You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
2044 lines
59 KiB
2044 lines
59 KiB
/*++
|
|
|
|
Copyright (c) 1996 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
tlhelp32.c
|
|
|
|
Abstract:
|
|
|
|
NT implementation of win95 ToolHelp API's
|
|
|
|
Author:
|
|
|
|
John Daly
|
|
|
|
Environment:
|
|
|
|
NT Only
|
|
|
|
Notes:
|
|
|
|
Version 1.0
|
|
structure definitions/documentation in tlhelp32.h
|
|
|
|
|
|
Revision History:
|
|
|
|
John Daly (johndaly) 5-Apr-1996
|
|
initial implementation
|
|
|
|
--*/
|
|
|
|
#include "basedll.h"
|
|
#pragma hdrstop
|
|
|
|
#include "tlhelp32.h"
|
|
|
|
#define BUFFER_SIZE 64*1024
|
|
#define ARRAYSIZE(x) (sizeof(x) / sizeof(x[0]))
|
|
|
|
/*
|
|
snapshot structure
|
|
|
|
This is mapped onto the beginning of the memory we use to hold the information.
|
|
|
|
*/
|
|
typedef struct tagSNAPSHOTSTATE {
|
|
/* item list counts */
|
|
ULONG HeapListCount;
|
|
ULONG ProcessCount;
|
|
ULONG ModuleCount;
|
|
ULONG ThreadCount;
|
|
/* item list head pointers */
|
|
PHEAPLIST32 HeapListHead;
|
|
PPROCESSENTRY32W ProcessListHead;
|
|
PMODULEENTRY32W ModuleListHead;
|
|
PTHREADENTRY32 ThreadListHead;
|
|
/* item list current indexes */
|
|
ULONG HeapListIndex;
|
|
ULONG ProcessListIndex;
|
|
ULONG ModuleListIndex;
|
|
ULONG ThreadListIndex;
|
|
/* data begins here... */
|
|
UCHAR DataBegin;
|
|
}SNAPSHOTSTATE;
|
|
typedef SNAPSHOTSTATE * PSNAPSHOTSTATE;
|
|
|
|
|
|
//
|
|
// private functions
|
|
//
|
|
|
|
NTSTATUS
|
|
ThpCreateRawSnap(
|
|
IN ULONG dwFlags,
|
|
IN ULONG th32ProcessID,
|
|
PUCHAR *RawProcess,
|
|
PRTL_DEBUG_INFORMATION *RawModule,
|
|
PRTL_DEBUG_INFORMATION *RawDebugInfo);
|
|
|
|
NTSTATUS
|
|
ThpAllocateSnapshotSection(
|
|
OUT PHANDLE SnapSection,
|
|
IN DWORD dwFlags,
|
|
IN DWORD th32ProcessID,
|
|
PUCHAR RawProcess,
|
|
PRTL_DEBUG_INFORMATION RawModule,
|
|
PRTL_DEBUG_INFORMATION RawDebugInfo);
|
|
|
|
NTSTATUS
|
|
ThpProcessToSnap(
|
|
IN DWORD dwFlags,
|
|
IN DWORD th32ProcessID,
|
|
IN HANDLE SnapSection,
|
|
PUCHAR RawProcess,
|
|
PRTL_DEBUG_INFORMATION RawModule,
|
|
PRTL_DEBUG_INFORMATION RawDebugInfo);
|
|
|
|
HANDLE
|
|
WINAPI
|
|
CreateToolhelp32Snapshot(
|
|
IN DWORD dwFlags,
|
|
IN DWORD th32ProcessID)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Takes a snapshot of the Win32 processes, heaps, modules, and threads used
|
|
by the Win32 processes. Returns an open handle to the specified snapshot if
|
|
successful or -1 otherwise.
|
|
|
|
NOTE that all of the snapshots are global except for the heap and module
|
|
lists which are process specific. To enumerate the heap or module state for
|
|
all WIN32 processes call with TH32CS_SNAPALL and the current process. Then
|
|
for each process in the TH32CS_SNAPPROCESS list that isn't the current
|
|
process, do a call with just TH32CS_SNAPHEAPLIST and/or TH32CS_SNAPMODULE.
|
|
|
|
Use CloseHandle to destroy the snapshot
|
|
|
|
This function is not multi-thread safe. All of the other functions are.
|
|
|
|
Arguments:
|
|
|
|
dwFlags - Supplies switches to specify action as follows:
|
|
TH32CS_INHERIT Indicates that the snapshot handle is to be inheritable.
|
|
TH32CS_SNAPALL Equivalent to specifying the TH32CS_SNAPHEAPLIST,
|
|
TH32CS_SNAPMODULE, TH32CS_SNAPPROCESS, and
|
|
TH32CS_SNAPTHREAD values.
|
|
TH32CS_SNAPHEAPLIST Includes the heap list of the specified Win32
|
|
process in the snapshot.
|
|
TH32CS_SNAPMODULE Includes the module list of the specified Win32
|
|
process in the snapshot.
|
|
TH32CS_SNAPPROCESS Includes the Win32 process list in the snapshot.
|
|
TH32CS_SNAPTHREAD Includes the Win32 thread list in the snapshot.
|
|
|
|
th32ProcessID - Supplies a Win32 process identifier. This parameter can be
|
|
zero to indicate the current process. This parameter is used when the
|
|
TH32CS_SNAPHEAPLIST or TH32CS_SNAPMODULE value is specified. Otherwise,
|
|
it is ignored. The snapshot taken by this function is examined by the
|
|
other tool help functions to provide their results. Access to the
|
|
snapshot is read only. The snapshot handle acts like a Win32 object
|
|
handle and is subject to the same rules regarding which processes and
|
|
threads it is valid in.
|
|
|
|
Return Value:
|
|
|
|
Returns an open handle to the specified snapshot if successful or -1 if not.
|
|
To retrieve an extended error status code generated by this function, use
|
|
the GetLastError function.
|
|
To destroy the snapshot, use the CloseHandle function.
|
|
|
|
--*/
|
|
{
|
|
HANDLE SnapSection;
|
|
PUCHAR RawProcess;
|
|
PRTL_DEBUG_INFORMATION RawModule;
|
|
PRTL_DEBUG_INFORMATION RawDebugInfo;
|
|
NTSTATUS Status = 0;
|
|
|
|
if (th32ProcessID == 0) {
|
|
th32ProcessID = GetCurrentProcessId();
|
|
}
|
|
|
|
//
|
|
// process the requested data types
|
|
//
|
|
|
|
Status = ThpCreateRawSnap(dwFlags,
|
|
th32ProcessID,
|
|
&RawProcess,
|
|
&RawModule,
|
|
&RawDebugInfo);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
BaseSetLastNTError(Status);
|
|
return (HANDLE)-1;
|
|
}
|
|
|
|
Status = ThpAllocateSnapshotSection(&SnapSection,
|
|
dwFlags,
|
|
th32ProcessID,
|
|
RawProcess,
|
|
RawModule,
|
|
RawDebugInfo);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
BaseSetLastNTError(Status);
|
|
return (HANDLE)-1;
|
|
}
|
|
|
|
Status = ThpProcessToSnap(dwFlags,
|
|
th32ProcessID,
|
|
SnapSection,
|
|
RawProcess,
|
|
RawModule,
|
|
RawDebugInfo);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
CloseHandle(SnapSection);
|
|
BaseSetLastNTError(Status);
|
|
return (HANDLE)-1;
|
|
}
|
|
|
|
return SnapSection;
|
|
}
|
|
|
|
|
|
BOOL
|
|
WINAPI
|
|
Heap32ListFirst(
|
|
IN HANDLE SnapSection,
|
|
IN OUT LPHEAPLIST32 lphl)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Retrieves information about the first heap that has been allocated by a
|
|
specified Win32 process.
|
|
|
|
Arguments:
|
|
|
|
SnapSection - Supplies the handle of the snapshot returned from a previous
|
|
call to the CreateToolhelp32Snapshot function.
|
|
|
|
lphl - Returns a HEAPLIST32 structure. The calling application must set
|
|
the dwSize member of HEAPLIST32 to the size, in bytes, of the structure.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if the first entry of the heap list has been copied to the buffer
|
|
or FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the
|
|
GetLastError function when no heap list exists or the snapshot does not contain
|
|
heap list information.
|
|
|
|
--*/
|
|
{
|
|
PSNAPSHOTSTATE SnapshotBase;
|
|
LARGE_INTEGER SectionOffset;
|
|
SIZE_T ViewSize;
|
|
NTSTATUS Status = 0;
|
|
BOOL retv = FALSE;
|
|
|
|
if (!lphl || lphl->dwSize != sizeof(HEAPLIST32)) {
|
|
BaseSetLastNTError(STATUS_INFO_LENGTH_MISMATCH);
|
|
return FALSE;
|
|
}
|
|
|
|
SectionOffset.LowPart = 0;
|
|
SectionOffset.HighPart = 0;
|
|
ViewSize = 0;
|
|
SnapshotBase = 0;
|
|
|
|
Status = NtMapViewOfSection(SnapSection,
|
|
NtCurrentProcess(),
|
|
&SnapshotBase,
|
|
0L,
|
|
0L,
|
|
&SectionOffset,
|
|
&ViewSize,
|
|
ViewShare,
|
|
0L,
|
|
PAGE_READWRITE);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
BaseSetLastNTError(Status);
|
|
return FALSE;
|
|
}
|
|
|
|
if (SnapshotBase->HeapListCount == 0) {
|
|
RtlZeroMemory((PUCHAR)lphl + sizeof(SIZE_T), (lphl->dwSize - sizeof(SIZE_T)));
|
|
SetLastError(ERROR_NO_MORE_FILES);
|
|
} else {
|
|
memcpy(lphl,
|
|
(LPHEAPLIST32)((ULONG_PTR)SnapshotBase + (ULONG_PTR)SnapshotBase->HeapListHead),
|
|
sizeof(HEAPLIST32));
|
|
retv = TRUE;
|
|
SnapshotBase->HeapListIndex = 1;
|
|
}
|
|
|
|
NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)SnapshotBase);
|
|
return retv;
|
|
}
|
|
|
|
|
|
BOOL
|
|
WINAPI
|
|
Heap32ListNext(
|
|
IN HANDLE SnapSection,
|
|
IN OUT LPHEAPLIST32 lphl)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Retrieves information about the next heap that has been allocated by a
|
|
Win32 process.
|
|
|
|
Arguments:
|
|
|
|
SnapSection - Supplies the handle of the snapshot returned from a previous
|
|
call to the CreateToolhelp32Snapshot function.
|
|
|
|
lphl - Returns a HEAPLIST32 structure. The calling application must set the
|
|
dwSize member of HEAPLIST32 to the size, in bytes, of the structure.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if the next entry of the heap list has been copied to the buffer or
|
|
FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the
|
|
GetLastError function when no more entries in the heap list exist.
|
|
|
|
--*/
|
|
{
|
|
PSNAPSHOTSTATE SnapshotBase;
|
|
BOOL retv = FALSE;
|
|
LARGE_INTEGER SectionOffset;
|
|
SIZE_T ViewSize;
|
|
NTSTATUS Status = 0;
|
|
|
|
if (!lphl || lphl->dwSize != sizeof(HEAPLIST32)) {
|
|
BaseSetLastNTError(STATUS_INFO_LENGTH_MISMATCH);
|
|
return FALSE;
|
|
}
|
|
|
|
SectionOffset.LowPart = 0;
|
|
SectionOffset.HighPart = 0;
|
|
ViewSize = 0;
|
|
SnapshotBase = 0;
|
|
|
|
Status = NtMapViewOfSection(SnapSection,
|
|
NtCurrentProcess(),
|
|
&SnapshotBase,
|
|
0L,
|
|
0L,
|
|
&SectionOffset,
|
|
&ViewSize,
|
|
ViewShare,
|
|
0L,
|
|
PAGE_READWRITE);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
BaseSetLastNTError(Status);
|
|
return FALSE;
|
|
}
|
|
|
|
if (SnapshotBase->HeapListIndex < SnapshotBase->HeapListCount) {
|
|
memcpy(lphl,
|
|
(LPHEAPLIST32)((ULONG_PTR)SnapshotBase + (ULONG_PTR)(&SnapshotBase->HeapListHead[SnapshotBase->HeapListIndex++])),
|
|
sizeof(HEAPLIST32));
|
|
retv = TRUE;
|
|
} else {
|
|
SetLastError(ERROR_NO_MORE_FILES);
|
|
}
|
|
|
|
NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)SnapshotBase);
|
|
|
|
return(retv);
|
|
}
|
|
|
|
|
|
BOOL
|
|
WINAPI
|
|
Heap32First(
|
|
IN OUT LPHEAPENTRY32 lphe,
|
|
IN DWORD th32ProcessID,
|
|
IN ULONG_PTR th32HeapID)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Retrieves information about the first block of a heap that has been
|
|
allocated by a Win32 process. Also, create a snapshot of that heap so
|
|
the Heap32Next functions can walk them.
|
|
|
|
Arguments:
|
|
|
|
lphe - Returns a HEAPENTRY32 structure. The calling application must set
|
|
the dwSize member to the size, in bytes, of the structure.
|
|
|
|
th32ProcessID - Supplies the identifier of the Win32 process context that
|
|
owns the heap.
|
|
|
|
th32HeapID - Supplies the identifier of the heap to enumerate.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if information for the first heap block has been copied to the buffer
|
|
or FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the
|
|
GetLastError function if the heap is invalid or empty.
|
|
|
|
Notes:
|
|
|
|
since there is no way to save heap snapshots or delete heap snapshots in any way that
|
|
makes sense (because this info is not associated with snapshots etc), the information
|
|
needs to be generated completely for each call. This is very expensive, it would be
|
|
a good idea to redesign this API...
|
|
We could try and cheat by preserving snapshots until they are completyely iterated or
|
|
until a new one is taken, etc, but we will just end up with a bunch of memory leaks
|
|
|
|
--*/
|
|
{
|
|
PRTL_DEBUG_INFORMATION ThRawHeapDebugInfo;
|
|
ULONG HeapListCount;
|
|
PRTL_HEAP_ENTRY p;
|
|
PRTL_HEAP_INFORMATION HeapInfo;
|
|
ULONG HeapEntryAddress;
|
|
NTSTATUS Status = 0;
|
|
BOOL retv = FALSE;
|
|
|
|
if (!lphe || lphe->dwSize != sizeof(HEAPENTRY32)) {
|
|
BaseSetLastNTError(STATUS_INFO_LENGTH_MISMATCH);
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// take snapshot
|
|
//
|
|
|
|
ThRawHeapDebugInfo = RtlCreateQueryDebugBuffer(0, FALSE);
|
|
if(ThRawHeapDebugInfo == 0)
|
|
{
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
Status = RtlQueryProcessDebugInformation((HANDLE)LongToHandle(th32ProcessID),
|
|
RTL_QUERY_PROCESS_HEAP_SUMMARY |
|
|
RTL_QUERY_PROCESS_HEAP_ENTRIES,
|
|
ThRawHeapDebugInfo);
|
|
if (!NT_SUCCESS(Status)) {
|
|
RtlDestroyQueryDebugBuffer(ThRawHeapDebugInfo);
|
|
BaseSetLastNTError(Status);
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// query snapshot
|
|
//
|
|
|
|
for (HeapListCount = 0;
|
|
HeapListCount < ThRawHeapDebugInfo->Heaps->NumberOfHeaps;
|
|
HeapListCount++) {
|
|
|
|
HeapInfo = &ThRawHeapDebugInfo->Heaps->Heaps[HeapListCount];
|
|
|
|
if ((ULONG_PTR)HeapInfo->BaseAddress == th32HeapID) {
|
|
|
|
p = HeapInfo->Entries;
|
|
|
|
lphe->dwResvd = 0;
|
|
lphe->dwLockCount = 0;
|
|
lphe->th32HeapID = th32HeapID;
|
|
lphe->th32ProcessID = th32ProcessID;
|
|
lphe->hHandle = (HANDLE)th32HeapID;// try this way
|
|
|
|
// walk up to first non-segment block (I am assuming there is always one)
|
|
// skip segments - can you have 2 in a row?
|
|
// is first block always a segment?
|
|
// We translate the heap flags to the most appropriate LF32_xxx values
|
|
while(RTL_HEAP_SEGMENT & p->Flags) {
|
|
lphe->dwAddress = (ULONG_PTR)p->u.s2.FirstBlock + ThRawHeapDebugInfo->Heaps->Heaps[HeapListCount].EntryOverhead; // reset this
|
|
++lphe->dwResvd;
|
|
++p;
|
|
}
|
|
|
|
//
|
|
// munge flags
|
|
//
|
|
|
|
//----------------------------------------------
|
|
if ((p->Flags & RTL_HEAP_BUSY) ||
|
|
(p->Flags & RTL_HEAP_SETTABLE_VALUE) ||
|
|
(p->Flags & RTL_HEAP_SETTABLE_FLAG2) ||
|
|
(p->Flags & RTL_HEAP_SETTABLE_FLAG3) ||
|
|
(p->Flags & RTL_HEAP_SETTABLE_FLAGS) ||
|
|
(p->Flags & RTL_HEAP_PROTECTED_ENTRY)
|
|
) {
|
|
lphe->dwFlags = LF32_FIXED;
|
|
}
|
|
else if ( p->Flags & RTL_HEAP_SETTABLE_FLAG1) {
|
|
lphe->dwFlags = LF32_MOVEABLE;
|
|
}
|
|
else if ( p->Flags & RTL_HEAP_UNCOMMITTED_RANGE) {
|
|
lphe->dwFlags = LF32_FREE;
|
|
}
|
|
//----------------------------------------------
|
|
|
|
lphe->dwBlockSize = p->Size;
|
|
retv = TRUE;
|
|
break;
|
|
}
|
|
}
|
|
|
|
//
|
|
// free snapshot
|
|
//
|
|
|
|
RtlDestroyQueryDebugBuffer(ThRawHeapDebugInfo);
|
|
|
|
return retv;
|
|
|
|
}
|
|
|
|
|
|
BOOL
|
|
WINAPI
|
|
Heap32Next(
|
|
IN OUT LPHEAPENTRY32 lphe)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Retrieves information about the next block of a heap that has been
|
|
allocated by a Win32 process.
|
|
|
|
Arguments:
|
|
|
|
lphe - Returns a HEAPENTRY32 structure. The calling application must set
|
|
the dwSize member to the size, in bytes, of the structure.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if information about the next block in the heap has been
|
|
copied to the buffer or FALSE otherwise. The ERROR_NO_MORE_FILES error
|
|
value is returned by the GetLastError function when no more objects in
|
|
the heap exist.
|
|
|
|
note:
|
|
|
|
this function can be prone to error since the heap can change between
|
|
calls to get heaplists, Heap32First, etc. There is no good way to
|
|
manage a snapshot using this model, so we just get to live with it.
|
|
|
|
--*/
|
|
{
|
|
PRTL_DEBUG_INFORMATION ThRawHeapDebugInfo;
|
|
PRTL_HEAP_ENTRY p;
|
|
PRTL_HEAP_INFORMATION HeapInfo;
|
|
ULONG HeapListCount;
|
|
BOOL retv = FALSE;
|
|
BOOL hit_seg = FALSE;
|
|
NTSTATUS Status = 0;
|
|
|
|
if (!lphe || lphe->dwSize != sizeof(HEAPENTRY32)) {
|
|
BaseSetLastNTError(STATUS_INFO_LENGTH_MISMATCH);
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// take snapshot
|
|
//
|
|
|
|
ThRawHeapDebugInfo = RtlCreateQueryDebugBuffer(0, FALSE);
|
|
if(ThRawHeapDebugInfo == 0)
|
|
{
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
Status = RtlQueryProcessDebugInformation((HANDLE)LongToHandle(lphe->th32ProcessID),
|
|
RTL_QUERY_PROCESS_HEAP_SUMMARY |
|
|
RTL_QUERY_PROCESS_HEAP_ENTRIES,
|
|
ThRawHeapDebugInfo);
|
|
if (!NT_SUCCESS(Status)) {
|
|
RtlDestroyQueryDebugBuffer(ThRawHeapDebugInfo);
|
|
BaseSetLastNTError(Status);
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// get index to correct heap list heap list - th32HeapID / baseadress
|
|
//
|
|
|
|
for (HeapListCount = 0; HeapListCount < ThRawHeapDebugInfo->Heaps->NumberOfHeaps; ++HeapListCount)
|
|
{
|
|
if((ULONG_PTR)ThRawHeapDebugInfo->Heaps->Heaps[HeapListCount].BaseAddress == lphe->th32HeapID)
|
|
{
|
|
break;
|
|
}
|
|
}
|
|
|
|
//
|
|
// ran out of heaps
|
|
//
|
|
|
|
if(HeapListCount >= ThRawHeapDebugInfo->Heaps->NumberOfHeaps)
|
|
{
|
|
RtlDestroyQueryDebugBuffer(ThRawHeapDebugInfo);
|
|
SetLastError(ERROR_NO_MORE_FILES);
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// check for last entry
|
|
//
|
|
|
|
++lphe->dwResvd; // point to next one
|
|
|
|
if(lphe->dwResvd >= ThRawHeapDebugInfo->Heaps->Heaps[HeapListCount].NumberOfEntries)
|
|
{
|
|
RtlDestroyQueryDebugBuffer(ThRawHeapDebugInfo);
|
|
SetLastError(ERROR_NO_MORE_FILES);
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// point to correct heap entry - index of this is kept in lphe->dwResvd
|
|
//
|
|
p = (PRTL_HEAP_ENTRY)&ThRawHeapDebugInfo->Heaps->Heaps[HeapListCount].Entries[lphe->dwResvd];
|
|
|
|
// keep segments in lphe->hHandle
|
|
while(RTL_HEAP_SEGMENT & p->Flags) {
|
|
lphe->dwAddress = (ULONG_PTR)p->u.s2.FirstBlock + ThRawHeapDebugInfo->Heaps->Heaps[HeapListCount].EntryOverhead;// reset this
|
|
if(lphe->dwResvd >= ThRawHeapDebugInfo->Heaps->Heaps[HeapListCount].NumberOfEntries)
|
|
{
|
|
RtlDestroyQueryDebugBuffer(ThRawHeapDebugInfo);
|
|
SetLastError(ERROR_NO_MORE_FILES);
|
|
return FALSE;
|
|
}
|
|
++lphe->dwResvd;
|
|
++p;
|
|
hit_seg = TRUE;
|
|
}
|
|
|
|
//
|
|
// calculate the address
|
|
// normally, we could add the size of the previous block to the existing (last) address
|
|
// to get the current address, but this is only for blocks that do not follow a segment
|
|
// I am assuming that there will always be a segment first
|
|
// current address = last address() + last size
|
|
// by the time we reach this point, either we have just exited from scannin a segment, or
|
|
// p-> is pointing at a non-segment entry.
|
|
//
|
|
|
|
if(hit_seg == FALSE)
|
|
{
|
|
lphe->dwAddress += lphe->dwBlockSize;
|
|
}
|
|
|
|
lphe->dwBlockSize = p->Size;
|
|
|
|
//
|
|
// munge flags
|
|
//
|
|
|
|
// We translate the heap flags to the most appropriate LF32_xxx values
|
|
//----------------------------------------------
|
|
if( (p->Flags & RTL_HEAP_BUSY) ||
|
|
(p->Flags & RTL_HEAP_SETTABLE_VALUE) ||
|
|
(p->Flags & RTL_HEAP_SETTABLE_FLAG2) ||
|
|
(p->Flags & RTL_HEAP_SETTABLE_FLAG3) ||
|
|
(p->Flags & RTL_HEAP_SETTABLE_FLAGS) ||
|
|
(p->Flags & RTL_HEAP_PROTECTED_ENTRY)
|
|
) {
|
|
lphe->dwFlags = LF32_FIXED;
|
|
}
|
|
else if( p->Flags & RTL_HEAP_SETTABLE_FLAG1) {
|
|
lphe->dwFlags = LF32_MOVEABLE;
|
|
}
|
|
else if( p->Flags & RTL_HEAP_UNCOMMITTED_RANGE) {
|
|
lphe->dwFlags = LF32_FREE;
|
|
}
|
|
//----------------------------------------------
|
|
|
|
retv = TRUE;
|
|
|
|
//
|
|
// free snapshot
|
|
//
|
|
|
|
RtlDestroyQueryDebugBuffer(ThRawHeapDebugInfo);
|
|
|
|
return(retv);
|
|
}
|
|
|
|
|
|
BOOL
|
|
WINAPI
|
|
Toolhelp32ReadProcessMemory(
|
|
IN DWORD th32ProcessID,
|
|
IN LPCVOID lpBaseAddress,
|
|
OUT PUCHAR lpBuffer,
|
|
IN SIZE_T cbRead,
|
|
OUT SIZE_T *lpNumberOfBytesRead)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Copies memory allocated to another process into an application-supplied
|
|
buffer. This function is for people who are to lazy to open
|
|
the process themselves.
|
|
|
|
Arguments:
|
|
|
|
th32ProcessID - Supplies the Identifier of the Win32 process whose memory
|
|
is being copied. This parameter can be zero to copy the memory of the
|
|
current process.
|
|
|
|
lpBaseAddress - Supplies the base address in the specified process to read.
|
|
Before transferring any data, the system verifies that all data in the
|
|
base address and memory of the specified size is accessible for read
|
|
access. If this is the case, the function proceeds. Otherwise, the
|
|
function fails.
|
|
|
|
lpBuffer - Returns the requested data
|
|
|
|
cbRead - Supplies the number of bytes to read from the specified process.
|
|
|
|
lpNumberOfBytesRead - Returns the number of bytes copied to the buffer. If
|
|
this parameter is NULL, it is ignored.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if successful.
|
|
|
|
--*/
|
|
{
|
|
HANDLE hProcess;
|
|
BOOL RetVal;
|
|
|
|
hProcess = OpenProcess(PROCESS_VM_READ, FALSE, th32ProcessID);
|
|
if (hProcess == NULL) {
|
|
return FALSE;
|
|
}
|
|
|
|
RetVal = ReadProcessMemory(hProcess,
|
|
lpBaseAddress,
|
|
lpBuffer,
|
|
cbRead,
|
|
lpNumberOfBytesRead);
|
|
|
|
CloseHandle(hProcess);
|
|
return RetVal;
|
|
}
|
|
|
|
|
|
BOOL
|
|
WINAPI
|
|
Process32FirstW(
|
|
IN HANDLE SnapSection,
|
|
IN OUT LPPROCESSENTRY32W lppe)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Retrieves information about the first Win32 process encountered in a system
|
|
snapshot.
|
|
|
|
Arguments:
|
|
|
|
SnapSection - Supplies the handle of a snapshot returned from a previous call
|
|
to the CreateToolhelp32Snapshot function.
|
|
|
|
lppe - Returns a PROCESSENTRY32W structure. The caller must set the dwSize
|
|
member to the size, in bytes, of the structure.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if the first entry of the process list has been copied to the buffer
|
|
or FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the
|
|
GetLastError function if no processes exist or the snapshot does not contain
|
|
process information.
|
|
|
|
--*/
|
|
{
|
|
PSNAPSHOTSTATE SnapshotBase;
|
|
LARGE_INTEGER SectionOffset;
|
|
SIZE_T ViewSize;
|
|
NTSTATUS Status = 0;
|
|
BOOL retv = FALSE;
|
|
|
|
if (!lppe || lppe->dwSize != sizeof(PROCESSENTRY32W)) {
|
|
BaseSetLastNTError(STATUS_INFO_LENGTH_MISMATCH);
|
|
return FALSE;
|
|
}
|
|
|
|
SectionOffset.LowPart = 0;
|
|
SectionOffset.HighPart = 0;
|
|
ViewSize = 0;
|
|
SnapshotBase = 0;
|
|
|
|
Status = NtMapViewOfSection(SnapSection,
|
|
NtCurrentProcess(),
|
|
&SnapshotBase,
|
|
0L,
|
|
0L,
|
|
&SectionOffset,
|
|
&ViewSize,
|
|
ViewShare,
|
|
0L,
|
|
PAGE_READWRITE);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
BaseSetLastNTError(Status);
|
|
return FALSE;
|
|
}
|
|
|
|
if (SnapshotBase->ProcessCount == 0) {
|
|
memset((PUCHAR)lppe + 4, 0, lppe->dwSize - 4);
|
|
SetLastError(ERROR_NO_MORE_FILES);
|
|
} else {
|
|
memcpy(lppe,
|
|
(LPPROCESSENTRY32W)((ULONG_PTR)SnapshotBase + (ULONG_PTR)SnapshotBase->ProcessListHead),
|
|
sizeof(PROCESSENTRY32W));
|
|
SnapshotBase->ProcessListIndex = 1;
|
|
retv = TRUE;
|
|
}
|
|
|
|
NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)SnapshotBase);
|
|
|
|
return retv;
|
|
}
|
|
|
|
BOOL
|
|
WINAPI
|
|
Process32First(
|
|
IN HANDLE SnapSection,
|
|
IN OUT LPPROCESSENTRY32 lppe)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
ANSI version of Process32FirstW.
|
|
|
|
Retrieves information about the first Win32 process encountered in a system
|
|
snapshot.
|
|
|
|
Arguments:
|
|
|
|
SnapSection - Supplies the handle of a snapshot returned from a previous call
|
|
to the CreateToolhelp32Snapshot function.
|
|
|
|
lppe - Returns a PROCESSENTRY32 structure. The caller must set the dwSize
|
|
member to the size, in bytes, of the structure.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if the first entry of the process list has been copied to the buffer
|
|
or FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the
|
|
GetLastError function if no processes exist or the snapshot does not contain
|
|
process information.
|
|
|
|
--*/
|
|
{
|
|
PROCESSENTRY32W pe32w;
|
|
BOOL b;
|
|
|
|
if (lppe == NULL || (lppe->dwSize < sizeof(PROCESSENTRY32))) {
|
|
BaseSetLastNTError(STATUS_INFO_LENGTH_MISMATCH);
|
|
return FALSE;
|
|
}
|
|
|
|
// Thunk to Process32FirstW
|
|
pe32w.dwSize = sizeof(pe32w);
|
|
b = Process32FirstW(SnapSection,&pe32w);
|
|
|
|
WideCharToMultiByte(CP_ACP, 0,
|
|
pe32w.szExeFile, -1,
|
|
lppe->szExeFile, ARRAYSIZE(lppe->szExeFile),
|
|
0, 0);
|
|
|
|
lppe->cntUsage = pe32w.cntUsage; // meaningless on NT, copy anyway
|
|
lppe->th32ProcessID = pe32w.th32ProcessID;
|
|
lppe->th32DefaultHeapID = pe32w.th32DefaultHeapID;
|
|
lppe->th32ModuleID = pe32w.th32ModuleID;
|
|
lppe->cntThreads = pe32w.cntThreads;
|
|
lppe->th32ParentProcessID = pe32w.th32ParentProcessID;
|
|
lppe->pcPriClassBase = pe32w.pcPriClassBase;
|
|
lppe->dwFlags = pe32w.dwFlags;
|
|
|
|
return b;
|
|
}
|
|
|
|
|
|
BOOL
|
|
WINAPI
|
|
Process32NextW(
|
|
IN HANDLE SnapSection,
|
|
IN OUT LPPROCESSENTRY32W lppe)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Retrieves information about the next Win32 process recorded in a system snapshot.
|
|
|
|
Arguments:
|
|
|
|
SnapSection - Supplies the handle of a snapshot returned from a previous call
|
|
to the CreateToolhelp32Snapshot function.
|
|
|
|
lppe - Returns a PROCESSENTRY32W structure. The caller must set the dwSize
|
|
member to the size, in bytes, of the structure.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if the next entry of the process list has been copied to the buffer or
|
|
FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the GetLastError
|
|
function if no processes exist or the snapshot does not contain process information.
|
|
|
|
--*/
|
|
{
|
|
PSNAPSHOTSTATE SnapshotBase;
|
|
BOOL retv = FALSE;
|
|
LARGE_INTEGER SectionOffset;
|
|
SIZE_T ViewSize;
|
|
NTSTATUS Status = 0;
|
|
|
|
if (!lppe || lppe->dwSize != sizeof(PROCESSENTRY32W)) {
|
|
BaseSetLastNTError(STATUS_INFO_LENGTH_MISMATCH);
|
|
return FALSE;
|
|
}
|
|
|
|
SectionOffset.LowPart = 0;
|
|
SectionOffset.HighPart = 0;
|
|
ViewSize = 0;
|
|
SnapshotBase = 0;
|
|
|
|
Status = NtMapViewOfSection(SnapSection,
|
|
NtCurrentProcess(),
|
|
&SnapshotBase,
|
|
0L,
|
|
0L,
|
|
&SectionOffset,
|
|
&ViewSize,
|
|
ViewShare,
|
|
0L,
|
|
PAGE_READWRITE);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
BaseSetLastNTError(Status);
|
|
return FALSE;
|
|
}
|
|
|
|
if (SnapshotBase->ProcessListIndex < SnapshotBase->ProcessCount) {
|
|
memcpy(lppe,
|
|
(LPPROCESSENTRY32W)((ULONG_PTR)SnapshotBase + (ULONG_PTR)(&SnapshotBase->ProcessListHead[SnapshotBase->ProcessListIndex++])),
|
|
sizeof(PROCESSENTRY32W));
|
|
retv = TRUE;
|
|
} else {
|
|
SetLastError(ERROR_NO_MORE_FILES);
|
|
}
|
|
|
|
NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)SnapshotBase);
|
|
|
|
return retv;
|
|
}
|
|
|
|
BOOL
|
|
WINAPI
|
|
Process32Next(
|
|
IN HANDLE SnapSection,
|
|
IN OUT LPPROCESSENTRY32 lppe)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
ANSI version of Process32NextW
|
|
|
|
Retrieves information about the next Win32 process recorded in a system snapshot.
|
|
|
|
Arguments:
|
|
|
|
SnapSection - Supplies the handle of a snapshot returned from a previous call
|
|
to the CreateToolhelp32Snapshot function.
|
|
|
|
lppe - Returns a PROCESSENTRY32 structure. The caller must set the dwSize
|
|
member to the size, in bytes, of the structure.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if the next entry of the process list has been copied to the buffer or
|
|
FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the GetLastError
|
|
function if no processes exist or the snapshot does not contain process information.
|
|
|
|
--*/
|
|
{
|
|
PROCESSENTRY32W pe32w;
|
|
BOOL b;
|
|
|
|
if (lppe == NULL || (lppe->dwSize < sizeof(PROCESSENTRY32))) {
|
|
BaseSetLastNTError(STATUS_INFO_LENGTH_MISMATCH);
|
|
return FALSE;
|
|
}
|
|
|
|
// Thunk to Process32NextW
|
|
pe32w.dwSize = sizeof(pe32w);
|
|
b = Process32NextW(SnapSection,&pe32w);
|
|
|
|
WideCharToMultiByte(CP_ACP, 0,
|
|
pe32w.szExeFile, -1,
|
|
lppe->szExeFile, ARRAYSIZE(lppe->szExeFile),
|
|
0, 0);
|
|
|
|
lppe->cntUsage = pe32w.cntUsage; // meaningless on NT, copy anyway
|
|
lppe->th32ProcessID = pe32w.th32ProcessID;
|
|
lppe->th32DefaultHeapID = pe32w.th32DefaultHeapID;
|
|
lppe->th32ModuleID = pe32w.th32ModuleID;
|
|
lppe->cntThreads = pe32w.cntThreads;
|
|
lppe->th32ParentProcessID = pe32w.th32ParentProcessID;
|
|
lppe->pcPriClassBase = pe32w.pcPriClassBase;
|
|
lppe->dwFlags = pe32w.dwFlags;
|
|
|
|
return b;
|
|
}
|
|
|
|
|
|
BOOL
|
|
WINAPI
|
|
Thread32First(
|
|
IN HANDLE SnapSection,
|
|
IN OUT LPTHREADENTRY32 lpte)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Retrieves information about the first thread of any Win32 process
|
|
encountered in a system snapshot.
|
|
|
|
Arguments:
|
|
|
|
SnapSection - Supplies the handle of a snapshot returned from a previous
|
|
call to the CreateToolhelp32Snapshot function.
|
|
|
|
lpte - Returns a THREADENTRY32 structure. The caller must set the dwSize
|
|
member to the size, in bytes, of the structure.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if the first entry of the thread list has been copied to the buffer or
|
|
FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the GetLastError
|
|
function if no threads exist or the snapshot does not contain thread information.
|
|
|
|
--*/
|
|
{
|
|
PSNAPSHOTSTATE SnapshotBase;
|
|
LARGE_INTEGER SectionOffset;
|
|
SIZE_T ViewSize;
|
|
NTSTATUS Status = 0;
|
|
BOOL retv = FALSE;
|
|
|
|
if (!lpte || lpte->dwSize != sizeof(THREADENTRY32)) {
|
|
BaseSetLastNTError(STATUS_INFO_LENGTH_MISMATCH);
|
|
return FALSE;
|
|
}
|
|
|
|
SectionOffset.LowPart = 0;
|
|
SectionOffset.HighPart = 0;
|
|
ViewSize = 0;
|
|
SnapshotBase = 0;
|
|
|
|
Status = NtMapViewOfSection(SnapSection,
|
|
NtCurrentProcess(),
|
|
&SnapshotBase,
|
|
0L,
|
|
0L,
|
|
&SectionOffset,
|
|
&ViewSize,
|
|
ViewShare,
|
|
0L,
|
|
PAGE_READWRITE);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
BaseSetLastNTError(Status);
|
|
return FALSE;
|
|
}
|
|
|
|
if (SnapshotBase->ThreadCount == 0) {
|
|
memset((PUCHAR)lpte + 4, 0, lpte->dwSize - 4);
|
|
SetLastError(ERROR_NO_MORE_FILES);
|
|
} else {
|
|
memcpy(lpte,
|
|
(LPTHREADENTRY32)((ULONG_PTR)SnapshotBase + (ULONG_PTR)SnapshotBase->ThreadListHead),
|
|
sizeof(THREADENTRY32));
|
|
SnapshotBase->ThreadListIndex = 1;
|
|
retv = TRUE;
|
|
}
|
|
|
|
NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)SnapshotBase);
|
|
|
|
return(retv);
|
|
}
|
|
|
|
|
|
BOOL
|
|
WINAPI
|
|
Thread32Next(
|
|
IN HANDLE SnapSection,
|
|
IN OUT LPTHREADENTRY32 lpte)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Retrieves information about the next thread of any Win32 process encountered in the
|
|
system memory snapshot.
|
|
|
|
Arguments:
|
|
|
|
SnapSection - Supplies the handle of a snapshot returned from a previous call
|
|
to the CreateToolhelp32Snapshot function.
|
|
|
|
lpte - Reeturns a THREADENTRY32 structure. The caller must set the dwSize
|
|
member to the size, in bytes, of the structure.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if the next entry of the thread list has been copied to the buffer or
|
|
FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the GetLastError
|
|
function if no threads exist or the snapshot does not contain thread information.
|
|
|
|
--*/
|
|
{
|
|
PSNAPSHOTSTATE SnapshotBase;
|
|
BOOL retv = FALSE;
|
|
LARGE_INTEGER SectionOffset;
|
|
SIZE_T ViewSize;
|
|
NTSTATUS Status = 0;
|
|
|
|
if (!lpte || lpte->dwSize != sizeof(THREADENTRY32)) {
|
|
BaseSetLastNTError(STATUS_INFO_LENGTH_MISMATCH);
|
|
return FALSE;
|
|
}
|
|
|
|
SectionOffset.LowPart = 0;
|
|
SectionOffset.HighPart = 0;
|
|
ViewSize = 0;
|
|
SnapshotBase = 0;
|
|
|
|
Status = NtMapViewOfSection(SnapSection,
|
|
NtCurrentProcess(),
|
|
&SnapshotBase,
|
|
0L,
|
|
0L,
|
|
&SectionOffset,
|
|
&ViewSize,
|
|
ViewShare,
|
|
0L,
|
|
PAGE_READWRITE);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
BaseSetLastNTError(Status);
|
|
return FALSE;
|
|
}
|
|
|
|
if (SnapshotBase->ThreadListIndex < SnapshotBase->ThreadCount) {
|
|
memcpy(lpte,
|
|
(PTHREADENTRY32)((ULONG_PTR)SnapshotBase + (ULONG_PTR)(&SnapshotBase->ThreadListHead[SnapshotBase->ThreadListIndex++])),
|
|
sizeof(THREADENTRY32));
|
|
retv = TRUE;
|
|
} else {
|
|
SetLastError(ERROR_NO_MORE_FILES);
|
|
}
|
|
|
|
NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)SnapshotBase);
|
|
|
|
return(retv);
|
|
}
|
|
|
|
|
|
BOOL
|
|
WINAPI
|
|
Module32FirstW(
|
|
IN HANDLE SnapSection,
|
|
IN OUT LPMODULEENTRY32W lpme)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Retrieves information about the first module associated with a Win32 process.
|
|
|
|
Arguments:
|
|
|
|
SnapSection - Supplies the handle of a snapshot returned from a previous call
|
|
to the CreateToolhelp32Snapshot function.
|
|
|
|
lpme - Returns a buffer containing a MODULEENTRY32W structure. The caller
|
|
must set the dwSize member to the size, in bytes, of the structure.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if the first entry of the module list has been copied to the buffer or
|
|
FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the GetLastError
|
|
function if no modules exist or the snapshot does not contain module information.
|
|
|
|
--*/
|
|
{
|
|
PSNAPSHOTSTATE SnapshotBase;
|
|
LARGE_INTEGER SectionOffset;
|
|
SIZE_T ViewSize;
|
|
NTSTATUS Status = 0;
|
|
BOOL retv = FALSE;
|
|
|
|
if (!lpme || lpme->dwSize != sizeof(MODULEENTRY32W)) {
|
|
BaseSetLastNTError(STATUS_INFO_LENGTH_MISMATCH);
|
|
return FALSE;
|
|
}
|
|
|
|
SectionOffset.LowPart = 0;
|
|
SectionOffset.HighPart = 0;
|
|
ViewSize = 0;
|
|
SnapshotBase = 0;
|
|
|
|
Status = NtMapViewOfSection(SnapSection,
|
|
NtCurrentProcess(),
|
|
&SnapshotBase,
|
|
0L,
|
|
0L,
|
|
&SectionOffset,
|
|
&ViewSize,
|
|
ViewShare,
|
|
0L,
|
|
PAGE_READWRITE);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
BaseSetLastNTError(Status);
|
|
return FALSE;
|
|
}
|
|
|
|
if (SnapshotBase->ModuleCount == 0) {
|
|
memset((PUCHAR)lpme + 4, 0, lpme->dwSize - 4);
|
|
SetLastError(ERROR_NO_MORE_FILES);
|
|
} else {
|
|
memcpy(lpme,
|
|
(PMODULEENTRY32W)((ULONG_PTR)SnapshotBase + (ULONG_PTR)SnapshotBase->ModuleListHead),
|
|
sizeof(MODULEENTRY32W));
|
|
SnapshotBase->ModuleListIndex = 1;
|
|
retv = TRUE;
|
|
}
|
|
|
|
NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)SnapshotBase);
|
|
|
|
return retv;
|
|
}
|
|
|
|
BOOL
|
|
WINAPI
|
|
Module32First(
|
|
IN HANDLE SnapSection,
|
|
IN OUT LPMODULEENTRY32 lpme)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
ANSI version of Module32FirstW.
|
|
|
|
Retrieves information about the first module associated with a Win32 process.
|
|
|
|
Arguments:
|
|
|
|
SnapSection - Supplies the handle of the snapshot returned from a previous call
|
|
to the CreateToolhelp32Snapshot function.
|
|
|
|
lpme - Returns a buffer containing a MODULEENTRY32 structure. The caller
|
|
must set the dwSize member to the size, in bytes, of the structure.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if the first entry of the module list has been copied to the buffer or
|
|
FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the GetLastError
|
|
function if no modules exist or the snapshot does not contain module information.
|
|
|
|
--*/
|
|
{
|
|
MODULEENTRY32W me32w;
|
|
DWORD dwSizeToCopy;
|
|
BOOL b;
|
|
|
|
if (lpme == NULL || (lpme->dwSize < sizeof(MODULEENTRY32))) {
|
|
SetLastError(ERROR_INVALID_PARAMETER);
|
|
return FALSE;
|
|
}
|
|
|
|
// Thunk to Module32FirstW
|
|
me32w.dwSize = sizeof(me32w);
|
|
b = Module32FirstW(SnapSection,&me32w);
|
|
|
|
WideCharToMultiByte(CP_ACP, 0,
|
|
me32w.szExePath, -1,
|
|
lpme->szExePath, ARRAYSIZE(lpme->szExePath),
|
|
0, 0);
|
|
|
|
WideCharToMultiByte(CP_ACP, 0,
|
|
me32w.szModule, -1,
|
|
lpme->szModule, ARRAYSIZE(lpme->szModule),
|
|
0, 0);
|
|
|
|
lpme->th32ModuleID = me32w.th32ModuleID;
|
|
lpme->th32ProcessID = me32w.th32ProcessID;
|
|
lpme->GlblcntUsage = me32w.GlblcntUsage;
|
|
lpme->ProccntUsage = me32w.ProccntUsage;
|
|
lpme->modBaseAddr = me32w.modBaseAddr;
|
|
lpme->modBaseSize = me32w.modBaseSize;
|
|
lpme->hModule = me32w.hModule;
|
|
|
|
return b;
|
|
}
|
|
|
|
|
|
BOOL
|
|
WINAPI
|
|
Module32NextW(
|
|
IN HANDLE SnapSection,
|
|
IN OUT LPMODULEENTRY32W lpme)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Retrieves information about the next module associated with a Win32 process or thread.
|
|
|
|
Arguments:
|
|
|
|
SnapSection - Supplies the handle of a snapshot returned from a previous call
|
|
to CreateToolhelp32Snapshot.
|
|
|
|
lpme - Returns a MODULEENTRY32W structure. The calling application must set
|
|
the dwSize member to the size, in bytes, of the structure.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if the next entry of the module list has been copied to the buffer or
|
|
FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the GetLastError
|
|
function if no more modules exist.
|
|
|
|
--*/
|
|
{
|
|
PSNAPSHOTSTATE SnapshotBase;
|
|
BOOL retv = FALSE;
|
|
LARGE_INTEGER SectionOffset;
|
|
SIZE_T ViewSize;
|
|
NTSTATUS Status = 0;
|
|
|
|
if (!lpme || lpme->dwSize != sizeof(MODULEENTRY32W)) {
|
|
BaseSetLastNTError(STATUS_INFO_LENGTH_MISMATCH);
|
|
return FALSE;
|
|
}
|
|
|
|
SectionOffset.LowPart = 0;
|
|
SectionOffset.HighPart = 0;
|
|
ViewSize = 0;
|
|
SnapshotBase = 0;
|
|
|
|
Status = NtMapViewOfSection(SnapSection,
|
|
NtCurrentProcess(),
|
|
&SnapshotBase,
|
|
0L,
|
|
0L,
|
|
&SectionOffset,
|
|
&ViewSize,
|
|
ViewShare,
|
|
0L,
|
|
PAGE_READWRITE);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
BaseSetLastNTError(Status);
|
|
return FALSE;
|
|
}
|
|
|
|
if (SnapshotBase->ModuleListIndex < SnapshotBase->ModuleCount) {
|
|
memcpy(lpme,
|
|
(LPMODULEENTRY32W)((ULONG_PTR)SnapshotBase + (ULONG_PTR)(&SnapshotBase->ModuleListHead[SnapshotBase->ModuleListIndex++])),
|
|
sizeof(MODULEENTRY32W));
|
|
retv = TRUE;
|
|
} else {
|
|
SetLastError(ERROR_NO_MORE_FILES);
|
|
}
|
|
|
|
NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)SnapshotBase);
|
|
|
|
return(retv);
|
|
}
|
|
|
|
|
|
BOOL
|
|
WINAPI
|
|
Module32Next(
|
|
IN HANDLE SnapSection,
|
|
IN OUT LPMODULEENTRY32 lpme)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
ANSI version of Module32NextW.
|
|
|
|
Retrieves information about the next module associated with a Win32 process or thread.
|
|
|
|
Arguments:
|
|
|
|
SnapSection - Supplies the handle of a snapshot returned from a previous call
|
|
to CreateToolhelp32Snapshot.
|
|
|
|
lpme - Returns a MODULEENTRY32 structure. The calling application must set
|
|
the dwSize member to the size, in bytes, of the structure.
|
|
|
|
Return Value:
|
|
|
|
Returns TRUE if the next entry of the module list has been copied to the buffer or
|
|
FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the GetLastError
|
|
function if no more modules exist.
|
|
|
|
--*/
|
|
{
|
|
MODULEENTRY32W me32w;
|
|
BOOL b;
|
|
|
|
if (lpme == NULL || (lpme->dwSize < sizeof(MODULEENTRY32))) {
|
|
SetLastError(ERROR_INVALID_DATA);
|
|
return FALSE;
|
|
}
|
|
|
|
// Thunk to Module32NextW
|
|
me32w.dwSize = sizeof(me32w);
|
|
b = Module32NextW(SnapSection,&me32w);
|
|
|
|
WideCharToMultiByte(CP_ACP, 0,
|
|
me32w.szModule, -1,
|
|
lpme->szModule, ARRAYSIZE(lpme->szModule),
|
|
0, 0);
|
|
|
|
WideCharToMultiByte(CP_ACP, 0,
|
|
me32w.szExePath, -1,
|
|
lpme->szExePath, ARRAYSIZE(lpme->szExePath),
|
|
0, 0);
|
|
|
|
lpme->th32ModuleID = me32w.th32ModuleID;
|
|
lpme->GlblcntUsage = me32w.GlblcntUsage;
|
|
lpme->ProccntUsage = me32w.ProccntUsage;
|
|
lpme->modBaseAddr = me32w.modBaseAddr;
|
|
lpme->modBaseSize = me32w.modBaseSize;
|
|
lpme->hModule = me32w.hModule;
|
|
|
|
return b;
|
|
}
|
|
|
|
NTSTATUS
|
|
ThpCreateRawSnap(
|
|
IN DWORD dwFlags,
|
|
IN DWORD th32ProcessID,
|
|
PUCHAR *RawProcess,
|
|
PRTL_DEBUG_INFORMATION *RawModule,
|
|
PRTL_DEBUG_INFORMATION *RawDebugInfo)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function gets raw snapshots for the data types specified by dwFlags.
|
|
|
|
Arguments:
|
|
|
|
th32ProcessID - Supplies a WIN32 process ID. See CreateToolhelp32Snapshot
|
|
for full description.
|
|
|
|
dwFlags - Supplies switches requesting various data. See
|
|
CreateToolhelp32Snapshot for full description
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS as appropriate
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status = 0;
|
|
ULONG BufferSize = BUFFER_SIZE;
|
|
SIZE_T stBufferSize = BUFFER_SIZE;
|
|
|
|
//
|
|
// get process/thread/module/heap info
|
|
//
|
|
|
|
*RawProcess = NULL;
|
|
*RawModule = NULL;
|
|
*RawDebugInfo = NULL;
|
|
|
|
if((dwFlags & TH32CS_SNAPPROCESS) || (dwFlags & TH32CS_SNAPTHREAD)){
|
|
do {
|
|
try {
|
|
stBufferSize = BufferSize;
|
|
Status = NtAllocateVirtualMemory(NtCurrentProcess(),
|
|
RawProcess,
|
|
0,
|
|
&stBufferSize,
|
|
MEM_COMMIT,
|
|
PAGE_READWRITE);
|
|
}
|
|
except( EXCEPTION_EXECUTE_HANDLER ) {
|
|
Status = GetExceptionCode();
|
|
}
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
break;
|
|
}
|
|
|
|
BufferSize = (ULONG)stBufferSize;
|
|
//
|
|
// get all of the status information */
|
|
//
|
|
Status = NtQuerySystemInformation(SystemProcessInformation,
|
|
*RawProcess,
|
|
BufferSize,
|
|
NULL);
|
|
|
|
if (Status == STATUS_INFO_LENGTH_MISMATCH) {
|
|
NtFreeVirtualMemory(NtCurrentProcess(),
|
|
RawProcess,
|
|
&stBufferSize,
|
|
MEM_RELEASE);
|
|
*RawProcess = NULL;
|
|
BufferSize += 8192;
|
|
}
|
|
|
|
} while(Status == STATUS_INFO_LENGTH_MISMATCH);
|
|
}
|
|
|
|
//
|
|
// get module information
|
|
//
|
|
|
|
if((dwFlags & TH32CS_SNAPMODULE) || (dwFlags & TH32CS_SNAPMODULE32))
|
|
{
|
|
if (NT_SUCCESS(Status)) {
|
|
*RawModule = RtlCreateQueryDebugBuffer(0, FALSE);
|
|
if (!*RawModule) {
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
}
|
|
}
|
|
|
|
if (NT_SUCCESS(Status)) {
|
|
Status = RtlQueryProcessDebugInformation((HANDLE)LongToHandle(th32ProcessID),
|
|
RTL_QUERY_PROCESS_NONINVASIVE |
|
|
((dwFlags & TH32CS_SNAPMODULE) ? RTL_QUERY_PROCESS_MODULES : 0) |
|
|
((dwFlags & TH32CS_SNAPMODULE32) ? RTL_QUERY_PROCESS_MODULES32 : 0),
|
|
*RawModule);
|
|
}
|
|
}
|
|
|
|
//
|
|
// get the heap summary information for the specified process */
|
|
//
|
|
|
|
if (dwFlags & TH32CS_SNAPHEAPLIST) {
|
|
if (NT_SUCCESS(Status)) {
|
|
|
|
*RawDebugInfo = RtlCreateQueryDebugBuffer(0, FALSE);
|
|
if (!*RawDebugInfo) {
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
}
|
|
}
|
|
if (NT_SUCCESS(Status)) {
|
|
Status = RtlQueryProcessDebugInformation((HANDLE)LongToHandle(th32ProcessID),
|
|
RTL_QUERY_PROCESS_HEAP_SUMMARY,
|
|
*RawDebugInfo);
|
|
}
|
|
}
|
|
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
if (*RawProcess) {
|
|
SIZE_T Size = 0;
|
|
NtFreeVirtualMemory(NtCurrentProcess(),
|
|
RawProcess,
|
|
&Size,
|
|
MEM_RELEASE);
|
|
*RawProcess = NULL;
|
|
}
|
|
if (*RawModule) {
|
|
RtlDestroyQueryDebugBuffer(*RawModule);
|
|
*RawModule = NULL;
|
|
}
|
|
if (*RawDebugInfo) {
|
|
RtlDestroyQueryDebugBuffer(*RawDebugInfo);
|
|
*RawDebugInfo = NULL;
|
|
}
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
ThpAllocateSnapshotSection(
|
|
OUT PHANDLE SnapSection,
|
|
IN DWORD dwFlags,
|
|
IN DWORD th32ProcessID,
|
|
PUCHAR RawProcess,
|
|
PRTL_DEBUG_INFORMATION RawModule,
|
|
PRTL_DEBUG_INFORMATION RawDebugInfo)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function calculates the size of the snapshot and allocates a
|
|
file mapping object for it in the pagefile.
|
|
Also, initialize snapshot information in the header
|
|
|
|
Arguments:
|
|
|
|
th32ProcessID - Supplies a WIN32 process ID. See CreateToolhelp32Snapshot
|
|
for full description.
|
|
|
|
dwFlags - Supplies switches describing requested data. See
|
|
CreateToolhelp32Snapshot for full description.
|
|
|
|
th32ProcessID -
|
|
|
|
RawProcess -
|
|
|
|
RawDebugInfo -
|
|
|
|
Return Value:
|
|
|
|
Handle to to the mapping object if successful, -1 otherwise
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status = 0;
|
|
PSNAPSHOTSTATE SnapshotBase;
|
|
SECURITY_ATTRIBUTES SecurityAttributes;
|
|
LPSECURITY_ATTRIBUTES lpSecurityAttributes;
|
|
ULONG SnapShotSize;
|
|
ULONG Offset1;
|
|
PSYSTEM_PROCESS_INFORMATION ProcessInfo;
|
|
OBJECT_ATTRIBUTES Obja;
|
|
POBJECT_ATTRIBUTES pObja;
|
|
LARGE_INTEGER SectionOffset;
|
|
LARGE_INTEGER SectionSize;
|
|
SIZE_T ViewSize;
|
|
SIZE_T Size;
|
|
ULONG ProcessCount = 0;
|
|
ULONG HeapListCount = 0;
|
|
ULONG ModuleCount = 0;
|
|
ULONG ThreadCount = 0;
|
|
|
|
SnapShotSize = sizeof(SNAPSHOTSTATE);
|
|
|
|
Offset1 = 0;
|
|
|
|
//
|
|
// calculate the required snapshot size
|
|
//
|
|
|
|
if ((dwFlags & TH32CS_SNAPPROCESS) || (dwFlags & TH32CS_SNAPTHREAD)) {
|
|
do {
|
|
ProcessCount++;
|
|
ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)&RawProcess[Offset1];
|
|
Offset1 += ProcessInfo->NextEntryOffset;
|
|
ThreadCount += ProcessInfo->NumberOfThreads;
|
|
} while (ProcessInfo->NextEntryOffset != 0);
|
|
|
|
if (dwFlags & TH32CS_SNAPPROCESS) {
|
|
SnapShotSize += ProcessCount * sizeof(PROCESSENTRY32W);
|
|
}
|
|
if (dwFlags & TH32CS_SNAPTHREAD) {
|
|
SnapShotSize += ThreadCount * sizeof(THREADENTRY32);
|
|
}
|
|
}
|
|
|
|
if (dwFlags & TH32CS_SNAPMODULE) {
|
|
SnapShotSize += RawModule->Modules->NumberOfModules * sizeof(MODULEENTRY32W);
|
|
ModuleCount = RawModule->Modules->NumberOfModules;
|
|
}
|
|
|
|
if (dwFlags & TH32CS_SNAPHEAPLIST) {
|
|
SnapShotSize += RawDebugInfo->Heaps->NumberOfHeaps * sizeof(HEAPLIST32);
|
|
HeapListCount = RawDebugInfo->Heaps->NumberOfHeaps;
|
|
}
|
|
|
|
//
|
|
// Create a security object if needed
|
|
//
|
|
|
|
if (dwFlags & TH32CS_INHERIT) {
|
|
SecurityAttributes.lpSecurityDescriptor = NULL;
|
|
SecurityAttributes.nLength = sizeof(SECURITY_ATTRIBUTES);
|
|
SecurityAttributes.bInheritHandle = TRUE;
|
|
lpSecurityAttributes = &SecurityAttributes;
|
|
} else {
|
|
lpSecurityAttributes = NULL;
|
|
}
|
|
|
|
//
|
|
// create a pagefile section to contain the snapshot
|
|
//
|
|
|
|
pObja = BaseFormatObjectAttributes(&Obja, lpSecurityAttributes, NULL);
|
|
|
|
SectionSize.LowPart = SnapShotSize;
|
|
SectionSize.HighPart = 0;
|
|
|
|
Status = NtCreateSection(SnapSection,
|
|
STANDARD_RIGHTS_REQUIRED | SECTION_QUERY | SECTION_MAP_READ | SECTION_MAP_WRITE,
|
|
pObja,
|
|
&SectionSize,
|
|
PAGE_READWRITE,
|
|
SEC_COMMIT,
|
|
NULL);
|
|
|
|
if ( !NT_SUCCESS(Status) ) {
|
|
return Status;
|
|
}
|
|
|
|
SectionOffset.LowPart = 0;
|
|
SectionOffset.HighPart = 0;
|
|
ViewSize = 0;
|
|
SnapshotBase = 0;
|
|
|
|
Status = NtMapViewOfSection(*SnapSection,
|
|
NtCurrentProcess(),
|
|
&SnapshotBase,
|
|
0L,
|
|
0L,
|
|
&SectionOffset,
|
|
&ViewSize,
|
|
ViewShare,
|
|
0L,
|
|
PAGE_READWRITE);
|
|
|
|
//
|
|
// free all memory if failure
|
|
//
|
|
|
|
if ( !NT_SUCCESS(Status) ) {
|
|
CloseHandle(*SnapSection);
|
|
|
|
if ((dwFlags & TH32CS_SNAPTHREAD) || (dwFlags & TH32CS_SNAPPROCESS)){
|
|
|
|
Size = 0;
|
|
NtFreeVirtualMemory(NtCurrentProcess(),
|
|
&RawProcess,
|
|
&Size,
|
|
MEM_RELEASE);
|
|
|
|
}
|
|
|
|
if (dwFlags & TH32CS_SNAPPROCESS) {
|
|
RtlDestroyQueryDebugBuffer(RawModule);
|
|
}
|
|
|
|
if (dwFlags & TH32CS_SNAPHEAPLIST) {
|
|
RtlDestroyQueryDebugBuffer(RawDebugInfo);
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
SnapshotBase->ProcessCount = ProcessCount;
|
|
SnapshotBase->HeapListCount = HeapListCount;
|
|
SnapshotBase->ModuleCount = ModuleCount;
|
|
SnapshotBase->ThreadCount = ThreadCount;
|
|
|
|
//
|
|
// return resources
|
|
//
|
|
|
|
NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)SnapshotBase);
|
|
|
|
return STATUS_SUCCESS;
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
ThpCopyAnsiToUnicode(
|
|
PWCHAR Dest,
|
|
PUCHAR Src,
|
|
USHORT Max)
|
|
{
|
|
UNICODE_STRING UnicodeString;
|
|
ANSI_STRING AnsiString;
|
|
|
|
UnicodeString.Buffer = Dest;
|
|
UnicodeString.MaximumLength = Max;
|
|
|
|
RtlInitAnsiString(&AnsiString, Src);
|
|
|
|
return RtlAnsiStringToUnicodeString( &UnicodeString, &AnsiString, FALSE );
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
ThpProcessToSnap(
|
|
IN DWORD dwFlags,
|
|
IN DWORD th32ProcessID,
|
|
IN HANDLE SnapSection,
|
|
PUCHAR RawProcess,
|
|
PRTL_DEBUG_INFORMATION RawModule,
|
|
PRTL_DEBUG_INFORMATION RawDebugInfo)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This function processes the data in the raw dumps specified by dwFlage into
|
|
a mapped file.
|
|
|
|
Arguments:
|
|
|
|
dwFlags - Supplies switches describing the data requested. See
|
|
CreateToolhelp32Snapshot for full description.
|
|
|
|
th32ProcessID - Supplies a WIN32 process ID. See CreateToolhelp32Snapshot
|
|
for full description.
|
|
|
|
SnapSection - Supplies handle to section allocated by ThpAllocateSnapshotSection.
|
|
|
|
RawProcess -
|
|
|
|
RawDebugInfo -
|
|
|
|
Return Value:
|
|
|
|
TRUE if successful, FALSE if there was a problem encountered
|
|
|
|
--*/
|
|
{
|
|
PSNAPSHOTSTATE SnapshotBase;
|
|
PUCHAR BufferWriteAddr; /* working pointer into out process data - usually points at end */
|
|
LARGE_INTEGER SectionOffset;
|
|
SIZE_T ViewSize;
|
|
NTSTATUS Status = 0;
|
|
SIZE_T Size;
|
|
|
|
SectionOffset.LowPart = 0;
|
|
SectionOffset.HighPart = 0;
|
|
ViewSize = 0;
|
|
SnapshotBase = 0;
|
|
|
|
Status = NtMapViewOfSection(SnapSection,
|
|
NtCurrentProcess(),
|
|
&SnapshotBase,
|
|
0L,
|
|
0L,
|
|
&SectionOffset,
|
|
&ViewSize,
|
|
ViewShare,
|
|
0L,
|
|
PAGE_READWRITE);
|
|
|
|
if (!NT_SUCCESS(Status)) {
|
|
return Status;
|
|
}
|
|
|
|
BufferWriteAddr = &SnapshotBase->DataBegin;
|
|
|
|
//
|
|
// write heap list to snapshot
|
|
// some of this code adapted from dh.c
|
|
//
|
|
if (dwFlags & TH32CS_SNAPHEAPLIST) {
|
|
ULONG HeapListCount = 0;
|
|
ULONG HeapEntryCount = 0;
|
|
LPHEAPLIST32 pHeapList;
|
|
|
|
SnapshotBase->HeapListHead = (PHEAPLIST32)(BufferWriteAddr - (PUCHAR)SnapshotBase);
|
|
pHeapList = (LPHEAPLIST32)BufferWriteAddr;
|
|
|
|
// heaplist
|
|
for (HeapListCount = 0; HeapListCount < SnapshotBase->HeapListCount; HeapListCount++){
|
|
pHeapList->dwSize = sizeof(HEAPLIST32);
|
|
pHeapList->th32ProcessID = th32ProcessID;
|
|
/* handle = baseaddress = ID we will use internally */
|
|
pHeapList->th32HeapID = (ULONG_PTR)RawDebugInfo->Heaps->Heaps[HeapListCount].BaseAddress;
|
|
pHeapList->dwFlags = RawDebugInfo->Heaps->Heaps[HeapListCount].Flags;
|
|
++pHeapList;
|
|
}
|
|
// update the pointer to the write area
|
|
BufferWriteAddr = (PCHAR)(BufferWriteAddr + HeapListCount * sizeof(HEAPLIST32));
|
|
RtlDestroyQueryDebugBuffer(RawDebugInfo);
|
|
}
|
|
|
|
//
|
|
// write module list to snapshot
|
|
//
|
|
if (dwFlags & TH32CS_SNAPMODULE) {
|
|
LPMODULEENTRY32W pModule;
|
|
ULONG Offset1 = 0;
|
|
ULONG mCount = 0;
|
|
PRTL_PROCESS_MODULE_INFORMATION ModuleInfo;
|
|
|
|
SnapshotBase->ModuleListHead = (PMODULEENTRY32W)(BufferWriteAddr - (PUCHAR)SnapshotBase);
|
|
|
|
//
|
|
// get module info from buffer
|
|
//
|
|
|
|
pModule = (LPMODULEENTRY32W)(BufferWriteAddr);
|
|
ModuleInfo = &RawModule->Modules->Modules[ 0 ];
|
|
for (mCount = 0; mCount < RawModule->Modules->NumberOfModules; mCount++) {
|
|
|
|
pModule->dwSize = sizeof(MODULEENTRY32W);
|
|
|
|
pModule->th32ProcessID = th32ProcessID;
|
|
|
|
//
|
|
// base == handle
|
|
//
|
|
|
|
pModule->hModule = ModuleInfo->ImageBase;
|
|
|
|
//
|
|
// Base address of module in th32ProcessID's context
|
|
//
|
|
|
|
pModule->modBaseAddr = ModuleInfo->ImageBase;
|
|
|
|
//
|
|
// Path
|
|
//
|
|
|
|
ThpCopyAnsiToUnicode(pModule->szExePath,
|
|
ModuleInfo->FullPathName,
|
|
sizeof(pModule->szExePath));
|
|
|
|
//
|
|
// module name
|
|
//
|
|
|
|
ThpCopyAnsiToUnicode(pModule->szModule,
|
|
&ModuleInfo->FullPathName[ModuleInfo->OffsetToFileName],
|
|
sizeof(pModule->szModule));
|
|
|
|
//
|
|
// Size in bytes of module starting at modBaseAddr
|
|
//
|
|
|
|
pModule->modBaseSize = ModuleInfo->ImageSize;
|
|
|
|
|
|
//
|
|
// these are meaningless on NT
|
|
// but some apps may care... Gruntz (bugid 327009)
|
|
// was failing because th32ModuleID was 0, so
|
|
// now we stick in the address of the Module descriptor
|
|
//
|
|
// However it turns out that a pointer doesn't fit in a DWORD,
|
|
// so we stick in the value 1 instead.
|
|
//
|
|
|
|
pModule->th32ModuleID = 1;
|
|
pModule->GlblcntUsage = ModuleInfo->LoadCount; // will be 0xffff
|
|
pModule->ProccntUsage = ModuleInfo->LoadCount; // will be 0xffff
|
|
|
|
++ModuleInfo;
|
|
++pModule;
|
|
}
|
|
|
|
//
|
|
// update the pointer to the write area
|
|
//
|
|
BufferWriteAddr = (PCHAR)(BufferWriteAddr + mCount * sizeof(MODULEENTRY32W));
|
|
RtlDestroyQueryDebugBuffer(RawModule);
|
|
}
|
|
|
|
//
|
|
// write process list to snapshot
|
|
//
|
|
if (dwFlags & TH32CS_SNAPPROCESS) {
|
|
|
|
PSYSTEM_PROCESS_INFORMATION ProcessInfo;
|
|
LPPROCESSENTRY32W pEntry;
|
|
ULONG cProcess = 0;
|
|
ULONG Offset1 = 0;
|
|
|
|
SnapshotBase->ProcessListHead = (PPROCESSENTRY32W)(BufferWriteAddr - (PUCHAR)SnapshotBase);
|
|
pEntry = (LPPROCESSENTRY32W)(BufferWriteAddr + cProcess * sizeof(PROCESSENTRY32W));
|
|
|
|
do {
|
|
/* get process info from buffer */
|
|
ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)&RawProcess[Offset1];
|
|
|
|
pEntry->dwSize = sizeof(PROCESSENTRY32W);
|
|
pEntry->th32ProcessID = HandleToUlong(ProcessInfo->UniqueProcessId);
|
|
pEntry->pcPriClassBase = ProcessInfo->BasePriority;
|
|
pEntry->cntThreads = ProcessInfo->NumberOfThreads;
|
|
pEntry->th32ParentProcessID = HandleToUlong(ProcessInfo->InheritedFromUniqueProcessId);
|
|
pEntry->cntUsage = 0;
|
|
pEntry->th32DefaultHeapID = 0;
|
|
pEntry->th32ModuleID = 0;
|
|
pEntry->dwFlags = 0;
|
|
|
|
// Path
|
|
if (ProcessInfo->ImageName.Buffer == NULL) {
|
|
lstrcpyW(pEntry->szExeFile, L"[System Process]");
|
|
} else {
|
|
if (ProcessInfo->ImageName.Length >= ARRAYSIZE(pEntry->szExeFile)) {
|
|
ProcessInfo->ImageName.Length = ARRAYSIZE(pEntry->szExeFile)-1;
|
|
}
|
|
memcpy(pEntry->szExeFile, ProcessInfo->ImageName.Buffer, ProcessInfo->ImageName.Length);
|
|
pEntry->szExeFile[ProcessInfo->ImageName.Length] = TEXT('\0');
|
|
}
|
|
|
|
Offset1 += ProcessInfo->NextEntryOffset;
|
|
++cProcess;
|
|
++pEntry;
|
|
|
|
} while (ProcessInfo->NextEntryOffset != 0);
|
|
|
|
// update the pointer to the write area
|
|
BufferWriteAddr = (PCHAR)(BufferWriteAddr + cProcess * sizeof(PROCESSENTRY32W));
|
|
}
|
|
|
|
//
|
|
// write thread list to snapshot
|
|
//
|
|
|
|
if (dwFlags & TH32CS_SNAPTHREAD) {
|
|
PSYSTEM_PROCESS_INFORMATION ProcessInfo;
|
|
PSYSTEM_THREAD_INFORMATION ThreadInfo;
|
|
LPTHREADENTRY32 tEntry;
|
|
ULONG Offset1 = 0;
|
|
ULONG cThread = 0;
|
|
|
|
SnapshotBase->ThreadListHead = (PTHREADENTRY32)(BufferWriteAddr - (PUCHAR)SnapshotBase);
|
|
tEntry = (LPTHREADENTRY32)(BufferWriteAddr + cThread * sizeof(THREADENTRY32));
|
|
|
|
do {
|
|
ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)&RawProcess[Offset1];
|
|
ThreadInfo = (PSYSTEM_THREAD_INFORMATION)(ProcessInfo + 1);
|
|
|
|
for (cThread = 0; cThread < ProcessInfo->NumberOfThreads; cThread++) {
|
|
|
|
tEntry->dwSize = sizeof(THREADENTRY32);
|
|
tEntry->th32ThreadID = HandleToUlong(ThreadInfo->ClientId.UniqueThread);
|
|
tEntry->th32OwnerProcessID = HandleToUlong(ThreadInfo->ClientId.UniqueProcess);
|
|
tEntry->tpBasePri = ThreadInfo->BasePriority;
|
|
tEntry->tpDeltaPri = 0;
|
|
tEntry->cntUsage = 0;
|
|
tEntry->dwFlags = 0;
|
|
|
|
++ThreadInfo;
|
|
++tEntry;
|
|
}
|
|
|
|
Offset1 += ProcessInfo->NextEntryOffset;
|
|
|
|
} while (ProcessInfo->NextEntryOffset != 0);
|
|
|
|
BufferWriteAddr = (PUCHAR)(BufferWriteAddr + cThread * sizeof(THREADENTRY32)); // update the pointer to the write area
|
|
}
|
|
|
|
if ((dwFlags & TH32CS_SNAPTHREAD) || (dwFlags & TH32CS_SNAPPROCESS)){
|
|
|
|
Size = 0;
|
|
NtFreeVirtualMemory(NtCurrentProcess(),
|
|
&RawProcess,
|
|
&Size,
|
|
MEM_RELEASE);
|
|
}
|
|
|
|
NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)SnapshotBase);
|
|
|
|
return STATUS_SUCCESS;
|
|
}
|