What is 'snapshot' function?

Question

My english not so good. I see this in tlhelp32.h Version 1.0:

/****** Shapshot function **********************************************/

HANDLE
WINAPI
CreateToolhelp32Snapshot(
    DWORD dwFlags,
    DWORD th32ProcessID
    );

Ln31. What is this mean?

Answer 1

It means it will create a snapshot of the processes in the system. A snapshot is the state of something at a given point in time. After you create the snapshot, new processes may start or old processes may end, but those changes will not be reflected in your snapshot.

Update: I didn't even noticed the typo, it's supposed to be snapshot not shapshot.

Answer 2

CreateToolhelp32Snapshot() is a function that helps you iterate all running processes. Or the resources used by a process. Like all the DLLs loaded by the process. Or the threads used by the process. Etcetera.

In general, that's a perilous operation. Because the process continues to execute and may load or unload DLLs or start or end threads, while you are iterating them. This will not in general come to a good end, very hard to ask for "give me the next one" when the previously iterated resource is no longer there.

So what CreateToolhelp32Snapshot() does is, very briefly, suspends the process and copy all the info about the resources used by the process. So when it returns, you can safely call Module32First/Next and Thread32First/Next to iterate the copied information. It creates a snapshot of the process state. Like a photograph, a frozen moment in time. The exact way it gets an atomic copy of the process state is not documented btw.

Do beware that the info you get is always stale, that's inevitable. And do note the dwFlags argument, that lets you ask for the specific resource you are going to iterate. Which helps it to make the snapshot quicker and consume less memory.