dlls/kernel32/toolhelp.c

   1 /*
   2  * Misc Toolhelp functions
   3  *
   4  * Copyright 1996 Marcus Meissner
   5  * Copyright 2005 Eric Pouech
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #include <stdarg.h>
  23 #include <stdlib.h>
  24 #include <string.h>
  25 #include <ctype.h>
  26 #include <assert.h>
  27 #include "ntstatus.h"
  28 #define WIN32_NO_STATUS
  29 #include "windef.h"
  30 #include "winbase.h"
  31 #include "winerror.h"
  32 #include "tlhelp32.h"
  33 #include "winnls.h"
  34 #include "winternl.h"
  35
  36 #include "kernel_private.h"
  37 #include "wine/debug.h"
  38
  39 WINE_DEFAULT_DEBUG_CHANNEL(toolhelp);
  40
  41 struct snapshot
  42 {
  43     int         process_count;
  44     int         process_pos;
  45     int         process_offset;
  46     int         thread_count;
  47     int         thread_pos;
  48     int         thread_offset;
  49     int         module_count;
  50     int         module_pos;
  51     int         module_offset;
  52     char        data[1];
  53 };
  54
  55 static WCHAR *fetch_string( HANDLE hProcess, UNICODE_STRING* us)
  56 {
  57     WCHAR*      local;
  58
  59     local = HeapAlloc( GetProcessHeap(), 0, us->Length );
  60     if (local)
  61     {
  62         if (!ReadProcessMemory( hProcess, us->Buffer, local, us->Length, NULL))
  63         {
  64             HeapFree( GetProcessHeap(), 0, local );
  65             local = NULL;
  66         }
  67     }
  68     us->Buffer = local;
  69     return local;
  70 }
  71
  72 static BOOL fetch_module( DWORD process, DWORD flags, LDR_DATA_TABLE_ENTRY **ldr_mod, ULONG *num )
  73 {
  74     HANDLE                      hProcess;
  75     PROCESS_BASIC_INFORMATION   pbi;
  76     PPEB_LDR_DATA               pLdrData;
  77     PLIST_ENTRY                 head, curr;
  78     BOOL                        ret = FALSE;
  79
  80     *num = 0;
  81
  82     if (!(flags & TH32CS_SNAPMODULE)) return TRUE;
  83
  84     if (process)
  85     {
  86         hProcess = OpenProcess( PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, FALSE, process );
  87         if (!hProcess) return FALSE;
  88     }
  89     else
  90         hProcess = GetCurrentProcess();
  91
  92     if (set_ntstatus( NtQueryInformationProcess( hProcess, ProcessBasicInformation,
  93                                                  &pbi, sizeof(pbi), NULL )))
  94     {
  95         if (ReadProcessMemory( hProcess, &pbi.PebBaseAddress->LdrData,
  96                                &pLdrData, sizeof(pLdrData), NULL ) &&
  97             ReadProcessMemory( hProcess,
  98                                &pLdrData->InLoadOrderModuleList.Flink,
  99                                &curr, sizeof(curr), NULL ))
 100         {
 101             head = &pLdrData->InLoadOrderModuleList;
 102
 103             while (curr != head)
 104             {
 105                 if (!*num)
 106                     *ldr_mod = HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(LDR_DATA_TABLE_ENTRY) );
 107                 else
 108                     *ldr_mod = HeapReAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, *ldr_mod,
 109                                             (*num + 1) * sizeof(LDR_DATA_TABLE_ENTRY) );
 110                 if (!*ldr_mod) break;
 111                 if (!ReadProcessMemory( hProcess,
 112                                         CONTAINING_RECORD(curr, LDR_DATA_TABLE_ENTRY,
 113                                                           InLoadOrderLinks),
 114                                         &(*ldr_mod)[*num],
 115                                         sizeof(LDR_DATA_TABLE_ENTRY), NULL))
 116                     break;
 117                 curr = (*ldr_mod)[*num].InLoadOrderLinks.Flink;
 118                 /* if we cannot fetch the strings, then just ignore this LDR_DATA_TABLE_ENTRY
 119                  * and continue loading the other ones in the list
 120                  */
 121                 if (!fetch_string( hProcess, &(*ldr_mod)[*num].BaseDllName )) continue;
 122                 if (fetch_string( hProcess, &(*ldr_mod)[*num].FullDllName ))
 123                     (*num)++;
 124                 else
 125                     HeapFree( GetProcessHeap(), 0, (*ldr_mod)[*num].BaseDllName.Buffer );
 126             }
 127             ret = TRUE;
 128         }
 129     }
 130
 131     if (process) CloseHandle( hProcess );
 132     return ret;
 133 }
 134
 135 static void fill_module( struct snapshot* snap, ULONG* offset, ULONG process,
 136                          LDR_DATA_TABLE_ENTRY* ldr_mod, ULONG num )
 137 {
 138     MODULEENTRY32W*     mod;
 139     ULONG               i;
 140     SIZE_T              l;
 141
 142     snap->module_count = num;
 143     snap->module_pos = 0;
 144     if (!num) return;
 145     snap->module_offset = *offset;
 146
 147     mod = (MODULEENTRY32W*)&snap->data[*offset];
 148
 149     for (i = 0; i < num; i++)
 150     {
 151         mod->dwSize = sizeof(MODULEENTRY32W);
 152         mod->th32ModuleID = 1; /* toolhelp internal id, never used */
 153         mod->th32ProcessID = process ? process : GetCurrentProcessId();
 154         mod->GlblcntUsage = 0xFFFF; /* FIXME */
 155         mod->ProccntUsage = 0xFFFF; /* FIXME */
 156         mod->modBaseAddr = ldr_mod[i].DllBase;
 157         mod->modBaseSize = ldr_mod[i].SizeOfImage;
 158         mod->hModule = ldr_mod[i].DllBase;
 159
 160         l = min(ldr_mod[i].BaseDllName.Length, sizeof(mod->szModule) - sizeof(WCHAR));
 161         memcpy(mod->szModule, ldr_mod[i].BaseDllName.Buffer, l);
 162         mod->szModule[l / sizeof(WCHAR)] = '\0';
 163         l = min(ldr_mod[i].FullDllName.Length, sizeof(mod->szExePath) - sizeof(WCHAR));
 164         memcpy(mod->szExePath, ldr_mod[i].FullDllName.Buffer, l);
 165         mod->szExePath[l / sizeof(WCHAR)] = '\0';
 166
 167         mod++;
 168     }
 169
 170     *offset += num * sizeof(MODULEENTRY32W);
 171 }
 172
 173 static BOOL fetch_process_thread( DWORD flags, SYSTEM_PROCESS_INFORMATION** pspi,
 174                                   ULONG* num_pcs, ULONG* num_thd)
 175 {
 176     NTSTATUS                    status;
 177     ULONG                       size, offset;
 178     PSYSTEM_PROCESS_INFORMATION spi;
 179
 180     *num_pcs = *num_thd = 0;
 181     if (!(flags & (TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD))) return TRUE;
 182
 183     *pspi = HeapAlloc( GetProcessHeap(), 0, size = 4096 );
 184     for (;;)
 185     {
 186         status = NtQuerySystemInformation( SystemProcessInformation, *pspi,
 187                                            size, NULL );
 188         switch (status)
 189         {
 190         case STATUS_SUCCESS:
 191             *num_pcs = *num_thd = offset = 0;
 192             spi = *pspi;
 193             do
 194             {
 195                 spi = (SYSTEM_PROCESS_INFORMATION*)((char*)spi + offset);
 196                 if (flags & TH32CS_SNAPPROCESS) (*num_pcs)++;
 197                 if (flags & TH32CS_SNAPTHREAD) *num_thd += spi->dwThreadCount;
 198             } while ((offset = spi->NextEntryOffset));
 199             return TRUE;
 200         case STATUS_INFO_LENGTH_MISMATCH:
 201             *pspi = HeapReAlloc( GetProcessHeap(), 0, *pspi, size *= 2 );
 202             break;
 203         default:
 204             SetLastError( RtlNtStatusToDosError( status ) );
 205             return FALSE;
 206         }
 207     }
 208 }
 209
 210 static void fill_process( struct snapshot* snap, ULONG* offset,
 211                           SYSTEM_PROCESS_INFORMATION* spi, ULONG num )
 212 {
 213     PROCESSENTRY32W*            pcs_entry;
 214     ULONG                       poff = 0;
 215     SIZE_T                      l;
 216
 217     snap->process_count = num;
 218     snap->process_pos = 0;
 219     if (!num) return;
 220     snap->process_offset = *offset;
 221
 222     pcs_entry = (PROCESSENTRY32W*)&snap->data[*offset];
 223
 224     do
 225     {
 226         spi = (SYSTEM_PROCESS_INFORMATION*)((char*)spi + poff);
 227
 228         pcs_entry->dwSize = sizeof(PROCESSENTRY32W);
 229         pcs_entry->cntUsage = 0; /* MSDN says no longer used, always 0 */
 230         pcs_entry->th32ProcessID = HandleToUlong(spi->UniqueProcessId);
 231         pcs_entry->th32DefaultHeapID = 0; /* MSDN says no longer used, always 0 */
 232         pcs_entry->th32ModuleID = 0; /* MSDN says no longer used, always 0 */
 233         pcs_entry->cntThreads = spi->dwThreadCount;
 234         pcs_entry->th32ParentProcessID = HandleToUlong(spi->ParentProcessId);
 235         pcs_entry->pcPriClassBase = spi->dwBasePriority;
 236         pcs_entry->dwFlags = 0; /* MSDN says no longer used, always 0 */
 237         l = min(spi->ProcessName.Length, sizeof(pcs_entry->szExeFile) - sizeof(WCHAR));
 238         memcpy(pcs_entry->szExeFile, spi->ProcessName.Buffer, l);
 239         pcs_entry->szExeFile[l / sizeof(WCHAR)] = '\0';
 240         pcs_entry++;
 241     } while ((poff = spi->NextEntryOffset));
 242
 243     *offset += num * sizeof(PROCESSENTRY32W);
 244 }
 245
 246 static void fill_thread( struct snapshot* snap, ULONG* offset, LPVOID info, ULONG num )
 247 {
 248     THREADENTRY32*              thd_entry;
 249     SYSTEM_PROCESS_INFORMATION* spi;
 250     SYSTEM_THREAD_INFORMATION*  sti;
 251     ULONG                       i, poff = 0;
 252
 253     snap->thread_count = num;
 254     snap->thread_pos = 0;
 255     if (!num) return;
 256     snap->thread_offset = *offset;
 257
 258     thd_entry = (THREADENTRY32*)&snap->data[*offset];
 259
 260     spi = info;
 261     do
 262     {
 263         spi = (SYSTEM_PROCESS_INFORMATION*)((char*)spi + poff);
 264         sti = &spi->ti[0];
 265
 266         for (i = 0; i < spi->dwThreadCount; i++)
 267         {
 268             thd_entry->dwSize = sizeof(THREADENTRY32);
 269             thd_entry->cntUsage = 0; /* MSDN says no longer used, always 0 */
 270             thd_entry->th32ThreadID = HandleToUlong(sti->ClientId.UniqueThread);
 271             thd_entry->th32OwnerProcessID = HandleToUlong(sti->ClientId.UniqueProcess);
 272             thd_entry->tpBasePri = sti->dwBasePriority;
 273             thd_entry->tpDeltaPri = 0; /* MSDN says no longer used, always 0 */
 274             thd_entry->dwFlags = 0; /* MSDN says no longer used, always 0" */
 275
 276             sti++;
 277             thd_entry++;
 278       }
 279     } while ((poff = spi->NextEntryOffset));
 280     *offset += num * sizeof(THREADENTRY32);
 281 }
 282
 283 /***********************************************************************
 284  *           CreateToolhelp32Snapshot                   (KERNEL32.@)
 285  */
 286 HANDLE WINAPI CreateToolhelp32Snapshot( DWORD flags, DWORD process )
 287 {
 288     SYSTEM_PROCESS_INFORMATION* spi = NULL;
 289     LDR_DATA_TABLE_ENTRY *mod = NULL;
 290     ULONG               num_pcs, num_thd, num_mod;
 291     HANDLE              hSnapShot = 0;
 292
 293     TRACE("%x,%x\n", flags, process );
 294     if (!(flags & (TH32CS_SNAPPROCESS|TH32CS_SNAPTHREAD|TH32CS_SNAPMODULE)))
 295     {
 296         FIXME("flags %x not implemented\n", flags );
 297         SetLastError( ERROR_CALL_NOT_IMPLEMENTED );
 298         return INVALID_HANDLE_VALUE;
 299     }
 300
 301     if (fetch_module( process, flags, &mod, &num_mod ) &&
 302         fetch_process_thread( flags, &spi, &num_pcs, &num_thd ))
 303     {
 304         ULONG sect_size;
 305         struct snapshot*snap;
 306         SECURITY_ATTRIBUTES sa;
 307
 308         /* create & fill the snapshot section */
 309         sect_size = sizeof(struct snapshot) - 1; /* for last data[1] */
 310         if (flags & TH32CS_SNAPMODULE)  sect_size += num_mod * sizeof(MODULEENTRY32W);
 311         if (flags & TH32CS_SNAPPROCESS) sect_size += num_pcs * sizeof(PROCESSENTRY32W);
 312         if (flags & TH32CS_SNAPTHREAD)  sect_size += num_thd * sizeof(THREADENTRY32);
 313         if (flags & TH32CS_SNAPHEAPLIST)FIXME("Unimplemented: heap list snapshot\n");
 314
 315         sa.bInheritHandle = (flags & TH32CS_INHERIT) != 0;
 316         sa.lpSecurityDescriptor = NULL;
 317
 318         hSnapShot = CreateFileMappingW( INVALID_HANDLE_VALUE, &sa,
 319                                         SEC_COMMIT | PAGE_READWRITE,
 320                                         0, sect_size, NULL );
 321         if (hSnapShot && (snap = MapViewOfFile( hSnapShot, FILE_MAP_ALL_ACCESS, 0, 0, 0 )))
 322         {
 323             DWORD   offset = 0;
 324
 325             fill_module( snap, &offset, process, mod, num_mod );
 326             fill_process( snap, &offset, spi, num_pcs );
 327             fill_thread( snap, &offset, spi, num_thd );
 328             UnmapViewOfFile( snap );
 329         }
 330     }
 331
 332     while (num_mod--)
 333     {
 334         HeapFree( GetProcessHeap(), 0, mod[num_mod].BaseDllName.Buffer );
 335         HeapFree( GetProcessHeap(), 0, mod[num_mod].FullDllName.Buffer );
 336     }
 337     HeapFree( GetProcessHeap(), 0, mod );
 338     HeapFree( GetProcessHeap(), 0, spi );
 339
 340     if (!hSnapShot) return INVALID_HANDLE_VALUE;
 341     return hSnapShot;
 342 }
 343
 344 static BOOL next_thread( HANDLE hSnapShot, LPTHREADENTRY32 lpte, BOOL first )
 345 {
 346     struct snapshot*    snap;
 347     BOOL                ret = FALSE;
 348
 349     if (lpte->dwSize < sizeof(THREADENTRY32))
 350     {
 351         SetLastError( ERROR_INSUFFICIENT_BUFFER );
 352         WARN("Result buffer too small (%d)\n", lpte->dwSize);
 353         return FALSE;
 354     }
 355     if ((snap = MapViewOfFile( hSnapShot, FILE_MAP_ALL_ACCESS, 0, 0, 0 )))
 356     {
 357         if (first) snap->thread_pos = 0;
 358         if (snap->thread_pos < snap->thread_count)
 359         {
 360             LPTHREADENTRY32 te = (THREADENTRY32*)&snap->data[snap->thread_offset];
 361             *lpte = te[snap->thread_pos++];
 362             ret = TRUE;
 363         }
 364         else SetLastError( ERROR_NO_MORE_FILES );
 365         UnmapViewOfFile( snap );
 366     }
 367     return ret;
 368 }
 369
 370 /***********************************************************************
 371  *              Thread32First    (KERNEL32.@)
 372  *
 373  * Return info about the first thread in a toolhelp32 snapshot
 374  */
 375 BOOL WINAPI Thread32First( HANDLE hSnapShot, LPTHREADENTRY32 lpte )
 376 {
 377     return next_thread( hSnapShot, lpte, TRUE );
 378 }
 379
 380 /***********************************************************************
 381  *              Thread32Next    (KERNEL32.@)
 382  *
 383  * Return info about the first thread in a toolhelp32 snapshot
 384  */
 385 BOOL WINAPI Thread32Next( HANDLE hSnapShot, LPTHREADENTRY32 lpte )
 386 {
 387     return next_thread( hSnapShot, lpte, FALSE );
 388 }
 389
 390 /***********************************************************************
 391  *              process_next
 392  *
 393  * Implementation of Process32First/Next. Note that the ANSI / Unicode
 394  * version check is a bit of a hack as it relies on the fact that only
 395  * the last field is actually different.
 396  */
 397 static BOOL process_next( HANDLE hSnapShot, LPPROCESSENTRY32W lppe,
 398                           BOOL first, BOOL unicode )
 399 {
 400     struct snapshot*    snap;
 401     BOOL                ret = FALSE;
 402     DWORD               sz = unicode ? sizeof(PROCESSENTRY32W) : sizeof(PROCESSENTRY32);
 403
 404     if (lppe->dwSize < sz)
 405     {
 406         SetLastError( ERROR_INSUFFICIENT_BUFFER );
 407         WARN("Result buffer too small (%d)\n", lppe->dwSize);
 408         return FALSE;
 409     }
 410     if ((snap = MapViewOfFile( hSnapShot, FILE_MAP_ALL_ACCESS, 0, 0, 0 )))
 411     {
 412         if (first) snap->process_pos = 0;
 413         if (snap->process_pos < snap->process_count)
 414         {
 415             LPPROCESSENTRY32W pe = (PROCESSENTRY32W*)&snap->data[snap->process_offset];
 416             if (unicode)
 417                 *lppe = pe[snap->process_pos];
 418             else
 419             {
 420                 lppe->cntUsage = pe[snap->process_pos].cntUsage;
 421                 lppe->th32ProcessID = pe[snap->process_pos].th32ProcessID;
 422                 lppe->th32DefaultHeapID = pe[snap->process_pos].th32DefaultHeapID;
 423                 lppe->th32ModuleID = pe[snap->process_pos].th32ModuleID;
 424                 lppe->cntThreads = pe[snap->process_pos].cntThreads;
 425                 lppe->th32ParentProcessID = pe[snap->process_pos].th32ParentProcessID;
 426                 lppe->pcPriClassBase = pe[snap->process_pos].pcPriClassBase;
 427                 lppe->dwFlags = pe[snap->process_pos].dwFlags;
 428
 429                 WideCharToMultiByte( CP_ACP, 0, pe[snap->process_pos].szExeFile, -1,
 430                                      (char*)lppe->szExeFile, sizeof(lppe->szExeFile),
 431                                      0, 0 );
 432             }
 433             snap->process_pos++;
 434             ret = TRUE;
 435         }
 436         else SetLastError( ERROR_NO_MORE_FILES );
 437         UnmapViewOfFile( snap );
 438     }
 439
 440     return ret;
 441 }
 442
 443
 444 /***********************************************************************
 445  *              Process32First    (KERNEL32.@)
 446  *
 447  * Return info about the first process in a toolhelp32 snapshot
 448  */
 449 BOOL WINAPI Process32First(HANDLE hSnapshot, LPPROCESSENTRY32 lppe)
 450 {
 451     return process_next( hSnapshot, (PROCESSENTRY32W*)lppe, TRUE, FALSE /* ANSI */ );
 452 }
 453
 454 /***********************************************************************
 455  *              Process32Next   (KERNEL32.@)
 456  *
 457  * Return info about the "next" process in a toolhelp32 snapshot
 458  */
 459 BOOL WINAPI Process32Next(HANDLE hSnapshot, LPPROCESSENTRY32 lppe)
 460 {
 461     return process_next( hSnapshot, (PROCESSENTRY32W*)lppe, FALSE, FALSE /* ANSI */ );
 462 }
 463
 464 /***********************************************************************
 465  *              Process32FirstW    (KERNEL32.@)
 466  *
 467  * Return info about the first process in a toolhelp32 snapshot
 468  */
 469 BOOL WINAPI Process32FirstW(HANDLE hSnapshot, LPPROCESSENTRY32W lppe)
 470 {
 471     return process_next( hSnapshot, lppe, TRUE, TRUE /* Unicode */ );
 472 }
 473
 474 /***********************************************************************
 475  *              Process32NextW   (KERNEL32.@)
 476  *
 477  * Return info about the "next" process in a toolhelp32 snapshot
 478  */
 479 BOOL WINAPI Process32NextW(HANDLE hSnapshot, LPPROCESSENTRY32W lppe)
 480 {
 481     return process_next( hSnapshot, lppe, FALSE, TRUE /* Unicode */ );
 482 }
 483
 484 /***********************************************************************
 485  *              module_nextW
 486  *
 487  * Implementation of Module32{First|Next}W
 488  */
 489 static BOOL module_nextW( HANDLE hSnapShot, LPMODULEENTRY32W lpme, BOOL first )
 490 {
 491     struct snapshot*    snap;
 492     BOOL                ret = FALSE;
 493
 494     if (lpme->dwSize < sizeof (MODULEENTRY32W))
 495     {
 496         SetLastError( ERROR_INSUFFICIENT_BUFFER );
 497         WARN("Result buffer too small (was: %d)\n", lpme->dwSize);
 498         return FALSE;
 499     }
 500     if ((snap = MapViewOfFile( hSnapShot, FILE_MAP_ALL_ACCESS, 0, 0, 0 )))
 501     {
 502         if (first) snap->module_pos = 0;
 503         if (snap->module_pos < snap->module_count)
 504         {
 505             LPMODULEENTRY32W pe = (MODULEENTRY32W*)&snap->data[snap->module_offset];
 506             *lpme = pe[snap->module_pos++];
 507             ret = TRUE;
 508         }
 509         else SetLastError( ERROR_NO_MORE_FILES );
 510         UnmapViewOfFile( snap );
 511     }
 512
 513     return ret;
 514 }
 515
 516 /***********************************************************************
 517  *              Module32FirstW   (KERNEL32.@)
 518  *
 519  * Return info about the "first" module in a toolhelp32 snapshot
 520  */
 521 BOOL WINAPI Module32FirstW(HANDLE hSnapshot, LPMODULEENTRY32W lpme)
 522 {
 523     return module_nextW( hSnapshot, lpme, TRUE );
 524 }
 525
 526 /***********************************************************************
 527  *              Module32NextW   (KERNEL32.@)
 528  *
 529  * Return info about the "next" module in a toolhelp32 snapshot
 530  */
 531 BOOL WINAPI Module32NextW(HANDLE hSnapshot, LPMODULEENTRY32W lpme)
 532 {
 533     return module_nextW( hSnapshot, lpme, FALSE );
 534 }
 535
 536 /***********************************************************************
 537  *              module_nextA
 538  *
 539  * Implementation of Module32{First|Next}A
 540  */
 541 static BOOL module_nextA( HANDLE handle, LPMODULEENTRY32 lpme, BOOL first )
 542 {
 543     BOOL ret;
 544     MODULEENTRY32W mew;
 545
 546     if (lpme->dwSize < sizeof(MODULEENTRY32))
 547     {
 548         SetLastError( ERROR_INSUFFICIENT_BUFFER );
 549         WARN("Result buffer too small (was: %d)\n", lpme->dwSize);
 550         return FALSE;
 551     }
 552
 553     mew.dwSize = sizeof(mew);
 554     if ((ret = module_nextW( handle, &mew, first )))
 555     {
 556         lpme->th32ModuleID  = mew.th32ModuleID;
 557         lpme->th32ProcessID = mew.th32ProcessID;
 558         lpme->GlblcntUsage  = mew.GlblcntUsage;
 559         lpme->ProccntUsage  = mew.ProccntUsage;
 560         lpme->modBaseAddr   = mew.modBaseAddr;
 561         lpme->modBaseSize   = mew.modBaseSize;
 562         lpme->hModule       = mew.hModule;
 563         WideCharToMultiByte( CP_ACP, 0, mew.szModule, -1, lpme->szModule, sizeof(lpme->szModule), NULL, NULL );
 564         WideCharToMultiByte( CP_ACP, 0, mew.szExePath, -1, lpme->szExePath, sizeof(lpme->szExePath), NULL, NULL );
 565     }
 566     return ret;
 567 }
 568
 569 /***********************************************************************
 570  *              Module32First   (KERNEL32.@)
 571  *
 572  * Return info about the "first" module in a toolhelp32 snapshot
 573  */
 574 BOOL WINAPI Module32First(HANDLE hSnapshot, LPMODULEENTRY32 lpme)
 575 {
 576     return module_nextA( hSnapshot, lpme, TRUE );
 577 }
 578
 579 /***********************************************************************
 580  *              Module32Next   (KERNEL32.@)
 581  *
 582  * Return info about the "next" module in a toolhelp32 snapshot
 583  */
 584 BOOL WINAPI Module32Next(HANDLE hSnapshot, LPMODULEENTRY32 lpme)
 585 {
 586     return module_nextA( hSnapshot, lpme, FALSE );
 587 }
 588
 589 /************************************************************************
 590  *              Heap32ListFirst (KERNEL32.@)
 591  *
 592  */
 593 BOOL WINAPI Heap32ListFirst(HANDLE hSnapshot, LPHEAPLIST32 lphl)
 594 {
 595     FIXME(": stub\n");
 596     return FALSE;
 597 }
 598
 599 /******************************************************************
 600  *              Toolhelp32ReadProcessMemory (KERNEL32.@)
 601  *
 602  *
 603  */
 604 BOOL WINAPI Toolhelp32ReadProcessMemory(DWORD pid, const void* base,
 605                                         void* buf, SIZE_T len, SIZE_T* r)
 606 {
 607     HANDLE h;
 608     BOOL   ret = FALSE;
 609
 610     h = (pid) ? OpenProcess(PROCESS_VM_READ, FALSE, pid) : GetCurrentProcess();
 611     if (h != NULL)
 612     {
 613         ret = ReadProcessMemory(h, base, buf, len, r);
 614         if (pid) CloseHandle(h);
 615     }
 616     return ret;
 617 }