Win32_Process & NULL property (ExecutablePath) value

[Jeremy]

Hello all,
I am implementing a temporary event consumer in a C/C++
application. I am successfully getting my temporary
events using the following Query

"select * from __instancecreationevent WITHIN 1 where
Targetinstance ISA 'Win32_Process'"

The problem that I have is that, occasionally, when I get
go to retrieve the ExecutablePath property from the
IWbemClassObject it is NULL;

....
CComBSTR bstrProcProp(_T("ExecutablePath"));
pObject->Get(bstrProcProp, 0, &vtVal, NULL, NULL);
....
Sometimes vtVal is empty.

Anyone know why this would be NULL? It doesn't always
happen, just occasionally, and if I stop and start the app
again, it will catch it the next time. Also, if I use
wbemtest enumerate all the win32_process objects after I
get the null value, the property is there for the running
application.

Thanks,
Jeremy

[Duke Sun]

How to reproduce the problem? I can't reproduce the problem on my machine
with the following VBS:

Set services = GetObject("WinMgmts:")

Set sink = WScript.CreateObject("WbemScripting.SWbemSink","SINK_")

services.ExecNotificationQueryAsync sink, _

"select * from __instancecreationevent WITHIN 1 where
Targetinstance ISA 'Win32_Process'"

WScript.Echo "Create a process to generate an event. " _
& VBCR & "Click OK to stop watching for events."

Sub SINK_OnObjectReady(objWbemObject, objAsyncContext)
WScript.Echo "New process created: " & _
objWbemObject.targetinstance.ExecutablePath
End Sub

[Jeremy]

I was able to repro the problem using your script.
Sometimes it happens the first time an app starts,
sometimes not, but if you start several applications in
rapid succession I can almost always get it to happen on
the 3rd or 4th one. When I start them "rapidly", I use my
quicklaunch tool bar and click accross that on several
apps in a row. Eventually I got the dialog message from
your scrtip without the path.

Jeremy

>.
>

[Ivan Brugiolo [MSFT]]

The ExecutablePath is read from the Memory of the started process.
If the process has died after NtQuerySystemInformation has returned,
there are little chances to retrieve something from the PEB of the process.

--
This posting is provided "As Is" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

"Jeremy" <jkerc...@expressmetrix.com> wrote in message
news:011601c2a60e$787917b0$8df82ecf@TK2MSFTNGXA02...

[Jeremy]

I would agree with that statement, but the process has not
died... it starts up normally.

Jeremy

>.
>

[Duke Sun]

I can reproduce the problem on my side. I'm now performing research on the
issue and will update you as soon as possible.

[Duke Sun]

The following code snippet may be of help. You can query WMI again for the
process object.

Set services = GetObject("WinMgmts:")

services.security_.privileges.addasstring "sedebugprivilege"
Set sink = WScript.CreateObject("WbemScripting.SWbemSink","SINK_")
services.ExecNotificationQueryAsync sink,"select * from

__instancecreationevent WITHIN 1 where Targetinstance ISA 'Win32_Process'"

WScript.Echo "Create a process to generate an event. " & VBCR & "Click OK

to stop watching for events."

Sub SINK_OnObjectReady(objWbemObject, objAsyncContext)
set ProcessSet = GetObject("winmgmts:").ExecQuery("select * from
Win32_Process where ProcessId=" & objWbemObject.TargetInstance.ProcessId)
for each Process in ProcessSet
WScript.Echo "New process created: " & Vbcrlf & _
"Process Name: " & Process.Name & Vbcrlf & _
"Executable Path: " & Process.ExecutablePath
next
End Sub

Best regards,
quansun
VS.NET, Visual C++
Microsoft

This posting is provided "AS IS" with no warranties, and confers no rights.
Got .Net? http://www.gotdotnet.com

[Jeremy Kercheval]

Thanks, I will use that work around.

Jeremy

>-----Original Message-----
>The following code snippet may be of help. You can query
WMI again for the
>process object.
>
>Set services = GetObject("WinMgmts:")
>services.security_.privileges.addasstring "sedebugprivileg
e"

>Set sink = WScript.CreateObject

>.
>