How to determine a child's parent process?

[Jaytex]

I have seen in the code bank .net solutions to determine the parent’s id from the child process. Is there a VB6 solution?
When I use CreateProcess (for a third party EXE) in VB I am able to determine the new process ID of the child process. If this child process now creates a new process, the grandchild process will have a new process ID. Since I have no access to the third party code I can only work from the list of active processes and need a method to determine from the list of active processes, which parent spawn it.

[Edgemeal]

Have you tried the GetParent API?

Parent_hWnd = GetParent(Child_hWnd)

And/or search forum for examples using, GetWindowThreadProcessId

[RhinoBull]

I have seen in the code bank .net solutions to determine the parent’s id from the child process. Is there a VB6 solution?

Have a look at this: Enumerate to Determine an App's Parent Process.

[Jaytex]

Have a look at this: Enumerate to Determine an App's Parent Process.

If I had access to the third party software this would work fine. I tried replacing the currentprocessid entry with GetWindowThreadProcessId(of each handle) but nothing of any use at the momemt. At least it gives me another approach to attach my problem with.

[Jaytex]

Have you tried the GetParent API?

Parent_hWnd = GetParent(Child_hWnd)

And/or search forum for examples using, GetWindowThreadProcessId

GetParent returned a 0 value for most handles, even the window box created by the child process.

[LaVolpe]

GetParent very well may return zero if it is a top level window.

Here's my thoughts. If RhinoBull's example will return parent process of a process, you can do this a bit in reverse or recursively.

1. You know the process handle of the process you created.
2. Use RhinoBull's example to see if any of the returned processes' Parent is your process handle
3. If so, repeat, using that child's process handle as the new "parent"
4. Keep repeating until no more child processes found.

[Jaytex]

I ran Microsoft's Spy ++ and confirmed I have no parents to any of my processes so returns had to be zero so looping child processes to detect a parent will not help but thanks.

I did create a simple test case of three vb exe files, First_child.exe pops up a form, calls Second_child.exe then outputs a msgbox. Second_child.exe pops up a form, calls Third_child.exe then outputs a msgbox. Third_child.exe outputs a msgbox. Curiously, I did notice that in Spy ++ I found a link for these process and msgboxs. They all had a common value for “Window Proc” found on the “CLASS” tab of the property window. Unfortunately for my project, the children and grandchildren all have different “Window Proc” values.

At least for my present project, the third party software I am executing (in hidden mode) behaves. My work around will be to use the FindWindow function since I do know the pop-up’s title. From here I can execute an API to make that window visible allowing the user to respond using a button on the window.

I’ll keep looking for that allusive link (if one exists) to determine the link between parent and child when children processes are created at the top level. This would allow a more elegant solution.

[whatsup]

hay Jaytex!
i made a spy, it's on the code bank
http://www.vbforums.com/showthread.php?p=3709317
i'm in a thought that it doesn't miss anything,
can list any process/window/component.

i'll be glad if you give it a try and tell me the result.
thanks.

[Jaytex]

Nice program but same results only quicker.

[Jaytex]

I have located a C program which will return the parent process ID from a child's process ID at http://www.codeguru.com/cpp/w-p/win32/article.php/c1437.
The final solution will be a little more complex since several threads can have a common process id.

[whatsup]

ok jaytex, after i understood what you are looking for,
and realized that i also my self wanted to know how to do this,
i started to translate your code,
but then i encounterd a macro that i didn't know exactly what it does.
so i made a quick search, and found that this example uses an undocumented
function that may not be support in the future accorind to MSDN
so i made another search, and surprise:
the solution is very easy, and it almost there in PSpy.
there is a member in on of the structures that PSPy uses,
called ParentProcessID
so you just have to read it too,
PSpy currently display only the ProcessID but not its parent,
its not a problem to display the parent,
but i make it some other time.

[Jaytex]

Glad to hear PSpy might be tweeked to display information about parent infomation. Let me know if you have a chance to update it.
I also looked into what MSDN stated about NtQueryInformationProcess and the GetProcessID function they tell you to use instead just keeps returning a zero for me.
The drawback to the ntparent.exe program is it just works at the process ID level. Since many windows might contrain the same PID, killing the children processes will be fairly easy.

[Jaytex]

WhatsUp, I took a look at PSpy and found that if we access tPE.th32ParentProcessID in module EnumAllProcesses we have a pointer from the child process to the parent process. Since many windows can have a common process, I need to know if PSpy has anyway of finding the owner of a process since there is only one owner and numerous sub-windows which belong to the main window.

[whatsup]

there is an update to PSpy, with parent process support.
about your question if i understood correctly,
before i kill any process/window, i check if it doesn't part of
PSpy process/windows.

for you to learn from the code,
only 2 sub is needed
EnumAllWindows
EnumAllProcess.

if you have any question feel free to ask,
and it better you do this on PSpy thread


EDIT: to find the highest parent process, i didn't wrote a code for this,
(only for the highest window)

but it simple, you just have to scan all processes and when find a parent ID,
start the scan again with this new id.