I'm trying to get the process handle of, say example.exe, so I can call TerminateProcess
on it. How can I do this? Notice, it doesn't have a window so FindWindow
won't work.
7 Answers
#include <cstdio>
#include <windows.h>
#include <tlhelp32.h>
int main( int, char *[] )
{
PROCESSENTRY32 entry;
entry.dwSize = sizeof(PROCESSENTRY32);
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
if (Process32First(snapshot, &entry) == TRUE)
{
while (Process32Next(snapshot, &entry) == TRUE)
{
if (stricmp(entry.szExeFile, "target.exe") == 0)
{
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, entry.th32ProcessID);
// Do stuff..
CloseHandle(hProcess);
}
}
}
CloseHandle(snapshot);
return 0;
}
Also, if you'd like to use PROCESS_ALL_ACCESS in OpenProcess, you could try this:
#include <cstdio>
#include <windows.h>
#include <tlhelp32.h>
void EnableDebugPriv()
{
HANDLE hToken;
LUID luid;
TOKEN_PRIVILEGES tkp;
OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken);
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid);
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = luid;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, false, &tkp, sizeof(tkp), NULL, NULL);
CloseHandle(hToken);
}
int main( int, char *[] )
{
EnableDebugPriv();
PROCESSENTRY32 entry;
entry.dwSize = sizeof(PROCESSENTRY32);
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
if (Process32First(snapshot, &entry) == TRUE)
{
while (Process32Next(snapshot, &entry) == TRUE)
{
if (stricmp(entry.szExeFile, "target.exe") == 0)
{
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, entry.th32ProcessID);
// Do stuff..
CloseHandle(hProcess);
}
}
}
CloseHandle(snapshot);
return 0;
}
-
10You code will skip the first process in the system (however, first process is most likely "SYSTEM" so no user-visible bug.)– MichaelMay 14, 2009 at 19:29
-
3change it to: HANDLE hProcess = OpenProcess( PROCESS_QUERY_INFORMATION + PROCESS_VM_READ + PROCESS_TERMINATE, FALSE, entry.th32ProcessID ); and I'll give you the answer– MalfistMay 14, 2009 at 19:44
-
2I've been able to make much progress from this answer - thanks so much to everyone who contributed. I am running into a permission issue though. Even with EnableDebugPriv, "I get OpenProcess failed with error 5 (Access is denied)" when I try to open processes that are not my own. In my case I am looking for iexplore across all users.– tofutimJul 18, 2012 at 23:35
-
5Excellent answer! You should change the line
if (stricmp(entry.szExeFile, "target.exe") == 0)
withif (_tcsicmp(entry.szExeFile, _T("target.exe")) == 0)
to keep type integrity when changing between Unicode and ANSI compile flags.– rafeekNov 18, 2014 at 15:47 -
2Note for people like me who like to alphabetize their headers --
windows.h
has to be included beforetlhelp32.h
or you end up with confusing errors about the functions being undefined (because the definitions depend onwindows.h
) Mar 10, 2016 at 5:41
The following code shows how you can use toolhelp and OpenProcess to get a handle to the process. Error handling removed for brevity.
HANDLE GetProcessByName(PCSTR name)
{
DWORD pid = 0;
// Create toolhelp snapshot.
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
PROCESSENTRY32 process;
ZeroMemory(&process, sizeof(process));
process.dwSize = sizeof(process);
// Walkthrough all processes.
if (Process32First(snapshot, &process))
{
do
{
// Compare process.szExeFile based on format of name, i.e., trim file path
// trim .exe if necessary, etc.
if (string(process.szExeFile) == string(name))
{
pid = process.th32ProcessID;
break;
}
} while (Process32Next(snapshot, &process));
}
CloseHandle(snapshot);
if (pid != 0)
{
return OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
}
// Not found
return NULL;
}
-
You forgot one parenthesis in the "if (MatchProcessName(process.szExeFile, name)" condition. Oct 13, 2011 at 9:47
-
Like xian's answer, this has a race condition and is inherently unsafe.– benrgJul 2, 2016 at 20:46
-
@Occulta
if (string(process.szExeFile) == string(name))
can be used instead of this function. I edited Michael's answer. Feb 25, 2017 at 21:54
There are two basic techniques. The first uses PSAPI; MSDN has an example that uses EnumProcesses
, OpenProcess
, EnumProcessModules
, and GetModuleBaseName
.
The other uses Toolhelp, which I prefer. Use CreateToolhelp32Snapshot
to get a snapshot of the process list, walk over it with Process32First
and Process32Next
, which provides module name and process ID, until you find the one you want, and then call OpenProcess
to get a handle.
The following code can be used:
DWORD FindProcessId(const std::wstring& processName)
{
PROCESSENTRY32 processInfo;
processInfo.dwSize = sizeof(processInfo);
HANDLE processesSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
if (processesSnapshot == INVALID_HANDLE_VALUE) {
return 0;
}
Process32First(processesSnapshot, &processInfo);
if (!processName.compare(processInfo.szExeFile))
{
CloseHandle(processesSnapshot);
return processInfo.th32ProcessID;
}
while (Process32Next(processesSnapshot, &processInfo))
{
if (!processName.compare(processInfo.szExeFile))
{
CloseHandle(processesSnapshot);
return processInfo.th32ProcessID;
}
}
CloseHandle(processesSnapshot);
return 0;
}
Usage:
auto processId = FindProcessId(L"blabla.exe");
Getting a handle should be obvious, just call OpenProcess()
or similar on it.
Check out: MSDN Article
You can use GetModuleName
(I think?) to get the name and check against that.
-
Most of the GetModuleName, QueryFullProcessImage name, etc., require a handle and thus won't be of much use. Toolhelp does return process name.– MichaelMay 14, 2009 at 19:33
OpenProcess Function
From MSDN:
To open a handle to another local process and obtain full access rights, you must enable the SeDebugPrivilege privilege.
-
-
1SeDebugPrivilege is most definitely not needed for processes that are running as you. If you have access to the process via it's ACL (which you generally do for processes you create at the same integrity level as your code), you do not need SeDebugPrivilege. From same MSDN page: If the caller has enabled the SeDebugPrivilege privilege, the requested access is granted regardless of the contents of the security descriptor.– MichaelMay 14, 2009 at 19:21
-
If you don't mind using system()
, doing system("taskkill /f /im process.exe")
would be significantly easier than these other methods.