ASM Community

toolhelp32 API

Hi telophase,

I've never used it but I imagine it would go like this :

SearchForProcess proc

	LOCAL pe32		:PROCESSENTRY32

	LOCAL hToolHelp		:HANDLE

	LOCAL pID		:DWORD



	mov pe32.dwSize,SIZEOF PROCESSENTRY32



	invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,NULL

	mov hToolHelp,eax



	invoke Process32First,hToolHelp,ADDR pe32

	.WHILE eax

		mov eax,pe32.th32ProcessID

		mov pID,eax

		; do your thing to see if this is the process your looking for

		invoke Process32Next,hToolHelp,ADDR pe32

	.ENDW



	; [color=red]invoke CloseToolhelp32Snapshot,hToolHelp[/color]

	; EDIT sorry wrong docs, that's for CE

	invoke CloseHandle,hToolHelp



	ret

SearchForProcess endp

Ofcouse like I said I have never actually tried it. The MASM32 package is missing the CloseToolhelp32Snapshot function so you'll have to load it manually. <- Sorry wrong docs, that function doesn't exist outside of CE

telophase,

I don't want to discourage you from asking questions, that is after all why the board is here. And I really don't mind answering them at all, but that took about 2 minutes to research at MSDN. You should take a little more time to research the method once the answer (as Comrade gave you) is clear. The best way to learn how to do things is to ask for a direction to search in then do the research yourself. Granted the answer comes out the same but you may find interesting things along the way.

Yeah, I think in NT it would just return 0 and quit without doing anything. The api calls are there but I think they do nothing. In NT you would have to use EnumProcesses which is much simpler IMHO.