Process not running...

c++ / delphi package - dll injection and api hooking
Post Reply
stOrM!
Posts: 51
Joined: Thu Jul 15, 2004 7:38 pm

Process not running...

Post by stOrM! »

Well let me say I am absolutly new to all of these especially on all that amazing / surprising hooking stuff...

So I need a helping hand here...
In the moment I have a small problem I noticed on a Server (Win2000) so I am curious on how to solve it maybe with hooking?

On the Server a process needs to run always but for some reason (not sure why) the process automatically stops on every two days or three...

I need to prevent that and make sure if the process died it restarts immediately.

Would a hook be a good solution here?
Don't know when the process dies, if something like process termination is fired up before or did it die silently without any calls to the process before?

So if so maybe I could hook into it and restart the process?
In the moment I'm just monitoring the tasklist for the process (timer based) and restart when the process got killed... In the timer event I'm asking: If Process('SomeProcess.EXE').IsStillRunning then

But like I say I'm totally new with hooks I would love to learn a little bit about it...

Maybe someone can help me out with a small example or whatever any help is much appriciated... :D

best regards
s!
madshi
Site Admin
Posts: 10766
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

If you don't know why that process exits, hooks probably won't help. I guess that the process simply crashes now and then. What you're doing now (simply restarting it when it's gone from the process list) is not a bad workaround. However, generally polling (= checking something in a timer) is not considered being a good programming practise. However, if you set the timer interval high enough (e.g. one check every 10 seconds or so), it's good enough.
stOrM!
Posts: 51
Joined: Thu Jul 15, 2004 7:38 pm

re

Post by stOrM! »

Thats exactly what I did a 10 seconds polling...

You're right, the problem I don't know why the process dies, like you assume its seems it just crashed now and then...

On the other hand you're right polling works but I'm curious (maybe too curious :-) if all could be also done because of a hook?
Like checking Process isn't alive restart it...

I choiced the problem as a starting point for me to learn so thats why are asking and it seems I'm on the right place here :D

Danke für die immer sehr schnellen Antworten :D

regards
s!
madshi
Site Admin
Posts: 10766
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

You can use IProcess.Notify to be notified when the target process ends.
stOrM!
Posts: 51
Joined: Thu Jul 15, 2004 7:38 pm

re

Post by stOrM! »

So is "Isstillrunning" and Notify are different? Like notify get me notified when the process is getting exited, while stillrunning doesn't check that state?

Let me please asked another question because of the hook if I ever could write one myself because of that situation...

Just for making things clearer to me:
If I ever could write a hook for myself because of the mentioned problem would the following the right functions to use?

TerminateProcessNext : function (processHandle, exitCode: dword) : bool; stdcall;
NtTerminateProcessNext : function (processHandle, exitCode: dword) : dword; stdcall;

best regards
s!
madshi
Site Admin
Posts: 10766
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

If the process crashes, hooking TerminateProcess probably wouldn't help. As I said, as long as you don't know why the process exits, hooking won't help much.

"IsStillRunning" is a simple function which returns whether the process is still running. "Notify" does nothing, it returns at once. But you'll get called when the process stopped. More details see documentation.
stOrM!
Posts: 51
Joined: Thu Jul 15, 2004 7:38 pm

re

Post by stOrM! »

Yep ok thank you very much!

best regards
s!
Post Reply