Question

Win7下，API函数错误还是系统BUG？

同志们，你们有没有在Win7用VS2008使用CreateToolhelp32Snapshot函数啊？将TH32CS_SNAPTHREAD传给该函数的第一个参数，将GetProcessId的返回值传给第二个参数，但是函数返回的句柄确实有问题的。代码如下：#include #include #include #include void _tmain(){DWORD PID=GetCurrentProcessId();HANDLE hThreadSnap=CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD,PID);int n=0;if(hThreadSnap!=INVALID_HANDLE_VALUE){THREADENTRY32 te={sizeof(te)};BOOL bT=Thread32First(hThreadSnap,&te);while(bT){_tprintf(TEXT(\"This thread id is %d.\\n\"),te.th32ThreadID);++n;bT=Thread32Next(hThreadSnap,&te);}}_tprintf(TEXT(\"This process\' id is %d\\n\"),PID);_tprintf(TEXT(\"There are %d threads in this process\\n\"),n);}得到线程有N百多个，当然，这就是包含系统所有线程，但是我给函数参数传递的是PID，是自己的PID函数返回的hThreadSnap句柄居然把所有线程的句柄都放进去了，而且我使用Medium完整性级别的进程都可以将High完整性级别的进程给SuspendThread！这是漏洞么？郁闷

Answer 1

HANDLE WINAPI CreateToolhelp32Snapshot(DWORD dwFlags,DWORD th32ProcessID);-------------------------------------------[in] Process identifier of the process to be included in the snapshot. This parameter can be zero to indicate the current process. This parameter is used when the TH32CS_SNAPHEAPLIST, TH32CS_SNAPMODULE, or TH32CS_SNAPALL value is specified. Otherwise, it is ignored and all processes are included in the snapshot.