PSS_HANDLE_ENTRY structure (processsnapshot.h)

Holds information about a handle returned by PssWalkSnapshot.

Syntax

typedef struct {
  HANDLE           Handle;
  PSS_HANDLE_FLAGS Flags;
  PSS_OBJECT_TYPE  ObjectType;
  FILETIME         CaptureTime;
  DWORD            Attributes;
  DWORD            GrantedAccess;
  DWORD            HandleCount;
  DWORD            PointerCount;
  DWORD            PagedPoolCharge;
  DWORD            NonPagedPoolCharge;
  FILETIME         CreationTime;
  WORD             TypeNameLength;
  wchar_t const    *TypeName;
  WORD             ObjectNameLength;
  wchar_t const    *ObjectName;
  union {
    struct {
      DWORD     ExitStatus;
      void      *PebBaseAddress;
      ULONG_PTR AffinityMask;
      LONG      BasePriority;
      DWORD     ProcessId;
      DWORD     ParentProcessId;
      DWORD     Flags;
    } Process;
    struct {
      DWORD     ExitStatus;
      void      *TebBaseAddress;
      DWORD     ProcessId;
      DWORD     ThreadId;
      ULONG_PTR AffinityMask;
      int       Priority;
      int       BasePriority;
      void      *Win32StartAddress;
    } Thread;
    struct {
      LONG  CurrentCount;
      BOOL  Abandoned;
      DWORD OwnerProcessId;
      DWORD OwnerThreadId;
    } Mutant;
    struct {
      BOOL ManualReset;
      BOOL Signaled;
    } Event;
    struct {
      void          *BaseAddress;
      DWORD         AllocationAttributes;
      LARGE_INTEGER MaximumSize;
    } Section;
    struct {
      LONG CurrentCount;
      LONG MaximumCount;
    } Semaphore;
  } TypeSpecificInformation;
} PSS_HANDLE_ENTRY;

Members

Handle

The handle value.

Flags

Flags that indicate what parts of this structure are valid. For more information, see PSS_HANDLE_FLAGS.

ObjectType

The type of the object that the handle references. For more information, see PSS_OBJECT_TYPE.

CaptureTime

The capture time of this information. For more information, see FILETIME.

Attributes

Attributes.

GrantedAccess

Reserved for use by the operating system.

HandleCount

Reserved for use by the operating system.

PointerCount

Reserved for use by the operating system.

PagedPoolCharge

Reserved for use by the operating system.

NonPagedPoolCharge

Reserved for use by the operating system.

CreationTime

Reserved for use by the operating system.

TypeNameLength

The length of TypeName, in bytes.

TypeName

The type name of the object referenced by this handle. The buffer may not terminated by a NULL character. The pointer is valid for the lifetime of the walk marker passed to PssWalkSnapshot.

ObjectNameLength

The length of ObjectName, in bytes.

ObjectName

Specifies the name of the object referenced by this handle. The buffer may not terminated by a NULL character. The pointer is valid for the lifetime of the walk marker passed to PssWalkSnapshot.

TypeSpecificInformation

Type-specific information.

Process

Valid for ObjectType = PSS_OBJECT_TYPE_PROCESS.

ExitStatus

The exit code of the process. If the process has not exited, this is set to STILL_ACTIVE (259).

PebBaseAddress

The address of the process environment block (PEB). Reserved for use by the operating system.

AffinityMask

The affinity mask of the process.

BasePriority

The base priority level of the process.

ProcessId

The process ID.

ParentProcessId

The parent process ID.

Flags

Flags about the process. For more information, see PSS_PROCESS_FLAGS.

Thread

Valid for ObjectType = PSS_OBJECT_TYPE_THREAD.

ExitStatus

The exit code of the process. If the process has not exited, this is set to STILL_ACTIVE (259).

TebBaseAddress

The address of the thread environment block (TEB). Reserved for use by the operating system.

ProcessId

The process ID.

ThreadId

The thread ID.

AffinityMask

The affinity mask of the process.

Priority

The thread’s dynamic priority level.

BasePriority

The thread’s base priority level.

Win32StartAddress

A pointer to the thread procedure for the thread.

Mutant

Valid for ObjectType = PSS_OBJECT_TYPE_MUTANT.

CurrentCount

Reserved for use by the operating system.

Abandoned

TRUE if the mutant has been abandoned (the owning thread exited without releasing the mutex), FALSE if not.

OwnerProcessId

The process ID of the owning thread, at the time of snapshot creation and handle capture.

OwnerThreadId

The process ID of the owning thread, at the time of snapshot creation and handle capture.

Event

Valid for ObjectType = PSS_OBJECT_TYPE_EVENT.

ManualReset

TRUE if the event is manual reset, FALSE if not.

Signaled

TRUE if the event was signaled at the time of snapshot creation and handle capture, FALSE if not.

Section

Valid for ObjectType = PSS_OBJECT_TYPE_SECTION.

BaseAddress

Reserved for use by the operating system.

AllocationAttributes

Reserved for use by the operating system.

MaximumSize

Reserved for use by the operating system.

TypeSpecificInformation.Process

TypeSpecificInformation.Process.ExitStatus

TypeSpecificInformation.Process.PebBaseAddress

TypeSpecificInformation.Process.AffinityMask

TypeSpecificInformation.Process.BasePriority

TypeSpecificInformation.Process.ProcessId

TypeSpecificInformation.Process.ParentProcessId

TypeSpecificInformation.Process.Flags

TypeSpecificInformation.Thread

TypeSpecificInformation.Thread.ExitStatus

TypeSpecificInformation.Thread.TebBaseAddress

TypeSpecificInformation.Thread.ProcessId

TypeSpecificInformation.Thread.ThreadId

TypeSpecificInformation.Thread.AffinityMask

TypeSpecificInformation.Thread.Priority

TypeSpecificInformation.Thread.BasePriority

TypeSpecificInformation.Thread.Win32StartAddress

TypeSpecificInformation.Mutant

TypeSpecificInformation.Mutant.CurrentCount

TypeSpecificInformation.Mutant.Abandoned

TypeSpecificInformation.Mutant.OwnerProcessId

TypeSpecificInformation.Mutant.OwnerThreadId

TypeSpecificInformation.Event

TypeSpecificInformation.Event.ManualReset

TypeSpecificInformation.Event.Signaled

TypeSpecificInformation.Section

TypeSpecificInformation.Section.BaseAddress

TypeSpecificInformation.Section.AllocationAttributes

TypeSpecificInformation.Section.MaximumSize

TypeSpecificInformation.Semaphore

TypeSpecificInformation.Semaphore.CurrentCount

TypeSpecificInformation.Semaphore.MaximumCount

Remarks

PssWalkSnapshot returns a PSS_HANDLE_ENTRY structure when the PSS_WALK_INFORMATION_CLASS member that the caller provides it is PSS_WALK_HANDLES.

Requirements

See also

Process Snapshotting