Verify Calling Parent Process

Keywords: Detect Determine Application Program Process Launched Ran Spawned Parent Child Calling Current Module Name WinExeName ZwQueryInformationProcess GetCurrentProcess GetCurrentProcessId

Question:

How can I instruct a WinBatch script (EXE) to first check that it was launched by a specific calling process name? (and if not, I want it to exit with maybe a popup message). I can handle the situations on how it would react in either case, but I just don't know how to verify the calling process name). I want to restrict the user from double-clicking the EXE and only let it be run by another application (which I'll know the name specifically and can hard-code it into the script).

Answer:

Attached is a test script that gets the PID of the parent process that spawned the current process. If the parent process no longer exists then the script will end up failing, but if the parent does exist and the child has rights to identify the parent process' module name, then the test can be performed as desired to validate the parent process' module name.

GETPARENTPROCID.WBT - Get parent process info

; GetParentProcId.wbt
; 32-bit
;
; This script makes use of one of the Win32 Kernel API functions to obtain the current process' parent process id number.
; The parent process' id can then be used to get information about the parent process.


#DefineFunction udfGetMyParentProcId()

; Get a pseudo-handle to our own process.

hMyProc = DllCall('KERNEL32.DLL',long:'GetCurrentProcess')

; Set up the input parameters for ZwQueryInformationProcess().

nProcInfoBufSize = 6 * 4

hProcInfoBuf = BinaryAlloc(nProcInfoBufSize)

ProcessBasicInformation = 0

Result = DllCall('NTDLL.DLL',long:'ZwQueryInformationProcess',long:hMyProc,long:ProcessBasicInformation,lpbinary:hProcInfoBuf,long:nProcInfoBufSize,lpnull)

BinaryEodSet(hProcInfoBuf,nProcInfoBufSize)

nMyProcId = BinaryPeek4(hProcInfoBuf,16)

nMyParentProcId = BinaryPeek4(hProcInfoBuf,20)

; Sanity check - get our own process id by another method.

nMyProcId2 = DllCall('KERNEL32.DLL',long:'GetCurrentProcessId')

hProcInfoBuf = BinaryFree(hProcInfoBuf)


Return nMyParentProcId

#EndFunction


#DefineFunction IsMyParentAConsole()

MyParentProcId = udfGetMyParentProcId()

MyParentMods = tListMod(MyParentProcId,1)

ConsoleModName = StrLower(StrCat(DirWindows(1),'CMD.EXE'))

bResult = @FALSE

nCount = ItemCount(MyParentMods,@TAB)

For nIndex = 1 To nCount
  ModName = StrLower(ItemExtract(nIndex,MyParentMods,@TAB))
  If (ModName == ConsoleModName)
    bResult = @TRUE
    Break
  EndIf
Next


Return bResult

#EndFunction


AddExtender('wwprc44I.dll')

Title01 = 'Get Parent Process Id'

Result = IsMyParentAConsole()

Message(Title01,StrCat('Is my parent process a console?  Result = ',Result))


Exit

Article ID:   W17026

File Created: 2013:04:01:09:17:06

Last Updated: 2013:04:01:09:17:06

	Backups
	Ctrl Alt Del Issues
	Determine Platform - OS
	Get EXE Name
	Get Machine Name - Workstation
	Icons
	Reboot Issues
	Recycle Bin
	Resource Lock
	System Information
	User Profiles

Database Search

TechHome