_WinAPI_ProcessListOWNER_WTS()

[cypher175]

How would I modify your code Manko to only get the ProcessOwner of a single PID or process name..??

[Manko]

Hi, Cypher175!

I've done some changes... Look at first post!

/Manko

[Ascend4nt]

Manko, hows it goin! Hey - I just tested this, and a rewrite I did, on Vista x64. It turns out that anything in another Session # will not return Owner info unless Admin rights are given. Oh well, at least on earlier O/S's it seemed to work fine =\

[Manko]

Manko, hows it goin! Hey - I just tested this, and a rewrite I did, on Vista x64. It turns out that anything in another Session # will not return Owner info unless Admin rights are given. Oh well, at least on earlier O/S's it seemed to work fine =\

Ascend4nt: Friend! Glad to see you back! Was the rewrite to get admin rights? Or did you change those first dwords to something else? It's good to see you!

/Manko

[Ascend4nt]

Oh, the rewrite was to fit in with this big Process functions module I did (1500+ lines not including the 'undocumented' module), and I had an older version of your function so it was only very slight modifications - a different way to calculate offsets (you originally had a hardcoded #), plus filtering capability. The admin rights of course is something ya need to do at the top of the script or during compiling..

I've also experimented with creating a 'ProcessGetOwner' function for single processes, and it actually works on XP but for like 5% of processes on Vista+ it gives odd results. (Posted it -> here to see if anyone can help with it (and avoid hijacking Manko's thread))

*edit: Even more peculiar, the WTS list reports 2 fewer instances of 'dllhost.exe' on the Vista box I'm testing it on. Can't quite figure out why it would be missing those, but the counts are definitely off..

Edited April 14, 2010 by Ascend4nt

[Gianni]

hello all

how this function could be used to provide information about the processes from remote machines?

thank you.

[Manko]

Check out "WTSEnumerateProcesses" API-call on MSDN. (First hit if you google it.)

You'll have to edit the function... Dunno if it's any good remotely... seems like it uses netbios...

/Manko

Edited August 27, 2012 by Manko

[Gianni]

thanks Manko,

....too difficult for me to use the windows api...

I think I will use the dos command "tasklist" with the / s parameter (as suggested here: ) although this command, unlike your function requires administrative rights on the remote machine, but for my purpose can also be effective.

thank you again.

[francoiste]

i have spawned a follow-up question in:

https://www.autoitscript.com/forum/topic/192333-crash-in-dllstructgetdata/

 

[francoiste]

proposed fix (to check the actual StringLength):

expandcollapse popup

#include <array.au3> ; Needed to display array in example.
#include <security.au3> ; Get OWNER from SID.

$tag_WTS_PROCESS_INFO = _
        "DWORD SessionId;" & _
        "DWORD ProcessId;" & _
        "PTR pProcessName;" & _
        "PTR pUserSid"

; ############ Example code #######################
MsgBox(0, "Process by name or number(PID)", "'Owner' of Explorer.exe is " & _ProcessListOWNER_WTS("Explorer.exe"))
$temp = _ProcessListOWNER_WTS()
$temp[0][0] = "Process"
$temp[0][1] = "ProcessId"
$temp[0][2] = "SessionId"
$temp[0][3] = "ProcessOWNER"
_ArrayDisplay($temp, "Process list with OWNER...")
; ###############################################


; ############ Here be func! ####################
Func _ProcessListOWNER_WTS($PID = 0)
    Local $i, $ret, $ret1, $mem
    $ret = DllCall("WTSApi32.dll", "int", "WTSEnumerateProcessesW", "int", 0, "int", 0, "int", 1, "ptr*", 0, "int*", 0)
    Local $array[$ret[5]][4]
    $mem = DllStructCreate($tag_WTS_PROCESS_INFO, $ret[4])
    For $i = 0 To $ret[5] - 1
        $mem = DllStructCreate($tag_WTS_PROCESS_INFO, $ret[4] + ($i * DllStructGetSize($mem)))
        ;if DllStructGetData($mem, "pProcessName") Then
        Local $pData = DllStructGetData($mem, "pProcessName")
        Local $iStringLen = _PtrStringLenW($pData)
        Local $pName = DllStructCreate("wchar[" & $iStringLen + 1 & "]", $pData)
        $array[$i][0] = DllStructGetData($pName, 1)
        ;EndIf
        $array[$i][1] = DllStructGetData($mem, "ProcessId")
        $array[$i][2] = DllStructGetData($mem, "SessionId")
        ;if DllStructGetData($mem, "pUserSid") Then
        $ret1 = _Security__LookupAccountSid(DllStructGetData($mem, "pUserSid"))
        If IsArray($ret1) Then $array[$i][3] = $ret1[0]
        ;EndIf
    Next

    DllCall("WTSApi32.dll", "int", "WTSFreeMemory", "int", $ret[4])

    If $PID Then
        If IsInt($PID) Then
            For $i = 0 To UBound($array, 1) - 1
                If $array[$i][1] = $PID Then
                    Return $array[$i][3]
                EndIf
            Next
        Else
            For $i = 0 To UBound($array, 1) - 1
                If $array[$i][0] = $PID Then
                    Return $array[$i][3]
                EndIf
            Next
        EndIf
    EndIf

    Return $array
EndFunc   ;==>_ProcessListOWNER_WTS
;################################ END FUNC ##########################################

Func _PtrStringLenW($pString)
    Local $aCall = DllCall("kernel32.dll", "dword", "lstrlenW", "ptr", $pString)
    If @error Then Return SetError(1, 0, 0)
    Return $aCall[0]
EndFunc   ;==>_PtrStringLenW

 

Edited February 20, 2018 by francoiste