Indeed, this material is very good and also contradicts what M$ have being releasing on their own docs.
On a discussion i had with Dave here
http://masm32.com/board/index.php?topic=3345.0 i was trying to figure it out what a hell NtCreateSection was doing in memory, since my debuggers were showing me something different from what M$ docs said. The 1st member of the structure (which i named as: SectionHandle) was proving to me that it is not at all just a handle as M$ docs said, but a member of a unknown structure.
After several tests i ended concluding that it is, in fact, part of a structure and not a simple variable where the handle is outputed.
Today, i finally found some documentation of the functions i´m analyzing and rewriting.
http://forum.vingrad.ru/topic-236938.htmlAs the source code shows, the "SectionHandle" (SnapSection) is related to a structure called "SNAPSHOTSTATE", whose members i have no idea what they are, so far.
What i´m doing is rebuilding CreateToolhelp32Snapshot Api to make it works on WinNT4 and also to have another source of reference material for those unknown internal Apis.
Btw....is someone knows where can i find the sources from the forum i posted above, please post it here, because the needed source is not in any of mine files of the Kernel Source code, neither the WDM SDK :(
So, if anyone knows where are these sources:
NTSTATUS
ThpAllocateSnapshotSection(
OUT PHANDLE SnapSection,
IN DWORD dwFlags,
IN DWORD th32ProcessID,
PUCHAR RawProcess,
PRTL_DEBUG_INFORMATION RawModule,
PRTL_DEBUG_INFORMATION RawDebugInfo)
(....)
ULONG ThreadCount = 0;
SnapShotSize = sizeof(SNAPSHOTSTATE);
Offset1 = 0;
//
// calculate the required snapshot size
//
if ((dwFlags & TH32CS_SNAPPROCESS) || (dwFlags & TH32CS_SNAPTHREAD)) {
do {
ProcessCount++;
ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)&RawProcess[Offset1];
Offset1 += ProcessInfo->NextEntryOffset;
ThreadCount += ProcessInfo->NumberOfThreads;
} while (ProcessInfo->NextEntryOffset != 0
Please, let me know...or post the link here. I wold like to take a look at them.