API

BaseSnapshot

Bases: abc.ABC

Base class for all *Snapshot classes.

Source code in tlhelp32/_base.py
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
class BaseSnapshot(abc.ABC):
    """Base class for all `*Snapshot` classes."""

    def __init__(self, type_: Snap, pid: int = 0) -> None:  # noqa
        self._type = type_
        self._pid = pid
        ptr = CreateToolhelp32Snapshot(type_, pid)
        if ptr == INVALID_HANDLE_VALUE:
            raise CreationFailedError
        self._handle = ptr

    def __enter__(self, *_) -> Self:
        return self

    def __repr__(self) -> str:
        return f"<Snapshot type={self._type}, pid={self._pid}>"

    def __exit__(self, *_) -> None:
        self.close()

    def close(self) -> bool:
        """Close the underlying snapshot handle and free up resources.

        Returns:
            bool: Whether the underlying handle was closed successfully.
        """
        if self._handle:  # pragma: no cover
            return bool(CloseHandle(self._handle))
        return False

close()

Close the underlying snapshot handle and free up resources.

Returns:

Name Type Description
bool bool

Whether the underlying handle was closed successfully.

Source code in tlhelp32/_base.py
 97
 98
 99
100
101
102
103
104
105
def close(self) -> bool:
    """Close the underlying snapshot handle and free up resources.

    Returns:
        bool: Whether the underlying handle was closed successfully.
    """
    if self._handle:  # pragma: no cover
        return bool(CloseHandle(self._handle))
    return False

Snapshot

Bases: BaseSnapshot

All-in-one snapshot.

Source code in tlhelp32/snapshot.py
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
class Snapshot(BaseSnapshot):
    """All-in-one snapshot."""

    def __init__(self, pid: int = 0, include_32bit: bool = False) -> None:
        """Create a snapshot containing the heaps, modules, processes and threads.

        Args:
            pid (int, optional): The PID of the process whose modules and heaps
                are to be enumerated. Defaults to 0. If it is 0, then the
                enumeration takes place for the current / calling process.
            include_32bit (bool, optional): Passed to `ModuleSnapshot`.

        Raises:
            CreationFailedError: If the call fails internally.
        """
        snap_type = Snap.ALL
        if include_32bit:
            snap_type |= Snap.MODULE32
        super().__init__(snap_type, pid)
        self._pid = pid
        self._he = HEAPENTRY32()
        self._hl = HEAPLIST32()
        self._me = MODULEENTRY32W()
        self._pe = PROCESSENTRY32W()
        self._te = THREADENTRY32()

    @property
    def heaps(self) -> HeapIterator:
        """Iterator for the heaps present in the snapshot."""
        return HeapIterator(self._handle, self._hl)

    @property
    def modules(self) -> ModuleIterator:
        """Iterator for the modules present in the snapshot."""
        return ModuleIterator(self._handle, self._me)

    @property
    def processes(self) -> ProcessIterator:
        """Iterator for the processes present in the snapshot."""
        return ProcessIterator(self._handle, self._pe)

    @property
    def threads(self) -> ThreadIterator:
        """Iterator for the threads present in the snapshot."""
        return ThreadIterator(self._handle, self._te)

__init__(pid=0, include_32bit=False)

Create a snapshot containing the heaps, modules, processes and threads.

Parameters:

Name Type Description Default
pid int

The PID of the process whose modules and heaps are to be enumerated. Defaults to 0. If it is 0, then the enumeration takes place for the current / calling process.

0
include_32bit bool

Passed to ModuleSnapshot.

False

Raises:

Type Description
CreationFailedError

If the call fails internally.

Source code in tlhelp32/snapshot.py
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
def __init__(self, pid: int = 0, include_32bit: bool = False) -> None:
    """Create a snapshot containing the heaps, modules, processes and threads.

    Args:
        pid (int, optional): The PID of the process whose modules and heaps
            are to be enumerated. Defaults to 0. If it is 0, then the
            enumeration takes place for the current / calling process.
        include_32bit (bool, optional): Passed to `ModuleSnapshot`.

    Raises:
        CreationFailedError: If the call fails internally.
    """
    snap_type = Snap.ALL
    if include_32bit:
        snap_type |= Snap.MODULE32
    super().__init__(snap_type, pid)
    self._pid = pid
    self._he = HEAPENTRY32()
    self._hl = HEAPLIST32()
    self._me = MODULEENTRY32W()
    self._pe = PROCESSENTRY32W()
    self._te = THREADENTRY32()

heaps() property

Iterator for the heaps present in the snapshot.

Source code in tlhelp32/snapshot.py
51
52
53
54
@property
def heaps(self) -> HeapIterator:
    """Iterator for the heaps present in the snapshot."""
    return HeapIterator(self._handle, self._hl)

modules() property

Iterator for the modules present in the snapshot.

Source code in tlhelp32/snapshot.py
56
57
58
59
@property
def modules(self) -> ModuleIterator:
    """Iterator for the modules present in the snapshot."""
    return ModuleIterator(self._handle, self._me)

processes() property

Iterator for the processes present in the snapshot.

Source code in tlhelp32/snapshot.py
61
62
63
64
@property
def processes(self) -> ProcessIterator:
    """Iterator for the processes present in the snapshot."""
    return ProcessIterator(self._handle, self._pe)

threads() property

Iterator for the threads present in the snapshot.

Source code in tlhelp32/snapshot.py
66
67
68
69
@property
def threads(self) -> ThreadIterator:
    """Iterator for the threads present in the snapshot."""
    return ThreadIterator(self._handle, self._te)

HeapListSnapshot

Bases: BaseSnapshot

Enumerates the heaps used by a particular process.

Enumerating (a.k.a. walking) the heap is an expensive operation, look for ways to avoid redoing it or use the Win32 HeapWalk function instead for a much better performance.

Source code in tlhelp32/heap.py
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
class HeapListSnapshot(BaseSnapshot):
    """Enumerates the heaps used by a particular process.

    Enumerating (a.k.a. walking) the heap is an expensive operation, look for
    ways to avoid redoing it or use the Win32 `HeapWalk` function instead for
    a much better performance.
    """

    def __init__(self, pid: int = 0) -> None:
        """Create a module snapshot.

        Args:
            pid (int, optional): The PID of the process whose modules are to
                be enumerated. Defaults to 0. If it is 0, then the modules for
                the current/calling process are enumerated.

        Raises:
            CreationFailedError: If the call fails internally.
        """
        super().__init__(Snap.HEAPLIST, pid)
        self._hl = HEAPLIST32()

    def __iter__(self) -> HeapIterator:
        return HeapIterator(self._handle, self._hl)

__init__(pid=0)

Create a module snapshot.

Parameters:

Name Type Description Default
pid int

The PID of the process whose modules are to be enumerated. Defaults to 0. If it is 0, then the modules for the current/calling process are enumerated.

0

Raises:

Type Description
CreationFailedError

If the call fails internally.

Source code in tlhelp32/heap.py
127
128
129
130
131
132
133
134
135
136
137
138
139
def __init__(self, pid: int = 0) -> None:
    """Create a module snapshot.

    Args:
        pid (int, optional): The PID of the process whose modules are to
            be enumerated. Defaults to 0. If it is 0, then the modules for
            the current/calling process are enumerated.

    Raises:
        CreationFailedError: If the call fails internally.
    """
    super().__init__(Snap.HEAPLIST, pid)
    self._hl = HEAPLIST32()

ModuleSnapshot

Bases: BaseSnapshot

Enumerates the modules belonging to a particular process.

Source code in tlhelp32/module.py
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
class ModuleSnapshot(BaseSnapshot):
    """Enumerates the modules belonging to a particular process."""

    def __init__(self, pid: int = 0, include_32bit: bool = False) -> None:
        """Create a module snapshot.

        Args:
            pid (int, optional): The PID of the process whose modules are to
                be enumerated. Defaults to 0. If it is 0, then the modules for
                the current/calling process are enumerated.
            include_32bit (bool, optional): Enumerate 32-bit modules also.
                Valid only for 64-bit processes, else this parameter is
                ignored. Defaults to False.

        Raises:
            CreationFailedError: If the call fails internally.
        """
        snap_type = Snap.MODULE
        if include_32bit:
            snap_type |= Snap.MODULE32
        super().__init__(snap_type, pid)
        self._me = MODULEENTRY32W()

    def __iter__(self) -> ModuleIterator | None:
        return ModuleIterator(self._handle, self._me)

__init__(pid=0, include_32bit=False)

Create a module snapshot.

Parameters:

Name Type Description Default
pid int

The PID of the process whose modules are to be enumerated. Defaults to 0. If it is 0, then the modules for the current/calling process are enumerated.

0
include_32bit bool

Enumerate 32-bit modules also. Valid only for 64-bit processes, else this parameter is ignored. Defaults to False.

False

Raises:

Type Description
CreationFailedError

If the call fails internally.

Source code in tlhelp32/module.py
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
def __init__(self, pid: int = 0, include_32bit: bool = False) -> None:
    """Create a module snapshot.

    Args:
        pid (int, optional): The PID of the process whose modules are to
            be enumerated. Defaults to 0. If it is 0, then the modules for
            the current/calling process are enumerated.
        include_32bit (bool, optional): Enumerate 32-bit modules also.
            Valid only for 64-bit processes, else this parameter is
            ignored. Defaults to False.

    Raises:
        CreationFailedError: If the call fails internally.
    """
    snap_type = Snap.MODULE
    if include_32bit:
        snap_type |= Snap.MODULE32
    super().__init__(snap_type, pid)
    self._me = MODULEENTRY32W()

ProcessSnapshot

Bases: BaseSnapshot

Enumerates all the processes residing in the system address space.

Source code in tlhelp32/process.py
39
40
41
42
43
44
45
46
47
48
49
50
51
52
class ProcessSnapshot(BaseSnapshot):
    """Enumerates all the processes residing in the system address space."""

    def __init__(self) -> None:
        """Create a process snapshot.

        Raises:
            CreationFailedError: If the call fails internally.
        """
        super().__init__(Snap.PROCESS)
        self._pe = PROCESSENTRY32W()

    def __iter__(self) -> ProcessIterator | None:
        return ProcessIterator(self._handle, self._pe)

__init__()

Create a process snapshot.

Raises:

Type Description
CreationFailedError

If the call fails internally.

Source code in tlhelp32/process.py
42
43
44
45
46
47
48
49
def __init__(self) -> None:
    """Create a process snapshot.

    Raises:
        CreationFailedError: If the call fails internally.
    """
    super().__init__(Snap.PROCESS)
    self._pe = PROCESSENTRY32W()

ThreadSnapshot

Bases: BaseSnapshot

Enumerates all the threads executing on the system.

Source code in tlhelp32/thread.py
39
40
41
42
43
44
45
46
47
48
49
50
51
52
class ThreadSnapshot(BaseSnapshot):
    """Enumerates all the threads executing on the system."""

    def __init__(self) -> None:
        """Create a thread snapshot.

        Raises:
            CreationFailedError: If the call fails internally.
        """
        super().__init__(Snap.THREAD)
        self._te = THREADENTRY32()

    def __iter__(self) -> ThreadIterator | None:
        return ThreadIterator(self._handle, self._te)

__init__()

Create a thread snapshot.

Raises:

Type Description
CreationFailedError

If the call fails internally.

Source code in tlhelp32/thread.py
42
43
44
45
46
47
48
49
def __init__(self) -> None:
    """Create a thread snapshot.

    Raises:
        CreationFailedError: If the call fails internally.
    """
    super().__init__(Snap.THREAD)
    self._te = THREADENTRY32()