Printable View
Im in the middle of creating a DLL for Game Maker (some people may know of it) and i need a way to check if a certain process is running. For example notepad.exe. If it is running return true, otherwise return false. I would appreciate any help to getting this done. Thanks.
one way to do it is like this:
Code:bool isRunning(string pName)
{
unsigned long aProcesses[1024], cbNeeded, cProcesses;
if(!EnumProcesses(aProcesses, sizeof(aProcesses), &cbNeeded))
return;
cProcesses = cbNeeded / sizeof(unsigned long);
for(unsigned int i = 0; i < cProcesses; i++)
{
if(aProcesses[i] == 0)
continue;
HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, 0, aProcesses[i]);
char buffer[50];
GetModuleBaseName(hProcess, 0, buffer, 50);
CloseHandle(hProcess);
if(pName == string(buffer))
return true;
}
return false;
}
Hey thanks for that. I'm getting one error when trying to compile though:
Code:error C2664: 'GetModuleBaseNameW' : cannot convert parameter 3 from 'char [50]' to 'LPWSTR'
Types pointed to are unrelated; conversion requires reinterpret_cast, C-style cast or function-style cast
Code:GetModuleBaseName(hProcess, 0, buffer, 50);
1. Remove unicode defines in your project setings
or
2. Change from char buffer[50] to wchar_t (or any unicode types)
or
3. Change from GetModuleBaseNameW to GetModuleBaseNameA
Is the wonderfull world of ANSI vs UNICODE
Thanks, I've got it all working perfectly now. One more question. Is it possile to get the the path to the exe of the process? Thanks
yeah, or atleast you can get the absolute path to the exe, somewhat like this:
Code:string getFilename(const unsigned long &processID)
{
HANDLE process;
process = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, 0, processID);
char buffer[256];
GetModuleFileNameEx(process, 0, buffer, 256);
CloseHandle(process);
return buffer;
}
hello i'm new to programing and i'm trying to monitor certain process and the posted code can do that for me but i have troubles compileing it and i was wondering witch heder files should i include thanks in advance
windows.h
You'll need windows.h, psapi.h and you'll have to link in psapi.libQuote:
Originally Posted by vlad26
ok thanks but i have another problem now :(((( i've linked psapi.h and included windows.h
but it's doesn't want to compile i'm getting this return without a value errors help please????
thanks in advance
return-statement with no value, in function returning 'int'
change thisQuote:
Originally Posted by vlad26
to this:Code:if(!EnumProcesses(aProcesses, sizeof(aProcesses), &cbNeeded))
return;
Code:if(!EnumProcesses(aProcesses, sizeof(aProcesses), &cbNeeded))
return false;
thanks it's working fine.Now i have another question i know i'm asking too much but, if my program name is vlad26.exe , how to change it's process name to be for example like this: vlad26process.exe
rename the file.
No, my point was to change the process name without renaming the program.Quote:
Originally Posted by robwhit
If you have access to the Windows DDK, then check out the documentation on the System Class Information structure. One field, UNICODESTRING processname is classified as read only. Thus, it cannot be modifed meaning that you cannot change the name of a process in task manager.Quote:
Originally Posted by vlad26
Allright, in context of this theme, I need a code that will check if there are two or more running processes with the same name ( for example, notepad.exe ) ... If there are two processes with same name, return true, otherwise, return false. ( I specify the process name ) .
Thanks in advance.
Classification doesn't make it less editable through DKOM. :pQuote:
Originally Posted by BobS0327
That is true. But for the OP's info, DKOM (Direct Kernel Object manipulation) is just a rootkit for hiding processes. DKOM can change the name by searching thru the EPROCESS block until it finds character array marker "SYSTEM". The process name is an offset in the EPROCESS block based on the location of this "SYSTEM" marker. The process name itself is a 16 byte character array.Quote:
Originally Posted by maxorator
So, essentially, DKOM changes the process name in memory.
Quote:
Originally Posted by outlawbt
Code:#pragma comment(lib, "advapi32.lib")
#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>
DWORD CountProcesses(CHAR *pProcessName)
{
DWORD dwCount = 0;
HANDLE hSnap = NULL;
PROCESSENTRY32 proc32;
if((hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)) == INVALID_HANDLE_VALUE)
return -1;
proc32.dwSize=sizeof(PROCESSENTRY32);
while((Process32Next(hSnap, &proc32)) == TRUE)
if(stricmp(proc32.szExeFile,pProcessName) == 0)
++dwCount;
CloseHandle(hSnap);
return dwCount;
}
int main(int argc, char **argv)
{
DWORD dwReturn;
if(argc == 2)
{
dwReturn = CountProcesses(argv[1]);
if(dwReturn != -1)
printf("There are %d %s processes running\n",dwReturn, argv[1] );
else
printf("CreateToolhelp32Snapshot failed\n");
}
return 0;
}
Thanks for the code, it works perfectly fine, but... I don't want to specify the process's name as program's argument, I want to enter it as string, for example
string process;
cin >> process;
...
I'm new to C/C++ programming, so i had some problems making the code in that what i want it to be....
I would strongly suggest you concentrate on improving your basic C/C++ coding skills before attempting to embark on something more challenging such as system level programming. Otherwise, you'll always need someone else to write the more complex code for you.Quote:
I'm new to C/C++ programming, so i had some problems making the code in that what i want it to be....
Code:// Compile cl.exe /EHsc /MT count.cpp
#pragma comment(lib, "advapi32.lib")
#include <iostream>
#include <windows.h>
#include <tlhelp32.h>
using namespace std;
DWORD CountProcesses(CHAR *pProcessName)
{
DWORD dwCount = 0;
HANDLE hSnap = NULL;
PROCESSENTRY32 proc32;
if((hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)) == INVALID_HANDLE_VALUE)
return -1;
proc32.dwSize=sizeof(PROCESSENTRY32);
while((Process32Next(hSnap, &proc32)) == TRUE)
if(stricmp(proc32.szExeFile,pProcessName) == 0)
++dwCount;
CloseHandle(hSnap);
return dwCount;
}
int main(void)
{
DWORD dwReturn;
char cAsk[] = "Enter process name: ";
char cProcess[80] = {0};
cout << cAsk;
cin >> cProcess;
dwReturn = CountProcesses(cProcess);
if(dwReturn != -1)
printf("There are %d %s processes running\n",dwReturn, cProcess);
else
printf("CreateToolhelp32Snapshot failed\n");
return 0;
}
Thanks a lot :)
Implementing the isRunning code under WindowsXP (Compiled with MingW) seems to cause a segmentation fault pretty reliable for me across a number of systems.
I've tracked the SEGSIV down to OpenProcess - anytime I attempt to use this, as with examples or otherwise, I get a segfault.
I'm not knowledgeable enough to really determine why, especially since theres no useful information out of the debugger...So, in case anyone else is having the problem and just wishes to determine whether or not a process is running:
Taken from another block of code containing segfault issues; but this code works pretty reliable for me.Code:int isRunning(char *pProcessName)
{
HANDLE hSnap = INVALID_HANDLE_VALUE;
HANDLE hProcess = INVALID_HANDLE_VALUE;
PROCESSENTRY32 ProcessStruct;
ProcessStruct.dwSize = sizeof(PROCESSENTRY32);
hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if(hSnap == INVALID_HANDLE_VALUE)
return -1;
if(Process32First(hSnap, &ProcessStruct) == FALSE)
return -1;
do
{
if(stricmp(strupr(ProcessStruct.szExeFile), pProcessName)==0)
{
CloseHandle( hSnap );
return ProcessStruct.th32ProcessID;
break;
}
}
while( Process32Next( hSnap, &ProcessStruct ) );
CloseHandle( hSnap );
return -1;
}
Returns -1 if no process found, or a PID.
Oh, and if anyone can figure out why the original isRunning might be segfaulting...I'd appreciate it =)