Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why does TH32CS_SNAPMODULE32 doesn't work alone?

Tags:

c

winapi

I was experimenting with some stuff in WinAPI. My OS is Win7 x64 P1 Ultimate. When I was trying to list all modules of a process I found out that the module that I wanted is a 32-bit module so I replaced

TH32CS_SNAPMODULE

With

TH32CS_SNAPMODULE32

After this no module was shown. So I decided to try using bitwise operators and looks like if I send the arguments like this

TH32CS_SNAPMODULE32 | TH32CS_SNAPMODULE

It works perfectly fine, listing all 64bit and 32bit modules. So my question here is why it doesn't work alone? Even the docs say it can be used with TH32CS_SNAPMODULE.

Quote from MSDN

TH32CS_SNAPMODULE32

Includes all 32-bit modules of the process specified in th32ProcessID in the snapshot when called from a 64-bit process. This flag can be combined with TH32CS_SNAPMODULE or TH32CS_SNAPALL. If the function fails with ERROR_BAD_LENGTH, retry the function until it succeeds.

like image 883
krystalgamer Avatar asked Jun 16 '26 04:06

krystalgamer


1 Answers

The documentation is admittedly confusing. What it meant to say is that the TH32CS_SNAPMODULE32 flag must be combined with another flag, but can only be combined with TH32CS_SNAPMODULE or TH32CS_SNAPALL.

It's only slightly better phrased in this official answer TH32CS_SNAPMODULE vs TH32CS_SNAPMODULE32 - note the "extra":

Based on the feedback from the developer team, TH32CS_SNAPMODULE will provide you native modules. You can OR TH32CS_SNAPMODULE32 with TH32CS_SNAPMODULE to get 32-bit modules also when on a 64-bit box. It exists to indicate that you want the extra 32-bit module state.

like image 123
dxiv Avatar answered Jun 20 '26 10:06

dxiv



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!