According to this thread at MSDN social (http://social.msdn.microsoft.com/Forums/en-US/windowsmobiledev/thread/d20f15eb-2a22-4634-bf14-e76ab2ca2259/), it should be easy to grab the name of the executable that launched window X. But I can't get it to work...
lea edi, buffer
invoke lstrcpy, edi, chr$("EMPTY") ; just for checking if something was written
invoke GetForegroundWindow
xchg eax, ebx
deb 4, "Title", $Win$(ebx) ; OK
invoke GetWindowThreadProcessId, ebx, 0
deb 4, "ID", eax ; OK
invoke GetModuleFileName, eax, edi, 1000
deb 4, "File", $Err$(), $edi ; operation completed
No errors, but the output shows that nothing is copied into the buffer. Any ideas?
Title $Win$(ebx) D:\Masm32\RichMasm\richmasm.exe
ID eax 2172
File
$Err$() Operazione completata.
$edi EMPTY
The return value from GetWindowThreadProcessId is the thread ID. The process ID is returned through the optional output second parameter, which you have passed 0.
I'm not sure if the process ID counts as the module handle.
Is the desired result obtained with $Win$?
Thanks for the hint :t
Win$(hWnd) returns the caption text. With...
push eax
invoke GetWindowThreadProcessId, ebx, esp
pop edx
deb 4, "ID thread", eax
deb 4, "ID process", edx
... I now get:
Title $Win$(ebx) Masm32 xHelp
ID thread eax 1536
ID process edx 3556
File
$Err$() Operazione completata.
$edi EMPTY
I found this. It's in C, but easily converted.
DWORD pID;
GetWindowThreadProcessId(hwnd, &pID);
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);
GetModuleFileNameEx(hProcess, NULL, buff, MAX_PATH);
CloseHandle(hProcess);
http://forums.codeguru.com/archive/index.php/t-325174.html
Yep, that works, thanxalot :t
GetProcessImageFileName works also on XP but it returns a different format:
invoke GetProcessImageFileName, esi, edi, 1000 ; \Device\HarddiskVolume3\masm32\RichMasm\Misc\searchchm\ChmWindow.exe
invoke GetModuleFileNameEx, esi, 0, edi, 1000 ; D:\Masm32\RichMasm\Misc\SearchCHM\ChmWindow.exe
My pleasure :)
Quote from: MSDNThe GetProcessImageFileName function returns the path in device form, rather than drive letters.