Process32First Function

Retrieves information about the first process encountered in a system snapshot.

Syntax

C++ 
BOOL WINAPI Process32First(
  __in     HANDLE hSnapshot,
  __inout  LPPROCESSENTRY32 lppe
);

Parameters

hSnapshot [in]

A handle to the snapshot returned from a previous call to the CreateToolhelp32Snapshot function.

lppe [in, out]

A pointer to a PROCESSENTRY32 structure. It contains process information such as the name of the executable file, the process identifier, and the process identifier of the parent process.

Return Value

Returns TRUE if the first entry of the process list has been copied to the buffer or FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the GetLastError function if no processes exist or the snapshot does not contain process information.

Remarks

The calling application must set the dwSize member of PROCESSENTRY32 to the size, in bytes, of the structure.

To retrieve information about other processes recorded in the same snapshot, use the Process32Next function.

Examples

For an example, see Taking a Snapshot and Viewing Processes.

Requirements

Minimum supported client

Windows 2000 Professional

Minimum supported server

Windows 2000 Server

Header

Tlhelp32.h

Library

Kernel32.lib

DLL

Kernel32.dll

Unicode and ANSI names

Process32FirstW (Unicode) and Process32First (ANSI)

See Also

CreateToolhelp32Snapshot
Process Walking
Process32Next
PROCESSENTRY32
Tool Help Functions

 

 

Send comments about this topic to Microsoft

Build date: 2/4/2010

Tags :


Community Content

Thomas Lee
XP vs Vista

Hi, Introducing Vista is the worst thing I ever experienced as a windows core developer.

I have the following code in Delphi to get a process id of an exe:

function FindAProcess(aExeFileName: String; aSkipProcessID: Cardinal = MAXWORD): Cardinal;
var
vSnapshotHandle: THandle;
vProcessEntry32: TProcessEntry32;
vExe: String;
begin
Result := MAXWORD;

vSnapshotHandle := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
vProcessEntry32.dwSize := SizeOf(vProcessEntry32);
FillChar(vProcessEntry32.szExeFile, SizeOf(vProcessEntry32.szExeFile), 0);
try
if Process32First(vSnapshotHandle, vProcessEntry32) then
begin
repeat
vExe := ArrayOfCharToString(vProcessEntry32.szExeFile);
if (UpperCase(vExe) = UpperCase(aExeFileName)) or
(Pos(aExeFileName, vExe) > 0) then
begin
if (aSkipProcessID <> vProcessEntry32.th32ProcessID) and
(vProcessEntry32.th32ProcessID <> 0) then
begin
Result := vProcessEntry32.th32ProcessID;
Break;
end;
end;
FillChar(vProcessEntry32.szExeFile, SizeOf(vProcessEntry32.szExeFile), 0);
until not Process32Next(vSnapshotHandle, vProcessEntry32)
end;
finally
CloseHandle(vSnapshotHandle);
end;
end;

And guess what... In XP it works fine but in Vista SP1 I only get 1 process and that is [System Process].

This really drives me mad...

[tfl - 25 08 09] Hi - and thanks for your post. You should post questions like this to the MSDN Forums at http://forums.microsoft.com/msdn or the MSDN Newsgroups at

http://www.microsoft.com/communities/newsgroups/en-us/ . You are much more likely get a quicker response using the forums than through the Community Content. For specific help about:
Visual Studio : http://groups.google.com/groups/dir?sel=usenet%3Dmicrosoft.public.vstudio%2C &
SQL Server : http://groups.google.com/groups/dir?sel=usenet%3Dmicrosoft.public.sqlserver%2C &
.NET Framework : http://groups.google.com/groups/dir?sel=usenet%3Dmicrosoft.public.dotnet.framework
PowerShell : http://groups.google.com/group/microsoft.public.windows.powershell/topics?pli=1
All Public : http://groups.google.com/groups/dir?sel=usenet%3Dmicrosoft.public%2C &


Page view tracker