]
    }

    @Requires(UnitTestPreconditions.Windows)
    def 'can extract process info from windows wmic'() {
        given:
        def output = '''
CommandLine ProcessId
\\SystemRoot\\System32\\smss.exe            244

	if r1&0xff == 0 {
		err = errnoErr(e1)
	}
	return
}

func CreateToolhelp32Snapshot(flags uint32, processId uint32) (handle Handle, err error) {
	r0, _, e1 := Syscall(procCreateToolhelp32Snapshot.Addr(), 2, uintptr(flags), uintptr(processId), 0)
	handle = Handle(r0)
	if handle == InvalidHandle {
		err = errnoErr(e1)
	}
	return
}

func DeleteFile(path *uint16) (err error) {

//sys	OpenProcess(desiredAccess uint32, inheritHandle bool, processId uint32) (handle Handle, err error)
//sys	ShellExecute(hwnd Handle, verb *uint16, file *uint16, args *uint16, cwd *uint16, showCmd int32) (err error) [failretval<=32] = shell32.ShellExecuteW

//sys	ReadConsole(console Handle, buf *uint16, toread uint32, read *uint32, inputControl *byte) (err error) = kernel32.ReadConsoleW
//sys	CreateToolhelp32Snapshot(flags uint32, processId uint32) (handle Handle, err error) [failretval==InvalidHandle] = kernel32.CreateToolhelp32Snapshot
//sys	Process32First(snapshot Handle, procEntry *ProcessEntry32) (err error) = kernel32.Process32FirstW

	if r1&0xff == 0 {
		err = errnoErr(e1)
	}
	return
}

func CreateToolhelp32Snapshot(flags uint32, processId uint32) (handle Handle, err error) {
	r0, _, e1 := syscall.Syscall(procCreateToolhelp32Snapshot.Addr(), 2, uintptr(flags), uintptr(processId), 0)
	handle = Handle(r0)
	if handle == InvalidHandle {
		err = errnoErr(e1)
	}
	return
}

  }

  if ((Get-service $service).Status -ne 'Stopped') {
    # Force kill the processes.
    Stop-Process -Force -PassThru -Id (Get-WmiObject win32_process |
      Where CommandLine -Like $cmdline).ProcessId

    # Wait until process has stopped.
    $waited = 0
    $log_period = 10
    $timeout = 60
    while ((Get-service $service).Status -ne 'Stopped' -and $waited -lt $timeout) {
      Start-Sleep 1

		{"ProcessEntry32.PriClassBase", Field, 4},
		{"ProcessEntry32.ProcessID", Field, 4},
		{"ProcessEntry32.Size", Field, 4},
		{"ProcessEntry32.Threads", Field, 4},
		{"ProcessEntry32.Usage", Field, 4},
		{"ProcessInformation", Type, 0},
		{"ProcessInformation.Process", Field, 0},
		{"ProcessInformation.ProcessId", Field, 0},
		{"ProcessInformation.Thread", Field, 0},

return{pageDirectoryBase,uniqueProcessKey,processId,parentId,sessionId,exitStatus,directoryTableBase,flags,userSID,imageFileName,commandLine,packageFullName,applicationId,exitTime};},decodeStart(header,decoder){const fields=this.decodeFields(header,decoder);const process=this.model.getOrCreateProcess(fields.processId);if(process.hasOwnProperty('has_ended')){throw new Error('Process clash detected.');}

pkg syscall (windows-386), type ProcessInformation struct
pkg syscall (windows-386), type ProcessInformation struct, Process Handle
pkg syscall (windows-386), type ProcessInformation struct, ProcessId uint32
pkg syscall (windows-386), type ProcessInformation struct, Thread Handle
pkg syscall (windows-386), type ProcessInformation struct, ThreadId uint32
pkg syscall (windows-386), type Protoent struct