41

I'm currently passing the pid on the command line to the child, but is there a way to do this in the Win32 API? Alternatively, can someone alleviate my fear that the pid I'm passing might belong to another process after some time if the parent has died?

1
  • Windows XP does not reassign the parent PID to be -1 when the parent process exits, so it is possible (and I have seen this happen) for the process tree to be wrong. So you can see NOTEPAD.EXE as the parent of IEXPLORE.EXE in the tree shown by Process Explorer, which is clearly wrong. Jun 27, 2012 at 21:57

5 Answers 5

60

Just in case anyone else runs across this question and is looking for a code sample, I had to do this recently for a Python library project I'm working on. Here's the test/sample code I came up with:

#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>

int main(int argc, char *argv[]) 
{
    int pid = -1;
    HANDLE h = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    PROCESSENTRY32 pe = { 0 };
    pe.dwSize = sizeof(PROCESSENTRY32);

    //assume first arg is the PID to get the PPID for, or use own PID
    if (argc > 1) {
        pid = atoi(argv[1]);
    } else {
        pid = GetCurrentProcessId();
    }

    if( Process32First(h, &pe)) {
        do {
            if (pe.th32ProcessID == pid) {
                printf("PID: %i; PPID: %i\n", pid, pe.th32ParentProcessID);
            }
        } while( Process32Next(h, &pe));
    }

    CloseHandle(h);
}
6
  • do you have the python-version by any chance? Aug 29, 2012 at 21:16
  • 1
    This approach can provide stale PIDs as mentioned elsewhere, and it can even have cycles if you try to walk up the parent IDs.
    – jws
    Sep 11, 2014 at 14:01
  • 5
    +1000000 for a code sample. Dunno whats up with stackoverflow lately, but I'm getting tired of browsing dozens of pages on a programming website without seeing any code.
    – user562566
    Feb 28, 2015 at 15:26
  • 1
    You might want to add a check for INVALID_HANDLE_VALUE. if ( h == INVALID_HANDLE_VALUE ) { // got an invalid handle
    – hmatt1
    Oct 28, 2015 at 14:06
  • @JamesSchmidt, By cycles you mean that the parent of a process may also be its child/descendant? Under what conditions could that happen?
    – GetFree
    Apr 18, 2017 at 12:05
23
ULONG_PTR GetParentProcessId() // By Napalm @ NetCore2K
{
 ULONG_PTR pbi[6];
 ULONG ulSize = 0;
 LONG (WINAPI *NtQueryInformationProcess)(HANDLE ProcessHandle, ULONG ProcessInformationClass,
  PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength); 
 *(FARPROC *)&NtQueryInformationProcess = 
  GetProcAddress(LoadLibraryA("NTDLL.DLL"), "NtQueryInformationProcess");
 if(NtQueryInformationProcess){
  if(NtQueryInformationProcess(GetCurrentProcess(), 0,
    &pbi, sizeof(pbi), &ulSize) >= 0 && ulSize == sizeof(pbi))
     return pbi[5];
 }
 return (ULONG_PTR)-1;
}
3
  • 3
    Before using NtQueryInformationProcess, be aware that it is an unsupported API, and I quote from the link: "NtQueryInformationProcess may be altered or unavailable in future versions of Windows." Furthermore, even in the documentation, the parent process ID field is a reserved field. Nov 23, 2015 at 23:44
  • Right, does not work pretty well with last msvc 2017
    – Stef
    Feb 6, 2019 at 23:30
  • I find that this technique mostly works, but occasionally NtQueryInformationProcess returns 0xC0000024 or 0xC0000008 Jul 28, 2020 at 23:45
23

A better way to do this is to call DuplicateHandle() to create an inheritable duplicate of your process handle. Then create the child process and pass the handle value on the command line. Close the duplicated handle in the parent process. When the child's done, it will need to Close its copy as well.

7
  • 8
    This method has the advantage that the handle will really refer to your parent even if the parent dies before you access it. With the pid passing method, there's potentially a race condition (although very unlikely) between passing the pid, the child accessing it, the parent shutting down and the pid being reused... Jun 11, 2009 at 10:23
  • Thanks Peter... DuplicateHandle is just what I was looking for. You're right, the HANDLE is better than PID (I just wanted to WaitForSingleObject so child could terminate if parent quits unexpectedly). Jul 3, 2010 at 7:18
  • One argument needed for DuplicateHandle is the target process handle. You wrote that first you create duplicate handle and then create child process. Its nonsense. You must create child process first and then create duplicate of process handle. So you cant pass handle value on command line. Jan 21, 2015 at 8:07
  • 1
    @truthseeker: No... you must duplicate the handle first. Otherwise, the child process would have no way to inherit it. You can pass the duplicate handle on the command line because the inherited handle in the child process will have the same numerical value as it does in the parent process. Think about it: handle inheritance would be fairly useless if you could not access those handles in the processes that inherited them! Jan 21, 2015 at 13:09
  • 3
    To clarify: ordinarily you would either duplicate or inherit a handle. In this case, however, all you have is the pseudo handle returned from GetCurrentProcess() which cannot be inherited. So you have to duplicate it to generate a real, inheritable handle. The reason to use inheritance is that if you duplicate the handle directly to the child process you have no easy way of telling the child process what the handle value is. Jan 29, 2015 at 21:00
13

Notice that if the parent process terminates it is very possible and even likely that the PID will be reused for another process. This is standard windows operation.

So to be sure, once you receive the id of the parent and are sure it is really your parent you should open a handle to it and use that.

2
  • Which is done using OpenProcess(). See the link in artur02's answer below. Apr 11, 2013 at 12:37
  • 27
    Reused PIDs can be detected by additionally checking start times. The real parent would have start time before the child's, a reused one - after. Oct 29, 2014 at 13:05
3

"Alternatively, can someone alleviate my fear that the pid I'm passing might belong to another process after some time if the parent has died?"

Yes, the PID can be reused. Unlike UNIX, Windows does not maintain a strong parent-child relationship tree.

1
  • 7
    Also on LINUX process IDs are being reused. Simply because pid_t is not of infinite size. MAXPID is 2^15. I see this happening multiple times during a day. On the other side, on Windows there is a strong parent-child relationship via handles -- as long as you keep the handle open, you can keep referring to the parent process.
    – user4590120
    Jan 8, 2016 at 0:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.