reactos/dll/win32/kernel32/client/toolhelp.c

   1 /*
   2  * COPYRIGHT:       See COPYING in the top level directory
   3  * PROJECT:         ReactOS system libraries
   4  * FILE:            dll/win32/kernel32/misc/toolhelp.c
   5  * PURPOSE:         Toolhelp functions
   6  * PROGRAMMER:      Thomas Weidenmueller <w3seek@reactos.com>
   7  *                  Robert Dickenson (robd@mok.lvcm.com)
   8  *
   9  * NOTES:           Do NOT use the heap functions in here because they
  10  *                  adulterate the heap statistics!
  11  *
  12  * UPDATE HISTORY:
  13  *                  10/30/2004 Implemented some parts (w3)
  14  *                             Inspired by the book "Windows NT Native API"
  15  *                  Created 05 January 2003 (robd)
  16  */
  17
  18 #include <k32.h>
  19
  20 #define NDEBUG
  21 #include <debug.h>
  22
  23 /* INTERNAL DEFINITIONS *******************************************************/
  24
  25 typedef struct _RTLP_HEAP_ENTRY
  26 {
  27     ULONG Size;
  28     USHORT Flags;
  29     USHORT Unknown1; /* FIXME */
  30     ULONG Unknown2; /* FIXME */
  31     PVOID Address;
  32 } RTLP_HEAP_ENTRY, *PRTLP_HEAP_ENTRY;
  33
  34 #define CHECK_PARAM_SIZE(ptr, siz)                                             \
  35   if((ptr) == NULL || (ptr)->dwSize != (siz))                                  \
  36   {                                                                            \
  37     SetLastError(ERROR_INVALID_PARAMETER);                                     \
  38     return FALSE;                                                              \
  39   }
  40
  41 /*
  42  * Tests in win showed that the dwSize field can be greater than the actual size
  43  * of the structure for the ansi functions. I found this out by accidently
  44  * forgetting to set the dwSize field in a test application and it just didn't
  45  * work in ros but in win.
  46  */
  47
  48 #define CHECK_PARAM_SIZEA(ptr, siz)                                            \
  49   if((ptr) == NULL || (ptr)->dwSize < (siz))                                   \
  50   {                                                                            \
  51     SetLastError(ERROR_INVALID_PARAMETER);                                     \
  52     return FALSE;                                                              \
  53   }
  54
  55 #define OffsetToPtr(Snapshot, Offset)                                          \
  56   ((ULONG_PTR)((Snapshot) + 1) + (ULONG_PTR)(Offset))
  57
  58 typedef struct _TH32SNAPSHOT
  59 {
  60   /* Heap list */
  61   ULONG HeapListCount;
  62   ULONG HeapListIndex;
  63   ULONG_PTR HeapListOffset;
  64   /* Module list */
  65   ULONG ModuleListCount;
  66   ULONG ModuleListIndex;
  67   ULONG_PTR ModuleListOffset;
  68   /* Process list */
  69   ULONG ProcessListCount;
  70   ULONG ProcessListIndex;
  71   ULONG_PTR ProcessListOffset;
  72   /* Thread list */
  73   ULONG ThreadListCount;
  74   ULONG ThreadListIndex;
  75   ULONG_PTR ThreadListOffset;
  76 } TH32SNAPSHOT, *PTH32SNAPSHOT;
  77
  78 /* INTERNAL FUNCTIONS *********************************************************/
  79
  80 static VOID
  81 TH32FreeAllocatedResources(PRTL_DEBUG_INFORMATION HeapDebug,
  82                            PRTL_DEBUG_INFORMATION ModuleDebug,
  83                            PVOID ProcThrdInfo,
  84                            SIZE_T ProcThrdInfoSize)
  85 {
  86   if(HeapDebug != NULL)
  87   {
  88     RtlDestroyQueryDebugBuffer(HeapDebug);
  89   }
  90   if(ModuleDebug != NULL)
  91   {
  92     RtlDestroyQueryDebugBuffer(ModuleDebug);
  93   }
  94
  95   if(ProcThrdInfo != NULL)
  96   {
  97     NtFreeVirtualMemory(NtCurrentProcess(),
  98                         &ProcThrdInfo,
  99                         &ProcThrdInfoSize,
 100                         MEM_RELEASE);
 101   }
 102 }
 103
 104 static NTSTATUS
 105 TH32CreateSnapshot(DWORD dwFlags,
 106                    DWORD th32ProcessID,
 107                    PRTL_DEBUG_INFORMATION *HeapDebug,
 108                    PRTL_DEBUG_INFORMATION *ModuleDebug,
 109                    PVOID *ProcThrdInfo,
 110                    SIZE_T *ProcThrdInfoSize)
 111 {
 112   NTSTATUS Status = STATUS_SUCCESS;
 113
 114   *HeapDebug = NULL;
 115   *ModuleDebug = NULL;
 116   *ProcThrdInfo = NULL;
 117   *ProcThrdInfoSize = 0;
 118
 119   /*
 120    * Allocate the debug information for a heap snapshot
 121    */
 122   if(dwFlags & TH32CS_SNAPHEAPLIST)
 123   {
 124     *HeapDebug = RtlCreateQueryDebugBuffer(0, FALSE);
 125     if(*HeapDebug != NULL)
 126     {
 127       Status = RtlQueryProcessDebugInformation(th32ProcessID,
 128                                                RTL_DEBUG_QUERY_HEAPS,
 129                                                *HeapDebug);
 130     }
 131     else
 132       Status = STATUS_UNSUCCESSFUL;
 133   }
 134
 135   /*
 136    * Allocate the debug information for a module snapshot
 137    */
 138   if(dwFlags & TH32CS_SNAPMODULE &&
 139      NT_SUCCESS(Status))
 140   {
 141     *ModuleDebug = RtlCreateQueryDebugBuffer(0, FALSE);
 142     if(*ModuleDebug != NULL)
 143     {
 144       Status = RtlQueryProcessDebugInformation(th32ProcessID,
 145                                                RTL_DEBUG_QUERY_MODULES,
 146                                                *ModuleDebug);
 147     }
 148     else
 149       Status = STATUS_UNSUCCESSFUL;
 150   }
 151
 152   /*
 153    * Allocate enough memory for the system's process list
 154    */
 155
 156   if(dwFlags & (TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD) &&
 157      NT_SUCCESS(Status))
 158   {
 159     for(;;)
 160     {
 161       (*ProcThrdInfoSize) += 0x10000;
 162       Status = NtAllocateVirtualMemory(NtCurrentProcess(),
 163                                        ProcThrdInfo,
 164                                        0,
 165                                        ProcThrdInfoSize,
 166                                        MEM_COMMIT,
 167                                        PAGE_READWRITE);
 168       if(!NT_SUCCESS(Status))
 169       {
 170         break;
 171       }
 172
 173       Status = NtQuerySystemInformation(SystemProcessInformation,
 174                                         *ProcThrdInfo,
 175                                         *ProcThrdInfoSize,
 176                                         NULL);
 177       if(Status == STATUS_INFO_LENGTH_MISMATCH)
 178       {
 179         NtFreeVirtualMemory(NtCurrentProcess(),
 180                             ProcThrdInfo,
 181                             ProcThrdInfoSize,
 182                             MEM_RELEASE);
 183         *ProcThrdInfo = NULL;
 184       }
 185       else
 186       {
 187         break;
 188       }
 189     }
 190   }
 191
 192   /*
 193    * Free resources in case of failure!
 194    */
 195
 196   if(!NT_SUCCESS(Status))
 197   {
 198     TH32FreeAllocatedResources(*HeapDebug,
 199                                *ModuleDebug,
 200                                *ProcThrdInfo,
 201                                *ProcThrdInfoSize);
 202   }
 203
 204   return Status;
 205 }
 206
 207 static NTSTATUS
 208 TH32CreateSnapshotSectionInitialize(DWORD dwFlags,
 209                                     DWORD th32ProcessID,
 210                                     PRTL_DEBUG_INFORMATION HeapDebug,
 211                                     PRTL_DEBUG_INFORMATION ModuleDebug,
 212                                     PVOID ProcThrdInfo,
 213                                     HANDLE *SectionHandle)
 214 {
 215   PSYSTEM_PROCESS_INFORMATION ProcessInfo;
 216   LPHEAPLIST32 HeapListEntry;
 217   LPMODULEENTRY32W ModuleListEntry;
 218   LPPROCESSENTRY32W ProcessListEntry;
 219   LPTHREADENTRY32 ThreadListEntry;
 220   OBJECT_ATTRIBUTES ObjectAttributes;
 221   LARGE_INTEGER SSize, SOffset;
 222   HANDLE hSection;
 223   PTH32SNAPSHOT Snapshot;
 224   ULONG_PTR DataOffset;
 225   SIZE_T ViewSize;
 226   ULONG i, nProcesses = 0, nThreads = 0, nHeaps = 0, nModules = 0;
 227   ULONG RequiredSnapshotSize = sizeof(TH32SNAPSHOT);
 228   PRTL_PROCESS_HEAPS hi = NULL;
 229   PRTL_PROCESS_MODULES mi = NULL;
 230   NTSTATUS Status = STATUS_SUCCESS;
 231
 232   /*
 233    * Determine the required size for the heap snapshot
 234    */
 235   if(dwFlags & TH32CS_SNAPHEAPLIST)
 236   {
 237     hi = (PRTL_PROCESS_HEAPS)HeapDebug->Heaps;
 238     nHeaps = hi->NumberOfHeaps;
 239     RequiredSnapshotSize += nHeaps * sizeof(HEAPLIST32);
 240   }
 241
 242   /*
 243    * Determine the required size for the module snapshot
 244    */
 245   if(dwFlags & TH32CS_SNAPMODULE)
 246   {
 247     mi = (PRTL_PROCESS_MODULES)ModuleDebug->Modules;
 248     nModules = mi->NumberOfModules;
 249     RequiredSnapshotSize += nModules * sizeof(MODULEENTRY32W);
 250   }
 251
 252   /*
 253    * Determine the required size for the processes and threads snapshot
 254    */
 255   if(dwFlags & (TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD))
 256   {
 257     ULONG ProcOffset = 0;
 258
 259     ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)ProcThrdInfo;
 260     do
 261     {
 262       ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)((ULONG_PTR)ProcessInfo + ProcOffset);
 263       nProcesses++;
 264       nThreads += ProcessInfo->NumberOfThreads;
 265       ProcOffset = ProcessInfo->NextEntryOffset;
 266     } while(ProcOffset != 0);
 267
 268     if(dwFlags & TH32CS_SNAPPROCESS)
 269     {
 270       RequiredSnapshotSize += nProcesses * sizeof(PROCESSENTRY32W);
 271     }
 272     if(dwFlags & TH32CS_SNAPTHREAD)
 273     {
 274       RequiredSnapshotSize += nThreads * sizeof(THREADENTRY32);
 275     }
 276   }
 277
 278   /*
 279    * Create and map the section
 280    */
 281
 282   SSize.QuadPart = RequiredSnapshotSize;
 283
 284   InitializeObjectAttributes(&ObjectAttributes,
 285                              NULL,
 286                              ((dwFlags & TH32CS_INHERIT) ? OBJ_INHERIT : 0),
 287                              NULL,
 288                              NULL);
 289
 290   Status = NtCreateSection(&hSection,
 291                            SECTION_ALL_ACCESS,
 292                            &ObjectAttributes,
 293                            &SSize,
 294                            PAGE_READWRITE,
 295                            SEC_COMMIT,
 296                            NULL);
 297   if(!NT_SUCCESS(Status))
 298   {
 299     return Status;
 300   }
 301
 302   SOffset.QuadPart = 0;
 303   ViewSize = 0;
 304   Snapshot = NULL;
 305
 306   Status = NtMapViewOfSection(hSection,
 307                               NtCurrentProcess(),
 308                               (PVOID*)&Snapshot,
 309                               0,
 310                               0,
 311                               &SOffset,
 312                               &ViewSize,
 313                               ViewShare,
 314                               0,
 315                               PAGE_READWRITE);
 316   if(!NT_SUCCESS(Status))
 317   {
 318     NtClose(hSection);
 319     return Status;
 320   }
 321
 322   RtlZeroMemory(Snapshot, sizeof(TH32SNAPSHOT));
 323   DataOffset = 0;
 324
 325   /*
 326    * Initialize the section data and fill it with all the data we collected
 327    */
 328
 329   /* initialize the heap list */
 330   if(dwFlags & TH32CS_SNAPHEAPLIST)
 331   {
 332     Snapshot->HeapListCount = nHeaps;
 333     Snapshot->HeapListOffset = DataOffset;
 334     HeapListEntry = (LPHEAPLIST32)OffsetToPtr(Snapshot, DataOffset);
 335     for(i = 0; i < nHeaps; i++)
 336     {
 337       HeapListEntry->dwSize = sizeof(HEAPLIST32);
 338       HeapListEntry->th32ProcessID = th32ProcessID;
 339       HeapListEntry->th32HeapID = (ULONG_PTR)hi->Heaps[i].BaseAddress;
 340       HeapListEntry->dwFlags = hi->Heaps[i].Flags;
 341
 342       HeapListEntry++;
 343     }
 344
 345     DataOffset += hi->NumberOfHeaps * sizeof(HEAPLIST32);
 346   }
 347
 348   /* initialize the module list */
 349   if(dwFlags & TH32CS_SNAPMODULE)
 350   {
 351     Snapshot->ModuleListCount = nModules;
 352     Snapshot->ModuleListOffset = DataOffset;
 353     ModuleListEntry = (LPMODULEENTRY32W)OffsetToPtr(Snapshot, DataOffset);
 354     for(i = 0; i < nModules; i++)
 355     {
 356       ModuleListEntry->dwSize = sizeof(MODULEENTRY32W);
 357       ModuleListEntry->th32ModuleID = 1; /* no longer used, always set to one! */
 358       ModuleListEntry->th32ProcessID = th32ProcessID;
 359       ModuleListEntry->GlblcntUsage = mi->Modules[i].LoadCount;
 360       ModuleListEntry->ProccntUsage = mi->Modules[i].LoadCount;
 361       ModuleListEntry->modBaseAddr = (BYTE*)mi->Modules[i].ImageBase;
 362       ModuleListEntry->modBaseSize = mi->Modules[i].ImageSize;
 363       ModuleListEntry->hModule = (HMODULE)mi->Modules[i].ImageBase;
 364
 365       MultiByteToWideChar(CP_ACP,
 366                           0,
 367                           &mi->Modules[i].FullPathName[mi->Modules[i].OffsetToFileName],
 368                           -1,
 369                           ModuleListEntry->szModule,
 370                           sizeof(ModuleListEntry->szModule) / sizeof(ModuleListEntry->szModule[0]));
 371
 372       MultiByteToWideChar(CP_ACP,
 373                           0,
 374                           mi->Modules[i].FullPathName,
 375                           -1,
 376                           ModuleListEntry->szExePath,
 377                           sizeof(ModuleListEntry->szExePath) / sizeof(ModuleListEntry->szExePath[0]));
 378
 379       ModuleListEntry++;
 380     }
 381
 382     DataOffset += mi->NumberOfModules * sizeof(MODULEENTRY32W);
 383   }
 384
 385   /* initialize the process list */
 386   if(dwFlags & TH32CS_SNAPPROCESS)
 387   {
 388     ULONG ProcOffset = 0;
 389
 390     Snapshot->ProcessListCount = nProcesses;
 391     Snapshot->ProcessListOffset = DataOffset;
 392     ProcessListEntry = (LPPROCESSENTRY32W)OffsetToPtr(Snapshot, DataOffset);
 393     ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)ProcThrdInfo;
 394     do
 395     {
 396       ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)((ULONG_PTR)ProcessInfo + ProcOffset);
 397
 398       ProcessListEntry->dwSize = sizeof(PROCESSENTRY32W);
 399       ProcessListEntry->cntUsage = 0; /* no longer used */
 400       ProcessListEntry->th32ProcessID = (ULONG_PTR)ProcessInfo->UniqueProcessId;
 401       ProcessListEntry->th32DefaultHeapID = 0; /* no longer used */
 402       ProcessListEntry->th32ModuleID = 0; /* no longer used */
 403       ProcessListEntry->cntThreads = ProcessInfo->NumberOfThreads;
 404       ProcessListEntry->th32ParentProcessID = (ULONG_PTR)ProcessInfo->InheritedFromUniqueProcessId;
 405       ProcessListEntry->pcPriClassBase = ProcessInfo->BasePriority;
 406       ProcessListEntry->dwFlags = 0; /* no longer used */
 407       if(ProcessInfo->ImageName.Buffer != NULL)
 408       {
 409         ULONG ExeFileLength = min(ProcessInfo->ImageName.Length,
 410                                   sizeof(ProcessListEntry->szExeFile) - sizeof(WCHAR));
 411         RtlCopyMemory(ProcessListEntry->szExeFile,
 412                       ProcessInfo->ImageName.Buffer,
 413                       ExeFileLength);
 414         ProcessListEntry->szExeFile[ExeFileLength / sizeof(WCHAR)] = UNICODE_NULL;
 415       }
 416       else
 417       {
 418         lstrcpyW(ProcessListEntry->szExeFile, L"[System Process]");
 419       }
 420
 421       ProcessListEntry++;
 422
 423       ProcOffset = ProcessInfo->NextEntryOffset;
 424     } while(ProcOffset != 0);
 425
 426     DataOffset += nProcesses * sizeof(PROCESSENTRY32W);
 427   }
 428
 429   /* initialize the thread list */
 430   if(dwFlags & TH32CS_SNAPTHREAD)
 431   {
 432     ULONG ProcOffset = 0;
 433
 434     Snapshot->ThreadListCount = nThreads;
 435     Snapshot->ThreadListOffset = DataOffset;
 436     ThreadListEntry = (LPTHREADENTRY32)OffsetToPtr(Snapshot, DataOffset);
 437     ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)ProcThrdInfo;
 438     do
 439     {
 440       PSYSTEM_THREAD_INFORMATION ThreadInfo;
 441       ULONG n;
 442
 443       ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)((ULONG_PTR)ProcessInfo + ProcOffset);
 444       ThreadInfo = (PSYSTEM_THREAD_INFORMATION)(ProcessInfo + 1);
 445
 446       for(n = 0; n < ProcessInfo->NumberOfThreads; n++)
 447       {
 448         ThreadListEntry->dwSize = sizeof(THREADENTRY32);
 449         ThreadListEntry->cntUsage = 0; /* no longer used */
 450         ThreadListEntry->th32ThreadID = (ULONG_PTR)ThreadInfo->ClientId.UniqueThread;
 451         ThreadListEntry->th32OwnerProcessID = (ULONG_PTR)ThreadInfo->ClientId.UniqueProcess;
 452         ThreadListEntry->tpBasePri = ThreadInfo->BasePriority;
 453         ThreadListEntry->tpDeltaPri = 0; /* no longer used */
 454         ThreadListEntry->dwFlags = 0; /* no longer used */
 455
 456         ThreadInfo++;
 457         ThreadListEntry++;
 458       }
 459
 460       ProcOffset = ProcessInfo->NextEntryOffset;
 461     } while(ProcOffset != 0);
 462   }
 463
 464   /*
 465    * We're done, unmap the view and return the section handle
 466    */
 467
 468   Status = NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
 469
 470   if(NT_SUCCESS(Status))
 471   {
 472     *SectionHandle = hSection;
 473   }
 474   else
 475   {
 476     NtClose(hSection);
 477   }
 478
 479   return Status;
 480 }
 481
 482 /* PUBLIC FUNCTIONS ***********************************************************/
 483
 484 /*
 485  * @implemented
 486  */
 487 BOOL
 488 WINAPI
 489 Heap32First(LPHEAPENTRY32 lphe, DWORD th32ProcessID, DWORD th32HeapID)
 490 {
 491   PRTL_DEBUG_INFORMATION DebugInfo;
 492   PRTL_HEAP_INFORMATION Heap;
 493   PRTLP_HEAP_ENTRY Block, LastBlock;
 494   ULONG i;
 495   NTSTATUS Status;
 496
 497   CHECK_PARAM_SIZE(lphe, sizeof(HEAPENTRY32));
 498
 499   DebugInfo = RtlCreateQueryDebugBuffer(0,
 500                                         FALSE);
 501   if (DebugInfo == NULL)
 502   {
 503     SetLastError(ERROR_NOT_ENOUGH_MEMORY);
 504     return FALSE;
 505   }
 506
 507   Status = RtlQueryProcessDebugInformation(th32ProcessID,
 508                                            RTL_DEBUG_QUERY_HEAPS | RTL_DEBUG_QUERY_HEAP_BLOCKS,
 509                                            DebugInfo);
 510
 511   if (NT_SUCCESS(Status))
 512   {
 513     Status = STATUS_NO_MORE_FILES;
 514
 515     for (i = 0;
 516          i != DebugInfo->Heaps->NumberOfHeaps;
 517          i++)
 518     {
 519       Heap = &DebugInfo->Heaps->Heaps[i];
 520
 521       if ((ULONG_PTR)Heap->BaseAddress == th32HeapID)
 522       {
 523         lphe->hHandle = (HANDLE)Heap->BaseAddress;
 524         lphe->dwAddress = 0;
 525         lphe->dwBlockSize = 0;
 526         lphe->dwFlags = 0;
 527         lphe->dwLockCount = 0;
 528         lphe->dwResvd = 0;
 529         lphe->th32ProcessID = th32ProcessID;
 530         lphe->th32HeapID = (ULONG_PTR)Heap->BaseAddress;
 531
 532         Block = (PRTLP_HEAP_ENTRY)Heap->Entries;
 533         LastBlock = Block + Heap->NumberOfEntries;
 534
 535         while (Block != LastBlock && (Block->Flags & PROCESS_HEAP_UNCOMMITTED_RANGE))
 536         {
 537           lphe->dwResvd++;
 538           lphe->dwAddress = (ULONG_PTR)((ULONG_PTR)Block->Address + Heap->EntryOverhead);
 539           Block++;
 540         }
 541
 542         if (Block != LastBlock && lphe->dwResvd != 0)
 543         {
 544           lphe->dwBlockSize =  Block->Size;
 545
 546           if (Block->Flags & 0x2F1) /* FIXME */
 547             lphe->dwFlags = LF32_FIXED;
 548           else if (Block->Flags & 0x20) /* FIXME */
 549             lphe->dwFlags = LF32_MOVEABLE;
 550           else if (Block->Flags & 0x100) /* FIXME */
 551             lphe->dwFlags = LF32_FREE;
 552
 553           Status = STATUS_SUCCESS;
 554         }
 555
 556         break;
 557       }
 558     }
 559   }
 560
 561   RtlDestroyQueryDebugBuffer(DebugInfo);
 562
 563   if (!NT_SUCCESS(Status))
 564   {
 565     BaseSetLastNTError(Status);
 566     return FALSE;
 567   }
 568
 569   return TRUE;
 570 }
 571
 572
 573 /*
 574  * @implemented
 575  */
 576 BOOL
 577 WINAPI
 578 Heap32Next(LPHEAPENTRY32 lphe)
 579 {
 580   PRTL_DEBUG_INFORMATION DebugInfo;
 581   PRTL_HEAP_INFORMATION Heap;
 582   PRTLP_HEAP_ENTRY Block, LastBlock;
 583   BOOLEAN FoundUncommitted = FALSE;
 584   ULONG i;
 585   NTSTATUS Status;
 586
 587   CHECK_PARAM_SIZE(lphe, sizeof(HEAPENTRY32));
 588
 589   DebugInfo = RtlCreateQueryDebugBuffer(0,
 590                                         FALSE);
 591   if (DebugInfo == NULL)
 592   {
 593     SetLastError(ERROR_NOT_ENOUGH_MEMORY);
 594     return FALSE;
 595   }
 596
 597   Status = RtlQueryProcessDebugInformation(lphe->th32ProcessID,
 598                                            RTL_DEBUG_QUERY_HEAPS | RTL_DEBUG_QUERY_HEAP_BLOCKS,
 599                                            DebugInfo);
 600
 601   if (NT_SUCCESS(Status))
 602   {
 603     Status = STATUS_NO_MORE_FILES;
 604
 605     for (i = 0;
 606          i != DebugInfo->Heaps->NumberOfHeaps;
 607          i++)
 608     {
 609       Heap = &DebugInfo->Heaps->Heaps[i];
 610
 611       if ((ULONG_PTR)Heap->BaseAddress == lphe->th32HeapID)
 612       {
 613         if (++lphe->dwResvd < Heap->NumberOfEntries)
 614         {
 615           lphe->dwFlags = 0;
 616
 617           Block = (PRTLP_HEAP_ENTRY)Heap->Entries + lphe->dwResvd;
 618           LastBlock = (PRTLP_HEAP_ENTRY)Heap->Entries + Heap->NumberOfEntries;
 619
 620           while (Block < LastBlock && (Block->Flags & PROCESS_HEAP_UNCOMMITTED_RANGE))
 621           {
 622             lphe->dwResvd++;
 623             lphe->dwAddress = (ULONG_PTR)((ULONG_PTR)Block->Address + Heap->EntryOverhead);
 624             FoundUncommitted = TRUE;
 625             Block++;
 626           }
 627
 628           if (Block < LastBlock)
 629           {
 630             if (!FoundUncommitted)
 631               lphe->dwAddress += lphe->dwBlockSize;
 632
 633             lphe->dwBlockSize =  Block->Size;
 634
 635             if (Block->Flags & 0x2F1) /* FIXME */
 636               lphe->dwFlags = LF32_FIXED;
 637             else if (Block->Flags & 0x20) /* FIXME */
 638               lphe->dwFlags = LF32_MOVEABLE;
 639             else if (Block->Flags & 0x100) /* FIXME */
 640               lphe->dwFlags = LF32_FREE;
 641
 642             Status = STATUS_SUCCESS;
 643           }
 644         }
 645
 646         break;
 647       }
 648     }
 649   }
 650
 651   RtlDestroyQueryDebugBuffer(DebugInfo);
 652
 653   if (!NT_SUCCESS(Status))
 654   {
 655     BaseSetLastNTError(Status);
 656     return FALSE;
 657   }
 658
 659   return TRUE;
 660
 661 }
 662
 663
 664 /*
 665  * @implemented
 666  */
 667 BOOL
 668 WINAPI
 669 Heap32ListFirst(HANDLE hSnapshot, LPHEAPLIST32 lphl)
 670 {
 671   PTH32SNAPSHOT Snapshot;
 672   LARGE_INTEGER SOffset;
 673   SIZE_T ViewSize;
 674   NTSTATUS Status;
 675
 676   CHECK_PARAM_SIZE(lphl, sizeof(HEAPLIST32));
 677
 678   SOffset.QuadPart = 0;
 679   ViewSize = 0;
 680   Snapshot = NULL;
 681
 682   Status = NtMapViewOfSection(hSnapshot,
 683                               NtCurrentProcess(),
 684                               (PVOID*)&Snapshot,
 685                               0,
 686                               0,
 687                               &SOffset,
 688                               &ViewSize,
 689                               ViewShare,
 690                               0,
 691                               PAGE_READWRITE);
 692   if(NT_SUCCESS(Status))
 693   {
 694     BOOL Ret;
 695
 696     if(Snapshot->HeapListCount > 0)
 697     {
 698       LPHEAPLIST32 Entries = (LPHEAPLIST32)OffsetToPtr(Snapshot, Snapshot->HeapListOffset);
 699       Snapshot->HeapListIndex = 1;
 700       RtlCopyMemory(lphl, &Entries[0], sizeof(HEAPLIST32));
 701       Ret = TRUE;
 702     }
 703     else
 704     {
 705       SetLastError(ERROR_NO_MORE_FILES);
 706       Ret = FALSE;
 707     }
 708
 709     NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
 710     return Ret;
 711   }
 712
 713   BaseSetLastNTError(Status);
 714   return FALSE;
 715 }
 716
 717
 718 /*
 719  * @implemented
 720  */
 721 BOOL
 722 WINAPI
 723 Heap32ListNext(HANDLE hSnapshot, LPHEAPLIST32 lphl)
 724 {
 725   PTH32SNAPSHOT Snapshot;
 726   LARGE_INTEGER SOffset;
 727   SIZE_T ViewSize;
 728   NTSTATUS Status;
 729
 730   CHECK_PARAM_SIZE(lphl, sizeof(HEAPLIST32));
 731
 732   SOffset.QuadPart = 0;
 733   ViewSize = 0;
 734   Snapshot = NULL;
 735
 736   Status = NtMapViewOfSection(hSnapshot,
 737                               NtCurrentProcess(),
 738                               (PVOID*)&Snapshot,
 739                               0,
 740                               0,
 741                               &SOffset,
 742                               &ViewSize,
 743                               ViewShare,
 744                               0,
 745                               PAGE_READWRITE);
 746   if(NT_SUCCESS(Status))
 747   {
 748     BOOL Ret;
 749
 750     if(Snapshot->HeapListCount > 0 &&
 751        Snapshot->HeapListIndex < Snapshot->HeapListCount)
 752     {
 753       LPHEAPLIST32 Entries = (LPHEAPLIST32)OffsetToPtr(Snapshot, Snapshot->HeapListOffset);
 754       RtlCopyMemory(lphl, &Entries[Snapshot->HeapListIndex++], sizeof(HEAPLIST32));
 755       Ret = TRUE;
 756     }
 757     else
 758     {
 759       SetLastError(ERROR_NO_MORE_FILES);
 760       Ret = FALSE;
 761     }
 762
 763     NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
 764     return Ret;
 765   }
 766
 767   BaseSetLastNTError(Status);
 768   return FALSE;
 769 }
 770
 771
 772 /*
 773  * @implemented
 774  */
 775 BOOL
 776 WINAPI
 777 Module32First(HANDLE hSnapshot, LPMODULEENTRY32 lpme)
 778 {
 779   MODULEENTRY32W me;
 780   BOOL Ret;
 781
 782   CHECK_PARAM_SIZEA(lpme, sizeof(MODULEENTRY32));
 783
 784   me.dwSize = sizeof(MODULEENTRY32W);
 785
 786   Ret = Module32FirstW(hSnapshot, &me);
 787   if(Ret)
 788   {
 789     lpme->th32ModuleID = me.th32ModuleID;
 790     lpme->th32ProcessID = me.th32ProcessID;
 791     lpme->GlblcntUsage = me.GlblcntUsage;
 792     lpme->ProccntUsage = me.ProccntUsage;
 793     lpme->modBaseAddr = me.modBaseAddr;
 794     lpme->modBaseSize = me.modBaseSize;
 795     lpme->hModule = me.hModule;
 796
 797     WideCharToMultiByte(CP_ACP, 0, me.szModule, -1, lpme->szModule, sizeof(lpme->szModule), 0, 0);
 798     WideCharToMultiByte(CP_ACP, 0, me.szExePath, -1, lpme->szExePath, sizeof(lpme->szExePath), 0, 0);
 799   }
 800
 801   return Ret;
 802 }
 803
 804
 805 /*
 806  * @implemented
 807  */
 808 BOOL
 809 WINAPI
 810 Module32FirstW(HANDLE hSnapshot, LPMODULEENTRY32W lpme)
 811 {
 812   PTH32SNAPSHOT Snapshot;
 813   LARGE_INTEGER SOffset;
 814   SIZE_T ViewSize;
 815   NTSTATUS Status;
 816
 817   CHECK_PARAM_SIZE(lpme, sizeof(MODULEENTRY32W));
 818
 819   SOffset.QuadPart = 0;
 820   ViewSize = 0;
 821   Snapshot = NULL;
 822
 823   Status = NtMapViewOfSection(hSnapshot,
 824                               NtCurrentProcess(),
 825                               (PVOID*)&Snapshot,
 826                               0,
 827                               0,
 828                               &SOffset,
 829                               &ViewSize,
 830                               ViewShare,
 831                               0,
 832                               PAGE_READWRITE);
 833   if(NT_SUCCESS(Status))
 834   {
 835     BOOL Ret;
 836
 837     if(Snapshot->ModuleListCount > 0)
 838     {
 839       LPMODULEENTRY32W Entries = (LPMODULEENTRY32W)OffsetToPtr(Snapshot, Snapshot->ModuleListOffset);
 840       Snapshot->ModuleListIndex = 1;
 841       RtlCopyMemory(lpme, &Entries[0], sizeof(MODULEENTRY32W));
 842       Ret = TRUE;
 843     }
 844     else
 845     {
 846       SetLastError(ERROR_NO_MORE_FILES);
 847       Ret = FALSE;
 848     }
 849
 850     NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
 851     return Ret;
 852   }
 853
 854   BaseSetLastNTError(Status);
 855   return FALSE;
 856 }
 857
 858
 859 /*
 860  * @implemented
 861  */
 862 BOOL
 863 WINAPI
 864 Module32Next(HANDLE hSnapshot, LPMODULEENTRY32 lpme)
 865 {
 866   MODULEENTRY32W me;
 867   BOOL Ret;
 868
 869   CHECK_PARAM_SIZEA(lpme, sizeof(MODULEENTRY32));
 870
 871   me.dwSize = sizeof(MODULEENTRY32W);
 872
 873   Ret = Module32NextW(hSnapshot, &me);
 874   if(Ret)
 875   {
 876     lpme->th32ModuleID = me.th32ModuleID;
 877     lpme->th32ProcessID = me.th32ProcessID;
 878     lpme->GlblcntUsage = me.GlblcntUsage;
 879     lpme->ProccntUsage = me.ProccntUsage;
 880     lpme->modBaseAddr = me.modBaseAddr;
 881     lpme->modBaseSize = me.modBaseSize;
 882     lpme->hModule = me.hModule;
 883
 884     WideCharToMultiByte(CP_ACP, 0, me.szModule, -1, lpme->szModule, sizeof(lpme->szModule), 0, 0);
 885     WideCharToMultiByte(CP_ACP, 0, me.szExePath, -1, lpme->szExePath, sizeof(lpme->szExePath), 0, 0);
 886   }
 887
 888   return Ret;
 889 }
 890
 891
 892 /*
 893  * @implemented
 894  */
 895 BOOL
 896 WINAPI
 897 Module32NextW(HANDLE hSnapshot, LPMODULEENTRY32W lpme)
 898 {
 899   PTH32SNAPSHOT Snapshot;
 900   LARGE_INTEGER SOffset;
 901   SIZE_T ViewSize;
 902   NTSTATUS Status;
 903
 904   CHECK_PARAM_SIZE(lpme, sizeof(MODULEENTRY32W));
 905
 906   SOffset.QuadPart = 0;
 907   ViewSize = 0;
 908   Snapshot = NULL;
 909
 910   Status = NtMapViewOfSection(hSnapshot,
 911                               NtCurrentProcess(),
 912                               (PVOID*)&Snapshot,
 913                               0,
 914                               0,
 915                               &SOffset,
 916                               &ViewSize,
 917                               ViewShare,
 918                               0,
 919                               PAGE_READWRITE);
 920   if(NT_SUCCESS(Status))
 921   {
 922     BOOL Ret;
 923
 924     if((Snapshot->ModuleListCount > 0) &&
 925        (Snapshot->ModuleListIndex < Snapshot->ModuleListCount))
 926     {
 927       LPMODULEENTRY32W Entries = (LPMODULEENTRY32W)OffsetToPtr(Snapshot, Snapshot->ModuleListOffset);
 928       RtlCopyMemory(lpme, &Entries[Snapshot->ModuleListIndex++], sizeof(MODULEENTRY32W));
 929       Ret = TRUE;
 930     }
 931     else
 932     {
 933       SetLastError(ERROR_NO_MORE_FILES);
 934       Ret = FALSE;
 935     }
 936
 937     NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
 938     return Ret;
 939   }
 940
 941   BaseSetLastNTError(Status);
 942   return FALSE;
 943 }
 944
 945
 946 /*
 947  * @implemented
 948  */
 949 BOOL
 950 WINAPI
 951 Process32First(HANDLE hSnapshot, LPPROCESSENTRY32 lppe)
 952 {
 953   PROCESSENTRY32W pe;
 954   BOOL Ret;
 955
 956   CHECK_PARAM_SIZEA(lppe, sizeof(PROCESSENTRY32));
 957
 958   pe.dwSize = sizeof(PROCESSENTRY32W);
 959
 960   Ret = Process32FirstW(hSnapshot, &pe);
 961   if(Ret)
 962   {
 963     lppe->cntUsage = pe.cntUsage;
 964     lppe->th32ProcessID = pe.th32ProcessID;
 965     lppe->th32DefaultHeapID = pe.th32DefaultHeapID;
 966     lppe->th32ModuleID = pe.th32ModuleID;
 967     lppe->cntThreads = pe.cntThreads;
 968     lppe->th32ParentProcessID = pe.th32ParentProcessID;
 969     lppe->pcPriClassBase = pe.pcPriClassBase;
 970     lppe->dwFlags = pe.dwFlags;
 971
 972     WideCharToMultiByte(CP_ACP, 0, pe.szExeFile, -1, lppe->szExeFile, sizeof(lppe->szExeFile), 0, 0);
 973   }
 974
 975   return Ret;
 976 }
 977
 978
 979 /*
 980  * @implemented
 981  */
 982 BOOL
 983 WINAPI
 984 Process32FirstW(HANDLE hSnapshot, LPPROCESSENTRY32W lppe)
 985 {
 986   PTH32SNAPSHOT Snapshot;
 987   LARGE_INTEGER SOffset;
 988   SIZE_T ViewSize;
 989   NTSTATUS Status;
 990
 991   CHECK_PARAM_SIZE(lppe, sizeof(PROCESSENTRY32W));
 992
 993   SOffset.QuadPart = 0;
 994   ViewSize = 0;
 995   Snapshot = NULL;
 996
 997   Status = NtMapViewOfSection(hSnapshot,
 998                               NtCurrentProcess(),
 999                               (PVOID*)&Snapshot,
1000                               0,
1001                               0,
1002                               &SOffset,
1003                               &ViewSize,
1004                               ViewShare,
1005                               0,
1006                               PAGE_READWRITE);
1007   if(NT_SUCCESS(Status))
1008   {
1009     BOOL Ret;
1010
1011     if(Snapshot->ProcessListCount > 0)
1012     {
1013       LPPROCESSENTRY32W Entries = (LPPROCESSENTRY32W)OffsetToPtr(Snapshot, Snapshot->ProcessListOffset);
1014
1015       Snapshot->ProcessListIndex = 1;
1016       RtlCopyMemory(lppe, &Entries[0], sizeof(PROCESSENTRY32W));
1017       Ret = TRUE;
1018     }
1019     else
1020     {
1021
1022       SetLastError(ERROR_NO_MORE_FILES);
1023       Ret = FALSE;
1024     }
1025
1026     NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
1027     return Ret;
1028   }
1029
1030   BaseSetLastNTError(Status);
1031   return FALSE;
1032 }
1033
1034
1035 /*
1036  * @implemented
1037  */
1038 BOOL
1039 WINAPI
1040 Process32Next(HANDLE hSnapshot, LPPROCESSENTRY32 lppe)
1041 {
1042   PROCESSENTRY32W pe;
1043   BOOL Ret;
1044
1045   CHECK_PARAM_SIZEA(lppe, sizeof(PROCESSENTRY32));
1046
1047   pe.dwSize = sizeof(PROCESSENTRY32W);
1048
1049   Ret = Process32NextW(hSnapshot, &pe);
1050   if(Ret)
1051   {
1052     lppe->cntUsage = pe.cntUsage;
1053     lppe->th32ProcessID = pe.th32ProcessID;
1054     lppe->th32DefaultHeapID = pe.th32DefaultHeapID;
1055     lppe->th32ModuleID = pe.th32ModuleID;
1056     lppe->cntThreads = pe.cntThreads;
1057     lppe->th32ParentProcessID = pe.th32ParentProcessID;
1058     lppe->pcPriClassBase = pe.pcPriClassBase;
1059     lppe->dwFlags = pe.dwFlags;
1060
1061     WideCharToMultiByte(CP_ACP, 0, pe.szExeFile, -1, lppe->szExeFile, sizeof(lppe->szExeFile), 0, 0);
1062   }
1063
1064   return Ret;
1065 }
1066
1067
1068 /*
1069  * @implemented
1070  */
1071 BOOL
1072 WINAPI
1073 Process32NextW(HANDLE hSnapshot, LPPROCESSENTRY32W lppe)
1074 {
1075   PTH32SNAPSHOT Snapshot;
1076   LARGE_INTEGER SOffset;
1077   SIZE_T ViewSize;
1078   NTSTATUS Status;
1079
1080   CHECK_PARAM_SIZE(lppe, sizeof(PROCESSENTRY32W));
1081
1082   SOffset.QuadPart = 0;
1083   ViewSize = 0;
1084   Snapshot = NULL;
1085
1086   Status = NtMapViewOfSection(hSnapshot,
1087                               NtCurrentProcess(),
1088                               (PVOID*)&Snapshot,
1089                               0,
1090                               0,
1091                               &SOffset,
1092                               &ViewSize,
1093                               ViewShare,
1094                               0,
1095                               PAGE_READWRITE);
1096   if(NT_SUCCESS(Status))
1097   {
1098     BOOL Ret;
1099
1100     if(Snapshot->ProcessListCount > 0 &&
1101        Snapshot->ProcessListIndex < Snapshot->ProcessListCount)
1102     {
1103       LPPROCESSENTRY32W Entries = (LPPROCESSENTRY32W)OffsetToPtr(Snapshot, Snapshot->ProcessListOffset);
1104       RtlCopyMemory(lppe, &Entries[Snapshot->ProcessListIndex++], sizeof(PROCESSENTRY32W));
1105       Ret = TRUE;
1106     }
1107     else
1108     {
1109       SetLastError(ERROR_NO_MORE_FILES);
1110       Ret = FALSE;
1111     }
1112
1113     NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
1114     return Ret;
1115   }
1116
1117   BaseSetLastNTError(Status);
1118   return FALSE;
1119 }
1120
1121
1122 /*
1123  * @implemented
1124  */
1125 BOOL
1126 WINAPI
1127 Thread32First(HANDLE hSnapshot, LPTHREADENTRY32 lpte)
1128 {
1129   PTH32SNAPSHOT Snapshot;
1130   LARGE_INTEGER SOffset;
1131   SIZE_T ViewSize;
1132   NTSTATUS Status;
1133
1134   CHECK_PARAM_SIZE(lpte, sizeof(THREADENTRY32));
1135
1136   SOffset.QuadPart = 0;
1137   ViewSize = 0;
1138   Snapshot = NULL;
1139
1140   Status = NtMapViewOfSection(hSnapshot,
1141                               NtCurrentProcess(),
1142                               (PVOID*)&Snapshot,
1143                               0,
1144                               0,
1145                               &SOffset,
1146                               &ViewSize,
1147                               ViewShare,
1148                               0,
1149                               PAGE_READWRITE);
1150   if(NT_SUCCESS(Status))
1151   {
1152     BOOL Ret;
1153
1154     if(Snapshot->ThreadListCount > 0)
1155     {
1156       LPTHREADENTRY32 Entries = (LPTHREADENTRY32)OffsetToPtr(Snapshot, Snapshot->ThreadListOffset);
1157       Snapshot->ThreadListIndex = 1;
1158       RtlCopyMemory(lpte, &Entries[0], sizeof(THREADENTRY32));
1159       Ret = TRUE;
1160     }
1161     else
1162     {
1163       SetLastError(ERROR_NO_MORE_FILES);
1164       Ret = FALSE;
1165     }
1166
1167     NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
1168     return Ret;
1169   }
1170
1171   BaseSetLastNTError(Status);
1172   return FALSE;
1173 }
1174
1175
1176 /*
1177  * @implemented
1178  */
1179 BOOL
1180 WINAPI
1181 Thread32Next(HANDLE hSnapshot, LPTHREADENTRY32 lpte)
1182 {
1183   PTH32SNAPSHOT Snapshot;
1184   LARGE_INTEGER SOffset;
1185   SIZE_T ViewSize;
1186   NTSTATUS Status;
1187
1188   CHECK_PARAM_SIZE(lpte, sizeof(THREADENTRY32));
1189
1190   SOffset.QuadPart = 0;
1191   ViewSize = 0;
1192   Snapshot = NULL;
1193
1194   Status = NtMapViewOfSection(hSnapshot,
1195                               NtCurrentProcess(),
1196                               (PVOID*)&Snapshot,
1197                               0,
1198                               0,
1199                               &SOffset,
1200                               &ViewSize,
1201                               ViewShare,
1202                               0,
1203                               PAGE_READWRITE);
1204   if(NT_SUCCESS(Status))
1205   {
1206     BOOL Ret;
1207
1208     if(Snapshot->ThreadListCount > 0 &&
1209        Snapshot->ThreadListIndex < Snapshot->ThreadListCount)
1210     {
1211       LPTHREADENTRY32 Entries = (LPTHREADENTRY32)OffsetToPtr(Snapshot, Snapshot->ThreadListOffset);
1212       RtlCopyMemory(lpte, &Entries[Snapshot->ThreadListIndex++], sizeof(THREADENTRY32));
1213       Ret = TRUE;
1214     }
1215     else
1216     {
1217       SetLastError(ERROR_NO_MORE_FILES);
1218       Ret = FALSE;
1219     }
1220
1221     NtUnmapViewOfSection(NtCurrentProcess(), (PVOID)Snapshot);
1222     return Ret;
1223   }
1224
1225   BaseSetLastNTError(Status);
1226   return FALSE;
1227 }
1228
1229
1230 /*
1231  * @implemented
1232  */
1233 BOOL
1234 WINAPI
1235 Toolhelp32ReadProcessMemory(DWORD th32ProcessID,  LPCVOID lpBaseAddress,
1236                             LPVOID lpBuffer, SIZE_T cbRead, SIZE_T* lpNumberOfBytesRead)
1237 {
1238   HANDLE hProcess = OpenProcess(PROCESS_VM_READ, FALSE, th32ProcessID);
1239   if(hProcess != NULL)
1240   {
1241     BOOL Ret = ReadProcessMemory(hProcess, lpBaseAddress, lpBuffer, cbRead, lpNumberOfBytesRead);
1242     CloseHandle(hProcess);
1243     return Ret;
1244   }
1245
1246   return FALSE;
1247 }
1248
1249
1250 /*
1251  * @implemented
1252  */
1253 HANDLE
1254 WINAPI
1255 CreateToolhelp32Snapshot(DWORD dwFlags, DWORD th32ProcessID)
1256 {
1257   PRTL_DEBUG_INFORMATION HeapDebug, ModuleDebug;
1258   PVOID ProcThrdInfo;
1259   SIZE_T ProcThrdInfoSize;
1260   NTSTATUS Status;
1261   HANDLE hSnapShotSection = NULL;
1262
1263   if(th32ProcessID == 0)
1264   {
1265     th32ProcessID = GetCurrentProcessId();
1266   }
1267
1268   /*
1269    * Get all information required for the snapshot
1270    */
1271   Status = TH32CreateSnapshot(dwFlags,
1272                               th32ProcessID,
1273                               &HeapDebug,
1274                               &ModuleDebug,
1275                               &ProcThrdInfo,
1276                               &ProcThrdInfoSize);
1277   if(!NT_SUCCESS(Status))
1278   {
1279     BaseSetLastNTError(Status);
1280     return NULL;
1281   }
1282
1283   /*
1284    * Create a section handle and initialize the collected information
1285    */
1286   Status = TH32CreateSnapshotSectionInitialize(dwFlags,
1287                                                th32ProcessID,
1288                                                HeapDebug,
1289                                                ModuleDebug,
1290                                                ProcThrdInfo,
1291                                                &hSnapShotSection);
1292
1293   /*
1294    * Free the temporarily allocated memory which is no longer needed
1295    */
1296   TH32FreeAllocatedResources(HeapDebug,
1297                              ModuleDebug,
1298                              ProcThrdInfo,
1299                              ProcThrdInfoSize);
1300
1301   if(!NT_SUCCESS(Status))
1302   {
1303     BaseSetLastNTError(Status);
1304     return NULL;
1305   }
1306
1307   return hSnapShotSection;
1308 }
1309
1310 /* EOF */