Differences between CreateToolhelp32Snapshot and PssCaptureSnapshot functions

0
votes

There are two functions defined in WinAPI in order to capture data of target process ,Can someone one explain use cases of these functions?

when to use each functions? If we have to check whether the target process is still alive in windows run-time which one is efficiently help us?

1
c++windowswinapivisual-c++win32-process
If we have to check whether the target process is still alive - you need open process handle and use it in call WaitForSingleObject[Ex], WaitForMultipleObjects[Ex], MsgWaitForMultipleObjects[Ex], etc - RbMm
@RbMm What is the most secured way? using EnumProcess and OpenProcess ,is it guarantee the process existence? - user6952310
this is depend from how you want determinate process. by short name ? in this case you need CreateToolhelp32Snapshot + Process32First+Process32Next + OpenProcess with SYNCHRONIZE access. but search process by name not reliable way. unclear what process you need. may be exist another way - RbMm
for PssCaptureSnapshot you need already have handle to the target process. if you want only get when process exit - for what you PssCaptureSnapshot at all ? - RbMm
@RbMm I am not using short names,Process ID or or just Process Handle.. There can be multiInstances.In the case of multi instances msdn.microsoft.com/en-us/library/dn457837(v=vs.85).aspx can be helpful - user6952310

1 Answers

-2
votes

The Windows API grows in evolution steps Windows version by Windows version..

CreateToolhelp32Snapshot is available for Windows XP. PssCaptureSnapshot is available from Windows 8.1.

So the difference will be exactly in what is documented. PssCaptureSnapshot may have more functionality. And in most cases the old API versions just call the new ones with the new functionality in transforming the flags and structures for the new version.

I can't tell this in detail here, but I assume that there is no great difference, if the functionality of CreateToolhelp32Snapshot is enough for you.

For me the primary decision is: What Windows version are you targeting? Windows 7? Than the answer is simple what to use... ;)

Depending on the flags, both functions give you what you ask for...