ImageHlp工具集

/*++ BUILD Version: 0000 Increment this if a change has global effects Copyright (c) Microsoft Corporation. All rights reserved. Module Name: imagehlp.h Abstract: This module defines the prototypes and constants required for the image help routines. Revision History: --*/ #ifndef _IMAGEHLP_ #define _IMAGEHLP_ #if _MSC_VER > 1020 #pragma once #endif #include <winapifamily.h> #pragma region Desktop Family #if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_DESKTOP) // As a general principal always call the 64 bit version // of every API, if a choice exists. The 64 bit version // works great on 32 bit platforms, and is forward // compatible to 64 bit platforms. #ifdef _WIN64 #ifndef _IMAGEHLP64 #define _IMAGEHLP64 #endif #endif #include <pshpack8.h> #ifndef WINTRUST_H #include <wintrust.h> #endif #ifdef __cplusplus extern "C" { #endif #ifdef _IMAGEHLP_SOURCE_ #define IMAGEAPI __stdcall #define DBHLP_DEPRECIATED #else #define IMAGEAPI DECLSPEC_IMPORT __stdcall #if (_MSC_VER >= 1300) && !defined(MIDL_PASS) #define DBHLP_DEPRECIATED __declspec(deprecated) #else #define DBHLP_DEPRECIATED #endif #endif #define DBHLPAPI IMAGEAPI #define IMAGE_SEPARATION (64*1024) // Observant readers may notice that 2 new fields, // 'fReadOnly' and 'Version' have been added to // the LOADED_IMAGE structure after 'fDOSImage'. // This does not change the size of the structure // from previous headers. That is because while // 'fDOSImage' is a byte, it is padded by the // compiler to 4 bytes. So the 2 new fields are // slipped into the extra space. typedef struct _LOADED_IMAGE { PSTR ModuleName; HANDLE hFile; PUCHAR MappedAddress; #ifdef _IMAGEHLP64 PIMAGE_NT_HEADERS64 FileHeader; #else PIMAGE_NT_HEADERS32 FileHeader; #endif PIMAGE_SECTION_HEADER LastRvaSection; ULONG NumberOfSections; PIMAGE_SECTION_HEADER Sections; ULONG Characteristics; BOOLEAN fSystemImage; BOOLEAN fDOSImage; BOOLEAN fReadOnly; UCHAR Version; LIST_ENTRY Links; ULONG SizeOfImage; } LOADED_IMAGE, *PLOADED_IMAGE; #define MAX_SYM_NAME 2000 BOOL IMAGEAPI BindImage( _In_ PCSTR ImageName, _In_ PCSTR DllPath, _In_ PCSTR SymbolPath ); typedef enum _IMAGEHLP_STATUS_REASON { BindOutOfMemory, BindRvaToVaFailed, BindNoRoomInImage, BindImportModuleFailed, BindImportProcedureFailed, BindImportModule, BindImportProcedure, BindForwarder, BindForwarderNOT, BindImageModified, BindExpandFileHeaders, BindImageComplete, BindMismatchedSymbols, BindSymbolsNotUpdated, BindImportProcedure32, BindImportProcedure64, BindForwarder32, BindForwarder64, BindForwarderNOT32, BindForwarderNOT64 } IMAGEHLP_STATUS_REASON; typedef BOOL (__stdcall *PIMAGEHLP_STATUS_ROUTINE)( _In_ IMAGEHLP_STATUS_REASON Reason, _In_ PCSTR ImageName, _In_ PCSTR DllName, _In_ ULONG_PTR Va, _In_ ULONG_PTR Parameter ); typedef BOOL (__stdcall *PIMAGEHLP_STATUS_ROUTINE32)( _In_ IMAGEHLP_STATUS_REASON Reason, _In_ PCSTR ImageName, _In_ PCSTR DllName, _In_ ULONG Va, _In_ ULONG_PTR Parameter ); typedef BOOL (__stdcall *PIMAGEHLP_STATUS_ROUTINE64)( _In_ IMAGEHLP_STATUS_REASON Reason, _In_ PCSTR ImageName, _In_ PCSTR DllName, _In_ ULONG64 Va, _In_ ULONG_PTR Parameter ); BOOL IMAGEAPI BindImageEx( _In_ DWORD Flags, _In_ PCSTR ImageName, _In_ PCSTR DllPath, _In_ PCSTR SymbolPath, _In_opt_ PIMAGEHLP_STATUS_ROUTINE StatusRoutine ); #define BIND_NO_BOUND_IMPORTS 0x00000001 #define BIND_NO_UPDATE 0x00000002 #define BIND_ALL_IMAGES 0x00000004 #define BIND_CACHE_IMPORT_DLLS 0x00000008 // Cache dll's across // calls to BindImageEx // (same as NT 3.1->NT 4.0) #define BIND_REPORT_64BIT_VA 0x00000010 BOOL IMAGEAPI ReBaseImage( _In_ PCSTR CurrentImageName, _In_ PCSTR SymbolPath, _In_ BOOL fReBase, // TRUE if actually rebasing, false if only summing _In_ BOOL fRebaseSysfileOk, // TRUE is system images s/b rebased _In_ BOOL fGoingDown, // TRUE if the image s/b rebased below the given base _In_ ULONG CheckImageSize, // Max size allowed (0 if don't care) _Out_ ULONG *OldImageSize, // Returned from the header _Out_ ULONG_PTR *OldImageBase, // Returned from the header _Out_ ULONG *NewImageSize, // Image size rounded to next separation boundary _Inout_ ULONG_PTR *NewImageBase, // (in) Desired new address. // (out) Next address (actual if going down) _In_ ULONG TimeStamp // new timestamp for image, if non-zero ); BOOL IMAGEAPI ReBaseImage64( _In_ PCSTR CurrentImageName, _In_ PCSTR SymbolPath, _In_ BOOL fReBase, // TRUE if actually rebasing, false if only summing _In_ BOOL fRebaseSysfileOk, // TRUE is system images s/b rebased _In_ BOOL fGoingDown, // TRUE if the image s/b rebased below the given base _In_ ULONG CheckImageSize, // Max size allowed (0 if don't care) _Out_ ULONG *OldImageSize, // Returned from the header _Out_ ULONG64 *OldImageBase, // Returned from the header _Out_ ULONG *NewImageSize, // Image size rounded to next separation boundary _Inout_ ULONG64 *NewImageBase, // (in) Desired new address. // (out) Next address (actual if going down) _In_ ULONG TimeStamp // new timestamp for image, if non-zero ); // // Define checksum return codes. // #define CHECKSUM_SUCCESS 0 #define CHECKSUM_OPEN_FAILURE 1 #define CHECKSUM_MAP_FAILURE 2 #define CHECKSUM_MAPVIEW_FAILURE 3 #define CHECKSUM_UNICODE_FAILURE 4 // Define Splitsym flags. #define SPLITSYM_REMOVE_PRIVATE 0x00000001 // Remove CV types/symbols and Fixup debug // Used for creating .dbg files that ship // as part of the product. #define SPLITSYM_EXTRACT_ALL 0x00000002 // Extract all debug info from image. // Normally, FPO is left in the image // to allow stack traces through the code. // Using this switch is similar to linking // with -debug:none except the .dbg file // exists... #define SPLITSYM_SYMBOLPATH_IS_SRC 0x00000004 // The SymbolFilePath contains an alternate // path to locate the pdb. // // Define checksum function prototypes. // PIMAGE_NT_HEADERS IMAGEAPI CheckSumMappedFile ( _In_ PVOID BaseAddress, _In_ DWORD FileLength, _Out_ PDWORD HeaderSum, _Out_ PDWORD CheckSum ); DWORD IMAGEAPI MapFileAndCheckSumA ( _In_ PCSTR Filename, _Out_ PDWORD HeaderSum, _Out_ PDWORD CheckSum ); DWORD IMAGEAPI MapFileAndCheckSumW ( _In_ PCWSTR Filename, _Out_ PDWORD HeaderSum, _Out_ PDWORD CheckSum ); #ifdef UNICODE #define MapFileAndCheckSum MapFileAndCheckSumW #else #define MapFileAndCheckSum MapFileAndCheckSumA #endif // !UNICODE BOOL IMAGEA