| 242 | } |
| 243 | |
| 244 | std::string CProcessFunctions::GetParentProcessName(DWORD dwCurrPID) |
| 245 | { |
| 246 | std::string szOutput = ""; |
| 247 | |
| 248 | auto dwParentPID = CProcessFunctions::GetProcessParentProcessId(dwCurrPID); |
| 249 | if (!dwParentPID) |
| 250 | { |
| 251 | DEBUG_LOG(LL_ERR, "Parent PID not found! Last error: %u", g_winapiApiTable->GetLastError()); |
| 252 | return szOutput; |
| 253 | } |
| 254 | |
| 255 | auto processEnumerator = std::make_unique<CSafeProcessHandle>(); |
| 256 | if (!processEnumerator || !processEnumerator.get()) |
| 257 | { |
| 258 | DEBUG_LOG(LL_ERR, "processEnumerator allocation failed! Last error: %u", g_winapiApiTable->GetLastError()); |
| 259 | return szOutput; |
| 260 | } |
| 261 | |
| 262 | auto hProcess = processEnumerator->FindProcessFromPID(dwParentPID); |
| 263 | if (!IS_VALID_HANDLE(hProcess)) |
| 264 | { |
| 265 | DEBUG_LOG(LL_ERR, "Parent process not found on process list! PID: %u", dwParentPID); |
| 266 | |
| 267 | hProcess = g_winapiApiTable->OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwParentPID); |
| 268 | if (!IS_VALID_HANDLE(hProcess)) |
| 269 | { |
| 270 | auto bIsAlive = CProcessFunctions::ProcessIsItAlive(dwParentPID); |
| 271 | DEBUG_LOG(LL_ERR, "Parent process can not open! Last error: %u IsAlive: %d", g_winapiApiTable->GetLastError(), bIsAlive); |
| 272 | return szOutput; |
| 273 | } |
| 274 | } |
| 275 | |
| 276 | auto szParentName = CProcessFunctions::GetProcessName(hProcess); |
| 277 | if (szParentName.empty()) |
| 278 | { |
| 279 | DEBUG_LOG(LL_ERR, "Parent process name not found!"); |
| 280 | g_nmApp->DynamicWinapiInstance()->SafeCloseHandle(hProcess); |
| 281 | return szOutput; |
| 282 | } |
| 283 | auto szLowerParentName = g_nmApp->FunctionsInstance()->szLower(szParentName); |
| 284 | |
| 285 | g_nmApp->DynamicWinapiInstance()->SafeCloseHandle(hProcess); |
| 286 | szOutput = szLowerParentName; |
| 287 | return szOutput; |
| 288 | } |
| 289 | |
| 290 | std::string CProcessFunctions::DosDevicePath2LogicalPath(LPCSTR lpszDosPath) |
| 291 | { |
nothing calls this directly
no test coverage detected