Prev: How to get notification when a new process is started
Next: VSS Fails on InitializeForBackup.
From: Kerem Gümrükcü on 16 Feb 2010 04:59
Hi,

i faced a interesting situation:
I am waiting inside a thread for
a process to exit on WaitForSingleObject().
The process exits, the handle gets signaled
and then i immediatelly call to a
CreateToolhelp32Snapshot(...)
with TH32CS_SNAPPROCESS
and the process is is still listed
in the snapshot. How come?

Well, this makes me ask myself this:
What is the best way to wait
for the process and make sure
it is fully terminated and all
structures, handles, memory, etc.
are fully destroyed?


TIA

regards

Kerem

--
-----------------------
Beste Gr�sse / Best regards / Votre bien devoue
Kerem G�mr�kc�
Latest Project: http://www.pro-it-education.de/software/deviceremover
Latest Open-Source Projects: http://entwicklung.junetz.de
-----------------------

From: David Lowndes on 16 Feb 2010 06:02
>i faced a interesting situation:
>I am waiting inside a thread for
>a process to exit on WaitForSingleObject().
>The process exits, the handle gets signaled
>and then i immediatelly call to a
>CreateToolhelp32Snapshot(...)
>with TH32CS_SNAPPROCESS
>and the process is is still listed
>in the snapshot. How come?

You've not closed your handle to the process?

Dave
From: Jonathan de Boyne Pollard on 16 Feb 2010 07:36
>
>
> Hi,
>
Are you asking for haiku, again? All right. Here you go:

Termination of
process is not the same as
object destruction.

From: Kerem Gümrükcü on 16 Feb 2010 14:04
Hi,

> You've not closed your handle to the process?

i did but this is not the point. When the process
dies and my WFSO returns and when i wait for
a few seconds (Sleep(...)) inside my thread, then
the snapshot does not contain the process anymore.
Its a matter of synchronization. So the point is: The
process dies, the handle gets signaled, but the OS
still keeps some information of the object in its
structures,...or why does CT32S still return that
information. I dont know why the internall
NtQuerySystemInformation function call (on vista
at least CT32S uses it) still returns that information.

K.

--
-----------------------
Beste Gr�sse / Best regards / Votre bien devoue
Kerem G�mr�kc�
Latest Project: http://www.pro-it-education.de/software/deviceremover
Latest Open-Source Projects: http://entwicklung.junetz.de
-----------------------

"David Lowndes" <DavidL(a)example.invalid> schrieb im Newsbeitrag
news:aoukn5h03lnuu39bua7kg0l4vs54os33ic(a)4ax.com...
>>i faced a interesting situation:
>>I am waiting inside a thread for
>>a process to exit on WaitForSingleObject().
>>The process exits, the handle gets signaled
>>and then i immediatelly call to a
>>CreateToolhelp32Snapshot(...)
>>with TH32CS_SNAPPROCESS
>>and the process is is still listed
>>in the snapshot. How come?
>
> You've not closed your handle to the process?
>
> Davea


From: rogero on 17 Feb 2010 06:05
On Feb 16, 7:04 pm, Kerem Gümrükcü <kareem...(a)hotmail.com> wrote:
> Hi,
>
> > You've not closed your handle to the process?
>
> i did but this is not the point. When the process
> dies and my WFSO returns and when i wait for
> a few seconds (Sleep(...)) inside my thread, then
> the snapshot does not contain the process anymore.
> Its a matter of synchronization. So the point is: The
> process dies, the handle gets signaled, but the OS
> still keeps some information of the object in its
> structures,...or why does CT32S still return that
> information. I dont know why the  internall
> NtQuerySystemInformation function call (on vista
> at least CT32S uses it) still returns that information.

Nor do I: it usually seems to skip terminated processes
whose EPROCESS entry is waiting until the last handle is closed.
(In this state you can still open the process handle, but can't to do
much with the returned handle except query the exit code.)

Isn't getting a WFSO return all you need?

Roger.
 |  Next  |  Last
Pages: 1 2 3
Prev: How to get notification when a new process is started
Next: VSS Fails on InitializeForBackup.