PSS_HANDLE_ENTRY structure (processsnapshot.h)
Holds information about a handle returned by PssWalkSnapshot.
Syntax
typedef struct {
HANDLE Handle;
PSS_HANDLE_FLAGS Flags;
PSS_OBJECT_TYPE ObjectType;
FILETIME CaptureTime;
DWORD Attributes;
DWORD GrantedAccess;
DWORD HandleCount;
DWORD PointerCount;
DWORD PagedPoolCharge;
DWORD NonPagedPoolCharge;
FILETIME CreationTime;
WORD TypeNameLength;
wchar_t const *TypeName;
WORD ObjectNameLength;
wchar_t const *ObjectName;
union {
struct {
DWORD ExitStatus;
void *PebBaseAddress;
ULONG_PTR AffinityMask;
LONG BasePriority;
DWORD ProcessId;
DWORD ParentProcessId;
DWORD Flags;
} Process;
struct {
DWORD ExitStatus;
void *TebBaseAddress;
DWORD ProcessId;
DWORD ThreadId;
ULONG_PTR AffinityMask;
int Priority;
int BasePriority;
void *Win32StartAddress;
} Thread;
struct {
LONG CurrentCount;
BOOL Abandoned;
DWORD OwnerProcessId;
DWORD OwnerThreadId;
} Mutant;
struct {
BOOL ManualReset;
BOOL Signaled;
} Event;
struct {
void *BaseAddress;
DWORD AllocationAttributes;
LARGE_INTEGER MaximumSize;
} Section;
struct {
LONG CurrentCount;
LONG MaximumCount;
} Semaphore;
} TypeSpecificInformation;
} PSS_HANDLE_ENTRY;
Members
Handle
The handle value.
Flags
Flags that indicate what parts of this structure are valid. For more information, see PSS_HANDLE_FLAGS.
ObjectType
The type of the object that the handle references. For more information, see PSS_OBJECT_TYPE.
CaptureTime
The capture time of this information. For more information, see FILETIME.
Attributes
Attributes.
GrantedAccess
Reserved for use by the operating system.
HandleCount
Reserved for use by the operating system.
PointerCount
Reserved for use by the operating system.
PagedPoolCharge
Reserved for use by the operating system.
NonPagedPoolCharge
Reserved for use by the operating system.
CreationTime
Reserved for use by the operating system.
TypeNameLength
The length of TypeName, in bytes.
TypeName
The type name of the object referenced by this handle. The buffer may not terminated by a NULL character. The pointer is valid for the lifetime of the walk marker passed to PssWalkSnapshot.
ObjectNameLength
The length of ObjectName, in bytes.
ObjectName
Specifies the name of the object referenced by this handle. The buffer may not terminated by a NULL character. The pointer is valid for the lifetime of the walk marker passed to PssWalkSnapshot.
TypeSpecificInformation
Type-specific information.
Process
Valid for ObjectType = PSS_OBJECT_TYPE_PROCESS.
ExitStatus
The exit code of the process. If the process has not exited, this is set to STILL_ACTIVE (259).
PebBaseAddress
The address of the process environment block (PEB). Reserved for use by the operating system.
AffinityMask
The affinity mask of the process.
BasePriority
The base priority level of the process.
ProcessId
The process ID.
ParentProcessId
The parent process ID.
Flags
Flags about the process. For more information, see PSS_PROCESS_FLAGS.
Thread
Valid for ObjectType = PSS_OBJECT_TYPE_THREAD.
ExitStatus
The exit code of the process. If the process has not exited, this is set to STILL_ACTIVE (259).
TebBaseAddress
The address of the thread environment block (TEB). Reserved for use by the operating system.
ProcessId
The process ID.
ThreadId
The thread ID.
AffinityMask
The affinity mask of the process.
Priority
The thread’s dynamic priority level.
BasePriority
The thread’s base priority level.
Win32StartAddress
A pointer to the thread procedure for the thread.
Mutant
Valid for ObjectType = PSS_OBJECT_TYPE_MUTANT.
CurrentCount
Reserved for use by the operating system.
Abandoned
TRUE if the mutant has been abandoned (the owning thread exited without releasing the mutex), FALSE if not.
OwnerProcessId
The process ID of the owning thread, at the time of snapshot creation and handle capture.
OwnerThreadId
The process ID of the owning thread, at the time of snapshot creation and handle capture.
Event
Valid for ObjectType = PSS_OBJECT_TYPE_EVENT.
ManualReset
TRUE if the event is manual reset, FALSE if not.
Signaled
TRUE if the event was signaled at the time of snapshot creation and handle capture, FALSE if not.
Section
Valid for ObjectType = PSS_OBJECT_TYPE_SECTION.
BaseAddress
Reserved for use by the operating system.
AllocationAttributes
Reserved for use by the operating system.
MaximumSize
Reserved for use by the operating system.
TypeSpecificInformation.Process
TypeSpecificInformation.Process.ExitStatus
TypeSpecificInformation.Process.PebBaseAddress
TypeSpecificInformation.Process.AffinityMask
TypeSpecificInformation.Process.BasePriority
TypeSpecificInformation.Process.ProcessId
TypeSpecificInformation.Process.ParentProcessId
TypeSpecificInformation.Process.Flags
TypeSpecificInformation.Thread
TypeSpecificInformation.Thread.ExitStatus
TypeSpecificInformation.Thread.TebBaseAddress
TypeSpecificInformation.Thread.ProcessId
TypeSpecificInformation.Thread.ThreadId
TypeSpecificInformation.Thread.AffinityMask
TypeSpecificInformation.Thread.Priority
TypeSpecificInformation.Thread.BasePriority
TypeSpecificInformation.Thread.Win32StartAddress
TypeSpecificInformation.Mutant
TypeSpecificInformation.Mutant.CurrentCount
TypeSpecificInformation.Mutant.Abandoned
TypeSpecificInformation.Mutant.OwnerProcessId
TypeSpecificInformation.Mutant.OwnerThreadId
TypeSpecificInformation.Event
TypeSpecificInformation.Event.ManualReset
TypeSpecificInformation.Event.Signaled
TypeSpecificInformation.Section
TypeSpecificInformation.Section.BaseAddress
TypeSpecificInformation.Section.AllocationAttributes
TypeSpecificInformation.Section.MaximumSize
TypeSpecificInformation.Semaphore
TypeSpecificInformation.Semaphore.CurrentCount
TypeSpecificInformation.Semaphore.MaximumCount
Remarks
PssWalkSnapshot returns a PSS_HANDLE_ENTRY structure when the PSS_WALK_INFORMATION_CLASS member that the caller provides it is PSS_WALK_HANDLES.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows 8.1 [desktop apps only] |
| Minimum supported server | Windows Server 2012 R2 [desktop apps only] |
| Header | processsnapshot.h |
See also
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for