Obtaining process name from process handle [modified]

[hxhl95]

Not UNICODE. I'm going to give GetModuleBaseName a try, but according to msdn:

MSDN:

To retrieve the base name of the main executable module for a remote process, use the GetProcessImageFileName or QueryFullProcessImageName function to retrieve the module name and then use the strrchr function as described in the previous paragraph. This is more efficient and more reliable than calling GetModuleBaseName with a NULL module handle.

EDIT/update: GetModuleBaseName also returns garbage...

GetModuleBaseName(ProcessHandle,NULL,processName,1024);
MessageBox(NULL,processName,"test",MB\_ICONINFORMATION);

modified on Friday, March 20, 2009 12:02 PM

[David Crow]

hxhl95 wrote:

Does the fact that I'm using VC++ 6.0 make a difference?

Only if you need to define _WIN32_WINNT. Look in winbase.h for the appropriate value (if any). See here for more.

"Old age is like a bank account. You withdraw later in life what you have deposited along the way." - Unknown

"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons

[hxhl95]

winbase.h doesn't contain a definition of GetProcessId. I tried defining it manually with DWORD WINAPI GetProcessId(__in HANDLE ProcessHandle), but then I get an unresolved external symbol error, even though I'm obviously including kernel32.lib...

[David Crow]

hxhl95 wrote:

winbase.h doesn't contain a definition of GetProcessId.

You need to install the Platform SDK.

"Old age is like a bank account. You withdraw later in life what you have deposited along the way." - Unknown

"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons

[hxhl95]

I have. :laugh:

[David Crow]

So are you looking in C:\Program Files\Microsoft SDK\include\winbase.h instead of C:\Program Files\Microsoft Visual Studio\VC98\Include\winbase.h? If you add #include to the top of a file, right-click it and select Open, which of the two files opens?

"Old age is like a bank account. You withdraw later in life what you have deposited along the way." - Unknown

"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons

[hxhl95]

I did #include <C:\Program Files\Microsoft Platform SDK\Include\winbase.h> just in case, and it's still giving me an undeclared error. When I open the file the SDK file opens, and I can see the definition of GetProcessId in the file. However the compiler just doesn't find it. :sigh:

[David Crow]

I'm out of suggestions at this point. This compiles fine for me:

#include <windows.h>

void main( void )
{
GetProcessId(0);
}

"Old age is like a bank account. You withdraw later in life what you have deposited along the way." - Unknown

"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons

[hxhl95]

Okay. I'll just try a different approach if I can't get this working by tomorrow. Thanks a lot for your help :)

[_Superman_]

You say that the error code is success and still you're getting garbage. This is highly unlikely. I believe you're not doing any error checking. So its probably gone wrong somewhere else. GetModuleBaseName for instance returns the length of the string copied. What is this value?

«_Superman_» I love work. It gives me something to do between weekends.

[hxhl95]

Oh, I'm sorry. I thought GetModuleBaseName returns an error code instead of the length of the string copied. I assumed the 0 it returned meant success :doh: That explains the garbage data. EDIT: I checked GetLastError, it's returning an invalid handle error. :wtf: Might this be because I'm getting the handle from NtTerminateProcess?

modified on Saturday, March 21, 2009 2:37 PM