Get URL from Broswer (all tabs) using PID - remotely?

[Graywalker]

Task : If Java.exe opens and it's parent process is a browser, get the URL of the web page it has open (hopefully the URL that started java).

I would love a way to do it remotely, but can live with having to run a monitor on the local machine.

What I have now is a function that uses WMI to query win32_process and get the processes and parent process id, searches that for Java and puts that info into a report.

I want to include the URL of the webpage that launched java. What I have so far is below, but it doesn't let me tie the Process ID to the window I get the URL from. It also will not get Firefox windows. The Shell method only gets Shell windows. I have nine windows open, but it only picks up two - internet explorer and file system explorer - missing both Firefox windows and all their tabs.

So, the question is - how to get a browser object when I start with only a Process ID and get the URL from that object? On a remote computer?

$oShell = ObjCreate("shell.application") ; Get the windows shell object

$oShellWindows = $oshell.windows ; Get open windows

If IsObj($oShellWindows) Then
    $string = ""
    For $Window in $oShellWindows ; count all windows
        $Wpid = ObjName($Window,3)
        $string = $string & $Window.LocationName & " ; " & $Window.FullName & " ; " & $Wpid & @CRLF
        If StringInStr($Window.FullName, "iexplore") Then
            MsgBox(0,"Internet Explorer", "You browsing the URL " & $Window.Document.Location.href)
        EndIf

    Next
    MsgBox(0,"Shell Windows", "You have the following " & $oShellWindows.Count & " windows open:" & @CRLF & $string);
EndIf

Fantasy code I would like to work:

$objWMIService = ObjGet("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" _
    & $strPCName & "\root\cimv2")
If IsObj($objWMIService) Then
  $colProcesses = $objWMIService.ExecQuery( _
    "select * from win32_process")
For $objProcess In $colProcesses
If $objProcess.ProcessId = $javaparentPID Then
   $Name = $objProcess.LocationName
   $URL = $objProcess.Document.Location.href
Endif

Code that gets the process IDs :

expandcollapse popup

Func _ProcessInfo($strPCName)
Dim $i = 0
Dim $User, $Domain, $objWMIService, $colProcesses, $procnum
Dim $Aprocesses[1][9]
Dim $pi, $ppi, $parent, $parentfound
$objWMIService = ObjGet("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" _
    & $strPCName & "\root\cimv2")
; Gather process information into an array
If IsObj($objWMIService) Then
  $colProcesses = $objWMIService.ExecQuery( _
    "select * from win32_process")
  For $objProcess In $colProcesses
   $i = $i + 1
   ReDim $Aprocesses[$i + 1][9]
   $Aprocesses[$i][1] = $objProcess.ProcessId
   $Aprocesses[$i][2] = $objProcess.Caption
   $Aprocesses[$i][3] = $objProcess.HandleCount
   $Aprocesses[$i][4] = $objProcess.ExecutablePath
   $Aprocesses[$i][5] = $objProcess.ParentProcessId
   $Aprocesses[$i][6] = $objProcess.CreationDate
   If $objProcess.GetOwner($User, $Domain) = 0 Then
    $Aprocesses[$i][7] = $Domain & _
      "\" & $User
   Else
    $Aprocesses[$i][7] = ""
   EndIf
  Next
  $Aprocesses[0][0] = $i
  $procnum = $i
  ;_ArrayDisplay($Aprocesses)
  ; Process the information about the Processes - LOL!
  $parentfound = 0
  For $pi = 1 To $procnum
   ; only looking for Java, so :
   If StringInStr($Aprocesses[$pi][2], "java") Then
    $parent = $Aprocesses[$pi][5]
    For $ppi = 1 To $procnum
     If $Aprocesses[$ppi][1] = $parent Then
      $parentfound = 1
      ExitLoop
     EndIf
    Next
    If $parentfound = 1 Then
     ; It has a parent process still running!
     $line = $strPCName & "," & $Aprocesses[$pi][1] & "," & $Aprocesses[$pi][2] & "," & $Aprocesses[$pi][3] & "," & _
       $Aprocesses[$pi][4] & "," & $Aprocesses[$pi][5] & "," & $Aprocesses[$pi][6] & "," & _
       $Aprocesses[$ppi][6] & "," & $Aprocesses[$ppi][2] & "," & $Aprocesses[$ppi][4] & "," & _
       $Aprocesses[$ppi][7]
     FileWriteLine($LogFile, $line)
    Else
     ; parent process left. No, little java, its not your fault... :)
     $line = $strPCName & "," & $Aprocesses[$pi][1] & "," & $Aprocesses[$pi][2] & "," & $Aprocesses[$pi][3] & "," & $Aprocesses[$pi][4] & "," & _
       $Aprocesses[$pi][5] & "," & $Aprocesses[$pi][6] & ",Parent already closed or not found" & ",Owner = ," & $Aprocesses[$pi][7]
     FileWriteLine($LogFile, $line)
    EndIf
   EndIf
   $parentfound = 0
   $ppi = 0
  Next
Else
  FileWriteLine($LogFile, $strPCName & ",Unable to query WMI on endpoint")
EndIf
EndFunc   ;==>_ProcessInfo

Edited January 19, 2012 by Graywalker

[Graywalker]

MsgBox(0,"Internet Explorer", "You browsing the URL " & $Window.LocationURL)

works just as well as

MsgBox(0,"Internet Explorer", "You browsing the URL " & $Window.Document.Location.href)

Something odd - I am on Windows 7 64bit - I have an open IE window.

$oIE = ObjGet("","InternetExplorer.Application")
$url = $oIE.LocationURL
$name = $oIE.LocationName

Returns an error on $url = $oIE.LocationURL of "==> Variable must be of type "Object".:"

Edited January 18, 2012 by Graywalker

[Graywalker]

Wow... I guess it is complicated... lol!

So, I've discovered a few ways to get the URL from the Window based on the window title :

AutoItSetOption("WinTitleMatchMode", 2)
If WinExists("Internet Explorer") Then
$wtext = WinGetText("Internet Explorer")
$wtexta = StringSplit($wtext, @LF)
For $l = 1 To $wtexta[0]
  If StringInStr($wtexta[$l], "http") Then
   $url = $wtexta[$l]
   ExitLoop
  EndIf
Next
EndIf
MsgBox(0, "URL", $url)
Endif

OR

AutoItSetOption("WinTitleMatchMode", 2)
#include <IE.au3>
$awins = WinList("Internet Explorer")
For $w = 1 to $awins[0][0]
  $oBrowser = _IEAttach($awins[$w][1],"HWND")
  If IsObj($oBrowser) Then
  $bURL = $oBrowser.LocationURL
  $bName = $oBrowser.LocationName
  MsgBox(0,"Browser Info",$bName & @CRLF & $bURL)
  EndIf
Next

But neither lets me a) Get it remotely Tie it directly to the Process ID - and both rely on the Window Title having "Internet Explorer" in it. (edit to clarify - that means that if there are multiple windows of Internet Explorer open, I can't be sure which URL is the one that opened Java.)

Not happy.... any ideas?

... and why THIS doesn't work, I don't know!!

$oBrowser = _IEAttach($objProcess.Handle, "HWND")
If IsObj($oBrowser) Then
  $bURL = $oBrowser.LocationURL
  $bName = $oBrowser.LocationName
  MsgBox(0, "Browser Info", $bName & @CRLF & $bURL)
Else
  MsgBox(0, "NOT an Object!", "Dummy!!")
EndIf

... actually, I suppose I do... I think the "Handle" returned by Win32_Process is actually the Process ID, not a "HWND" handle.

Edited January 18, 2012 by Graywalker

[Graywalker]

More info! Getting closer....

The following code gets the PID with the window - because once you have the handle, you can use the handle instead of the window title.

However, with tabbed browsing, the WinGetText($handle) only gets the tab that is in focus. Since most of my enterprise is on IE 7, this won't be much of an issue... BUT... it could get that way. Also, _IEAttach seems to have the same issue with tabs.

Any ideas how to get the URLs of tabs?

If StringInStr($Aprocesses[$i][4], "iexplore") Then
   $Pid = ""
   $wtext = ""
   $url = ""
   If WinExists("Internet Explorer") Then
    $awins = WinList("Internet Explorer")
    ;_ArrayDisplay($awins)
    For $w = 1 To $awins[0][0]
     $Pid = WinGetProcess($awins[$w][1])
     ;If $Pid = $Aprocesses[$i][1] Then
      $wtext = WinGetText($awins[$w][1])
      $wtexta = StringSplit($wtext, @LF)
      For $l = 1 To $wtexta[0]
       If StringInStr($wtexta[$l], "http") Then
        $url = $wtexta[$l]
        ExitLoop
       EndIf
      Next
     ;EndIf
     MsgBox(0,"Array Info",$Pid & @CRLF & $url)
    Next
   EndIf

[Graywalker]

Got the URLs of the Tabs!

The following code seems to be mostly working - on a local machine. It doesn't work with Firefox, but that is not absolutely necessary at this point, although I would LOVE it if someone provided a solution to that - and doing it from a central computer to other computers on the local network.

The code lists all windows with "Internet Explorer" in the title bar, then tries to get an object from each - if it is not an object on it's own, it tries to see if it is embedded in the previous object. Either way, it tries to get the Title and the URL of the window - hopefully Internet Explorer. Unfortunatly, if someone changed the IE window title to "Internut Exploder", then this won't work too well.

AutoItSetOption("WinTitleMatchMode", 2)
AutoItSetOption("WinDetectHiddenText", 1)

$awins = WinList("Internet Explorer")
$mainhwnd = ""
For $w = 1 To $awins[0][0]
  FileWriteLine($logfile, "Windows array " & $w & "," & $awins[$w][0] & "," & $awins[$w][1])
  $oBrowser = _IEAttach($awins[$w][1], "HWND")
  If IsObj($oBrowser) Then
   $oldmainhwnd = $mainhwnd
   $mainhwnd = $awins[$w][1]
   $bURL = _IEPropertyGet($oBrowser, "locationurl");$oBrowser.Document.Location.href
   $bName = _IEPropertyGet($oBrowser, "title");$oBrowser.Location
   $Pid = WinGetProcess($awins[$w][1])
   FileWriteLine($logfile, $bName & "," & $bURL & "," & $Pid)
  Else
   If $oldmainhwnd = $mainhwnd Then
    ;Do Nothing, same old stuff.
   Else
    For $w2 = 1 To $awins[0][0]
     $oBrowser = _IEAttach($mainhwnd, "Embedded", $w2)
     If IsObj($oBrowser) Then
      $bURL = _IEPropertyGet($oBrowser, "locationurl");$oBrowser.Document.Location.href
      $bName = _IEPropertyGet($oBrowser, "title");$oBrowser.Location
      $Pid = WinGetProcess($awins[$w][1])
      FileWriteLine($logfile, $bName & "," & $bURL & "," & $Pid & ", Using HWND " & $mainhwnd & ", $w2 = " & $w2 & ", old hwnd = " & $oldmainhwnd)
     Else
      ; Do nothing - maybe exitloop??
     EndIf
    Next
    $oldmainhwnd = $mainhwnd
   EndIf
  EndIf
Next

If anyone shows interest, I will post the whole script to look for java and get the URLs that called it when I get that script completed. This piece was a monster all by itself.

Edited January 19, 2012 by Graywalker

[Graywalker]

Nothing? Really?

Okay, how about a way to get the IE History remotely using AutoIT? Maybe the last 10 URLs visited? I hope that would include the currently open windows....

The script I wrote is not going to work, because of the way the User environments work... I can get the running processes of a user, but I can't, with an admin account, see the currently open windows on the user's account using _IEwhatever UDF or the WinList function. (running script using scheduled task as admin)

So... how to get the URLs???

Edited January 20, 2012 by Graywalker