Click here to Skip to main content
15,920,111 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
C++
void MyBeautifulFunction()
{
		    DWORD processes[1024], cbNeeded;
			EnumProcesses(processes, sizeof(processes), &cbNeeded);
			DWORD HowManyProcIds = cbNeeded / sizeof(DWORD);

			for (size_t i = 0; i < HowManyProcIds; i++)
			{
				wchar_t szProcessName[MAX_PATH] = L"<unknown>";
				HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processes[i]);
				HMODULE ProcMod;
				DWORD cb;

				if (hProcess != NULL)
				{
					if (EnumProcessModules(hProcess, &ProcMod, sizeof(ProcMod), &cb))
						GetModuleBaseName(hProcess, ProcMod, szProcessName, sizeof(szProcessName) / sizeof(wchar_t));

                    //wstring used to store the results
					ProcessesBuffer += szProcessName;
					ProcessesBuffer += L"\n\r";

					CloseHandle(hProcess);
				}
			}
			SetWindowText(EditForEnumeratedProcesses, ProcessesBuffer.c_str());
}

The program gets administration rights on runtime (thanks to this guide I found here : Elevating during runtime)
But the final results equals the one i'd get if the program had no administration rights, it enums half of the real running processes and on a good third of the enumerated ones it fails at naming them leaving the proc name to "unknown"

Thanks in advance
Posted

1 solution

this works fine when elevated on my system, don't bother with that codeproject sample, either manually runas admin or change its manifest to require elevation
BTW you can't elevate an app to admin priv if YOU don't have admin rights on the machine

all 153 processes discovered, some unnamed - compiled in 32bit
all 153 processes discovered, all named - compiled in 64bit

oh - and this is a repeat of EnumProcess() not returning all the expected processes[^] - don't repeat questions


void MyBeautifulFunction()
{
	DWORD processes[1024], cbNeeded;
	EnumProcesses(processes, sizeof(processes), &cbNeeded);
	DWORD HowManyProcIds = cbNeeded / sizeof(DWORD);
 
	std::vector<CString> AllProcessesBuffer;

	for (size_t i = 0; i < HowManyProcIds; i++)
	{
		CString processBuffer(_T("unknown"));

		HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processes[i]);
		HMODULE ProcMod;
		DWORD cb;
 
		if (hProcess != NULL)
		{

			if (EnumProcessModules(hProcess, &ProcMod, sizeof(ProcMod), &cb))
			{
				wchar_t szProcessName[MAX_PATH];
				GetModuleBaseName(hProcess, ProcMod, szProcessName, sizeof(szProcessName) / sizeof(wchar_t));
				//wstring used to store the results
				processBuffer = szProcessName;
			}
			else
			{
				processBuffer.Format(_T("failed EnumProcessModules %d"), GetLastError());
			}
 
 
			CloseHandle(hProcess);
		}
		else
		{
			processBuffer.Format(_T("Failed OpenProcess %d"),GetLastError());
		}
		AllProcessesBuffer.push_back(processBuffer);
	}

}
 
Share this answer
 
v2
Comments
Member 11287295 7-Dec-14 18:20pm    
Using your code now retrieves 54 processes (I guess it's the legit number of all running processes) the first process always fail with errorcode 87 -invalid parameter, 10 fails on enumProcessModules with error 299 and almost 38 fails with error code 5 : access denied, I get the same exact output if i'm giving admin rights or not, i'm directly running it as administrator (and I'm actually the computer Administrator)

EDIT: I'm not using MFC but plain winAPI, compiled in 64bit gives off more results, but I still see 25+ processes failing with access denied and the first process failing with error 87
barneyman 7-Dec-14 18:54pm    
so get the failing PIDs and use something like procexp (http://technet.microsoft.com/en-au/sysinternals/bb896653.aspx) to determine any common reason for that - ISTR the first process is always the OS or one of it's henchmen, so it's unlikely you'll get to that - the others that fail may be simply denying you access

you could always try running it as SYSTEM (psExec - http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx) and see what that does

you're not defining what constitutes 'success' - what do you want out of this code?
Member 11287295 7-Dec-14 20:10pm    
I finally found a way to make it work, the current process token needs to obtain the SeDebugPriviledges, it now returns only 2-3 access denied failures and the infamous first process which as you said could be OS-related.
I'll call it success for now and be just happy with it, thanks for your help
barneyman 8-Dec-14 14:01pm    
that makes sense - vaguely remember setting that priv a few years ago for another reason - happy to help

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900