Everhart, Glenn
From:	G J S Srinivas [gjsrini@wipinfo.soft.net]
Sent:	Wednesday, October 14, 1998 7:47 AM
To:	Oren Teich
Cc:	ntdev@atria.com
Subject:	RE: [ntdev] finding child process id
Hi,
These functions are in NTDLL.DLL. Right now they are not documented.
You can use the  follwing two calls to get the parent process id.

In PSAPI.DLL.
EnumProcesss:
Retrieves all pids.

EnumProcesses( DWORD *lpids [Array to recieve process ids],
		 DWORD cb; [Size of the array]
		DWORD *cbNeeded; [Number of bytes retrieved after the call]);

In NTDLL.DLL
Gets all information of a process depending on class passed you can check up 
NTDDK.h for more information. You can pass "ProcessBasicInformation"  as the
PROCESSINFOCLASS to find out its parent. This structure is present in 
NTDDK.H.

NtQueryInformationProcess(DWORD handle; [handle to the process handle],
			     PROCESSINFOCLASS [information class],
			     PVOID ProcessInformation,
			     ULONG ProcessInformationLength,
			     PULONG ReturnLength);
NTDDK.H has these prototypes.

Regards,
-Srinivas.

> This is a good solution.  The exec()'d process is usually around for man
> minutes if not an hour or more.  Now the only problem is,
> NtQueryInformationProcess isn't on MSDN online, nor does VC++ 5.0 seem to
> know anything about it.  Where can I find this function?
> 
> Thanks,
> Oren
> 
> > -----Original Message-----
> > From: Bhaduri, Arnab [mailto:Arnab_Bhaduri@cisnc.canon.com]
> > Sent: Tuesday, October 13, 1998 11:38 AM
> > To: ntdev@atria.com; 'Oren Teich'
> > Subject: RE: [ntdev] finding child process id
> >
> >
> >
> > <Oren Teich wrote>
> > > there is a C program that calls CreateProcess to start a Perl script.
> > > This perl script then in turn exec's something else.  Now the
> > problem arises in
> > > that Win32 Perl exec seems to not actually exec, as there is no
> > such thing
> > > in windows I guess, but rather to create a new process, and exit.  The
> > > only problem with this is that now I no longer have the PID of the
> > newly exec'd
> > > process.  I don't know it's name, I don't really know what time
> > it started
> > > at, I don't really know anything about it.
> > > In unix, I could open the process table immediately after the exec
> > > from the parent, and find out who my child is, and that would be the
> > > process I'm looking for.  Is there any way to do something similar in
> > > NT, or does anyone have any recommendations as to the NT way of doing
> > > this?
> > >
> > I presume you want to know the PID of the "exec'ed" process.
> > You can walk the process list and check the parent PID
> > against the PID of the Perl script, but be warned that this
> > is both cumbersome and expensive. NtQueryInformationProcess()
> > will give you the "parent" PID of any process. You will need
> > to walk the process list, call this function for each process,
> > and match the parent PID against the PID of the Perl script.
> > While all this is going on, your exec'ed process might do its
> > job and exit, in which case...
> >
> > Perhaps you could explain a bit more about what exactly you
> > need to know about the exec'ed process.
> >
> > Regards
> > Arnab
> >
> 
>  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> [ To unsubscribe, send email to ntdev-request@atria.com with body
> UNSUBSCRIBE (the subject is ignored). ]
> 


 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[ To unsubscribe, send email to ntdev-request@atria.com with body
UNSUBSCRIBE (the subject is ignored). ]