Jump to content
Sign in to follow this  
gil900

i need to check if a some process launched a new process

Recommended Posts

gil900

hello,

i need to check for $main_process and see if $main_process has launched a new sub-process and then i need to check the same thing on the sub-process.

but i don't need additional help as soon as I know how to do this check.

i don't know how to do this and if it is possible..

 

i need help.

thanks for the helpers!

Edited by gil900

Share this post


Link to post
Share on other sites
kylomas

gil900,

WMI can monitor starting/ending processes and list the parent process like this

;~ #include <date.au3>
;~ #include <misc.au3>

HotKeySet("{ESC}","ESC")

local $oerror = ObjEvent("AutoIt.Error", "_DeBug")

Local $Obj  = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & @ComputerName & "\root\cimv2")
Local $hObj = ObjCreate("WbemScripting.SWbemSink")

If IsObj($Obj) And IsObj($hObj) Then
    ObjEvent($hObj, "SINK_")
    $Obj.ExecNotificationQueryAsync($hObj, "SELECT * FROM __InstanceCreationEvent WITHIN 0.1 WHERE TargetInstance ISA 'Win32_Process'")
    $Obj.ExecNotificationQueryAsync($hObj, "SELECT * FROM __InstanceDeletionEvent WITHIN 0.1 WHERE TargetInstance ISA 'Win32_Process'")
EndIf

Sleep(9999999999)

Func SINK_OnObjectReady($OB)
    local $str,$owner,$ret
    Switch $OB.Path_.Class
        Case "__InstanceCreationEvent"
            $str = stringformat('%-10s PID[%05i] Name[%20s] Parent[%5i]', _
                                '! Started',$OB.TargetInstance.ProcessID,$ob.targetinstance.name,$ob.targetinstance.parentprocessid)
            consolewrite($str & @lf)
            $str = ""
        Case "__InstanceDeletionEvent"
            $str = stringformat('%-10s PID[%05i] Name[%20s]', _
                    '! Ended  ',$OB.TargetInstance.ProcessID,$ob.targetinstance.name)
            consolewrite($str & @lf)
            $str = ""
    EndSwitch
    Return 1
EndFunc

Func _Debug($oError)
    ConsoleWrite( _
            "! ##################### AUTOIT OBJECT ERROR ######################################" & @CRLF & _
            "!                err.number is        : " & @TAB & hex($oError.number,8) & @CRLF & _
            "!                err.scriptline is    : " & @TAB & $oError.scriptline & @CRLF & _
            "!                err.windesc is       : " & @TAB & $oError.windescription & @CRLF & _
            "!                err.desc is          : " & @TAB & $oError.description & @CRLF & _
            "!                err.source is        : " & @TAB & $oError.source & @CRLF & _
            "!                err.retcode is       : " & @TAB & hex($oError.retcode,8) & @CRLF & _
            "! ################################################################################" & @CRLF _
            )
    Return 0
EndFunc

Func ESC()
    Exit(0)
EndFunc

Hope it helps!

kylomas

  • Like 1

Forum Rules         Procedure for posting code

"I like pigs.  Dogs look up to us.  Cats look down on us.  Pigs treat us as equals."

- Sir Winston Churchill

Share this post


Link to post
Share on other sites
gil900

gil900,

WMI can monitor starting/ending processes and list the parent process like this

;~ #include <date.au3>
;~ #include <misc.au3>

HotKeySet("{ESC}","ESC")

local $oerror = ObjEvent("AutoIt.Error", "_DeBug")

Local $Obj  = ObjGet("winmgmts:{impersonationLevel=impersonate}!\\" & @ComputerName & "\root\cimv2")
Local $hObj = ObjCreate("WbemScripting.SWbemSink")

If IsObj($Obj) And IsObj($hObj) Then
    ObjEvent($hObj, "SINK_")
    $Obj.ExecNotificationQueryAsync($hObj, "SELECT * FROM __InstanceCreationEvent WITHIN 0.1 WHERE TargetInstance ISA 'Win32_Process'")
    $Obj.ExecNotificationQueryAsync($hObj, "SELECT * FROM __InstanceDeletionEvent WITHIN 0.1 WHERE TargetInstance ISA 'Win32_Process'")
EndIf

Sleep(9999999999)

Func SINK_OnObjectReady($OB)
    local $str,$owner,$ret
    Switch $OB.Path_.Class
        Case "__InstanceCreationEvent"
            $str = stringformat('%-10s PID[%05i] Name[%20s] Parent[%5i]', _
                                '! Started',$OB.TargetInstance.ProcessID,$ob.targetinstance.name,$ob.targetinstance.parentprocessid)
            consolewrite($str & @lf)
            $str = ""
        Case "__InstanceDeletionEvent"
            $str = stringformat('%-10s PID[%05i] Name[%20s]', _
                    '! Ended  ',$OB.TargetInstance.ProcessID,$ob.targetinstance.name)
            consolewrite($str & @lf)
            $str = ""
    EndSwitch
    Return 1
EndFunc

Func _Debug($oError)
    ConsoleWrite( _
            "! ##################### AUTOIT OBJECT ERROR ######################################" & @CRLF & _
            "!                err.number is        : " & @TAB & hex($oError.number,8) & @CRLF & _
            "!                err.scriptline is    : " & @TAB & $oError.scriptline & @CRLF & _
            "!                err.windesc is       : " & @TAB & $oError.windescription & @CRLF & _
            "!                err.desc is          : " & @TAB & $oError.description & @CRLF & _
            "!                err.source is        : " & @TAB & $oError.source & @CRLF & _
            "!                err.retcode is       : " & @TAB & hex($oError.retcode,8) & @CRLF & _
            "! ################################################################################" & @CRLF _
            )
    Return 0
EndFunc

Func ESC()
    Exit(0)
EndFunc

Hope it helps!

kylomas

Thank you very much for the code.

i tested it and i saw that it see what it should see and this is very good start.

but it allso see and write in the console informition about all other processes that runing in windows.

this info is a junk for me in my case.

i need that the code will listen to a specific process and not to all runnig process in windows.

i don't know how to modify this code because I do not understand how the code works ..

Share this post


Link to post
Share on other sites
kylomas

gil900,

This code fragment is an example if one way to monitor processes to get you started.  Use Google, Scriptomatic, the Help file and this forum to answer any questions you have AFTER you have defined exactly what you want to do.

kylomas

  • Like 1

Forum Rules         Procedure for posting code

"I like pigs.  Dogs look up to us.  Cats look down on us.  Pigs treat us as equals."

- Sir Winston Churchill

Share this post


Link to post
Share on other sites
gil900

gil900,

This code fragment is an example if one way to monitor processes to get you started.  Use Google, Scriptomatic, the Help file and this forum to answer any questions you have AFTER you have defined exactly what you want to do.

kylomas

my problem is with steam.exe

when i starting a game in steam, steam is launching the game. and i need a way for my script to know the prosses name of the game/exe name of the game which runing. the script can't know which game has launched by steam.. this is a big problem for me. this is why im looking for a way to get the sub-prosses name.

in this case, the sub-prosses is the game that launched by steam.

the is what i want to do..

Edited by gil900

Share this post


Link to post
Share on other sites
gil900

Ok I'm sorry I broke the rules ..
But it's not for cheats .. It's for a whole different purpose.
I want to count how many time I play the game for myself.
For this I need to know how long the game runs. But for this I need know who is this game(this is why the topoc started).

Edited by gil900

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.
Sign in to follow this  

×