Question

I need to get a specific instance of a running object (from c#). It is possible that there are multiple instances of this application running. Unfortunately, this app is always registered in the ROT with the exact same name (e.g., “!{DED89DB0-45B6-11CE-B307-0800363A1E02}”). I can iterate through the ROT using techniques shown here and find the unique instance of my app, but when I use the GetObject method on the IRunningObjectTable instance it always returns the first object registered.

Is there any way to get a reference to that specific object? So close, but yet so far…

Answer 1

It is a quite complicated thing and there is no real solution for that. The way we have solved it in one of our projects is the following:

– you need to create and app in C++ (.NET is too high level) that overrides RegisterActiveObject and RevokeActiveObject with your own method, install a hook.
– you need to start the application BEFORE starting your app.
– when the code is started it will listen to events to create new objects in ROT
– your code needs to intercept that (overriding RegisterActiveObject)
– check whether the registering object is the one of your interest
– if it is then you can modify it`s name (e.g. by adding PID at the end) and add to ROT
– now you have e.g. the following element

!{DED89DB0-45B6-11CE-B307-0800363A1E02}
!{DED89DB0-45B6-11CE-B307-0800363A1E02}
!{DED89DB0-45B6-11CE-B307-0800363A1E02}_3365
!{DED89DB0-45B6-11CE-B307-0800363A1E02}_4564

• now the last 2 entries point to different instances of your app, you can get it then from ROT by name. Of course adding PID is just an example, you can modify the name as you wish (as long as is stays unique – that`s the whole point).

  Look into psapi.h and dbghelp.h.

  Good luck,
  Blaise