c - Get Parent Process Name (Windows) -
i trying name of parent process (full path) in windows console application (c/c++). looks should work, failing , can't see doing wrong. getting parent pid, failing on getting name. corrections appreciated.
#include <windows.h> #include <stdio.h> #include <tlhelp32.h> #include <psapi.h> dword getparentpid(dword pid) { handle h = null; processentry32 pe = { 0 }; dword ppid = 0; pe.dwsize = sizeof(processentry32); h = createtoolhelp32snapshot(th32cs_snapprocess, 0); if( process32first(h, &pe)) { { if (pe.th32processid == pid) { ppid = pe.th32parentprocessid; break; } } while( process32next(h, &pe)); } closehandle(h); return (ppid); } int getprocessname(dword pid, puchar fname, dword sz) { handle h = null; int e = 0; h = openprocess ( process_query_information, false, pid ); if (h) { if (getmodulefilenameex(h, null, fname, sz) == 0) e = getlasterror(); closehandle(h); } else { e = getlasterror(); } return (e); } int main(int argc, char *argv[]) { dword pid, ppid; int e; char fname[max_path] = {0}; pid = getcurrentprocessid(); ppid = getparentpid(pid); e = getprocessname(ppid, fname, max_path); printf("ppid=%d err=%d exe={%s}\n", ppid, e, fname); }
additional information: openprocess returning 5 (error_access_denied). if add process_vm_read suggested, returns 299 (error_partial_copy). can open current process, not parent process.
call openprocess
additional process_vm_read
flag , should work:
h = openprocess ( process_query_information | process_vm_read, false, pid );
also @ possible duplicate mentioned mekap
Comments
Post a Comment