WINSDK: Determining whether an arbitrary pid identifies a running process on Windows

Question

Attempting to implement a poor man's test of whether a process is still running or not (essentially an equivalent of the trivial kill(pid, 0).)

Hoped to be able to simply call OpenProcess with some minimal desired access then test for either GetLastError() == ERROR_INVALID_PARAMETER or GetExitCodeProcess(...) != STILL_ACTIVE.

Nice try... Running on Windows XP, as administrator:

HANDLE hProc = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid);
if (!hProc) {
  DWORD dwLastError = GetLastError();
}

...fails miserably with dwLastError == ERROR_ACCESS_DENIED when pid is owned by a different (not SYSTEM) user. Moreover, if pid was originally owned by a different user but has since terminated, OpenProcess also fails with ERROR_ACCESS_DENIED (not ERROR_INVALID_PARAMETER.)

Do I have to use Process32First/Process32Next or EnumProcesses?

I absolutely do not want to use SeDebugPrivilege.

Thanks, V

Answer 1

  static bool
  isProcessAlive(int pid) {
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    assert(hSnap != NULL);

    if (!hSnap)
      return false;

    PROCESSENTRY32 pe32 = { sizeof(pe32), 0 };
    BOOL bSuccess = Process32First(hSnap, &pe32);
    assert(bSuccess);

    if (!bSuccess)
      return false;

    while (pe32.th32ProcessID != pid && Process32Next(hSnap, &pe32));
    assert(GetLastError() == 0 || GetLastError() == ERROR_NO_MORE_FILES);
    CloseHandle(hSnap);

    return pe32.th32ProcessID == pid;
  }