More on Processes (getProcesses)

I have the following function to get a list of all runing processes and other info, as posted in two other places in the section, one of the most irritating things about it is that GetModuleBaseName does not get the correct name for all the processes, e.g. ALG.exe and CSRSS.exe, two common windows processes aren't in the list where they are in taskmanager.

Code:

int getProcesses() { HMODULE hModule; char szProcessName[MAX_PATH] = {0}; DWORD dwProcesses[1024], cbNeeded, cProcesses; unsigned int i; char PIDbuf[10]; char buf[50]; if (!EnumProcesses(dwProcesses, sizeof(dwProcesses), &cbNeeded)) return -1; cProcesses = cbNeeded / sizeof(DWORD); for (i = 0; i < cProcesses; i++) if(dwProcesses[i] != 0) { HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, dwProcesses[i]); if (NULL != hProcess) { strcpy(szProcessName, "System"); if (EnumProcessModules(hProcess, &hModule, sizeof(hModule), &cbNeeded)) { GetModuleBaseName(hProcess, hModule, szProcessName, sizeof(szProcessName)/sizeof(CHAR)); } } sprintf(PIDbuf, "%d", dwProcesses[i]); InsertRow(GetDlgItem(hwndMain, ID_LISTVIEW), szProcessName,PIDbuf, GetProcessMemoryWSS(hProcess, buf), GetProcessMemoryPWSS(hProcess, buf), GetProcessPriority(hProcess), GetUserInfo(dwProcesses[i], hProcess)); CloseHandle(hProcess); } return cProcesses; }

As you can see in the attachment the process with a PID of 3600 is ment to be ALG.exe not nmsrvc.exe. Also where this happens the memory usage and briotity class are blank. I was thinking of checking whether GetProcessMemoryWSS fails (returns "") if it has, get PID -> open handle -> get name and replace it with szProcessName. However I don't know of any functions to do this. I don't want to use PdhEnumObjectItems as that caches and I don't fancy using Snapshots either. Is there any way this can be acheived?

Try using NtQueryInformationProcess() to get the process name (it will be returned in the ProcessInformation structure) and see if that gives something different.

You should check GetModuleBaseName return value - probably it failed and you just printed what was left in the buffer after the previous call

As I tried to point out in your previous thread....

If OpenProcess() returns a NULL, you still insert a row and use a NULL handle in the calls to get other info.

I have fixed up the check: if (NULL != hProcess), as if hProcess is NULL, I need to Close the handle and move on to the next process. The problem now is that GetModuleBaseName doesn't return 0, it might be that EnumProcessModules fails so GetModuleBaseName never returns 0. Note I haven't tryed implementing NtQueryInformationProcess yet. Here is what I currently have (I have removed the top as it is the same as before:

Code:

for (i = 0; i < cProcesses; i++) if(dwProcesses[i] != 0) { HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, dwProcesses[i]); if (NULL != hProcess) { strcpy(szProcessName, "System"); if (EnumProcessModules(hProcess, &hModule, sizeof(hModule), &cbNeeded)) { GetModuleBaseName(hProcess, hModule, szProcessName, sizeof(szProcessName)/sizeof(CHAR)); } sprintf(PIDbuf, "%d", dwProcesses[i]); InsertRow(GetDlgItem(hwndMain, ID_LISTVIEW), szProcessName,PIDbuf, GetProcessMemoryWSS(hProcess, buf), GetProcessMemoryPWSS(hProcess, buf), GetProcessPriority(hProcess), GetUserInfo(dwProcesses[i], hProcess)); } CloseHandle(hProcess); } return cProcesses; }

what is api function to close current selecting process?

You mean close down a process (close notepad for example) or close the handle to a function you opened?

Quote:

Originally Posted by P4R4N01D

e.g. ALG.exe and CSRSS.exe, two common windows processes aren't in the list where they are in taskmanager.

That's because when you try and open the handles, OpenProcess is failing, and if you GetLastError(), it'll probably be 5 which is Access Denied. Why? Well those two process don't have the default service DACL, specifically for those two processes Administrator accounts have no permissions at all.

If you want to check for yourself, download my QueryDACL tool, then get the PID of either of those processes and run:
qd kernel process <pid you just found>
that'll output all the permissions available for each account that has an entry in the DACL. Builtin\Administrators will be strangely absent.

To get round it, you need to enable the SE_DEBUG_NAME privilege for your process (see AdjustTokenPrivileges and friends, see the linked example at the bottom for how to do it) do the querying, and disable it when you don't need it any more.

yes elysia
if you know api function, please write it to me

Simple, use CreateProcess to Create a Process and use TerminateProcess to close one. Terminate Process requires the handle to the Process that is to be closed and all these functions are declared in Kernel32.lib e.g.

Code:

TerminateProcess(OpenProcess(PROCESS_TERMINATE,FALSE,PID),0) //Where PID is a int (or UNIT)

Also as you know a process that is forced to end task will not be able to ignore the request, so it might be a good idea to think about asking the user for confirmation (Esp. if they are about to close a system process), don't want the user having to go through a reboot just because they "accidentally" closed csrss.exe.

Also thanks adeyblue, I knew that OpenProcess was failing, but didn't know why. Now I know I will look into it and probably post a function that gets a handle to those processes.

Good!!!
i solved old my problem for your help.
thanks again.

Hi, P4R4N01D
i have some issue while using my app.
it is my app is forced to end process to open as you say.
i'd like to get a message for process when ending process.
can you tell me another api function for it or other ways?
regards

Do you mean to ask the user for confirmation to end the process or give them some output when the close a system process? If it is for confirmation then just use a messageBox, I like to give the user an option to toggle this on/off via a menu, set a flag and test it when the user tries to end the process.
If you want to give specific output on if the user tries to exit a SYSTEM process, then the only way I would recommend is to use multiple if statements to test for common processes: "Idle", "csrss", etc, do some research if necessary. I don't recommend getting the user name of the process to see if it was run by the OS (See the user name column in task manager) or not as this is surprisingly lengthy and complex. If you must know it is in one of the threads I started, about process user names.

Code:

TerminateProcess(OpenProcess(PROCESS_TERMINATE,FALSE,PID),0) //Where PID is a int (or UNIT)

This type of copy is not really recommended.
OpenProcess returns a handle which you must close.
And I don't see the purpose of terminating a process you just open? Or it was it just an example?

Another (better) way to close a process is to close its main window or send close to all of its windows. That way it will exit the way it should. I don't remember exactly how to to enumerate windows for a given process/thread.

i mean when open some process(e.g. notepad.exe), edit letters and close process(notepad), i need to show messagebox for saving my data.
then if use TerminateProcess api, i cant get this messagebox.
so i'm looking for another api function to closing process.
i think get mainhandle of window(notepad window) and close process for using it's handle.
is it possible this way?
if possible, please help me in advance or post api function.
thanks.

Quote:

Originally Posted by Elysia

Code:

TerminateProcess(OpenProcess(PROCESS_TERMINATE,FALSE,PID),0) //Where PID is a int (or UNIT)

Another (better) way to close a process is to close its main window or send close to all of its windows. That way it will exit the way it should. I don't remember exactly how to to enumerate windows for a given process/thread.

elysia,
you mentioned to use getwindow, getnextwindow api, i guess
what about it?

That use of terminate process was an example to Terminate the process with only its identifier.
ExitProcess is another api function that is similar to TermimateProcess but I don't think that is waht you are looking for. If you want to tell notepad to close and then give notepad the option of doing something first (getting user input), the only way I can think of is to use its handle in a call to SendMessage and send the process a WM_CLOSE message. As the handle should be one to its main window (definitely not a child window) it should be the same as the user clicking on the X button or going File>Exit in notepad. I haven't done this before so I am not sure of it, but it should work in theory. Try it, I would like to see if it works
//added:
I think Elysia is referring to look at EnumChildWindows which from msdn: "The EnumChildWindows function is more reliable than calling GetWindow in a loop. An application that calls GetWindow to perform this task risks being caught in an infinite loop or referencing a handle to a window that has been destroyed."