locked
CreateToolhelp32Snapshot and EnumProcessModules won't work on vista 64 bit OS when 32 bit app calls these functions on 64 bit RRS feed

  • Question

  • I previously used CreateToolhelp32Snapshot to get PID of a given process running and then EnumProcessModules to list the modules (dll's)running with that process.

    however, my programs were solely used in 32 bit environment before. I wish to be able to utilize the same code to list 64 bit programs list of modules under a process.

    The CreateToolhelp32Snapshot / Process32First / Process32Next works fine to get the PID of 64 bit apps, but EnumProcessModules / GetModuleFileNameExA / GetModuleBaseNameA does not work on 64 bit processes that are running.

     

    I note the following in the MSDN knowledge base regarding EnumProcessModules:

     

    If this function is called from a 32-bit application running on WOW64, it can only enumerate the modules of a 32-bit process. To enumerate the modules of a 64-bit process from an application running on WOW64, use the CreateToolhelp32Snapshot function.

     

    and then on the CreateToolhelp32Snapshot page of the same site:

     

    CreateToolhelp32Snapshot Function
    ----------------------------------
    If the specified process is a 64-bit process and the caller is a 32-bit process, this call will fail. Note that you can use the QueryFullProcessImageName function to retrieve the full name of an executable image for both 32- and 64-bit processes from a 32-bit process.

     

    I See the information posted for QueryFullProcessImageName but am not sure how to implement it.

    do you do this instead of CreateToolhelp32Snapshot? then what? how do you access the list of modules running under that process?

     

    i am not sure how to get ahold of the list of modules of a running 64 bit process from a 32 bit application.

     

    for instance:

     

    My application is 32 bit program.  I am running it in Vista 64 bit OS.  it tries to access 64 bit program (notepad.exe, for instance) and list the attached modules of that process (kernel32.dll, for instance) and also the base address of the .exe and each of the .dll's.

     

    I appreciate any help in this!

     

    best,

    Mike


    Monday, February 25, 2008 3:25 AM

All replies

  • Hi Mike

    The funny thing is that pslist by sysinternals are able to do it (eg. list 64 bit processes from a 32 bit application)

    I am also looking for a solution.
    --
    Svend
    Tuesday, March 25, 2008 2:13 PM
  • Hi, 

     I tried, but there seems no appropriate solution to this question. U can try EnumProcessModulesEx() to get modules in 64bit process, but make sure that ur application is a 64bit app, it means it can't run on 32bit OS.

    Friday, June 20, 2014 3:38 AM