[Question] Process Status API(psapi.dll): EnumProcesses

[nilum]

Alright, it seems BlackMagic uses EnumWindowsProc, but I've decided to go a different route and enumerate through the process list. It's not really a matter of efficiency and is more about wanting to do things different for the sake of experimenting and educating myself about using different Windows API calls.

EnumProcesses returns an array of process IDs and I really have no problem getting it to do that. The problem is being forced to specify array size. I was expecting this function call to be more intuitive and simply point to some OS managed array, but instead it takes an initialized array and only updates it up to a specified number of processes. Obviously, I could simply specify some very high number, but that just doesn't feel right to me.

Is there simply some array that the OS manages that I could read from? To clarify, I would expect the OS to have a list of process IDs for all opened processes. Seems like it might be easier just to point to that, if it exists.

[sitnspinlock]

hello,

active process list is always changing, so these api's build buffers containing information during the time of the call. for all you know, right after the call, another process could begin execution.

psapi functions and the toolhelp api's (see msdn) all share the same common native api NtQuerySystemInformation with systemProcessInformation class to tell the api's user about existing processes.

if you wanted access to this list you would need to write a driver.

[nilum]

Wow. Thank you. Very helpful information.