Getting process information of every process

Question

I am trying to create a program that any normal user can run on windows and generate a process list of all processes, including the executable location. I have used CreateToolhelp32Snapshot() to get all process names, pid, ppid. But having issues getting the image path. Everything I do results in pretty much Access Denied.

I have tried ZwQueryInformationProcess, GetProcessImageFileName, etc. and also using OpenProcess to get the handle to each process. I can get the handle by using PROCESS_QUERY_LIMITED_INFORMATION, but any other option doesn't work. I am lost and have been at this for a few days. Can anyone point me in the right direction?

EylM · Answer 1 · 2018-05-17T23:42:43.397

This is the code that works for non-admin user on Windows. Use the szExeFile member of PROCESSENTRY32 to get the path:

HANDLE hProcessSnap = NULL;
HANDLE hProcess = NULL;
PROCESSENTRY32 pe32;
DWORD dwPriorityClass = 0;

// Take a snapshot of all processes in the system.
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hProcessSnap == INVALID_HANDLE_VALUE)
{
    return;
}

// Set the size of the structure before using it.
pe32.dwSize = sizeof(PROCESSENTRY32);

// Retrieve information about the first process,
// and exit if unsuccessful
if (!Process32First(hProcessSnap, &pe32))
{
    CloseHandle(hProcessSnap);          // clean the snapshot object
    return;
}

// Now walk the snapshot of processes, and
// display information about each process in turn
do
{
    // do something with the pe32 struct.
    // pe32.szExeFile -> path of the file

} while (Process32Next(hProcessSnap, &pe32));

CloseHandle(hProcessSnap);

You shouldn't be using `PROCESS_ALL_ACCESS` when calling `OpenProcess()`. Request only the rights you actually need. For instance, `GetPriorityClass()` needs only `PROCESS_QUERY_INFORMATION` or `PROCESS_QUERY_LIMITED_INFORMATION`. But, this example is not using `hProcess` for anything, so you don't even need to call `OpenProcess()` at all. — Remy Lebeau, May 17 '18 at 19:01

Getting process information of every process

1 Answers1