[RESOLVED] Attach Program to Another So If It's Terminated, So Will the Other

[abazabam]

I'm trying to create a program that monitors the activities of the program, and if the monitoring program is terminated, so will the other. I noticed how debuggers do this when they attach themselves to another program, so I would like the code to do something like that.

[abazabam]

I liked the code from http://pscode.com/vb/scripts/ShowCod...41711&lngWId=1, but it was too long and complicated for me. I don't want any debugging stuff. I just want the code to attach the program to another.

[moeur]

Is all you're looking to do is to terminate a VB program when a non-VB program terminates?

You say attach (which you won't have to do) and monitor (what other monitoring will there be?)

[moeur]

You could do something like this:

Option Explicit
 
Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
Private Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long
Private Const WM_CLOSE = &H10
 
Private Sub Form_Unload(Cancel As Integer)
Dim hWndNotepad As Long
 
    'get handle to Notepad
    hWndNotepad = FindWindow("Notepad", vbNullString)
    'close notepad
    If hWndNotepad <> 0 Then _
        SendMessage hWndNotepad, WM_CLOSE, 0, 0
 
End Sub

This program shuts down notepad before exiting.
Also, it lets you know if Notepad is running or not by updating a label

Edit: removed uneeded stuff

[abazabam]

I need a really simple code. Moeur, the code you gave me wouldn't work for what I'm trying to do. If the monitoring program is terminated, the other program will still be running. I'm talking about the monitoring program, not the program that's being monitored.

[moeur]

No, this "monitoring" program terminates the other program (in this case Notepad) when someone closes the monitoring program.

[abazabam]

I know. I want the program so that if the monitoring program is terminated, so will the program being monitored.

[moeur]

OK, I'm confused.
Is the monitoring program a 3rd program, or the one we're writing?

You can just add the above code to the monitoring program and then the monitored program will close when you close the monitoring program.

In this case, Notepad closes when I close my program.

[abazabam]

Okay fine. Let me try to make it simpler. I want it to do exactly what a debugger does, without the debugging stuff. If you attach a program to a debugger and you terminate the debugger, the program being debugged will also be terminated.

[moeur]

and this code does exactly that.

In this case my code goes in the debugger and Notepad is the program being debugged.

Did you try it?

[abazabam]

I guess I could use that, but I wanted it more like this:

Private Declare Function DebugActiveProcess Lib "kernel32" (ByVal dwProcessId As Long) As Long

Private Sub Form_Load()
DebugActiveProcess Shell("c:\myprogram.exe", vbNormalFocus)
End Sub

I got this far, and this is exactly what I wanted except the program being debugged is frozen.

[moeur]

Well, you've got two conflicting requirements.
1. Keep it simple.
2. attach a debugger.

[abazabam]

I know debuggers are very complicated, that's why I just want to know how to use the DebugActiveProcess API to attach the program and not have the program being attached freeze.

[Joacim Andersson]

I'm also very confused. If you don't want to debug the other process why do you want to use the DebugActiveProcess function? That function will suspend all threads in the foreign process and send the current state of the process to your application. You must call the WaitForDebugEvent function and process all debugging events sent to your application. These events include CREATE_PROCESS_DEBUG_EVENT which represent the process currently being debugged. You will then get a CREATE_THREAD_DEBUG_EVENT for each thread started by the process. Furthermore a LOAD_DLL_DEBUG_EVENT is sent for each and every DLL that is loaded in the foreign process memory space.

It's your job to then resume all threads that has been started by the process and also resume the loading of each DLL the process want to load into memory. Until that is done the process will appear frozen since your application has taken over the job normally handled by Windows simply because you're debugging the process.

But then again, you stated that you wanted to start debugging without doing any debugging which to me sounds funny. I assume that you actually just want to monitor the application and unload it when your application ends, or do you wish to end your application when the foreign process ends? This is very confusing indeed.

[abazabam]

Okay, let me explain exactly, what I'm trying to do. I'm just trying to create a time trial wrapper in VB. The monitoring program will monitor how long the program has been running and if the user uses the program too long the monitoring program will close itself and the program. However, the monitoring program can easily be terminated with the program to be monitored still running, so the user can use it as long as he or she wants.

[abazabam]

Can you just give me a code or upload a code to do this? I've always liked my code to be as short and simple as possible, but it's not possible to do that, can you at least make it as short and basic as possible?

[moeur]

What is wrong with using the code I already provided?
I think it is the simplest code that will do the job.
Or, do you need help with the other functions of your monitoring program?

[abazabam]

I just want to use the DebugActiveProcess API in the code. I never really liked SendMessage and FindWindow.

[abazabam]

Maybe I'll just make another post about DebugActiveProcess

[moeur]

I think you are wrong about how a debugee will act when the debugger is shut down. It will continue to run. Here is the simplest debugger I could write. You can see for yourself.

ption Explicit
 
Private isRunning As Boolean
Private ProcessID As Long
 
Private Const PROCESS_ALL_ACCESS = &H100FFF
 
Private Type PROCESS_INFORMATION
    hProcess As Long
    hThread As Long
    dwProcessId As Long
    dwThreadId As Long
End Type
 
Private Type STARTUPINFO
    cb As Long
    lpReserved As String
    lpDesktop As String
    lpTitle As String
    dwX As Long
    dwY As Long
    dwXSize As Long
    dwYSize As Long
    dwXCountChars As Long
    dwYCountChars As Long
    dwFillAttribute As Long
    dwFlags As Long
    wShowWindow As Integer
    cbReserved2 As Integer
    lpReserved2 As Byte
    hStdInput As Long
    hStdOutput As Long
    hStdError As Long
End Type
 
Private Enum ProcessCreationFlags
    DEBUG_PROCESS = &H1
    DEBUG_ONLY_THIS_PROCESS = &H2
    CREATE_SUSPENDED = &H4
    DETACHED_PROCESS = &H8
    CREATE_NEW_CONSOLE = &H10
    NORMAL_PRIORITY_CLASS = &H20
    IDLE_PRIORITY_CLASS = &H40
    HIGH_PRIORITY_CLASS = &H80
    REALTIME_PRIORITY_CLASS = &H100
    CREATE_NEW_PROCESS_GROUP = &H200
    CREATE_UNICODE_ENVIRONMENT = &H400
    CREATE_SEPARATE_WOW_VDM = &H800
    CREATE_SHARED_WOW_VDM = &H1000
    CREATE_FORCEDOS = &H2000
    CREATE_DEFAULT_ERROR_MODE = &H4000000
    CREATE_NO_WINDOW = &H8000000
End Enum
 
Private Declare Function CreateProcess Lib _
    "kernel32" Alias "CreateProcessA" ( _
    ByVal lpApplicationName As String, _
    ByVal lpCommandLine As String, _
    ByVal lpProcessAttributes As Long, _
    ByVal lpThreadAttributes As Long, _
    ByVal bInheritHandles As Long, _
    ByVal dwCreationFlags As Long, _
    ByVal lpEnvironment As Long, _
    ByVal lpCurrentDirectory As String, _
    lpStartupInfo As STARTUPINFO, _
    lpProcessInformation As PROCESS_INFORMATION _
) As Long
 
 
'Debugging event code that identifies the type of
'  debugging event.
Private Const EXCEPTION_DEBUG_EVENT = 1
Private Const CREATE_THREAD_DEBUG_EVENT = 2
Private Const CREATE_PROCESS_DEBUG_EVENT = 3
Private Const EXIT_THREAD_DEBUG_EVENT = 4
 
Private Const LOAD_DLL_DEBUG_EVENT = 6
Private Const UNLOAD_DLL_DEBUG_EVENT = 7
Private Const OUTPUT_DEBUG_STRING_EVENT = 8
Private Const RIP_EVENT = 9
 
Private Const EXCEPTION_BREAKPOINT = &H80000003
Private Const DBG_CONTINUE = &H10002
Private Const DBG_TERMINATE_THREAD = &H40010003
Private Const DBG_TERMINATE_PROCESS = &H40010004
Private Const DBG_CONTROL_C = &H40010005
Private Const DBG_CONTROL_BREAK = &H40010008
Private Const DBG_EXCEPTION_NOT_HANDLED = &H80010001
Private Const EXIT_PROCESS_DEBUG_EVENT = 5
Private Const EXCEPTION_MAXIMUM_PARAMETERS = 15
 
Private Type DEBUG_EVENT
  dwDebugEventCode As Long
  dwProcessId As Long
  dwThreadId As Long
  union(0 To 87) As Byte
End Type
 
    Private Type EXCEPTION_RECORD
       ExceptionCode As Long
       ExceptionFlags As Long
       pExceptionRecord As Long    ' Pointer to an EXCEPTION_RECORD structure
       ExceptionAddress As Long
       NumberParameters As Long
       ExceptionInformation(EXCEPTION_MAXIMUM_PARAMETERS) As Long
    End Type
    
    Private Type EXCEPTION_DEBUG_INFO
        pExceptionRecord As EXCEPTION_RECORD
        dwFirstChance As Long
    End Type
 
Private Declare Function OpenProcess Lib "kernel32" ( _
    ByVal dwDesiredAccess As Long, _
    ByVal bInheritHandle As Long, _
    ByVal dwProcessId As Long _
) As Long
 
Private Declare Function WaitForDebugEvent Lib "kernel32" ( _
    lpDebugEvent As DEBUG_EVENT, _
    ByVal dwMilliseconds As Long _
) As Integer 'Bool
 
Private Declare Function DebugActiveProcess Lib "kernel32" ( _
    ByVal dwProcessId As Long _
) As Long
 
Private Declare Function DebugActiveProcessStop Lib "kernel32" ( _
    ByVal dwProcessId As Long _
) As Long
 
Private Declare Function ContinueDebugEvent Lib "kernel32" ( _
    ByVal dwProcessId As Long, _
    ByVal dwThreadId As Long, _
    ByVal dwContinueStatus As Long _
) As Long
 
Private Declare Function CloseHandle Lib "kernel32" ( _
    ByVal hObject As Long _
) As Long
 
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" ( _
    Destination As Any, _
    Source As Any, _
    ByVal Length As Long _
)
 
Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" ( _
    ByVal lpClassName As String, _
    ByVal lpWindowName As String _
) As Long
 
Private Declare Function GetWindowThreadProcessId Lib "user32" ( _
    ByVal hwnd As Long, _
    lpdwProcessId As Long _
) As Long
 
Private Sub Command1_Click()
    Dim hWndNtPD As Long
    Dim hProc As Long
    
    'get handle to Window if it is open
    hWndNtPD = FindWindow("SciCalc", vbNullString)
    
    'if program has not started then start it
    If hWndNtPD = 0 Then
        Dim PINFO As PROCESS_INFORMATION
        Dim si As STARTUPINFO
    
        si.cb = Len(si)
        If CreateProcess(vbNullString, "C:\Windows\system32\calc.exe", 0&, 0&, 0&, _
            DEBUG_ONLY_THIS_PROCESS, 0&, _
            vbNullString, si, PINFO) Then
                ProcessID = PINFO.dwProcessId
                hProc = PINFO.hProcess
        Else
            MsgBox "CreateProcess failed"
            Exit Sub
        End If
        
    Else
        'program is already running, open its process
        If GetWindowThreadProcessId(hWndNtPD, ProcessID) = 0 Then
            MsgBox "Error Getting ProcessID"
            Exit Sub
        End If
    
        hProc = OpenProcess(PROCESS_ALL_ACCESS, 0&, ProcessID)
        If hProc = 0 Then
            MsgBox "Error Opening process"
            Exit Sub
        End If
        
        If DebugActiveProcess(ProcessID) = 0 Then
            CloseHandle hProc
            MsgBox "Error Attaching Debugger"
            Exit Sub
        End If
 
        
    End If
    
'    The debug loop.  Runs until the debuggee terminates
   Dim dbgevent As DEBUG_EVENT
   Dim dwContinueStatus As Long
    isRunning = True
    Do
        'wait here for 100ms for debug event
        If WaitForDebugEvent(dbgevent, 100) Then
            Debug.Print "Debug Event: "; dbgevent.dwDebugEventCode
            
            If dbgevent.dwDebugEventCode = EXCEPTION_DEBUG_EVENT Then
                dwContinueStatus = HandleException(dbgevent)
            Else
                dwContinueStatus = DBG_CONTINUE
            End If
            'continue debugging
            Call ContinueDebugEvent(dbgevent.dwProcessId, _
                            dbgevent.dwThreadId, _
                                    dwContinueStatus)
        Else
            'no debug event occurred
            DoEvents
        End If
    Loop While (dbgevent.dwDebugEventCode <> EXIT_PROCESS_DEBUG_EVENT) And isRunning
    
    isRunning = False
    
End Sub
 
Private Sub Form_Unload(Cancel As Integer)
    isRunning = False
    DebugActiveProcessStop ProcessID
End Sub
 
Private Function HandleException(dbgevent As DEBUG_EVENT) As Long
    Dim dwContinueStatus As Long
    
    Dim exceptRec As EXCEPTION_RECORD
    Dim Exception As EXCEPTION_DEBUG_INFO
    Call CopyMemory(Exception, dbgevent.union(0), Len(Exception))
    Call CopyMemory(exceptRec, Exception.pExceptionRecord, Len(exceptRec))
        Debug.Print
        Debug.Print "Exception code: ";
        Debug.Print Hex(exceptRec.ExceptionCode); "  Addr: ";
        Debug.Print Hex(exceptRec.ExceptionAddress)
 
    ' If it isn't a breakpoint, we don't want to know about it.
    If exceptRec.ExceptionCode <> EXCEPTION_BREAKPOINT Then
        HandleException = DBG_EXCEPTION_NOT_HANDLED
        Exit Function
    End If
    dwContinueStatus = DBG_CONTINUE
    
    HandleException = dwContinueStatus
 
End Function

[abazabam]

Thanks so much! That's exactly what I needed! Are you sure that if you terminate the debugger, the debugged program doesn't terminate, also? It does for this computer and my old computer, too.

[moeur]

Well, I'm using XP which might be different than what you are using. Try it.

[abazabam]

I don't get it. I'm using Windows XP SP2. Maybe you don't understand what I'm talking about. Here's what I did. I copied and pasted your code into VB and then I compiled it to an executable(c:\test.exe). Then I ran test.exe and clicked Command1. I opened the Task Manager, clicked the Processes tab and terminated test.exe. Calc.exe was also terminated.

[moeur]

The problem was that I was running it out of the IDE, once I compiled it it works as you say.
Also I had to remove

DebugActiveProcessStop ProcessID

from the Form_Unload event

Have fun with it.

[abazabam]

How would I terminate Calc.exe using TerminateProcess? I tried "isRunning = False: DebugActiveProcessStop ProcessID: TerminateProcess ProcessID, 0", but it didn't work.

[moeur]

This code I gave you terminates calc.exe when it is closed; right?


Your method should be

TerminateProcess hProc,0

Check out this thread for many ways to kill a program
http://www.vbforums.com/showthread.p...minate+process
and this one
http://www.vbforums.com/showthread.p...minate+process

[abazabam]

You were right. It was hProc not ProcessId. Also, how do I lock calc.exe after I have ran the process? It's for my trial wrapping program, so I need it so that no one can copy and paste calc.exe to somewhere else, easily.(My program to be protected will be in the place of calc.exe). I tried using "Lock #FileNum", CreateFile, and OpenFile, but none of them worked. Also, If I didn't even have the calc.exe window open, I don't even need to use DebugActiveProcess?

[dglienna]

You'll still be able to start the 'calc' program without starting your debug program, so what is the point if it's a trial program? Won't they see the other .exe?

[moeur]

I don't think you can lock a file.
You could just rename it, move it to another directory and hide it.

BTW I think you owe me one here so why not rate my post?

Gotta get to that 100 mark so I've resorted to begging

[Joacim Andersson]

Stop whining moeur... I've tried to give you some rep points here but I can't since I've done it already... Maybe not in this thread but I need to spread it around a bit... So why don't you start giving me some rep points as well

[abazabam]

It doesn't matter if you can see the .exe as long as it can't be copied somewhere else. As soon as the trial is over, or the program is exited, the debugging program will delete the .exe. It's not even close to being foolproof but I'm trying my best.

[abazabam]

Actually, I can't seem to delete the file after I stop debugging it. I tried, "isRunning = False", "DebugActiveProcessStop ProcessID", "DebugActiveProcessStop hProc", and "TerminateProcess hProc, 0" but they didn't work.