Who called my app?

[Guest]

How do I know who called/ran my application? I'm talking about a compiled ahk script.
Was it user ran it directly from a file manager? was it via cmd? Was it another app? etc...

Thanks

[trismarck]

Guest, see this. Basically the idea is to get the name of the parent process.

[Guest]

Thanks trismarck : )

But that function is ancient ad I'm getting Chinese text, its not UNICODE :/
It seems all I need is the parent process PID
Any idea?

[LinearSpoon]

I had used this code in another script to return the name of the process listening over a certain port, but I guess it can be adapted to your purposes. Tested on ANSI, Unicode, 32 bit and 64 bit AHK.
Edit: I take back what I said about doing both the parent PID and name in the same loop. Improved speed somewhat anyway.

Code: Select all

scriptPID := GetCurrentProcess()
scriptEXE := GetProcessName(scriptPID)
parentPID := GetParentProcess(scriptPID)
parentEXE := GetProcessName(parentPID)
Msgbox % "Script PID: " scriptPID "`nScript executable: " scriptEXE "`nParent PID: " parentPID "`nParent executable: " parentEXE


GetParentProcess(PID)
{
  static function := DllCall("GetProcAddress", "ptr", DllCall("GetModuleHandle", "str", "kernel32.dll", "ptr"), "astr", "Process32Next" (A_IsUnicode ? "W" : ""), "ptr")
  if !(h := DllCall("CreateToolhelp32Snapshot", "uint", 2, "uint", 0))
    return
  VarSetCapacity(pEntry, sz := (A_PtrSize = 8 ? 48 : 36)+(A_IsUnicode ? 520 : 260))
  Numput(sz, pEntry, 0, "uint")
  DllCall("Process32First" (A_IsUnicode ? "W" : ""), "ptr", h, "ptr", &pEntry)
  loop
  {
    if (pid = NumGet(pEntry, 8, "uint") || !DllCall(function, "ptr", h, "ptr", &pEntry))
      break
  }
  DllCall("CloseHandle", "ptr", h)
  return Numget(pEntry, 16+2*A_PtrSize, "uint")
}

GetProcessName(PID)
{
  static function := DllCall("GetProcAddress", "ptr", DllCall("GetModuleHandle", "str", "kernel32.dll", "ptr"), "astr", "Process32Next" (A_IsUnicode ? "W" : ""), "ptr")
  if !(h := DllCall("CreateToolhelp32Snapshot", "uint", 2, "uint", 0))
    return
  VarSetCapacity(pEntry, sz := (A_PtrSize = 8 ? 48 : 36)+260*(A_IsUnicode ? 2 : 1))
  Numput(sz, pEntry, 0, "uint")
  DllCall("Process32First" (A_IsUnicode ? "W" : ""), "ptr", h, "ptr", &pEntry)
  loop
  {
    if (pid = NumGet(pEntry, 8, "uint") || !DllCall(function, "ptr", h, "ptr", &pEntry))
      break
  }
  DllCall("CloseHandle", "ptr", h)
  return StrGet(&pEntry+28+2*A_PtrSize, A_IsUnicode ? "utf-16" : "utf-8")
}

GetCurrentProcess()
{
  return DllCall("GetCurrentProcessId")
}

[Chef]

[LinearSpoon]

Looks like you grabbed the old version before I made some edits... I didn't close the snapshot handle and I made some changes to improve the speed. *Shrugs*

[Chef]

Looks like you grabbed the old version before I made some edits... I didn't close the snapshot handle and I made some changes to improve the speed. *Shrugs*

Turned out it could be done without all those dllCalls, see my gist post above.

[trismarck]

LinearSpoon, thanks for the code. I have a question:

Code: Select all

VarSetCapacity(pEntry, sz := (A_PtrSize = 8 ? 48 : 36)+(A_IsUnicode ? 520 : 260))

Shouldn't there be 40 instead of 48? LONG seems to be 4 bytes on 64-bit Windows.

Code: Select all

return Numget(pEntry, 16+2*A_PtrSize, "uint") ; 20+A_PtrSize
...
return StrGet(&pEntry+28+2*A_PtrSize, A_IsUnicode ? "utf-16" : "utf-8") ; 32+A_PtrSize

[LinearSpoon]

@trismark: No. It's true LONG is int type (4 bytes) on 64 bit Windows. The issue is that th32DefaultHeapID is an "int64" type. This has several implications.

First, th32DefaultHeapID must sit on an address offset from the start of the struct that is a multiple of its size (8 bytes). The previous member th32ProcessID, occupies offset 8 to 12. The compiler inserts 4 "pad" bytes here so that th32DefaultHeapID can sit at offset 16.
Second, th32DefaultHeapID is itself 4 bytes larger on 64 bit compared to on 32 bit.
Third and last, the size of the entire structure must be a multiple of its largest member (Exercise: Why?). The structure as defined would be 564 bytes, which is 4 bytes short of being divisible by the size of th32DefaultHeapID. Again, 4 more "pad" bytes are inserted to make it work.

Together, these account for the 12 byte difference between 64 and 32 bit versions of the structure. In the spoiler below is the layout of the struct for each AHK build.

Spoiler

Code: Select all

ANSI 32
######################################################
Struct: PROCESSENTRY32          total size: 296
Member                   Pos     C++ Type                AHK Type
dwSize                   @ 0     unsigned long           uint
cntUsage                 @ 4     unsigned long           uint
th32ProcessID            @ 8     unsigned long           uint
th32DefaultHeapID        @ 12    unsigned long           uint
th32ModuleID             @ 16    unsigned long           uint
cntThreads               @ 20    unsigned long           uint
th32ParentProcessID      @ 24    unsigned long           uint
pcPriClassBase           @ 28    long                    int
dwFlags                  @ 32    unsigned long           uint
szExeFile                @ 36    char [260]

Code: Select all

Unicode 32
######################################################
Struct: PROCESSENTRY32          total size: 556
Member                   Pos     C++ Type                AHK Type
dwSize                   @ 0     unsigned long           uint
cntUsage                 @ 4     unsigned long           uint
th32ProcessID            @ 8     unsigned long           uint
th32DefaultHeapID        @ 12    unsigned long           uint
th32ModuleID             @ 16    unsigned long           uint
cntThreads               @ 20    unsigned long           uint
th32ParentProcessID      @ 24    unsigned long           uint
pcPriClassBase           @ 28    long                    int
dwFlags                  @ 32    unsigned long           uint
szExeFile                @ 36    wchar_t [260]

Code: Select all

Unicode 64
######################################################
Struct: PROCESSENTRY32          total size: 568
Member                   Pos     C++ Type                AHK Type
dwSize                   @ 0     unsigned long           uint
cntUsage                 @ 4     unsigned long           uint
th32ProcessID            @ 8     unsigned long           uint
th32DefaultHeapID        @ 16    unsigned __int64        uint64
th32ModuleID             @ 24    unsigned long           uint
cntThreads               @ 28    unsigned long           uint
th32ParentProcessID      @ 32    unsigned long           uint
pcPriClassBase           @ 36    long                    int
dwFlags                  @ 40    unsigned long           uint
szExeFile                @ 44    wchar_t [260]

This spoiler contains the exercise answer.

Spoiler

Structs are a multiple of the size of the largest member in case they are used as part of an array. Without the pad bytes, the first struct would have properly aligned elements, but the second struct in the array would have its members offset by the number of missing pad bytes.

[JeezLouise]

Can you tell me how to write this part

return, process[property]

I tried all types but final was process[ParentProcessId] etc, and example would help a lot