views:

33

answers:

1

Hi:

I am using CreateProcessAsUser() to make processes. I would like to tag some of them so that later on, given a process ID/handle I can work out whether or not it was I who launched them.

Are there any techniques for marking a process natively like this. I want my solution to be stateless, hence a table of PIDs is not suitable - nor is checking the parent of the process to see if I made it (the processes are reparented).

Any ideas? Thanks!

A: 

if you are targeting Windows Vista or Windows Server 2008, then you may use InitializeProcThreadAttributeList() and add the attribute list to the process through the STARTUPINFOEX structure when calling CreateProcess(). however, you have to destroy the attribute list yourself before the process terminates, and it does not seem to be the case from what i understand...

if the process have a window, you can also use window properties, but here again you have to destroy the property list when the window is destroyed, and you don't control this neither...

i am afraid you will have to resort to something else. can you explain why a table of PIDs is unsuitable ? i suspect it is because your "launcher" may terminate and have to find its processes again when it is restarted. in this case you should consider serializing those informations to disk when starting a process, and read them back when restarting (plus some additional checks to verify the validity of the serialized informations).

Adrien Plisson
Thanks for your ideas Adrien. Yes, you are correct about the concerns around the "launcher" lifetime. Serializing is so clunky, and one would have to have some kind of housekeeping to purge processes which had terminated. As for InitializeProcThreadAttributeList(), I am already using that to be able to reparent the processes that I launch. I don't think you can add arbitrary attributes however, they have to be one of the canonical list.
mrbouffant
you are right, i overlooked the fact that you can't use custom attributes for processes. however, serializing is not so clunky, it would just need a lot of validity checks when reading back the serialized data...
Adrien Plisson