Ken writes:
Could it be that it’s not zero, but that EnumProcessModules is expecting a
LPDWORD but you’re passing a *__int64 and you’re seeing the wrong DWORD? I
don’t know this for a fact (haven’t played with x64 much yet), but possible?
I ran into this issue before I started messing around on the 64-bit platform
- 64-bits just made it worse - so I don’t think this is the problem.
Besides, a pointer ot a memory location is just that, a pointer. In this
situation, I’m using a 32-bit pointer to a 64-bit location so the upper 32
bits never get written. My purpose was to align the storage on a 64-bit
boundary.
I do know that casting (__int64 *) as (ULONG *) can lead to problems.
No question. Your source is 64-bits and the new destination is only 32 so
you only transact 32 bits. If there’s any value in the upper 32 bits, it’s
gone.
Don’s post looks ominous, too…
This whole thing is driving me nuts. There has to be a way to reliably
convert PIDs to name strings.
Mickey.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
Sent: Friday, August 05, 2005 12:24 PM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] EnumProcessModules error
What value are you getting back for Needed?
Ken
Zero. Buffer is not modified.
Well it could be the following (from the source of EnumProcessModules):
// The system process has no PEB. STATUS_PARTIAL_COPY is a poor choice
// for a return value, but it’s what’s always been returned, so
continue // to do so to maintain application compatibility.
–
Don
The phrase “system process” is interesting. Even when things are working, I
get the error if PID is 4. That doesn’t bother me. It’s when all of a
sudden, I get the error on all but one or two of the current processes.
There is some example code for this at
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/perfmon/bas
e/enumerating_all_modules_for_a_process.asp
I’m hoping there’s some action I can take to correct the situation when the
error shows up. I saw something to that effect in dealing with the error
while attempting to read a process’ memory (I think that’s what it was).
Regards,
Mickey.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Don Burn
Sent: Friday, August 05, 2005 10:21 AM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] EnumProcessModules error
Well it could be the following (from the source of EnumProcessModules):
// The system process has no PEB. STATUS_PARTIAL_COPY is a poor choice //
for a return value, but it’s what’s always been returned, so continue // to
do so to maintain application compatibility.
–
Don Burn (MVP, Windows DDK)
Windows 2k/XP/2k3 Filesystem and Driver Consulting
Remove StopSpam from the email to reply
“Ken Cross” wrote in message news:xxxxx@ntfsd…
> What value are you getting back for Needed?
>
> Ken
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
> Sent: Friday, August 05, 2005 10:07 AM
> To: Windows File Systems Devs Interest List
> Subject: RE: [ntfsd] EnumProcessModules error
>
> Can I bump this back into the list?
>
> My apologies for being impatient but it’s really causing my filter
> stuff some grief. On 32-bit, I’ve seen cases where I call it and it
> works then call it a few seconds later with the exact same info and
> get this error. On 64-bit, I almost always get it.
>
> FWIW, if you use this function and plan on going to 64-bit, you’ll be
> asking
> too…
>
> Thanks,
> Mickey.
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Mickey Lane
> Sent: Tuesday, August 02, 2005 10:16 AM
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] EnumProcessModules error
>
>
> What does ERROR_PARTIAL_COPY mean as an error return from
> EnumProcessModules()?
>
>
> __int64 Buffer[400]; // maybe 64-bit alignment helps
>__int64 Needed = 0;
> HANDLE ProcessHandle; // ProcessHandle = OpenProcess ( …etc…
> ProcessID) w/no errors reported
>
> size_t siz = sizeof (Buffer); // siz = 3200
>
> BOOL r = EnumProcessModules (
> ProcessHandle,
> (HMODULE *) Buffer,
> siz,
> (ULONG *) &Needed);
>
> r == FALSE
> GetLastError() returns ERROR_PARTIAL_COPY
>
>
> I’ve checked every reference I can think of. I see others ask the same
> question but no answers.
>
> Thanks for any help,
> Mickey.
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: xxxxx@earthlink.net To
> unsubscribe
> send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the IFS FAQ at
> https://www.osronline.com/article.cfm?id=17
>
> You are currently subscribed to ntfsd as: unknown lmsubst tag
> argument: ‘’ To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@earthlink.net To unsubscribe
send a blank email to xxxxx@lists.osr.com
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
—
Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17
You are currently subscribed to ntfsd as: xxxxx@earthlink.net To unsubscribe
send a blank email to xxxxx@lists.osr.com