Jump to content

Recommended Posts

Posted (edited)

Hi to all AutoITScript community.

Dears i have an idea but i dont know to realise it.

Say process exist by named debuger.exe

This is not hard detect it just simple

if ProcessExists("debuger.exe") Then
    MsgBox(64,"Process Exist","Process Exist (debuger.exe) ",5)
Else
    MsgBox(64,"Not Exist!","Not Exist!",5)
    Exit
    EndIf

But how to know from which directory this process started?(I mean debuger.exe where located and get location for it in this case it is directory)

Like below:

PID    PPID    PGID     WINPID  TTY  UID    STIME COMMAND
      972       0       0        972    ?    0 22:12:30 C:\Program Files\Sunbelt Software\Personal Firewall\SbPFCl.exe
     2076       0       0       2076    ?    0 22:12:43 C:\WINDOWS\system32\ctfmon.exe
     2400       0       0       2400    ?    0 22:13:03 C:\WINDOWS\system32\hkcmd.exe
     2408       0       0       2408    ?    0 22:13:03 C:\WINDOWS\system32\igfxpers.exe
     2464       0       0       2464    ?    0 22:13:04 C:\WINDOWS\RTHDCPL.EXE
     2500       0       0       2500    ?    0 22:13:05 C:\Program Files\USB Disk Security\USBGuard.exe
     2516       0       0       2516    ?    0 22:13:06 C:\Program Files\Shadow Defender\DefenderDaemon.exe
     2608       0       0       2608    ?    0 22:13:06 C:\Program Files\SpeedFan\speedfan.exe
     2644       0       0       2644    ?    0 22:13:07 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
     2652       0       0       2652    ?    0 22:13:07 C:\Documents and Settings\All Users\Application Data\netmeter\NetMeter114beta_4.exe
     2668       0       0       2668    ?    0 22:13:07 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
     3400       0       0       3400    ?    0 22:25:27 C:\Program Files\Winamp\winamp.exe
     3024       0       0       3024    ?    0 22:32:03 C:\WINDOWS\explorer.exe
     3412       0       0       3412    ?    0 22:43:55 C:\Program Files\Mozilla Firefox\firefox.exe
     2680       0       0       2680    ?    0 22:45:03 C:\WINDOWS\system32\ping.exe
     2736       0       0       2736    ?    0 22:45:24 H:\local---technet_microsoft_com120000000060.rwx-rwx--r  owner---root\Tcpview.exe
      516       0       0        516    ?    0 23:40:09 C:\WINDOWS\system32\cmd.exe
     2768       0       0       2768    ?    0 01:28:33 C:\Program Files\FlashGet\flashget.exe
      508       0       0        508    ?    0 01:29:05 J:\MENIM\menim\test.exe
      524       0       0        524    ?    0 01:31:32 C:\WINDOWS\system32\NOTEPAD.EXE
     2780       0       0       2780    ?    0 01:36:29 C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe
     3792       0       0       3792    ?    0 01:38:49 C:\cygwin\step\Cygwin.exe
     3628       0       0       3628    ?    0 01:38:49 C:\WINDOWS\system32\cmd.exe
     1332       1    1332       1332  con 1005 01:38:50 /usr/bin/bash
     1772    1332    1772       3076  con 1005 01:40:13 /cygdrive/c/WINDOWS/system32/cmd
     3076       0       0       3076    ?    0 01:40:14 c:\WINDOWS\system32\cmd.exe
     3048       1    3048       3048  con 1005 01:40:35 /usr/bin/ps

In cygwin for get this result i use ps -W but in standart Win Os how to get like this result using Autoit script(but without cygwin or powershell or console)

tasklist /V ?

I try

FileGetLongName()
no doubt:(

Is here in AUTOIT detection of Processname Path?

Really i cannot figure it out.

Any tips,helps is greatly appreciate.

Thanks again.

Edited by Sh3llC043r
[size="5"] [/size]
Posted

Check out the _WinAPI_GetModuleFileNameEx() function from Yashied's excellent WinApiEx UDF @

http://www.autoitscript.com/forum/index.php?showtopic=98712&view=findpost&p=709878

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...