two process with same name, but, diferent folder, how close one specific...

[Luigi]

A stupid doubt:

I have two applications with same name, but, in diferent folders, like:

C:01app.exe

C:02app.exe

How kill the app.exe from 01 folder? Or kill app from 02 folder?

ProcessClose("app.exe") kill app.exe, but, I dont have control...

How do this?

Thanks, Detefon

[BrewManNH]

How are you starting them?

[Luigi]

Traditional form (double click).
Not (yet) like service or similar.
 

[mLipok]

I think it should be useful
 

expandcollapse popup

; #FUNCTION# ===============================================================================
; Name...........: _ProcessGetPath(
; Description ...: Retrieves a process file path
; Syntax.........: _ProcessGetPath($vProcess)
; Parameters ....: $vProcess - PID or name of a process
; Requirements...: kernel32.dll, psapi.dll
; Return values .: Success - A full process path
;                    @error = 0
;                   Failure - Empty string
;                    @error = 1 - Invalid process name/PID
;                    @error = 2 - kernel32.dll failed to open (wrong version?)
;                    @error = 3 - Could not OpenProcess
;                     @error = 4 - psapi.dll failed to open (doesn't exist?)
;                    @error = 5 - returned path is empty or invalid
; Author ........: JScript, Larry, SmOke_N
; Modified.......: mrRevoked - reformated, error checking
; Remarks .......:
; Related .......:
; Link ..........;
; Example .......;
; ============================================================================================
Func _ProcessGetPath($vProcess)
    Local $i_PID, $hKernel32, $hPsapi, $aProcessHandle, $tDLLStruct, $iError, $sProcessPath
    $i_PID = ProcessExists($vProcess)
    If Not $i_PID Then Return SetError(1, 0, "");process doesn't exist?
    $hKernel32 = DllOpen("Kernel32.dll")
    $iError = @error
    If $iError Then
        DllClose($hKernel32)
        Return SetError(2, $iError, ""); dllopen kernell32.dll failed
    EndIf
    $aProcessHandle = DllCall($hKernel32, "int", "OpenProcess", "int", 0x0400 + 0x0010, "int", 0, "int", $i_PID)
    $iError = @error
    If $iError Or $aProcessHandle[0] = 0 Then
        DllClose($hKernel32)
        Return SetError(2, $iError, "");openprocess failed
    EndIf
    $hPsapi = DllOpen("Psapi.dll")
    $iError = @error
    If $iError Then
        DllClose($hKernel32)
        DllClose($hPsapi)
        Return SetError(3, $iError, ""); dllopen psapi.dll failed
    EndIf
    $tDLLStruct = DllStructCreate("char[1000]")
    DllCall($hPsapi, "long", "GetModuleFileNameEx", "int", $aProcessHandle[0], "int", 0, "ptr", DllStructGetPtr($tDLLStruct), "long", DllStructGetSize($tDLLStruct))
    $iError = @error
    DllCall($hKernel32, "int", "CloseHandle", "int", $aProcessHandle[0])
    DllClose($hKernel32)
    DllClose($hPsapi)
    If $iError Then
        $tDLLStruct = 0
        Return SetError(4, $iError, "");GetModulefilenamex failed
    EndIf
    $sProcessPath = DllStructGetData($tDLLStruct, 1)
    $tDLLStruct = 0
    ;format the output
    If StringLen($sProcessPath) < 2 Then Return SetError(5, 0, "");is empty or non readable
    If StringLeft($sProcessPath, 4) = "\??\" Then $sProcessPath = StringReplace($sProcessPath, "\??\", "")
    If StringLeft($sProcessPath, 20) = "\SystemRoot\System32" Then $sProcessPath = StringReplace($sProcessPath, "\SystemRoot\System32", @SystemDir)
    Return SetError(0, 0, $sProcessPath)
EndFunc   ;==>_ProcessGetPath

EDIT:

or this one:

#include <WinAPIProc.au3>
_WinAPI_GetProcessFileName ( [$iPID = 0] )

Edited November 19, 2014 by mLipok

[Luigi]

I found this udf >_ProcessListProperties() is full complete, but I need something more simple.

I realy like _WinAPI_GetProcessFileName  it work fine and fast for my case.

Thank you @mLipok

A little example:
 

#include <WinAPIProc.au3>
#include <Array.au3>

Local $aProcessList = ProcessList("Dropbox.exe")
If @error Then
    ConsoleWrite("@error->" & @error & @LF)
Else
    For $i = 1 To $aProcessList[0][0]
        $path = _WinAPI_GetProcessFileName($aProcessList[$i][1])
        If @error Then
            ConsoleWrite("@error->" & @error & @LF)
        Else
            ConsoleWrite("$path->" & $path & @LF)
        EndIf
    Next
EndIf

I am curious, sometimes have executables have no path... like svchost.exe, csrss.exe...

Edited November 20, 2014 by Detefon

[SmOke_N]

After seeing issues with others (in different languages) using similar methods due to 64bit vs 32bit or different windows versions.

I think things should be changed just a bit.

expandcollapse popup

#include <WinAPIProc.au3>
Global $gsz_path = _ProcessGetPathEx("chrome.exe")
ConsoleWrite($gsz_path & @CRLF & "Path StringLen = " & @extended & @CRLF)

; @param1 = process name or pid
; @param2 = default 0 = drive\etc format
;           true = native system path format
Func _ProcessGetPathEx($v_process, $b_native = 0)

    Local $i_pid = ProcessExists($v_process)
    If Not $i_pid Then
        ; process does not exist
        Return SetError(1, 0, "")
    EndIf

    Local $sz_filepath = ""
    ; are we working with anything less than vista?
    If __WINVER() < 0x0600 Then
        ; _WinAPI_GetProcessFileName seems misleading
        $sz_filepath = _WinAPI_GetProcessFileName($i_pid)
        Return SetError(@error, @extended, $sz_filepath)
    EndIf

    ; vista and above, should help with possible 64bit issues as well
    Local $h_k32 = DllOpen("Kernel32.dll")
    If @error Or Not $h_k32 Then
        ; could not open kernel32.dll
        Return SetError(2, 0, 0)
    EndIf

    Local Const $pgp_PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
    Local Const $pgp_PROCESS_QUERY_INFORMATION = 0x0400
    Local Const $pgp_PROCESS_NAME_NATIVE = 0x00000001

    ; open process with query info only
    Local $a_openprocess = DllCall($h_k32, "handle", "OpenProcess", _
        "long", BitOR($pgp_PROCESS_QUERY_INFORMATION, _
            $pgp_PROCESS_QUERY_LIMITED_INFORMATION), _
        "int", 0, "long", $i_pid)
    Local $i_err = @error
    If $i_err Or Not IsArray($a_openprocess) Then
        DllClose($h_k32)
        ; error code from dllcall sent as extended
        Return SetError(3, $i_err, 0)
    EndIf
    Local $h_openproc = $a_openprocess[0]

    Local $n_native = $b_native ? $pgp_PROCESS_NAME_NATIVE : 0
    Local $a_query = DllCall($h_k32, "bool", "QueryFullProcessImageNameW", _
        "handle", $h_openproc, "dword", $n_native, "wstr", "", "int*", 4096)
    $i_err = @error
    If $i_err Or Not IsArray($a_query) Then
        DllClose($h_k32)
        ; error code from dllcall sent as extended
        Return SetError(4, $i_err, 0)
    EndIf

    DllCall($h_k32, "int", "CloseHandle", "handle", $h_openproc)
    DllClose($h_k32)

    ; return string length as extended
    Return SetError(0, $a_query[4], $a_query[3])
EndFunc

Seems a bit safer to me.

Edited November 20, 2014 by SmOke_N

[SmOke_N]

I found this udf >_ProcessListProperties() is full complete, but I need something more simple.

I realy like _WinAPI_GetProcessFileName  it work fine and fast for my case.

Thank you @mLipok

A little example:

 

#include <WinAPIProc.au3>
#include <Array.au3>

Local $aProcessList = ProcessList("Dropbox.exe")
If @error Then
    ConsoleWrite("@error->" & @error & @LF)
Else
    For $i = 1 To $aProcessList[0][0]
        $path = _WinAPI_GetProcessFileName($aProcessList[$i][1])
        If @error Then
            ConsoleWrite("@error->" & @error & @LF)
        Else
            ConsoleWrite("$path->" & $path & @LF)
        EndIf
    Next
EndIf

I am curious, sometimes have executables have no path... like svchost.exe, csrss.exe...

 

I didn't see this before I posted above.  You have to have debug privileges on some of the processes.

Try this and let's see what your results are.

expandcollapse popup

#include <Security.au3>
#include <WinAPI.au3>

_SetDebugPriv()

Global $gsz_Path = _ProcessGetPathEx("svchost.exe")
MsgBox(0, 0, $gsz_Path & @CRLF & "Path StringLen = " & @extended & @CRLF)

Func _SetDebugPriv()

    Local $h_curproc = _WinAPI_GetCurrentProcess()
    Local $h_token = _Security__OpenProcessToken($h_curproc, _
        BitOR($TOKEN_ADJUST_PRIVILEGES, $TOKEN_QUERY))
    If Not $h_token Then
        Return SetError(2, 0, 0)
    EndIf

    Local $n_sdn = _Security__LookupPrivilegeValue("", $SE_DEBUG_NAME)

    Local $t_tokenpriv = DllStructCreate("dword;dword;long;dword")
    Local $p_tokenpriv = DllStructGetPtr($t_tokenpriv)
    DLLStructSetData($t_tokenpriv, 1, 1)
    DLLStructSetData($t_tokenpriv, 2, $n_sdn)
    DLLStructSetData($t_tokenpriv, 3, 0)
    DLLStructSetData($t_tokenpriv, 4, $SE_PRIVILEGE_ENABLED)
    Local $n_tokensize = DllStructGetSize($t_tokenpriv)

    Local $b_ret = _Security__AdjustTokenPrivileges($h_token, False, _
        $p_tokenpriv, $n_tokensize)

    _WinAPI_CloseHandle($h_token)

    Return SetError(Not $b_ret, 0, $b_ret)
EndFunc

; @param1 = process name or pid
; @param2 = default 0 = drive\etc format
;           true = native system path format
Func _ProcessGetPathEx($v_process, $b_native = 0)

    Local $i_pid = ProcessExists($v_process)
    If Not $i_pid Then
        ; process does not exist
        Return SetError(1, 0, "")
    EndIf

    Local $sz_filepath = ""
    ; are we working with anything less than vista?
    If __WINVER() < 0x0600 Then
        ; _WinAPI_GetProcessFileName seems misleading
        $sz_filepath = _WinAPI_GetProcessFileName($i_pid)
        Return SetError(@error, @extended, $sz_filepath)
    EndIf

    ; vista and above, should help with possible 64bit issues as well
    Local $h_k32 = DllOpen("Kernel32.dll")
    If @error Or Not $h_k32 Then
        ; could not open kernel32.dll
        Return SetError(2, 0, 0)
    EndIf

    Local Const $pgp_PROCESS_QUERY_LIMITED_INFORMATION = 0x1000
    Local Const $pgp_PROCESS_QUERY_INFORMATION = 0x0400
    Local Const $pgp_PROCESS_NAME_NATIVE = 0x00000001

    ; open process with query info only
    Local $a_openprocess = DllCall($h_k32, "handle", "OpenProcess", _
        "long", BitOR($pgp_PROCESS_QUERY_INFORMATION, _
            $pgp_PROCESS_QUERY_LIMITED_INFORMATION), _
        "int", 0, "long", $i_pid)
    Local $i_err = @error
    If $i_err Or Not IsArray($a_openprocess) Then
        DllClose($h_k32)
        ; error code from dllcall sent as extended
        Return SetError(3, $i_err, 0)
    EndIf
    Local $h_openproc = $a_openprocess[0]

    Local $n_native = $b_native ? $pgp_PROCESS_NAME_NATIVE : 0
    Local $a_query = DllCall($h_k32, "bool", "QueryFullProcessImageNameW", _
        "handle", $h_openproc, "dword", $n_native, "wstr", "", "int*", 4096)
    $i_err = @error
    If $i_err Or Not IsArray($a_query) Then
        DllClose($h_k32)
        ; error code from dllcall sent as extended
        Return SetError(4, $i_err, 0)
    EndIf

    _WinAPI_CloseHandle($h_openproc)
    DllClose($h_k32)

    ; return string length as extended
    Return SetError(0, $a_query[4], $a_query[3])
EndFunc