WinAPI: How to enumerate processes?

[ovidiucucu]

Q: How to enumerate currently running processes?

A: One method is by using Process Status API (PSAPI).

Example

#include <list>
#include <iostream>
#include <Windows.h>
#include <Psapi.h>
#pragma comment(lib, "Psapi.lib")
// Note: linking to Psapi.lib is not necessary if the target system is Windows 7 or newer

DWORD PSAPI_EnumProcesses(std::list<DWORD>& listProcessIDs, DWORD dwMaxProcessCount)
{
    DWORD dwRet = NO_ERROR;
    listProcessIDs.clear();
    DWORD *pProcessIds = new DWORD[dwMaxProcessCount];
    DWORD cb = dwMaxProcessCount * sizeof(DWORD);
    DWORD dwBytesReturned = 0;

    // call PSAPI EnumProcesses
    if (::EnumProcesses(pProcessIds, cb, &dwBytesReturned))
    {
        // push returned process IDs into the output list
        const int nSize = dwBytesReturned / sizeof(DWORD);
        for(int nIndex = 0; nIndex < nSize; nIndex++)
        {
            listProcessIDs.push_back(pProcessIds[nIndex]);
        }
    }
    else
    {
        dwRet = ::GetLastError();
    }
    delete[]pProcessIds;
    return dwRet;
}

int main()
{
    std::list<DWORD> listProcessIDs;
    const DWORD dwMaxProcessCount = 1024;
    DWORD dwRet = PSAPI_EnumProcesses(listProcessIDs, dwMaxProcessCount);
    if(NO_ERROR == dwRet)
    {
        const std::list<DWORD>::const_iterator end = listProcessIDs.end();
        std::list<DWORD>::const_iterator iter = listProcessIDs.begin();
        for( ; iter != end; ++iter)
        {
            DWORD dwProcessID = *iter;
            std::cout << "Process ID: " << dwProcessID << std::endl;
            // NOTE: you can pass dwProcessID to ::OpenProcess and further get
            // more process info by using the returned process handle 
        }
    }
    else
    {
        std::cout << "PSAPI_GetProcessesList failed. Error: " << dwRet << std::endl;
        return dwRet;
    }
    return 0;
}

Resources and related articles

• MSDN: Process Status API
• MSDN: EnumProcesses function
• Codexpert: Listing Processes – Part 2: Using PSAPI

[ovidiucucu]

A: Another way is by using Tool Help Library.

Example

#include <list>
#include <iostream>
#include <Windows.h>
#include <Tlhelp32.h>

DWORD ToolHelp_EnumProcesses(std::list<PROCESSENTRY32>& listProcessInfo)
{
    DWORD dwRet = NO_ERROR;
    listProcessInfo.clear();
    // take a snapshot of processes
    DWORD dwFlags = TH32CS_SNAPPROCESS;
    HANDLE hSnapshot = ::CreateToolhelp32Snapshot(dwFlags, 0);
    if (INVALID_HANDLE_VALUE == hSnapshot)
    {
        return ::GetLastError();
    }
    PROCESSENTRY32 processEntry = {0};
    processEntry.dwSize = sizeof(PROCESSENTRY32);
    // get info for each process in the snapshot
    if (::Process32First(hSnapshot, &processEntry))
    {
        do
        {
            listProcessInfo.push_back(processEntry);
        } while (::Process32Next(hSnapshot, &processEntry));
    }
    else
    {
        dwRet = ::GetLastError();
    }
    ::CloseHandle(hSnapshot);
    return dwRet;
}

int main()
{
    std::list<PROCESSENTRY32> listProcessInfo;
    DWORD dwRet = ToolHelp_EnumProcesses(listProcessInfo);
    if(NO_ERROR == dwRet)
    {
        const std::list<PROCESSENTRY32>::const_iterator end = listProcessInfo.end();
        std::list<PROCESSENTRY32>::const_iterator iter = listProcessInfo.begin();
        for (; iter != end; ++iter)
        {
            const PROCESSENTRY32& processEntry = *iter;
            // NOTE: UNICODE & _UNICODE preprocessor constants are defined in this project
            std::wcout << L"Process ID: " << processEntry.th32ProcessID << std::endl;
            std::wcout << L"Exe file name: " << processEntry.szExeFile << std::endl;
            std::wcout << L"Parent process ID: " << processEntry.th32ParentProcessID << std::endl;
            std::wcout << L"Threads count: " << processEntry.cntThreads << std::endl;
            // ...
        }
    }
    else
    {
        std::cout << "ToolHelp_EnumProcesses falied. Error: " << dwRet << std::endl;
        return dwRet;
    }
	return 0;
}

Resources and related articles

• MSDN: Tool Help Library
• MSDN: Taking a Snapshot and Viewing Processes
• Codexpert: Listing Processes – Part 3: Using Tool Help Library

[ovidiucucu]

A: Also we can use WTSEnumerateProcesses or WTSEnumerateProcessesEx from Remote Desktop Services API (formerly known as Windows Terminal Services API).

Example

#include <iostream>
#include <list>
#include <string>
#include <Windows.h>
// Windows Terminal Server API header & lib 
#include <Wtsapi32.h>
#pragma comment(lib, "Wtsapi32.lib")

class CProcessInfo
{
    DWORD m_dwProcessId;
    DWORD m_dwSessionId;
    std::wstring m_strProcessName;
public:
    CProcessInfo(WTS_PROCESS_INFO& processInfo)
        : m_dwProcessId(processInfo.ProcessId),
        m_dwSessionId(processInfo.SessionId),
        m_strProcessName(processInfo.pProcessName)
    {
    }
    DWORD GetProcessId() const {return m_dwProcessId;}
    DWORD GetSessionId() const {return m_dwSessionId;}
    std::wstring GetProcessName() const {return m_strProcessName;}
};

DWORD RDSAPI_EnumProcesses(std::list<CProcessInfo>& listProcessInfo)
{
    listProcessInfo.clear(); // clear output array
    HANDLE hServer = WTS_CURRENT_SERVER_HANDLE; // local machine processes
    PWTS_PROCESS_INFO pProcessInfo = NULL;
    DWORD dwCount = 0;
    // enumerate processes
    if (!::WTSEnumerateProcesses(hServer, 0, 1, &pProcessInfo, &dwCount))
    {
        return ::GetLastError();
    }
    // push processes info into the output list
    for (DWORD dwIndex = 0; dwIndex < dwCount; dwIndex++)
    {
        CProcessInfo processInfo(pProcessInfo[dwIndex]);
        listProcessInfo.push_back(processInfo);
    }
    // free the memory allocated in WTSEnumerateProcesses
    ::WTSFreeMemory(pProcessInfo);
    return NO_ERROR;
}

int main()
{
    std::list<CProcessInfo> listProcessInfo;
    DWORD dwRet = RDSAPI_EnumProcesses(listProcessInfo);
    if (NO_ERROR == dwRet)
    {
        const std::list<CProcessInfo>::const_iterator end = listProcessInfo.end();
        std::list<CProcessInfo>::const_iterator iter = listProcessInfo.begin();
        for (; iter != end; ++iter)
        {
            const CProcessInfo& processInfo = *iter;
            std::wcout << L"Process ID: " << processInfo.GetProcessId() << std::endl;
            std::wcout << L"Process name: " << processInfo.GetProcessName() << std::endl;
            std::wcout << L"Session ID: " << processInfo.GetSessionId() << std::endl;
        }
    }
    else
    {
        std::wcout << L"RDSAPI_EnumProcesses failed. Error: " << dwRet << std::endl;
        return dwRet;
    }
    return 0;
}

Resources and related articles

• MSDN: Remote Desktop Services
• MSDN: WTSEnumerateProcesses function
• Codexpert: Listing Processes – Part 4: Using Remote Desktop Services API