{"componentChunkName":"component---src-templates-post-template-js","path":"/rust-winapi-process-enum-en","result":{"data":{"markdownRemark":{"id":"6810c39b-fede-5c59-9d7a-ea0e16b7f46f","html":"
\n

This page has been machine-translated from the original page.

\n
\n

Following on from the previous articles, I wanted to keep trying to build various programs in Rust that call Windows APIs.

\n

This time, I wanted to build a program that enumerates process information in the system using CreateToolhelp32Snapshot and Process32First/Process32Next, which I had also implemented previously in the article below.

\n

](/win32api-getprocesslist)

\n

The detailed API explanations are already covered there, so this time I am simply aiming to reimplement that code in Rust.

\n\n

Table of Contents

\n\n

The Code I Created

\n

The final code I created is shown below.

\n
// cargo run --bin EnumProcess.rs\n\nuse windows::Win32::{\n    System::Diagnostics::ToolHelp::{\n        CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, PROCESSENTRY32W, TH32CS_SNAPPROCESS\n    },\n    Foundation::{CloseHandle, INVALID_HANDLE_VALUE},\n};\n\n\nfn main() {\n    unsafe {\n        //HANDLE CreateToolhelp32Snapshot(\n        //[in] DWORD dwFlags,\n        //[in] DWORD th32ProcessID\n        //);\n\n        // Result<HANDLE> を返すため unwrap で HANDLE を取得\n        let h_toolhelp32_snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0).unwrap();\n        if h_toolhelp32_snapshot == INVALID_HANDLE_VALUE {\n            eprintln!(\"ERROR: Could not get a Toolhelp32Snapshot\");\n            return;\n        }\n        \n        \n        //typedef struct tagPROCESSENTRY32\n        //{\n        //DWORD   dwSize;\n        //DWORD   cntUsage;\n        //DWORD   th32ProcessID;\n        //ULONG_PTR th32DefaultHeapID;\n        //DWORD   th32ModuleID;\n        //DWORD   cntThreads;\n        //DWORD   th32ParentProcessID;\n        //LONG    pcPriClassBase;\n        //DWORD   dwFlags;\n        //CHAR    szExeFile[MAX_PATH];\n        //} PROCESSENTRY32;\n\n        // BOOL Process32First(\n        //     [in]      HANDLE           hSnapshot,\n        //     [in, out] LPPROCESSENTRY32 lppe\n        // );\n\n        let mut pe32 = PROCESSENTRY32W {\n            dwSize: std::mem::size_of::<PROCESSENTRY32W>() as u32,\n            ..Default::default()\n        };\n\n        match Process32FirstW(h_toolhelp32_snapshot, &mut pe32) {\n            Ok(_) => {\n                println!(\"Got process snapshot.\");\n                \n                loop {\n                    let exe_file = {\n                        let len = pe32.szExeFile.iter()\n                                                        .position(|&c| c == 0)\n                                                        .unwrap_or(pe32.szExeFile.len());\n                        String::from_utf16_lossy(&pe32.szExeFile[..len])\n                    };\n\n                    println!(\"Process name: {}\", exe_file);\n                    println!(\"=====> PID: {}\", pe32.th32ProcessID);\n                    println!(\"=====> Threads count: {}\", pe32.cntThreads);\n\n                    match Process32NextW(h_toolhelp32_snapshot, &mut pe32) {\n                        Ok(_) => {  },\n                        Err(_e) => {\n                            // eprintln!(\"Failed to get next process: {}\", e);\n                            break; \n                        }\n                    }\n\n                }\n\n            },\n            Err(e) => {\n                eprintln!(\"Failed to get first process: {}\", e);\n            }\n        }\n\n        // Close h_toolhelp32_snapshot handle.\n        let handle_name = \"h_toolhelp32_snapshot\";\n        match CloseHandle(h_toolhelp32_snapshot) {\n            Ok(_) => {\n                println!(\"Handle closed: {}\", handle_name);\n            },\n            Err(e) => {\n                eprintln!(\"Failed to close handle:{} {}\", handle_name, e);\n            }\n        }\n\n    }\n\n    return;\n\n}
\n

When I built and ran this code, I was able to enumerate the process information in the system just like the code I had written in C.

\n

\n \n \n \n \n \n \n \n \n

\n

Adding Dependencies

\n

To implement the code above with the Windows Crate, I added a setting to Cargo.toml that specifies Win32_System_Diagnostics_ToolHelp in features.

\n
[dependencies]\nwindows = { version = \"0.60.0\", features = [\n    \"Win32_System_Diagnostics_ToolHelp\"\n] }
\n

Loading Modules

\n

To call the Windows APIs required for process enumeration, I loaded the following modules.

\n
use windows::Win32::{\n    System::Diagnostics::ToolHelp::{\n        CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, PROCESSENTRY32W, TH32CS_SNAPPROCESS\n    },\n    Foundation::{CloseHandle, INVALID_HANDLE_VALUE},\n};
\n

Since the three APIs CreateToolhelp32Snapshot and Process32FirstW/Process32NextW appeared to exist under windows::Win32::System::Diagnostics::ToolHelp in the Windows Crate, I loaded that module.

\n

Reference: windows::Win32::System::Diagnostics::ToolHelp - Rust

\n

I also loaded CloseHandle so that I could close the handle that gets created.

\n

Reference: CloseHandle in windows::Win32::Foundation - Rust

\n

Obtaining a Handle with CreateToolhelp32Snapshot

\n

Inside the unsafe block in main, I first call the CreateToolhelp32Snapshot API to obtain a handle to the process snapshot.

\n
//HANDLE CreateToolhelp32Snapshot(\n//[in] DWORD dwFlags,\n//[in] DWORD th32ProcessID\n//);\n\n// Result<HANDLE> を返すため unwrap で HANDLE を取得\nlet h_toolhelp32_snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0).unwrap();\nif h_toolhelp32_snapshot == INVALID_HANDLE_VALUE {\n    eprintln!(\"ERROR: Could not get a Toolhelp32Snapshot\");\n    return;\n}
\n

One difference from the C implementation is that CreateToolhelp32Snapshot in the Windows Crate returns a value of type Result<HANDLE> rather than HANDLE.

\n

\n \n \n \n \n \n \n \n \n

\n

Reference: CreateToolhelp32Snapshot in windows::Win32::System::Diagnostics::ToolHelp - Rust

\n

A Result like this seems to be a special type prepared for error handling in Rust.

\n

Basically, Result is an enum with two variants, Ok and Err, and it seems to let you implement different actions depending on the returned value.

\n
enum Result<T, E> {\n    Ok(T),\n    Err(E),\n}
\n

Reference: Recoverable Errors with Result - The Rust Programming Language

\n

Reference: RustによるResult型のエラーハンドリング入門

\n

There seem to be several ways to extract a return value from a Result, but this time I used unwrap.

\n

When you use unwrap, if the Result value is Ok, it extracts the function’s return value, and if it is Err, it seems to crash the program with panic!.

\n

This stores the obtained handle in the _h_toolhelp32_snapshot variable.

\n

Also, when I tried to use a variable named hToolhelp32Snapshot at this point, the compiler scolded me for not using a snake_case variable name.

\n

\n \n \n \n \n \n \n \n \n

\n

Implementing the Loop

\n

Once all the operations up to this point are complete, all that remains is to use the Process32FirstW/Process32NextW APIs to retrieve process information in order from the snapshot handle.

\n

Both Process32FirstW and Process32NextW in the Windows Crate return an empty(?) Result as their return value.

\n

So this time I used match rather than unwrap.

\n
match Process32FirstW(h_toolhelp32_snapshot, &mut pe32) {\n    Ok(_) => {\n        println!(\"Got process snapshot.\");\n\n        loop {\n            let exe_file = {\n                let len = pe32.szExeFile.iter()\n                                                .position(|&c| c == 0)\n                                                .unwrap_or(pe32.szExeFile.len());\n                String::from_utf16_lossy(&pe32.szExeFile[..len])\n            };\n\n            println!(\"Process name: {}\", exe_file);\n            println!(\"=====> PID: {}\", pe32.th32ProcessID);\n            println!(\"=====> Threads count: {}\", pe32.cntThreads);\n\n            match Process32NextW(h_toolhelp32_snapshot, &mut pe32) {\n                Ok(_) => {  },\n                Err(_e) => {\n                    // eprintln!(\"Failed to get next process: {}\", e);\n                    break; \n                }\n            }\n\n        }\n\n    },\n    Err(e) => {\n        eprintln!(\"Failed to get first process: {}\", e);\n    }\n}
\n

When you use match with Result, you can implement the handling for both cases where Ok and Err are returned.

\n

In the example above, within the processing that succeeds in retrieving information using Process32FirstW, I perform loop processing with a loop block and keep outputting process information until retrieving information with Process32NextW fails.

\n

Closing the Handle

\n

After all processing is complete, I close the handle to the process snapshot that I obtained using CloseHandle.

\n
// Close h_toolhelp32_snapshot handle.\nlet handle_name = \"h_toolhelp32_snapshot\";\nmatch CloseHandle(h_toolhelp32_snapshot) {\n    Ok(_) => {\n        println!(\"Handle closed: {}\", handle_name);\n    },\n    Err(e) => {\n        eprintln!(\"Failed to close handle:{} {}\", handle_name, e);\n    }\n}
\n

Summary

\n

Rust seems to have quite a few quirks, but it is quite fun to write.

","fields":{"slug":"/rust-winapi-process-enum-en","tagSlugs":["/tag/rust/","/tag/windows/","/tag/rust-win-api/","/tag/english/"]},"frontmatter":{"date":"2025-04-05","description":"Enumerating process information with Windows APIs in Rust","tags":["Rust","Windows","Rust-WinAPI","English"],"title":"Enumerating Process Information with Windows APIs in Rust","socialImage":{"publicURL":"/static/f6d8b1a54ce1b9da10d734a48a8a0ca8/rust-winapi-process-enum.png"}}}},"pageContext":{"slug":"/rust-winapi-process-enum-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}