eric pouech (@epo) commented about dlls/kernel32/toolhelp.c:
HANDLE hProcess; PROCESS_BASIC_INFORMATION pbi; PPEB_LDR_DATA pLdrData; PLIST_ENTRY head, curr;
PLIST_ENTRY32 head32, curr32; BOOL ret = FALSE;
BOOL target_wow64;
PPEB_LDR_DATA32 pLdrData32;
PEB32* peb32;
DWORD tmp;
WCHAR system32[MAX_PATH], syswow64[MAX_PATH];
int system32_len = 0, syswow64_len = 0;
*num = 0;
if (!(flags & TH32CS_SNAPMODULE)) return TRUE;
doc says that SNAPMODULE32 alone is supported (this should be probably be tested as well)
among the questions to be checked (perhaps not integrated as a test):
* what does a snapshot from a 32bit process to a 32 bit process, with SNAPMODULE32 only return?