Question

I’m trying to load a process list, and it functions correctly on 32bit python. However, on 64bit, I can’t get the process name to list. The code is below. If I change szExeFile’s structure from a c_char, to c_int or long, the process list enumerate, but I have no way of seeing what pid belongs to what exe. How can I get this to function on x64?

from ctypes import *
from ctypes.wintypes import *
import sys


# const variable
# Establish rights and basic options needed for all process declartion / iteration
TH32CS_SNAPPROCESS = 2
STANDARD_RIGHTS_REQUIRED = 0x000F0000
SYNCHRONIZE = 0x00100000
PROCESS_ALL_ACCESS = (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFF)
TH32CS_SNAPMODULE = 0x00000008
TH32CS_SNAPTHREAD = 0x00000004

##  Create object definitions to story information in
class PROCESSENTRY32(Structure):
    _fields_ = [ ( 'dwSize' , c_uint ) , 
                 ( 'cntUsage' , c_uint) ,
                 ( 'th32ProcessID' , c_uint) ,
                 ( 'th32DefaultHeapID' , c_uint) ,
                 ( 'th32ModuleID' , c_uint) ,
                 ( 'cntThreads' , c_uint) ,
                 ( 'th32ParentProcessID' , c_uint) ,
                 ( 'pcPriClassBase' , c_long) ,
                 ( 'dwFlags' , c_uint) ,
                 ( 'szExeFile' , c_char * 260 ) ]

CreateToolhelp32Snapshot= windll.kernel32.CreateToolhelp32Snapshot
Process32First = windll.kernel32.Process32First
Process32Next = windll.kernel32.Process32Next
GetLastError = windll.kernel32.GetLastError
OpenProcess = windll.kernel32.OpenProcess
GetPriorityClass = windll.kernel32.GetPriorityClass
CloseHandle = windll.kernel32.CloseHandle

try:
    hProcessSnap = c_void_p(0)
    hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS , 0 )
    pe32 = PROCESSENTRY32()
    pe32.dwSize = sizeof( PROCESSENTRY32 )
    ret = Process32First( hProcessSnap , pointer( pe32 ) )
    global PROGPid
    PROGPid=False
    while ret:
        print pe32.dwSize,pe32.cntUsage,pe32.th32ProcessID,pe32.th32DefaultHeapID,pe32.th32ModuleID,pe32.cntThreads,pe32.th32ParentProcessID,pe32.pcPriClassBase,pe32.dwFlags,pe32.szExeFile
        hProcess = OpenProcess( PROCESS_ALL_ACCESS , 0 , pe32.th32ProcessID )
        dwPriorityClass = GetPriorityClass( hProcess )
        if dwPriorityClass == 0 :
            CloseHandle( hProcess )
        PROGPid=pe32.th32ProcessID
        ret = Process32Next( hProcessSnap, pointer(pe32) )
        print PROGPid
    CloseHandle ( hProcessSnap )

except:
    print "Error in ListProcessPid"

Answer 1

Your PROCESSENTRY32 structure is wrong. This works for me:

class PROCESSENTRY32(Structure):
    _fields_ = [ ( 'dwSize' , DWORD ) ,
                 ( 'cntUsage' , DWORD) ,
                 ( 'th32ProcessID' , DWORD) ,
                 ( 'th32DefaultHeapID' , POINTER(ULONG)) ,
                 ( 'th32ModuleID' , DWORD) ,
                 ( 'cntThreads' , DWORD) ,
                 ( 'th32ParentProcessID' , DWORD) ,
                 ( 'pcPriClassBase' , LONG) ,
                 ( 'dwFlags' , DWORD) ,
                 ( 'szExeFile' , c_char * 260 ) ]