Unit ToolHelp32

-----------------------------------------------------------------------------} { An import unit to expose the ToolHelp32 functions. } { } { NOTE!!! This only works on Win95. NT 3.5x and 4.0 do not provide these } { functions in Kernel32.dll (or anywhere as far as I know). If you find } { functions that are equivalent to these on NT, please let me know. } { } { Copyright 1996, Brad Stowers. All Rights Reserved. } { This unit can be freely used and distributed in commercial and private } { environments, provied this notice is not modified in any way and there is } { no charge for it other than nomial handling fees. Contact me directly for } { modifications to this agreement. } {-----------------------------------------------------------------------------} { Feel free to contact me if you have any questions, comments or suggestions } { at bstowers@pobox.com or 72733,3374 on CompuServe. } { The lateset version will always be available on the web at: } { http://www.pobox.com/~bstowers/delphi/ } {-----------------------------------------------------------------------------} { Date last modified: Jan 30, 1997 } {-----------------------------------------------------------------------------} { ----------------------------------------------------------------------------} { ToolHelp32 v1.00 } { ----------------------------------------------------------------------------} { Revision History: } { 1.00: + Initial release. } { The comments in this unit are from the SDK. } { ----------------------------------------------------------------------------

Classes

Functions

CreateToolhelp32Snapshot -
Heap32First -
Heap32ListFirst - is shared heap
Heap32ListNext -
Heap32Next -
Module32First - NOTE CAREFULLY that the modBaseAddr and hModule fields are valid ONLY in th32ProcessID's process context.
Module32Next -
Process32First -
Process32Next -
Thread32First -
Thread32Next -
Toolhelp32ReadProcessMemory -

Types

PHEAPENTRY32
PHEAPLIST32
PMODULEENTRY32
PPROCESSENTRY32
PTHREADENTRY32
THEAPENTRY32
THEAPLIST32
TMODULEENTRY32
TPROCESSENTRY32
TTHREADENTRY32

Constants

HF32_DEFAULT
HF32_SHARED
LF32_FIXED
LF32_FREE
LF32_MOVEABLE
MAX_MODULE_NAME32
PCB_HIGH
PCB_IDLE
PCB_NORMAL
PCB_REALTIME
TH32CS_INHERIT
TH32CS_SNAPALL
TH32CS_SNAPHEAPLIST
TH32CS_SNAPMODULE
TH32CS_SNAPPROCESS
TH32CS_SNAPTHREAD

Variables


Functions


function CreateToolhelp32Snapshot(dwFlags, th32ProcessID: DWORD): THandle;


function Heap32First(const lphe: THEAPENTRY32; th32ProcessID, th32HeapID: DWORD): boolean;


function Heap32ListFirst(hSnapshot: THandle; const lphl: THEAPLIST32): boolean;

is shared heap

function Heap32ListNext(hSnapshot: THandle; const lphl: THEAPLIST32): boolean;


function Heap32Next(const lphe: THEAPENTRY32): boolean;


function Module32First(hSnapshot: THandle; const lpme: TMODULEENTRY32): boolean;

NOTE CAREFULLY that the modBaseAddr and hModule fields are valid ONLY in th32ProcessID's process context. //

function Module32Next(hSnapshot: THandle; const lpme: TMODULEENTRY32): boolean;


function Process32First(hSnapshot: THandle; const lppe: TPROCESSENTRY32): boolean;


function Process32Next(hSnapshot: THandle; const lppe: TPROCESSENTRY32): boolean;


function Thread32First(hSnapshot: THandle; const lpte: TTHREADENTRY32): boolean;


function Thread32Next(hSnapshot: THandle; const lpte: TTHREADENTRY32): boolean;


function Toolhelp32ReadProcessMemory(th32ProcessID: DWORD; lpBaseAddress, lpBuffer: pointer; cbRead: DWORD; lpNumberOfBytesRead: PDWORD): boolean;


Types


PHEAPENTRY32 = ^THEAPENTRY32

PHEAPLIST32 = ^THEAPLIST32
Use CloseHandle to destroy the snapshot // (****** heap walking
PMODULEENTRY32 = ^TMODULEENTRY32
**** Module walking
PPROCESSENTRY32 = ^TPROCESSENTRY32
**** Process walking
PTHREADENTRY32 = ^TTHREADENTRY32
**** Thread walking
THEAPENTRY32 = record
dwSize : DWORD;
hHandle : THandle;
dwAddress : DWORD;
dwBlockSize : DWORD;
dwFlags : DWORD;
dwLockCount : DWORD;
dwResvd : DWORD;
th32ProcessID : DWORD;
th32HeapID : DWORD;
end;

THEAPLIST32 = record
dwSize : DWORD;
th32ProcessID : DWORD;
th32HeapID : DWORD;
dwFlags : DWORD;
end;

TMODULEENTRY32 = record
dwSize : DWORD;
th32ModuleID : DWORD;
th32ProcessID : DWORD;
GlblcntUsage : DWORD;
ProccntUsage : DWORD;
modBaseAddr : PBYTE;
modBaseSize : DWORD;
hModule : HMODULE;
szModule : array [0..MAX_MODULE_NAME32] of char;
szExePath : array [0..MAX_PATH-1] of char;
end;

TPROCESSENTRY32 = record
dwSize : DWORD;
cntUsage : DWORD;
th32ProcessID : DWORD;
th32DefaultHeapID : DWORD;
th32ModuleID : DWORD;
cntThreads : DWORD;
th32ParentProcessID : DWORD;
pcPriClassBase : LongInt;
dwFlags : DWORD;
szExeFile : array[0..MAX_PATH-1] of char;
end;

TTHREADENTRY32 = record
dwSize : DWORD;
cntUsage : DWORD;
th32ThreadID : DWORD;
th32OwnerProcessID : DWORD;
tpBasePri : LongInt;
tpDeltaPri : LongInt;
dwFlags : DWORD;
end;

Constants

HF32_DEFAULT = 1

dwFlags //

HF32_SHARED = 2

process's default heap

LF32_FIXED = $00000001

dwFlags //

LF32_FREE = $00000002

LF32_MOVEABLE = $00000004

MAX_MODULE_NAME32 = 255

PCB_HIGH = 13

PCB_IDLE = 4

Path

PCB_NORMAL = 8

PCB_REALTIME = 24

TH32CS_INHERIT = $80000000

TH32CS_SNAPALL = TH32CS_SNAPHEAPLIST or TH32CS_SNAPPROCESS or TH32CS_SNAPTHREAD or TH32CS_SNAPMODULE

TH32CS_SNAPHEAPLIST = $00000001

The th32ProcessID argument is only used if TH32CS_SNAPHEAPLIST or TH32CS_SNAPMODULE is specified. th32ProcessID == 0 means the current process. // NOTE that all of the snapshots are global except for the heap and module lists which are process specific. To enumerate the heap or module state for all WIN32 processes call with TH32CS_SNAPALL and the current process. Then for each process in the TH32CS_SNAPPROCESS list that isn't the current process, do a call with just TH32CS_SNAPHEAPLIST and/or TH32CS_SNAPMODULE. // dwFlags //

TH32CS_SNAPMODULE = $00000008

TH32CS_SNAPPROCESS = $00000002

TH32CS_SNAPTHREAD = $00000004


Variables