toolhelp.c File Reference

#include <k32.h>
#include <debug.h>

Include dependency graph for toolhelp.c:

Go to the source code of this file.

Classes
struct	_RTLP_HEAP_ENTRY
struct	_TH32SNAPSHOT

Macros
#define	NDEBUG
#define	CHECK_PARAM_SIZE(ptr, siz)
#define	CHECK_PARAM_SIZEA(ptr, siz)
#define	OffsetToPtr(Snapshot, Offset)    ((ULONG_PTR)((Snapshot) + 1) + (ULONG_PTR)(Offset))

Typedefs
typedef struct _RTLP_HEAP_ENTRY	RTLP_HEAP_ENTRY
typedef struct _RTLP_HEAP_ENTRY *	PRTLP_HEAP_ENTRY
typedef struct _TH32SNAPSHOT	TH32SNAPSHOT
typedef struct _TH32SNAPSHOT *	PTH32SNAPSHOT

Functions
static VOID	TH32FreeAllocatedResources (PRTL_DEBUG_INFORMATION HeapDebug, PRTL_DEBUG_INFORMATION ModuleDebug, PVOID ProcThrdInfo, SIZE_T ProcThrdInfoSize)
static NTSTATUS	TH32CreateSnapshot (DWORD dwFlags, DWORD th32ProcessID, PRTL_DEBUG_INFORMATION *HeapDebug, PRTL_DEBUG_INFORMATION *ModuleDebug, PVOID *ProcThrdInfo, SIZE_T *ProcThrdInfoSize)
static NTSTATUS	TH32CreateSnapshotSectionInitialize (DWORD dwFlags, DWORD th32ProcessID, PRTL_DEBUG_INFORMATION HeapDebug, PRTL_DEBUG_INFORMATION ModuleDebug, PVOID ProcThrdInfo, HANDLE *SectionHandle)
BOOL WINAPI	Heap32First (LPHEAPENTRY32 lphe, DWORD th32ProcessID, DWORD th32HeapID)
BOOL WINAPI	Heap32Next (LPHEAPENTRY32 lphe)
BOOL WINAPI	Heap32ListFirst (HANDLE hSnapshot, LPHEAPLIST32 lphl)
BOOL WINAPI	Heap32ListNext (HANDLE hSnapshot, LPHEAPLIST32 lphl)
BOOL WINAPI	Module32First (HANDLE hSnapshot, LPMODULEENTRY32 lpme)
BOOL WINAPI	Module32FirstW (HANDLE hSnapshot, LPMODULEENTRY32W lpme)
BOOL WINAPI	Module32Next (HANDLE hSnapshot, LPMODULEENTRY32 lpme)
BOOL WINAPI	Module32NextW (HANDLE hSnapshot, LPMODULEENTRY32W lpme)
BOOL WINAPI	Process32First (HANDLE hSnapshot, LPPROCESSENTRY32 lppe)
BOOL WINAPI	Process32FirstW (HANDLE hSnapshot, LPPROCESSENTRY32W lppe)
BOOL WINAPI	Process32Next (HANDLE hSnapshot, LPPROCESSENTRY32 lppe)
BOOL WINAPI	Process32NextW (HANDLE hSnapshot, LPPROCESSENTRY32W lppe)
BOOL WINAPI	Thread32First (HANDLE hSnapshot, LPTHREADENTRY32 lpte)
BOOL WINAPI	Thread32Next (HANDLE hSnapshot, LPTHREADENTRY32 lpte)
BOOL WINAPI	Toolhelp32ReadProcessMemory (DWORD th32ProcessID, LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T cbRead, SIZE_T *lpNumberOfBytesRead)
HANDLE WINAPI	CreateToolhelp32Snapshot (DWORD dwFlags, DWORD th32ProcessID)

Macro Definition Documentation

CHECK_PARAM_SIZE

#define CHECK_PARAM_SIZE	(		ptr,
			siz
	)

Value:

  if((ptr) == NULL || (ptr)->dwSize != (siz))                                  \
  {                                                                            \
    SetLastError(ERROR_INVALID_PARAMETER);                                     \
    return FALSE;                                                              \
  }

Definition at line 34 of file toolhelp.c.

CHECK_PARAM_SIZEA

#define CHECK_PARAM_SIZEA	(		ptr,
			siz
	)

Value:

  if((ptr) == NULL || (ptr)->dwSize < (siz))                                   \
  {                                                                            \
    SetLastError(ERROR_INVALID_PARAMETER);                                     \
    return FALSE;                                                              \
  }

Definition at line 48 of file toolhelp.c.

NDEBUG

#define NDEBUG

Definition at line 20 of file toolhelp.c.

OffsetToPtr

#define OffsetToPtr	(		Snapshot,
			Offset
	)		((ULONG_PTR)((Snapshot) + 1) + (ULONG_PTR)(Offset))

Definition at line 55 of file toolhelp.c.

Typedef Documentation

PRTLP_HEAP_ENTRY

typedef struct _RTLP_HEAP_ENTRY * PRTLP_HEAP_ENTRY

PTH32SNAPSHOT

typedef struct _TH32SNAPSHOT * PTH32SNAPSHOT

RTLP_HEAP_ENTRY

typedef struct _RTLP_HEAP_ENTRY RTLP_HEAP_ENTRY

TH32SNAPSHOT

typedef struct _TH32SNAPSHOT TH32SNAPSHOT

Function Documentation

CreateToolhelp32Snapshot()

HANDLE WINAPI CreateToolhelp32Snapshot	(	DWORD	dwFlags,
		DWORD	th32ProcessID
	)

Definition at line 1255 of file toolhelp.c.

{
  PRTL_DEBUG_INFORMATION HeapDebug, ModuleDebug;
  PVOID ProcThrdInfo;
  SIZE_T ProcThrdInfoSize;
  NTSTATUS Status;
  HANDLE hSnapShotSection = NULL;
 
  if(th32ProcessID == 0)
  {
    th32ProcessID = GetCurrentProcessId();
  }
 
  /*
   * Get all information required for the snapshot
   */
  Status = TH32CreateSnapshot(dwFlags,
                              th32ProcessID,
                              &HeapDebug,
                              &ModuleDebug,
                              &ProcThrdInfo,
                              &ProcThrdInfoSize);
  if(!NT_SUCCESS(Status))
  {
    BaseSetLastNTError(Status);
    return NULL;
  }
 
  /*
   * Create a section handle and initialize the collected information
   */
  Status = TH32CreateSnapshotSectionInitialize(dwFlags,
                                               th32ProcessID,
                                               HeapDebug,
                                               ModuleDebug,
                                               ProcThrdInfo,
                                               &hSnapShotSection);
 
  /*
   * Free the temporarily allocated memory which is no longer needed
   */
  TH32FreeAllocatedResources(HeapDebug,
                             ModuleDebug,
                             ProcThrdInfo,
                             ProcThrdInfoSize);
 
  if(!NT_SUCCESS(Status))
  {
    BaseSetLastNTError(Status);
    return NULL;
  }
 
  return hSnapShotSection;
}

Referenced by _DoDLLInjection(), enumerate_processes(), fill_process(), GetProcessID(), IntGetImageBase(), IsBlockFromHeap(), PrintBugreport(), and ShutdownProcessTree().

Heap32First()

BOOL WINAPI Heap32First	(	LPHEAPENTRY32	lphe,
		DWORD	th32ProcessID,
		DWORD	th32HeapID
	)

Definition at line 489 of file toolhelp.c.

{
  PRTL_DEBUG_INFORMATION DebugInfo;
  PRTL_HEAP_INFORMATION Heap;
  PRTLP_HEAP_ENTRY Block, LastBlock;
  ULONG i;
  NTSTATUS Status;
 
  CHECK_PARAM_SIZE(lphe, sizeof(HEAPENTRY32));
 
  DebugInfo = RtlCreateQueryDebugBuffer(0,
                                        FALSE);
  if (DebugInfo == NULL)
  {
    SetLastError(ERROR_NOT_ENOUGH_MEMORY);
    return FALSE;
  }
 
  Status = RtlQueryProcessDebugInformation(th32ProcessID,
                                           RTL_DEBUG_QUERY_HEAPS | RTL_DEBUG_QUERY_HEAP_BLOCKS,
                                           DebugInfo);
 
  if (NT_SUCCESS(Status))
  {
    Status = STATUS_NO_MORE_FILES;
 
    for (i = 0;
         i != DebugInfo->Heaps->NumberOfHeaps;
         i++)
    {
      Heap = &DebugInfo->Heaps->Heaps[i];
 
      if ((ULONG_PTR)Heap->BaseAddress == th32HeapID)
      {
        lphe->hHandle = (HANDLE)Heap->BaseAddress;
        lphe->dwAddress = 0;
        lphe->dwBlockSize = 0;
        lphe->dwFlags = 0;
        lphe->dwLockCount = 0;
        lphe->dwResvd = 0;
        lphe->th32ProcessID = th32ProcessID;
        lphe->th32HeapID = (ULONG_PTR)Heap->BaseAddress;
 
        Block = (PRTLP_HEAP_ENTRY)Heap->Entries;
        LastBlock = Block + Heap->NumberOfEntries;
 
        while (Block != LastBlock && (Block->Flags & PROCESS_HEAP_UNCOMMITTED_RANGE))
        {
          lphe->dwResvd++;
          lphe->dwAddress = (ULONG_PTR)((ULONG_PTR)Block->Address + Heap->EntryOverhead);
          Block++;
        }
 
        if (Block != LastBlock && lphe->dwResvd != 0)
        {
          lphe->dwBlockSize =  Block->Size;
 
          if (Block->Flags & 0x2F1) /* FIXME */
            lphe->dwFlags = LF32_FIXED;
          else if (Block->Flags & 0x20) /* FIXME */
            lphe->dwFlags = LF32_MOVEABLE;
          else if (Block->Flags & 0x100) /* FIXME */
            lphe->dwFlags = LF32_FREE;
 
          Status = STATUS_SUCCESS;
        }
 
        break;
      }
    }
  }
 
  RtlDestroyQueryDebugBuffer(DebugInfo);
 
  if (!NT_SUCCESS(Status))
  {
    BaseSetLastNTError(Status);
    return FALSE;
  }
 
  return TRUE;
}

Referenced by IsBlockFromHeap().

Heap32ListFirst()

BOOL WINAPI Heap32ListFirst	(	HANDLE	hSnapshot,
		LPHEAPLIST32	lphl
	)

Definition at line 669 of file toolhelp.c.

{
  PTH32SNAPSHOT Snapshot;
  LARGE_INTEGER SOffset;
  SIZE_T ViewSize;
  NTSTATUS Status;
 
  CHECK_PARAM_SIZE(lphl, sizeof(HEAPLIST32));
 
  SOffset.QuadPart = 0;
  ViewSize = 0;
  Snapshot = NULL;
 
  Status = NtMapViewOfSection(hSnapshot,
                              NtCurrentProcess(),
                              (PVOID*)&Snapshot,
                              0,
                              0,
                              &SOffset,
                              &ViewSize,
                              ViewShare,
                              0,
                              PAGE_READWRITE);
  if(NT_SUCCESS(Status))
  {
    BOOL Ret;
 
    if(Snapshot->HeapListCount > 0)
    {
      LPHEAPLIST32 Entries = (LPHEAPLIST32)OffsetToPtr(Snapshot, Snapshot->HeapListOffset);
      Snapshot->HeapListIndex = 1;
      RtlCopyMemory(lphl, &Entries[0], sizeof(HEAPLIST32));
      Ret = TRUE;
    }
    else
    {
      SetLastError(ERROR_NO_MORE_FILES);
      Ret = FALSE;
    }
 
    NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
    return Ret;
  }
 
  BaseSetLastNTError(Status);
  return FALSE;
}

Heap32ListNext()

BOOL WINAPI Heap32ListNext	(	HANDLE	hSnapshot,
		LPHEAPLIST32	lphl
	)

Definition at line 723 of file toolhelp.c.

{
  PTH32SNAPSHOT Snapshot;
  LARGE_INTEGER SOffset;
  SIZE_T ViewSize;
  NTSTATUS Status;
 
  CHECK_PARAM_SIZE(lphl, sizeof(HEAPLIST32));
 
  SOffset.QuadPart = 0;
  ViewSize = 0;
  Snapshot = NULL;
 
  Status = NtMapViewOfSection(hSnapshot,
                              NtCurrentProcess(),
                              (PVOID*)&Snapshot,
                              0,
                              0,
                              &SOffset,
                              &ViewSize,
                              ViewShare,
                              0,
                              PAGE_READWRITE);
  if(NT_SUCCESS(Status))
  {
    BOOL Ret;
 
    if(Snapshot->HeapListCount > 0 &&
       Snapshot->HeapListIndex < Snapshot->HeapListCount)
    {
      LPHEAPLIST32 Entries = (LPHEAPLIST32)OffsetToPtr(Snapshot, Snapshot->HeapListOffset);
      RtlCopyMemory(lphl, &Entries[Snapshot->HeapListIndex++], sizeof(HEAPLIST32));
      Ret = TRUE;
    }
    else
    {
      SetLastError(ERROR_NO_MORE_FILES);
      Ret = FALSE;
    }
 
    NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
    return Ret;
  }
 
  BaseSetLastNTError(Status);
  return FALSE;
}

Heap32Next()

BOOL WINAPI Heap32Next

(

LPHEAPENTRY32

lphe

)

Definition at line 578 of file toolhelp.c.

{
  PRTL_DEBUG_INFORMATION DebugInfo;
  PRTL_HEAP_INFORMATION Heap;
  PRTLP_HEAP_ENTRY Block, LastBlock;
  BOOLEAN FoundUncommitted = FALSE;
  ULONG i;
  NTSTATUS Status;
 
  CHECK_PARAM_SIZE(lphe, sizeof(HEAPENTRY32));
 
  DebugInfo = RtlCreateQueryDebugBuffer(0,
                                        FALSE);
  if (DebugInfo == NULL)
  {
    SetLastError(ERROR_NOT_ENOUGH_MEMORY);
    return FALSE;
  }
 
  Status = RtlQueryProcessDebugInformation(lphe->th32ProcessID,
                                           RTL_DEBUG_QUERY_HEAPS | RTL_DEBUG_QUERY_HEAP_BLOCKS,
                                           DebugInfo);
 
  if (NT_SUCCESS(Status))
  {
    Status = STATUS_NO_MORE_FILES;
 
    for (i = 0;
         i != DebugInfo->Heaps->NumberOfHeaps;
         i++)
    {
      Heap = &DebugInfo->Heaps->Heaps[i];
 
      if ((ULONG_PTR)Heap->BaseAddress == lphe->th32HeapID)
      {
        if (++lphe->dwResvd < Heap->NumberOfEntries)
        {
          lphe->dwFlags = 0;
 
          Block = (PRTLP_HEAP_ENTRY)Heap->Entries + lphe->dwResvd;
          LastBlock = (PRTLP_HEAP_ENTRY)Heap->Entries + Heap->NumberOfEntries;
 
          while (Block < LastBlock && (Block->Flags & PROCESS_HEAP_UNCOMMITTED_RANGE))
          {
            lphe->dwResvd++;
            lphe->dwAddress = (ULONG_PTR)((ULONG_PTR)Block->Address + Heap->EntryOverhead);
            FoundUncommitted = TRUE;
            Block++;
          }
 
          if (Block < LastBlock)
          {
            if (!FoundUncommitted)
              lphe->dwAddress += lphe->dwBlockSize;
 
            lphe->dwBlockSize =  Block->Size;
 
            if (Block->Flags & 0x2F1) /* FIXME */
              lphe->dwFlags = LF32_FIXED;
            else if (Block->Flags & 0x20) /* FIXME */
              lphe->dwFlags = LF32_MOVEABLE;
            else if (Block->Flags & 0x100) /* FIXME */
              lphe->dwFlags = LF32_FREE;
 
            Status = STATUS_SUCCESS;
          }
        }
 
        break;
      }
    }
  }
 
  RtlDestroyQueryDebugBuffer(DebugInfo);
 
  if (!NT_SUCCESS(Status))
  {
    BaseSetLastNTError(Status);
    return FALSE;
  }
 
  return TRUE;
 
}

Referenced by IsBlockFromHeap().

Module32First()

BOOL WINAPI Module32First	(	HANDLE	hSnapshot,
		LPMODULEENTRY32	lpme
	)

Definition at line 777 of file toolhelp.c.

{
  MODULEENTRY32W me;
  BOOL Ret;
 
  CHECK_PARAM_SIZEA(lpme, sizeof(MODULEENTRY32));
 
  me.dwSize = sizeof(MODULEENTRY32W);
 
  Ret = Module32FirstW(hSnapshot, &me);
  if(Ret)
  {
    lpme->th32ModuleID = me.th32ModuleID;
    lpme->th32ProcessID = me.th32ProcessID;
    lpme->GlblcntUsage = me.GlblcntUsage;
    lpme->ProccntUsage = me.ProccntUsage;
    lpme->modBaseAddr = me.modBaseAddr;
    lpme->modBaseSize = me.modBaseSize;
    lpme->hModule = me.hModule;
 
    WideCharToMultiByte(CP_ACP, 0, me.szModule, -1, lpme->szModule, sizeof(lpme->szModule), 0, 0);
    WideCharToMultiByte(CP_ACP, 0, me.szExePath, -1, lpme->szExePath, sizeof(lpme->szExePath), 0, 0);
  }
 
  return Ret;
}

Referenced by IntGetImageBase().

Module32FirstW()

BOOL WINAPI Module32FirstW	(	HANDLE	hSnapshot,
		LPMODULEENTRY32W	lpme
	)

Definition at line 810 of file toolhelp.c.

{
  PTH32SNAPSHOT Snapshot;
  LARGE_INTEGER SOffset;
  SIZE_T ViewSize;
  NTSTATUS Status;
 
  CHECK_PARAM_SIZE(lpme, sizeof(MODULEENTRY32W));
 
  SOffset.QuadPart = 0;
  ViewSize = 0;
  Snapshot = NULL;
 
  Status = NtMapViewOfSection(hSnapshot,
                              NtCurrentProcess(),
                              (PVOID*)&Snapshot,
                              0,
                              0,
                              &SOffset,
                              &ViewSize,
                              ViewShare,
                              0,
                              PAGE_READWRITE);
  if(NT_SUCCESS(Status))
  {
    BOOL Ret;
 
    if(Snapshot->ModuleListCount > 0)
    {
      LPMODULEENTRY32W Entries = (LPMODULEENTRY32W)OffsetToPtr(Snapshot, Snapshot->ModuleListOffset);
      Snapshot->ModuleListIndex = 1;
      RtlCopyMemory(lpme, &Entries[0], sizeof(MODULEENTRY32W));
      Ret = TRUE;
    }
    else
    {
      SetLastError(ERROR_NO_MORE_FILES);
      Ret = FALSE;
    }
 
    NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
    return Ret;
  }
 
  BaseSetLastNTError(Status);
  return FALSE;
}

Referenced by Module32First().

Module32Next()

BOOL WINAPI Module32Next	(	HANDLE	hSnapshot,
		LPMODULEENTRY32	lpme
	)

Definition at line 864 of file toolhelp.c.

{
  MODULEENTRY32W me;
  BOOL Ret;
 
  CHECK_PARAM_SIZEA(lpme, sizeof(MODULEENTRY32));
 
  me.dwSize = sizeof(MODULEENTRY32W);
 
  Ret = Module32NextW(hSnapshot, &me);
  if(Ret)
  {
    lpme->th32ModuleID = me.th32ModuleID;
    lpme->th32ProcessID = me.th32ProcessID;
    lpme->GlblcntUsage = me.GlblcntUsage;
    lpme->ProccntUsage = me.ProccntUsage;
    lpme->modBaseAddr = me.modBaseAddr;
    lpme->modBaseSize = me.modBaseSize;
    lpme->hModule = me.hModule;
 
    WideCharToMultiByte(CP_ACP, 0, me.szModule, -1, lpme->szModule, sizeof(lpme->szModule), 0, 0);
    WideCharToMultiByte(CP_ACP, 0, me.szExePath, -1, lpme->szExePath, sizeof(lpme->szExePath), 0, 0);
  }
 
  return Ret;
}

Referenced by IntGetImageBase().

Module32NextW()

BOOL WINAPI Module32NextW	(	HANDLE	hSnapshot,
		LPMODULEENTRY32W	lpme
	)

Definition at line 897 of file toolhelp.c.

{
  PTH32SNAPSHOT Snapshot;
  LARGE_INTEGER SOffset;
  SIZE_T ViewSize;
  NTSTATUS Status;
 
  CHECK_PARAM_SIZE(lpme, sizeof(MODULEENTRY32W));
 
  SOffset.QuadPart = 0;
  ViewSize = 0;
  Snapshot = NULL;
 
  Status = NtMapViewOfSection(hSnapshot,
                              NtCurrentProcess(),
                              (PVOID*)&Snapshot,
                              0,
                              0,
                              &SOffset,
                              &ViewSize,
                              ViewShare,
                              0,
                              PAGE_READWRITE);
  if(NT_SUCCESS(Status))
  {
    BOOL Ret;
 
    if((Snapshot->ModuleListCount > 0) &&
       (Snapshot->ModuleListIndex < Snapshot->ModuleListCount))
    {
      LPMODULEENTRY32W Entries = (LPMODULEENTRY32W)OffsetToPtr(Snapshot, Snapshot->ModuleListOffset);
      RtlCopyMemory(lpme, &Entries[Snapshot->ModuleListIndex++], sizeof(MODULEENTRY32W));
      Ret = TRUE;
    }
    else
    {
      SetLastError(ERROR_NO_MORE_FILES);
      Ret = FALSE;
    }
 
    NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
    return Ret;
  }
 
  BaseSetLastNTError(Status);
  return FALSE;
}

Referenced by Module32Next().

Process32First()

BOOL WINAPI Process32First	(	HANDLE	hSnapshot,
		LPPROCESSENTRY32	lppe
	)

Definition at line 951 of file toolhelp.c.

{
  PROCESSENTRY32W pe;
  BOOL Ret;
 
  CHECK_PARAM_SIZEA(lppe, sizeof(PROCESSENTRY32));
 
  pe.dwSize = sizeof(PROCESSENTRY32W);
 
  Ret = Process32FirstW(hSnapshot, &pe);
  if(Ret)
  {
    lppe->cntUsage = pe.cntUsage;
    lppe->th32ProcessID = pe.th32ProcessID;
    lppe->th32DefaultHeapID = pe.th32DefaultHeapID;
    lppe->th32ModuleID = pe.th32ModuleID;
    lppe->cntThreads = pe.cntThreads;
    lppe->th32ParentProcessID = pe.th32ParentProcessID;
    lppe->pcPriClassBase = pe.pcPriClassBase;
    lppe->dwFlags = pe.dwFlags;
 
    WideCharToMultiByte(CP_ACP, 0, pe.szExeFile, -1, lppe->szExeFile, sizeof(lppe->szExeFile), 0, 0);
  }
 
  return Ret;
}

Referenced by PrintBugreport().

Process32FirstW()

BOOL WINAPI Process32FirstW	(	HANDLE	hSnapshot,
		LPPROCESSENTRY32W	lppe
	)

Definition at line 984 of file toolhelp.c.

{
  PTH32SNAPSHOT Snapshot;
  LARGE_INTEGER SOffset;
  SIZE_T ViewSize;
  NTSTATUS Status;
 
  CHECK_PARAM_SIZE(lppe, sizeof(PROCESSENTRY32W));
 
  SOffset.QuadPart = 0;
  ViewSize = 0;
  Snapshot = NULL;
 
  Status = NtMapViewOfSection(hSnapshot,
                              NtCurrentProcess(),
                              (PVOID*)&Snapshot,
                              0,
                              0,
                              &SOffset,
                              &ViewSize,
                              ViewShare,
                              0,
                              PAGE_READWRITE);
  if(NT_SUCCESS(Status))
  {
    BOOL Ret;
 
    if(Snapshot->ProcessListCount > 0)
    {
      LPPROCESSENTRY32W Entries = (LPPROCESSENTRY32W)OffsetToPtr(Snapshot, Snapshot->ProcessListOffset);
 
      Snapshot->ProcessListIndex = 1;
      RtlCopyMemory(lppe, &Entries[0], sizeof(PROCESSENTRY32W));
      Ret = TRUE;
    }
    else
    {
 
      SetLastError(ERROR_NO_MORE_FILES);
      Ret = FALSE;
    }
 
    NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
    return Ret;
  }
 
  BaseSetLastNTError(Status);
  return FALSE;
}

Referenced by _DoDLLInjection(), enumerate_processes(), fill_process(), GetProcessID(), Process32First(), and ShutdownProcessTreeHelper().

Process32Next()

BOOL WINAPI Process32Next	(	HANDLE	hSnapshot,
		LPPROCESSENTRY32	lppe
	)

Definition at line 1040 of file toolhelp.c.

{
  PROCESSENTRY32W pe;
  BOOL Ret;
 
  CHECK_PARAM_SIZEA(lppe, sizeof(PROCESSENTRY32));
 
  pe.dwSize = sizeof(PROCESSENTRY32W);
 
  Ret = Process32NextW(hSnapshot, &pe);
  if(Ret)
  {
    lppe->cntUsage = pe.cntUsage;
    lppe->th32ProcessID = pe.th32ProcessID;
    lppe->th32DefaultHeapID = pe.th32DefaultHeapID;
    lppe->th32ModuleID = pe.th32ModuleID;
    lppe->cntThreads = pe.cntThreads;
    lppe->th32ParentProcessID = pe.th32ParentProcessID;
    lppe->pcPriClassBase = pe.pcPriClassBase;
    lppe->dwFlags = pe.dwFlags;
 
    WideCharToMultiByte(CP_ACP, 0, pe.szExeFile, -1, lppe->szExeFile, sizeof(lppe->szExeFile), 0, 0);
  }
 
  return Ret;
}

Referenced by PrintBugreport().

Process32NextW()

BOOL WINAPI Process32NextW	(	HANDLE	hSnapshot,
		LPPROCESSENTRY32W	lppe
	)

Definition at line 1073 of file toolhelp.c.

{
  PTH32SNAPSHOT Snapshot;
  LARGE_INTEGER SOffset;
  SIZE_T ViewSize;
  NTSTATUS Status;
 
  CHECK_PARAM_SIZE(lppe, sizeof(PROCESSENTRY32W));
 
  SOffset.QuadPart = 0;
  ViewSize = 0;
  Snapshot = NULL;
 
  Status = NtMapViewOfSection(hSnapshot,
                              NtCurrentProcess(),
                              (PVOID*)&Snapshot,
                              0,
                              0,
                              &SOffset,
                              &ViewSize,
                              ViewShare,
                              0,
                              PAGE_READWRITE);
  if(NT_SUCCESS(Status))
  {
    BOOL Ret;
 
    if(Snapshot->ProcessListCount > 0 &&
       Snapshot->ProcessListIndex < Snapshot->ProcessListCount)
    {
      LPPROCESSENTRY32W Entries = (LPPROCESSENTRY32W)OffsetToPtr(Snapshot, Snapshot->ProcessListOffset);
      RtlCopyMemory(lppe, &Entries[Snapshot->ProcessListIndex++], sizeof(PROCESSENTRY32W));
      Ret = TRUE;
    }
    else
    {
      SetLastError(ERROR_NO_MORE_FILES);
      Ret = FALSE;
    }
 
    NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
    return Ret;
  }
 
  BaseSetLastNTError(Status);
  return FALSE;
}

Referenced by _DoDLLInjection(), enumerate_processes(), fill_process(), GetProcessID(), Process32Next(), and ShutdownProcessTreeHelper().

TH32CreateSnapshot()

static NTSTATUS TH32CreateSnapshot ( DWORD  dwFlags, DWORD  th32ProcessID, PRTL_DEBUG_INFORMATION *  HeapDebug, PRTL_DEBUG_INFORMATION *  ModuleDebug, PVOID *  ProcThrdInfo, SIZE_T *  ProcThrdInfoSize  )

static

Definition at line 105 of file toolhelp.c.

{
  NTSTATUS Status = STATUS_SUCCESS;
 
  *HeapDebug = NULL;
  *ModuleDebug = NULL;
  *ProcThrdInfo = NULL;
  *ProcThrdInfoSize = 0;
 
  /*
   * Allocate the debug information for a heap snapshot
   */
  if(dwFlags & TH32CS_SNAPHEAPLIST)
  {
    *HeapDebug = RtlCreateQueryDebugBuffer(0, FALSE);
    if(*HeapDebug != NULL)
    {
      Status = RtlQueryProcessDebugInformation(th32ProcessID,
                                               RTL_DEBUG_QUERY_HEAPS,
                                               *HeapDebug);
    }
    else
      Status = STATUS_UNSUCCESSFUL;
  }
 
  /*
   * Allocate the debug information for a module snapshot
   */
  if(dwFlags & TH32CS_SNAPMODULE &&
     NT_SUCCESS(Status))
  {
    *ModuleDebug = RtlCreateQueryDebugBuffer(0, FALSE);
    if(*ModuleDebug != NULL)
    {
      Status = RtlQueryProcessDebugInformation(th32ProcessID,
                                               RTL_DEBUG_QUERY_MODULES,
                                               *ModuleDebug);
    }
    else
      Status = STATUS_UNSUCCESSFUL;
  }
 
  /*
   * Allocate enough memory for the system's process list
   */
 
  if(dwFlags & (TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD) &&
     NT_SUCCESS(Status))
  {
    for(;;)
    {
      (*ProcThrdInfoSize) += 0x10000;
      Status = NtAllocateVirtualMemory(NtCurrentProcess(),
                                       ProcThrdInfo,
                                       0,
                                       ProcThrdInfoSize,
                                       MEM_COMMIT,
                                       PAGE_READWRITE);
      if(!NT_SUCCESS(Status))
      {
        break;
      }
 
      Status = NtQuerySystemInformation(SystemProcessInformation,
                                        *ProcThrdInfo,
                                        *ProcThrdInfoSize,
                                        NULL);
      if(Status == STATUS_INFO_LENGTH_MISMATCH)
      {
        NtFreeVirtualMemory(NtCurrentProcess(),
                            ProcThrdInfo,
                            ProcThrdInfoSize,
                            MEM_RELEASE);
        *ProcThrdInfo = NULL;
      }
      else
      {
        break;
      }
    }
  }
 
  /*
   * Free resources in case of failure!
   */
 
  if(!NT_SUCCESS(Status))
  {
    TH32FreeAllocatedResources(*HeapDebug,
                               *ModuleDebug,
                               *ProcThrdInfo,
                               *ProcThrdInfoSize);
  }
 
  return Status;
}

Referenced by CreateToolhelp32Snapshot().

TH32CreateSnapshotSectionInitialize()

static NTSTATUS TH32CreateSnapshotSectionInitialize ( DWORD  dwFlags, DWORD  th32ProcessID, PRTL_DEBUG_INFORMATION  HeapDebug, PRTL_DEBUG_INFORMATION  ModuleDebug, PVOID  ProcThrdInfo, HANDLE *  SectionHandle  )

static

Definition at line 208 of file toolhelp.c.

{
  PSYSTEM_PROCESS_INFORMATION ProcessInfo;
  LPHEAPLIST32 HeapListEntry;
  LPMODULEENTRY32W ModuleListEntry;
  LPPROCESSENTRY32W ProcessListEntry;
  LPTHREADENTRY32 ThreadListEntry;
  OBJECT_ATTRIBUTES ObjectAttributes;
  LARGE_INTEGER SSize, SOffset;
  HANDLE hSection;
  PTH32SNAPSHOT Snapshot;
  ULONG_PTR DataOffset;
  SIZE_T ViewSize;
  ULONG i, nProcesses = 0, nThreads = 0, nHeaps = 0, nModules = 0;
  ULONG RequiredSnapshotSize = sizeof(TH32SNAPSHOT);
  PRTL_PROCESS_HEAPS hi = NULL;
  PRTL_PROCESS_MODULES mi = NULL;
  NTSTATUS Status = STATUS_SUCCESS;
 
  /*
   * Determine the required size for the heap snapshot
   */
  if(dwFlags & TH32CS_SNAPHEAPLIST)
  {
    hi = (PRTL_PROCESS_HEAPS)HeapDebug->Heaps;
    nHeaps = hi->NumberOfHeaps;
    RequiredSnapshotSize += nHeaps * sizeof(HEAPLIST32);
  }
 
  /*
   * Determine the required size for the module snapshot
   */
  if(dwFlags & TH32CS_SNAPMODULE)
  {
    mi = (PRTL_PROCESS_MODULES)ModuleDebug->Modules;
    nModules = mi->NumberOfModules;
    RequiredSnapshotSize += nModules * sizeof(MODULEENTRY32W);
  }
 
  /*
   * Determine the required size for the processes and threads snapshot
   */
  if(dwFlags & (TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD))
  {
    ULONG ProcOffset = 0;
 
    ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)ProcThrdInfo;
    do
    {
      ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)((ULONG_PTR)ProcessInfo + ProcOffset);
      nProcesses++;
      nThreads += ProcessInfo->NumberOfThreads;
      ProcOffset = ProcessInfo->NextEntryOffset;
    } while(ProcOffset != 0);
 
    if(dwFlags & TH32CS_SNAPPROCESS)
    {
      RequiredSnapshotSize += nProcesses * sizeof(PROCESSENTRY32W);
    }
    if(dwFlags & TH32CS_SNAPTHREAD)
    {
      RequiredSnapshotSize += nThreads * sizeof(THREADENTRY32);
    }
  }
 
  /*
   * Create and map the section
   */
 
  SSize.QuadPart = RequiredSnapshotSize;
 
  InitializeObjectAttributes(&ObjectAttributes,
                             NULL,
                             ((dwFlags & TH32CS_INHERIT) ? OBJ_INHERIT : 0),
                 NULL,
                 NULL);
 
  Status = NtCreateSection(&hSection,
                           SECTION_ALL_ACCESS,
                           &ObjectAttributes,
                           &SSize,
                           PAGE_READWRITE,
                           SEC_COMMIT,
                           NULL);
  if(!NT_SUCCESS(Status))
  {
    return Status;
  }
 
  SOffset.QuadPart = 0;
  ViewSize = 0;
  Snapshot = NULL;
 
  Status = NtMapViewOfSection(hSection,
                              NtCurrentProcess(),
                              (PVOID*)&Snapshot,
                              0,
                              0,
                              &SOffset,
                              &ViewSize,
                              ViewShare,
                              0,
                              PAGE_READWRITE);
  if(!NT_SUCCESS(Status))
  {
    NtClose(hSection);
    return Status;
  }
 
  RtlZeroMemory(Snapshot, sizeof(TH32SNAPSHOT));
  DataOffset = 0;
 
  /*
   * Initialize the section data and fill it with all the data we collected
   */
 
  /* initialize the heap list */
  if(dwFlags & TH32CS_SNAPHEAPLIST)
  {
    Snapshot->HeapListCount = nHeaps;
    Snapshot->HeapListOffset = DataOffset;
    HeapListEntry = (LPHEAPLIST32)OffsetToPtr(Snapshot, DataOffset);
    for(i = 0; i < nHeaps; i++)
    {
      HeapListEntry->dwSize = sizeof(HEAPLIST32);
      HeapListEntry->th32ProcessID = th32ProcessID;
      HeapListEntry->th32HeapID = (ULONG_PTR)hi->Heaps[i].BaseAddress;
      HeapListEntry->dwFlags = hi->Heaps[i].Flags;
 
      HeapListEntry++;
    }
 
    DataOffset += hi->NumberOfHeaps * sizeof(HEAPLIST32);
  }
 
  /* initialize the module list */
  if(dwFlags & TH32CS_SNAPMODULE)
  {
    Snapshot->ModuleListCount = nModules;
    Snapshot->ModuleListOffset = DataOffset;
    ModuleListEntry = (LPMODULEENTRY32W)OffsetToPtr(Snapshot, DataOffset);
    for(i = 0; i < nModules; i++)
    {
      ModuleListEntry->dwSize = sizeof(MODULEENTRY32W);
      ModuleListEntry->th32ModuleID = 1; /* no longer used, always set to one! */
      ModuleListEntry->th32ProcessID = th32ProcessID;
      ModuleListEntry->GlblcntUsage = mi->Modules[i].LoadCount;
      ModuleListEntry->ProccntUsage = mi->Modules[i].LoadCount;
      ModuleListEntry->modBaseAddr = (BYTE*)mi->Modules[i].ImageBase;
      ModuleListEntry->modBaseSize = mi->Modules[i].ImageSize;
      ModuleListEntry->hModule = (HMODULE)mi->Modules[i].ImageBase;
 
      MultiByteToWideChar(CP_ACP,
                          0,
                          &mi->Modules[i].FullPathName[mi->Modules[i].OffsetToFileName],
                          -1,
                          ModuleListEntry->szModule,
                          sizeof(ModuleListEntry->szModule) / sizeof(ModuleListEntry->szModule[0]));
 
      MultiByteToWideChar(CP_ACP,
                          0,
                          mi->Modules[i].FullPathName,
                          -1,
                          ModuleListEntry->szExePath,
                          sizeof(ModuleListEntry->szExePath) / sizeof(ModuleListEntry->szExePath[0]));
 
      ModuleListEntry++;
    }
 
    DataOffset += mi->NumberOfModules * sizeof(MODULEENTRY32W);
  }
 
  /* initialize the process list */
  if(dwFlags & TH32CS_SNAPPROCESS)
  {
    ULONG ProcOffset = 0;
 
    Snapshot->ProcessListCount = nProcesses;
    Snapshot->ProcessListOffset = DataOffset;
    ProcessListEntry = (LPPROCESSENTRY32W)OffsetToPtr(Snapshot, DataOffset);
    ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)ProcThrdInfo;
    do
    {
      ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)((ULONG_PTR)ProcessInfo + ProcOffset);
 
      ProcessListEntry->dwSize = sizeof(PROCESSENTRY32W);
      ProcessListEntry->cntUsage = 0; /* no longer used */
      ProcessListEntry->th32ProcessID = (ULONG_PTR)ProcessInfo->UniqueProcessId;
      ProcessListEntry->th32DefaultHeapID = 0; /* no longer used */
      ProcessListEntry->th32ModuleID = 0; /* no longer used */
      ProcessListEntry->cntThreads = ProcessInfo->NumberOfThreads;
      ProcessListEntry->th32ParentProcessID = (ULONG_PTR)ProcessInfo->InheritedFromUniqueProcessId;
      ProcessListEntry->pcPriClassBase = ProcessInfo->BasePriority;
      ProcessListEntry->dwFlags = 0; /* no longer used */
      if(ProcessInfo->ImageName.Buffer != NULL)
      {
        ULONG ExeFileLength = min(ProcessInfo->ImageName.Length,
                                  sizeof(ProcessListEntry->szExeFile) - sizeof(WCHAR));
        RtlCopyMemory(ProcessListEntry->szExeFile,
                      ProcessInfo->ImageName.Buffer,
                      ExeFileLength);
        ProcessListEntry->szExeFile[ExeFileLength / sizeof(WCHAR)] = UNICODE_NULL;
      }
      else
      {
        lstrcpyW(ProcessListEntry->szExeFile, L"[System Process]");
      }
 
      ProcessListEntry++;
 
      ProcOffset = ProcessInfo->NextEntryOffset;
    } while(ProcOffset != 0);
 
    DataOffset += nProcesses * sizeof(PROCESSENTRY32W);
  }
 
  /* initialize the thread list */
  if(dwFlags & TH32CS_SNAPTHREAD)
  {
    ULONG ProcOffset = 0;
 
    Snapshot->ThreadListCount = nThreads;
    Snapshot->ThreadListOffset = DataOffset;
    ThreadListEntry = (LPTHREADENTRY32)OffsetToPtr(Snapshot, DataOffset);
    ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)ProcThrdInfo;
    do
    {
      PSYSTEM_THREAD_INFORMATION ThreadInfo;
      ULONG n;
 
      ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)((ULONG_PTR)ProcessInfo + ProcOffset);
      ThreadInfo = (PSYSTEM_THREAD_INFORMATION)(ProcessInfo + 1);
 
      for(n = 0; n < ProcessInfo->NumberOfThreads; n++)
      {
        ThreadListEntry->dwSize = sizeof(THREADENTRY32);
        ThreadListEntry->cntUsage = 0; /* no longer used */
        ThreadListEntry->th32ThreadID = (ULONG_PTR)ThreadInfo->ClientId.UniqueThread;
        ThreadListEntry->th32OwnerProcessID = (ULONG_PTR)ThreadInfo->ClientId.UniqueProcess;
        ThreadListEntry->tpBasePri = ThreadInfo->BasePriority;
        ThreadListEntry->tpDeltaPri = 0; /* no longer used */
        ThreadListEntry->dwFlags = 0; /* no longer used */
 
        ThreadInfo++;
        ThreadListEntry++;
      }
 
      ProcOffset = ProcessInfo->NextEntryOffset;
    } while(ProcOffset != 0);
  }
 
  /*
   * We're done, unmap the view and return the section handle
   */
 
  Status = NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
 
  if(NT_SUCCESS(Status))
  {
    *SectionHandle = hSection;
  }
  else
  {
    NtClose(hSection);
  }
 
  return Status;
}

Referenced by CreateToolhelp32Snapshot().

TH32FreeAllocatedResources()

static VOID TH32FreeAllocatedResources ( PRTL_DEBUG_INFORMATION  HeapDebug, PRTL_DEBUG_INFORMATION  ModuleDebug, PVOID  ProcThrdInfo, SIZE_T  ProcThrdInfoSize  )

static

Definition at line 81 of file toolhelp.c.

{
  if(HeapDebug != NULL)
  {
    RtlDestroyQueryDebugBuffer(HeapDebug);
  }
  if(ModuleDebug != NULL)
  {
    RtlDestroyQueryDebugBuffer(ModuleDebug);
  }
 
  if(ProcThrdInfo != NULL)
  {
    NtFreeVirtualMemory(NtCurrentProcess(),
                        &ProcThrdInfo,
                        &ProcThrdInfoSize,
                        MEM_RELEASE);
  }
}

Referenced by CreateToolhelp32Snapshot(), and TH32CreateSnapshot().

Thread32First()

BOOL WINAPI Thread32First	(	HANDLE	hSnapshot,
		LPTHREADENTRY32	lpte
	)

Definition at line 1127 of file toolhelp.c.

{
  PTH32SNAPSHOT Snapshot;
  LARGE_INTEGER SOffset;
  SIZE_T ViewSize;
  NTSTATUS Status;
 
  CHECK_PARAM_SIZE(lpte, sizeof(THREADENTRY32));
 
  SOffset.QuadPart = 0;
  ViewSize = 0;
  Snapshot = NULL;
 
  Status = NtMapViewOfSection(hSnapshot,
                              NtCurrentProcess(),
                              (PVOID*)&Snapshot,
                              0,
                              0,
                              &SOffset,
                              &ViewSize,
                              ViewShare,
                              0,
                              PAGE_READWRITE);
  if(NT_SUCCESS(Status))
  {
    BOOL Ret;
 
    if(Snapshot->ThreadListCount > 0)
    {
      LPTHREADENTRY32 Entries = (LPTHREADENTRY32)OffsetToPtr(Snapshot, Snapshot->ThreadListOffset);
      Snapshot->ThreadListIndex = 1;
      RtlCopyMemory(lpte, &Entries[0], sizeof(THREADENTRY32));
      Ret = TRUE;
    }
    else
    {
      SetLastError(ERROR_NO_MORE_FILES);
      Ret = FALSE;
    }
 
    NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
    return Ret;
  }
 
  BaseSetLastNTError(Status);
  return FALSE;
}

Thread32Next()

BOOL WINAPI Thread32Next	(	HANDLE	hSnapshot,
		LPTHREADENTRY32	lpte
	)

Definition at line 1181 of file toolhelp.c.

{
  PTH32SNAPSHOT Snapshot;
  LARGE_INTEGER SOffset;
  SIZE_T ViewSize;
  NTSTATUS Status;
 
  CHECK_PARAM_SIZE(lpte, sizeof(THREADENTRY32));
 
  SOffset.QuadPart = 0;
  ViewSize = 0;
  Snapshot = NULL;
 
  Status = NtMapViewOfSection(hSnapshot,
                              NtCurrentProcess(),
                              (PVOID*)&Snapshot,
                              0,
                              0,
                              &SOffset,
                              &ViewSize,
                              ViewShare,
                              0,
                              PAGE_READWRITE);
  if(NT_SUCCESS(Status))
  {
    BOOL Ret;
 
    if(Snapshot->ThreadListCount > 0 &&
       Snapshot->ThreadListIndex < Snapshot->ThreadListCount)
    {
      LPTHREADENTRY32 Entries = (LPTHREADENTRY32)OffsetToPtr(Snapshot, Snapshot->ThreadListOffset);
      RtlCopyMemory(lpte, &Entries[Snapshot->ThreadListIndex++], sizeof(THREADENTRY32));
      Ret = TRUE;
    }
    else
    {
      SetLastError(ERROR_NO_MORE_FILES);
      Ret = FALSE;
    }
 
    NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
    return Ret;
  }
 
  BaseSetLastNTError(Status);
  return FALSE;
}

Toolhelp32ReadProcessMemory()

BOOL WINAPI Toolhelp32ReadProcessMemory	(	DWORD	th32ProcessID,
		LPCVOID	lpBaseAddress,
		LPVOID	lpBuffer,
		SIZE_T	cbRead,
		SIZE_T *	lpNumberOfBytesRead
	)

Definition at line 1235 of file toolhelp.c.

{
  HANDLE hProcess = OpenProcess(PROCESS_VM_READ, FALSE, th32ProcessID);
  if(hProcess != NULL)
  {
    BOOL Ret = ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, cbRead, lpNumberOfBytesRead);
    CloseHandle(hProcess);
    return Ret;
  }
 
  return FALSE;
}