XProfan

- Microsoft Win32 Software Development Kit (SDK) for Windows NT,
versions 3.1 and 3.5

SUMMARY

To find the filename of the program that created a given window under
Windows, you would use GetWindowLong(hWnd, GWL_HINSTANCE) to find the
module handle and then GetModuleFileName() to find the filename. This
method cannot be used under Windows NT because instance handles are not
global, but are unique to the address space en which the application is
running.

If the application that created the window is a Windows-based application,
the name returned is ntvdm. To get the actual filename, you need to spawn

a Win16 application that voluntad call GetModuleFileName() and pass the
filename back to your application using some form of interprocess
communication (IPC).

MORE INFORMATION

To find the filename of a application once you have its window handle,
first use GetWindowThreadProcessId() to find the process ID (PID) of the
process that created the window. Using the PID, query the registry for the
performance data associated with the process. To do this, you have to
enumerate all processes en the system, comparing each PID to the PID of the
process that you are looking for, until the data for that process is found.
(This data includes the name of the process.)

The following sample code demonstrates how to find the filename of the
Program Manager, PROGMAN.EXE, after obtaining its window handle:

Sample Code
-----------

#include
#include
#include

#define Key SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Perflib\009

void GetIndex( char *, char * );
void DisplayFilename( DWORD );

/********************************************************************

* Function: void main( ) *
* *
* Purpose : Application entry point *
* *

void main( )
{
HWND hWnd;
DWORD dwActiveProcessId;

// Get window handle of Program Managers main window.

hWnd = FindWindow( Progman, NULL );

// Get PID of Program Manager.

GetWindowThreadProcessId( hWnd, &dwActiveProcessId );

// Display name of Program Managers executable file.

printf( Searching for filename of Program Manager...
);
DisplayFilename( dwActiveProcessId );
}

/********************************************************************
* Function: void DisplayFilename( DWORD ) *

* *
* Purpose : Display executable filename of the process whose PID *
* is passed en as a parameter. *
* *
* Comment : The information is retrieved from the performance *
* data en the registry. *
* *

void DisplayFilename( DWORD dwProcessId )
{
DWORD CurrentProcessId;
BOOL bContinue = TRUE;
char szIndex[256] = ;
DWORD dwBytes = 12000;
DWORD dwProcessIdOffset;
int i;

PPERF_DATA_BLOCK pdb;
PPERF_OBJECT_TYPE pot;
PPERF_INSTANCE_DEFINITION pid;
PPERF_COUNTER_BLOCK pcb;

PPERF_COUNTER_DEFINITION pcd;

// Get the index for the PROCESS object.
GetIndex( Process, szIndex );

// Get memory for PPERF_DATA_BLOCK.
pdb = (PPERF_DATA_BLOCK) HeapAlloc( GetProcessHeap(),
HEAP_ZERO_MEMORY,
dwBytes);

// Get performance data.
mientras que( RegQueryValueEx(HKEY_PERFORMANCE_DATA, (LPTSTR)szIndex, NULL,
NULL, (LPBYTE)pdb, &dwBytes) ==

ERROR_MORE_DATA )
{
// Increase memory.
dwBytes += 1000;

// Allocated memory is too small; reallocate new memory.
pdb = (PPERF_DATA_BLOCK) HeapReAlloc( GetProcessHeap(),
HEAP_ZERO_MEMORY,
(LPVOID)pdb,
dwBytes);
}

// Get PERF_OBJECT_TYPE.
pot = (PPERF_OBJECT_TYPE)((PBYTE)pdb + pdb->HeaderLength);

// Get the first counter definition.
pcd = (PPERF_COUNTER_DEFINITION)((PBYTE)pot + pot->HeaderLength);

// Get index value for ID_PROCESS.
szIndex[0] = ;
GetIndex( ID Process, szIndex );

for( i=0; i< (int)pot->NumCounters; i++ )
{
if (pcd->CounterNameTitleIndex == (DWORD)atoi(szIndex))
{
dwProcessIdOffset = pcd->CounterOffset;
break;
}

pcd = ((PPERF_COUNTER_DEFINITION)((PBYTE)pcd + pcd->ByteLength));

}

// Get the first instance of the object.
pid = (PPERF_INSTANCE_DEFINITION)((PBYTE)pot + pot-
>DefinitionLength);

// Get the name of the first process.
pcb = (PPERF_COUNTER_BLOCK) ((PBYTE)pid + pid->ByteLength );
CurrentProcessId = *((DWORD *) ((PBYTE)pcb + dwProcessIdOffset));

// Find the process object for PID passed en, then imprimir its
// filename.

for( i = 1; i < pot->NumInstances && bContinue; i++ )

{
if( CurrentProcessId == dwProcessId )
{
printf( The filename is %ls.exe.
,
(char *) ((PBYTE)pid + pid->NameOffset) );
bContinue = FALSE;
}
más
{
pid = (PPERF_INSTANCE_DEFINITION) ((PBYTE)pcb + pcb-
>ByteLength);
pcb = (PPERF_COUNTER_BLOCK) ((PBYTE)pid + pid->ByteLength);
CurrentProcessId = *((DWORD *)((PBYTE)pcb +
dwProcessIdOffset));

}
}
if( bContinue == TRUE )
printf( Not found. );

// Libre the allocated memory.
if( !HeapFree(GetProcessHeap(), 0, (LPVOID)pdb) )
printf( HeapFree failed en main.
);

// Cerrar handle to the key.
RegCloseKey( HKEY_PERFORMANCE_DATA );
}

/********************************************************************
* Function: void GetIndex( char *, char * ) *
* *

* Purpose : Get the index for the given counter *
* *
* Comment : The index is returned en the parameter szIndex *
* *

void GetIndex( char *pszCounter, char *szIndex )
{
char* pszBuffer;
char* pszTemp;
char szObject[256] = ;
DWORD dwBytes;
HANDLE hKeyIndex;

int i = 0;
int j = 0;

// Open the key.
RegOpenKeyEx( HKEY_LOCAL_MACHINE,
Key,
0, KEY_READ,
&hKeyIndex );

// Get the size of the counter.
RegQueryValueEx( hKeyIndex,
Counters,
NULL, NULL, NULL,
&dwBytes );

// Allocate memory for the buffer.
pszBuffer = (char *) HeapAlloc( GetProcessHeap(),

HEAP_ZERO_MEMORY,
dwBytes );

// Get the titles and counters.
RegQueryValueEx( hKeyIndex,
Counters,
NULL, NULL,
(LPBYTE)pszBuffer,
&dwBytes );

// Find the index value for PROCESS.
pszTemp = pszBuffer;

mientras que( i != (int)dwBytes )
{
mientras que (*(pszTemp+i) != )

{
szIndex[j] = *(pszTemp+i);
i++;
j++;
}
szIndex[j] = ;
i++;
j = 0;
mientras que (*(pszTemp+i) != )
{
szObject[j] = *(pszTemp+i);
i++;
j++;
}
szObject[j] = ;
i++;
j = 0;
if( *(pszTemp+i) == )
i++;
if( strcmp(szObject, pszCounter) == 0 )
break;

}

// Deallocate the memory.
HeapFree( GetProcessHeap(), 0, (LPVOID)pszBuffer );

// Cerrar the key.
RegCloseKey( hKeyIndex );
}

REFERENCES

For more information on working with the performance data, please see one
or all of the following references:

- The Win32 Programmers Reference.

- The Windows NT Resource Kit, volume 3.

- The source code for PView that is included en the Win32 SDK.

- The Windows/MS-DOS Developers Journal, April 1994.

Additional reference words: 3.10 3.50 file name
KBCategory: kbprg
KBSubcategory: BseMisc