Правильный размер структур.

[JPCool]

Доброго дня, подскажите где взять 64 битный структуры на любом языке.

Менялись ли они вообще в 64 битной винде может быть что то новое в win 8 -10 кто то сталкивался?



THREAD_BASIC_INFORMATION
SYSTEM_PROCESSES

FILE_DIRECTORY_INFORMATION
FILE_FULL_DIRECTORY_INFORMATION
FILE_ID_BOTH_DIR_INFORMATION
FILE_BOTH_DIRECTORY_INFORMATION
FILE_NAMES_INFORMATION

TImageThunkData32
IMAGE_NT_HEADERS
IMAGE_OPTIONAL_HEADER

type
PClientID = ^TClientID;
TClientID = packed record
 UniqueProcess:cardinal;
 UniqueThread:cardinal;
end;


type
 PTHREAD_BASIC_INFORMATION = ^THREAD_BASIC_INFORMATION;
  THREAD_BASIC_INFORMATION = packed record
  ExitStatus: BOOL;
  TebBaseAddress: pointer;
  ClientId: TClientID;
  AffinityMask: DWORD;
  Priority: dword;
  BasePriority: dword;
 end;



PSYSTEM_PROCESSES = ^SYSTEM_PROCESSES;
SYSTEM_PROCESSES = packed record
   NextEntryDelta,
   ThreadCount: dword;
   Reserved1 : array [0..5] of dword;
   CreateTime,
   UserTime,
   KernelTime: LARGE_INTEGER;
   ProcessName: TUnicodeString;
   BasePriority: dword;
   ProcessId,
   InheritedFromProcessId,
   HandleCount: dword;
   Reserved2: array [0..1] of dword;
   VmCounters: VM_COUNTERS;
   IoCounters: IO_COUNTERS; // Windows 2000 only
   Threads: array [0..0] of SYSTEM_THREADS;
  end;


type
 FILE_DIRECTORY_INFORMATION = packed record
  NextEntryOffset: ULONG;
  Unknown: ULONG;
  CreationTime,
  LastAccessTime,
  LastWriteTime,
  ChangeTime,
  EndOfFile,
  AllocationSize: int64;
  FileAttributes: ULONG;
  FileNameLength: ULONG;
  FileName: PWideChar;
 end;
 PFILE_DIRECTORY_INFORMATION=^FILE_DIRECTORY_INFORMATION;


type
 FILE_FULL_DIRECTORY_INFORMATION = packed record
   NextEntryOffset: ULONG;
   Unknown: ULONG;
   CreationTime,
   LastAccessTime,
   LastWriteTime,
   ChangeTime,
   EndOfFile,
   AllocationSize: int64;
   FileAttributes: ULONG;
   FileNameLength: ULONG;
   EaInformationLength: ULONG;
   FileName: PWideChar;
 end;


type
 FILE_ID_BOTH_DIR_INFORMATION = packed record
  NextEntryOffset: ULONG;
  FileIndex: ULONG;
  CreationTime:int64;
  LastAccessTime:int64;
  LastWriteTime:int64;
  ChangeTime:int64;
  EndOfFile:int64;
  AllocationSize:int64;
  FileAttributes: ULONG;
  FileNameLength: ULONG;
  EaSize: ULONG;
  ShortNameLength:Integer;
  ShortName: array [0..11] of WideChar;
  FileId:int64;
  FileName:WideChar;
  end;
  PFILE_ID_BOTH_DIR_INFORMATION =^FILE_ID_BOTH_DIR_INFORMATION;



type
 FILE_BOTH_DIRECTORY_INFORMATION = packed record
   NextEntryOffset: ULONG;
   Unknown: ULONG;
   CreationTime,
   LastAccessTime,
   LastWriteTime,
   ChangeTime,
   EndOfFile,
   AllocationSize: int64;
   FileAttributes: ULONG;
   FileNameLength: ULONG;
   EaInformationLength: ULONG;
   AlternateNameLength: ULONG;
   AlternateName: array [0..10] of WideChar;
   FileName:WideChar;
 end;
 PFILE_BOTH_DIRECTORY_INFORMATION=^FILE_BOTH_DIRECTORY_INFORMATION;


type
 FILE_NAMES_INFORMATION = packed record
   NextEntryOffset: ULONG;
   Unknown: ULONG;
   FileNameLength: ULONG;
   FileName: PWideChar;
 end;

Type
 PImageThunkData = ^TImageThunkData32;
  TImageThunkData32 = packed record
    _function : PDWORD;
  end;


PImageExportDirectory = ^TImageExportDirectory;
  _IMAGE_EXPORT_DIRECTORY = packed record
      Characteristics: DWord;
      TimeDateStamp: DWord;
      MajorVersion: Word;
      MinorVersion: Word;
      Name: DWord;
      Base: DWord;
      NumberOfFunctions: DWord;
      NumberOfNames: DWord;
      AddressOfFunctions: ^PDWORD;
      AddressOfNames: ^PDWORD;
      AddressOfNameOrdinals: ^PWord;
  end;

[JPCool]

JwaWinNT,JwaWinType,JwaNtStatus

http://sourceforge.net/projects/jedi-apilib/

Тему можно закрыть...

[Sam Gold]

Менялись ли они вообще в 64 битной винде может быть что то новое в win 8 -10 кто то сталкивался?

По сравнению с х86? Менялись конечно.
Самое надежное, имхо, поставить WinDbg, подгрузить символы и посмотреть структуру. Например:

dt ntdll!_IMAGE_NT_HEADERS64
   +0x000 Signature        : Uint4B
   +0x004 FileHeader       : _IMAGE_FILE_HEADER
   +0x018 OptionalHeader   : _IMAGE_OPTIONAL_HEADER64

[waleri]

Самое надежное - это скачать Platform SDK да посмотреть в нем.