Determine Process Start Time

Question:

Is there a way in WB and its assorted extenders to determine the start time of a particular process (e.g., the way you can see this info using SysInternal's Process Explorer)?

Answer:

Unfortunately, that's one of the things that the Process extender is lacking in.

I do know how to obtain the information, though, but it involves using DllCall() to make use of the Win32 API function GetProcessTimes() in KERNEL32.DLL. This function requires a process handle be passed to it, and you might be able to get the prcoess handle via the Process extender; otherwise, you have to call the OpenProcess() API function via DllCall() in order to obtain the necessary process handle from a PID.

;************************************************************************************
;
;   Given a process handle, return the process start time. (YmdHms format)
; 
;   Returns "" if the function fails.
;
;************************************************************************************
#DefineFunction ProcessStartTime(Handle)
K32 = DllLoad(strcat(dirwindows(1),"Kernel32.DLL"))
T1 = BinaryAlloc(8)
T2 = BinaryAlloc(8)
T3 = BinaryAlloc(8)
T4 = BinaryAlloc(16)
if DllCall(K32,long:"GetProcessTimes",long:Handle,lpBinary:T1,lpBinary:T2,lpBinary:T3,lpBinary:T4)
    DllCall(K32,lpstr:"FileTimeToLocalFileTime",lpbinary:T1, lpbinary:T2)
    DllCall(K32,lpstr:"FileTimeToSystemTime",lpbinary:T2, lpbinary:T4)
    Time = StrFixLeft(BinaryPeek2(T4,0),"0",4)
    Time = StrCat(Time,":",StrFixLeft(BinaryPeek2(T4,2),"0",2))
    Time = StrCat(Time,":",StrFixLeft(BinaryPeek2(T4,6),"0",2))
    Time = StrCat(Time,":",StrFixLeft(BinaryPeek2(T4,8),"0",2))
    Time = StrCat(Time,":",StrFixLeft(BinaryPeek2(T4,10),"0",2))
    Time = StrCat(Time,":",StrFixLeft(BinaryPeek2(T4,12),"0",2))
else
    Time = ""
endif
BinaryFree(T1)
BinaryFree(T2)
BinaryFree(T3)
BinaryFree(T4)
DllFree(K32)
return Time
#EndFunction


Addextender("wwprc44I.dll")

id=tListProc()
list=Askitemlist("List of all current processes", id, @TAB, @UNSORTED, @SINGLE)

; parse off process ID and Name
procid=itemextract(2,list,"|")
procname=itemextract(1,list,"|")
flag=3
ErrorMode(@off)
handle=tOpenProc(procid,flag)
ErrorMode(@cancel)
if handle==0
   Message("Unable to open process",tGetLastError())
   exit
endif

;-------------------------------------------------
;  Example - Get start time of this process.
;-------------------------------------------------
StartTime = ProcessStartTime(Handle)
Message("Start Time",StartTime)

ret=tCloseProc(handle)

Article ID:   W16993

File Created: 2013:04:01:09:16:50

Last Updated: 2013:04:01:09:16:50

	Backups
	Ctrl Alt Del Issues
	Determine Platform - OS
	Get EXE Name
	Get Machine Name - Workstation
	Icons
	Reboot Issues
	Recycle Bin
	Resource Lock
	System Information
	User Profiles

Database Search

TechHome