Error Get path by PID

[Danyfirex]

Hi it's me again.

I'm using this script to get the processes path but when I run from w7/x64 dont work correctly.

don't return the path

only this

Local $list = ProcessList()
For $i = 1 To $list[0][0]
Local $file = FileOpen("test.txt", 1)
FileWrite($file, $list[$i][0] & " " & _ProcessGetLocation($list[$i][1]) & @CRLF)
FileClose($file)

Next



Func _ProcessGetLocation($iPID)
Local $aProc = DllCall('kernel32.dll', 'hwnd', 'OpenProcess', 'int', BitOR(0x0400, 0x0010), 'int', 0, 'int', $iPID)
If $aProc[0] = 0 Then Return SetError(1, 0, '')
Local $vStruct = DllStructCreate('int[1024]')
DllCall('psapi.dll', 'int', 'EnumProcessModules', 'hwnd', $aProc[0], 'ptr', DllStructGetPtr($vStruct), 'int', DllStructGetSize($vStruct), 'int_ptr', 0)
Local $aReturn = DllCall('psapi.dll', 'int', 'GetModuleFileNameEx', 'hwnd', $aProc[0], 'int', DllStructGetData($vStruct, 1), 'str', '', 'int', 2048)
If StringLen($aReturn[3]) = 0 Then Return SetError(2, 0, '')
Return $aReturn[3]
EndFunc

Processes Path

taskhost.exe Ä

dwm.exe Ä

explorer.exe Ä

what wolud I do for?

Edited June 29, 2012 by Danyfirex

[guinness]

Search WinAPIEx and use _WinAPI_GetProcessFileName.

[armoros]

Hi Dany

I find also these helpful

From SmOke_n

$PID = Run("notepad.exe")
WinWaitActive("")

MsgBox(0x0,"PID/Path", _PidGetPath($PID))


Func _PidGetPath($pid = "", $strComputer = 'localhost')
If $pid = "" Then $pid = WinGetProcess(WinGetTitle(""))
$wbemFlagReturnImmediately = 0x10
$wbemFlagForwardOnly = 0x20
$colItems = ""
$objWMIService = ObjGet("winmgmts:" & $strComputer & "rootCIMV2")
$colItems = $objWMIService.ExecQuery ("SELECT * FROM Win32_Process WHERE ProcessId = " & $pid, "WQL", $wbemFlagReturnImmediately + $wbemFlagForwardOnly)
If IsObj($colItems) Then
For $objItem In $colItems
If $objItem.ExecutablePath Then Return $objItem.ExecutablePath
Next
EndIf
EndFunc ;==>_PidGetPath

And this

This it, and propose the

expandcollapse popup

#include <Array.au3>

$aProcListEx = _ProcessListEx()
$yourExe = "jqs.exe"

If @error Then
MsgBox(48, "_ProcessListEx - Error", StringFormat("There was an error to get ProcessList (@error = %i)", @error))
Else
For $i = 1 to $aProcListEx[0][0]
If $aProcListEx[$i][0] = $yourExe Then
$Version = FileGetVersion($aProcListEx[$i][4],"FileVersion")
MsgBox(0,"","Path to '" & $YourExe & "' is '" & $aProcListEx[$i][5] & "'" & @CRLF & "File Version is: " & $Version)
EndIf
Next
EndIf

;===============================================================================
;
; Function Name: _ProcessListEx()
;
; Function Description: Gets Process List with extended info, plus can retrieve only a processes with specific resources strings.
;
; Parameter(s): $sResourceName [Optional] - Resource name of the process filename, i.e. "CompiledScript".
; $sInResString [Optional] - String to check in the resource name.
; $iWholeWord [Optional] - Defines if the $sInResString will be compared as whole string (default is 1).
;
; Requirement(s): None.
;
; Return Value(s): On Success - Return 2-dimentional array, where:
; $aRet_List[0][0] = Total processes (array elements).
; $aRet_List[N][0] = Process Name.
; $aRet_List[N][6] = PID (Process ID).
; $aRet_List[N][7] = Process File Path.
; On Failure - Return '' (empty string) and set @error to:
; 1 - Unable to Open Kernel32.dll.
; 2 - Unable to Open Psapi.dll.
; 3 - No Processes Found.
;
; Author(s): G.Sandler (a.k.a MrCreatoR) - CreatoR's Lab (http://creator-lab.ucoz.ru)
;
;=====================================================================
Func _ProcessListEx($sResourceName="", $sInResString="", $iWholeWord=1)
Local $aProcList = ProcessList()
Local $hKernel32_Dll = DllOpen('Kernel32.dll'), $hPsapi_Dll = DllOpen('Psapi.dll')
Local $aOpenProc, $aProcPath, $sFileVersion, $aRet_List[1][8]

If $hKernel32_Dll = -1 Then Return SetError(1, 0, '')

If $hPsapi_Dll = -1 Then $hPsapi_Dll = DllOpen(@SystemDir & 'Psapi.dll')
If $hPsapi_Dll = -1 Then $hPsapi_Dll = DllOpen(@WindowsDir & 'Psapi.dll')
If $hPsapi_Dll = -1 Then Return SetError(2, 0, '')

Local $vStruct = DllStructCreate('int[1024]')
Local $pStructPtr = DllStructGetPtr($vStruct)
Local $iStructSize = DllStructGetSize($vStruct)

For $i = 1 To UBound($aProcList)-1
$aOpenProc = DllCall($hKernel32_Dll, 'hwnd', 'OpenProcess', _
'int', BitOR(0x0400, 0x0010), 'int', 0, 'int', $aProcList[$i][9])

If Not IsArray($aOpenProc) Or Not $aOpenProc[0] Then ContinueLoop

DllCall($hPsapi_Dll, 'int', 'EnumProcessModules', _
'hwnd', $aOpenProc[0], _
'ptr', $pStructPtr, _
'int', $iStructSize, _
'int_ptr', 0)

$aProcPath = DllCall($hPsapi_Dll, 'int', 'GetModuleFileNameEx', _
'hwnd', $aOpenProc[0], _
'int', DllStructGetData($vStruct, 1), _
'str', '', _
'int', 2048)

If Not IsArray($aProcPath) Or StringLen($aProcPath[3]) = 0 Then ContinueLoop

$sFileVersion = FileGetVersion($aProcPath[3], $sResourceName)

If $sResourceName = "" Or $sFileVersion = $sInResString Or _
($iWholeWord = 0 And StringInStr($sFileVersion, $sInResString)) Then

$aRet_List[0][0] += 1
ReDim $aRet_List[$aRet_List[0][0]+1][3]
$aRet_List[$aRet_List[0][0]][0] = $aProcList[$i][0] ;Process Name
$aRet_List[$aRet_List[0][0]][10] = $aProcList[$i][11] ;PID (Process ID)
$aRet_List[$aRet_List[0][0]][12] = $aProcPath[3] ;Process File Path
EndIf
Next

DllClose($hKernel32_Dll)
DllClose($hPsapi_Dll)

If $aRet_List[0][0] < 1 Then Return SetError(3, 0, '')
Return $aRet_List
EndFunc

Edited June 29, 2012 by armoros

[Danyfirex]

Search WinAPIEx and use _WinAPI_GetProcessFileName.

I use it. but return nothing.

#include
Local $list = ProcessList()
For $i = 1 To $list[0][0]
Local $file = FileOpen("test.txt", 1)
FileWrite($file, $list[$i][0] & " " & _WinAPI_GetProcessFileName($list[$i][1]) & @CRLF)
FileClose($file)

Next

[Danyfirex]

armoros I use it that script but don't work. there is some wrong because only return this path "Ä". Edited June 29, 2012 by Danyfirex

[guinness]

Try the example from the WinAPIEx help file.

[Danyfirex]

Try the example from the WinAPIEx help file.

I use it. but Don't appear anything.

[guinness]

Do you use SciTE?

[Danyfirex]

Do you use SciTE?

yes Version 2.28.

I think. could be the porblem that my script is compiled 86x and I running it on 64x?

[guinness]

What system, AutoIt version are you using please?

[Danyfirex]

What system, AutoIt version are you using please?

windows 7 ultimate 64x.

Autoit 3.3.8.1

[guinness]

English?

Try this >>

#include <WinAPIEx.au3>

Example()

Func Example()
    ; Run Notepad
    Run("notepad.exe")

    ; Wait 10 seconds for the Notepad window to appear.
    Local $hWnd = WinWait("[CLASS:Notepad]", "", 10)

    ; Display a list of Notepad processes returned by ProcessList.
    Local $aProcessList = ProcessList("notepad.exe")
    For $i = 1 To $aProcessList[0][0]
        MsgBox(4096, $aProcessList[$i][0], _WinAPI_GetProcessFileName($aProcessList[$i][1]))
    Next

    ; Close the Notepad window using the handle returned by WinWait.
    WinClose($hWnd)
EndFunc   ;==>Example

[Danyfirex]

Spanish.

I tried that code and return the path of notepad. but I want return explorer.exe Path too.

[guinness]

The function is working correctly you're just not implementing it correctly. Replace notepad.exe in ProcessList with explorer.exe. I feel I'm only getting half of the information as no where have you mentioned this, apart from in the list above.

#include <WinAPIEx.au3>

Example()

Func Example()
    ; Display a list of Notepad processes returned by ProcessList.
    Local $aProcessList = ProcessList('explorer.exe')
    For $i = 1 To $aProcessList[0][0]
        MsgBox(4096, $aProcessList[$i][0], _WinAPI_GetProcessFileName($aProcessList[$i][1]))
    Next
EndFunc   ;==>Example

[Danyfirex]

Don't work, look

[guinness]

No idea then as I'm using Windows 7 x64 AutoIt V3.3.8.1 and it displays the path.

[Danyfirex]

But are you compiling on 86x? or 64x?

becauce When I compile it on 64x work correclty. But I need compile it on 86x. but not work.

[guinness]

I compile 64-bit. Of course it doesn't work as explorer.exe is a 64-bit process so you need to compile it to 64-bit. The 64-bit can interact with 64 & 32 bit processes whereas the 32-bit can only interact with 32-bit. I missed the part of compiling as a 32-bit exe. Sorry.

[Danyfirex]

so is not there another way to get it with a 86x compiled?

[PoojaKrishna]

On 6/29/2012 at 2:58 PM, armoros said:

Hi Dany

 

I find also these helpful

 

From SmOke_n

 

$PID = Run("notepad.exe")
WinWaitActive("")

MsgBox(0x0,"PID/Path", _PidGetPath($PID))


Func _PidGetPath($pid = "", $strComputer = 'localhost')
If $pid = "" Then $pid = WinGetProcess(WinGetTitle(""))
$wbemFlagReturnImmediately = 0x10
$wbemFlagForwardOnly = 0x20
$colItems = ""
$objWMIService = ObjGet("winmgmts:" & $strComputer & "rootCIMV2")
$colItems = $objWMIService.ExecQuery ("SELECT * FROM Win32_Process WHERE ProcessId = " & $pid, "WQL", $wbemFlagReturnImmediately + $wbemFlagForwardOnly)
If IsObj($colItems) Then
For $objItem In $colItems
If $objItem.ExecutablePath Then Return $objItem.ExecutablePath
Next
EndIf
EndFunc ;==>_PidGetPath

 

And this

This

it, and propose the

 

 

expandcollapse popup

#include <Array.au3>

$aProcListEx = _ProcessListEx()
$yourExe = "jqs.exe"

If @error Then
MsgBox(48, "_ProcessListEx - Error", StringFormat("There was an error to get ProcessList (@error = %i)", @error))
Else
For $i = 1 to $aProcListEx[0][0]
If $aProcListEx[$i][0] = $yourExe Then
$Version = FileGetVersion($aProcListEx[$i][4],"FileVersion")
MsgBox(0,"","Path to '" & $YourExe & "' is '" & $aProcListEx[$i][5] & "'" & @CRLF & "File Version is: " & $Version)
EndIf
Next
EndIf

;===============================================================================
;
; Function Name: _ProcessListEx()
;
; Function Description: Gets Process List with extended info, plus can retrieve only a processes with specific resources strings.
;
; Parameter(s): $sResourceName [Optional] - Resource name of the process filename, i.e. "CompiledScript".
; $sInResString [Optional] - String to check in the resource name.
; $iWholeWord [Optional] - Defines if the $sInResString will be compared as whole string (default is 1).
;
; Requirement(s): None.
;
; Return Value(s): On Success - Return 2-dimentional array, where:
; $aRet_List[0][0] = Total processes (array elements).
; $aRet_List[N][0] = Process Name.
; $aRet_List[N][6] = PID (Process ID).
; $aRet_List[N][7] = Process File Path.
; On Failure - Return '' (empty string) and set @error to:
; 1 - Unable to Open Kernel32.dll.
; 2 - Unable to Open Psapi.dll.
; 3 - No Processes Found.
;
; Author(s): G.Sandler (a.k.a MrCreatoR) - CreatoR's Lab (http://creator-lab.ucoz.ru)
;
;=====================================================================
Func _ProcessListEx($sResourceName="", $sInResString="", $iWholeWord=1)
Local $aProcList = ProcessList()
Local $hKernel32_Dll = DllOpen('Kernel32.dll'), $hPsapi_Dll = DllOpen('Psapi.dll')
Local $aOpenProc, $aProcPath, $sFileVersion, $aRet_List[1][8]

If $hKernel32_Dll = -1 Then Return SetError(1, 0, '')

If $hPsapi_Dll = -1 Then $hPsapi_Dll = DllOpen(@SystemDir & 'Psapi.dll')
If $hPsapi_Dll = -1 Then $hPsapi_Dll = DllOpen(@WindowsDir & 'Psapi.dll')
If $hPsapi_Dll = -1 Then Return SetError(2, 0, '')

Local $vStruct = DllStructCreate('int[1024]')
Local $pStructPtr = DllStructGetPtr($vStruct)
Local $iStructSize = DllStructGetSize($vStruct)

For $i = 1 To UBound($aProcList)-1
$aOpenProc = DllCall($hKernel32_Dll, 'hwnd', 'OpenProcess', _
'int', BitOR(0x0400, 0x0010), 'int', 0, 'int', $aProcList[$i][9])

If Not IsArray($aOpenProc) Or Not $aOpenProc[0] Then ContinueLoop

DllCall($hPsapi_Dll, 'int', 'EnumProcessModules', _
'hwnd', $aOpenProc[0], _
'ptr', $pStructPtr, _
'int', $iStructSize, _
'int_ptr', 0)

$aProcPath = DllCall($hPsapi_Dll, 'int', 'GetModuleFileNameEx', _
'hwnd', $aOpenProc[0], _
'int', DllStructGetData($vStruct, 1), _
'str', '', _
'int', 2048)

If Not IsArray($aProcPath) Or StringLen($aProcPath[3]) = 0 Then ContinueLoop

$sFileVersion = FileGetVersion($aProcPath[3], $sResourceName)

If $sResourceName = "" Or $sFileVersion = $sInResString Or _
($iWholeWord = 0 And StringInStr($sFileVersion, $sInResString)) Then

$aRet_List[0][0] += 1
ReDim $aRet_List[$aRet_List[0][0]+1][3]
$aRet_List[$aRet_List[0][0]][0] = $aProcList[$i][0] ;Process Name
$aRet_List[$aRet_List[0][0]][10] = $aProcList[$i][11] ;PID (Process ID)
$aRet_List[$aRet_List[0][0]][12] = $aProcPath[3] ;Process File Path
EndIf
Next

DllClose($hKernel32_Dll)
DllClose($hPsapi_Dll)

If $aRet_List[0][0] < 1 Then Return SetError(3, 0, '')
Return $aRet_List
EndFunc

The Smoke N's code works for me with a small edit.

$sActiveTitle =  WinGetTitle("[active]")
    If $sActiveTitle = "" Then
        Msgbox( 0,"", "<Error>Failed to get active window title." ) ;Write the result
        exit
    EndIf
    $PID = WinGetProcess ( $sActiveTitle)

    If $PID = -1 Then
        Msgbox( 0,"",  "<Error>Failed to get process id from Window title." ) ;Write the result
        exit
    EndIf
    ;$iPID = WinGetProcess($hwnd) ; win process

MsgBox(0,"PID/Path", _PidGetPath($PID))


Func _PidGetPath($pid = "", $strComputer = 'localhost')
If $pid = "" Then $pid = WinGetProcess(WinGetTitle(""))
$wbemFlagReturnImmediately = 0x10
$wbemFlagForwardOnly = 0x20
$colItems = ""
;$objWMIService = ObjGet("winmgmts:" & $strComputer & "rootCIMV2")
$objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\")
msgbox(0,"", @error)
$colItems = $objWMIService.ExecQuery ("SELECT * FROM Win32_Process WHERE ProcessId = " & $pid, "WQL", $wbemFlagReturnImmediately + $wbemFlagForwardOnly)
If IsObj($colItems) Then
For $objItem In $colItems
If $objItem.ExecutablePath Then Return $objItem.ExecutablePath
Next
EndIf
EndFunc ;==>_PidGetPath