}

func findProcess(pid int) (p *Process, err error) {
	const da = syscall.STANDARD_RIGHTS_READ |
		syscall.PROCESS_QUERY_INFORMATION | syscall.SYNCHRONIZE
	h, e := syscall.OpenProcess(da, false, uint32(pid))
	if e != nil {
		return nil, NewSyscallError("OpenProcess", e)
	}
	return newHandleProcess(pid, uintptr(h)), nil
}

func init() {
	cmd := windows.UTF16PtrToString(syscall.GetCommandLine())
	if len(cmd) == 0 {

		parent.Wait()
	}()

	// run child process

	const _PROCESS_CREATE_PROCESS = 0x0080
	const _PROCESS_DUP_HANDLE = 0x0040
	childDumpPath := filepath.Join(t.TempDir(), "ppid.txt")
	ph, err := syscall.OpenProcess(_PROCESS_CREATE_PROCESS|_PROCESS_DUP_HANDLE|syscall.PROCESS_QUERY_INFORMATION,
		false, uint32(parent.Process.Pid))
	if err != nil {
		t.Fatal(err)
	}
	defer syscall.CloseHandle(ph)

                // AttachConsole also returns ERROR_GEN_FAILURE when the process
                // doesn't exist, so we need to verify that the pid is valid.
                if (OpenProcess(SYNCHRONIZE, FALSE, pid) == NULL) {
                    ErrorExit(TEXT("OpenProcess"));
                }

                // We expect AttachConsole to fail with a particular error if the
                // provided pid is not attached to a console

	// modeHandle.
	//
	// handle must be accessed only via the handleTransientAcquire method
	// (or during closeHandle), not directly! handle is immutable.
	//
	// On Windows, it is a handle from OpenProcess.
	// On Linux, it is a pidfd.
	// It is unused on other GOOSes.
	handle uintptr
}

func newPIDProcess(pid int) *Process {
	p := &Process{
		Pid:  pid,
		mode: modePID,
	}

	procMapViewOfFile                      = modkernel32.NewProc("MapViewOfFile")
	procMoveFileW                          = modkernel32.NewProc("MoveFileW")
	procOpenProcess                        = modkernel32.NewProc("OpenProcess")
	procPostQueuedCompletionStatus         = modkernel32.NewProc("PostQueuedCompletionStatus")
	procProcess32FirstW                    = modkernel32.NewProc("Process32FirstW")

		}
	}()

	defer func() {
		err = resumeChildThread(kernel32, cmd.Process.Pid)
		if err != nil {
			t.Fatal(err)
		}
	}()

	ph, err := syscall.OpenProcess(_PROCESS_ALL_ACCESS, false, uint32(cmd.Process.Pid))
	if err != nil {
		t.Fatal(err)
	}
	defer syscall.CloseHandle(ph)

	var mask, sysmask uintptr

//sys	OpenProcess(da uint32, inheritHandle bool, pid uint32) (handle Handle, err error)
//sys	TerminateProcess(handle Handle, exitcode uint32) (err error)
//sys	GetExitCodeProcess(handle Handle, exitcode *uint32) (err error)

	procOpenMutexW                                           = modkernel32.NewProc("OpenMutexW")
	procOpenProcess                                          = modkernel32.NewProc("OpenProcess")
	procOpenThread                                           = modkernel32.NewProc("OpenThread")
	procPostQueuedCompletionStatus                           = modkernel32.NewProc("PostQueuedCompletionStatus")

//sys   updateProcThreadAttribute(attrlist *ProcThreadAttributeList, flags uint32, attr uintptr, value unsafe.Pointer, size uintptr, prevvalue unsafe.Pointer, returnedsize *uintptr) (err error) = UpdateProcThreadAttribute
//sys	OpenProcess(desiredAccess uint32, inheritHandle bool, processId uint32) (handle Handle, err error)

		{"O_SYMLINK", Const, 0},
		{"O_SYNC", Const, 0},
		{"O_TRUNC", Const, 0},
		{"O_TTY_INIT", Const, 0},
		{"O_WRONLY", Const, 0},
		{"Open", Func, 0},
		{"OpenCurrentProcessToken", Func, 0},
		{"OpenProcess", Func, 0},
		{"OpenProcessToken", Func, 0},
		{"Openat", Func, 0},
		{"Overlapped", Type, 0},
		{"Overlapped.HEvent", Field, 0},
		{"Overlapped.Internal", Field, 0},