Get handle from a main process

Question

Possible Duplicate:
Determine the parent process of the current app

I would like to get the a MainProcess Handle or PID of a process. For example Google Chrome drops another processes for each tab which are actually threads. In ProcessExplorer it shows chrome.exe in the treeview as a mainprocess and the threads underneath it. How could I check or get the MainProcess Handle/PID? Something like a WindowsAPI?

Thanks for your help.

score 3 · Accepted Answer · edited May 23 '17 at 12:03

@RRUZ has already answered an almost identical question on Stack Overflow. However, the code there is incorrect in that it declares process IDs as THandle. The following corrects the mistakes that I found, and also adapts the routine to return a PID rather than a filename:

uses
  Windows,
  tlhelp32,
  SysUtils;

function GetParentPid: DWORD;
var
  HandleSnapShot: THandle;
  EntryParentProc: TProcessEntry32;
  CurrentProcessId: DWORD;
  HandleParentProc: THandle;
  ParentProcessId: DWORD;
begin
  Result := 0;
  HandleSnapShot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);   //enumerate the process
  if HandleSnapShot<>INVALID_HANDLE_VALUE then
  begin
    EntryParentProc.dwSize := SizeOf(EntryParentProc);
    if Process32First(HandleSnapShot, EntryParentProc) then    //find the first process
    begin
      CurrentProcessId := GetCurrentProcessId; //get the id of the current process
      repeat
        if EntryParentProc.th32ProcessID=CurrentProcessId then
        begin
          ParentProcessId := EntryParentProc.th32ParentProcessID; //get the id of the parent process
          HandleParentProc := OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, False, ParentProcessId);
          if HandleParentProc<>0 then
          begin
            Result := ParentProcessId;
            CloseHandle(HandleParentProc);
          end;
          break;
        end;
      until not Process32Next(HandleSnapShot, EntryParentProc);
    end;
    CloseHandle(HandleSnapShot);
  end;
end;

I know that this is a duplicate question, but the code here is precisely what the OP wants, so I'll leave it visible for a while at least.

since which you are removed the call to `GetModuleFileNameEx` function to get the parent process filename you can remove the `Psapi` unit too of the uses. — RRUZ, Apr 17 '12 at 20:22
DWORD is better than THandle, but when I wrote that article i use Delphi 2007 Where `THandle = System.THandle = DWORD = LongWord` :) — RRUZ, Apr 17 '12 at 20:26
@RRUZ Yeah, I know where you are coming from. The thing is, `THandle` was never really equal to `DWORD`. It has always been a pointer sized thing. In winnt.h it is `typedef PVOID HANDLE`. It's getting these details right that makes porting to 64 bit easy. Now, the RTL has traditionally been rather poor at these details which I think is where a lot of the mis-understandings arise from. `THandle` has traditionally been declared as `LongWord` which is just bogus in my view. It should be `Pointer`. — David Heffernan, Apr 17 '12 at 20:29

Get handle from a main process

1 Answers1