How to enumerate application windows and processes with Win32 APIs

Summary

One of the things that we often encounter when writing programs is to list all the running programs or processes in the system exactly. Windows Task Manager is one of these programs. It lists both the running desktop applications and all the running processes in the system. So, how do we accomplish such a task in a program? This issue is discussed in detail below.

Enumerate top level (top-level) Windows

Enumerating the top-level windows of the desktop may be easier relative to the enumeration process. The way to enumerate the top-level windows of the desktop is to use the EnumWindows () function. Do not use GetWindow () to create a list of Windows, because complex parent-child and sibling relationships between Windows (Z-order) can cause confusion and inaccurate enumeration results.

EnumWindows () has two parameters, one pointer to the callback function, and the user-defined LPARAM value that invokes the callback function for each desktop window (or top-level window). The callback function then uses the window handle to do some processing, such as adding it to the list. This method guarantees that the enumeration results will not be messed up by the complex hierarchical relationships of the windows, so once the window handle is available, we can get the window title through GetWindowText ().

Enumerating processes

Establishing a System process list is slightly more complex than enumerating the windows. This is mainly because the API functions used are dependent on different Win32 operating systems. In Windows 9x, Windows Me, Windows Professional, and Windows XP, we can use the APIs functions in the TOOLHELP32 library. But in Windows NT, we have to use the APIs function in the PSAPI library, the PSAPI Library is part of the SDK. In this article we will discuss the implementation of all of the above platforms. The accompanying example program wraps the APIs in the library above so that the wrapped function can support all WIN32 operating systems.

Enumerating processes using the TOOLHELP32 library

TOOLHELP32 library functions are in KERNEL32.dll, they are standard API functions. However, Windows NT 4.0 does not provide these letters.

There are a variety of functions in the TOOLHELP32 library that can be used to enumerate processes, threads, and get memory and module information from the system. The enumeration process takes only the following three functions: CreateToolhelp32Snapshot (), Process32First (), and Process32Next ().

The first step in using the TOOLHELP32 function is to create the system Information "snapshot" using the CreateToolhelp32Snapshot () function. This function allows you to choose the type of information stored in the snapshot. If you're just interested in process information, just include the th32cs_snapprocess flag. The CreateToolhelp32Snapshot () function returns a HANDLE that must be passed to CloseHandle () after the call is completed.

The next step is to call the Process32First function, get the list of processes from the snapshot, and then call Process32Next again until the function returns FALSE. This traverses the list of processes in the snapshot. Both of these functions take two parameters, which are snapshot handles and a PROCESSENTRY32 structure respectively.

After you call Process32First or Process32Next, PROCESSENTRY32 contains critical information about a process in your system. Where the process ID is stored in the th32processid of this structure. This ID can be passed to the OpenProcess () API to obtain a handle to the process. The corresponding executable file name and its storage path are stored in the Szexefile struct member. Other useful information can also be found in this structure.

Note: Before calling Process32First (), be sure to remember to set the dwsize member of the PROCESSENTRY32 structure to sizeof (PROCESSENTRY32).