Rename VB6 Process

Vinson · Joined: 04 Oct 2007 Posts: 25

I would like to know if there is a way to rename my VB6 process after it has
been launched. There are some convoluted ways to achieve the same end
result, but I am wondering if there is a simple API that would easily do the
trick.

Incidentally, the reason I wish to rename the process is that I don't want
my users to end my program with the task manager. Instead, they should end
it only with the command button I have provided them (program really needs a
clean shutdown; not a sudden one). If you alternatively know of a way to
protect a process from being ended from the task manager, that would be
great, too!

Thanks!

Vinson

Archived from group: microsoft>public>vb>winapi

Bob Butler · Joined: 04 Oct 2007 Posts: 1081

"Vinson" wrote in message @microsoft.com...
>I would like to know if there is a way to rename my VB6 process after it
>has
> been launched. There are some convoluted ways to achieve the same end
> result, but I am wondering if there is a simple API that would easily do
> the
> trick.
>
> Incidentally, the reason I wish to rename the process is that I don't want
> my users to end my program with the task manager. Instead, they should
> end
> it only with the command button I have provided them (program really needs
> a
> clean shutdown; not a sudden one). If you alternatively know of a way to
> protect a process from being ended from the task manager, that would be
> great, too!

If you respond to the Form_QueryUnload and Form_Unload events you should be
able to do a clean shutdown. There's no way to totally prevent a forced
termination.

Vinson · Joined: 04 Oct 2007 Posts: 25

Thank you for the reply.

Sadly, the Task Manager performs the equivalent to a TerminateProcess API
call when ending a process, and that unconditionally halts a program before
removing it from memory. Any events that would normally fire, simply can't.

I would like to rename a process simply to obfuscate its listing, but there
are already certain processes that Windows protects, so it is quite possible
to protect a process.

Vinson

"Bob Butler" wrote:

> "Vinson" wrote in message
> @microsoft.com...
> >I would like to know if there is a way to rename my VB6 process after it
> >has
> > been launched. There are some convoluted ways to achieve the same end
> > result, but I am wondering if there is a simple API that would easily do
> > the
> > trick.
> >
> > Incidentally, the reason I wish to rename the process is that I don't want
> > my users to end my program with the task manager. Instead, they should
> > end
> > it only with the command button I have provided them (program really needs
> > a
> > clean shutdown; not a sudden one). If you alternatively know of a way to
> > protect a process from being ended from the task manager, that would be
> > great, too!
>
> If you respond to the Form_QueryUnload and Form_Unload events you should be
> able to do a clean shutdown. There's no way to totally prevent a forced
> termination.
>
>

Bob Butler · Joined: 04 Oct 2007 Posts: 1081

"Vinson" wrote in message @microsoft.com...
> Thank you for the reply.
>
> Sadly, the Task Manager performs the equivalent to a TerminateProcess API
> call when ending a process, and that unconditionally halts a program
> before
> removing it from memory. Any events that would normally fire, simply
> can't.

IIRC, it first sends a WM_Close message and only does a hard termination if
the app does not respond and the user then tells it to. You should be able
to exit cleanly when requested.

> I would like to rename a process simply to obfuscate its listing, but
> there
> are already certain processes that Windows protects, so it is quite
> possible
> to protect a process.

Windows protects services and such but that's not going to be of much help.
Changing the App.Title may change some of what the task manager displays but
the only way I know of to rename it would be to have your app copy itself to
a temporary file and then execute that.

Vinson · Joined: 04 Oct 2007 Posts: 25

Thanks again, for your reply.

There are about 7 ways to end an application that will allow events to fire
upon exit, but if you select a process from the process list in Task Manager
(not the application list), and choose to end it, Windows will use the
TerminateProcess API which kills the app in it's tracks. Windows will even
warn you that ending a process is not the ideal way to end an program since
its ending it in this way would be unconditional. I have tested this, and
any events that would normally fire cannot.

I really do appreciate your response, but there has to be an API out there,
lying around, that can pull off a process rename or that can set a flag to
protect my program from being ended through the process list. I can always
do some elaborate steps to achieve my goals, but I really would like to just
call an API. Neat. Clean. Correct.

Thanks!

Vinson

"Bob Butler" wrote:

> "Vinson" wrote in message
> @microsoft.com...
> > Thank you for the reply.
> >
> > Sadly, the Task Manager performs the equivalent to a TerminateProcess API
> > call when ending a process, and that unconditionally halts a program
> > before
> > removing it from memory. Any events that would normally fire, simply
> > can't.
>
> IIRC, it first sends a WM_Close message and only does a hard termination if
> the app does not respond and the user then tells it to. You should be able
> to exit cleanly when requested.
>
> > I would like to rename a process simply to obfuscate its listing, but
> > there
> > are already certain processes that Windows protects, so it is quite
> > possible
> > to protect a process.
>
> Windows protects services and such but that's not going to be of much help.
> Changing the App.Title may change some of what the task manager displays but
> the only way I know of to rename it would be to have your app copy itself to
> a temporary file and then execute that.
>
>

Thorsten Albers · Joined: 04 Oct 2007 Posts: 756

Vinson schrieb im Beitrag
...
> I really do appreciate your response, but there has to be an API out
there,
> lying around, that can pull off a process rename or that can set a flag
to
> protect my program from being ended through the process list. I can
always
> do some elaborate steps to achieve my goals, but I really would like to
just
> call an API. Neat. Clean. Correct.

AFAIK the common way is to start a second process which checks if the main
process is still running, and, if not, restarts it. In the documentation on
TerminateProcess() there is a statement which may be of very importance for
this: "Terminating a process does not cause child processes to be
terminated.". So, as a suggestion, start the second process as a child
process. I myself don't have any experience in how to do this, it is just a
thought...

--
----------------------------------------------------------------------
THORSTEN ALBERS Universität Freiburg
albers@
uni-freiburg.de
----------------------------------------------------------------------

Scott Seligman · Joined: 04 Oct 2007 Posts: 12

=?Utf-8?B?Vmluc29u?= wrote:
>
>I really do appreciate your response, but there has to be an API out
>there, lying around, that can pull off a process rename or that can
>set a flag to protect my program from being ended through the process
>list. I can always do some elaborate steps to achieve my goals, but I
>really would like to just call an API. Neat. Clean. Correct.

Why are you so sure such an API exists? Task Manager has a hard coded
list of modules it'll refuse to terminate, but other task managers can
happily terminate those processes (generally with disastrous results,
Windows doesn't take well to csrss.exe suddenly disappearing, for
instance). There's no API to add your process to Task Manager's hard
coded list.

Short of techniques used by malware and the like, there's no way to
ensure that your process won't be terminated by some technique. Even
then, the power cord can generally be used to terminate a process
unexpectedly.

--
--------- Scott Seligman and michelle dot net> ---------
Circular logic will only make you dizzy, Doctor.
-- Peri in Doctor Who:"The Two Doctors"

Vinson · Joined: 04 Oct 2007 Posts: 25

Thanks. I might have to resort to the method of an app watching an app.

"Thorsten Albers" wrote:

> Vinson schrieb im Beitrag
> ...
> > I really do appreciate your response, but there has to be an API out
> there,
> > lying around, that can pull off a process rename or that can set a flag
> to
> > protect my program from being ended through the process list. I can
> always
> > do some elaborate steps to achieve my goals, but I really would like to
> just
> > call an API. Neat. Clean. Correct.
>
> AFAIK the common way is to start a second process which checks if the main
> process is still running, and, if not, restarts it. In the documentation on
> TerminateProcess() there is a statement which may be of very importance for
> this: "Terminating a process does not cause child processes to be
> terminated.". So, as a suggestion, start the second process as a child
> process. I myself don't have any experience in how to do this, it is just a
> thought...
>
> --
> ----------------------------------------------------------------------
> THORSTEN ALBERS UniversitÃ¤t Freiburg
> albers@
> uni-freiburg.de
> ----------------------------------------------------------------------
>
>

Vinson · Joined: 04 Oct 2007 Posts: 25

Thanks for your post.

I am not absolutley certain that a public API exists to rename or flag a
process as protected, but in thinking of the precept Ockham's Razor, I just
don't believe that Microsoft would choose to limit themselves in any way when
creating their very own OS. Therefore, I strongly suspect that one does
exist, even if it is undocumented.

Vinson

"Scott Seligman" wrote:

> =?Utf-8?B?Vmluc29u?= wrote:
> >
> >I really do appreciate your response, but there has to be an API out
> >there, lying around, that can pull off a process rename or that can
> >set a flag to protect my program from being ended through the process
> >list. I can always do some elaborate steps to achieve my goals, but I
> >really would like to just call an API. Neat. Clean. Correct.
>
> Why are you so sure such an API exists? Task Manager has a hard coded
> list of modules it'll refuse to terminate, but other task managers can
> happily terminate those processes (generally with disastrous results,
> Windows doesn't take well to csrss.exe suddenly disappearing, for
> instance). There's no API to add your process to Task Manager's hard
> coded list.
>
> Short of techniques used by malware and the like, there's no way to
> ensure that your process won't be terminated by some technique. Even
> then, the power cord can generally be used to terminate a process
> unexpectedly.
>
> --
> --------- Scott Seligman and michelle dot net> ---------
> Circular logic will only make you dizzy, Doctor.
> -- Peri in Doctor Who:"The Two Doctors"
>

Scott Seligman · Joined: 04 Oct 2007 Posts: 12

=?Utf-8?B?Vmluc29u?= wrote:
>
>Thanks for your post.
>
>I am not absolutley certain that a public API exists to rename or flag a
>process as protected, but in thinking of the precept Ockham's Razor, I just
>don't believe that Microsoft would choose to limit themselves in any way when
>creating their very own OS. Therefore, I strongly suspect that one does
>exist, even if it is undocumented.

Really? But MS never uses it, unless you can point me to a process
you can't kill with TerminateProcess().

--
--------- Scott Seligman and michelle dot net> ---------
Democracy is two wolves and a lamb voting on what to have for lunch.
Liberty is a well armed lamb contesting the vote.
-- Benjamin Franklin

Vinson · Joined: 04 Oct 2007 Posts: 25

We might be talking about two different things.

From the Task Manager, Services.exe is an example of a protected process.
If you try to end Services.exe from Task Manager process list, Windows won't
allow it. I want my process to be protected in this way using a flag or
attribute, or whatever.

Ultimately, it may still be possible for a developer to close Services.exe
using the TerminateProcess API (I have not tested it), but obviously, most
end-users will not be ready to take it to that extreme. If I figure out a
way to protect my program, and a user wants to stop my running program by
using the TerminateProcess API, and is willing to write a program to do it, I
suppose I will applaud their efforts. Of course, it is easier just to close
my application by clicking on the appropriate button.

Vinson

"Scott Seligman" wrote:

> =?Utf-8?B?Vmluc29u?= wrote:
> >
> >Thanks for your post.
> >
> >I am not absolutley certain that a public API exists to rename or flag a
> >process as protected, but in thinking of the precept Ockham's Razor, I just
> >don't believe that Microsoft would choose to limit themselves in any way when
> >creating their very own OS. Therefore, I strongly suspect that one does
> >exist, even if it is undocumented.
>
> Really? But MS never uses it, unless you can point me to a process
> you can't kill with TerminateProcess().
>
> --
> --------- Scott Seligman and michelle dot net> ---------
> Democracy is two wolves and a lamb voting on what to have for lunch.
> Liberty is a well armed lamb contesting the vote.
> -- Benjamin Franklin
>

Bob Butler · Joined: 04 Oct 2007 Posts: 1081

"Vinson" wrote in message @microsoft.com...
> Of course, it is easier just to close
> my application by clicking on the appropriate button.

Of course, it is easier to just write your applicaiton to handle close
requests cleanly.

You are barking up the wrong tree and all your wishing and hoping that
things are different won't help.

Scott Seligman · Joined: 04 Oct 2007 Posts: 12

=?Utf-8?B?Vmluc29u?= wrote:
>
>We might be talking about two different things.
>
>From the Task Manager, Services.exe is an example of a protected
>process. If you try to end Services.exe from Task Manager process
>list, Windows won't allow it. I want my process to be protected in
>this way using a flag or attribute, or whatever.

Ahh. I tried to point this out earlier (but apparently failed), Windows
isn't doing anything here. This is purely a hard coded list of process
names in TaskMgr.exe. That list includes lsass.exe, services.exe,
smss.exe, winlogon.exe, csrss.exe. There's no API at play here,
TaskMgr.exe is just comparing the image name to a hard coded list of
names it won't close. Other task managers are more than free to close
these processes.

The only way you could get your process into this list would be to
modify TaskMgr.exe itself.

Of course, you could name your process with one of these process names
and task manager will treat it as if it's a system process. There may be
other problems with naming your process like this, but nothing comes to
mind so long as you avoid installing it to System32. Doing this would
put your product into the category of products I refuse to install on
any of my computers, but somehow I doubt you care about that =)

--
--------- Scott Seligman and michelle dot net> ---------
Democracy is two wolves and a lamb voting on what to have for lunch.
Liberty is a well armed lamb contesting the vote.
-- Benjamin Franklin

Vinson · Joined: 04 Oct 2007 Posts: 25

No application can handle closing down cleanly when it is being torn out of
memory, unexpectedly. My "wishing" was to get help from API experts to
handle cleanly closing an application in such a circumstance, Bob.

Vinson

"Bob Butler" wrote:

> "Vinson" wrote in message
> @microsoft.com...
> > Of course, it is easier just to close
> > my application by clicking on the appropriate button.
>
> Of course, it is easier to just write your applicaiton to handle close
> requests cleanly.
>
> You are barking up the wrong tree and all your wishing and hoping that
> things are different won't help.
>
>
>

Vinson · Joined: 04 Oct 2007 Posts: 25

I appreciate the tips, even if they are peppered with a bit of sarcasim.

Vinson

"Scott Seligman" wrote:

> =?Utf-8?B?Vmluc29u?= wrote:
> >
> >We might be talking about two different things.
> >
> >From the Task Manager, Services.exe is an example of a protected
> >process. If you try to end Services.exe from Task Manager process
> >list, Windows won't allow it. I want my process to be protected in
> >this way using a flag or attribute, or whatever.
>
> Ahh. I tried to point this out earlier (but apparently failed), Windows
> isn't doing anything here. This is purely a hard coded list of process
> names in TaskMgr.exe. That list includes lsass.exe, services.exe,
> smss.exe, winlogon.exe, csrss.exe. There's no API at play here,
> TaskMgr.exe is just comparing the image name to a hard coded list of
> names it won't close. Other task managers are more than free to close
> these processes.
>
> The only way you could get your process into this list would be to
> modify TaskMgr.exe itself.
>
> Of course, you could name your process with one of these process names
> and task manager will treat it as if it's a system process. There may be
> other problems with naming your process like this, but nothing comes to
> mind so long as you avoid installing it to System32. Doing this would
> put your product into the category of products I refuse to install on
> any of my computers, but somehow I doubt you care about that =)
>
> --
> --------- Scott Seligman and michelle dot net> ---------
> Democracy is two wolves and a lamb voting on what to have for lunch.
> Liberty is a well armed lamb contesting the vote.
> -- Benjamin Franklin
>

VB6 rename a file I cannot find any reference to how I go about renaming a disk file. I have a note file that is on a path similar to this : and I want to rename it to

How to rename a key in registry with API ? Hello I want to rename a key which has under-keys. I can remove keys. I can create a key. But if there are under-keys that does not go. Does somebody have an idea? Thank you

Hiding a Process from task Manager(Particular Process) Hi, My Question is how to hide a particular process from a task manager.I saw the code which was in VB but I want to convert it to VC++ application can you please provide a sample code. I want to hide a process on Win XP/2000/NT operating system. Please h

Rename a file with an invalid filename I have a filename with a ? in the middle of the name. I know it's an invalid name and I want to rename the file, but I can't rename it because it's an invalid filename (error 123 The filename, directory name, or volume label syntax is incorrect.). The fil

Rename Document Name in Printer Spooler Hello, I'm trying to find a way to change the document name that is displayed in the printer spooler when printing a crystal report from my VB.Net application. Right now, it only shows the word "document." I'm using VB.Net 2003 and Crystal Reports XI dev