开通博客赚积分
发布资源赚积分
分类

源码开发语言/平台
当前位置：首页 > 源码/资料 > Windows编程 > 查看源码
JwaImageHlp.pas
资源名称：win32api.zip　[点击查看]
上传用户：davidchvip
上传日期：2009-07-28
资源大小：1749k
文件大小：143k
源码类别：

Windows编程

开发平台：

Delphi

JwaImageHlp.pas：源码内容
  1. {******************************************************************************}
  2. {                                                                       }
  3. { Image Help API interface Unit for Object Pascal                              }
  4. {                                                                       }
  5. { Portions created by Microsoft are Copyright (C) 1995-2001 Microsoft          }
  6. { Corporation. All Rights Reserved.                                            }
  7. {                 }
  8. { The original file is: imagehlp.h, released August 2001. The original Pascal  }
  9. { code is: ImageHelp.pas, released December 2000. The initial developer of the }
  10. { Pascal code is Marcel van Brakel (brakelm@chello.nl).                        }
  11. {                                                                              }
  12. { Portions created by Marcel van Brakel are Copyright (C) 1999-2001            }
  13. { Marcel van Brakel. All Rights Reserved.                                      }
  14. {                 }
  15. { Obtained through: Joint Endeavour of Delphi Innovators (Project JEDI)        }
  16. {                }
  17. { You may retrieve the latest version of this file at the Project JEDI home    }
  18. { page, located at http://delphi-jedi.org or my personal homepage located at   }
  19. { http://members.chello.nl/m.vanbrakel2                                        }
  20. {                }
  21. { The contents of this file are used with permission, subject to the Mozilla   }
  22. { Public License Version 1.1 (the "License"); you may not use this file except }
  23. { in compliance with the License. You may obtain a copy of the License at      }
  24. { http://www.mozilla.org/MPL/MPL-1.1.html                                      }
  25. {                                                                              }
  26. { Software distributed under the License is distributed on an "AS IS" basis,   }
  27. { WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for }
  28. { the specific language governing rights and limitations under the License.    }
  29. {                                                                              }
  30. { Alternatively, the contents of this file may be used under the terms of the  }
  31. { GNU Lesser General Public License (the  "LGPL License"), in which case the   }
  32. { provisions of the LGPL License are applicable instead of those above.        }
  33. { If you wish to allow use of your version of this file only under the terms   }
  34. { of the LGPL License and not to allow others to use your version of this file }
  35. { under the MPL, indicate your decision by deleting  the provisions above and  }
  36. { replace  them with the notice and other provisions required by the LGPL      }
  37. { License.  If you do not delete the provisions above, a recipient may use     }
  38. { your version of this file under either the MPL or the LGPL License.          }
  39. {                 }
  40. { For more information about the LGPL: http://www.gnu.org/copyleft/lesser.html }
  41. {                 }
  42. {******************************************************************************}
  44. unit JwaImageHlp;
  46. {$WEAKPACKAGEUNIT}
  48. {$HPPEMIT ''}
  49. {$HPPEMIT '#include "ImageHlp.h"'}
  50. {$HPPEMIT ''}
  52. {$I WINDEFINES.INC}
  54. interface
  56. uses
  57.   Windows, JwaWinBase, JwaWinNT, JwaWinType;
  59. const
  60.   IMAGE_SEPARATION = (64*1024);
  61.   {$EXTERNALSYM IMAGE_SEPARATION}
  63. type
  64.   PLOADED_IMAGE = ^LOADED_IMAGE;
  65.   {$EXTERNALSYM PLOADED_IMAGE}
  66.   _LOADED_IMAGE = record
  67.     ModuleName: PSTR;
  68.     hFile: HANDLE;
  69.     MappedAddress: PUCHAR;
  70.     FileHeader: PIMAGE_NT_HEADERS32;
  71.     LastRvaSection: PIMAGE_SECTION_HEADER;
  72.     NumberOfSections: ULONG;
  73.     Sections: PIMAGE_SECTION_HEADER;
  74.     Characteristics: ULONG;
  75.     fSystemImage: ByteBool;
  76.     fDOSImage: ByteBool;
  77.     Links: LIST_ENTRY;
  78.     SizeOfImage: ULONG;
  79.   end;
  80.   {$EXTERNALSYM _LOADED_IMAGE}
  81.   LOADED_IMAGE = _LOADED_IMAGE;
  82.   {$EXTERNALSYM LOADED_IMAGE}
  83.   TLoadedImage = LOADED_IMAGE;
  84.   PLoadedImage = PLOADED_IMAGE;
  86. const
  87.   MAX_SYM_NAME = 2000;
  88.   {$EXTERNALSYM MAX_SYM_NAME}
  90. function BindImage(ImageName, DllPath, SymbolPath: PSTR): BOOL; stdcall;
  91. {$EXTERNALSYM BindImage}
  93. type
  94.   _IMAGEHLP_STATUS_REASON = (
  95.     BindOutOfMemory,
  96.     BindRvaToVaFailed,
  97.     BindNoRoomInImage,
  98.     BindImportModuleFailed,
  99.     BindImportProcedureFailed,
  100.     BindImportModule,
  101.     BindImportProcedure,
  102.     BindForwarder,
  103.     BindForwarderNOT,
  104.     BindImageModified,
  105.     BindExpandFileHeaders,
  106.     BindImageComplete,
  107.     BindMismatchedSymbols,
  108.     BindSymbolsNotUpdated,
  109.     BindImportProcedure32,
  110.     BindImportProcedure64,
  111.     BindForwarder32,
  112.     BindForwarder64,
  113.     BindForwarderNOT32,
  114.     BindForwarderNOT64);
  115.   {$EXTERNALSYM _IMAGEHLP_STATUS_REASON}
  116.   IMAGEHLP_STATUS_REASON = _IMAGEHLP_STATUS_REASON;
  117.   {$EXTERNALSYM IMAGEHLP_STATUS_REASON}
  118.   TImageHlpStatusReason = IMAGEHLP_STATUS_REASON;
  120.   PIMAGEHLP_STATUS_ROUTINE = function (Reason: IMAGEHLP_STATUS_REASON;
  121.     ImageName, DllName: PSTR; Va, Parameter: ULONG_PTR): BOOL; stdcall;
  122.   {$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE}
  123.   PImageHlpStatusRoutine = PIMAGEHLP_STATUS_ROUTINE;
  125.   PIMAGEHLP_STATUS_ROUTINE32 = function (Reason: IMAGEHLP_STATUS_REASON; ImageName, DllName: PSTR;
  126.     Va: ULONG; Parameter: ULONG_PTR): BOOL; stdcall;
  127.   {$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE32}
  128.   PImageHlpStatusRoutine23 = PIMAGEHLP_STATUS_ROUTINE32;
  130.   PIMAGEHLP_STATUS_ROUTINE64 = function (Reason: IMAGEHLP_STATUS_REASON; ImageName, DllName: PSTR;
  131.     Va: ULONG64; Parameter: ULONG_PTR): BOOL; stdcall;
  132.   {$EXTERNALSYM PIMAGEHLP_STATUS_ROUTINE64}
  133.   PImageHlpStatusRoutine64 = PIMAGEHLP_STATUS_ROUTINE64;
  135. function BindImageEx(Flags: DWORD; ImageName, DllPath, SymbolPath: PSTR;
  136.   StatusRoutine: PIMAGEHLP_STATUS_ROUTINE): BOOL; stdcall;
  137. {$EXTERNALSYM BindImageEx}
  139. const
  140.   BIND_NO_BOUND_IMPORTS  = $00000001;
  141.   {$EXTERNALSYM BIND_NO_BOUND_IMPORTS}
  142.   BIND_NO_UPDATE         = $00000002;
  143.   {$EXTERNALSYM BIND_NO_UPDATE}
  144.   BIND_ALL_IMAGES        = $00000004;
  145.   {$EXTERNALSYM BIND_ALL_IMAGES}
  146.   BIND_CACHE_IMPORT_DLLS = $00000008; // Cache dll's across calls to BindImageEx (same as NT 3.1->NT 4.0)
  147.   {$EXTERNALSYM BIND_CACHE_IMPORT_DLLS}
  149.   BIND_REPORT_64BIT_VA   = $00000010;
  150.   {$EXTERNALSYM BIND_REPORT_64BIT_VA}
  152. function ReBaseImage(CurrentImageName: PSTR; SymbolPath: PSTR; fReBase: BOOL;
  153.   fRebaseSysfileOk: BOOL; fGoingDown: BOOL; CheckImageSize: ULONG;
  154.   var OldImageSize: ULONG; var OldImageBase: ULONG_PTR; var NewImageSize: ULONG;
  155.   var NewImageBase: ULONG_PTR; TimeStamp: ULONG): BOOL; stdcall;
  156. {$EXTERNALSYM ReBaseImage}
  158. function ReBaseImage64(CurrentImageName: PSTR; SymbolPath: PSTR; fReBase: BOOL;
  159.   fRebaseSysfileOk: BOOL; fGoingDown: BOOL; CheckImageSize: ULONG;
  160.   var OldImageSize: ULONG; var OldImageBase: ULONG64; var NewImageSize: ULONG;
  161.   var NewImageBase: ULONG64; TimeStamp: ULONG): BOOL; stdcall;
  162. {$EXTERNALSYM ReBaseImage64}
  164. //
  165. // Define checksum return codes.
  166. //
  168. const
  169.   CHECKSUM_SUCCESS         = 0;
  170.   {$EXTERNALSYM CHECKSUM_SUCCESS}
  171.   CHECKSUM_OPEN_FAILURE    = 1;
  172.   {$EXTERNALSYM CHECKSUM_OPEN_FAILURE}
  173.   CHECKSUM_MAP_FAILURE     = 2;
  174.   {$EXTERNALSYM CHECKSUM_MAP_FAILURE}
  175.   CHECKSUM_MAPVIEW_FAILURE = 3;
  176.   {$EXTERNALSYM CHECKSUM_MAPVIEW_FAILURE}
  177.   CHECKSUM_UNICODE_FAILURE = 4;
  178.   {$EXTERNALSYM CHECKSUM_UNICODE_FAILURE}
  180. // Define Splitsym flags.
  182.   SPLITSYM_REMOVE_PRIVATE = $00000001; // Remove CV types/symbols and Fixup debug
  183.   {$EXTERNALSYM SPLITSYM_REMOVE_PRIVATE}
  184.                                                     //  Used for creating .dbg files that ship
  185.                                                     //  as part of the product.
  187.   SPLITSYM_EXTRACT_ALL = $00000002; // Extract all debug info from image.
  188.   {$EXTERNALSYM SPLITSYM_EXTRACT_ALL}
  189.                                                     //  Normally, FPO is left in the image
  190.                                                     //  to allow stack traces through the code.
  191.                                                     //  Using this switch is similar to linking
  192.                                                     //  with -debug:none except the .dbg file
  193.                                                     //  exists...
  195.   SPLITSYM_SYMBOLPATH_IS_SRC = $00000004; // The SymbolFilePath contains an alternate
  196.   {$EXTERNALSYM SPLITSYM_SYMBOLPATH_IS_SRC}
  197.                                                     //  path to locate the pdb.
  199. //
  200. // Define checksum function prototypes.
  201. //
  203. function CheckSumMappedFile(BaseAddress: PVOID; FileLength: DWORD;
  204.   var HeaderSum, CheckSum: DWORD): PIMAGE_NT_HEADERS; stdcall;
  205. {$EXTERNALSYM CheckSumMappedFile}
  207. function MapFileAndCheckSumA(Filename: PSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
  208. {$EXTERNALSYM MapFileAndCheckSumA}
  209. function MapFileAndCheckSumW(Filename: PWSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
  210. {$EXTERNALSYM MapFileAndCheckSumW}
  212. {$IFDEF UNICODE}
  213. function MapFileAndCheckSum(Filename: PWSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
  214. {$EXTERNALSYM MapFileAndCheckSum}
  215. {$ELSE}
  216. function MapFileAndCheckSum(Filename: PSTR; var HeaderSum, CheckSum: DWORD): DWORD; stdcall;
  217. {$EXTERNALSYM MapFileAndCheckSum}
  218. {$ENDIF}
  220. function GetImageConfigInformation(const LoadedImage: LOADED_IMAGE;
  221.   var ImageConfigInformation: IMAGE_LOAD_CONFIG_DIRECTORY): BOOL; stdcall;
  222. {$EXTERNALSYM GetImageConfigInformation}
  224. function GetImageUnusedHeaderBytes(const LoadedImage: LOADED_IMAGE;
  225.   var SizeUnusedHeaderBytes: DWORD): DWORD; stdcall;
  226. {$EXTERNALSYM GetImageUnusedHeaderBytes}
  228. function SetImageConfigInformation(const LoadedImage: LOADED_IMAGE;
  229.   const ImageConfigInformation: IMAGE_LOAD_CONFIG_DIRECTORY): BOOL; stdcall;
  230. {$EXTERNALSYM SetImageConfigInformation}
  232. // Image Integrity API's
  234. const
  235.   CERT_PE_IMAGE_DIGEST_DEBUG_INFO      = $01;
  236.   {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_DEBUG_INFO}
  237.   CERT_PE_IMAGE_DIGEST_RESOURCES       = $02;
  238.   {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_RESOURCES}
  239.   CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO = $04;
  240.   {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_ALL_IMPORT_INFO}
  241.   CERT_PE_IMAGE_DIGEST_NON_PE_INFO     = $08; // include data outside the PE image
  242.   {$EXTERNALSYM CERT_PE_IMAGE_DIGEST_NON_PE_INFO}
  244.   CERT_SECTION_TYPE_ANY = $FF; // Any Certificate type
  245.   {$EXTERNALSYM CERT_SECTION_TYPE_ANY}
  247. type
  248.   DIGEST_HANDLE = PVOID;
  249.   {$EXTERNALSYM DIGEST_HANDLE}
  250.   TDigestHandle = DIGEST_HANDLE;
  252.   DIGEST_FUNCTION = function (refdata: DIGEST_HANDLE; pData: PBYTE; dwLength: DWORD): BOOL; stdcall;
  253.   {$EXTERNALSYM DIGEST_FUNCTION}
  254.   TDigestFunction = DIGEST_FUNCTION;
  256. function ImageGetDigestStream(FileHandle: HANDLE; DigestLevel: DWORD;
  257.   DigestFunction: DIGEST_FUNCTION; DigestHandle: DIGEST_HANDLE): BOOL; stdcall;
  258. {$EXTERNALSYM ImageGetDigestStream}
  260. function ImageAddCertificate(FileHandle: HANDLE; Certificate: PWinCertificate;
  261.   var Index: DWORD): BOOL; stdcall;
  262. {$EXTERNALSYM ImageAddCertificate}
  264. function ImageRemoveCertificate(FileHandle: HANDLE; Index: DWORD): BOOL; stdcall;
  265. {$EXTERNALSYM ImageRemoveCertificate}
  267. function ImageEnumerateCertificates(FileHandle: HANDLE; TypeFilter: WORD;
  268.   var CertificateCount: DWORD; Indices: PDWORD; IndexCount: DWORD): BOOL; stdcall;
  269. {$EXTERNALSYM ImageEnumerateCertificates}
  271. function ImageGetCertificateData(FileHandle: HANDLE; CertificateIndex: DWORD;
  272.   Certificate: PWinCertificate; var RequiredLength: DWORD): BOOL; stdcall;
  273. {$EXTERNALSYM ImageGetCertificateData}
  275. function ImageGetCertificateHeader(FileHandle: HANDLE; CertificateIndex: DWORD;
  276.   Certificateheader: PWinCertificate): BOOL; stdcall;
  277. {$EXTERNALSYM ImageGetCertificateHeader}
  279. function ImageLoad(DllName: PSTR; DllPath: PSTR): PLOADED_IMAGE; stdcall;
  280. {$EXTERNALSYM ImageLoad}
  282. function ImageUnload(const LoadedImage: LOADED_IMAGE): BOOL; stdcall;
  283. {$EXTERNALSYM ImageUnload}
  285. function MapAndLoad(ImageName, DllPath: PSTR; var LoadedImage: LOADED_IMAGE;
  286.   DotDll: BOOL; ReadOnly: BOOL): BOOL; stdcall;
  287. {$EXTERNALSYM MapAndLoad}
  289. function UnMapAndLoad(const LoadedImage: LOADED_IMAGE): BOOL; stdcall;
  290. {$EXTERNALSYM UnMapAndLoad}
  292. function TouchFileTimes(FileHandle: HANDLE; pSystemTime: PSYSTEMTIME): BOOL; stdcall;
  293. {$EXTERNALSYM TouchFileTimes}
  295. function SplitSymbols(ImageName, SymbolsPath, SymbolFilePath: PSTR; Flags: DWORD): BOOL; stdcall;
  296. {$EXTERNALSYM SplitSymbols}
  298. function UpdateDebugInfoFile(ImageFileName, SymbolPath, DebugFilePath: PSTR;
  299.   const NtHeaders: IMAGE_NT_HEADERS32): BOOL; stdcall;
  300. {$EXTERNALSYM UpdateDebugInfoFile}
  302. function UpdateDebugInfoFileEx(ImageFileName, SymbolPath, DebugFilePath: PSTR;
  303.   const NtHeaders: IMAGE_NT_HEADERS32; OldChecksum: DWORD): BOOL; stdcall;
  304. {$EXTERNALSYM UpdateDebugInfoFileEx}
  306. function FindDebugInfoFile(FileName, SymbolPath, DebugFilePath: PSTR): HANDLE; stdcall;
  307. {$EXTERNALSYM FindDebugInfoFile}
  309. type
  310.   PFIND_DEBUG_FILE_CALLBACK = function (FileHandle: HANDLE; FileName: PSTR;
  311.     CallerData: PVOID): BOOL; stdcall;
  312.   {$EXTERNALSYM PFIND_DEBUG_FILE_CALLBACK}
  313.   PFindDebugFileCallback = PFIND_DEBUG_FILE_CALLBACK;
  315. function FindDebugInfoFileEx(FileName, SymbolPath, DebugFilePath: PSTR;
  316.   Callback: PFIND_DEBUG_FILE_CALLBACK; CallerData: PVOID): HANDLE; stdcall;
  317. {$EXTERNALSYM FindDebugInfoFileEx}
  319. type
  320.   PFINDFILEINPATHCALLBACK = function (filename: PSTR; context: PVOID): BOOL; stdcall;
  321.   {$EXTERNALSYM PFINDFILEINPATHCALLBACK}
  323. function SymFindFileInPath(hprocess: HANDLE; SearchPath, FileName: LPSTR; id: PVOID; two, three, flags: DWORD;
  324.   FoundFile: LPSTR; callback: PFINDFILEINPATHCALLBACK; context: PVOID): BOOL; stdcall;
  325. {$EXTERNALSYM SymFindFileInPath}
  327. function FindExecutableImage(FileName, SymbolPath, ImageFilePath: PSTR): HANDLE; stdcall;
  328. {$EXTERNALSYM FindExecutableImage}
  330. type
  331.   PFIND_EXE_FILE_CALLBACK = function (FileHandle: HANDLE; FileName: PSTR;
  332.     CallerData: PVOID): BOOL; stdcall;
  333.   {$EXTERNALSYM PFIND_EXE_FILE_CALLBACK}
  334.   PFindExeFileCallback = PFIND_EXE_FILE_CALLBACK;
  336. function FindExecutableImageEx(FileName, SymbolPath, ImageFilePath: PSTR;
  337.   Callback: PFIND_EXE_FILE_CALLBACK; CallerData: PVOID): HANDLE; stdcall;
  338. {$EXTERNALSYM FindExecutableImageEx}
  340. function ImageNtHeader(Base: PVOID): PIMAGE_NT_HEADERS; stdcall;
  341. {$EXTERNALSYM ImageNtHeader}
  343. function ImageDirectoryEntryToDataEx(Base: PVOID; MappedAsImage: ByteBool;
  344.   DirectoryEntry: USHORT; var Size: ULONG; var FoundHeader: PIMAGE_SECTION_HEADER): PVOID; stdcall;
  345. {$EXTERNALSYM ImageDirectoryEntryToDataEx}
  347. function ImageDirectoryEntryToData(Base: PVOID; MappedAsImage: ByteBool;
  348.   DirectoryEntry: USHORT; var Size: ULONG): PVOID; stdcall;
  349. {$EXTERNALSYM ImageDirectoryEntryToData}
  351. function ImageRvaToSection(NtHeaders: PIMAGE_NT_HEADERS; Base: PVOID; Rva: ULONG): PIMAGE_SECTION_HEADER; stdcall;
  352. {$EXTERNALSYM ImageRvaToSection}
  354. function ImageRvaToVa(NtHeaders: PIMAGE_NT_HEADERS; Base: PVOID; Rva: ULONG;
  355.   var LastRvaSection: PIMAGE_SECTION_HEADER): PVOID; stdcall;
  356. {$EXTERNALSYM ImageRvaToVa}
  358. // Symbol server exports
  360. type
  361.   PSYMBOLSERVERPROC = function (a1, a2: LPCSTR; a3: PVOID; a4, a5: DWORD; a6: LPSTR): BOOL; stdcall;
  362.   {$EXTERNALSYM PSYMBOLSERVERPROC}
  363.   PSYMBOLSERVEROPENPROC = function: BOOL; stdcall;
  364.   {$EXTERNALSYM PSYMBOLSERVEROPENPROC}
  365.   PSYMBOLSERVERCLOSEPROC = function: BOOL; stdcall;
  366.   {$EXTERNALSYM PSYMBOLSERVERCLOSEPROC}
  367.   PSYMBOLSERVERSETOPTIONSPROC = function (a1: UINT_PTR; a2: ULONG64): BOOL; stdcall;
  368.   {$EXTERNALSYM PSYMBOLSERVERSETOPTIONSPROC}
  369.   PSYMBOLSERVERCALLBACKPROC = function (action: UINT_PTR; data: ULONG64; context: ULONG64): BOOL; stdcall;
  370.   {$EXTERNALSYM PSYMBOLSERVERCALLBACKPROC}
  371.   PSYMBOLSERVERGETOPTIONSPROC = function: UINT_PTR; stdcall;
  372.   {$EXTERNALSYM PSYMBOLSERVERGETOPTIONSPROC}
  373.   PSYMBOLSERVERPINGPROC = function (a1: LPCSTR): BOOL; stdcall;
  374.   {$EXTERNALSYM PSYMBOLSERVERPINGPROC}
  376. const
  377.   SSRVOPT_CALLBACK   = $01;
  378.   {$EXTERNALSYM SSRVOPT_CALLBACK}
  379.   SSRVOPT_DWORD      = $02;
  380.   {$EXTERNALSYM SSRVOPT_DWORD}
  381.   SSRVOPT_DWORDPTR   = $04;
  382.   {$EXTERNALSYM SSRVOPT_DWORDPTR}
  383.   SSRVOPT_GUIDPTR    = $08;
  384.   {$EXTERNALSYM SSRVOPT_GUIDPTR}
  385.   SSRVOPT_OLDGUIDPTR = $10;
  386.   {$EXTERNALSYM SSRVOPT_OLDGUIDPTR}
  387.   SSRVOPT_UNATTENDED = $20;
  388.   {$EXTERNALSYM SSRVOPT_UNATTENDED}
  389.   SSRVOPT_RESET      = ULONG_PTR(-1);
  390.   {$EXTERNALSYM SSRVOPT_RESET}
  392.   SSRVACTION_TRACE   = 1;
  393.   {$EXTERNALSYM SSRVACTION_TRACE}
  395. // This api won't be ported to Win64 - Fix your code.
  397. type
  398.   PIMAGE_DEBUG_INFORMATION = ^IMAGE_DEBUG_INFORMATION;
  399.   {$EXTERNALSYM PIMAGE_DEBUG_INFORMATION}
  400.   _IMAGE_DEBUG_INFORMATION = record
  401.     List: LIST_ENTRY;
  402.     ReservedSize: DWORD;
  403.     ReservedMappedBase: PVOID;
  404.     ReservedMachine: USHORT;
  405.     ReservedCharacteristics: USHORT;
  406.     ReservedCheckSum: DWORD;
  407.     ImageBase: DWORD;
  408.     SizeOfImage: DWORD;
  409.     ReservedNumberOfSections: DWORD;
  410.     ReservedSections: PIMAGE_SECTION_HEADER;
  411.     ReservedExportedNamesSize: DWORD;
  412.     ReservedExportedNames: PSTR;
  413.     ReservedNumberOfFunctionTableEntries: DWORD;
  414.     ReservedFunctionTableEntries: PIMAGE_FUNCTION_ENTRY;
  415.     ReservedLowestFunctionStartingAddress: DWORD;
  416.     ReservedHighestFunctionEndingAddress: DWORD;
  417.     ReservedNumberOfFpoTableEntries: DWORD;
  418.     ReservedFpoTableEntries: PFPO_DATA;
  419.     SizeOfCoffSymbols: DWORD;
  420.     CoffSymbols: PIMAGE_COFF_SYMBOLS_HEADER;
  421.     ReservedSizeOfCodeViewSymbols: DWORD;
  422.     ReservedCodeViewSymbols: PVOID;
  423.     ImageFilePath: PSTR;
  424.     ImageFileName: PSTR;
  425.     ReservedDebugFilePath: PSTR;
  426.     ReservedTimeDateStamp: DWORD;
  427.     ReservedRomImage: BOOL;
  428.     ReservedDebugDirectory: PIMAGE_DEBUG_DIRECTORY;
  429.     ReservedNumberOfDebugDirectories: DWORD;
  430.     ReservedOriginalFunctionTableBaseAddress: DWORD;
  431.     Reserved: array [0..1] of DWORD;
  432.   end;
  433.   {$EXTERNALSYM _IMAGE_DEBUG_INFORMATION}
  434.   IMAGE_DEBUG_INFORMATION = _IMAGE_DEBUG_INFORMATION;
  435.   {$EXTERNALSYM IMAGE_DEBUG_INFORMATION}
  436.   TImageDebugInformation = IMAGE_DEBUG_INFORMATION;
  437.   PImageDebugInformation = PIMAGE_DEBUG_INFORMATION;
  439. function MapDebugInformation(FileHandle: HANDLE; FileName, SymbolPath: PSTR;
  440.   ImageBase: DWORD): PIMAGE_DEBUG_INFORMATION; stdcall;
  441. {$EXTERNALSYM MapDebugInformation}
  443. function UnmapDebugInformation(DebugInfo: PIMAGE_DEBUG_INFORMATION): BOOL; stdcall;
  444. {$EXTERNALSYM UnmapDebugInformation}
  446. function SearchTreeForFile(RootPath, InputPathName, OutputPathBuffer: PSTR): BOOL; stdcall;
  447. {$EXTERNALSYM SearchTreeForFile}
  449. type
  450.   PENUMDIRTREE_CALLBACK = function (FilePath: LPCSTR; CallerData: PVOID): BOOL; stdcall;
  451.   {$EXTERNALSYM PENUMDIRTREE_CALLBACK}
  452.   PEnumDirTreeCallback = PENUMDIRTREE_CALLBACK;
  454. function EnumDirTree(hProcess: HANDLE; RootPath, InputPathName, OutputPathBuffer: PSTR;
  455.   Callback: PENUMDIRTREE_CALLBACK; CallbackData: PVOID): BOOL; stdcall;
  456. {$EXTERNALSYM EnumDirTree}
  458. function MakeSureDirectoryPathExists(DirPath: PCSTR): BOOL; stdcall;
  459. {$EXTERNALSYM MakeSureDirectoryPathExists}
  461. //
  462. // UnDecorateSymbolName Flags
  463. //
  465. const
  466.   UNDNAME_COMPLETE               = ($0000); // Enable full undecoration
  467.   {$EXTERNALSYM UNDNAME_COMPLETE}
  468.   UNDNAME_NO_LEADING_UNDERSCORES = ($0001); // Remove leading underscores from MS extended keywords
  469.   {$EXTERNALSYM UNDNAME_NO_LEADING_UNDERSCORES}
  470.   UNDNAME_NO_MS_KEYWORDS         = ($0002); // Disable expansion of MS extended keywords
  471.   {$EXTERNALSYM UNDNAME_NO_MS_KEYWORDS}
  472.   UNDNAME_NO_FUNCTION_RETURNS    = ($0004); // Disable expansion of return type for primary declaration
  473.   {$EXTERNALSYM UNDNAME_NO_FUNCTION_RETURNS}
  474.   UNDNAME_NO_ALLOCATION_MODEL    = ($0008); // Disable expansion of the declaration model
  475.   {$EXTERNALSYM UNDNAME_NO_ALLOCATION_MODEL}
  476.   UNDNAME_NO_ALLOCATION_LANGUAGE = ($0010); // Disable expansion of the declaration language specifier
  477.   {$EXTERNALSYM UNDNAME_NO_ALLOCATION_LANGUAGE}
  478.   UNDNAME_NO_MS_THISTYPE         = ($0020); // NYI Disable expansion of MS keywords on the 'this' type for primary declaration
  479.   {$EXTERNALSYM UNDNAME_NO_MS_THISTYPE}
  480.   UNDNAME_NO_CV_THISTYPE         = ($0040); // NYI Disable expansion of CV modifiers on the 'this' type for primary declaration
  481.   {$EXTERNALSYM UNDNAME_NO_CV_THISTYPE}
  482.   UNDNAME_NO_THISTYPE            = ($0060); // Disable all modifiers on the 'this' type
  483.   {$EXTERNALSYM UNDNAME_NO_THISTYPE}
  484.   UNDNAME_NO_ACCESS_SPECIFIERS   = ($0080); // Disable expansion of access specifiers for members
  485.   {$EXTERNALSYM UNDNAME_NO_ACCESS_SPECIFIERS}
  486.   UNDNAME_NO_THROW_SIGNATURES    = ($0100); // Disable expansion of 'throw-signatures' for functions and pointers to functions
  487.   {$EXTERNALSYM UNDNAME_NO_THROW_SIGNATURES}
  488.   UNDNAME_NO_MEMBER_TYPE         = ($0200); // Disable expansion of 'static' or 'virtual'ness of members
  489.   {$EXTERNALSYM UNDNAME_NO_MEMBER_TYPE}
  490.   UNDNAME_NO_RETURN_UDT_MODEL    = ($0400); // Disable expansion of MS model for UDT returns
  491.   {$EXTERNALSYM UNDNAME_NO_RETURN_UDT_MODEL}
  492.   UNDNAME_32_BIT_DECODE          = ($0800); // Undecorate 32-bit decorated names
  493.   {$EXTERNALSYM UNDNAME_32_BIT_DECODE}
  494.   UNDNAME_NAME_ONLY              = ($1000); // Crack only the name for primary declaration;
  495.   {$EXTERNALSYM UNDNAME_NAME_ONLY}
  496.                                                                                                    //  return just [scope::]name.  Does expand template params
  497.   UNDNAME_NO_ARGUMENTS    = ($2000); // Don't undecorate arguments to function
  498.   {$EXTERNALSYM UNDNAME_NO_ARGUMENTS}
  499.   UNDNAME_NO_SPECIAL_SYMS = ($4000); // Don't undecorate special names (v-table, vcall, vector xxx, metatype, etc)
  500.   {$EXTERNALSYM UNDNAME_NO_SPECIAL_SYMS}
  502. function UnDecorateSymbolName(DecoratedName: PCSTR; UnDecoratedName: PSTR;
  503.   UndecoratedLength: DWORD; Flags: DWORD): DWORD; stdcall;
  504. {$EXTERNALSYM UnDecorateSymbolName}
  506. //
  507. // these values are used for synthesized file types
  508. // that can be passed in as image headers instead of
  509. // the standard ones from ntimage.h
  510. //
  512. const
  513.   DBHHEADER_DEBUGDIRS    = $1;
  514.   {$EXTERNALSYM DBHHEADER_DEBUGDIRS}
  516. type
  517.   _MODLOAD_DATA = record
  518.     ssize: DWORD;                  // size of this struct
  519.     ssig: DWORD;                   // signature identifying the passed data
  520.     data: PVOID;                   // pointer to passed data
  521.     size: DWORD;                   // size of passed data
  522.     flags: DWORD;                  // options
  523.   end;
  524.   {$EXTERNALSYM _MODLOAD_DATA}
  525.   MODLOAD_DATA = _MODLOAD_DATA;
  526.   {$EXTERNALSYM MODLOAD_DATA}
  527.   PMODLOAD_DATA = ^MODLOAD_DATA;
  528.   {$EXTERNALSYM PMODLOAD_DATA}
  529.   TModLoadData = MODLOAD_DATA;
  530.   PModLoadData = PMODLOAD_DATA;
  532. //
  533. // StackWalking API
  534. //
  536. type
  537.   ADDRESS_MODE = (
  538.     AddrMode1616,
  539.     AddrMode1632,
  540.     AddrModeReal,
  541.     AddrModeFlat);
  542.   {$EXTERNALSYM ADDRESS_MODE}
  543.   TAddressMode = ADDRESS_MODE;
  545.   LPADDRESS64 = ^ADDRESS64;
  546.   {$EXTERNALSYM PADDRESS64}
  547.   _tagADDRESS64 = record
  548.     Offset: DWORD64;
  549.     Segment: WORD;
  550.     Mode: ADDRESS_MODE;
  551.   end;
  552.   {$EXTERNALSYM _tagADDRESS64}
  553.   ADDRESS64 = _tagADDRESS64;
  554.   {$EXTERNALSYM ADDRESS64}
  555.   TAddress64 = ADDRESS64;
  556.   PAddress64 = LPADDRESS64;
  558.   LPADDRESS = ^ADDRESS;
  559.   {$EXTERNALSYM PADDRESS}
  560.   _tagADDRESS = record
  561.     Offset: DWORD;
  562.     Segment: WORD;
  563.     Mode: ADDRESS_MODE;
  564.   end;
  565.   {$EXTERNALSYM _tagADDRESS}
  566.   ADDRESS = _tagADDRESS;
  567.   {$EXTERNALSYM ADDRESS}
  568.   TAddress = ADDRESS;
  569.   PAddress = LPADDRESS;
  571. procedure Address32To64(a32: LPADDRESS; a64: LPADDRESS64);
  572. {$EXTERNALSYM Address32To64}
  574. procedure Address64To32(a64: LPADDRESS64; a32: LPADDRESS);
  575. {$EXTERNALSYM Address64To32}
  577. //
  578. // This structure is included in the STACKFRAME structure,
  579. // and is used to trace through usermode callbacks in a thread's
  580. // kernel stack.  The values must be copied by the kernel debugger
  581. // from the DBGKD_GET_VERSION and WAIT_STATE_CHANGE packets.
  582. //
  584. //
  585. // New KDHELP structure for 64 bit system support.
  586. // This structure is preferred in new code.
  587. //
  589. type
  590.   PKDHELP64 = ^KDHELP64;
  591.   {$EXTERNALSYM PKDHELP64}
  592.   _KDHELP64 = record
  593.     //
  594.     // address of kernel thread object, as provided in the
  595.     // WAIT_STATE_CHANGE packet.
  596.     //
  597.     Thread: DWORD64;
  598.     //
  599.     // offset in thread object to pointer to the current callback frame
  600.     // in kernel stack.
  601.     //
  602.     ThCallbackStack: DWORD;
  603.     //
  604.     // offset in thread object to pointer to the current callback backing
  605.     // store frame in kernel stack.
  606.     //
  607.     ThCallbackBStore: DWORD;
  608.     //
  609.     // offsets to values in frame:
  610.     //
  611.     // address of next callback frame
  612.     NextCallback: DWORD;
  613.     // address of saved frame pointer (if applicable)
  614.     FramePointer: DWORD;
  615.     //
  616.     // Address of the kernel function that calls out to user mode
  617.     //
  618.     KiCallUserMode: DWORD64;
  619.     //
  620.     // Address of the user mode dispatcher function
  621.     //
  622.     KeUserCallbackDispatcher: DWORD64;
  623.     //
  624.     // Lowest kernel mode address
  625.     //
  626.     SystemRangeStart: DWORD64;
  627.     Reserved: array [0..7] of DWORD64;
  628.   end;
  629.   {$EXTERNALSYM _KDHELP64}
  630.   KDHELP64 = _KDHELP64;
  631.   {$EXTERNALSYM KDHELP64}
  632.   TKdHelp64 = KDHELP64;
  633.   //PKdHelp64 = PKDHELP64;
  635.   PKDHELP = ^KDHELP;
  636.   {$EXTERNALSYM PKDHELP}
  637.   _KDHELP = record
  638.     //
  639.     // address of kernel thread object, as provided in the
  640.     // WAIT_STATE_CHANGE packet.
  641.     //
  642.     Thread: DWORD;
  643.     //
  644.     // offset in thread object to pointer to the current callback frame
  645.     // in kernel stack.
  646.     //
  647.     ThCallbackStack: DWORD;
  648.     //
  649.     // offsets to values in frame:
  650.     //
  651.     // address of next callback frame
  652.     NextCallback: DWORD;
  653.     // address of saved frame pointer (if applicable)
  654.     FramePointer: DWORD;
  655.     //
  656.     // Address of the kernel function that calls out to user mode
  657.     //
  658.     KiCallUserMode: DWORD;
  659.     //
  660.     // Address of the user mode dispatcher function
  661.     //
  662.     KeUserCallbackDispatcher: DWORD;
  663.     //
  664.     // Lowest kernel mode address
  665.     //
  666.     SystemRangeStart: DWORD;
  667.     //
  668.     // offset in thread object to pointer to the current callback backing
  669.     // store frame in kernel stack.
  670.     //
  671.     ThCallbackBStore: DWORD;
  672.     Reserved: array [0..7] of DWORD;
  673.   end;
  674.   {$EXTERNALSYM _KDHELP}
  675.   KDHELP = _KDHELP;
  676.   {$EXTERNALSYM KDHELP}
  677.   TKdHelp = KDHELP;
  678.   //PKdHelp = PKDHELP;
  680. procedure KdHelp32To64(p32: PKDHELP; p64: PKDHELP64);
  681. {$EXTERNALSYM KdHelp32To64}
  683. type
  684.   LPSTACKFRAME64 = ^STACKFRAME64;
  685.   {$EXTERNALSYM LPSTACKFRAME64}
  686.   _tagSTACKFRAME64 = record
  687.     AddrPC: ADDRESS64; // program counter
  688.     AddrReturn: ADDRESS64; // return address
  689.     AddrFrame: ADDRESS64; // frame pointer
  690.     AddrStack: ADDRESS64; // stack pointer
  691.     AddrBStore: ADDRESS64; // backing store pointer
  692.     FuncTableEntry: PVOID; // pointer to pdata/fpo or NULL
  693.     Params: array [0..3] of DWORD64; // possible arguments to the function
  694.     Far: BOOL; // WOW far call
  695.     Virtual: BOOL; // is this a virtual frame?
  696.     Reserved: array [0..2] of DWORD64;
  697.     KdHelp: KDHELP64;
  698.   end;
  699.   {$EXTERNALSYM _tagSTACKFRAME64}
  700.   STACKFRAME64 = _tagSTACKFRAME64;
  701.   {$EXTERNALSYM STACKFRAME64}
  702.   TStackFrame64 = STACKFRAME64;
  703.   PStackFrame64 = LPSTACKFRAME64;
  705.   LPSTACKFRAME = ^STACKFRAME;
  706.   {$EXTERNALSYM LPSTACKFRAME}
  707.   _tagSTACKFRAME = record
  708.     AddrPC: ADDRESS; // program counter
  709.     AddrReturn: ADDRESS; // return address
  710.     AddrFrame: ADDRESS; // frame pointer
  711.     AddrStack: ADDRESS; // stack pointer
  712.     FuncTableEntry: PVOID; // pointer to pdata/fpo or NULL
  713.     Params: array [0..3] of DWORD; // possible arguments to the function
  714.     Far: BOOL; // WOW far call
  715.     Virtual: BOOL; // is this a virtual frame?
  716.     Reserved: array [0..2] of DWORD;
  717.     KdHelp: KDHELP;
  718.     AddrBStore: ADDRESS; // backing store pointer
  719.   end;
  720.   {$EXTERNALSYM _tagSTACKFRAME}
  721.   STACKFRAME = _tagSTACKFRAME;
  722.   {$EXTERNALSYM STACKFRAME}
  723.   TStackFrame = STACKFRAME;
  724.   PStackFrame = LPSTACKFRAME;
  726.   PREAD_PROCESS_MEMORY_ROUTINE64 = function (hProcess: HANDLE; qwBaseAddress: DWORD64;
  727.     lpBuffer: PVOID; nSize: DWORD; var lpNumberOfBytesRead: DWORD): BOOL; stdcall;
  728.   {$EXTERNALSYM PREAD_PROCESS_MEMORY_ROUTINE64}
  729.   PReadProcessMemoryRoutine64 = PREAD_PROCESS_MEMORY_ROUTINE64;
  731.   PFUNCTION_TABLE_ACCESS_ROUTINE64 = function (hProcess: HANDLE;
  732.     AddrBase: DWORD64): PVOID; stdcall;
  733.   {$EXTERNALSYM PFUNCTION_TABLE_ACCESS_ROUTINE64}
  734.   PFunctionTableAccessRoutine64 = PFUNCTION_TABLE_ACCESS_ROUTINE64;
  736.   PGET_MODULE_BASE_ROUTINE64 = function (hProcess: HANDLE;
  737.     Address: DWORD64): DWORD64; stdcall;
  738.   {$EXTERNALSYM PGET_MODULE_BASE_ROUTINE64}
  739.   PGetModuleBaseRoutine64 = PGET_MODULE_BASE_ROUTINE64;
  741.   PTRANSLATE_ADDRESS_ROUTINE64 = function (hProcess: HANDLE; hThread: HANDLE;
  742.     const lpaddr: ADDRESS64): DWORD64; stdcall;
  743.   {$EXTERNALSYM PTRANSLATE_ADDRESS_ROUTINE64}
  744.   PTranslateAddressRoutine64 = PTRANSLATE_ADDRESS_ROUTINE64;
  746. function StackWalk64(MachineType: DWORD; hProcess: HANDLE; hThread: HANDLE;
  747.   var StackFrame: STACKFRAME64; ContextRecord: PVOID;
  748.   ReadMemoryRoutine: PREAD_PROCESS_MEMORY_ROUTINE64;
  749.   FunctionTableAccessRoutine: PFUNCTION_TABLE_ACCESS_ROUTINE64;
  750.   GetModuleBaseRoutine: PGET_MODULE_BASE_ROUTINE64;
  751.   TranslateAddress: PTRANSLATE_ADDRESS_ROUTINE64): BOOL; stdcall;
  752. {$EXTERNALSYM StackWalk64}
  754. type
  755.   PREAD_PROCESS_MEMORY_ROUTINE = function (hProcess: HANDLE;
  756.     lpBaseAddress: DWORD; lpBuffer: PVOID; nSize: DWORD;
  757.     var lpNumberOfBytesRead: DWORD): BOOL; stdcall;
  758.   {$EXTERNALSYM PREAD_PROCESS_MEMORY_ROUTINE}
  759.   PreadProcessMemoryRoutine = PREAD_PROCESS_MEMORY_ROUTINE;
  761.   PFUNCTION_TABLE_ACCESS_ROUTINE = function (hProcess: HANDLE; AddrBase: DWORD): PVOID; stdcall;
  762.   {$EXTERNALSYM PFUNCTION_TABLE_ACCESS_ROUTINE}
  763.   PFunctionTableAccessRoutine = PFUNCTION_TABLE_ACCESS_ROUTINE;
  765.   PGET_MODULE_BASE_ROUTINE = function (hProcess: HANDLE; Address: DWORD): DWORD; stdcall;
  766.   {$EXTERNALSYM PGET_MODULE_BASE_ROUTINE}
  767.   PGetModuleBaseRoutine = PGET_MODULE_BASE_ROUTINE;
  769.   PTRANSLATE_ADDRESS_ROUTINE = function (hProcess: HANDLE; hThread: HANDLE;
  770.     const lpaddr: ADDRESS): DWORD; stdcall;
  771.   {$EXTERNALSYM PTRANSLATE_ADDRESS_ROUTINE}
  772.   PTranslateAddressRoutine = PTRANSLATE_ADDRESS_ROUTINE;
  774. function StackWalk(MachineType: DWORD; hProcess: HANDLE; hThread: HANDLE;
  775.   var StackFrame: STACKFRAME; ContextRecord: PVOID;
  776.   ReadMemoryRoutine: PREAD_PROCESS_MEMORY_ROUTINE;
  777.   FunctionTableAccessRoutine: PFUNCTION_TABLE_ACCESS_ROUTINE;
  778.   GetModuleBaseRoutine: PGET_MODULE_BASE_ROUTINE;
  779.   TranslateAddress: PTRANSLATE_ADDRESS_ROUTINE): BOOL; stdcall;
  780. {$EXTERNALSYM StackWalk}
  782. const
  783.   API_VERSION_NUMBER = 9;
  784.   {$EXTERNALSYM API_VERSION_NUMBER}
  786. type
  787.   LPAPI_VERSION = ^API_VERSION;
  788.   {$EXTERNALSYM LPAPI_VERSION}
  789.   API_VERSION = record
  790.     MajorVersion: USHORT;
  791.     MinorVersion: USHORT;
  792.     Revision: USHORT;
  793.     Reserved: USHORT;
  794.   end;
  795.   {$EXTERNALSYM API_VERSION}
  796.   TApiVersion = API_VERSION;
  797.   PApiVersion = LPAPI_VERSION;
  799. function ImagehlpApiVersion: LPAPI_VERSION; stdcall;
  800. {$EXTERNALSYM ImagehlpApiVersion}
  802. function ImagehlpApiVersionEx(const AppVersion: API_VERSION): LPAPI_VERSION; stdcall;
  803. {$EXTERNALSYM ImagehlpApiVersionEx}
  805. function GetTimestampForLoadedLibrary(Module: HMODULE): DWORD; stdcall;
  806. {$EXTERNALSYM GetTimestampForLoadedLibrary}
  808. //
  809. // typedefs for function pointers
  810. //
  812. type
  813.   PSYM_ENUMMODULES_CALLBACK64 = function (ModuleName: PSTR; BaseOfDll: DWORD64;
  814.     UserContext: PVOID): BOOL; stdcall;
  815.   {$EXTERNALSYM PSYM_ENUMMODULES_CALLBACK64}
  816.   PSymEnummodulesCallback64 = PSYM_ENUMMODULES_CALLBACK64;
  818.   PSYM_ENUMSYMBOLS_CALLBACK64 = function (SymbolName: PSTR; SymbolAddress: DWORD64;
  819.     SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  820.   {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK64}
  821.   PSymEnumsymbolsCallback64 = PSYM_ENUMSYMBOLS_CALLBACK64;
  823.   PSYM_ENUMSYMBOLS_CALLBACK64W = function (SymbolName: PWSTR;
  824.     SymbolAddress: DWORD64; SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  825.   {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK64W}
  826.   PSymEnumsymbolsCallback64w = PSYM_ENUMSYMBOLS_CALLBACK64W;
  828.   PENUMLOADED_MODULES_CALLBACK64 = function (ModuleName: PSTR;
  829.     ModuleBase: DWORD64; ModuleSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  830.   {$EXTERNALSYM PENUMLOADED_MODULES_CALLBACK64}
  831.   PSnumloadedModulesCallback64 = PENUMLOADED_MODULES_CALLBACK64;
  833.   PSYMBOL_REGISTERED_CALLBACK64 = function (hProcess: HANDLE; ActionCode: ULONG;
  834.     CallbackData: ULONG64; UserContext: ULONG64): BOOL; stdcall;
  835.   {$EXTERNALSYM PSYMBOL_REGISTERED_CALLBACK64}
  836.   PSymbolRegisteredCallback64 = PSYMBOL_REGISTERED_CALLBACK64;
  838.   PSYMBOL_FUNCENTRY_CALLBACK = function (hProcess: HANDLE; AddrBase: DWORD;
  839.     UserContext: PVOID): PVOID; stdcall;
  840.   {$EXTERNALSYM PSYMBOL_FUNCENTRY_CALLBACK}
  841.   PSymbolFuncentryCallback = PSYMBOL_FUNCENTRY_CALLBACK;
  843.   PSYMBOL_FUNCENTRY_CALLBACK64 = function (hProcess: HANDLE; AddrBase: ULONG64;
  844.     UserContext: ULONG64): PVOID; stdcall;
  845.   {$EXTERNALSYM PSYMBOL_FUNCENTRY_CALLBACK64}
  846.   PSymbolFuncentryCallback64 = PSYMBOL_FUNCENTRY_CALLBACK64;
  848.   PSYM_ENUMMODULES_CALLBACK = function (ModuleName: PSTR; BaseOfDll: ULONG;
  849.     UserContext: PVOID): BOOL; stdcall;
  850.   {$EXTERNALSYM PSYM_ENUMMODULES_CALLBACK}
  851.   PSymEnummodulesCallback = PSYM_ENUMMODULES_CALLBACK;
  853.   PSYM_ENUMSYMBOLS_CALLBACK = function (SymbolName: PSTR; SymbolAddress: ULONG;
  854.     SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  855.   {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACK}
  856.   PSymEnumsymbolsCallback = PSYM_ENUMSYMBOLS_CALLBACK;
  858.   PSYM_ENUMSYMBOLS_CALLBACKW = function (SymbolName: PWSTR; SymbolAddress: ULONG;
  859.     SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  860.   {$EXTERNALSYM PSYM_ENUMSYMBOLS_CALLBACKW}
  861.   PSymEnumsymbolsCallbackw = PSYM_ENUMSYMBOLS_CALLBACKW;
  863.   PENUMLOADED_MODULES_CALLBACK = function (ModuleName: PSTR; ModuleBase: ULONG;
  864.     ModuleSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  865.   {$EXTERNALSYM PENUMLOADED_MODULES_CALLBACK}
  866.   PEnumloadedModulesCallback = PENUMLOADED_MODULES_CALLBACK;
  868.   PSYMBOL_REGISTERED_CALLBACK = function (hProcess: HANDLE; ActionCode: ULONG;
  869.     CallbackData: PVOID; UserContext: PVOID): BOOL; stdcall;
  870.   {$EXTERNALSYM PSYMBOL_REGISTERED_CALLBACK}
  871.   PSymbolRegisteredCallback = PSYMBOL_REGISTERED_CALLBACK;
  873. //
  874. // flags found in SYMBOL_INFO.Flags
  875. //
  877. const
  878.   SYMFLAG_VALUEPRESENT   = $00000001;
  879.   {$EXTERNALSYM SYMFLAG_VALUEPRESENT}
  880.   SYMFLAG_REGISTER       = $00000008;
  881.   {$EXTERNALSYM SYMFLAG_REGISTER}
  882.   SYMFLAG_REGREL         = $00000010;
  883.   {$EXTERNALSYM SYMFLAG_REGREL}
  884.   SYMFLAG_FRAMEREL       = $00000020;
  885.   {$EXTERNALSYM SYMFLAG_FRAMEREL}
  886.   SYMFLAG_PARAMETER      = $00000040;
  887.   {$EXTERNALSYM SYMFLAG_PARAMETER}
  888.   SYMFLAG_LOCAL          = $00000080;
  889.   {$EXTERNALSYM SYMFLAG_LOCAL}
  890.   SYMFLAG_CONSTANT       = $00000100;
  891.   {$EXTERNALSYM SYMFLAG_CONSTANT}
  892.   SYMFLAG_EXPORT         = $00000200;
  893.   {$EXTERNALSYM SYMFLAG_EXPORT}
  894.   SYMFLAG_FORWARDER      = $00000400;
  895.   {$EXTERNALSYM SYMFLAG_FORWARDER}
  896.   SYMFLAG_FUNCTION       = $00000800;
  897.   {$EXTERNALSYM SYMFLAG_FUNCTION}
  898.   SYMFLAG_VIRTUAL        = $00001000;
  899.   {$EXTERNALSYM SYMFLAG_VIRTUAL}
  900.   SYMFLAG_THUNK          = $00002000;
  901.   {$EXTERNALSYM SYMFLAG_THUNK}
  902.   SYMFLAG_TLSREL         = $00004000;
  903.   {$EXTERNALSYM SYMFLAG_TLSREL}
  905. //
  906. // symbol type enumeration
  907. //
  909. type
  910.   SYM_TYPE = (
  911.     SymNone,
  912.     SymCoff,
  913.     SymCv,
  914.     SymPdb,
  915.     SymExport,
  916.     SymDeferred,
  917.     SymSym,                   // .sym file
  918.     SymDia,
  919.     SymVirtual,
  920.     NumSymTypes);
  921.   {$EXTERNALSYM SYM_TYPE}
  922.   TSymType = SYM_TYPE;
  924. //
  925. // symbol data structure
  926. //
  928.   PIMAGEHLP_SYMBOL64 = ^IMAGEHLP_SYMBOL64;
  929.   {$EXTERNALSYM PIMAGEHLP_SYMBOL64}
  930.   _IMAGEHLP_SYMBOL64 = record
  931.     SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_SYMBOL64)
  932.     Address: DWORD64; // virtual address including dll base address
  933.     Size: DWORD; // estimated size of symbol, can be zero
  934.     Flags: DWORD; // info about the symbols, see the SYMF defines
  935.     MaxNameLength: DWORD; // maximum size of symbol name in 'Name'
  936.     Name: array [0..0] of CHAR; // symbol name (null terminated string)
  937.   end;
  938.   {$EXTERNALSYM _IMAGEHLP_SYMBOL64}
  939.   IMAGEHLP_SYMBOL64 = _IMAGEHLP_SYMBOL64;
  940.   {$EXTERNALSYM IMAGEHLP_SYMBOL64}
  941.   TImageHlpSymbol64 = IMAGEHLP_SYMBOL64;
  942.   PImageHlpSymbol64 = PIMAGEHLP_SYMBOL64;
  944.   _IMAGEHLP_SYMBOL64_PACKAGE = record
  945.     sym: IMAGEHLP_SYMBOL64;
  946.     name: array [0..MAX_SYM_NAME] of CHAR;
  947.   end;
  948.   {$EXTERNALSYM _IMAGEHLP_SYMBOL64_PACKAGE}
  949.   IMAGEHLP_SYMBOL64_PACKAGE = _IMAGEHLP_SYMBOL64_PACKAGE;
  950.   {$EXTERNALSYM IMAGEHLP_SYMBOL64_PACKAGE}
  951.   PIMAGEHLP_SYMBOL64_PACKAGE = ^IMAGEHLP_SYMBOL64_PACKAGE;
  952.   {$EXTERNALSYM PIMAGEHLP_SYMBOL64_PACKAGE}
  953.   TImageHlpSymbol64Package = IMAGEHLP_SYMBOL64_PACKAGE;
  954.   PImageHlpSymbol64Package = PIMAGEHLP_SYMBOL64_PACKAGE;  
  956. //#if !defined(_IMAGEHLP_SOURCE_) && defined(_IMAGEHLP64)
  957. //
  958. //#define IMAGEHLP_SYMBOL IMAGEHLP_SYMBOL64
  959. //#define PIMAGEHLP_SYMBOL PIMAGEHLP_SYMBOL64
  960. //#define IMAGEHLP_SYMBOL_PACKAGE IMAGEHLP_SYMBOL64_PACKAGE
  961. //#define PIMAGEHLP_SYMBOL_PACKAGE PIMAGEHLP_SYMBOL64_PACKAGE
  962. //
  963. //#else
  965.   PIMAGEHLP_SYMBOL = ^IMAGEHLP_SYMBOL;
  966.   {$EXTERNALSYM PIMAGEHLP_SYMBOL}
  967.   _IMAGEHLP_SYMBOL = record
  968.     SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_SYMBOL)
  969.     Address: DWORD; // virtual address including dll base address
  970.     Size: DWORD; // estimated size of symbol, can be zero
  971.     Flags: DWORD; // info about the symbols, see the SYMF defines
  972.     MaxNameLength: DWORD; // maximum size of symbol name in 'Name'
  973.     Name: array [0..0] of CHAR; // symbol name (null terminated string)
  974.   end;
  975.   {$EXTERNALSYM _IMAGEHLP_SYMBOL}
  976.   IMAGEHLP_SYMBOL = _IMAGEHLP_SYMBOL;
  977.   {$EXTERNALSYM IMAGEHLP_SYMBOL}
  978.   TImageHlpSymbol = IMAGEHLP_SYMBOL;
  979.   PImageHlpSymbol = PIMAGEHLP_SYMBOL;
  981.   _IMAGEHLP_SYMBOL_PACKAGE = record
  982.     sym: IMAGEHLP_SYMBOL;
  983.     name: array [0..MAX_SYM_NAME] of CHAR;
  984.   end;
  985.   {$EXTERNALSYM _IMAGEHLP_SYMBOL_PACKAGE}
  986.   IMAGEHLP_SYMBOL_PACKAGE = _IMAGEHLP_SYMBOL_PACKAGE;
  987.   {$EXTERNALSYM IMAGEHLP_SYMBOL_PACKAGE}
  988.   PIMAGEHLP_SYMBOL_PACKAGE = ^IMAGEHLP_SYMBOL_PACKAGE;
  989.   {$EXTERNALSYM PIMAGEHLP_SYMBOL_PACKAGE}
  990.   TImageHlpSymbolPackage = IMAGEHLP_SYMBOL_PACKAGE;
  991.   PImageHlpSymbolPackage = PIMAGEHLP_SYMBOL_PACKAGE;
  993. //#endif
  995. //
  996. // module data structure
  997. //
  999.   PIMAGEHLP_MODULE64 = ^IMAGEHLP_MODULE64;
  1000.   {$EXTERNALSYM PIMAGEHLP_MODULE64}
  1001.   _IMAGEHLP_MODULE64 = record
  1002.     SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE64)
  1003.     BaseOfImage: DWORD64; // base load address of module
  1004.     ImageSize: DWORD; // virtual size of the loaded module
  1005.     TimeDateStamp: DWORD; // date/time stamp from pe header
  1006.     CheckSum: DWORD; // checksum from the pe header
  1007.     NumSyms: DWORD; // number of symbols in the symbol table
  1008.     SymType: SYM_TYPE; // type of symbols loaded
  1009.     ModuleName: array [0..3] of CHAR; // module name
  1010.     ImageName: array [0..255] of CHAR; // image name
  1011.     LoadedImageName: array [0..255] of CHAR; // symbol file name
  1012.   end;
  1013.   {$EXTERNALSYM _IMAGEHLP_MODULE64}
  1014.   IMAGEHLP_MODULE64 = _IMAGEHLP_MODULE64;
  1015.   {$EXTERNALSYM IMAGEHLP_MODULE64}
  1016.   TImageHlpModule64 = IMAGEHLP_MODULE64;
  1017.   PImageHlpModule64 = PIMAGEHLP_MODULE64;
  1019.   PIMAGEHLP_MODULEW64 = ^IMAGEHLP_MODULEW64;
  1020.   {$EXTERNALSYM PIMAGEHLP_MODULEW64}
  1021.   _IMAGEHLP_MODULE64W = record
  1022.     SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE64)
  1023.     BaseOfImage: DWORD64; // base load address of module
  1024.     ImageSize: DWORD; // virtual size of the loaded module
  1025.     TimeDateStamp: DWORD; // date/time stamp from pe header
  1026.     CheckSum: DWORD; // checksum from the pe header
  1027.     NumSyms: DWORD; // number of symbols in the symbol table
  1028.     SymType: SYM_TYPE; // type of symbols loaded
  1029.     ModuleName: array [0..31] of WCHAR; // module name
  1030.     ImageName: array [0..255] of WCHAR; // image name
  1031.     LoadedImageName: array [0..255] of WCHAR; // symbol file name
  1032.   end;
  1033.   {$EXTERNALSYM _IMAGEHLP_MODULE64W}
  1034.   IMAGEHLP_MODULEW64 = _IMAGEHLP_MODULE64W;
  1035.   {$EXTERNALSYM IMAGEHLP_MODULEW64}
  1036.   TImageHlpModuleW64 = IMAGEHLP_MODULEW64;
  1037.   PImageHlpModuleW64 = PIMAGEHLP_MODULEW64;
  1039.   PIMAGEHLP_MODULE = ^IMAGEHLP_MODULE;
  1040.   {$EXTERNALSYM PIMAGEHLP_MODULE}
  1041.   _IMAGEHLP_MODULE = record
  1042.     SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE)
  1043.     BaseOfImage: DWORD; // base load address of module
  1044.     ImageSize: DWORD; // virtual size of the loaded module
  1045.     TimeDateStamp: DWORD; // date/time stamp from pe header
  1046.     CheckSum: DWORD; // checksum from the pe header
  1047.     NumSyms: DWORD; // number of symbols in the symbol table
  1048.     SymType: SYM_TYPE; // type of symbols loaded
  1049.     ModuleName: array [0..31] of CHAR; // module name
  1050.     ImageName: array [0..255] of CHAR; // image name
  1051.     LoadedImageName: array [0..255] of CHAR; // symbol file name
  1052.   end;
  1053.   {$EXTERNALSYM _IMAGEHLP_MODULE}
  1054.   IMAGEHLP_MODULE = _IMAGEHLP_MODULE;
  1055.   {$EXTERNALSYM IMAGEHLP_MODULE}
  1056.   TImageHlpModule = IMAGEHLP_MODULE;
  1057.   PImageHlpModule = PIMAGEHLP_MODULE;
  1059.   PIMAGEHLP_MODULEW = ^IMAGEHLP_MODULEW;
  1060.   {$EXTERNALSYM PIMAGEHLP_MODULEW}
  1061.   _IMAGEHLP_MODULEW = record
  1062.     SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_MODULE)
  1063.     BaseOfImage: DWORD; // base load address of module
  1064.     ImageSize: DWORD; // virtual size of the loaded module
  1065.     TimeDateStamp: DWORD; // date/time stamp from pe header
  1066.     CheckSum: DWORD; // checksum from the pe header
  1067.     NumSyms: DWORD; // number of symbols in the symbol table
  1068.     SymType: SYM_TYPE; // type of symbols loaded
  1069.     ModuleName: array [0..31] of WCHAR; // module name
  1070.     ImageName: array [0..255] of WCHAR; // image name
  1071.     LoadedImageName: array [0..255] of WCHAR; // symbol file name
  1072.   end;
  1073.   {$EXTERNALSYM _IMAGEHLP_MODULEW}
  1074.   IMAGEHLP_MODULEW = _IMAGEHLP_MODULEW;
  1075.   {$EXTERNALSYM IMAGEHLP_MODULEW}
  1076.   TImageHlpModuleW = IMAGEHLP_MODULEW;
  1077.   PImageHlpModuleW = PIMAGEHLP_MODULEW;
  1079. //
  1080. // source file line data structure
  1081. //
  1083.   PIMAGEHLP_LINE64 = ^IMAGEHLP_LINE64;
  1084.   {$EXTERNALSYM PIMAGEHLP_LINE64}
  1085.   _IMAGEHLP_LINE64 = record
  1086.     SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_LINE64)
  1087.     Key: PVOID; // internal
  1088.     LineNumber: DWORD; // line number in file
  1089.     FileName: PCHAR; // full filename
  1090.     Address: DWORD64; // first instruction of line
  1091.   end;
  1092.   {$EXTERNALSYM _IMAGEHLP_LINE64}
  1093.   IMAGEHLP_LINE64 = _IMAGEHLP_LINE64;
  1094.   {$EXTERNALSYM IMAGEHLP_LINE64}
  1095.   TImageHlpLine64 = IMAGEHLP_LINE64;
  1096.   PImageHlpLine64 = PIMAGEHLP_LINE64;
  1098.   PIMAGEHLP_LINE = ^IMAGEHLP_LINE;
  1099.   {$EXTERNALSYM PIMAGEHLP_LINE}
  1100.   _IMAGEHLP_LINE = record
  1101.     SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_LINE)
  1102.     Key: PVOID; // internal
  1103.     LineNumber: DWORD; // line number in file
  1104.     FileName: PCHAR; // full filename
  1105.     Address: DWORD; // first instruction of line
  1106.   end;
  1107.   {$EXTERNALSYM _IMAGEHLP_LINE}
  1108.   IMAGEHLP_LINE = _IMAGEHLP_LINE;
  1109.   {$EXTERNALSYM IMAGEHLP_LINE}
  1110.   TImageHlpLine = IMAGEHLP_LINE;
  1111.   PImageHlpLine = PIMAGEHLP_LINE;
  1113. //
  1114. // source file structure
  1115. //
  1117. type
  1118.   _SOURCEFILE = record
  1119.     ModBase: DWORD64;                // base address of loaded module
  1120.     FileName: PCHAR;                 // full filename of source
  1121.   end;
  1122.   {$EXTERNALSYM _SOURCEFILE}
  1123.   SOURCEFILE = _SOURCEFILE;
  1124.   {$EXTERNALSYM SOURCEFILE}
  1125.   PSOURCEFILE = ^SOURCEFILE;
  1126.   {$EXTERNALSYM PSOURCEFILE}
  1127.   TSourceFile = SOURCEFILE;
  1129. //
  1130. // data structures used for registered symbol callbacks
  1131. //
  1133. const
  1134.   CBA_DEFERRED_SYMBOL_LOAD_START    = $00000001;
  1135.   {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_START}
  1136.   CBA_DEFERRED_SYMBOL_LOAD_COMPLETE = $00000002;
  1137.   {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_COMPLETE}
  1138.   CBA_DEFERRED_SYMBOL_LOAD_FAILURE  = $00000003;
  1139.   {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_FAILURE}
  1140.   CBA_SYMBOLS_UNLOADED              = $00000004;
  1141.   {$EXTERNALSYM CBA_SYMBOLS_UNLOADED}
  1142.   CBA_DUPLICATE_SYMBOL              = $00000005;
  1143.   {$EXTERNALSYM CBA_DUPLICATE_SYMBOL}
  1144.   CBA_READ_MEMORY                   = $00000006;
  1145.   {$EXTERNALSYM CBA_READ_MEMORY}
  1146.   CBA_DEFERRED_SYMBOL_LOAD_CANCEL   = $00000007;
  1147.   {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_CANCEL}
  1148.   CBA_SET_OPTIONS                   = $00000008;
  1149.   {$EXTERNALSYM CBA_SET_OPTIONS}
  1150.   CBA_EVENT                         = $00000010;
  1151.   {$EXTERNALSYM CBA_EVENT}
  1152.   CBA_DEFERRED_SYMBOL_LOAD_PARTIAL  = $00000020;
  1153.   {$EXTERNALSYM CBA_DEFERRED_SYMBOL_LOAD_PARTIAL}
  1154.   CBA_DEBUG_INFO                    = $10000000;
  1155.   {$EXTERNALSYM CBA_DEBUG_INFO}
  1157. type
  1158.   PIMAGEHLP_CBA_READ_MEMORY = ^IMAGEHLP_CBA_READ_MEMORY;
  1159.   {$EXTERNALSYM PIMAGEHLP_CBA_READ_MEMORY}
  1160.   _IMAGEHLP_CBA_READ_MEMORY = record
  1161.     addr: DWORD64; // address to read from
  1162.     buf: PVOID; // buffer to read to
  1163.     bytes: DWORD; // amount of bytes to read
  1164.     bytesread: LPDWORD; // pointer to store amount of bytes read
  1165.   end;
  1166.   {$EXTERNALSYM _IMAGEHLP_CBA_READ_MEMORY}
  1167.   IMAGEHLP_CBA_READ_MEMORY = _IMAGEHLP_CBA_READ_MEMORY;
  1168.   {$EXTERNALSYM IMAGEHLP_CBA_READ_MEMORY}
  1169.   TImageHlpCbaReadMemory = IMAGEHLP_CBA_READ_MEMORY;
  1170.   PImageHlpCbaReadMemory = PIMAGEHLP_CBA_READ_MEMORY;
  1172. const
  1173.   sevInfo    = 0;
  1174.   {$EXTERNALSYM sevInfo}
  1175.   sevProblem = 1;
  1176.   {$EXTERNALSYM sevProblem}
  1177.   sevAttn    = 2;
  1178.   {$EXTERNALSYM sevAttn}
  1179.   sevFatal   = 3;
  1180.   {$EXTERNALSYM sevFatal}
  1181.   sevMax     = 4; // unused
  1182.   {$EXTERNALSYM sevMax}
  1184. type
  1185.   _IMAGEHLP_CBA_EVENT = record
  1186.     severity: DWORD;                                     // values from sevInfo to sevFatal
  1187.     code: DWORD;                                         // numerical code IDs the error
  1188.     desc: PCHAR;                                         // may contain a text description of the error
  1189.     object_: PVOID;                                      // value dependant upon the error code
  1190.   end;
  1191.   {$EXTERNALSYM _IMAGEHLP_CBA_EVENT}
  1192.   IMAGEHLP_CBA_EVENT = _IMAGEHLP_CBA_EVENT;
  1193.   {$EXTERNALSYM IMAGEHLP_CBA_EVENT}
  1194.   PIMAGEHLP_CBA_EVENT = ^IMAGEHLP_CBA_EVENT;
  1195.   {$EXTERNALSYM PIMAGEHLP_CBA_EVENT}
  1196.   TImageHlpCbaEvent = IMAGEHLP_CBA_EVENT;
  1197.   PImageHlpCbaEvent = PIMAGEHLP_CBA_EVENT;
  1199.   PIMAGEHLP_DEFERRED_SYMBOL_LOAD64 = ^IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
  1200.   {$EXTERNALSYM PIMAGEHLP_DEFERRED_SYMBOL_LOAD64}
  1201.   _IMAGEHLP_DEFERRED_SYMBOL_LOAD64 = record
  1202.     SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD64)
  1203.     BaseOfImage: DWORD64; // base load address of module
  1204.     CheckSum: DWORD; // checksum from the pe header
  1205.     TimeDateStamp: DWORD; // date/time stamp from pe header
  1206.     FileName: array [0..MAX_PATH - 1] of CHAR; // symbols file or image name
  1207.     Reparse: ByteBool; // load failure reparse
  1208.     hFile: HANDLE; // file handle, if passed
  1209.     Flags: DWORD; //
  1210.   end;
  1211.   {$EXTERNALSYM _IMAGEHLP_DEFERRED_SYMBOL_LOAD64}
  1212.   IMAGEHLP_DEFERRED_SYMBOL_LOAD64 = _IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
  1213.   {$EXTERNALSYM IMAGEHLP_DEFERRED_SYMBOL_LOAD64}
  1214.   TImageHlpDeferredSymbolLoad64 = IMAGEHLP_DEFERRED_SYMBOL_LOAD64;
  1215.   PImageHlpDeferredSymbolLoad64 = PIMAGEHLP_DEFERRED_SYMBOL_LOAD64;
  1217. const
  1218.   DSLFLAG_MISMATCHED_PDB = $1;
  1219.   {$EXTERNALSYM DSLFLAG_MISMATCHED_PDB}
  1220.   DSLFLAG_MISMATCHED_DBG = $2;
  1221.   {$EXTERNALSYM DSLFLAG_MISMATCHED_DBG}
  1223. type
  1224.   PIMAGEHLP_DEFERRED_SYMBOL_LOAD = ^IMAGEHLP_DEFERRED_SYMBOL_LOAD;
  1225.   {$EXTERNALSYM PIMAGEHLP_DEFERRED_SYMBOL_LOAD}
  1226.   _IMAGEHLP_DEFERRED_SYMBOL_LOAD = record
  1227.     SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DEFERRED_SYMBOL_LOAD)
  1228.     BaseOfImage: DWORD; // base load address of module
  1229.     CheckSum: DWORD; // checksum from the pe header
  1230.     TimeDateStamp: DWORD; // date/time stamp from pe header
  1231.     FileName: array [0..MAX_PATH - 1] of CHAR; // symbols file or image name
  1232.     Reparse: ByteBool; // load failure reparse
  1233.     hFile: HANDLE; // file handle, if passed    
  1234.   end;
  1235.   {$EXTERNALSYM _IMAGEHLP_DEFERRED_SYMBOL_LOAD}
  1236.   IMAGEHLP_DEFERRED_SYMBOL_LOAD = _IMAGEHLP_DEFERRED_SYMBOL_LOAD;
  1237.   {$EXTERNALSYM IMAGEHLP_DEFERRED_SYMBOL_LOAD}
  1238.   TImageHlpDeferredSymbolLoad = IMAGEHLP_DEFERRED_SYMBOL_LOAD;
  1239.   PImageHlpDeferredSymbolLoad = PIMAGEHLP_DEFERRED_SYMBOL_LOAD;
  1241.   PIMAGEHLP_DUPLICATE_SYMBOL64 = ^IMAGEHLP_DUPLICATE_SYMBOL64;
  1242.   {$EXTERNALSYM PIMAGEHLP_DUPLICATE_SYMBOL64}
  1243.   _IMAGEHLP_DUPLICATE_SYMBOL64 = record
  1244.     SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL64)
  1245.     NumberOfDups: DWORD; // number of duplicates in the Symbol array
  1246.     Symbol: PIMAGEHLP_SYMBOL64; // array of duplicate symbols
  1247.     SelectedSymbol: DWORD; // symbol selected (-1 to start)
  1248.   end;
  1249.   {$EXTERNALSYM _IMAGEHLP_DUPLICATE_SYMBOL64}
  1250.   IMAGEHLP_DUPLICATE_SYMBOL64 = _IMAGEHLP_DUPLICATE_SYMBOL64;
  1251.   {$EXTERNALSYM IMAGEHLP_DUPLICATE_SYMBOL64}
  1252.   TImageHlpDuplicateSymbol64 = IMAGEHLP_DUPLICATE_SYMBOL64;
  1253.   PImageHlpDuplicateSymbol64 = PIMAGEHLP_DUPLICATE_SYMBOL64;
  1255.   PIMAGEHLP_DUPLICATE_SYMBOL = ^IMAGEHLP_DUPLICATE_SYMBOL;
  1256.   {$EXTERNALSYM PIMAGEHLP_DUPLICATE_SYMBOL}
  1257.   _IMAGEHLP_DUPLICATE_SYMBOL = record
  1258.     SizeOfStruct: DWORD; // set to sizeof(IMAGEHLP_DUPLICATE_SYMBOL)
  1259.     NumberOfDups: DWORD; // number of duplicates in the Symbol array
  1260.     Symbol: PIMAGEHLP_SYMBOL; // array of duplicate symbols
  1261.     SelectedSymbol: DWORD; // symbol selected (-1 to start)
  1262.   end;
  1263.   {$EXTERNALSYM _IMAGEHLP_DUPLICATE_SYMBOL}
  1264.   IMAGEHLP_DUPLICATE_SYMBOL = _IMAGEHLP_DUPLICATE_SYMBOL;
  1265.   {$EXTERNALSYM IMAGEHLP_DUPLICATE_SYMBOL}
  1266.   TImageHlpDuplicateSymbol = IMAGEHLP_DUPLICATE_SYMBOL;
  1267.   PImageHlpDuplicateSymbol = PIMAGEHLP_DUPLICATE_SYMBOL;
  1269. // If dbghelp ever needs to display graphical UI, it will use this as the parent window.
  1271. //BOOL
  1272. //SymSetParentWindow(
  1273. //    HWND hwnd
  1274. //    );
  1276. //
  1277. // options that are set/returned by SymSetOptions() & SymGetOptions()
  1278. // these are used as a mask
  1279. //
  1281. const
  1282.   SYMOPT_CASE_INSENSITIVE  = $00000001;
  1283.   {$EXTERNALSYM SYMOPT_CASE_INSENSITIVE}
  1284.   SYMOPT_UNDNAME           = $00000002;
  1285.   {$EXTERNALSYM SYMOPT_UNDNAME}
  1286.   SYMOPT_DEFERRED_LOADS    = $00000004;
  1287.   {$EXTERNALSYM SYMOPT_DEFERRED_LOADS}
  1288.   SYMOPT_NO_CPP            = $00000008;
  1289.   {$EXTERNALSYM SYMOPT_NO_CPP}
  1290.   SYMOPT_LOAD_LINES        = $00000010;
  1291.   {$EXTERNALSYM SYMOPT_LOAD_LINES}
  1292.   SYMOPT_OMAP_FIND_NEAREST = $00000020;
  1293.   {$EXTERNALSYM SYMOPT_OMAP_FIND_NEAREST}
  1294.   SYMOPT_LOAD_ANYTHING         = $00000040;
  1295.   {$EXTERNALSYM SYMOPT_LOAD_ANYTHING}
  1296.   SYMOPT_IGNORE_CVREC          = $00000080;
  1297.   {$EXTERNALSYM SYMOPT_IGNORE_CVREC}
  1298.   SYMOPT_NO_UNQUALIFIED_LOADS  = $00000100;
  1299.   {$EXTERNALSYM SYMOPT_NO_UNQUALIFIED_LOADS}
  1300.   SYMOPT_FAIL_CRITICAL_ERRORS  = $00000200;
  1301.   {$EXTERNALSYM SYMOPT_FAIL_CRITICAL_ERRORS}
  1302.   SYMOPT_EXACT_SYMBOLS         = $00000400;
  1303.   {$EXTERNALSYM SYMOPT_EXACT_SYMBOLS}
  1304.   SYMOPT_ALLOW_ABSOLUTE_SYMBOLS = $00000800;
  1305.   {$EXTERNALSYM SYMOPT_ALLOW_ABSOLUTE_SYMBOLS}
  1306.   SYMOPT_IGNORE_NT_SYMPATH      = $00001000;
  1307.   {$EXTERNALSYM SYMOPT_IGNORE_NT_SYMPATH}
  1308.   SYMOPT_INCLUDE_32BIT_MODULES = $00002000;
  1309.   {$EXTERNALSYM SYMOPT_INCLUDE_32BIT_MODULES}
  1310.   SYMOPT_PUBLICS_ONLY          = $00004000;
  1311.   {$EXTERNALSYM SYMOPT_PUBLICS_ONLY}
  1312.   SYMOPT_NO_PUBLICS            = $00008000;
  1313.   {$EXTERNALSYM SYMOPT_NO_PUBLICS}
  1314.   SYMOPT_AUTO_PUBLICS          = $00010000;
  1315.   {$EXTERNALSYM SYMOPT_AUTO_PUBLICS}
  1316.   SYMOPT_NO_IMAGE_SEARCH       = $00020000;
  1317.   {$EXTERNALSYM SYMOPT_NO_IMAGE_SEARCH}
  1318.   SYMOPT_SECURE                = $00040000;
  1319.   {$EXTERNALSYM SYMOPT_SECURE}
  1321.   SYMOPT_DEBUG             = DWORD($80000000);
  1322.   {$EXTERNALSYM SYMOPT_DEBUG}
  1324. function SymSetOptions(SymOptions: DWORD): DWORD; stdcall;
  1325. {$EXTERNALSYM SymSetOptions}
  1327. function SymGetOptions: DWORD; stdcall;
  1328. {$EXTERNALSYM SymGetOptions}
  1330. function SymCleanup(hProcess: HANDLE): BOOL; stdcall;
  1331. {$EXTERNALSYM SymCleanup}
  1333. function SymMatchString(string_, expression: LPSTR; fCase: BOOL): BOOL; stdcall;
  1334. {$EXTERNALSYM SymMatchString}
  1336. type
  1337.   PSYM_ENUMSOURCFILES_CALLBACK = function (pSourceFile: PSOURCEFILE; UserContext: PVOID): BOOL; stdcall;
  1338.   {$EXTERNALSYM PSYM_ENUMSOURCFILES_CALLBACK}
  1339.   PSymEnumSourceFilesCallback = PSYM_ENUMSOURCFILES_CALLBACK;
  1341. function SymEnumSourceFiles(hProcess: HANDLE; ModBase: ULONG64; Mask: LPSTR;
  1342.   cbSrcFiles: PSYM_ENUMSOURCFILES_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1343. {$EXTERNALSYM SymEnumSourceFiles}
  1345. function SymEnumerateModules64(hProcess: HANDLE; EnumModulesCallback: PSYM_ENUMMODULES_CALLBACK64;
  1346.   UserContext: PVOID): BOOL; stdcall;
  1347. {$EXTERNALSYM SymEnumerateModules64}
  1349. function SymEnumerateModules(hProcess: HANDLE; EnumModulesCallback: PSYM_ENUMMODULES_CALLBACK;
  1350.   UserContext: PVOID): BOOL; stdcall;
  1351. {$EXTERNALSYM SymEnumerateModules}
  1353. function SymEnumerateSymbols64(hProcess: HANDLE; BaseOfDll: DWORD64;
  1354.   EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK64; UserContext: PVOID): BOOL; stdcall;
  1355. {$EXTERNALSYM SymEnumerateSymbols64}
  1357. function SymEnumerateSymbolsW64(hProcess: HANDLE; BaseOfDll: DWORD64;
  1358.   EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK64W; UserContext: PVOID): BOOL; stdcall;
  1359. {$EXTERNALSYM SymEnumerateSymbolsW64}
  1361. function SymEnumerateSymbols(hProcess: HANDLE; BaseOfDll: DWORD;
  1362.   EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1363. {$EXTERNALSYM SymEnumerateSymbols}
  1365. function SymEnumerateSymbolsW(hProcess: HANDLE; BaseOfDll: DWORD;
  1366.   EnumSymbolsCallback: PSYM_ENUMSYMBOLS_CALLBACKW; UserContext: PVOID): BOOL; stdcall;
  1367. {$EXTERNALSYM SymEnumerateSymbolsW}
  1369. function EnumerateLoadedModules64(hProcess: HANDLE; EnumLoadedModulesCallback: PENUMLOADED_MODULES_CALLBACK64;
  1370.   UserContext: PVOID): BOOL; stdcall;
  1371. {$EXTERNALSYM EnumerateLoadedModules64}
  1373. function EnumerateLoadedModules(hProcess: HANDLE; EnumLoadedModulesCallback: PENUMLOADED_MODULES_CALLBACK;
  1374.   UserContext: PVOID): BOOL; stdcall;
  1375. {$EXTERNALSYM EnumerateLoadedModules}
  1377. function SymFunctionTableAccess64(hProcess: HANDLE; AddrBase: DWORD64): PVOID; stdcall;
  1378. {$EXTERNALSYM SymFunctionTableAccess64}
  1380. function SymFunctionTableAccess(hProcess: HANDLE; AddrBase: DWORD): PVOID; stdcall;
  1381. {$EXTERNALSYM SymFunctionTableAccess}
  1383. function SymGetModuleInfo64(hProcess: HANDLE; qwAddr: DWORD64;
  1384.   var ModuleInfo: IMAGEHLP_MODULE64): BOOL; stdcall;
  1385. {$EXTERNALSYM SymGetModuleInfo64}
  1387. function SymGetModuleInfoW64(hProcess: HANDLE; qwAddr: DWORD64;
  1388.   var ModuleInfo: IMAGEHLP_MODULEW64): BOOL; stdcall;
  1389. {$EXTERNALSYM SymGetModuleInfoW64}
  1391. function SymGetModuleInfo(hProcess: HANDLE; dwAddr: DWORD;
  1392.   var ModuleInfo: IMAGEHLP_MODULE): BOOL; stdcall;
  1393. {$EXTERNALSYM SymGetModuleInfo}
  1395. function SymGetModuleInfoW(hProcess: HANDLE; dwAddr: DWORD;
  1396.   var ModuleInfo: IMAGEHLP_MODULEW): BOOL; stdcall;
  1397. {$EXTERNALSYM SymGetModuleInfoW}
  1399. function SymGetModuleBase64(hProcess: HANDLE; qwAddr: DWORD64): DWORD64; stdcall;
  1400. {$EXTERNALSYM SymGetModuleBase64}
  1402. function SymGetModuleBase(hProcess: HANDLE; dwAddr: DWORD): DWORD; stdcall;
  1403. {$EXTERNALSYM SymGetModuleBase}
  1405. function SymGetSymNext64(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL64): BOOL; stdcall;
  1406. {$EXTERNALSYM SymGetSymNext64}
  1408. function SymGetSymNext(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL): BOOL; stdcall;
  1409. {$EXTERNALSYM SymGetSymNext}
  1411. function SymGetSymPrev64(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL64): BOOL; stdcall;
  1412. {$EXTERNALSYM SymGetSymPrev64}
  1414. function SymGetSymPrev(hProcess: HANDLE; var Symbol: IMAGEHLP_SYMBOL): BOOL; stdcall;
  1415. {$EXTERNALSYM SymGetSymPrev}
  1417. function SymGetLineFromAddr64(hProcess: HANDLE; qwAddr: DWORD64;
  1418.   var pdwDisplacement: DWORD; var Line64: IMAGEHLP_LINE64): BOOL; stdcall;
  1419. {$EXTERNALSYM SymGetLineFromAddr64}
  1421. function SymGetLineFromAddr(hProcess: HANDLE; dwAddr: DWORD;
  1422.   var pdwDisplacement: DWORD; var Line: IMAGEHLP_LINE): BOOL; stdcall;
  1423. {$EXTERNALSYM SymGetLineFromAddr}
  1425. function SymGetLineFromName64(hProcess: HANDLE; ModuleName: PSTR; FileName: PSTR;
  1426.   dwLineNumber: DWORD; var plDisplacement: LONG; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
  1427. {$EXTERNALSYM SymGetLineFromName64}
  1429. function SymGetLineFromName(hProcess: HANDLE; ModuleName: PSTR; FileName: PSTR;
  1430.   dwLineNumber: DWORD; var plDisplacement: LONG; var Line: IMAGEHLP_LINE): BOOL; stdcall;
  1431. {$EXTERNALSYM SymGetLineFromName}
  1433. function SymGetLineNext64(hProcess: HANDLE; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
  1434. {$EXTERNALSYM SymGetLineNext64}
  1436. function SymGetLineNext(hProcess: HANDLE; var Line: IMAGEHLP_LINE): BOOL; stdcall;
  1437. {$EXTERNALSYM SymGetLineNext}
  1439. function SymGetLinePrev64(hProcess: HANDLE; var Line: IMAGEHLP_LINE64): BOOL; stdcall;
  1440. {$EXTERNALSYM SymGetLinePrev64}
  1442. function SymGetLinePrev(hProcess: HANDLE; var Line: IMAGEHLP_LINE): BOOL; stdcall;
  1443. {$EXTERNALSYM SymGetLinePrev}
  1445. function SymMatchFileName(FileName, Match: PSTR; var FileNameStop, MatchStop: PSTR): BOOL; stdcall;
  1446. {$EXTERNALSYM SymMatchFileName}
  1448. function SymInitialize(hProcess: HANDLE; UserSearchPath: PSTR; fInvadeProcess: BOOL): BOOL; stdcall;
  1449. {$EXTERNALSYM SymInitialize}
  1451. function SymGetSearchPath(hProcess: HANDLE; SearchPath: PSTR; SearchPathLength: DWORD): BOOL; stdcall;
  1452. {$EXTERNALSYM SymGetSearchPath}
  1454. function SymSetSearchPath(hProcess: HANDLE; SearchPath: PSTR): BOOL; stdcall;
  1455. {$EXTERNALSYM SymSetSearchPath}
  1457. function SymLoadModule64(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR;
  1458.   BaseOfDll: DWORD64; SizeOfDll: DWORD): DWORD64; stdcall;
  1459. {$EXTERNALSYM SymLoadModule64}
  1461. const
  1462.   SLMFLAG_VIRTUAL = $1;
  1463.   {$EXTERNALSYM SLMFLAG_VIRTUAL}
  1465. function SymLoadModuleEx(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR; BaseOfDll: DWORD64;
  1466.   DllSize: DWORD; Data: PMODLOAD_DATA; Flag: DWORD): DWORD64; stdcall;
  1467. {$EXTERNALSYM SymLoadModuleEx}
  1469. function SymLoadModule(hProcess, hFile: HANDLE; ImageName, ModuleName: PSTR;
  1470.   BaseOfDll: DWORD; SizeOfDll: DWORD): DWORD; stdcall;
  1471. {$EXTERNALSYM SymLoadModule}
  1473. function SymUnloadModule64(hProcess: HANDLE; BaseOfDll: DWORD64): BOOL; stdcall;
  1474. {$EXTERNALSYM SymUnloadModule64}
  1476. function SymUnloadModule(hProcess: HANDLE; BaseOfDll: DWORD): BOOL; stdcall;
  1477. {$EXTERNALSYM SymUnloadModule}
  1479. function SymUnDName64(const sym: IMAGEHLP_SYMBOL64; UnDecName: PSTR;
  1480.   UnDecNameLength: DWORD): BOOL; stdcall;
  1481. {$EXTERNALSYM SymUnDName64}
  1483. function SymUnDName(const sym: IMAGEHLP_SYMBOL; UnDecName: PSTR;
  1484.   UnDecNameLength: DWORD): BOOL; stdcall;
  1485. {$EXTERNALSYM SymUnDName}
  1487. function SymRegisterCallback64(hProcess: HANDLE; CallbackFunction: PSYMBOL_REGISTERED_CALLBACK64;
  1488.   UserContext: ULONG64): BOOL; stdcall;
  1489. {$EXTERNALSYM SymRegisterCallback64}
  1491. function SymRegisterFunctionEntryCallback64(hProcess: HANDLE; CallbackFunction: PSYMBOL_FUNCENTRY_CALLBACK64;
  1492.   UserContext: ULONG64): BOOL; stdcall;
  1493. {$EXTERNALSYM SymRegisterFunctionEntryCallback64}
  1495. function SymRegisterCallback(hProcess: HANDLE; CallbackFunction: PSYMBOL_REGISTERED_CALLBACK;
  1496.   UserContext: PVOID): BOOL; stdcall;
  1497. {$EXTERNALSYM SymRegisterCallback}
  1499. function SymRegisterFunctionEntryCallback(hProcess: HANDLE; CallbackFunction: PSYMBOL_FUNCENTRY_CALLBACK;
  1500.   UserContext: PVOID): BOOL; stdcall;
  1501. {$EXTERNALSYM SymRegisterFunctionEntryCallback}
  1503. type
  1504.   PIMAGEHLP_SYMBOL_SRC = ^IMAGEHLP_SYMBOL_SRC;
  1505.   {$EXTERNALSYM PIMAGEHLP_SYMBOL_SRC}
  1506.   _IMAGEHLP_SYMBOL_SRC = record
  1507.     sizeofstruct: DWORD;
  1508.     type_: DWORD;
  1509.     file_: array [0..MAX_PATH - 1] of Char;
  1510.   end;
  1511.   {$EXTERNALSYM _IMAGEHLP_SYMBOL_SRC}
  1512.   IMAGEHLP_SYMBOL_SRC = _IMAGEHLP_SYMBOL_SRC;
  1513.   {$EXTERNALSYM IMAGEHLP_SYMBOL_SRC}
  1514.   TImageHlpSymbolSrc = IMAGEHLP_SYMBOL_SRC;
  1515.   PImageHlpSymbolSrc = PIMAGEHLP_SYMBOL_SRC;
  1517.   PMODULE_TYPE_INFO = ^MODULE_TYPE_INFO;
  1518.   {$EXTERNALSYM PMODULE_TYPE_INFO}
  1519.   _MODULE_TYPE_INFO = record
  1520.     dataLength: USHORT;
  1521.     leaf: USHORT;
  1522.     data: array [0..0] of BYTE;
  1523.   end;
  1524.   {$EXTERNALSYM _MODULE_TYPE_INFO}
  1525.   MODULE_TYPE_INFO = _MODULE_TYPE_INFO;
  1526.   {$EXTERNALSYM MODULE_TYPE_INFO}
  1527.   TModuleTypeInfo = MODULE_TYPE_INFO;
  1528.   PModuleTypeInfo = PMODULE_TYPE_INFO;
  1530. type
  1531.   PSYMBOL_INFO = ^SYMBOL_INFO;
  1532.   {$EXTERNALSYM PSYMBOL_INFO}
  1533.   _SYMBOL_INFO = record
  1534.     SizeOfStruct: ULONG;
  1535.     TypeIndex: ULONG; // Type Index of symbol
  1536.     Reserved: array [0..1] of ULONG64;
  1537.     Info: ULONG;
  1538.     Size: ULONG;
  1539.     ModBase: ULONG64; // Base Address of module comtaining this symbol
  1540.     Flags: ULONG;
  1541.     Value: ULONG64; // Value of symbol, ValuePresent should be 1
  1542.     Address: ULONG64; // Address of symbol including base address of module
  1543.     Register_: ULONG; // register holding value or pointer to value
  1544.     Scope: ULONG; // scope of the symbol
  1545.     Tag: ULONG; // pdb classification
  1546.     NameLen: ULONG; // Actual length of name
  1547.     MaxNameLen: ULONG;
  1548.     Name: array [0..0] of CHAR; // Name of symbol
  1549.   end;
  1550.   {$EXTERNALSYM _SYMBOL_INFO}
  1551.   SYMBOL_INFO = _SYMBOL_INFO;
  1552.   {$EXTERNALSYM SYMBOL_INFO}
  1553.   TSymbolInfo = SYMBOL_INFO;
  1554.   PSymbolInfo = PSYMBOL_INFO;
  1556.   _SYMBOL_INFO_PACKAGE = record
  1557.     si: SYMBOL_INFO;
  1558.     name: array [0..MAX_SYM_NAME] of CHAR;
  1559.   end;
  1560.   {$EXTERNALSYM _SYMBOL_INFO_PACKAGE}
  1561.   SYMBOL_INFO_PACKAGE = _SYMBOL_INFO_PACKAGE;
  1562.   {$EXTERNALSYM SYMBOL_INFO_PACKAGE}
  1563.   PSYMBOL_INFO_PACKAGE = ^SYMBOL_INFO_PACKAGE;
  1564.   {$EXTERNALSYM PSYMBOL_INFO_PACKAGE}
  1565.   TSymbolInfoPackage = SYMBOL_INFO_PACKAGE;
  1566.   PSymbolInfoPackage = PSYMBOL_INFO_PACKAGE;
  1568.   PIMAGEHLP_STACK_FRAME = ^IMAGEHLP_STACK_FRAME;
  1569.   {$EXTERNALSYM PIMAGEHLP_STACK_FRAME}
  1570.   _IMAGEHLP_STACK_FRAME = record
  1571.     InstructionOffset: ULONG64;
  1572.     ReturnOffset: ULONG64;
  1573.     FrameOffset: ULONG64;
  1574.     StackOffset: ULONG64;
  1575.     BackingStoreOffset: ULONG64;
  1576.     FuncTableEntry: ULONG64;
  1577.     Params: array [0..3] of ULONG64;
  1578.     Reserved: array [0..4] of ULONG64;
  1579.     Virtual_: BOOL;
  1580.     Reserved2: ULONG;
  1581.   end;
  1582.   {$EXTERNALSYM _IMAGEHLP_STACK_FRAME}
  1583.   IMAGEHLP_STACK_FRAME = _IMAGEHLP_STACK_FRAME;
  1584.   {$EXTERNALSYM IMAGEHLP_STACK_FRAME}
  1585.   TImageHlpStackFrame = IMAGEHLP_STACK_FRAME;
  1586.   PImageHlpStackFrame = PIMAGEHLP_STACK_FRAME;
  1588.   IMAGEHLP_CONTEXT = LPVOID;
  1589.   {$EXTERNALSYM IMAGEHLP_CONTEXT}
  1590.   PIMAGEHLP_CONTEXT = ^IMAGEHLP_CONTEXT;
  1591.   {$EXTERNALSYM PIMAGEHLP_CONTEXT}
  1592.   TImageHlpContext = IMAGEHLP_CONTEXT;
  1593.   PImageHlpContext = PIMAGEHLP_CONTEXT;
  1595. function SymSetContext(hProcess: HANDLE; StackFrame: PIMAGEHLP_STACK_FRAME; Context: PIMAGEHLP_CONTEXT): BOOL; stdcall;
  1596. {$EXTERNALSYM SymSetContext}
  1598. function SymFromAddr(hProcess: HANDLE; Address: DWORD64; Displacement: PDWORD64; Symbol: PSYMBOL_INFO): BOOL; stdcall;
  1599. {$EXTERNALSYM SymFromAddr}
  1601. // While SymFromName will provide a symbol from a name,
  1602. // SymEnumSymbols can provide the same matching information
  1603. // for ALL symbols with a matching name, even regular
  1604. // expressions.  That way you can search across modules
  1605. // and differentiate between identically named symbols.
  1607. function SymFromName(hProcess: HANDLE; Name: LPSTR; Symbol: PSYMBOL_INFO): BOOL; stdcall;
  1608. {$EXTERNALSYM SymFromName}
  1610. type
  1611.   PSYM_ENUMERATESYMBOLS_CALLBACK = function (pSymInfo: PSYMBOL_INFO; SymbolSize: ULONG; UserContext: PVOID): BOOL; stdcall;
  1612.   {$EXTERNALSYM PSYM_ENUMERATESYMBOLS_CALLBACK}
  1613.   PSymEnumerateSymbolsCallback = PSYM_ENUMERATESYMBOLS_CALLBACK;
  1615. function SymEnumSymbols(hProcess: HANDLE; BaseOfDll: ULONG64; Mask: PCSTR; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1616. {$EXTERNALSYM SymEnumSymbols}
  1618. function SymEnumSymbolsForAddr(hProcess: HANDLE; Address: DWORD64;
  1619.   EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1620. {$EXTERNALSYM SymEnumSymbolsForAddr}
  1622. type
  1623.   _IMAGEHLP_SYMBOL_TYPE_INFO = (
  1624.     TI_GET_SYMTAG,
  1625.     TI_GET_SYMNAME,
  1626.     TI_GET_LENGTH,
  1627.     TI_GET_TYPE,
  1628.     TI_GET_TYPEID,
  1629.     TI_GET_BASETYPE,
  1630.     TI_GET_ARRAYINDEXTYPEID,
  1631.     TI_FINDCHILDREN,
  1632.     TI_GET_DATAKIND,
  1633.     TI_GET_ADDRESSOFFSET,
  1634.     TI_GET_OFFSET,
  1635.     TI_GET_VALUE,
  1636.     TI_GET_COUNT,
  1637.     TI_GET_CHILDRENCOUNT,
  1638.     TI_GET_BITPOSITION,
  1639.     TI_GET_VIRTUALBASECLASS,
  1640.     TI_GET_VIRTUALTABLESHAPEID,
  1641.     TI_GET_VIRTUALBASEPOINTEROFFSET,
  1642.     TI_GET_CLASSPARENTID,
  1643.     TI_GET_NESTED,
  1644.     TI_GET_SYMINDEX,
  1645.     TI_GET_LEXICALPARENT,
  1646.     TI_GET_ADDRESS,
  1647.     TI_GET_THISADJUST,
  1648.     TI_GET_UDTKIND,
  1649.     TI_IS_EQUIV_TO,
  1650.     TI_GET_CALLING_CONVENTION);
  1651.   {$EXTERNALSYM _IMAGEHLP_SYMBOL_TYPE_INFO}
  1652.   IMAGEHLP_SYMBOL_TYPE_INFO = _IMAGEHLP_SYMBOL_TYPE_INFO;
  1653.   {$EXTERNALSYM IMAGEHLP_SYMBOL_TYPE_INFO}
  1654.   TImageHlpSymbolTypeInfo = IMAGEHLP_SYMBOL_TYPE_INFO;
  1656.   PTI_FINDCHILDREN_PARAMS = ^TI_FINDCHILDREN_PARAMS;
  1657.   {$EXTERNALSYM PTI_FINDCHILDREN_PARAMS}
  1658.   _TI_FINDCHILDREN_PARAMS = record
  1659.     Count: ULONG;
  1660.     Start: ULONG;
  1661.     ChildId: array [0..0] of ULONG;
  1662.   end;
  1663.   {$EXTERNALSYM _TI_FINDCHILDREN_PARAMS}
  1664.   TI_FINDCHILDREN_PARAMS = _TI_FINDCHILDREN_PARAMS;
  1665.   {$EXTERNALSYM TI_FINDCHILDREN_PARAMS}
  1666.   TTiFindChildrenParams = TI_FINDCHILDREN_PARAMS;
  1667.   PTiFindChildrenParams = PTI_FINDCHILDREN_PARAMS;
  1669. function SymGetTypeInfo(hProcess: HANDLE; ModBase: DWORD64; TypeId: ULONG; GetType: IMAGEHLP_SYMBOL_TYPE_INFO; pInfo: PVOID): BOOL; stdcall;
  1670. {$EXTERNALSYM SymGetTypeInfo}
  1672. function SymEnumTypes(hProcess: HANDLE; BaseOfDll: ULONG64; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1673. {$EXTERNALSYM SymEnumTypes}
  1675. function SymGetTypeFromName(hProcess: HANDLE; BaseOfDll: ULONG64; Name: LPSTR; Symbol: PSYMBOL_INFO): BOOL; stdcall;
  1676. {$EXTERNALSYM SymGetTypeFromName}
  1678. function SymAddSymbol(hProcess: HANDLE; BaseOfDll: ULONG64; Name: PCSTR; Address: DWORD64; Size, Flags: DWORD): BOOL; stdcall;
  1679. {$EXTERNALSYM SymAddSymbol}
  1681. function SymDeleteSymbol(hProcess: HANDLE; BaseOfDll: ULONG64; Name: PCSTR; Address: DWORD64; Flags: DWORD): BOOL; stdcall;
  1682. {$EXTERNALSYM SymDeleteSymbol}
  1684. //
  1685. // Full user-mode dump creation.
  1686. //
  1688. type
  1689.   PDBGHELP_CREATE_USER_DUMP_CALLBACK = function (DataType: DWORD; var Data: PVOID; DataLength: LPDWORD; UserData: PVOID): BOOL; stdcall;
  1690.   {$EXTERNALSYM PDBGHELP_CREATE_USER_DUMP_CALLBACK}
  1691.   PDbgHelpCreateUserDumpCallback = PDBGHELP_CREATE_USER_DUMP_CALLBACK;
  1693. function DbgHelpCreateUserDump(FileName: LPSTR; Callback: PDBGHELP_CREATE_USER_DUMP_CALLBACK; UserData: PVOID): BOOL; stdcall;
  1694. {$EXTERNALSYM DbgHelpCreateUserDump}
  1696. function DbgHelpCreateUserDumpW(FileName: LPWSTR; Callback: PDBGHELP_CREATE_USER_DUMP_CALLBACK; UserData: PVOID): BOOL; stdcall;
  1697. {$EXTERNALSYM DbgHelpCreateUserDumpW}
  1699. // -----------------------------------------------------------------
  1700. // The following 4 legacy APIs are fully supported, but newer
  1701. // ones are recommended.  SymFromName and SymFromAddr provide
  1702. // much more detailed info on the returned symbol.
  1704. function SymGetSymFromAddr64(hProcess: HANDLE; qwAddr: DWORD64; pdwDisplacement: PDWORD64; Symbol: PIMAGEHLP_SYMBOL64): BOOL; stdcall;
  1705. {$EXTERNALSYM SymGetSymFromAddr64}
  1707. function SymGetSymFromAddr(hProcess: HANDLE; dwAddr: DWORD; pdwDisplacement: PDWORD; Symbol: PIMAGEHLP_SYMBOL): BOOL; stdcall;
  1708. {$EXTERNALSYM SymGetSymFromAddr}
  1710. // While following two APIs will provide a symbol from a name,
  1711. // SymEnumSymbols can provide the same matching information
  1712. // for ALL symbols with a matching name, even regular
  1713. // expressions.  That way you can search across modules
  1714. // and differentiate between identically named symbols.
  1716. function SymGetSymFromName64(hProcess: HANDLE; Name: PSTR; Symbol: PIMAGEHLP_SYMBOL64): BOOL; stdcall;
  1717. {$EXTERNALSYM SymGetSymFromName64}
  1719. function SymGetSymFromName(hProcess: HANDLE; Name: PSTR; Symbol: PIMAGEHLP_SYMBOL): BOOL; stdcall;
  1720. {$EXTERNALSYM SymGetSymFromName}
  1722. // -----------------------------------------------------------------
  1723. // The following APIs exist only for backwards compatibility
  1724. // with a pre-release version documented in an MSDN release.
  1726. // You should use SymFindFileInPath if you want to maintain
  1727. // future compatibility.
  1729. function FindFileInPath(hprocess: HANDLE; SearchPath: LPSTR; FileName: LPSTR; id: PVOID; two: DWORD; three: DWORD; flags: DWORD; FilePath: LPSTR): BOOL; stdcall;
  1730. {$EXTERNALSYM FindFileInPath}
  1732. // You should use SymFindFileInPath if you want to maintain
  1733. // future compatibility.
  1735. function FindFileInSearchPath(hprocess: HANDLE; SearchPath: LPSTR; FileName: LPSTR; one: DWORD; two: DWORD; three: DWORD; FilePath: LPSTR): BOOL; stdcall;
  1736. {$EXTERNALSYM FindFileInSearchPath}
  1738. function SymEnumSym(hProcess: HANDLE; BaseOfDll: ULONG64; EnumSymbolsCallback: PSYM_ENUMERATESYMBOLS_CALLBACK; UserContext: PVOID): BOOL; stdcall;
  1739. {$EXTERNALSYM SymEnumSym}
  1741. // These values should not be used.
  1742. // They have been replaced by SYMFLAG_ values.
  1744. const
  1745.   SYMF_OMAP_GENERATED  = $00000001;
  1746.   SYMF_OMAP_MODIFIED   = $00000002;
  1747.   SYMF_REGISTER        = $00000008;
  1748.   SYMF_REGREL          = $00000010;
  1749.   SYMF_FRAMEREL        = $00000020;
  1750.   SYMF_PARAMETER       = $00000040;
  1751.   SYMF_LOCAL           = $00000080;
  1752.   SYMF_CONSTANT        = $00000100;
  1753.   SYMF_EXPORT          = $00000200;
  1754.   SYMF_FORWARDER       = $00000400;
  1755.   SYMF_FUNCTION        = $00000800;
  1756.   SYMF_VIRTUAL         = $00001000;
  1757.   SYMF_THUNK           = $00002000;
  1758.   SYMF_TLSREL          = $00004000;
  1760. // These values should also not be used.
  1761. // They have been replaced by SYMFLAG_ values.
  1763.   IMAGEHLP_SYMBOL_INFO_VALUEPRESENT         = 1;
  1764.   IMAGEHLP_SYMBOL_INFO_REGISTER             = SYMF_REGISTER;        // 0x0008
  1765.   IMAGEHLP_SYMBOL_INFO_REGRELATIVE          = SYMF_REGREL;          // 0x0010
  1766.   IMAGEHLP_SYMBOL_INFO_FRAMERELATIVE        = SYMF_FRAMEREL;        // 0x0020
  1767.   IMAGEHLP_SYMBOL_INFO_PARAMETER            = SYMF_PARAMETER;       // 0x0040
  1768.   IMAGEHLP_SYMBOL_INFO_LOCAL                = SYMF_LOCAL;           // 0x0080
  1769.   IMAGEHLP_SYMBOL_INFO_CONSTANT             = SYMF_CONSTANT;        // 0x0100
  1770.   IMAGEHLP_SYMBOL_FUNCTION                  = SYMF_FUNCTION;        // 0x0800
  1771.   IMAGEHLP_SYMBOL_VIRTUAL                   = SYMF_VIRTUAL;         // 0x1000
  1772.   IMAGEHLP_SYMBOL_THUNK                     = SYMF_THUNK;           // 0x2000
  1773.   IMAGEHLP_SYMBOL_INFO_TLSRELATIVE          = SYMF_TLSREL;          // 0x4000
  1775. const
  1776.   MINIDUMP_SIGNATURE = ('PMDM');
  1777.   {$EXTERNALSYM MINIDUMP_SIGNATURE}
  1778.   MINIDUMP_VERSION   = (42899);
  1779.   {$EXTERNALSYM MINIDUMP_VERSION}
  1781. type
  1782.   RVA = DWORD;
  1783.   {$EXTERNALSYM RVA}
  1784.   RVA64 = ULONG64;
  1785.   {$EXTERNALSYM RVA64}
  1787.   _MINIDUMP_LOCATION_DESCRIPTOR = record
  1788.     DataSize: ULONG32;
  1789.     Rva: RVA;
  1790.   end;
  1791.   {$EXTERNALSYM _MINIDUMP_LOCATION_DESCRIPTOR}
  1792.   MINIDUMP_LOCATION_DESCRIPTOR = _MINIDUMP_LOCATION_DESCRIPTOR;
  1793.   {$EXTERNALSYM MINIDUMP_LOCATION_DESCRIPTOR}
  1794.   TMinidumpLocationDescriptor = MINIDUMP_LOCATION_DESCRIPTOR;
  1795.   PMinidumpLocationDescriptor = ^MINIDUMP_LOCATION_DESCRIPTOR;
  1797.   _MINIDUMP_LOCATION_DESCRIPTOR64 = record
  1798.     DataSize: ULONG64;
  1799.     Rva: RVA64;
  1800.   end;
  1801.   {$EXTERNALSYM _MINIDUMP_LOCATION_DESCRIPTOR64}
  1802.   MINIDUMP_LOCATION_DESCRIPTOR64 = _MINIDUMP_LOCATION_DESCRIPTOR64;
  1803.   {$EXTERNALSYM MINIDUMP_LOCATION_DESCRIPTOR64}
  1804.   TMinidumpLocationDescriptor64 = MINIDUMP_LOCATION_DESCRIPTOR64;
  1805.   PMinidumpLocationDescriptor64 = ^MINIDUMP_LOCATION_DESCRIPTOR64;
  1807.   PMINIDUMP_MEMORY_DESCRIPTOR = ^MINIDUMP_MEMORY_DESCRIPTOR;
  1808.   {$EXTERNALSYM PMINIDUMP_MEMORY_DESCRIPTOR}
  1809.   _MINIDUMP_MEMORY_DESCRIPTOR = record
  1810.     StartOfMemoryRange: ULONG64;
  1811.     Memory: MINIDUMP_LOCATION_DESCRIPTOR;
  1812.   end;
  1813.   {$EXTERNALSYM _MINIDUMP_MEMORY_DESCRIPTOR}
  1814.   MINIDUMP_MEMORY_DESCRIPTOR = _MINIDUMP_MEMORY_DESCRIPTOR;
  1815.   {$EXTERNALSYM MINIDUMP_MEMORY_DESCRIPTOR}
  1816.   TMinidumpMemoryDescriptor = MINIDUMP_MEMORY_DESCRIPTOR;
  1817.   PMinidumpMemoryDescriptor = PMINIDUMP_MEMORY_DESCRIPTOR;
  1819. // DESCRIPTOR64 is used for full-memory minidumps where
  1820. // all of the raw memory is laid out sequentially at the
  1821. // end of the dump.  There is no need for individual RVAs
  1822. // as the RVA is the base RVA plus the sum of the preceeding
  1823. // data blocks.
  1825.   PMINIDUMP_MEMORY_DESCRIPTOR64 = ^MINIDUMP_MEMORY_DESCRIPTOR64;
  1826.   {$EXTERNALSYM PMINIDUMP_MEMORY_DESCRIPTOR64}
  1827.   _MINIDUMP_MEMORY_DESCRIPTOR64 = record
  1828.     StartOfMemoryRange: ULONG64;
  1829.     DataSize: ULONG64;
  1830.   end;
  1831.   {$EXTERNALSYM _MINIDUMP_MEMORY_DESCRIPTOR64}
  1832.   MINIDUMP_MEMORY_DESCRIPTOR64 = _MINIDUMP_MEMORY_DESCRIPTOR64;
  1833.   {$EXTERNALSYM MINIDUMP_MEMORY_DESCRIPTOR64}
  1834.   TMinidumpMemoryDescriptor64 = MINIDUMP_MEMORY_DESCRIPTOR64;
  1835.   PMinidumpMemoryDescriptor64 = PMINIDUMP_MEMORY_DESCRIPTOR64;
  1837.   PMINIDUMP_HEADER = ^MINIDUMP_HEADER;
  1838.   {$EXTERNALSYM PMINIDUMP_HEADER}
  1839.   _MINIDUMP_HEADER = record
  1840.     Signature: ULONG32;
  1841.     Version: ULONG32;
  1842.     NumberOfStreams: ULONG32;
  1843.     StreamDirectoryRva: RVA;
  1844.     CheckSum: ULONG32;
  1845.     U: record
  1846.     case Integer of
  1847.       0: (Reserved: ULONG32);
  1848.       1: (TimeDateStamp: ULONG32);
  1849.     end;
  1850.     Flags: ULONG64;
  1851.   end;
  1852.   {$EXTERNALSYM _MINIDUMP_HEADER}
  1853.   MINIDUMP_HEADER = _MINIDUMP_HEADER;
  1854.   {$EXTERNALSYM MINIDUMP_HEADER}
  1855.   TMinidumpHeader = MINIDUMP_HEADER;
  1856.   PMinidumpHeader = PMINIDUMP_HEADER;
  1858. //
  1859. // The MINIDUMP_HEADER field StreamDirectoryRva points to 
  1860. // an array of MINIDUMP_DIRECTORY structures.
  1861. //
  1863.   PMINIDUMP_DIRECTORY = ^MINIDUMP_DIRECTORY;
  1864.   {$EXTERNALSYM PMINIDUMP_DIRECTORY}
  1865.   _MINIDUMP_DIRECTORY = record
  1866.     StreamType: ULONG32;
  1867.     Location: MINIDUMP_LOCATION_DESCRIPTOR;
  1868.   end;
  1869.   {$EXTERNALSYM _MINIDUMP_DIRECTORY}
  1870.   MINIDUMP_DIRECTORY = _MINIDUMP_DIRECTORY;
  1871.   {$EXTERNALSYM MINIDUMP_DIRECTORY}
  1872.   TMinidumpDirectory = MINIDUMP_DIRECTORY;
  1873.   PMinidumpDirectory = PMINIDUMP_DIRECTORY;
  1875.   PMINIDUMP_STRING = ^MINIDUMP_STRING;
  1876.   {$EXTERNALSYM PMINIDUMP_STRING}
  1877.   _MINIDUMP_STRING = record
  1878.     Length: ULONG32; // Length in bytes of the string
  1879.     Buffer: PWCHAR; // Variable size buffer
  1880.   end;
  1881.   {$EXTERNALSYM _MINIDUMP_STRING}
  1882.   MINIDUMP_STRING = _MINIDUMP_STRING;
  1883.   {$EXTERNALSYM MINIDUMP_STRING}
  1884.   TMinidumpString = MINIDUMP_STRING;
  1885.   PMinidumpString = PMINIDUMP_STRING;
  1887. //
  1888. // The MINIDUMP_DIRECTORY field StreamType may be one of the following types.
  1889. // Types will be added in the future, so if a program reading the minidump
  1890. // header encounters a stream type it does not understand it should ignore
  1891. // the data altogether. Any tag above LastReservedStream will not be used by
  1892. // the system and is reserved for program-specific information.
  1893. //
  1895. const
  1896.   UnusedStream                = 0;
  1897.   {$EXTERNALSYM UnusedStream}
  1898.   ReservedStream0             = 1;
  1899.   {$EXTERNALSYM ReservedStream0}
  1900.   ReservedStream1             = 2;
  1901.   {$EXTERNALSYM ReservedStream1}
  1902.   ThreadListStream            = 3;
  1903.   {$EXTERNALSYM ThreadListStream}
  1904.   ModuleListStream            = 4;
  1905.   {$EXTERNALSYM ModuleListStream}
  1906.   MemoryListStream            = 5;
  1907.   {$EXTERNALSYM MemoryListStream}
  1908.   ExceptionStream             = 6;
  1909.   {$EXTERNALSYM ExceptionStream}
  1910.   SystemInfoStream            = 7;
  1911.   {$EXTERNALSYM SystemInfoStream}
  1912.   ThreadExListStream          = 8;
  1913.   {$EXTERNALSYM ThreadExListStream}
  1914.   Memory64ListStream          = 9;
  1915.   {$EXTERNALSYM Memory64ListStream}
  1916.   CommentStreamA              = 10;
  1917.   {$EXTERNALSYM CommentStreamA}
  1918.   CommentStreamW              = 11;
  1919.   {$EXTERNALSYM CommentStreamW}
  1920.   HandleDataStream            = 12;
  1921.   {$EXTERNALSYM HandleDataStream}
  1922.   FunctionTableStream         = 13;
  1923.   {$EXTERNALSYM FunctionTableStream}
  1924.   UnloadedModuleListStream   = 14;
  1925.   {$EXTERNALSYM UnloadedModuleListStream}
  1926.   MiscInfoStream             = 15;
  1927.   {$EXTERNALSYM MiscInfoStream}
  1929.   LastReservedStream          = $ffff;
  1930.   {$EXTERNALSYM LastReservedStream}
  1932. type
  1933.   _MINIDUMP_STREAM_TYPE = DWORD;
  1934.   {$EXTERNALSYM MINIDUMP_STREAM_TYPE}
  1935.   MINIDUMP_STREAM_TYPE = _MINIDUMP_STREAM_TYPE;
  1936.   {$EXTERNALSYM _MINIDUMP_STREAM_TYPE}
  1937.   TMinidumpStreamType = MINIDUMP_STREAM_TYPE;
  1939. //
  1940. // The minidump system information contains processor and
  1941. // Operating System specific information.
  1942. //
  1944. type
  1945.   _CPU_INFORMATION = record
  1946.     case Integer of
  1948.         //
  1949.         // X86 platforms use CPUID function to obtain processor information.
  1950.         //
  1952.         0: (
  1954.           //
  1955.           // CPUID Subfunction 0, register EAX (VendorId [0]),
  1956.           // EBX (VendorId [1]) and ECX (VendorId [2]).
  1957.           //
  1959.           VendorId: array [0..2] of ULONG32;
  1961.           //
  1962.           // CPUID Subfunction 1, register EAX
  1963.           //
  1965.           VersionInformation: ULONG32;
  1967.           //
  1968.           // CPUID Subfunction 1, register EDX
  1969.           //
  1971.           FeatureInformation: ULONG32;
  1973.           //
  1974.           // CPUID, Subfunction 80000001, register EBX. This will only
  1975.           // be obtained if the vendor id is "AuthenticAMD".
  1976.           //
  1978.           AMDExtendedCpuFeatures: ULONG32);
  1980.         //
  1981.         // Non-x86 platforms use processor feature flags.
  1982.         //
  1984.         1: (
  1985.           ProcessorFeatures: array [0..1] of ULONG64);
  1986.     end;
  1988.   _MINIDUMP_SYSTEM_INFO = record
  1990.     //
  1991.     // ProcessorArchitecture, ProcessorLevel and ProcessorRevision are all
  1992.     // taken from the SYSTEM_INFO structure obtained by GetSystemInfo( ).
  1993.     //
  1995.     ProcessorArchitecture: USHORT;
  1996.     ProcessorLevel: USHORT;
  1997.     ProcessorRevision: USHORT;
  1999.     U: record
  2000.     case Integer of
  2001.       0: (Reserved0: USHORT);
  2002.       1: (
  2003.         NumberOfProcessors: UCHAR;
  2004.         ProductType: UCHAR);
  2005.     end;
  2007.     //
  2008.     // MajorVersion, MinorVersion, BuildNumber, PlatformId and
  2009.     // CSDVersion are all taken from the OSVERSIONINFO structure
  2010.     // returned by GetVersionEx( ).
  2011.     //
  2013.     MajorVersion: ULONG32;
  2014.     MinorVersion: ULONG32;
  2015.     BuildNumber: ULONG32;
  2016.     PlatformId: ULONG32;
  2018.     //
  2019.     // RVA to a CSDVersion string in the string table.
  2020.     //
  2022.     CSDVersionRva: RVA;
  2024.     U2: record
  2025.     case Integer of
  2026.       0: (Reserved1: ULONG32);
  2027.       1: (
  2028.         SuiteMask: USHORT;
  2029.         Reserved2: USHORT);
  2030.     end;
  2031.     
  2032.     //
  2033.     // CPU information is obtained from one of two places.
  2034.     //
  2035.     //  1) On x86 computers, CPU_INFORMATION is obtained from the CPUID
  2036.     //     instruction. You must use the X86 portion of the union for X86
  2037.     //     computers.
  2038.     //
  2039.     //  2) On non-x86 architectures, CPU_INFORMATION is obtained by calling
  2040.     //     IsProcessorFeatureSupported().
  2041.     //
  2043.     Cpu: _CPU_INFORMATION;
  2044.   end;
  2045.   {$EXTERNALSYM _MINIDUMP_SYSTEM_INFO}
  2046.   MINIDUMP_SYSTEM_INFO = _MINIDUMP_SYSTEM_INFO;
  2047.   {$EXTERNALSYM MINIDUMP_SYSTEM_INFO}
  2048.   PMINIDUMP_SYSTEM_INFO = ^MINIDUMP_SYSTEM_INFO;
  2049.   {$EXTERNALSYM PMINIDUMP_SYSTEM_INFO}
  2050.   TMinidumpSystemInfo = MINIDUMP_SYSTEM_INFO;
  2051.   PMinidumpSystemInfo = PMINIDUMP_SYSTEM_INFO;
  2053.   CPU_INFORMATION = _CPU_INFORMATION;
  2054.   {$EXTERNALSYM CPU_INFORMATION}
  2055.   PCPU_INFORMATION = CPU_INFORMATION;
  2056.   {$EXTERNALSYM PCPU_INFORMATION}
  2058. //
  2059. // The minidump thread contains standard thread
  2060. // information plus an RVA to the memory for this 
  2061. // thread and an RVA to the CONTEXT structure for
  2062. // this thread.
  2063. //
  2066. //
  2067. // ThreadId must be 4 bytes on all architectures.
  2068. //
  2070. // C_ASSERT (sizeof ( ((PPROCESS_INFORMATION)0)->dwThreadId ) == 4);
  2072. type
  2073.   PMINIDUMP_THREAD = ^MINIDUMP_THREAD;
  2074.   {$EXTERNALSYM PMINIDUMP_THREAD}
  2075.   _MINIDUMP_THREAD = record
  2076.     ThreadId: ULONG32;
  2077.     SuspendCount: ULONG32;
  2078.     PriorityClass: ULONG32;
  2079.     Priority: ULONG32;
  2080.     Teb: ULONG64;
  2081.     Stack: MINIDUMP_MEMORY_DESCRIPTOR;
  2082.     ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
  2083.   end;
  2084.   {$EXTERNALSYM _MINIDUMP_THREAD}
  2085.   MINIDUMP_THREAD = _MINIDUMP_THREAD;
  2086.   {$EXTERNALSYM MINIDUMP_THREAD}
  2087.   TMinidumpThread = MINIDUMP_THREAD;
  2088.   PMinidumpThread = PMINIDUMP_THREAD;
  2090. //
  2091. // The thread list is a container of threads.
  2092. //
  2094.   PMINIDUMP_THREAD_LIST = ^MINIDUMP_THREAD_LIST;
  2095.   {$EXTERNALSYM PMINIDUMP_THREAD_LIST}
  2096.   _MINIDUMP_THREAD_LIST = record
  2097.     NumberOfThreads: ULONG32;
  2098.     Threads: array [0..0] of MINIDUMP_THREAD;
  2099.   end;
  2100.   {$EXTERNALSYM _MINIDUMP_THREAD_LIST}
  2101.   MINIDUMP_THREAD_LIST = _MINIDUMP_THREAD_LIST;
  2102.   {$EXTERNALSYM MINIDUMP_THREAD_LIST}
  2103.   TMinidumpThreadList = MINIDUMP_THREAD_LIST;
  2104.   PMinidumpThreadList = PMINIDUMP_THREAD_LIST;
  2106.   PMINIDUMP_THREAD_EX = ^MINIDUMP_THREAD_EX;
  2107.   {$EXTERNALSYM PMINIDUMP_THREAD_EX}
  2108.   _MINIDUMP_THREAD_EX = record
  2109.     ThreadId: ULONG32;
  2110.     SuspendCount: ULONG32;
  2111.     PriorityClass: ULONG32;
  2112.     Priority: ULONG32;
  2113.     Teb: ULONG64;
  2114.     Stack: MINIDUMP_MEMORY_DESCRIPTOR;
  2115.     ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
  2116.     BackingStore: MINIDUMP_MEMORY_DESCRIPTOR;
  2117.   end;
  2118.   {$EXTERNALSYM _MINIDUMP_THREAD_EX}
  2119.   MINIDUMP_THREAD_EX = _MINIDUMP_THREAD_EX;
  2120.   {$EXTERNALSYM MINIDUMP_THREAD_EX}
  2121.   TMinidumpThreadEx = MINIDUMP_THREAD_EX;
  2122.   PMinidumpThreadEx = PMINIDUMP_THREAD_EX;
  2124. //
  2125. // The thread list is a container of threads.
  2126. //
  2128.   PMINIDUMP_THREAD_EX_LIST = ^MINIDUMP_THREAD_EX_LIST;
  2129.   {$EXTERNALSYM PMINIDUMP_THREAD_EX_LIST}
  2130.   _MINIDUMP_THREAD_EX_LIST = record
  2131.     NumberOfThreads: ULONG32;
  2132.     Threads: array [0..0] of MINIDUMP_THREAD_EX;
  2133.   end;
  2134.   {$EXTERNALSYM _MINIDUMP_THREAD_EX_LIST}
  2135.   MINIDUMP_THREAD_EX_LIST = _MINIDUMP_THREAD_EX_LIST;
  2136.   {$EXTERNALSYM MINIDUMP_THREAD_EX_LIST}
  2137.   TMinidumpThreadExList = MINIDUMP_THREAD_EX_LIST;
  2138.   PMinidumpThreadExList = PMINIDUMP_THREAD_EX_LIST;
  2141. //
  2142. // The MINIDUMP_EXCEPTION is the same as EXCEPTION on Win64.
  2143. //
  2145.   PMINIDUMP_EXCEPTION = ^MINIDUMP_EXCEPTION;
  2146.   {$EXTERNALSYM PMINIDUMP_EXCEPTION}
  2147.   _MINIDUMP_EXCEPTION = record
  2148.     ExceptionCode: ULONG32;
  2149.     ExceptionFlags: ULONG32;
  2150.     ExceptionRecord: ULONG64;
  2151.     ExceptionAddress: ULONG64;
  2152.     NumberParameters: ULONG32;
  2153.     __unusedAlignment: ULONG32;
  2154.     ExceptionInformation: array [0..EXCEPTION_MAXIMUM_PARAMETERS - 1] of ULONG64;
  2155.   end;
  2156.   {$EXTERNALSYM _MINIDUMP_EXCEPTION}
  2157.   MINIDUMP_EXCEPTION = _MINIDUMP_EXCEPTION;
  2158.   {$EXTERNALSYM MINIDUMP_EXCEPTION}
  2159.   TMinidumpException = MINIDUMP_EXCEPTION;
  2160.   PMinidumpException = PMINIDUMP_EXCEPTION;
  2162. //
  2163. // The exception information stream contains the id of the thread that caused
  2164. // the exception (ThreadId), the exception record for the exception
  2165. // (ExceptionRecord) and an RVA to the thread context where the exception
  2166. // occured.
  2167. //
  2169.   PMINIDUMP_EXCEPTION_STREAM = ^MINIDUMP_EXCEPTION_STREAM;
  2170.   {$EXTERNALSYM PMINIDUMP_EXCEPTION_STREAM}
  2171.   _MINIDUMP_EXCEPTION_STREAM = record
  2172.     ThreadId: ULONG32;
  2173.     __alignment: ULONG32;
  2174.     ExceptionRecord: MINIDUMP_EXCEPTION;
  2175.     ThreadContext: MINIDUMP_LOCATION_DESCRIPTOR;
  2176.   end;
  2177.   {$EXTERNALSYM _MINIDUMP_EXCEPTION_STREAM}
  2178.   MINIDUMP_EXCEPTION_STREAM = _MINIDUMP_EXCEPTION_STREAM;
  2179.   {$EXTERNALSYM MINIDUMP_EXCEPTION_STREAM}
  2180.   TMinidumpExceptionStream = MINIDUMP_EXCEPTION_STREAM;
  2181.   PMinidumpExceptionStream = PMINIDUMP_EXCEPTION_STREAM;
  2183. //
  2184. // The MINIDUMP_MODULE contains information about a
  2185. // a specific module. It includes the CheckSum and
  2186. // the TimeDateStamp for the module so the module
  2187. // can be reloaded during the analysis phase.
  2188. //
  2190.   PMINIDUMP_MODULE = ^MINIDUMP_MODULE;
  2191.   {$EXTERNALSYM PMINIDUMP_MODULE}
  2192.   _MINIDUMP_MODULE = record
  2193.     BaseOfImage: ULONG64;
  2194.     SizeOfImage: ULONG32;
  2195.     CheckSum: ULONG32;
  2196.     TimeDateStamp: ULONG32;
  2197.     ModuleNameRva: RVA;
  2198.     VersionInfo: VS_FIXEDFILEINFO;
  2199.     CvRecord: MINIDUMP_LOCATION_DESCRIPTOR;
  2200.     MiscRecord: MINIDUMP_LOCATION_DESCRIPTOR;
  2201.     Reserved0: ULONG64; // Reserved for future use.
  2202.     Reserved1: ULONG64; // Reserved for future use.
  2203.   end;
  2204.   {$EXTERNALSYM _MINIDUMP_MODULE}
  2205.   MINIDUMP_MODULE = _MINIDUMP_MODULE;
  2206.   {$EXTERNALSYM MINIDUMP_MODULE}
  2207.   TMinidumpModule = MINIDUMP_MODULE;
  2208.   PMinidumpModule = PMINIDUMP_MODULE;
  2210. //
  2211. // The minidump module list is a container for modules.
  2212. //
  2214.   PMINIDUMP_MODULE_LIST = ^MINIDUMP_MODULE_LIST;
  2215.   {$EXTERNALSYM PMINIDUMP_MODULE_LIST}
  2216.   _MINIDUMP_MODULE_LIST = record
  2217.     NumberOfModules: ULONG32;
  2218.     Modules: array [0..0] of MINIDUMP_MODULE;
  2219.   end;
  2220.   {$EXTERNALSYM _MINIDUMP_MODULE_LIST}
  2221.   MINIDUMP_MODULE_LIST = _MINIDUMP_MODULE_LIST;
  2222.   {$EXTERNALSYM MINIDUMP_MODULE_LIST}
  2223.   TMinidumpModuleList = MINIDUMP_MODULE_LIST;
  2224.   PMinidumpModuleList = PMINIDUMP_MODULE_LIST;
  2226. //
  2227. // Memory Ranges
  2228. //
  2230.   PMINIDUMP_MEMORY_LIST = ^MINIDUMP_MEMORY_LIST;
  2231.   {$EXTERNALSYM PMINIDUMP_MEMORY_LIST}
  2232.   _MINIDUMP_MEMORY_LIST = record
  2233.     NumberOfMemoryRanges: ULONG32;
  2234.     MemoryRanges: array [0..0] of MINIDUMP_MEMORY_DESCRIPTOR;
  2235.   end;
  2236.   {$EXTERNALSYM _MINIDUMP_MEMORY_LIST}
  2237.   MINIDUMP_MEMORY_LIST = _MINIDUMP_MEMORY_LIST;
  2238.   {$EXTERNALSYM MINIDUMP_MEMORY_LIST}
  2239.   TMinidumpMemoryList = MINIDUMP_MEMORY_LIST;
  2240.   PMinidumpMemoryList = PMINIDUMP_MEMORY_LIST;
  2242.   PMINIDUMP_MEMORY64_LIST = ^MINIDUMP_MEMORY64_LIST;
  2243.   {$EXTERNALSYM PMINIDUMP_MEMORY64_LIST}
  2244.   _MINIDUMP_MEMORY64_LIST = record
  2245.     NumberOfMemoryRanges: ULONG64;
  2246.     BaseRva: RVA64;
  2247.     MemoryRanges: array [0..0] of MINIDUMP_MEMORY_DESCRIPTOR64;
  2248.   end;
  2249.   {$EXTERNALSYM _MINIDUMP_MEMORY64_LIST}
  2250.   MINIDUMP_MEMORY64_LIST = _MINIDUMP_MEMORY64_LIST;
  2251.   {$EXTERNALSYM MINIDUMP_MEMORY64_LIST}
  2252.   TMinidumpMemory64List = MINIDUMP_MEMORY64_LIST;
  2253.   PMinidumpMemory64List = PMINIDUMP_MEMORY64_LIST;
  2255. //
  2256. // Support for user supplied exception information.
  2257. //
  2259.   PMINIDUMP_EXCEPTION_INFORMATION = ^MINIDUMP_EXCEPTION_INFORMATION;
  2260.   {$EXTERNALSYM PMINIDUMP_EXCEPTION_INFORMATION}
  2261.   _MINIDUMP_EXCEPTION_INFORMATION = record
  2262.     ThreadId: DWORD;
  2263.     ExceptionPointers: PEXCEPTION_POINTERS;
  2264.     ClientPointers: BOOL;
  2265.   end;
  2266.   {$EXTERNALSYM _MINIDUMP_EXCEPTION_INFORMATION}
  2267.   MINIDUMP_EXCEPTION_INFORMATION = _MINIDUMP_EXCEPTION_INFORMATION;
  2268.   {$EXTERNALSYM MINIDUMP_EXCEPTION_INFORMATION}
  2269.   TMinidumpExceptionInformation = MINIDUMP_EXCEPTION_INFORMATION;
  2270.   PMinidumpExceptionInformation = PMINIDUMP_EXCEPTION_INFORMATION;
  2272. //
  2273. // Support for capturing system handle state at the time of the dump.
  2274. //
  2276.   PMINIDUMP_HANDLE_DESCRIPTOR = ^MINIDUMP_HANDLE_DESCRIPTOR;
  2277.   {$EXTERNALSYM PMINIDUMP_HANDLE_DESCRIPTOR}
  2278.   _MINIDUMP_HANDLE_DESCRIPTOR = record
  2279.     Handle: ULONG64;
  2280.     TypeNameRva: RVA;
  2281.     ObjectNameRva: RVA;
  2282.     Attributes: ULONG32;
  2283.     GrantedAccess: ULONG32;
  2284.     HandleCount: ULONG32;
  2285.     PointerCount: ULONG32;
  2286.   end;
  2287.   {$EXTERNALSYM _MINIDUMP_HANDLE_DESCRIPTOR}
  2288.   MINIDUMP_HANDLE_DESCRIPTOR = _MINIDUMP_HANDLE_DESCRIPTOR;
  2289.   {$EXTERNALSYM MINIDUMP_HANDLE_DESCRIPTOR}
  2290.   TMinidumpHandleDescriptor = MINIDUMP_HANDLE_DESCRIPTOR;
  2291.   PMinidumpHandleDescriptor = PMINIDUMP_HANDLE_DESCRIPTOR;
  2293.   PMINIDUMP_HANDLE_DATA_STREAM = ^MINIDUMP_HANDLE_DATA_STREAM;
  2294.   {$EXTERNALSYM PMINIDUMP_HANDLE_DATA_STREAM}
  2295.   _MINIDUMP_HANDLE_DATA_STREAM = record
  2296.     SizeOfHeader: ULONG32;
  2297.     SizeOfDescriptor: ULONG32;
  2298.     NumberOfDescriptors: ULONG32;
  2299.     Reserved: ULONG32;
  2300.   end;
  2301.   {$EXTERNALSYM _MINIDUMP_HANDLE_DATA_STREAM}
  2302.   MINIDUMP_HANDLE_DATA_STREAM = _MINIDUMP_HANDLE_DATA_STREAM;
  2303.   {$EXTERNALSYM MINIDUMP_HANDLE_DATA_STREAM}
  2304.   TMinidumpHandleDataStream = MINIDUMP_HANDLE_DATA_STREAM;
  2305.   PMinidumpHandleDataStream = PMINIDUMP_HANDLE_DATA_STREAM;
  2307. //
  2308. // Support for capturing dynamic function table state at the time of the dump.
  2309. //
  2311.   PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR = ^MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
  2312.   {$EXTERNALSYM PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
  2313.   _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR = record
  2314.     MinimumAddress: ULONG64;
  2315.     MaximumAddress: ULONG64;
  2316.     BaseAddress: ULONG64;
  2317.     EntryCount: ULONG32;
  2318.     SizeOfAlignPad: ULONG32;
  2319.   end;
  2320.   {$EXTERNALSYM _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
  2321.   MINIDUMP_FUNCTION_TABLE_DESCRIPTOR = _MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
  2322.   {$EXTERNALSYM MINIDUMP_FUNCTION_TABLE_DESCRIPTOR}
  2323.   TMinidumpFunctionTableDescriptor = MINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
  2324.   PMinidumpFunctionTableDescriptor = PMINIDUMP_FUNCTION_TABLE_DESCRIPTOR;
  2326.   PMINIDUMP_FUNCTION_TABLE_STREAM = ^MINIDUMP_FUNCTION_TABLE_STREAM;
  2327.   {$EXTERNALSYM PMINIDUMP_FUNCTION_TABLE_STREAM}
  2328.   _MINIDUMP_FUNCTION_TABLE_STREAM = record
  2329.     SizeOfHeader: ULONG32;
  2330.     SizeOfDescriptor: ULONG32;
  2331.     SizeOfNativeDescriptor: ULONG32;
  2332.     SizeOfFunctionEntry: ULONG32;
  2333.     NumberOfDescriptors: ULONG32;
  2334.     SizeOfAlignPad: ULONG32;
  2335.   end;
  2336.   {$EXTERNALSYM _MINIDUMP_FUNCTION_TABLE_STREAM}
  2337.   MINIDUMP_FUNCTION_TABLE_STREAM = _MINIDUMP_FUNCTION_TABLE_STREAM;
  2338.   {$EXTERNALSYM MINIDUMP_FUNCTION_TABLE_STREAM}
  2339.   TMinidumpFunctionTableStream = MINIDUMP_FUNCTION_TABLE_STREAM;
  2340.   PMinidumpFunctionTableStream = PMINIDUMP_FUNCTION_TABLE_STREAM;
  2342. //
  2343. // The MINIDUMP_UNLOADED_MODULE contains information about a
  2344. // a specific module that was previously loaded but no
  2345. // longer is.  This can help with diagnosing problems where
  2346. // callers attempt to call code that is no longer loaded.
  2347. //
  2349.   _MINIDUMP_UNLOADED_MODULE = record
  2350.     BaseOfImage: ULONG64;
  2351.     SizeOfImage: ULONG32;
  2352.     CheckSum: ULONG32;
  2353.     TimeDateStamp: ULONG32;
  2354.     ModuleNameRva: RVA;
  2355.   end;
  2356.   {$EXTERNALSYM _MINIDUMP_UNLOADED_MODULE}
  2357.   MINIDUMP_UNLOADED_MODULE = _MINIDUMP_UNLOADED_MODULE;
  2358.   {$EXTERNALSYM MINIDUMP_UNLOADED_MODULE}
  2359.   PMINIDUMP_UNLOADED_MODULE = ^MINIDUMP_UNLOADED_MODULE;
  2360.   {$EXTERNALSYM PMINIDUMP_UNLOADED_MODULE}
  2361.   TMiniDumpUnloadedModule = MINIDUMP_UNLOADED_MODULE;
  2362.   PMiniDumpUnloadedModule = PMINIDUMP_UNLOADED_MODULE;
  2364. //
  2365. // The minidump unloaded module list is a container for unloaded modules.
  2366. //
  2368.   _MINIDUMP_UNLOADED_MODULE_LIST = record
  2369.     SizeOfHeader: ULONG32;
  2370.     SizeOfEntry: ULONG32;
  2371.     NumberOfEntries: ULONG32;
  2372.   end;
  2373.   {$EXTERNALSYM _MINIDUMP_UNLOADED_MODULE_LIST}
  2374.   MINIDUMP_UNLOADED_MODULE_LIST = _MINIDUMP_UNLOADED_MODULE_LIST;
  2375.   {$EXTERNALSYM MINIDUMP_UNLOADED_MODULE_LIST}
  2376.   PMINIDUMP_UNLOADED_MODULE_LIST = ^MINIDUMP_UNLOADED_MODULE_LIST;
  2377.   {$EXTERNALSYM PMINIDUMP_UNLOADED_MODULE_LIST}
  2378.   TMiniDumpUnloadedModuleList = MINIDUMP_UNLOADED_MODULE_LIST;
  2379.   PMiniDumpUnloadedModuleList = PMINIDUMP_UNLOADED_MODULE_LIST;
  2381. //
  2382. // The miscellaneous information stream contains a variety
  2383. // of small pieces of information.  A member is valid if
  2384. // it's within the available size and its corresponding
  2385. // bit is set.