Question

I am writing a program on Windows XP, trying to get the proccess handle of calc.exe. I can assume that the user indeed ran calc.exe, but he might have changed the file name.

Is there a name to get the calc.exe process’s handle even though is name had been changed?

I have found this answer but it doesn’t deal with the case when the naughty user changes the name (for example to calc_new.exe):

How can I get a process handle by its name in C++?

Is there some other property of a Win32 process I can use to find the handle?

Answer 1

You can do this with the following sequence of Win32 API calls:

1. Use Spy++ or something similar to find the class name of the top level window you are targeting.
2. Call FindWindow or EnumWindows to find top-level windows with that class name.
3. Call GetWindowThreadProcessId to find the process ID of each window of interest.
4. Call OpenProcess passing the process ID to get a process handle.