Enumerating NTVDM Processes under NT4

[Chris Lowndes]

Have built VB5 app to enumerate all running processes under NT4 but need to enumerate sub-processes running for DOS or Win16 apps (as in Task Manager Processes Tab). These all relate to NTVDM.EXE but to differentiate need to define the .EXE files running within that process.

Anyone know how Task Manager gets the .EXE names?

Chris Lowndes

[Lothar Haensler]

check out MSDN article Q175030

it shows how to enumerate processes in NT. It includes code for enumerating 16 bit processes using the VDMEnumTaskWOWEx functionl.

[Chris Lowndes]

Thanks
Have got that far already. VDMEnumTaskWOWEx only returns a ProcessID for each NTVDM sub process. I cannot find a way to return the .EXE associated with the PID.

Any more help?

Chris Lowndes

[Lothar Haensler]

no sir, it takes a function address as an argument.
that function will be called for each found file with the following parameters:
BOOL WINAPI Enum16( DWORD dwThreadId, WORD hMod16, WORD hTask16,
PSZ pszModName, PSZ pszFileName, LPARAM lpUserDefined )

pszFileName is what you are looking for.

[Chris Lowndes]

This is the code for my callback function.


private Function VDMEnumTaskWOWProc(byval dwThreadID as Long, _
byval hMod16 as Long, _
byval hTask16 as Long, _
byref sModName as string, _
byref sFileName as string, _
byref lParam as Long) as Boolean

NumProcesses16 = NumProcesses16 + 1
ReDim Preserve Threads16(1 to NumProcesses16) as Long
Threads16(NumProcesses16) = dwThreadID
VDMEnumTaskWOWProc = false

End Function




How can I assign the .EXE name to sFileName?
I've run out of ideas.

Chris Lowndes

[Lothar Haensler]

IMHO your declaration is wrong.
You don't use ByRefs.
Use Byval for your strings.
the sFileName argument is filled automatically for you.

You callback function is called for each 16-Bit process with all the arguments mentioned.
Now, when your callback is called sFileName will already be filled with the file name of the current 16-Bit-process.
I'd store those values in a collection.
col.add Key:=pid, Item:=sFilename

[Lothar Haensler]

since all that is kind of hard to explain I'd really recommend that you check that MSDN article. It contains all the (C) source code for enumerating all processes 16 and 32 bit.

[Chris Lowndes]

Thanks mate
That was all that was wrong
Changing to ByVal enabled me to populate a collection/array with the .EXE names.

Save me an hour or two

Chris Lowndes