Get Session ID of another process in C++

Question

When I start my application, I try to figure out if there is another process of the application. I also try to figure out if it runs in a different user session.

So far so good, that's what it looks like in C#:

    private static bool isThereAnotherInstance() {
        string name = Path.GetFileNameWithoutExtension(Application.ExecutablePath);
        Process[] pAll = Process.GetProcessesByName(name);
        Process pCurrent = Process.GetCurrentProcess();
        foreach (Process p in pAll) {
            if (p.Id == pCurrent.Id) continue;
            if (p.SessionId != pCurrent.SessionId) continue;
            return true;
        }
        return false;
    }

But the requirements has changed, I need this piece of code in C++ using plain WinAPI.

Until now, I'm able to find a process that has the same executable path by using CreateToolhelp32Snapshot, OpenProcess, etc.

The missing part is how to get the session id of a process (current and other processes, AND current and other session)
How to do this?

Answer 1

Code for listing all PID, SID, EXE ("ala" Task Manager, sort of) Works for me (Windows 7 64b) VS2012 Express

#include <stdio.h>
#include <tchar.h>

#include <Windows.h>
#include <Winternl.h>

#pragma comment( lib, "ntdll.lib" )

typedef LONG KPRIORITY; // Thread priority
typedef struct _SYSTEM_PROCESS_INFORMATION_DETAILD {
    ULONG NextEntryOffset;
    ULONG NumberOfThreads;
    LARGE_INTEGER SpareLi1;
    LARGE_INTEGER SpareLi2;
    LARGE_INTEGER SpareLi3;
    LARGE_INTEGER CreateTime;
    LARGE_INTEGER UserTime;
    LARGE_INTEGER KernelTime;
    UNICODE_STRING ImageName;
    KPRIORITY BasePriority;
    HANDLE UniqueProcessId;
    ULONG InheritedFromUniqueProcessId;
    ULONG HandleCount;
    BYTE Reserved4[4];
    PVOID Reserved5[11];
    SIZE_T PeakPagefileUsage;
    SIZE_T PrivatePageCount;
    LARGE_INTEGER Reserved6[6];
} SYSTEM_PROCESS_INFORMATION_DETAILD, *PSYSTEM_PROCESS_INFORMATION_DETAILD;

int _tmain(int argc, _TCHAR* argv[]) {

    SYSTEM_PROCESS_INFORMATION aSPI[ 1024 ];
    // could ask for actual needed size size and malloc (with few extra new processes bonus...)
    NTSTATUS nts = NtQuerySystemInformation( SystemProcessInformation, aSPI, sizeof( aSPI ), NULL );
    if ( NT_ERROR( nts ) ) return -1;

    char * pSPI = reinterpret_cast<char*>( &aSPI[ 0 ] );
    while ( true ) {
        SYSTEM_PROCESS_INFORMATION_DETAILD * pOneSPI = reinterpret_cast<SYSTEM_PROCESS_INFORMATION_DETAILD*>( pSPI );
        WCHAR * pwch = pOneSPI->ImageName.Buffer;
        if ( pwch == 0 || pOneSPI->ImageName.Length == 0 ) pwch = TEXT( "Unknown" );
        _tprintf( TEXT( "PID %d - SID %d EXE %s\n" ), pOneSPI->UniqueProcessId, *reinterpret_cast<LONG*>( &pOneSPI->Reserved4 ), pwch );
        if ( pOneSPI->NextEntryOffset ) pSPI += pOneSPI->NextEntryOffset;
        else break;
    } 

    return 0;
}

Many thanks to @Oleg for documentation of the SPI structure on SO here

Answer 2

As mentioned by arx, ProcessIdToSessionId should do the job.
But unfortunately, in my case it tells me ACCESS_DENIED for the processes I'm interested in.
It DOES its job for the current process.

So here's my solution, using NtQuerySystemInformation.
.NETs Process class uses the same function internally .

typedef struct _SYSTEM_PROCESS_INFORMATION_BUG {
    //...
}

typedef NTSTATUS (WINAPI *PNtQuerySystemInformation) (
    IN SYSTEM_INFORMATION_CLASS SystemInformationClass,
    OUT PVOID SystemInformation,
    IN ULONG SystemInformationLength,
    OUT PULONG ReturnLength OPTIONAL
    );

#ifndef NT_ERROR
#define NT_ERROR(Status) ((ULONG)(Status) >> 30 == 3)
#endif

#define PROCESSINFO_BUFFERSIZE (256*1024)

DLL_EXPORT int GetProcessIdFromPath2(char *exePath, int flags) {
    char exe[MAX_PATH], *exeName, file[MAX_PATH], *fileName;
    DWORD pidCurrent, sessionIdCurrent;
    int ret=-1;

    strcpy(exe, exePath);
    strupr(exe);
    exeName=getFileName(exe);

    pidCurrent = GetCurrentProcessId();
    if (!ProcessIdToSessionId(pidCurrent, &sessionIdCurrent)) sessionIdCurrent=0;
    HMODULE hNT = LoadLibrary("Ntdll.dll");
    if (hNT) {
        PNtQuerySystemInformation pNtQuerySystemInformation = (PNtQuerySystemInformation)GetProcAddress(hNT, "NtQuerySystemInformation");
        if (pNtQuerySystemInformation) {
            SYSTEM_PROCESS_INFORMATION_BUG* processInfo;
            char *buffer = (char*)malloc(PROCESSINFO_BUFFERSIZE);
            if (!buffer) {
                ret=-3;
            }
            else {
                char *current=buffer;
                DWORD len;
                int count=0;
                NTSTATUS s = pNtQuerySystemInformation(SystemProcessInformation, buffer, PROCESSINFO_BUFFERSIZE, &len);
                if (NT_ERROR(s)) {
                    ret=-2;
                }
                else {
                    ret=0;
                    while(1) {
                        processInfo = (SYSTEM_PROCESS_INFORMATION_BUG*)current;
                        if (processInfo->ImageName.Buffer!=NULL){
                            wcstombs(file, processInfo->ImageName.Buffer, MAX_PATH-1);
                            strupr(file);
                            fileName=getFileName(file);
                            if (strcmp(fileName, exeName)==0) {
                                if (processInfo->UniqueProcessId!=pidCurrent) {
                                    if (processInfo->SessionId==sessionIdCurrent) {
                                        ret = processInfo->UniqueProcessId;
                                    }
                                }
                            }
                        }
                        if (processInfo->NextEntryOffset==0) break;
                        current+=processInfo->NextEntryOffset;
                        count++;
                    }
                }
                free(buffer);
                buffer=NULL;
            }
        }
        FreeLibrary(hNT);
    }
    return ret;
}

Answer 3

The ProcessIdToSessionId function maps a process ID to a session ID.

You note that this seems to require excessive permissions that aren't needed by .Net.

.Net does get some of its process data from HKEY_PERFORMANCE_DATA in the registry, but this doesn't include the session ID. The session ID is obtained using NtQuerySystemInformation to return an array of SYSTEM_PROCESS_INFORMATION structures. This structure is not well documented, but the session ID immediately follows the handle count (i.e. it is the field currently declared as BYTE Reserved4[4];). Microsoft do not guarantee that this will continue to be true in future versions of Windows.