1.7.1 Applications and Threads

<< Click to Display Table of Contents >>

Navigation:  1. Starting Guides >

1.7.1 Applications and Threads

1.7. Application, PID and TID

Previous Top Next


Starting Guide

 

Applications, PID and TID

Understanding Applications, Processes and Threads

 

clip0533

The running processes and Threads make all things that computers do.

 

What can we do with applications using the robot-scripts?

We can start an application in multiple ways. For example using:

EXA. - Execute Asynchron

EXB. - Execute-Blocking

 

We can kill an application using the commands:

KPN. - Kill Process by Name

 

We can check if an specified application is actually running.

IEP. / NEP. - If-Exists-Process

 

And finally we can enumerate/count all running processes using

FEP. - For-Each-Process

 

Which is less often used.

 

Lets take a look into the task-manager, which applications/processes are currently running:

 

 

graphic

 

 

What we can see is that there are several processes with the same name "iexplore.exe".

But how do we find the one we need?

 

How can we select a specific process/application?

 

Rather then selecting a process "by name", we can use the process-ID (PID).

The PID is a number that is unique to each process. Having the PID, we can work with the process.

 

Using the PID we can do things like:

CPR. - Close-PRocess

 

Find out which user has started the process:

GPU. - Get Process User

 

we can wait until a process ends. Using

WPT. - Wait-Process-Termination

 

If we have just started a process - for example with -

EXE. - Execute Programm

 

then we can use

WPR. - Wait-Process-Running

 

to be sure the process we need is running. A PID is a magic number when dealing with applications and processes. If you have the PID, you can do anything you want with that process. As long as you have the sufficient rights.

 

How do we get the PID from an process or application?

 

1. We may get the PID directly from the starting command. Only starting commands that wait until the process is running, can support filling #pid#. Therefore see the description of the starting command if it supports #pid#.

 

If we use:

 

EXE.?pfad\UltraVNC_1.0.9.6.1_Setup.exe

VAR.$$PID=#pid#

MBX.MY PID is: $$PID

 

we get the PID in the system variable #pid# automatically.

 

2. We get the PID from any window. It doesn't matter if its a Top-Level window or a control (child-window). If we have the window, we can get the PID like this:

 

STW.t|Testapp

' We'll put the PID of the process from that window

' into the variable $$PID using the GDF.-command

GDF.ap|$$PID

 

It does not need to be a Top-Window, it can be any actual localized window, try this

STW.t|Testapp

SCW.c|butto

GDF.ap|$$PID

' Will print the PID in the Debug-Area of the Editor

DBP.$$PID

ENR.

 

3.  We can get the PID from the name of the EXE-File

 

VAR.$$FIL=?exepath\MR01.exe

GDF.fp|$$FIL|$$PID

' Will print the PID in the Debug-Area of the Editor

DBP.$$PID

ENR.

 

or we can use IEF. for that.

 

' Get the PID using IEP.

IEP.Testapp_01.exe

    MBX.#pid#

ELS.

    MBX. That Application is not running!

EIF.

ENR.

 

GDF. works with any process in the Task-Manager, no matter if that process has a window or not.

 

What makes IEP. (If exist process) so powerful?

 

IEP. primarly helps you to find out, if a process is running. For this you can specify the process in several ways, including the use of 3.2 Standard-Search Pattern.

 

Assume you use IEP. to check if there is a process like this:

 

graphic

 

Now IEP. finds such a process. But what is the real name of the process?

sky ... what?

We have just specified "sky". As IEP. uses Standards Search Patterns, any part of thereal name is valid.

The name of the process must only contain that phrase. We get this information if we take a look on the actual stack.

 

graphic

 

IEP. provides us with a lot of information about the found process. In position zero

 

IEP.x64.exe

  MBX. Process ID is: #pid#

EIF.

 

If you have multiple EXE running with the same name, you can specify a number. If the EXE is found, the #pid# is set to the EXE's Process-ID. Please note that #tid# is always set to zero.

 

You can specify a full path, or only the filename or a part of it. If you search for a dll, then the extension ".dll" must be included in the pattern.

 

You can use NEP.,  the negative Form of this command (NEP. - Not Exists Process).

 

If a process is found, valuable information is placed on the actual stack. These include the full name and path of the found executable.

 

appsandpidb4

 

Below are two snapshots of the windows-taskmanager. Skype.exe has the PID (process-id) 4600. Its on the stack on position 02 in the picture above.

The 2312  which is on position 01 (picture above) is the parent-process, that is the process which has started skype.exe.

In the task manager, we can see that this is the PID of the windows-explorer. This way you can find out which process has started another process.

 

If you give IEP. a variable as third parameter, then the stack will not get the full path of the found file. You will find it in the given variable instead.

 

Please note that the 2.4 The global and local Stack as Que or as Stack will influence the sequence in which the items appear on the stack.

 

graphic graphic

 

You can also use IEP. to verify, if a process with a specified PID is alive or not.

To do this, the Syntax is:

 

STS.GLOBAL

IEP.>1234

  MBX.PID 1234 (Filename=$$000) is alive!

EIF.