Process Snapshot lock + Get most info from a proccess...

Hi all EE experts,

I have serie of question related to process that I belive is a doubt to many Windows Developers. I expect that some of you advanced Windows Programmers can help :)

Source code examples are very appreciated and must be in C! :)

1 - In general when we want to list process and it filename in a Windows machine we use CreateToolhelp32Snapshot() + Process32First() + Process32Next(), more or less like that:

void ListProc(){

HANDLE hSnapshot=CreateToolhelp32Snapshot(TH32CS_PROCESS,0);

if (hSnapshot==-1){
  printf("Failed create snapshot...");
  exit(1);
 }

PROCESSENTRY32 pe;
pe.dwSize=sizeof(PROCESSENTRY32);

BOOL retval=Process32First(hSnapshot,&pe);
while(retval){

  printf("Process ID : %08X belongs to %s\n",pe.th32ProcessID, pe.szExeFile);
  pe.dwSize=sizeof(PROCESSENTRY32);
  retval=Process32Next(hSnapshot,&pe);

 }

CloseHandle(hSnapshot);
}

So, how can I "lock/Suspend" the process creation and deletion while I do some stuff? Example:

ListProc();
LockProcessCreationAndDeletion();
MakeSomeStuff();
ListProc();
UnlockProcessCreationAndDeletion();

How can it be done?

2 - I were asking how to obtain a list of threads and modules from a process, however I found some useful examples into web, other developers that want learn it, check:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/traversing_the_thread_list.asp   ( List Threads of a process).

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/perfmon/base/traversing_the_module_list.asp   ( List Modules of a Process).

http://www.codeproject.com/threads/processapi.asp   (Intersting resource).

I yet found:

- If you want to close a program send a sendmessage() with WM_CLOSE.
- If you want to close a thread:
OpenThread()
TerminateThread()
CloseHandle()

Question 2 replyed by myself, so points to me... hehehe (just joking).

3 - How can list all files that process have opened? I seen it use NtQuerySystemInformation() appear that the trick is into SystemHandleInformation, I found some examples here but all in C++ and it's a litlle confuse for me. Can someone point me a example (can be just a funcion like: ListFilesByProc(DWORD dwPID) in C ? And preferable translating the names from Hardfisk0\Partition1\directory\FileExample.txt to letters assigned by Windows, like c:\\directory\FileExample.txt (this I couldn't find into Google) :)

4 - Supoose I want list programs executed by other programs, for example, suposse a program called test.exe call calc.exe, I could create a process snapshot and walk thought it and check if the struct PROCESSENTRY32 have the field  th32ParentProcessID not NULL, and consequentilly know if it's called by other program or not. My doubt is, it's the best way I can do it? Or exist some own API into Windows or something better to enumerate process executed by a process? :)

5 - Exist a program called CurrPorts (http://www.nirsoft.net/utils/cports.html), it enumerate all ports that a process is using, for example if it's listen in port X, and connectint to port Y with host XZ into remote port VX, etc. How this data can be extracted from a process?

6 - If we just have a PID, how can us get a PROCESSENTRY32 structure of this process or similar to list it filename on disk, threads, modules, other information in asked in this thread? :)

Thank you and all help is appreciated.

Regards