#[repr(C)]pub struct Header64 {Show 30 fields
pub signature: u32,
pub valid_dump: u32,
pub major_version: u32,
pub minor_version: u32,
pub directory_table_base: u64,
pub pfn_database: u64,
pub ps_loaded_module_list: u64,
pub ps_active_process_head: u64,
pub machine_image_type: u32,
pub number_processors: u32,
pub bug_check_code: u32,
pub bug_check_code_parameters: [u64; 4],
pub version_user: [u8; 32],
pub kd_debugger_data_block: u64,
pub physical_memory_block_buffer: [u8; 700],
pub context_record_buffer: [u8; 3000],
pub exception: ExceptionRecord64,
pub dump_type: u32,
pub required_dump_space: i64,
pub system_time: i64,
pub comment: [u8; 128],
pub system_up_time: i64,
pub minidump_fields: u32,
pub secondary_data_state: u32,
pub product_type: u32,
pub suite_mask: u32,
pub writer_status: u32,
pub kd_secondary_version: u8,
pub attributes: u32,
pub boot_id: u32,
/* private fields */
}
Expand description
Adjusted C struct for DUMP_HEADERS64
from MS Rust docs. Padding
adjustment added from reversing nt!IoFillDumpHeader
.
Fields§
§signature: u32
§valid_dump: u32
§major_version: u32
§minor_version: u32
§directory_table_base: u64
§pfn_database: u64
§ps_loaded_module_list: u64
§ps_active_process_head: u64
§machine_image_type: u32
§number_processors: u32
§bug_check_code: u32
§bug_check_code_parameters: [u64; 4]
§version_user: [u8; 32]
§kd_debugger_data_block: u64
§physical_memory_block_buffer: [u8; 700]
§context_record_buffer: [u8; 3000]
§exception: ExceptionRecord64
§dump_type: u32
§required_dump_space: i64
§system_time: i64
§comment: [u8; 128]
§system_up_time: i64
§minidump_fields: u32
§secondary_data_state: u32
§product_type: u32
§suite_mask: u32
§writer_status: u32
§kd_secondary_version: u8
§attributes: u32
§boot_id: u32
Trait Implementations§
Auto Trait Implementations§
impl Freeze for Header64
impl RefUnwindSafe for Header64
impl Send for Header64
impl Sync for Header64
impl Unpin for Header64
impl UnwindSafe for Header64
Blanket Implementations§
Source§impl<T> BorrowMut<T> for Twhere
T: ?Sized,
impl<T> BorrowMut<T> for Twhere
T: ?Sized,
Source§fn borrow_mut(&mut self) -> &mut T
fn borrow_mut(&mut self) -> &mut T
Mutably borrows from an owned value. Read more