Events
Nov 19, 11 PM - Nov 21, 11 PM
Gain the competitive edge you need with powerful AI and Cloud solutions by attending Microsoft Ignite online.
Register nowThis browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Flags that specify what PssCaptureSnapshot captures.
typedef enum {
PSS_CAPTURE_NONE = 0x00000000,
PSS_CAPTURE_VA_CLONE = 0x00000001,
PSS_CAPTURE_RESERVED_00000002 = 0x00000002,
PSS_CAPTURE_HANDLES = 0x00000004,
PSS_CAPTURE_HANDLE_NAME_INFORMATION = 0x00000008,
PSS_CAPTURE_HANDLE_BASIC_INFORMATION = 0x00000010,
PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION = 0x00000020,
PSS_CAPTURE_HANDLE_TRACE = 0x00000040,
PSS_CAPTURE_THREADS = 0x00000080,
PSS_CAPTURE_THREAD_CONTEXT = 0x00000100,
PSS_CAPTURE_THREAD_CONTEXT_EXTENDED = 0x00000200,
PSS_CAPTURE_RESERVED_00000400 = 0x00000400,
PSS_CAPTURE_VA_SPACE = 0x00000800,
PSS_CAPTURE_VA_SPACE_SECTION_INFORMATION = 0x00001000,
PSS_CAPTURE_IPT_TRACE = 0x00002000,
PSS_CAPTURE_RESERVED_00004000,
PSS_CREATE_BREAKAWAY_OPTIONAL = 0x04000000,
PSS_CREATE_BREAKAWAY = 0x08000000,
PSS_CREATE_FORCE_BREAKAWAY = 0x10000000,
PSS_CREATE_USE_VM_ALLOCATIONS = 0x20000000,
PSS_CREATE_MEASURE_PERFORMANCE = 0x40000000,
PSS_CREATE_RELEASE_SECTION = 0x80000000
} PSS_CAPTURE_FLAGS;
PSS_CAPTURE_NONE Value: 0x00000000 Capture nothing. |
PSS_CAPTURE_VA_CLONE Value: 0x00000001 Capture a snapshot of all cloneable pages in the process. The clone includes all MEM_PRIVATE regions, as well as all sections (MEM_MAPPED and MEM_IMAGE) that are shareable. All Win32 sections created via CreateFileMapping are shareable. |
PSS_CAPTURE_RESERVED_00000002 Value: 0x00000002 (Do not use.) |
PSS_CAPTURE_HANDLES Value: 0x00000004 Capture the handle table (handle values only). |
PSS_CAPTURE_HANDLE_NAME_INFORMATION Value: 0x00000008 Capture name information for each handle. |
PSS_CAPTURE_HANDLE_BASIC_INFORMATION Value: 0x00000010 Capture basic handle information such as HandleCount, PointerCount, GrantedAccess, etc. |
PSS_CAPTURE_HANDLE_TYPE_SPECIFIC_INFORMATION Value: 0x00000020 Capture type-specific information for supported object types: Process, Thread, Event, Mutant, Section. |
PSS_CAPTURE_HANDLE_TRACE Value: 0x00000040 Capture the handle tracing table. |
PSS_CAPTURE_THREADS Value: 0x00000080 Capture thread information (IDs only). |
PSS_CAPTURE_THREAD_CONTEXT Value: 0x00000100 Capture the context for each thread. |
PSS_CAPTURE_THREAD_CONTEXT_EXTENDED Value: 0x00000200 Capture extended context for each thread (e.g. CONTEXT_XSTATE). |
PSS_CAPTURE_RESERVED_00000400 Value: 0x00000400 (Do not use.) |
PSS_CAPTURE_VA_SPACE Value: 0x00000800 Capture a snapshot of the virtual address space. The VA space is captured as an array of MEMORY_BASIC_INFORMATION structures. This flag does not capture the contents of the pages. |
PSS_CAPTURE_VA_SPACE_SECTION_INFORMATION Value: 0x00001000 For MEM_IMAGE and MEM_MAPPED regions, dumps the path to the file backing the sections (identical to what GetMappedFileName returns). For MEM_IMAGE regions, also dumps:
The PROCESS_VM_READ access right is required on the process handle. Warning This option is only valid when PSS_CAPTURE_VA_SPACE is specified. |
PSS_CAPTURE_IPT_TRACE Value: 0x00002000 |
PSS_CREATE_BREAKAWAY_OPTIONAL Value: 0x04000000 The breakaway is optional. If the clone process fails to create as a breakaway, then it is created still inside the job. This flag must be specified in combination with either PSS_CREATE_FORCE_BREAKAWAY and/or PSS_CREATE_BREAKAWAY. |
PSS_CREATE_BREAKAWAY Value: 0x08000000 The clone is broken away from the parent process' job. This is equivalent to CreateProcess flag CREATE_BREAKAWAY_FROM_JOB. |
PSS_CREATE_FORCE_BREAKAWAY Value: 0x10000000 The clone is forcefully broken away the parent process's job. This is only allowed for Tcb-privileged callers. |
PSS_CREATE_USE_VM_ALLOCATIONS Value: 0x20000000 The facility should not use the process heap for any persistent or transient allocations. The use of the heap may be undesirable in certain contexts such as creation of snapshots in the exception reporting path (where the heap may be corrupted). |
PSS_CREATE_MEASURE_PERFORMANCE Value: 0x40000000 Measure performance of the facility. Performance counters can be retrieved via PssQuerySnapshot with the PSS_QUERY_PERFORMANCE_COUNTERS information class of PSS_QUERY_INFORMATION_CLASS. |
PSS_CREATE_RELEASE_SECTION Value: 0x80000000 The virtual address (VA) clone process does not hold a reference to the underlying image. This will cause functions such as QueryFullProcessImageName to fail on the VA clone process. Important This flag has no effect unless PSS_CAPTURE_VA_CLONE is specified. |
If both PSS_CREATE_FORCE_BREAKAWAY and PSS_CREATE_BREAKAWAY are specified, then PSS_CREATE_FORCE_BREAKAWAY takes precedence.
Requirement | Value |
---|---|
Minimum supported client | Windows 8.1 [desktop apps only] |
Minimum supported server | Windows Server 2012 R2 [desktop apps only] |
Header | processsnapshot.h |
Events
Nov 19, 11 PM - Nov 21, 11 PM
Gain the competitive edge you need with powerful AI and Cloud solutions by attending Microsoft Ignite online.
Register now