1
{******************************************************************************}
3
{ ToolHelp API interface Unit for Object Pascal }
5
{ Portions created by Microsoft are Copyright (C) 1995-2001 Microsoft }
6
{ Corporation. All Rights Reserved. }
8
{ The original file is: tlhelp32.h, released June 2000. The original Pascal }
9
{ code is: TlHelp32.pas, released December 2000. The initial developer of the }
10
{ Pascal code is Marcel van Brakel (brakelm att chello dott nl). }
12
{ Portions created by Marcel van Brakel are Copyright (C) 1999-2001 }
13
{ Marcel van Brakel. All Rights Reserved. }
15
{ Obtained through: Joint Endeavour of Delphi Innovators (Project JEDI) }
17
{ You may retrieve the latest version of this file at the Project JEDI }
18
{ APILIB home page, located at http://jedi-apilib.sourceforge.net }
20
{ The contents of this file are used with permission, subject to the Mozilla }
21
{ Public License Version 1.1 (the "License"); you may not use this file except }
22
{ in compliance with the License. You may obtain a copy of the License at }
23
{ http://www.mozilla.org/MPL/MPL-1.1.html }
25
{ Software distributed under the License is distributed on an "AS IS" basis, }
26
{ WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License for }
27
{ the specific language governing rights and limitations under the License. }
29
{ Alternatively, the contents of this file may be used under the terms of the }
30
{ GNU Lesser General Public License (the "LGPL License"), in which case the }
31
{ provisions of the LGPL License are applicable instead of those above. }
32
{ If you wish to allow use of your version of this file only under the terms }
33
{ of the LGPL License and not to allow others to use your version of this file }
34
{ under the MPL, indicate your decision by deleting the provisions above and }
35
{ replace them with the notice and other provisions required by the LGPL }
36
{ License. If you do not delete the provisions above, a recipient may use }
37
{ your version of this file under either the MPL or the LGPL License. }
39
{ For more information about the LGPL: http://www.gnu.org/copyleft/lesser.html }
41
{******************************************************************************}
43
// $Id: jwatlhelp32.pas,v 1.1 2005/04/04 07:56:10 marco Exp $
50
{$HPPEMIT '#include "tlhelp32.h"'}
61
MAX_MODULE_NAME32 = 255;
62
{$EXTERNALSYM MAX_MODULE_NAME32}
66
function CreateToolhelp32Snapshot(dwFlags, th32ProcessID: DWORD): HANDLE; stdcall;
67
{$EXTERNALSYM CreateToolhelp32Snapshot}
70
// The th32ProcessID argument is only used if TH32CS_SNAPHEAPLIST or
71
// TH32CS_SNAPMODULE is specified. th32ProcessID == 0 means the current
74
// NOTE that all of the snapshots are global except for the heap and module
75
// lists which are process specific. To enumerate the heap or module
76
// state for all WIN32 processes call with TH32CS_SNAPALL and the
77
// current process. Then for each process in the TH32CS_SNAPPROCESS
78
// list that isn't the current process, do a call with just
79
// TH32CS_SNAPHEAPLIST and/or TH32CS_SNAPMODULE.
85
TH32CS_SNAPHEAPLIST = $00000001;
86
{$EXTERNALSYM TH32CS_SNAPHEAPLIST}
87
TH32CS_SNAPPROCESS = $00000002;
88
{$EXTERNALSYM TH32CS_SNAPPROCESS}
89
TH32CS_SNAPTHREAD = $00000004;
90
{$EXTERNALSYM TH32CS_SNAPTHREAD}
91
TH32CS_SNAPMODULE = $00000008;
92
{$EXTERNALSYM TH32CS_SNAPMODULE}
93
TH32CS_SNAPMODULE32 = $00000010;
94
{$EXTERNALSYM TH32CS_SNAPMODULE32}
95
TH32CS_SNAPALL = TH32CS_SNAPHEAPLIST or TH32CS_SNAPPROCESS or
96
TH32CS_SNAPTHREAD or TH32CS_SNAPMODULE;
97
{$EXTERNALSYM TH32CS_SNAPALL}
98
TH32CS_INHERIT = $80000000;
99
{$EXTERNALSYM TH32CS_INHERIT}
102
// Use CloseHandle to destroy the snapshot
108
PHEAPLIST32 = ^HEAPLIST32;
109
{$EXTERNALSYM PHEAPLIST32}
110
tagHEAPLIST32 = record
112
th32ProcessID: DWORD; // owning process
113
th32HeapID: ULONG_PTR; // heap (in owning process's context!)
116
{$EXTERNALSYM tagHEAPLIST32}
117
HEAPLIST32 = tagHEAPLIST32;
118
{$EXTERNALSYM HEAPLIST32}
119
LPHEAPLIST32 = ^HEAPLIST32;
120
{$EXTERNALSYM LPHEAPLIST32}
121
THeapList32 = HEAPLIST32;
128
HF32_DEFAULT = 1; // process's default heap
129
{$EXTERNALSYM HF32_DEFAULT}
130
HF32_SHARED = 2; // is shared heap
131
{$EXTERNALSYM HF32_SHARED}
133
function Heap32ListFirst(hSnapshot: HANDLE; var lphl: HEAPLIST32): BOOL; stdcall;
134
{$EXTERNALSYM Heap32ListFirst}
135
function Heap32ListNext(hSnapshot: HANDLE; var lphl: HEAPLIST32): BOOL; stdcall;
136
{$EXTERNALSYM Heap32ListNext}
139
PHEAPENTRY32 = ^HEAPENTRY32;
140
{$EXTERNALSYM PHEAPENTRY32}
141
tagHEAPENTRY32 = record
143
hHandle: HANDLE; // Handle of this heap block
144
dwAddress: ULONG_PTR; // Linear address of start of block
145
dwBlockSize: SIZE_T; // Size of block in bytes
149
th32ProcessID: DWORD; // owning process
150
th32HeapID: ULONG_PTR; // heap block is in
152
{$EXTERNALSYM tagHEAPENTRY32}
153
HEAPENTRY32 = tagHEAPENTRY32;
154
{$EXTERNALSYM HEAPENTRY32}
155
LPHEAPENTRY32 = ^HEAPENTRY32;
156
{$EXTERNALSYM LPHEAPENTRY32}
157
THeapEntry32 = HEAPENTRY32;
164
LF32_FIXED = $00000001;
165
{$EXTERNALSYM LF32_FIXED}
166
LF32_FREE = $00000002;
167
{$EXTERNALSYM LF32_FREE}
168
LF32_MOVEABLE = $00000004;
169
{$EXTERNALSYM LF32_MOVEABLE}
171
function Heap32First(var lphe: HEAPENTRY32; th32ProcessID: DWORD;
172
th32HeapID: ULONG_PTR): BOOL; stdcall;
173
{$EXTERNALSYM Heap32First}
174
function Heap32Next(var lphe: HEAPENTRY32): BOOL; stdcall;
175
{$EXTERNALSYM Heap32Next}
177
function Toolhelp32ReadProcessMemory(th32ProcessID: DWORD; lpBaseAddress: LPCVOID;
178
lpBuffer: LPVOID; cbRead: DWORD; lpNumberOfBytesRead: LPDWORD): BOOL; stdcall;
179
{$EXTERNALSYM Toolhelp32ReadProcessMemory}
184
PPROCESSENTRY32W = ^PROCESSENTRY32W;
185
{$EXTERNALSYM PPROCESSENTRY32W}
186
tagPROCESSENTRY32W = record
189
th32ProcessID: DWORD; // this process
190
th32DefaultHeapID: ULONG_PTR;
191
th32ModuleID:DWORD; // associated exe
193
th32ParentProcessID: DWORD; // this process's parent process
194
pcPriClassBase: LONG; // Base priority of process's threads
196
szExeFile: array [0..MAX_PATH - 1] of WCHAR; // Path
198
{$EXTERNALSYM tagPROCESSENTRY32W}
199
PROCESSENTRY32W = tagPROCESSENTRY32W;
200
{$EXTERNALSYM PROCESSENTRY32W}
201
LPPROCESSENTRY32W = ^PROCESSENTRY32W;
202
{$EXTERNALSYM LPPROCESSENTRY32W}
203
TProcessEntry32W = PROCESSENTRY32W;
207
PROCESSENTRY32 = PROCESSENTRY32W;
208
{$EXTERNALSYM PROCESSENTRY32}
209
PPROCESSENTRY32 = PPROCESSENTRY32W;
210
{$EXTERNALSYM PPROCESSENTRY32}
211
LPPROCESSENTRY32 = LPPROCESSENTRY32W;
212
{$EXTERNALSYM LPPROCESSENTRY32}
213
TProcessEntry32 = TProcessEntry32W;
217
PPROCESSENTRY32 = ^PROCESSENTRY32;
218
{$EXTERNALSYM PPROCESSENTRY32}
219
tagPROCESSENTRY32 = record
222
th32ProcessID: DWORD; // this process
223
th32DefaultHeapID: ULONG_PTR;
224
th32ModuleID: DWORD; // associated exe
226
th32ParentProcessID: DWORD; // this process's parent process
227
pcPriClassBase: LONG; // Base priority of process's threads
229
szExeFile: array [0..MAX_PATH - 1] of Char; // Path
231
{$EXTERNALSYM tagPROCESSENTRY32}
232
PROCESSENTRY32 = tagPROCESSENTRY32;
233
{$EXTERNALSYM PROCESSENTRY32}
234
LPPROCESSENTRY32 = ^PROCESSENTRY32;
235
{$EXTERNALSYM LPPROCESSENTRY32}
236
TProcessEntry32 = PROCESSENTRY32;
240
function Process32FirstW(hSnapshot: HANDLE; var lppe: PROCESSENTRY32W): BOOL; stdcall;
241
{$EXTERNALSYM Process32FirstW}
242
function Process32NextW(hSnapshot: HANDLE; var lppe: PROCESSENTRY32W): BOOL; stdcall;
243
{$EXTERNALSYM Process32NextW}
245
function Process32First(hSnapshot: HANDLE; var lppe: PROCESSENTRY32): BOOL; stdcall;
246
{$EXTERNALSYM Process32First}
247
function Process32Next(hSnapshot: HANDLE; var lppe: PROCESSENTRY32): BOOL; stdcall;
248
{$EXTERNALSYM Process32Next}
253
PTHREADENTRY32 = ^THREADENTRY32;
254
{$EXTERNALSYM PTHREADENTRY32}
255
tagTHREADENTRY32 = record
258
th32ThreadID: DWORD; // this thread
259
th32OwnerProcessID: DWORD; // Process this thread is associated with
264
{$EXTERNALSYM tagTHREADENTRY32}
265
THREADENTRY32 = tagTHREADENTRY32;
266
{$EXTERNALSYM THREADENTRY32}
267
LPTHREADENTRY32 = ^THREADENTRY32;
268
{$EXTERNALSYM LPTHREADENTRY32}
269
TThreadEntry32 = THREADENTRY32;
271
function Thread32First(hSnapshot: HANDLE; var lpte: THREADENTRY32): BOOL; stdcall;
272
{$EXTERNALSYM Thread32First}
273
function Thread32Next(hSnapshot: HANDLE; var lpte: THREADENTRY32): BOOL; stdcall;
274
{$EXTERNALSYM Thread32Next}
279
PMODULEENTRY32W = ^MODULEENTRY32W;
280
{$EXTERNALSYM PMODULEENTRY32W}
281
tagMODULEENTRY32W = record
283
th32ModuleID: DWORD; // This module
284
th32ProcessID: DWORD; // owning process
285
GlblcntUsage: DWORD; // Global usage count on the module
286
ProccntUsage: DWORD; // Module usage count in th32ProcessID's context
287
modBaseAddr: LPBYTE; // Base address of module in th32ProcessID's context
288
modBaseSize: DWORD; // Size in bytes of module starting at modBaseAddr
289
hModule: HMODULE; // The hModule of this module in th32ProcessID's context
290
szModule: array [0..MAX_MODULE_NAME32] of WCHAR;
291
szExePath: array [0..MAX_PATH - 1] of WCHAR;
293
{$EXTERNALSYM tagMODULEENTRY32W}
294
MODULEENTRY32W = tagMODULEENTRY32W;
295
{$EXTERNALSYM MODULEENTRY32W}
296
LPMODULEENTRY32W = ^MODULEENTRY32W;
297
{$EXTERNALSYM LPMODULEENTRY32W}
298
TModuleEntry32W = MODULEENTRY32W;
302
MODULEENTRY32 = MODULEENTRY32W;
303
{$EXTERNALSYM MODULEENTRY32}
304
PMODULEENTRY32 = PMODULEENTRY32W;
305
{$EXTERNALSYM PMODULEENTRY32}
306
LPMODULEENTRY32 = LPMODULEENTRY32W;
307
{$EXTERNALSYM LPMODULEENTRY32}
308
TModuleEntry32 = TModuleEntry32W;
312
PMODULEENTRY32 = ^MODULEENTRY32;
313
{$EXTERNALSYM PMODULEENTRY32}
314
tagMODULEENTRY32 = record
316
th32ModuleID: DWORD; // This module
317
th32ProcessID: DWORD; // owning process
318
GlblcntUsage: DWORD; // Global usage count on the module
319
ProccntUsage: DWORD; // Module usage count in th32ProcessID's context
320
modBaseAddr: LPBYTE; // Base address of module in th32ProcessID's context
321
modBaseSize: DWORD; // Size in bytes of module starting at modBaseAddr
322
hModule: HMODULE; // The hModule of this module in th32ProcessID's context
323
szModule: array [0..MAX_MODULE_NAME32] of Char;
324
szExePath: array [0..MAX_PATH - 1] of Char;
326
{$EXTERNALSYM tagMODULEENTRY32}
327
MODULEENTRY32 = tagMODULEENTRY32;
328
{$EXTERNALSYM MODULEENTRY32}
329
LPMODULEENTRY32 = ^MODULEENTRY32;
330
{$EXTERNALSYM LPMODULEENTRY32}
331
TModuleEntry32 = MODULEENTRY32;
335
function Module32FirstW(hSnapshot: HANDLE; var lpme: MODULEENTRY32W): BOOL; stdcall;
336
{$EXTERNALSYM Module32FirstW}
337
function Module32NextW(hSnapshot: HANDLE; var lpme: MODULEENTRY32W): BOOL; stdcall;
338
{$EXTERNALSYM Module32NextW}
341
// NOTE CAREFULLY that the modBaseAddr and hModule fields are valid ONLY
342
// in th32ProcessID's process context.
344
function Module32First(hSnapshot: HANDLE; var lpme: MODULEENTRY32): BOOL; stdcall;
345
{$EXTERNALSYM Module32First}
346
function Module32Next(hSnapshot: HANDLE; var lpme: MODULEENTRY32): BOOL; stdcall;
347
{$EXTERNALSYM Module32Next}
352
kernel32 = 'kernel32.dll';
359
{$IFDEF DYNAMIC_LINK}
362
_CreateToolhelp32Snapshot: Pointer;
364
function CreateToolhelp32Snapshot;
366
GetProcedureAddress(_CreateToolhelp32Snapshot, kernel32, 'CreateToolhelp32Snapshot');
370
JMP [_CreateToolhelp32Snapshot]
375
_Heap32ListFirst: Pointer;
377
function Heap32ListFirst;
379
GetProcedureAddress(_Heap32ListFirst, kernel32, 'Heap32ListFirst');
383
JMP [_Heap32ListFirst]
388
_Heap32ListNext: Pointer;
390
function Heap32ListNext;
392
GetProcedureAddress(_Heap32ListNext, kernel32, 'Heap32ListNext');
396
JMP [_Heap32ListNext]
401
_Heap32First: Pointer;
403
function Heap32First;
405
GetProcedureAddress(_Heap32First, kernel32, 'Heap32First');
414
_Heap32Next: Pointer;
418
GetProcedureAddress(_Heap32Next, kernel32, 'Heap32Next');
427
_Toolhelp32ReadProcessMemory: Pointer;
429
function Toolhelp32ReadProcessMemory;
431
GetProcedureAddress(_Toolhelp32ReadProcessMemory, kernel32, 'Toolhelp32ReadProcessMemory');
435
JMP [_Toolhelp32ReadProcessMemory]
440
_Process32FirstW: Pointer;
442
function Process32FirstW;
444
GetProcedureAddress(_Process32FirstW, kernel32, 'Process32FirstW');
448
JMP [_Process32FirstW]
453
_Process32NextW: Pointer;
455
function Process32NextW;
457
GetProcedureAddress(_Process32NextW, kernel32, 'Process32NextW');
461
JMP [_Process32NextW]
466
_Process32First: Pointer;
468
function Process32First;
470
GetProcedureAddress(_Process32First, kernel32, 'Process32First' + AWSuffix);
474
JMP [_Process32First]
479
_Process32Next: Pointer;
481
function Process32Next;
483
GetProcedureAddress(_Process32Next, kernel32, 'Process32Next' + AWSuffix);
492
_Thread32First: Pointer;
494
function Thread32First;
496
GetProcedureAddress(_Thread32First, kernel32, 'Thread32First');
505
_Thread32Next: Pointer;
507
function Thread32Next;
509
GetProcedureAddress(_Thread32Next, kernel32, 'Thread32Next');
518
_Module32FirstW: Pointer;
520
function Module32FirstW;
522
GetProcedureAddress(_Module32FirstW, kernel32, 'Module32FirstW');
526
JMP [_Module32FirstW]
531
_Module32NextW: Pointer;
533
function Module32NextW;
535
GetProcedureAddress(_Module32NextW, kernel32, 'Module32NextW');
544
_Module32First: Pointer;
546
function Module32First;
548
GetProcedureAddress(_Module32First, kernel32, 'Module32First' + AWSuffix);
557
_Module32Next: Pointer;
559
function Module32Next;
561
GetProcedureAddress(_Module32Next, kernel32, 'Module32Next' + AWSuffix);
571
function CreateToolhelp32Snapshot; external kernel32 name 'CreateToolhelp32Snapshot';
572
function Heap32ListFirst; external kernel32 name 'Heap32ListFirst';
573
function Heap32ListNext; external kernel32 name 'Heap32ListNext';
574
function Heap32First; external kernel32 name 'Heap32First';
575
function Heap32Next; external kernel32 name 'Heap32Next';
576
function Toolhelp32ReadProcessMemory; external kernel32 name 'Toolhelp32ReadProcessMemory';
577
function Process32FirstW; external kernel32 name 'Process32FirstW';
578
function Process32NextW; external kernel32 name 'Process32NextW';
579
function Process32First; external kernel32 name 'Process32First' + AWSuffix;
580
function Process32Next; external kernel32 name 'Process32Next' + AWSuffix;
581
function Thread32First; external kernel32 name 'Thread32First';
582
function Thread32Next; external kernel32 name 'Thread32Next';
583
function Module32FirstW; external kernel32 name 'Module32FirstW';
584
function Module32NextW; external kernel32 name 'Module32NextW';
585
function Module32First; external kernel32 name 'Module32First' + AWSuffix;
586
function Module32Next; external kernel32 name 'Module32Next' + AWSuffix;
588
{$ENDIF DYNAMIC_LINK}