nsProcess plugin

[rxs2k5]

How do I create the following thing
1. remove the loop
2. find the processes to find notepad , wordpad means in mutiple form and single finding
3. kill all the following process after finding it existence

Section /o "Kill process" KillProcess
loop:
${nsProcess::FindProcess} "NoTePad.exe" $R0
StrCmp $R0 0 0 +2
MessageBox MB_OKCANCEL|MB_ICONEXCLAMATION 'Close "notepad" before continue' IDOK loop IDCANCEL end

${nsProcess::KillProcess} "NoTePad.exe" $R0
MessageBox MB_OK "nsProcess::KillProcess$\n$\n\
Errorlevel: [$R0]"
Exec "notepad.exe"
Exec "notepad.exe"
Exec "notepad.exe"
BringToFront
MessageBox MB_OK "Press OK and 3 notepad's windows will be closed"

${nsProcess::KillProcess} "NoTePad.exe" $R0
MessageBox MB_OK "nsProcess::KillProcess$\n$\n\
Errorlevel: [$R0]"

end:
${nsProcess::Unload}
SectionEnd

[oleksa]

error code 603

I'd downloaded this plugin and had tested it. Test install script always returns Error level 603. If I run script single or with calc.exe

Help me please! What does this error mean? Where I can find error code list?

Thank you.
I have Windows XP prof x64.

[Instructor]

Help me please! What does this error mean? Where I can find error code list?

In the Readme.txt Unfortunatelly I can't test it on WinXP x64.

[oleksa]

I've found that EnumProcessModules fails when is called for 64 bit applications (calc.exe is 64-bit application) on 64 bit OS with error

299
ERROR_PARTIAL_COPY
Only part of a ReadProcessMemory or WriteProcessMemory request was completed.

I will try to find solution for this problem.

[oleksa]

Hello Instructor.
It's me again.

Have you tried CreateToolhelp32Snapshot, Process32First, Process32Next functions on NT platforms? It works fine at my comp (I'm administrator). This functions are located in kernel32.dll as MSDN says - no psapi is required and should work on Win95/98, WinNT, Win2000 and Windows XP.

Why OpenProcess and EnumProcessModules are used for NT like OS now (Windows 2000, XP, 2003)? Only for Windows NT 4.0 support?

[{_trueparuex^}]

@oleksa
Could you try this. I removed the PSAPI and OS check and now it's using only the "Win95/98" method.

[oleksa]

Hello {_trueparuex^}

Yes - that sample code (based on CreateToolhelp32Snapshot, Process32First, Process32Next functions) works fine on my comp. To save Windows NT 4.0 compatibility I suggest rewrite OS check from

code:
if (osvi.dwPlatformId == VER_PLATFORM_WIN32_NT)

to

code:
if (osvi.dwPlatformId == VER_PLATFORM_WIN32_NT && osvi.dwMajorVersion <= 4)

This check should be true only on Windows NT (as MSDN says). So on NT will work code that gets processes name with PSAPI.
Windows 95, 98, Me, 2000, 2003 and XP should support Tool help functions.

[{_trueparuex^}]

Good. I have my own NSIS unrelated stuff based on the same code... But there is one major disadvantage in CreateToolhelp32Snapshot method. It doesn't work with file names longer than 15 characters. So trying to kill process with name like this "ThisIsPrettyLongName.exe" won't work. One solution would be simply to limit the file names to 15 characters, but that could cause kill of unintentional processes.

So let's see what Instructor gets up to with.

[Instructor]

oleksa can you test it on the x64

Fixed: WinNT 4.0 by default doesn't have PSAPI.DLL. Code for WinNT/2000/XP has
          been rewritten (using NTDLL.DLL). Note: on WinNT 4.0 process name limited
          to 15 characters.
Changed: error codes.


"nsProcess" plugin v1.4

[oleksa]

Instructor works fine, thank you.
looks for calc.exe (603 if process hasn't been started and 0 if process has been started)
checks does notepad.exe running and closes all three notepads succesfully.

Thank you.

[oleksa]

But there is one major disadvantage in CreateToolhelp32Snapshot method. It doesn't work with file names longer than 15 characters. So trying to kill process with name like this "ThisIsPrettyLongName.exe" won't work.

2 {_trueparuex^}
How could wou know that CreateToolhelp32Snapshot method won't work?

I have test it and all works fine:

code:
PROCESS NAME:  AcroRd32.exe

PROCESS NAME:  devenv.exe

PROCESS NAME:  mspdbsrv.exe

PROCESS NAME:  ThisIsPrettyLongName.exe

I could post test code (from MSDN) here or send you e-mail as you wish.

Good bye.

[{_trueparuex^}]

Originally posted by oleksa
2 {_trueparuex^}
How could wou know that CreateToolhelp32Snapshot method won't work?

I have test it and all works fine:

code:
PROCESS NAME:  AcroRd32.exe

PROCESS NAME:  devenv.exe

PROCESS NAME:  mspdbsrv.exe

PROCESS NAME:  ThisIsPrettyLongName.exe

I could post test code (from MSDN) here or send you e-mail as you wish.

Good bye.

I wasn't aware of this before, but that 15 characters name limitation is only in win2k or older.


@Instructor
That 15 characters name limitation is also in Windows 2000 when using NTDLL.DLL PSAPI didn't have that limitation.

[dienjd]

Instructor,
There is a spyware app with a DLL that has the same name as this plug-in:

http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453097507

This is too bad...I don't know of a way around having your plug-in associated with adware other than renaming it.

Those of you who are already using it may want to rename it to avoid having your installer raise anti-virus/spy flags when running.

[Instructor]

Fixed: removed memory leak in WinNT/2000/XP method.


"nsProcess" plugin v1.5

[CharlesB2]

Originally posted by Instructor
Fixed: removed memory leak in WinNT/2000/XP method.


"nsProcess" plugin v1.5

Hey,

Since recent update of McAfee VirusScan, the use of a previous nsProcess version was detected as a Trojan (generic prockill.a)!! The last version (1.5) does not cause the problem. Thanks a lot!

Cheers