PC Review


Reply
Thread Tools Rating: Thread Rating: 3 votes, 1.00 average.

System.Diagnostics.Process, any way to terminate the specified process AND any child processes which were started by it?

 
 
=?Utf-8?B?RnJhbmsgSm9uZXM=?=
Guest
Posts: n/a
 
      14th Apr 2004
We have some C# code on Windows 2000/XP/2003 that launches a process via the classes in System.Diagnostics, namely ProcessInfo and Process class. The process can get stuck and after a certain timeout we make a call t
System.Diagnostics.Process.Kill(
to terminate the process. However, the process launches other child processes and the Process.Kill() leaves those child processes running. In particular the process we are trying to manage occassionally crashes with Windows exception memory read error and that pops up another dialog box. If you just kill the crashed process, the application popup remains but if you kill process and child processes the application popup also goes away along with the crashed app

In C# code want to terminate the specified process AND any child processes which were started by it, similar to what can be accomplished from the commandline with taskkill.exe (and similarly with windows 2000 era resource kit file rkill.exe)
taskkill.exe /PID 1234 /F /
The same kind of thing can be done with the Task Manager taskmgr.exe in which one can right click on a process in the Processes tab and choose "End Process Tree" instead of "End Process

There is a function NtQueryInformationProcess in the NTDLL.dll with the struct PROCESSINFOCLASS that can be called in such a way as to get InheritedFromUniqueProcessId from the PROCESS_BASIC_INFORMATION
http://www.codeguru.com/Cpp/W-P/win32/article.php/c1437
That gives a "Parent" process ID that can then be used to walk through all processes and kill a tree of processes, that is the information we are looking for that would enable us to locate all child processes and terminate those as well

Is that the only way to obtain the information under Windows (2000, XP, 2003)
Any idea how to make such calls from C#? We are able to make basic calls but calls such as this one that have OUT parameters we have trouble getting to work in C#

Thanks
Fran

 
Reply With Quote
 
 
 
 
Tian Min Huang
Guest
Posts: n/a
 
      15th Apr 2004
Hi Frank,

Thanks for your post. NtQueryInformationProcess is supported in Windows
XP/2000/2003. Based on my experience and research, I did not find other
method to achieve this.

In C#, you can use P/Invoke to call unmanaged APIs. Please refer to the
following MSDN article:

Consuming Unmanaged DLL Functions
http://msdn.microsoft.com/library/de...us/cpguide/htm
l/cpconConsumingUnmanagedDLLFunctions.asp

The article below give several samples on passing structures as In/Out
parameters in P/Invoke:

Marshaling Classes, Structures, and Unions
http://msdn.microsoft.com/library/de...us/cpguide/htm
l/cpconmarshalingclassesstructuresunions.asp

If you have any problems, please feel free to let me know.

Have a nice day!

Regards,

HuangTM
Microsoft Online Partner Support
MCSE/MCSD

Get Secure! -- www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

 
Reply With Quote
 
 
 
 
oaktreepub@hotmail.com
Guest
Posts: n/a
 
      18th Oct 2004
There is an MSDN article in October 2004 MSDN magazine entitled
"Examine Running Processes Using Both Managed and Unmanaged Code".
http://msdn.microsoft.com/msdnmag/is...r/default.aspx

The code download includes a wrapper class, wrapper.cs.

The Wrapper.cs contains examples of calling NtQueryInformationProcess
to get InheritedFromUniqueProcessId which is equivalent to the Parent
Process ID.

Basically the calling code from .NET would look like this:

[DllImport("KERNEL32.DLL")] private static extern int
OpenProcess(eDesiredAccess dwDesiredAccess, bool bInheritHandle, int
dwProcessId);

[DllImport("KERNEL32.DLL")] private static extern int CloseHandle(int
hObject);

[DllImport("NTDLL.DLL")] private static extern int
NtQueryInformationProcess(int hProcess, PROCESSINFOCLASS pic, ref
PROCESS_BASIC_INFORMATION pbi, int cb, ref int pSize);

enum PROCESSINFOCLASS : int
{
ProcessBasicInformation = 0,
ProcessQuotaLimits,
ProcessIoCounters,
ProcessVmCounters,
ProcessTimes,
ProcessBasePriority,
ProcessRaisePriority,
ProcessDebugPort,
ProcessExceptionPort,
ProcessAccessToken,
ProcessLdtInformation,
ProcessLdtSize,
ProcessDefaultHardErrorMode,
ProcessIoPortHandlers, // Note: this is kernel mode only
ProcessPooledUsageAndLimits,
ProcessWorkingSetWatch,
ProcessUserModeIOPL,
ProcessEnableAlignmentFaultFixup,
ProcessPriorityClass,
ProcessWx86Information,
ProcessHandleCount,
ProcessAffinityMask,
ProcessPriorityBoost,
MaxProcessInfoClass
};

[StructLayout(LayoutKind.Sequential)]
public struct PROCESS_BASIC_INFORMATION
{
public int ExitStatus;
public int PebBaseAddress;
public int AffinityMask;
public int BasePriority;
public int UniqueProcessId;
public int InheritedFromUniqueProcessId;

public int Size
{
get { return(6*4); }
}
};

enum eDesiredAccess : int
{
DELETE = 0x00010000,
READ_CONTROL = 0x00020000,
WRITE_DAC = 0x00040000,
WRITE_OWNER = 0x00080000,
SYNCHRONIZE = 0x00100000,
STANDARD_RIGHTS_ALL = 0x001F0000,

PROCESS_TERMINATE = 0x0001,
PROCESS_CREATE_THREAD = 0x0002,
PROCESS_SET_SESSIONID = 0x0004,
PROCESS_VM_OPERATION = 0x0008,
PROCESS_VM_READ = 0x0010,
PROCESS_VM_WRITE = 0x0020,
PROCESS_DUP_HANDLE = 0x0040,
PROCESS_CREATE_PROCESS = 0x0080,
PROCESS_SET_QUOTA = 0x0100,
PROCESS_SET_INFORMATION = 0x0200,
PROCESS_QUERY_INFORMATION = 0x0400,
PROCESS_ALL_ACCESS = SYNCHRONIZE | 0xFFF
}


public static int GetParentProcessId(int PID)
{
int ParentID = 0;

try
{
int hProcess =
OpenProcess(eDesiredAccess.PROCESS_QUERY_INFORMATION, false, PID);
if (hProcess != 0)
{
PROCESS_BASIC_INFORMATION pbi = new
PROCESS_BASIC_INFORMATION();
int pSize = 0;
if (-1 != NtQueryInformationProcess(hProcess,
PROCESSINFOCLASS.ProcessBasicInformation, ref pbi, pbi.Size, ref
pSize))
{
ParentID = pbi.InheritedFromUniqueProcessId;
}

CloseHandle(hProcess);
}
}
catch(Exception e)
{
Trace.WriteLine("Error in GetParentProcessId(): {0}", e.Message);
}

return(ParentID);
}

 
Reply With Quote
 
oaktreepub@hotmail.com
Guest
Posts: n/a
 
      19th Oct 2004
Here is one such implementation of a TreeKill and a GetChildProcessIds
and GetParentProcessId based on the NtQueryInformationProcess and the
PROCESS_BASIC_INFORMATION struct property InheritedFromUniqueProcessId.


----------------------


using System.Collections;
using System.Diagnostics;
using System.Runtime.InteropServices;

/// <summary>
/// Summary description for ProcessTreeKillable.
/// </summary>
public class ProcessUtility
{
public static void KillTree(int processToKillId)
{
// Kill each child process
foreach (int childProcessId in GetChildProcessIds(processToKillId))
{
using (Process child = Process.GetProcessById(childProcessId))
{
child.Kill();
}
}

// Then kill this process
using (Process thisProcess = Process.GetProcessById(processToKillId))
{
thisProcess.Kill();
}
}


public static int GetParentProcessId(int processId)
{
int ParentID = 0;

int hProcess = OpenProcess(eDesiredAccess.PROCESS_QUERY_INFORMATION,
false, processId);

if (hProcess != 0)
{
try
{
PROCESS_BASIC_INFORMATION pbi = new PROCESS_BASIC_INFORMATION();
int pSize = 0;
if (-1 != NtQueryInformationProcess(hProcess,
PROCESSINFOCLASS.ProcessBasicInformation, ref pbi, pbi.Size, ref
pSize))
{
ParentID = pbi.InheritedFromUniqueProcessId;
}
}
finally
{
CloseHandle(hProcess);
}
}

return (ParentID);
}

public static int[] GetChildProcessIds(int parentProcessId)
{
ArrayList myChildren = new ArrayList();

foreach (Process proc in Process.GetProcesses())
{
int currentProcessId = proc.Id;
proc.Dispose();

if (parentProcessId == GetParentProcessId(currentProcessId))
{
// Add this one
myChildren.Add(currentProcessId);

// Add any of its children
myChildren.AddRange(GetChildProcessIds(currentProcessId));
}
}


return (int[]) myChildren.ToArray(typeof (int));
}

#region PInvokes

[DllImport("KERNEL32.DLL")]
private static extern int OpenProcess(eDesiredAccess dwDesiredAccess,
bool bInheritHandle, int dwProcessId);

[DllImport("KERNEL32.DLL")]
private static extern int CloseHandle(int hObject);

[DllImport("NTDLL.DLL")]
private static extern int NtQueryInformationProcess(int hProcess,
PROCESSINFOCLASS pic, ref PROCESS_BASIC_INFORMATION pbi, int cb, ref
int pSize);

private enum PROCESSINFOCLASS : int
{
ProcessBasicInformation = 0,
ProcessQuotaLimits,
ProcessIoCounters,
ProcessVmCounters,
ProcessTimes,
ProcessBasePriority,
ProcessRaisePriority,
ProcessDebugPort,
ProcessExceptionPort,
ProcessAccessToken,
ProcessLdtInformation,
ProcessLdtSize,
ProcessDefaultHardErrorMode,
ProcessIoPortHandlers, // Note: this is kernel mode only
ProcessPooledUsageAndLimits,
ProcessWorkingSetWatch,
ProcessUserModeIOPL,
ProcessEnableAlignmentFaultFixup,
ProcessPriorityClass,
ProcessWx86Information,
ProcessHandleCount,
ProcessAffinityMask,
ProcessPriorityBoost,
MaxProcessInfoClass
} ;

[StructLayout(LayoutKind.Sequential)]
private struct PROCESS_BASIC_INFORMATION
{
public int ExitStatus;
public int PebBaseAddress;
public int AffinityMask;
public int BasePriority;
public int UniqueProcessId;
public int InheritedFromUniqueProcessId;

public int Size
{
get { return (6*4); }
}
} ;

private enum eDesiredAccess : int
{
DELETE = 0x00010000,
READ_CONTROL = 0x00020000,
WRITE_DAC = 0x00040000,
WRITE_OWNER = 0x00080000,
SYNCHRONIZE = 0x00100000,
STANDARD_RIGHTS_ALL = 0x001F0000,

PROCESS_TERMINATE = 0x0001,
PROCESS_CREATE_THREAD = 0x0002,
PROCESS_SET_SESSIONID = 0x0004,
PROCESS_VM_OPERATION = 0x0008,
PROCESS_VM_READ = 0x0010,
PROCESS_VM_WRITE = 0x0020,
PROCESS_DUP_HANDLE = 0x0040,
PROCESS_CREATE_PROCESS = 0x0080,
PROCESS_SET_QUOTA = 0x0100,
PROCESS_SET_INFORMATION = 0x0200,
PROCESS_QUERY_INFORMATION = 0x0400,
PROCESS_ALL_ACCESS = SYNCHRONIZE | 0xFFF
}

#endregion
}

 
Reply With Quote
 
 
 
Reply

Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to terminate process started using the Shell function John Bradley Microsoft VB .NET 2 28th Aug 2007 04:47 AM
Terminate a child process when parent process is killed =?Utf-8?B?YmFyYnV0eg==?= Microsoft Dot NET Framework 3 9th Jul 2007 10:29 PM
TO FIND TOTAL ORDERS SHIPPED AND NOT SHIPPED AND TOTAL OF AMOUNT WHICH WERE SHIPPED AND WHICH WERE NOT SHIPPED Ashley Microsoft Access Queries 2 3rd Oct 2006 09:18 PM
TO FIND TOTAL ORDERS SHIPPED AND NOT SHIPPED AND TOTAL OF AMOUNT WHICH WERE SHIPPED AND WHICH WERE NOT SHIPPED Ashley Microsoft Access 1 2nd Oct 2006 08:01 PM
Shutting down child processes started using System.Diagnostic.Process Lloyd Gomes via .NET 247 Microsoft Dot NET Framework 1 8th Mar 2005 04:55 AM


Features
 

Advertising
 

Newsgroups
 


All times are GMT +1. The time now is 03:29 PM.