PSS_CAPTURE_FLAGS enumeration

Flags that specify what PssCaptureSnapshot captures.

Syntax

typedef enum  {
  PSS_CAPTURE_NONE,
  PSS_CAPTURE_VA_CLONE,
  PSS_CAPTURE_RESERVED_00000002,
  PSS_CAPTURE_HANDLES,
  PSS_CAPTURE_HANDLE_NAME_INFORMATION,
  PSS_CAPTURE_HANDLE_BASIC_INFORMATION,
  PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION,
  PSS_CAPTURE_HANDLE_TRACE,
  PSS_CAPTURE_THREADS,
  PSS_CAPTURE_THREAD_CONTEXT,
  PSS_CAPTURE_THREAD_CONTEXT_EXTENDED,
  PSS_CAPTURE_RESERVED_00000400,
  PSS_CAPTURE_VA_SPACE,
  PSS_CAPTURE_VA_SPACE_SECTION_INFORMATION,
  PSS_CAPTURE_IPT_TRACE,
  PSS_CAPTURE_RESERVED_00004000,
  PSS_CREATE_BREAKAWAY_OPTIONAL,
  PSS_CREATE_BREAKAWAY,
  PSS_CREATE_FORCE_BREAKAWAY,
  PSS_CREATE_USE_VM_ALLOCATIONS,
  PSS_CREATE_MEASURE_PERFORMANCE,
  PSS_CREATE_RELEASE_SECTION
} PSS_CAPTURE_FLAGS;

Constants

PSS_CAPTURE_NONE Capture nothing.
PSS_CAPTURE_VA_CLONE Capture a snapshot of all cloneable pages in the process. The clone includes all MEM_PRIVATE regions, as well as all sections (MEM_MAPPED and MEM_IMAGE) that are shareable. All Win32 sections created via CreateFileMapping are shareable.
PSS_CAPTURE_RESERVED_00000002 (Do not use.)
PSS_CAPTURE_HANDLES Capture the handle table (handle values only).
PSS_CAPTURE_HANDLE_NAME_INFORMATION Capture name information for each handle.
PSS_CAPTURE_HANDLE_BASIC_INFORMATION Capture basic handle information such as HandleCount, PointerCount, GrantedAccess, etc.
PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION Capture type-specific information for supported object types: Process, Thread, Event, Mutant, Section.
PSS_CAPTURE_HANDLE_TRACE Capture the handle tracing table.
PSS_CAPTURE_THREADS Capture thread information (IDs only).
PSS_CAPTURE_THREAD_CONTEXT Capture the context for each thread.
PSS_CAPTURE_THREAD_CONTEXT_EXTENDED Capture extended context for each thread (e.g. CONTEXT_XSTATE).
PSS_CAPTURE_RESERVED_00000400 (Do not use.)
PSS_CAPTURE_VA_SPACE Capture a snapshot of the virtual address space. The VA space is captured as an array of MEMORY_BASIC_INFORMATION structures. This flag does not capture the contents of the pages.
PSS_CAPTURE_VA_SPACE_SECTION_INFORMATION For MEM_IMAGE and MEM_MAPPED regions, dumps the path to the file backing the sections (identical to what GetMappedFileName returns). For MEM_IMAGE regions, also dumps:



  • IMAGE_NT_HEADERS.FileHeader.TimeDateStamp



  • IMAGE_NT_HEADERS.OptionalHeader.SizeOfImage



  • IMAGE_NT_HEADERS.OptionalHeader.ImageBase



  • IMAGE_NT_HEADERS.OptionalHeader.CheckSum



The PROCESS_VM_READ access right is required on the process handle.

Warning  This option is only valid when PSS_CAPTURE_VA_SPACE is specified.

 
PSS_CAPTURE_IPT_TRACE
PSS_CREATE_BREAKAWAY_OPTIONAL The breakaway is optional. If the clone process fails to create as a breakaway, then it is created still inside the job. This flag must be specified in combination with either PSS_CREATE_FORCE_BREAKAWAY and/or PSS_CREATE_BREAKAWAY.
PSS_CREATE_BREAKAWAY The clone is broken away from the parent process' job. This is equivalent to CreateProcess flag CREATE_BREAKAWAY_FROM_JOB.
PSS_CREATE_FORCE_BREAKAWAY The clone is forcefully broken away the parent process's job. This is only allowed for Tcb-privileged callers.
PSS_CREATE_USE_VM_ALLOCATIONS The facility should not use the process heap for any persistent or transient allocations. The use of the heap may be undesirable in certain contexts such as creation of snapshots in the exception reporting path (where the heap may be corrupted).
PSS_CREATE_MEASURE_PERFORMANCE Measure performance of the facility. Performance counters can be retrieved via PssQuerySnapshot with the PSS_QUERY_PERFORMANCE_COUNTERS information class of PSS_QUERY_INFORMATION_CLASS.
PSS_CREATE_RELEASE_SECTION The virtual address (VA) clone process does not hold a reference to the underlying image. This will cause functions such as QueryFullProcessImageName to fail on the VA clone process.

Important  

This flag has no effect unless PSS_CAPTURE_VA_CLONE is specified.


 

Remarks

If both PSS_CREATE_FORCE_BREAKAWAY and PSS_CREATE_BREAKAWAY are specified, then PSS_CREATE_FORCE_BREAKAWAY takes precedence.

Requirements

   
Minimum supported client Windows 8.1 [desktop apps only]
Minimum supported server Windows Server 2012 R2 [desktop apps only]
Header processsnapshot.h

See also

Process Snapshotting