i'm currently using this code to get the list of processes on remote computers. I get name and pid of these processes but i'd like to know who's owning them. Any idea how to get that information ? Thanks.
Code: Select all
#COINIT_MULTITHREAD=0
#RPC_C_AUTHN_LEVEL_CONNECT=2
#RPC_C_IMP_LEVEL_IDENTIFY=2
#EOAC_NONE=0
#RPC_C_AUTHN_WINNT=10
#RPC_C_AUTHZ_NONE=0
#RPC_C_AUTHN_LEVEL_CALL=3
#RPC_C_IMP_LEVEL_IMPERSONATE=3
#CLSCTX_INPROC_SERVER=1
#wbemFlagReturnImmediately=16
#wbemFlagForwardOnly=32
#IFlags = #wbemFlagReturnImmediately + #wbemFlagForwardOnly
#WBEM_INFINITE=$FFFFFFFF
Global WMITask$
Global WMINbrProp.l
Global Dim WMIPropertie$(1)
;********************************
Procedure.l ansi2bstr(ansi.s)
size.l=MultiByteToWideChar_(#CP_ACP,0,ansi,-1,0,0)
Dim unicode.w(size)
MultiByteToWideChar_(#CP_ACP, 0, ansi, Len(ansi), unicode(), size)
ProcedureReturn SysAllocString_(@unicode())
EndProcedure
;********************************
Procedure bstr2string (bstr)
Shared result.s
result.s = ""
pos=bstr
While PeekW (pos)
result=result+Chr(PeekW(pos))
pos=pos+2
Wend
ProcedureReturn @result
EndProcedure
;*********************************************************
Procedure.s CallWMI(Hostname$)
CoInitializeEx_(0,#COINIT_MULTITHREAD)
hres=CoInitializeSecurity_(0, -1,0,0,#RPC_C_AUTHN_LEVEL_CONNECT,#RPC_C_IMP_LEVEL_IDENTIFY,0,#EOAC_NONE,0)
If hres = 0
hres=CoCreateInstance_(?CLSID_WbemLocator,0,#CLSCTX_INPROC_SERVER,?IID_IWbemLocator,@loc.IWbemLocator)
If hres = 0
hres=loc\ConnectServer(ansi2bstr("\\" + Hostname$ + "\root\cimv2"),0,0,0,0,0,0,@svc.IWbemServices)
If hres = 0
hres=svc\queryinterface(?IID_IUnknown,@pUnk.IUnknown)
hres=CoSetProxyBlanket_(svc,#RPC_C_AUTHN_WINNT,#RPC_C_AUTHZ_NONE,0,#RPC_C_AUTHN_LEVEL_CALL,#RPC_C_IMP_LEVEL_IMPERSONATE,0,#EOAC_NONE)
If hres = 0
hres=CoSetProxyBlanket_(pUnk,#RPC_C_AUTHN_WINNT,#RPC_C_AUTHZ_NONE,0,#RPC_C_AUTHN_LEVEL_CALL,#RPC_C_IMP_LEVEL_IMPERSONATE,0,#EOAC_NONE)
If hres = 0
pUnk\release()
hres=svc\ExecQuery(ansi2bstr("WQL"),ansi2bstr(WMITask$), #IFlags,0,@pEnumerator.IEnumWbemClassObject)
If hres = 0
hres=pEnumerator\reset()
Repeat
hres=pEnumerator\Next(#WBEM_INFINITE, 1, @pclsObj.IWbemClassObject, @uReturn)
For i=0 To WMINbrProp-1
mem=AllocateMemory(1000)
hres=pclsObj\get(ansi2bstr(WMIPropertie$(i)), 0, mem, 0, 0)
type=PeekW(mem)
Select type
Case 11
v=PeekL(mem+8)
If v=0
val.s="FALSE"
Else
val.s="TRUE"
EndIf
Case 8
val.s=PeekS(bstr2string(PeekL(mem+8)))
Case 3
val.s=Str(PeekL(mem+8))
Default
val.s=""
EndSelect
If uReturn <> 0: wmi$=wmi$+val+"~": EndIf
FreeMemory(mem)
Next
Until uReturn = 0
pEnumerator\release()
pclsObj\release()
Else
wmi$ = "ERROR - unable To call IWbemServices::ExecQuery"
EndIf
Else
wmi$ = "ERROR - unable to call CoSetProxyBlanket"
EndIf
Else
wmi$ = "ERROR - unable to call CoSetProxyBlanket"
EndIf
svc\release()
Else
wmi$ = "ERROR - unable to call IWbemLocator::ConnectServer"
EndIf
loc\release()
Else
wmi$ = "ERROR - unable to call CoCreateInstance"
EndIf
Else
wmi$ = "ERROR - unable to call CoInitializeSecurity"
EndIf
CoUninitialize_()
ProcedureReturn wmi$
DataSection
CLSID_IEnumWbemClassObject: Data.l $1B1CAD8C : Data.w $2DAB, $11D2 : Data.b $B6, $04, $00, $10, $4B, $70, $3E, $FD
IID_IEnumWbemClassObject: Data.l $7C857801 : Data.w $7381, $11CF : Data.b $88, $4D, $00, $AA, $00, $4B, $2E, $24
CLSID_WbemLocator: Data.l $4590F811 : Data.w $1D3A, $11D0 : Data.b $89, $1F, $00, $AA, $00, $4B, $2E, $24
IID_IWbemLocator: Data.l $DC12A687 : Data.w $737F, $11CF : Data.b $88, $4D, $00, $AA, $00, $4B, $2E, $24
IID_IUnknown: Data.l $00000000 : Data.w $0000, $0000 : Data.b $C0, $00, $00, $00, $00, $00, $00, $46
EndDataSection
EndProcedure
;*********************************************************
Host$ = "ThisComputer" ;<---- the computer you want to query
WMITask$ = "SELECT * FROM Win32_Process"
WMINbrProp.l = 2
Dim WMIPropertie$(WMINbrProp-1)
WMIPropertie$(0) = "Name"
WMIPropertie$(1) = "ProcessId"
WMIText$ = CallWMI(Host$)
If Left(WMIText$,5) = "ERROR"
Debug WMIText$
Else
NbrLines = CountString(WMIText$, "~")
For counter = 1 To NbrLines Step 2
PName$ = StringField(WMIText$, counter, "~")
PID$ = StringField(WMIText$, counter+1, "~")
Debug "Process = " + PName$ + " (PID=" + PID$ + ")"
Next
EndIf
End
