|
Crashpad
|
Information about a specific module loaded within the process at the time the snapshot was taken. More...
#include "dbghelp.h"
Public Attributes | |
| uint64_t | BaseOfImage |
| The base address of the loaded module in the address space of the process that the minidump file contains a snapshot of. | |
| uint32_t | SizeOfImage |
| The size of the loaded module. | |
| uint32_t | CheckSum |
The loaded module’s checksum, or 0 if unknown. More... | |
| uint32_t | TimeDateStamp |
The module’s timestamp, in time_t units, seconds since the POSIX epoch, or 0 if unknown. More... | |
| RVA | ModuleNameRva |
| RVA of a MINIDUMP_STRING containing the module’s path or file name. | |
| VS_FIXEDFILEINFO | VersionInfo |
| The module’s version information. | |
| MINIDUMP_LOCATION_DESCRIPTOR | CvRecord |
| A pointer to the module’s CodeView record, typically a link to its debugging information in crashpad::CodeViewRecordPDB70 format. More... | |
| MINIDUMP_LOCATION_DESCRIPTOR | MiscRecord |
| A pointer to the module’s miscellaneous debugging record, a structure of type IMAGE_DEBUG_MISC. More... | |
| uint64_t | Reserved0 |
| uint64_t | Reserved1 |
Information about a specific module loaded within the process at the time the snapshot was taken.
A module may be the main executable, a shared library, or a loadable module.
| uint32_t MINIDUMP_MODULE::CheckSum |
The loaded module’s checksum, or 0 if unknown.
On Windows, this field comes from the CheckSum field of the module’s IMAGE_OPTIONAL_HEADER structure, if present. It reflects the checksum at the time the module was linked.
| MINIDUMP_LOCATION_DESCRIPTOR MINIDUMP_MODULE::CvRecord |
A pointer to the module’s CodeView record, typically a link to its debugging information in crashpad::CodeViewRecordPDB70 format.
The specific format of the CodeView record is indicated by its signature, the first 32-bit value in the structure. For links to debugging information in contemporary usage, this is normally a crashpad::CodeViewRecordPDB70 structure, but may be a crashpad::CodeViewRecordPDB20 structure instead. These structures identify a link to debugging data within a .pdb (Program Database) file. See Matching Debug Information, PDB Files.
On Windows, it is also possible for the CodeView record to contain debugging information itself, as opposed to a link to a .pdb file. See Microsoft Symbol and Type Information, section 7.2, “Debug Information Format” for a list of debug information formats, and Undocumented Windows 2000 Secrets, Windows 2000 Debugging Support/Microsoft Symbol File Internals/CodeView Subsections for an in-depth description of the CodeView 4.1 format. Signatures seen in the wild include “NB09” (0x3930424e) for CodeView 4.1 and “NB11” (0x3131424e) for CodeView 5.0. This form of debugging information within the module, as opposed to a link to an external .pdb file, is chosen by building with /Z7 in Visual Studio 6.0 (1998) and earlier. This embedded form of debugging information is now considered obsolete.
On Windows, the CodeView record is taken from a module’s IMAGE_DEBUG_DIRECTORY entry whose Type field has the value IMAGE_DEBUG_TYPE_CODEVIEW (2), if any. Records in crashpad::CodeViewRecordPDB70 format are generated by Visual Studio .NET (2002) (version 7.0) and later.
When the CodeView record is not present, the fields of this MINIDUMP_LOCATION_DESCRIPTOR will be 0.
| MINIDUMP_LOCATION_DESCRIPTOR MINIDUMP_MODULE::MiscRecord |
A pointer to the module’s miscellaneous debugging record, a structure of type IMAGE_DEBUG_MISC.
This field is Windows-specific, and has no meaning on other operating systems. It is largely obsolete on Windows, where it was used to link to debugging information stored in a .dbg file. .dbg files have been superseded by .pdb files.
On Windows, the miscellaneous debugging record is taken from module’s IMAGE_DEBUG_DIRECTORY entry whose Type field has the value IMAGE_DEBUG_TYPE_MISC (4), if any.
When the miscellaneous debugging record is not present, the fields of this MINIDUMP_LOCATION_DESCRIPTOR will be 0.
| uint32_t MINIDUMP_MODULE::TimeDateStamp |
The module’s timestamp, in time_t units, seconds since the POSIX epoch, or 0 if unknown.
On Windows, this field comes from the TimeDateStamp field of the module’s IMAGE_FILE_HEADER structure. It reflects the timestamp at the time the module was linked.
1.8.18