWSuffix;
  3696. function GetImageConfigInformation; external ImageHlpLib name 'GetImageConfigInformation';
  3697. function GetImageUnusedHeaderBytes; external ImageHlpLib name 'GetImageUnusedHeaderBytes';
  3698. function SetImageConfigInformation; external ImageHlpLib name 'SetImageConfigInformation';
  3699. function ImageGetDigestStream; external ImageHlpLib name 'ImageGetDigestStream';
  3700. function ImageAddCertificate; external ImageHlpLib name 'ImageAddCertificate';
  3701. function ImageRemoveCertificate; external ImageHlpLib name 'ImageRemoveCertificate';
  3702. function ImageEnumerateCertificates; external ImageHlpLib name 'ImageEnumerateCertificates';
  3703. function ImageGetCertificateData; external ImageHlpLib name 'ImageGetCertificateData';
  3704. function ImageGetCertificateHeader; external ImageHlpLib name 'ImageGetCertificateHeader';
  3705. function ImageLoad; external ImageHlpLib name 'ImageLoad';
  3706. function ImageUnload; external ImageHlpLib name 'ImageUnload';
  3707. function MapAndLoad; external ImageHlpLib name 'MapAndLoad';
  3708. function UnMapAndLoad; external ImageHlpLib name 'UnMapAndLoad';
  3709. function TouchFileTimes; external ImageHlpLib name 'TouchFileTimes';
  3710. function SplitSymbols; external ImageHlpLib name 'SplitSymbols';
  3711. function UpdateDebugInfoFile; external ImageHlpLib name 'UpdateDebugInfoFile';
  3712. function UpdateDebugInfoFileEx; external ImageHlpLib name 'UpdateDebugInfoFileEx';
  3713. function FindDebugInfoFile; external ImageHlpLib name 'FindDebugInfoFile';
  3714. function FindDebugInfoFileEx; external ImageHlpLib name 'FindDebugInfoFileEx';
  3715. function SymFindFileInPath; external ImageHlpLib name 'SymFindFileInPath';
  3716. function FindExecutableImage; external ImageHlpLib name 'FindExecutableImage';
  3717. function FindExecutableImageEx; external ImageHlpLib name 'FindExecutableImageEx';
  3718. function ImageNtHeader; external ImageHlpLib name 'ImageNtHeader';
  3719. function ImageDirectoryEntryToDataEx; external ImageHlpLib name 'ImageDirectoryEntryToDataEx';
  3720. function ImageDirectoryEntryToData; external ImageHlpLib name 'ImageDirectoryEntryToData';
  3721. function ImageRvaToSection; external ImageHlpLib name 'ImageRvaToSection';
  3722. function ImageRvaToVa; external ImageHlpLib name 'ImageRvaToVa';
  3723. function MapDebugInformation; external ImageHlpLib name 'MapDebugInformation';
  3724. function UnmapDebugInformation; external ImageHlpLib name 'UnmapDebugInformation';
  3725. function SearchTreeForFile; external ImageHlpLib name 'SearchTreeForFile';
  3726. function EnumDirTree; external ImageHlpLib name 'EnumDirTree';
  3727. function MakeSureDirectoryPathExists; external ImageHlpLib name 'MakeSureDirectoryPathExists';
  3728. function UnDecorateSymbolName; external ImageHlpLib name 'UnDecorateSymbolName';
  3729. function StackWalk64; external ImageHlpLib name 'StackWalk64';
  3730. function StackWalk; external ImageHlpLib name 'StackWalk';
  3731. function ImagehlpApiVersion; external ImageHlpLib name 'ImagehlpApiVersion';
  3732. function ImagehlpApiVersionEx; external ImageHlpLib name 'ImagehlpApiVersionEx';
  3733. function GetTimestampForLoadedLibrary; external ImageHlpLib name 'GetTimestampForLoadedLibrary';
  3734. function SymSetOptions; external ImageHlpLib name 'SymSetOptions';
  3735. function SymGetOptions; external ImageHlpLib name 'SymGetOptions';
  3736. function SymCleanup; external ImageHlpLib name 'SymCleanup';
  3737. function SymMatchString; external ImageHlpLib name 'SymMatchString';
  3738. function SymEnumSourceFiles; external ImageHlpLib name 'SymEnumSourceFiles';
  3739. function SymEnumerateModules64; external ImageHlpLib name 'SymEnumerateModules64';
  3740. function SymEnumerateModules; external ImageHlpLib name 'SymEnumerateModules';
  3741. function SymEnumerateSymbols64; external ImageHlpLib name 'SymEnumerateSymbols64';
  3742. function SymEnumerateSymbolsW64; external ImageHlpLib name 'SymEnumerateSymbolsW64';
  3743. function SymEnumerateSymbols; external ImageHlpLib name 'SymEnumerateSymbols';
  3744. function SymEnumerateSymbolsW; external ImageHlpLib name 'SymEnumerateSymbolsW';
  3745. function EnumerateLoadedModules64; external ImageHlpLib name 'EnumerateLoadedModules64';
  3746. function EnumerateLoadedModules; external ImageHlpLib name 'EnumerateLoadedModules';
  3747. function SymFunctionTableAccess64; external ImageHlpLib name 'SymFunctionTableAccess64';
  3748. function SymFunctionTableAccess; external ImageHlpLib name 'SymFunctionTableAccess';
  3749. function SymGetModuleInfo64; external ImageHlpLib name 'SymGetModuleInfo64';
  3750. function SymGetModuleInfoW64; external ImageHlpLib name 'SymGetModuleInfoW64';
  3751. function SymGetModuleInfo; external ImageHlpLib name 'SymGetModuleInfo';
  3752. function SymGetModuleInfoW; external ImageHlpLib name 'SymGetModuleInfoW';
  3753. function SymGetModuleBase64; external ImageHlpLib name 'SymGetModuleBase64';
  3754. function SymGetModuleBase; external ImageHlpLib name 'SymGetModuleBase';
  3755. function SymGetSymNext64; external ImageHlpLib name 'SymGetSymNext64';
  3756. function SymGetSymNext; external ImageHlpLib name 'SymGetSymNext';
  3757. function SymGetSymPrev64; external ImageHlpLib name 'SymGetSymPrev64';
  3758. function SymGetSymPrev; external ImageHlpLib name 'SymGetSymPrev';
  3759. function SymGetLineFromAddr64; external ImageHlpLib name 'SymGetLineFromAddr64';
  3760. function SymGetLineFromAddr; external ImageHlpLib name 'SymGetLineFromAddr';
  3761. function SymGetLineFromName64; external ImageHlpLib name 'SymGetLineFromName64';
  3762. function SymGetLineFromName; external ImageHlpLib name 'SymGetLineFromName';
  3763. function SymGetLineNext64; external ImageHlpLib name 'SymGetLineNext64';
  3764. function SymGetLineNext; external ImageHlpLib name 'SymGetLineNext';
  3765. function SymGetLinePrev64; external ImageHlpLib name 'SymGetLinePrev64';
  3766. function SymGetLinePrev; external ImageHlpLib name 'SymGetLinePrev';
  3767. function SymMatchFileName; external ImageHlpLib name 'SymMatchFileName';
  3768. function SymInitialize; external ImageHlpLib name 'SymInitialize';
  3769. function SymGetSearchPath; external ImageHlpLib name 'SymGetSearchPath';
  3770. function SymSetSearchPath; external ImageHlpLib name 'SymSetSearchPath';
  3771. function SymLoadModuleEx; external ImageHlpLib name 'SymLoadModuleEx';
  3772. function SymLoadModule64; external ImageHlpLib name 'SymLoadModule64';
  3773. function SymLoadModule; external ImageHlpLib name 'SymLoadModule';
  3774. function SymUnloadModule64; external ImageHlpLib name 'SymUnloadModule64';
  3775. function SymUnloadModule; external ImageHlpLib name 'SymUnloadModule';
  3776. function SymUnDName64; external ImageHlpLib name 'SymUnDName64';
  3777. function SymUnDName; external ImageHlpLib name 'SymUnDName';
  3778. function SymRegisterCallback64; external ImageHlpLib name 'SymRegisterCallback64';
  3779. function SymRegisterFunctionEntryCallback64; external ImageHlpLib name 'SymRegisterFunctionEntryCallback64';
  3780. function SymRegisterCallback; external ImageHlpLib name 'SymRegisterCallback';
  3781. function SymRegisterFunctionEntryCallback; external ImageHlpLib name 'SymRegisterFunctionEntryCallback';
  3782. function SymSetContext; external ImageHlpLib name 'SymSetContext';
  3783. function SymFromAddr; external ImageHlpLib name 'SymFromAddr';
  3784. function SymFromName; external ImageHlpLib name 'SymFromName';
  3785. function SymEnumSymbolsForAddr; external ImageHlpLib name 'SymEnumSymbolsForAddr';
  3786. function SymEnumSymbols; external ImageHlpLib name 'SymEnumSymbols';
  3787. function SymGetTypeInfo; external ImageHlpLib name 'SymGetTypeInfo';
  3788. function SymEnumTypes; external ImageHlpLib name 'SymEnumTypes';
  3789. function SymGetTypeFromName; external ImageHlpLib name 'SymGetTypeFromName';
  3790. function SymAddSymbol; external ImageHlpLib name 'SymAddSymbol';
  3791. function SymDeleteSymbol; external ImageHlpLib name 'SymDeleteSymbol';
  3792. function DbgHelpCreateUserDump; external ImageHlpLib name 'DbgHelpCreateUserDump';
  3793. function DbgHelpCreateUserDumpW; external ImageHlpLib name 'DbgHelpCreateUserDumpW';
  3794. function SymGetSymFromAddr64; external ImageHlpLib name 'SymGetSymFromAddr64';
  3795. function SymGetSymFromAddr; external ImageHlpLib name 'SymGetSymFromAddr';
  3796. function SymGetSymFromName64; external ImageHlpLib name 'SymGetSymFromName64';
  3797. function SymGetSymFromName; external ImageHlpLib name 'SymGetSymFromName';
  3798. function FindFileInPath; external ImageHlpLib name 'FindFileInPath';
  3799. function FindFileInSearchPath; external ImageHlpLib name 'FindFileInSearchPath';
  3800. function SymEnumSym; external ImageHlpLib name 'SymEnumSym';
  3801. function MiniDumpWriteDump; external ImageHlpLib name 'MiniDumpWriteDump';
  3802. function MiniDumpReadDumpStream; external ImageHlpLib name 'MiniDumpReadDumpStream';
  3803. {$ENDIF DYNAMIC_LINK}
  3804. end.