Solved

Watch to see what processes are spawned by another process

Posted on 2006-06-29
9
402 Views
Last Modified: 2010-05-18
Hello,

I have a requirement to track what programs are opened by another process.  The process is third party, so I cannot change it.  I am looking to attach some sort of tracer to the first process so that I can see if it spawns other processes and add them to a list.  Consider the following:

Program Z runs a launcher (Process A)
Process A launches Process B
Process A launches Process C
Program Z must maintain a list of the handles of Process B, and Process C, and must know when they are closed.

The business requirement for this project is that our program, Program Z, invokes a launcher (Process A) for other programs.  We need to know when the other programs are closed, and so we are trying to track the handles for the additional processes which are spawned by Process A.

Is it possible to figure out what processes are spawned from a 3rd party process, and to find out when the new processes are closed?

Thanks!
0
Comment
Question by:TLevin10
  • 5
  • 4
9 Comments
 
LVL 12

Expert Comment

by:topdog770
Comment Utility
Are you using VS2003 or VS2005?
0
 

Author Comment

by:TLevin10
Comment Utility
VS2003
0
 

Author Comment

by:TLevin10
Comment Utility
I am thinking that maybe what I am looking for is similar to "spying" on Process A, like I would do with Spy++?
0
 
LVL 12

Accepted Solution

by:
topdog770 earned 500 total points
Comment Utility
Here's a very basic code snippet that I had laying around... was trying to create a bit nicer example, but ran out of time, sorry for delay.

The performance counter must be enabled on the computer for the GetProcesses function to work.

Here's the key..            
============================================
      Process[] p = System.Diagnostics.Process.GetProcesses();
      foreach (Process process in p)
               {
                     // do something with each process
               }
============================================



using System;
using System.Drawing;
using System.Collections;
using System.ComponentModel;
using System.Windows.Forms;
using System.Data;
using System.Runtime.InteropServices;  
using System.Diagnostics;


namespace ProcessView
{
      /// <summary>
      /// Summary description for Form1.
      /// </summary>
      public class Form1 : System.Windows.Forms.Form
      {
            private System.Windows.Forms.ListView ProcessListView;
            private System.Windows.Forms.Label ProcessCountLabel;
            /// <summary>
            /// Required designer variable.
            /// </summary>
            private System.ComponentModel.Container components = null;

            public Form1()
            {
                  //
                  // Required for Windows Form Designer support
                  //
                  InitializeComponent();
            }

            /// <summary>
            /// Clean up any resources being used.
            /// </summary>
            protected override void Dispose( bool disposing )
            {
                  if( disposing )
                  {
                        if (components != null)
                        {
                              components.Dispose();
                        }
                  }
                  base.Dispose( disposing );
            }

            #region Windows Form Designer generated code
            /// <summary>
            /// Required method for Designer support - do not modify
            /// the contents of this method with the code editor.
            /// </summary>
            private void InitializeComponent()
            {
                  this.ProcessListView = new System.Windows.Forms.ListView();
                  this.ProcessCountLabel = new System.Windows.Forms.Label();
                  this.SuspendLayout();
                  //
                  // ProcessListView
                  //
                  this.ProcessListView.Location = new System.Drawing.Point(8, 56);
                  this.ProcessListView.Name = "ProcessListView";
                  this.ProcessListView.Size = new System.Drawing.Size(272, 208);
                  this.ProcessListView.TabIndex = 0;
                  //
                  // ProcessCountLabel
                  //
                  this.ProcessCountLabel.Location = new System.Drawing.Point(176, 16);
                  this.ProcessCountLabel.Name = "ProcessCountLabel";
                  this.ProcessCountLabel.TabIndex = 1;
                  this.ProcessCountLabel.Text = "label1";
                  //
                  // Form1
                  //
                  this.AutoScaleBaseSize = new System.Drawing.Size(5, 13);
                  this.ClientSize = new System.Drawing.Size(292, 273);
                  this.Controls.Add(this.ProcessCountLabel);
                  this.Controls.Add(this.ProcessListView);
                  this.Name = "Form1";
                  this.Text = "Form1";
                  this.Load += new System.EventHandler(this.Form1_Load);
                  this.ResumeLayout(false);

            }
            #endregion

            /// <summary>
            /// The main entry point for the application.
            /// </summary>
            [STAThread]
            static void Main()
            {
                  Application.Run(new Form1());
            }

            private void ShowProcessInfo()
            {
                  Process[] p = System.Diagnostics.Process.GetProcesses();
                  ProcessListView.Items.Clear();
                  foreach (Process process in p)
                  {
                        ListViewItem lvi = new ListViewItem(
                              process.ProcessName);
                        lvi.SubItems.Add(process.Id.ToString());
                        try
                        {
                              if (process.MainModule != null)
                              {
                                    lvi.SubItems.Add(
                                          process.MainModule.ModuleName);
                              }
                              else lvi.SubItems.Add("-");
                        }
                        catch (Exception ex)
                        {
                              // for example, access denied
                              lvi.SubItems.Add(ex.Message);
                        }
                        lvi.SubItems.Add(
                              (process.PagedMemorySize/1024)+" KB");
                        ProcessListView.Items.Add(lvi);
                  }
                  ProcessCountLabel.Text =      p.Length.ToString();
            }

            private void Form1_Load(object sender, System.EventArgs e)
            {
                  ShowProcessInfo();
            }
      }
}
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 

Author Comment

by:TLevin10
Comment Utility
Very interesting - so I can loop through all the processes and find the one I'm looking for.  However, I have run into a small problem...

The following code should illustrate:

public void WatchProcesses()
{
      Process[] procCollection = Process.GetProcessesByName("spawnedProcess");

      foreach (Process p in procCollection)
            p.Exited +=new EventHandler(p_Exited);
}

private void p_Exited(object sender, EventArgs e)
{
      this.OnExit();
}

When I launch the "launcher" process (Process A) I attach to its exit event, which runs "WatchProcesses()".  Since the launcher just launches the new Processes and exits, this is the correct time to find the processes it launched.  Since I know the name of the launched processes, I can bind to their exit events (as in the same code).  However, when I exit the launched processes, no event is fired.  Why is this?

P.S. - The Processes (B and C) which are launched by Process A are not managed processes.  Can I still bind to their exit events? How would I do this for VB applications (thats what processes B and C are)?

0
 

Author Comment

by:TLevin10
Comment Utility
Note on the P.S - I mean VB6, not VB.NET...
0
 

Author Comment

by:TLevin10
Comment Utility
NEVERMIND! I figured it out - the VB processes don't normally have "enableRaisingEvents" set to true, so I had to set this first.

Now its working - thanks!
0
 
LVL 12

Expert Comment

by:topdog770
Comment Utility
change this code to

 foreach (Process p in procCollection)
{
          p.EnableRaisingEvents;  
          p.Exited +=new EventHandler(p_Exited);
}
0
 
LVL 12

Expert Comment

by:topdog770
Comment Utility
Np, glad it's working!

0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Extention Methods in C# 3.0 by Ivo Stoykov C# 3.0 offers extension methods. They allow extending existing classes without changing the class's source code or relying on inheritance. These are static methods invoked as instance method. This…
Introduction Although it is an old technology, serial ports are still being used by many hardware manufacturers. If you develop applications in C#, Microsoft .NET framework has SerialPort class to communicate with the serial ports.  I needed to…
This video discusses moving either the default database or any database to a new volume.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now