How can I get child processes handles, knowing the handle of the parent process?

Admin 1
Viewed 401

On windows 10, I would like to suspend a whole process tree using NtSuspendProcess on each of the children/grand-children processes.

I am starting the parent process using exec.Command("java", ...) and the process tree should look like:

myapp (executes cmd.Start())
   \__java (parent)
        \__java
             |__proc1
             \__proc2

I am able to retrieve the process parent handle uintptr with:

cmd := exec.Command("java", ...)
cmd.Start()
// mirror os.Process struct
type osprocmirror struct {
    Pid    int
    handle uintptr
    isdone uint32
    sigMu  sync.RWMutex
}
handle := (*osprocmirror)(unsafe.Pointer(cmd.Process))

I can't figure out how I can retrieve the handles of the child processes from the parent handle (or pid), in order to suspend them individually.
(since the option to suspend all together parent and children processes does not exist, I should suspend one by one right?)

  • I tried by listing all processes and then selecting only the ones with the the correct parent pid , but I cannot find a way to reliably get the parent pid by knowing the child pid (plus there would be problems in case of grandchildren processes, plus I would prefer working exclusively with handles which should be more reliable).
  • I tried to create a job into which the first process is spawned, in order to be able to list all the child pids/handles using the job's handle, but it's quite complex and would need some low level implementations (which do not fit well with os.exec package).
  • I found a windows function from user32.dll called EnumChildWindows and started to implement it, but since I did not understand how it works completely (does it only work with processes that have graphical windows? because I'm not working with GUI at all), I wanted to know other possible solutions (maybe easier).

Is there a simpler way of getting all the children processes handles from the parent handle?
If not, do you have some good example for this sort of implementation?

Thank you

go handle parent-child process windows
1 Answers

I created a small script that does exactly that (check here)
I'll post it here:

// This is a script to retrieve the child processes pids of a process (retrieve the complete process tree)
// Tn this example the process identified by pid 7400 is used
// (please to run the test chose a process pid that has at least 1 child process)
// (tested on windows)

package main

import (
    "fmt"
    "syscall"
    "unsafe"
)

func main() {
    rootPid := uint32(7400)

    tree, err := getTreePids(rootPid)
    if err != nil {
        fmt.Println(err)
    }
    fmt.Println("tree [", len(tree), "]:\t", tree)
}

// getTreePids will return a list of pids that represent the tree of process pids originating from the specified one.
// (they are ordered: [parent, 1 gen child, 2 gen child, ...])
func getTreePids(rootPid uint32) ([]uint32, error) {
    // https://docs.microsoft.com/en-us/windows/win32/api/tlhelp32/ns-tlhelp32-processentry32
    procEntry := syscall.ProcessEntry32{}
    parentLayer := []uint32{rootPid}
    treePids := parentLayer
    foundRootPid := false

    snapshot, err := syscall.CreateToolhelp32Snapshot(uint32(syscall.TH32CS_SNAPPROCESS), 0)
    if err != nil {
        return nil, err
    }
    defer syscall.CloseHandle(snapshot)

    procEntry.Size = uint32(unsafe.Sizeof(procEntry))

    for {
        // set procEntry to the first process in the snapshot
        err = syscall.Process32First(snapshot, &procEntry)
        if err != nil {
            return nil, err
        }

        // loop through the processes in the snapshot, if the parent pid of the analyzed process
        // is in in the parent layer, append the analyzed process pid in the child layer
        var childLayer []uint32
        for {
            if procEntry.ProcessID == rootPid {
                foundRootPid = true
            }

            if contains(parentLayer, procEntry.ParentProcessID) {
                // avoid adding a pid if it's already contained in treePids
                // useful for pid 0 whose ppid is 0 and would lead to recursion (windows)
                if !contains(treePids, procEntry.ProcessID) {
                    childLayer = append(childLayer, procEntry.ProcessID)
                }
            }

            // advance to next process in snapshot
            err = syscall.Process32Next(snapshot, &procEntry)
            if err != nil {
                // if there aren't anymore processes to be analyzed, break out of the loop
                break
            }
        }

        // if the specified rootPid is not found, return error
        if !foundRootPid {
            return nil, fmt.Errorf("specified rootPid not found")
        }

        // fmt.Println(childLayer)

        // there are no more child processes, return the process tree
        if len(childLayer) == 0 {
            return treePids, nil
        }

        // append the child layer to the tree pids
        treePids = append(treePids, childLayer...)

        // to analyze the next layer, set the child layer to be the new parent layer
        parentLayer = childLayer
    }
}

func contains(list []uint32, e uint32) bool {
    for _, l := range list {
        if l == e {
            return true
        }
    }
    return false
}
user_123364650
Related