_ProcessGetParent() : _ProcessGetChildren()

[SmOke_N]

_ProcessGetParent:
Example Call:

MsgBox(0, "Parent Process", _ProcessGetParent(@AutoItPID))

expandcollapse popup

Func _ProcessGetParent($i_pid)
    Local $TH32CS_SNAPPROCESS = 0x00000002
    
    Local $a_tool_help = DllCall('Kernel32.dll', 'long', 'CreateToolhelp32Snapshot', 'int', $TH32CS_SNAPPROCESS, 'int', 0)
    If IsArray($a_tool_help) = 0 Or $a_tool_help[0] = -1 Then Return SetError(1, 0, $i_pid)
    
    Local $tagPROCESSENTRY32 = _
            DllStructCreate( _
            'dword dwsize;' & _
            'dword cntUsage;' & _
            'dword th32ProcessID;' & _
            'uint th32DefaultHeapID;' & _
            'dword th32ModuleID;' & _
            'dword cntThreads;' & _
            'dword th32ParentProcessID;' & _
            'long pcPriClassBase;' & _
            'dword dwFlags;' & _
            'char szExeFile[260]' _
            )
    DllStructSetData($tagPROCESSENTRY32, 1, DllStructGetSize($tagPROCESSENTRY32))
    
    Local $p_PROCESSENTRY32 = DllStructGetPtr($tagPROCESSENTRY32)
    
    Local $a_pfirst = DllCall('Kernel32.dll', 'int', 'Process32First', 'long', $a_tool_help[0], 'ptr', $p_PROCESSENTRY32)
    If IsArray($a_pfirst) = 0 Then Return SetError(2, 0, $i_pid)
    
    Local $a_pnext, $i_return = 0
    If DllStructGetData($tagPROCESSENTRY32, 'th32ProcessID') = $i_pid Then
        $i_return = DllStructGetData($tagPROCESSENTRY32, 'th32ParentProcessID')
        DllCall('Kernel32.dll', 'int', 'CloseHandle', 'long', $a_tool_help[0])
        If $i_return Then Return $i_return
        Return $i_pid
    EndIf
    
    While @error = 0
        $a_pnext = DllCall('Kernel32.dll', 'int', 'Process32Next', 'long', $a_tool_help[0], 'ptr', $p_PROCESSENTRY32)
        If DllStructGetData($tagPROCESSENTRY32, 'th32ProcessID') = $i_pid Then
            $i_return = DllStructGetData($tagPROCESSENTRY32, 'th32ParentProcessID')
            If $i_return Then ExitLoop
            $i_return = $i_pid
            ExitLoop
        EndIf
    WEnd
    DllCall('Kernel32.dll', 'int', 'CloseHandle', 'long', $a_tool_help[0])
    Return $i_return
EndFunc   ;==>_ProcessGetParent

expandcollapse popup

Func _ProcessGetChildren($i_pid)
    Local Const $TH32CS_SNAPPROCESS = 0x00000002
    
    Local $a_tool_help = DllCall('Kernel32.dll', 'long', 'CreateToolhelp32Snapshot', 'int', $TH32CS_SNAPPROCESS, 'int', 0)
    If IsArray($a_tool_help) = 0 Or $a_tool_help[0] = -1 Then Return SetError(1, 0, $i_pid)
    
    Local $tagPROCESSENTRY32 = _
            DllStructCreate _
            ( _
            'dword dwsize;' & _
            'dword cntUsage;' & _
            'dword th32ProcessID;' & _
            'uint th32DefaultHeapID;' & _
            'dword th32ModuleID;' & _
            'dword cntThreads;' & _
            'dword th32ParentProcessID;' & _
            'long pcPriClassBase;' & _
            'dword dwFlags;' & _
            'char szExeFile[260]' _
            )
    DllStructSetData($tagPROCESSENTRY32, 1, DllStructGetSize($tagPROCESSENTRY32))
    
    Local $p_PROCESSENTRY32 = DllStructGetPtr($tagPROCESSENTRY32)
    
    Local $a_pfirst = DllCall('Kernel32.dll', 'int', 'Process32First', 'long', $a_tool_help[0], 'ptr', $p_PROCESSENTRY32)
    If IsArray($a_pfirst) = 0 Then Return SetError(2, 0, $i_pid)
    
    Local $a_pnext, $a_children[11] = [10], $i_child_pid, $i_parent_pid, $i_add = 0
    $i_child_pid = DllStructGetData($tagPROCESSENTRY32, 'th32ProcessID')
    If $i_child_pid <> $i_pid Then
        $i_parent_pid = DllStructGetData($tagPROCESSENTRY32, 'th32ParentProcessID')
        If $i_parent_pid = $i_pid Then
            $i_add += 1
            $a_children[$i_add] = $i_child_pid
        EndIf
    EndIf
    
    While 1
        $a_pnext = DllCall('Kernel32.dll', 'int', 'Process32Next', 'long', $a_tool_help[0], 'ptr', $p_PROCESSENTRY32)
        If IsArray($a_pnext) And $a_pnext[0] = 0 Then ExitLoop
        $i_child_pid = DllStructGetData($tagPROCESSENTRY32, 'th32ProcessID')
        If $i_child_pid <> $i_pid Then
            $i_parent_pid = DllStructGetData($tagPROCESSENTRY32, 'th32ParentProcessID')
            If $i_parent_pid = $i_pid Then
                If $i_add = $a_children[0] Then
                    ReDim $a_children[$a_children[0] + 10]
                    $a_children[0] = $a_children[0] + 10
                EndIf
                $i_add += 1
                $a_children[$i_add] = $i_child_pid
            EndIf
        EndIf
    WEnd
    
    If $i_add <> 0 Then
        ReDim $a_children[$i_add + 1]
        $a_children[0] = $i_add
    EndIf
    
    DllCall('Kernel32.dll', 'int', 'CloseHandle', 'long', $a_tool_help[0])
    If $i_add Then Return $a_children
    Return SetError(3, 0, 0)
EndFunc   ;==>_ProcessGetChildren

2015/02/07

Just providing the debug priviledge and process.au3 I use now.  As suggested by Melba below, you may very well find that it's easier to use _WinAPI_GetParentProcess and _WinAPI_EnumChildProcess now.

2015/02/08

It appears there was an issue with the above two functions in my au3's provided.  One noteable one is with ProcessGetChildren, it appears that my functions and _WinAPI_GetParentProcess have the same issue.  Returning a non-existing Process ID when the process has no parent.  Fixed in the non-struck through processes.au3.

DebugPrivilege.au3

Processes.au3

Processes.au3

Edited February 8, 2015 by SmOke_N
AutoIt tags blew up code

[therks]

Wow, that seems so complicated. I thought there was a simpler way of doing that, with like... ONE function call. And what an odd function name, "CreateToolhelp32Snapshot" hehe. Cool though, now you just need to get it added to the shipped Process.au3

[SmOke_N]

Wow, that seems so complicated. I thought there was a simpler way of doing that, with like... ONE function call. And what an odd function name, "CreateToolhelp32Snapshot" hehe. Cool though, now you just need to get it added to the shipped Process.au3

Well... I don't really see that as "complicated", but yes, I would have thought so as well (a simple call, maybe a callback func or something). Unfortunately, any research I did on it came up empty for a result (other than WMI).

As far as submission, I don't mind posting here in the example scripts forum, but hate to maintain things like this... so I'll just leave here ...

[wraithdu]

I think you can also do this with 'psapi.dll'. It's been a while since I did the function calls for an NSIS header though.

[SmOke_N]

I think you can also do this with 'psapi.dll'. It's been a while since I did the function calls for an NSIS header though.

I've read all the listed functions and structures for psapi on msdn. I won't say it's impossible with with psapi, but I read nothing in msdn that indicated you could do either one of those. Do you have an example?

[level20peon]

Is it possible to update those two functions to work on x64?

[Melba23]

level20peon,

Rather than posting in thread which has been dormant for over 6 years, why not look in the Help file and see if these functions are now available in the standard set? If you had done so, you might well have found _WinAPI_GetParentProcess & _WinAPI_EnumChildProcess. Much simpler for everyone that way.

M23

[SmOke_N]

@level20peon, as curious as I am on what is not working for you with 64bit, I have to agree with Melba.  They've since added these two functions to the _WinAPI library, re-written a little, but still follows the same CreateToolSnapShot/Process32FirstW/Process32NextW format I have above.  So I would suggest following that as they'll more than likely keep up to date with it more than I will these.

The only thing I think is more reliable in my Processes.au3 file, than the _WinAPI library, is the ProcessGetPathEx function, that should be changed in the WinAPI IMO.

I did provide the debug privilege library I use as well for you, that may be the issue you're running into without knowing your true problem.

[level20peon]

Rather than posting in thread which has been dormant for over 6 years, why not look in the Help file and see if these functions are now available in the standard set? If you had done so, you might well have found _WinAPI_GetParentProcess & _WinAPI_EnumChildProcess. Much simpler for everyone that way.

 

I have done so, but apparently at the wrong location. After therks hinted that this might as well land in the "Process.au3" at some point, this is where I looked - without finding anything. Also, searches for "get child process" and various permutations of this in the autoitscript.com forum via google didn't net any results at all (well, except for this thread).

Thanks for pointing me into the right direction and sorry for the inconvenience.

@level20peon, as curious as I am on what is not working for you with 64bit, I have to agree with Melba.  They've since added these two functions to the _WinAPI library, re-written a little, but still follows the same CreateToolSnapShot/Process32FirstW/Process32NextW format I have above.  So I would suggest following that as they'll more than likely keep up to date with it more than I will these.

The only thing I think is more reliable in my Processes.au3 file, than the _WinAPI library, is the ProcessGetPathEx function, that should be changed in the WinAPI IMO.

I did provide the debug privilege library I use as well for you, that may be the issue you're running into without knowing your true problem.

 

Sure, I will give those functions a try. I don't know what exactly is not working in the "original" function (I tested _ProcessGetChildren()) at this point, I just know that it doesn't return anything if I run it in x64 mode.

Edited February 8, 2015 by level20peon

[SmOke_N]

I've never had a need to compile my executables in 64bit mode.  32bit executables run fine for me, and I don't need to worry if the dllcalls are formatted correctly.

I did however compile and run the above .au3's in 64bit mode just to see, and they ran fine.

[SmOke_N]

It appears there was an issue with the above two functions in my au3's provided.  One noteable one is with ProcessGetChildren, it appears that my functions and _WinAPI_GetParentProcess have the same issue.  Returning a non-existing Process ID when the process has no parent.  Fixed in the non-struck through processes.au3 above.