Question

Attempting to implement a poor man’s test of whether a process is still running or not (essentially an equivalent of the trivial kill(pid, 0).)

Hoped to be able to simply call OpenProcess with some minimal desired access then test for either GetLastError() == ERROR_INVALID_PARAMETER or GetExitCodeProcess(...) != STILL_ACTIVE.

Nice try… Running on Windows XP, as administrator:

HANDLE hProc = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid);
if (!hProc) {
  DWORD dwLastError = GetLastError();
}

…fails miserably with dwLastError == ERROR_ACCESS_DENIED when pid is owned by a different (not SYSTEM) user. Moreover, if pid was originally owned by a different user but has since terminated, OpenProcess also fails with ERROR_ACCESS_DENIED (not ERROR_INVALID_PARAMETER.)

Do I have to use Process32First/Process32Next or EnumProcesses?

I absolutely do not want to use SeDebugPrivilege.

Thanks,
V

Answer 1

static BOOL
isProcessAlive(DWORD th32ProcessID) {
  BOOL bSuccess = FALSE;

  HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  if (hSnap != INVALID_HANDLE_VALUE) {
    PROCESSENTRY32 pe32 = { sizeof(pe32), 0 };
    if (Process32First(hSnap, &pe32)) {
      while (pe32.th32ProcessID != pid && Process32Next(hSnap, &pe32));
      _ASSERT(GetLastError() == 0 || GetLastError() == ERROR_NO_MORE_FILES);
      bSuccess = (pe32.th32ProcessID == th32ProcessID);
    }
    CloseHandle(hSnap);
  }
  return bSuccess;
}