I was experimenting with some stuff in WinAPI. My OS is Win7 x64 P1 Ultimate. When I was trying to list all modules of a process I found out that the module that I wanted is a 32-bit module so I replaced
TH32CS_SNAPMODULE
With
TH32CS_SNAPMODULE32
After this no module was shown. So I decided to try using bitwise operators and looks like if I send the arguments like this
TH32CS_SNAPMODULE32 | TH32CS_SNAPMODULE
It works perfectly fine, listing all 64bit and 32bit modules. So my question here is why it doesn't work alone? Even the docs say it can be used with TH32CS_SNAPMODULE.
Quote from MSDN
TH32CS_SNAPMODULE32
Includes all 32-bit modules of the process specified in th32ProcessID in the snapshot when called from a 64-bit process. This flag can be combined with TH32CS_SNAPMODULE or TH32CS_SNAPALL. If the function fails with ERROR_BAD_LENGTH, retry the function until it succeeds.
The documentation is admittedly confusing. What it meant to say is that the TH32CS_SNAPMODULE32 flag must be combined with another flag, but can only be combined with TH32CS_SNAPMODULE or TH32CS_SNAPALL.
It's only slightly better phrased in this official answer TH32CS_SNAPMODULE vs TH32CS_SNAPMODULE32 - note the "extra":
Based on the feedback from the developer team, TH32CS_SNAPMODULE will provide you native modules. You can OR TH32CS_SNAPMODULE32 with TH32CS_SNAPMODULE to get 32-bit modules also when on a 64-bit box. It exists to indicate that you want the extra 32-bit module state.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With