What executable did started my executable?

Question

Is there a reliable way to know what executable has called my executable?

I have a .NET executable but I would like to know who has started my application.

Answer 1

There's an answer to your question http://www.codeproject.com/KB/threads/ParentPID.aspx

In short, you create a snapshot of all processes running with lpfCreateToolhelp32Snapshot(), then iterate through it to find your process (identified by GetCurrentProcessId()) with lpfProcess32First()/lpfProcess32Next(). Once you found your own process, the structure you get gives you process id of the parent process, the one that has run your app.

Once you get parent PID, it is easy to get filename of exe file and other attributes with EnumProcessModules() and GetModuleFileNameEx().

But you can probably just use the code from the link.

Answer 2

Do you want to find this out programmatically? Then you will find these related questions helpful:

• How to get parent process in .NET in managed way
• How can I get the PID of the parent process of my application
• How can a Win32 process get the pid of its parent?

If you simply want to see the parent process you can use Process Explorer from Sysinternals.

Answer 3

Why do you need to know this? Windows doesn't maintain a strict parent process heirarchy like unix does - it records the PID of the parent when a process is created, but when this process goes away it isn't updated (because a process does not track its children, so you can't update it). This means it is possible that the parent process PID points to a process which no longer exists. Even worse, theoretically the process ID can be reused, meaning that the parent process ID can point to a totally different process.