Search notes:
WinAPI data types and constants
C/C++ managed type Notes (mainly in conjunction with P/Invoke)
VOID
void
System.Void
Applied to a function that does not return a value.
HANDLE
void *
System.IntPtr or System.UIntPtr
32 bits on 32-bit Windows operating systems, 64 bits on 64-bit Windows operating systems.
BYTE
unsigned char
System.Byte
8 bits
SHORT
short
System.Int16
16 bits
WORD
unsigned short
System.UInt16
16 bits
INT
int
System.Int32
32 bits
UINT
unsigned int
System.UInt32
32 bits
LONG
long
System.Int32
32 bits
BOOL
long
System.Boolean or System.Int32
32 bits, see also UnmanagedType .Bool
.
DWORD
unsigned long
System.UInt32
32 bits
ULONG
unsigned long
System.UInt32
32 bits
CHAR
char
System.Char
Decorate with ANSI.
WCHAR
wchar_t
System.Char
Decorate with Unicode.
LPSTR
char *
System.String or System.Text.StringBuilder
Decorate with ANSI.
LPCSTR
const char *
System.String or System.Text.StringBuilder
Decorate with ANSI.
LPWSTR
wchar_t *
System.String or System.Text.StringBuilder
Decorate with Unicode.
LPCWSTR
const wchar_t *
System.String or System.Text.StringBuilder
Decorate with Unicode.
FLOAT
float
System.Single
32 bits
DOUBLE
double
System.Double
64 bits
Inspecting Windows header files
c:\> cl /E include-windows.c > include-windows.preprocessed
Even better is using
gcc :
c:\> gcc -dD -E -H include-windows.c > winclude-windows.E
The following definitions are or were relevant for me at least once.
basetsd.h
basetsd.h
has definitions and typedefs for
basic sized types . It includes new (64 bit?) data-type definitions to make source code word size independent. Examples of such types are
INT_PTR
,
UINT_PTR
,
__int3264
etc.
INT_PTR
and its unsigned cousin UINT_PTR
are defined to be the the same size as a pointer
#ifdef _WIN64
typedef __int64 INT_PTR,*PINT_PTR ;
typedef unsigned __int64 UINT_PTR,*PUINT_PTR ;
typedef __int64 LONG_PTR,*PLONG_PTR ;
typedef unsigned __int64 ULONG_PTR,*PULONG_PTR;
#define __int3264 __int64
#else
typedef int INT_PTR,*PINT_PTR ;
typedef unsigned int UINT_PTR,*PUINT_PTR ;
typedef long LONG_PTR,*PLONG_PTR ;
typedef unsigned long ULONG_PTR,*PULONG_PTR;
#define __int3264 int
#endif
typedef unsigned int UINT_PTR,*PUINT_PTR;
wtypesbase.h
#if !defined(OLE2ANSI) // Apparently, OLE2ANSI is defined nowhere.
typedef WCHAR OLECHAR;
typedef OLECHAR *LPOLESTR;
typedef const OLECHAR *LPCOLESTR;
#define OLESTR(str) L##str
#else
typedef char OLECHAR;
typedef LPSTR LPOLESTR;
typedef LPCSTR LPCOLESTR;
#define OLESTR(str) str
#endif
typedef OLECHAR *BSTR;
oaidl.h
Definitions for interfaces.
This include file seems to be generated by a MIDL compiler.
typedef LONG DISPID;
typedef struct tagDISPPARAMS {
VARIANTARG *rgvarg;
DISPID *rgdispidNamedArgs;
UINT cArgs;
UINT cNamedArgs;
} DISPPARAMS;
typedef struct tagEXCEPINFO {
WORD wCode;
WORD wReserved;
BSTR bstrSource;
BSTR bstrDescription;
BSTR bstrHelpFile;
DWORD dwHelpContext;
PVOID pvReserved;
HRESULT (__attribute__((__stdcall__)) *pfnDeferredFillIn)(struct tagEXCEPINFO *);
SCODE scode;
} EXCEPINFO,*LPEXCEPINFO;
The IDispatchVtbl
struct
and the
IDispatch
interface is defined in this file
typedef struct IDispatchVtbl {
…
} IDispatchVtbl;
interface IDispatch {
CONST_VTBL IDispatchVtbl* lpVtbl;
};
typedef struct tagVARIANT VARIANT;
struct tagVARIANT {
__extension__ union {
__extension__ struct
{
VARTYPE vt;
WORD wReserved1;
WORD wReserved2;
WORD wReserved3;
__extension__ union {
LONGLONG llVal;
LONG lVal;
BYTE bVal;
SHORT iVal;
FLOAT fltVal;
DOUBLE dblVal;
VARIANT_BOOL boolVal;
SCODE scode;
CY cyVal;
DATE date;
BSTR bstrVal;
IUnknown *punkVal;
IDispatch *pdispVal;
SAFEARRAY *parray;
BYTE *pbVal;
SHORT *piVal;
LONG *plVal;
LONGLONG *pllVal;
FLOAT *pfltVal;
DOUBLE *pdblVal;
VARIANT_BOOL *pboolVal;
SCODE *pscode;
CY *pcyVal;
DATE *pdate;
BSTR *pbstrVal;
IUnknown **ppunkVal;
IDispatch **ppdispVal;
SAFEARRAY **pparray;
VARIANT *pvarVal;
PVOID byref;
CHAR cVal;
USHORT uiVal;
ULONG ulVal;
ULONGLONG ullVal;
INT intVal;
UINT uintVal;
DECIMAL *pdecVal;
CHAR *pcVal;
USHORT *puiVal;
ULONG *pulVal;
ULONGLONG *pullVal;
INT *pintVal;
UINT *puintVal;
struct {
PVOID pvRecord;
IRecordInfo *pRecInfo;
} ;
} ;
} ;
DECIMAL decVal;
} ;
};
typedef VARIANT *LPVARIANT;
typedef VARIANT VARIANTARG;
typedef VARIANT *LPVARIANTARG;
winnt.h //
// Basics
//
#ifndef VOID
#define VOID void
typedef char CHAR;
typedef short SHORT;
typedef long LONG;
#if !defined(MIDL_PASS)
typedef int INT;
#endif
#endif
typedef LONG HRESULT;
typedef BYTE BOOLEAN;
typedef char CCHAR;
typedef char CHAR;
typedef wchar_t WCHAR
…
typedef __nullterminated WCHAR *NWPSTR, *LPWSTR, *PWSTR;
typedef __nullterminated CONST PWSTR *PCZPWSTR;
#define STDMETHODCALLTYPE WINAPI
LARGE_INTEGER
LARGE_INTEGER
represents a 64-bit signed integer value. Compare with the (Microsoft extensions?) __int64
and hyper
.
LARGE_INTEGER
is used (among others?) for QueryPerformanceCounter
.
typedef union _LARGE_INTEGER {
struct {
DWORD LowPart;
LONG HighPart;
} DUMMYSTRUCTNAME;
struct {
DWORD LowPart;
LONG HighPart;
} u;
LONGLONG QuadPart;
DECLARE_HANDLE
winnt.h
defines the macro
DECLARE_HANDLE(name)
with which it is possble to create «handle types», such as
HWND
.
The macro depends on the value of STRICT
.
#ifdef STRICT
typedef void *HANDLE;
#define DECLARE_HANDLE(name) struct name##__{int unused;}; typedef struct name##__ *name
#else
typedef PVOID HANDLE;
#define DECLARE_HANDLE(name) typedef HANDLE name
#endif
typedef HANDLE *PHANDLE;
MAKELANGID
#define MAKELANGID(p, s) ((((WORD )(s)) << 10) | (WORD )(p))
#define PRIMARYLANGID(lgid) ((WORD )(lgid) & 0x3ff)
#define SUBLANGID(lgid) ((WORD )(lgid) >> 10)
MAKELCID
#define NLS_VALID_LOCALE_MASK 0x000fffff
#define MAKELCID(lgid, srtid) ((DWORD)((((DWORD)((WORD )(srtid))) << 16) | \
((DWORD)((WORD )(lgid)))))
#define MAKESORTLCID(lgid, srtid, ver) \
((DWORD)((MAKELCID(lgid, srtid)) | \
(((DWORD)((WORD )(ver))) << 20)))
Rtl… definitions
#define RtlMoveMemory(Destination,Source,Length) memmove((Destination),(Source),(Length))
#define RtlCopyMemory(Destination,Source,Length) memcpy ((Destination),(Source),(Length))
#define RtlFillMemory(Destination,Length,Fill) memset ((Destination),(Fill) ,(Length))
#define RtlZeroMemory(Destination,Length) memset ((Destination), 0 ,(Length))
Note, that
RtlCopyMemory
and
RtlFillMemory
are found in
kernel32.dll
, but
RtlMoveMemory
is not.
Not sure if RtlZeroMemory
is in kernel32.dll
.
NT_TIB
typedef struct _NT_TIB {
struct _EXCEPTION_REGISTRATION_RECORD *ExceptionList;
PVOID StackBase;
PVOID StackLimit;
PVOID SubSystemTib;
#if defined(_MSC_EXTENSIONS)
union {
PVOID FiberData;
DWORD Version;
};
#else
PVOID FiberData;
#endif
PVOID ArbitraryUserPointer;
struct _NT_TIB *Self;
} NT_TIB;
typedef NT_TIB *PNT_TIB;
SID typedef struct _SID {
BYTE Revision;
BYTE SubAuthorityCount;
SID_IDENTIFIER_AUTHORITY IdentifierAuthority;
DWORD SubAuthority[ANYSIZE_ARRAY];
} SID, *PISID;
Privileges
winnt.h
also defines the possible
privileges . These definitions start with
SE_
and expand to strings, like so:
#define SE_CREATE_TOKEN_NAME TEXT ("SeCreateTokenPrivilege")
#define SE_ASSIGNPRIMARYTOKEN_NAME TEXT("SeAssignPrimaryTokenPrivilege")
#define SE_LOCK_MEMORY_NAME TEXT("SeLockMemoryPrivilege")
… etc …
windef.h
Windows data types
windef.h
defines the Windows(?) data types:
typedef unsigned long DWORD;
typedef int BOOL;
typedef unsigned char BYTE;
typedef unsigned short WORD;
typedef float FLOAT;
typedef FLOAT *PFLOAT;
typedef BOOL *PBOOL;
typedef BOOL *LPBOOL;
typedef BYTE *PBYTE;
typedef BYTE *LPBYTE;
typedef int *PINT;
typedef int *LPINT;
typedef WORD *PWORD;
typedef WORD *LPWORD;
typedef long *LPLONG;
typedef DWORD *PDWORD;
typedef DWORD *LPDWORD;
typedef void *LPVOID;
typedef const void *LPCVOID;
typedef int INT;
typedef unsigned int UINT;
typedef unsigned int *PUINT;
typedef WORD ATOM;
typedef DWORD COLORREF;
TODO
/* Types use for passing & returning polymorphic values */
typedef UINT_PTR WPARAM;
typedef LONG_PTR LPARAM;
typedef LONG_PTR LRESULT;
WINAPI
Most (if not all)
WinAPI functions use the
stdcall calling conventions. The macro
WINAPI
reflects that.
#define CALLBACK __stdcall
#define WINAPI __stdcall
HWND
DECLARE_HANDLE (HWND);
This results (if STRICT
is enabled) in
struct HWND__{int unused;}; typedef struct HWND__ *HWND;
More handles
Similarly to HWND
, more handles, as follows, are created:
struct HACCEL__ { int unused; }; typedef struct HACCEL__ *HACCEL;
struct HBITMAP__ { int unused; }; typedef struct HBITMAP__ *HBITMAP;
struct HBRUSH__ { int unused; }; typedef struct HBRUSH__ *HBRUSH;
struct HCOLORSPACE__ { int unused; }; typedef struct HCOLORSPACE__ *HCOLORSPACE;
struct HDC__ { int unused; }; typedef struct HDC__ *HDC;
struct HGLRC__ { int unused; }; typedef struct HGLRC__ *HGLRC;
struct HDESK__ { int unused; }; typedef struct HDESK__ *HDESK;
struct HENHMETAFILE__ { int unused; }; typedef struct HENHMETAFILE__ *HENHMETAFILE;
struct HFONT__ { int unused; }; typedef struct HFONT__ *HFONT;
struct HICON__ { int unused; }; typedef struct HICON__ *HICON;
struct HMENU__ { int unused; }; typedef struct HMENU__ *HMENU;
struct HMETAFILE__ { int unused; }; typedef struct HMETAFILE__ *HMETAFILE;
struct HINSTANCE__ { int unused; }; typedef struct HINSTANCE__ *HINSTANCE;
typedef HINSTANCE HMODULE;
struct HPALETTE__ { int unused; }; typedef struct HPALETTE__ *HPALETTE;
struct HPEN__ { int unused; }; typedef struct HPEN__ *HPEN;
struct HRGN__ { int unused; }; typedef struct HRGN__ *HRGN;
struct HRSRC__ { int unused; }; typedef struct HRSRC__ *HRSRC;
struct HSTR__ { int unused; }; typedef struct HSTR__ *HSTR;
struct HTASK__ { int unused; }; typedef struct HTASK__ *HTASK;
struct HWINSTA__ { int unused; }; typedef struct HWINSTA__ *HWINSTA;
struct HKL__ { int unused; }; typedef struct HKL__ *HKL;
struct HMONITOR__ { int unused; }; typedef struct HMONITOR__ *HMONITOR;
struct HWINEVENTHOOK__ { int unused; }; typedef struct HWINEVENTHOOK__ *HWINEVENTHOOK;
struct HUMPD__ { int unused; }; typedef struct HUMPD__ *HUMPD;
WinBase.h
The declaration of WinMain
is found in WinBase.h
. The actual declaration is more complicated than shown here because it is also dependent on if it is compiled on a Mac environment or with _M_CEE_PURE
.
WinMain (
HINSTANCE hInstance ,
HINSTANCE hPrevInstance,
LPSTR lpCmdLine ,
int nShowCmd
);
wWinMain(
HINSTANCE hInstance ,
HINSTANCE hPrevInstance,
LPWSTR lpCmdLine ,
int nShowCmd
);
Definitions of xxxMemory macros
WinBase.h
creates the following four macros to redirect memory related »functions« to Rtl… counterparts.
Interestingly, in
winnt.h
, the Rtl… strings are further
redirected to
memcmp
,
memmove
,
memcpy
and
memset
.
#define MoveMemory RtlMoveMemory
#define CopyMemory RtlCopyMemory
#define FillMemory RtlFillMemory
#define ZeroMemory RtlZeroMemory
guiddef.h
typedef struct _GUID {
unsigned long Data1;
unsigned short Data2;
unsigned short Data3;
unsigned char Data4[ 8 ];
} GUID;
GUID
, IID
and CLSID
are essentially the same thing!
typedef GUID IID;
typedef GUID CLSID;
typedef IID *LPIID;
typedef CLSID *LPCLSID;
#define IID_NULL GUID_NULL
#define CLSID_NULL GUID_NULL
#define IsEqualIID (riid1 , riid2 ) IsEqualGUID(riid1 , riid2 )
#define IsEqualCLSID(rclsid1, rclsid2) IsEqualGUID(rclsid1, rclsid2)
#ifdef __midl_proxy
#define __MIDL_CONST
#else
#define __MIDL_CONST const
#endif
#ifdef __cplusplus
#define REFGUID const GUID &
#define REFIID const IID &
#define REFCLSID const IID &
#define REFFMTID const IID &
#else
#define REFGUID const GUID * __MIDL_CONST
#define REFIID const IID * __MIDL_CONST
#define REFCLSID const IID * __MIDL_CONST
#define REFFMTID const IID * __MIDL_CONST
#endif
DEFINE_OLEGUID
guiddef.h
also defines the macro DEFINE_OLEGUID
.
#define DEFINE_OLEGUID(name, l, w1, w2) DEFINE_GUID(name, l, w1, w2, 0xC0,0,0,0,0,0,0,0x46)
This definition seems to indicate that the guids that end in C0 00 00 00 00 00 46
are OLE Guids.
RpcDce.h typedef GUID UUID;
cguid.h extern const IID GUID_NULL;
objbase.h
Component object model definitions.
interface
is just a fancy term for an ordinary struct
:
#if defined(__cplusplus) && !defined(CINTERFACE)
#define __STRUCT__ struct
#define interface __STRUCT__
#else
#define interface struct
#endif
unknwn.h
unknwn.h
defines the c
struct
for
IUnknown .
#if defined(__cplusplus) && !defined(CINTERFACE)
#else
typedef struct IUnknownVtbl
{
BEGIN_INTERFACE
HRESULT ( STDMETHODCALLTYPE *QueryInterface )(
IUnknown * This,
/* [in] */ REFIID riid,
/* [annotation][iid_is][out] */
__RPC__deref_out void **ppvObject);
ULONG ( STDMETHODCALLTYPE *AddRef )(
IUnknown * This);
ULONG ( STDMETHODCALLTYPE *Release )(
IUnknown * This);
END_INTERFACE
} IUnknownVtbl;
interface IUnknown
{
CONST_VTBL struct IUnknownVtbl *lpVtbl;
};
#endif
oleauto.h
Constants for the 5th (including this
) argument in IDispatch->pVtbl->Invoke
(wFlags
)
#define DISPATCH_METHOD 0x1
#define DISPATCH_PROPERTYGET 0x2
#define DISPATCH_PROPERTYPUT 0x4
#define DISPATCH_PROPERTYPUTREF 0x8
minwindef.h
A prominent example of a function that returns a FARPROC
is GetProcAddress()
.
#ifdef _WIN64
typedef INT_PTR (WINAPI *FARPROC ) ();
typedef INT_PTR (WINAPI *NEARPROC) ();
typedef INT_PTR (WINAPI *PROC ) ();
#else
typedef int (WINAPI *FARPROC ) ();
typedef int (WINAPI *NEARPROC) ();
typedef int (WINAPI *PROC ) ();
#endif
winnls.h #define CP_ACP 0
#define CP_OEMCP 1
#define CP_MACCP 2
#define CP_THREAD_ACP 3
#define CP_SYMBOL 42
#define CP_UTF8 65001
…
#define CTRY_DEFAULT 0
#define CTRY_SWITZERLAND 41
…
#define CAL_GREGORIAN 1
#define CAL_GREGORIAN_US 2
WinError.h
WinError.h
contains the error code definitions :
#define ERROR_SUCCESS 0L
#define ERROR_INVALID_FUNCTION 1L // dderror
#define ERROR_FILE_NOT_FOUND 2L
… etc …
shtypes.h
shtypes.h
is generated by the MIDL compiler.
SHITEMID
All objects that are visible in the
Shell (files, directories, servers, workgroups etc) are identified by an identifier that is unique within their parent parent folder.
These identifiers are associated with the SHITEMID
data type. A SHITEMID
represents a node or an item (think folder or file) in the Shell namespace.
A SHITEMID
is a variable length byte stream. The first two bytes in a SHITEMID
store the stream's length.
typedef struct _SHITEMID {
USHORT cb;
BYTE abID[1];
} SHITEMID;
ITEMIDLIST
An ITEMIDLIST
is an ordererd list of SHITEMID
, each separated from the next by two zero bytes, and serves as the functional equivalent of a file-system path in the Shell namesace.
typedef struct _ITEMIDLIST {
SHITEMID mkid;
} ITEMIDLIST;
TODO
NTAPI
Somehwere, NTAPI
seems to be defined to __stdcall__
.
IMAGE_DATA_DIRECTORY (winnt.h) typedef struct _IMAGE_DATA_DIRECTORY {
DWORD VirtualAddress;
DWORD Size;
} IMAGE_DATA_DIRECTORY,*PIMAGE_DATA_DIRECTORY;
IMAGE_OPTIONAL_HEADER #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
typedef struct _IMAGE_OPTIONAL_HEADER {
…
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
typedef struct _IMAGE_OPTIONAL_HEADER64 {
…
IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
#ifdef _WIN64
typedef IMAGE_OPTIONAL_HEADER64 IMAGE_OPTIONAL_HEADER;
typedef PIMAGE_OPTIONAL_HEADER64 PIMAGE_OPTIONAL_HEADER;
#define IMAGE_SIZEOF_NT_OPTIONAL_HEADER IMAGE_SIZEOF_NT_OPTIONAL64_HEADER
#define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR64_MAGIC
#else
typedef IMAGE_OPTIONAL_HEADER32 IMAGE_OPTIONAL_HEADER;
typedef PIMAGE_OPTIONAL_HEADER32 PIMAGE_OPTIONAL_HEADER;
#define IMAGE_SIZEOF_NT_OPTIONAL_HEADER IMAGE_SIZEOF_NT_OPTIONAL32_HEADER
#define IMAGE_NT_OPTIONAL_HDR_MAGIC IMAGE_NT_OPTIONAL_HDR32_MAGIC
#endif
IMAGE_FILE_HEADER (winnt.h) typedef struct _IMAGE_FILE_HEADER {
WORD Machine;
WORD NumberOfSections;
DWORD TimeDateStamp;
DWORD PointerToSymbolTable;
DWORD NumberOfSymbols;
WORD SizeOfOptionalHeader;
WORD Characteristics;
} IMAGE_FILE_HEADER,*PIMAGE_FILE_HEADER;
IMAGE_NT_HEADERS (winnt.h) typedef struct _IMAGE_NT_HEADERS64 {
DWORD Signature;
IMAGE_FILE_HEADER FileHeader;
IMAGE_OPTIONAL_HEADER64 OptionalHeader;
} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;
typedef struct _IMAGE_NT_HEADERS {
DWORD Signature;
IMAGE_FILE_HEADER FileHeader;
IMAGE_OPTIONAL_HEADER32 OptionalHeader;
} IMAGE_NT_HEADERS32, *PIMAGE_NT_HEADERS32;
#ifdef _WIN64
typedef IMAGE_NT_HEADERS64 IMAGE_NT_HEADERS;
typedef PIMAGE_NT_HEADERS64 PIMAGE_NT_HEADERS;
#else
typedef IMAGE_NT_HEADERS32 IMAGE_NT_HEADERS;
typedef PIMAGE_NT_HEADERS32 PIMAGE_NT_HEADERS;
#endif
LOADED_IMAGE (via imagehlp.h)
The structure that can be obtained by MapAndLoad
.
typedef struct _LOADED_IMAGE {
PSTR ModuleName;
HANDLE hFile;
PUCHAR MappedAddress;
#ifdef _IMAGEHLP64
PIMAGE_NT_HEADERS64 FileHeader;
#else
PIMAGE_NT_HEADERS32 FileHeader;
#endif
PIMAGE_SECTION_HEADER LastRvaSection;
ULONG NumberOfSections;
PIMAGE_SECTION_HEADER Sections;
ULONG Characteristics;
BOOLEAN fSystemImage;
BOOLEAN fDOSImage;
BOOLEAN fReadOnly;
UCHAR Version;
LIST_ENTRY Links;
ULONG SizeOfImage;
} LOADED_IMAGE, *PLOADED_IMAGE;
EXCEPTION_POINTERS
The EXCEPTION_POINTERS
struct contains a machine independent description of an exception in ExceptionRecord
and a machine dependent description of the processor state when the exception occurred.
typedef struct _EXCEPTION_POINTERS {
PEXCEPTION_REOCRD ExceptionRecord;
PCONTEXT ContextRecord;
} EXCEPTION_POINTERS;