KillProc plug-in is not working in x64 bit machines

dhiraj3301 · 6th May 2010, 11:44

KillProc plug-in is not working in x64 bit machines

I have written following code:

StrCpy $0 "Draw.exe"
KillProc::FindProcesses
${If} $0 > 0
StrCpy $0 "Draw.exe"
KillProc::KillProcesses
${Endif}

this code is working fine on 32 bit machine,
anyone can please suggest what to do for for killing process in x64 bit machine.

Afrow UK · 6th May 2010, 13:40

Is the process a 32-bit process or a 64-bit one? What is $1 set to after calling KillProcesses?

Stu

dhiraj3301 · 6th May 2010, 14:21

it is 64 bit process

process name is same but it is not able to find that process using
KillProc::FindProcesses

Afrow UK · 6th May 2010, 16:11

What is the value of $1 after the KillProcesses call?
Does the plug-in kill 32-bit processes OK?

Stu

dhiraj3301 · 7th May 2010, 04:37

the value of $1 after the KillProcesses call is 0
this plug in kill 32-bit machines processes sucessfully.

Afrow UK · 7th May 2010, 09:38

This is a problem with the EnumProcessModules API and 32-bit processes. It cannot enumerate modules of a 64-bit process when the caller is a 32-bit process, therefore it fails to find your process name. If you must kill your application (i.e. you cannot safely close it with WM_CLOSE for example) then you will need to write a 64-bit executable to do it that you execute with NSIS. Don't bother trying any other plug-ins either because the EnumProcessModules limitation is not plug-in specific.

Stu

Javarome · 2nd November 2010, 13:29

I confirm the need for a 64 bit process killing ability. Anything planned about that?

demiller9 · 2nd November 2010, 18:44

Have you tried to use WMI? You should be able to query the processes (by name) and when you have the one you want to kill, call the Terminate method on the WMI process object.

Javarome · 11th February 2011, 11:14

Yes WMI seems to be the recommended approach to implement it, but I was more expecting a support from NSIS (or a NSIS plugin).

That said, I also found the EnumProcessModulesEx is your friend for listing both 32 and 64 bits processes, but with static linking issues however (not located in the same library since Win7).

Afrow UK · 11th February 2011, 15:12

As I've already said, EnumProcessModulesEx is no good when the calling process is 32-bit. It will return the same results as EnumProcessModules (MSDN states this too). The only way is to use WMI (or write a 64-bit app to do it).

Stu

chironex · 21st July 2011, 20:26

I had the same problem and updated the code to use WMI as was suggested.

http://chironexsoftware.com/blog/?p=34

Brummelchen · 8th January 2012, 23:30

the documentation of this plugin is really poor

Quote:

KillProcWMI , is an NSIS plugin based on the original KillProc plugin. KillProcWMI uses WMI to acheive the same results, which avoids problems with 32bit processes not being able to kill 64 bit processes.

All Code is freely provided, no guarantees or warranties about its quality, use at your own risk.

Jared Allen.
ChironexSoftware.com

i have tried all options to get it working - failed

tried it with "killproc", "killprocwmi" with same filename...
http://nsis.sourceforge.net/KillProc_plug-in

anyone with a working example? (and file places to put in except \plugins)

Afrow UK · 9th January 2012, 00:24

Did you use the DLL he provided? http://www.chironexsoftware.com/down...illProcWMI.zip

Stu

lkn · 20th February 2018, 13:51

Quote:

Originally Posted by Afrow UK

Did you use the DLL he provided? http://www.chironexsoftware.com/down...illProcWMI.zip

This link has expired. Does anyone have a copy??
I googled it, but I'm not lucky.

Brummelchen · 9th January 2012, 16:23

ofc - thats why i wonder it does not work.
the major problem is that i can not compile the file!

Afrow UK · 9th January 2012, 18:38

What do you mean it does not work? What do you mean you cannot compile the file? Please elaborate.

Stu

Brummelchen · 9th January 2012, 21:01

compiling
KillProc::FindProcesses

not compiling
KillProcWMI::FindProcesses

> Invalid command: KillProcWMI::FindProcesses

if i rename KillProcWMI.dll to KillProc.dll
and use the regular Killproc syntax

> Invalid command: KillProc::FindProcesses

bleh

so what is the correct syntax?

both dll are in \plugins

Afrow UK · 9th January 2012, 21:03

There is only one function KillProcWMI::KillProc (if in doubt look at the source code, or look at the output from makensis which lists all plug-in functions).

Stu

Brummelchen · 9th January 2012, 21:59

omg how stupid ist that?
ofc i can force terminating a thread but more polite is the option for user to end it manually
so i try to find the process at first but there is no plugin for x64 which can do that.

Brummelchen · 14th January 2012, 16:24

sorry, wont work here

StrCpy $0 "filename.exe"
KillProcWMI::KillProc

any new hints for 64bit?

Rapport12 · 16th February 2012, 04:17

I was successful using:

KillProcWMI::KillProc "ProcessName.exe"

In that way I guess it works more like the older KillProc Plug-in rather than the new one. However, I was able to terminate a 64-bit process on Windows Server 2008 R2 using it.

Brummelchen · 16th February 2012, 21:12

i will try next days, actually i still need WMIC to determine task and to kill it.

stass · 20th February 2018, 14:33

https://github.com/axelstudios/Mouse...illProcWMI.zip

6th May 2010, 11:44	#1
dhiraj3301 Junior Member Join Date: Apr 2010 Posts: 39	KillProc plug-in is not working in x64 bit machines KillProc plug-in is not working in x64 bit machines I have written following code: StrCpy $0 "Draw.exe" KillProc::FindProcesses ${If} $0 > 0 StrCpy $0 "Draw.exe" KillProc::KillProcesses ${Endif} this code is working fine on 32 bit machine, anyone can please suggest what to do for for killing process in x64 bit machine.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode

6th May 2010, 13:40	#2
Afrow UK Moderator Join Date: Nov 2002 Location: Surrey, England Posts: 8,434	Is the process a 32-bit process or a 64-bit one? What is $1 set to after calling KillProcesses? Stu

6th May 2010, 14:21	#3
dhiraj3301 Junior Member Join Date: Apr 2010 Posts: 39	it is 64 bit process process name is same but it is not able to find that process using KillProc::FindProcesses

6th May 2010, 16:11	#4
Afrow UK Moderator Join Date: Nov 2002 Location: Surrey, England Posts: 8,434	What is the value of $1 after the KillProcesses call? Does the plug-in kill 32-bit processes OK? Stu

7th May 2010, 04:37	#5
dhiraj3301 Junior Member Join Date: Apr 2010 Posts: 39	the value of $1 after the KillProcesses call is 0 this plug in kill 32-bit machines processes sucessfully.

7th May 2010, 09:38	#6
Afrow UK Moderator Join Date: Nov 2002 Location: Surrey, England Posts: 8,434	This is a problem with the EnumProcessModules API and 32-bit processes. It cannot enumerate modules of a 64-bit process when the caller is a 32-bit process, therefore it fails to find your process name. If you must kill your application (i.e. you cannot safely close it with WM_CLOSE for example) then you will need to write a 64-bit executable to do it that you execute with NSIS. Don't bother trying any other plug-ins either because the EnumProcessModules limitation is not plug-in specific. Stu

2nd November 2010, 13:29	#7
Javarome Junior Member Join Date: Oct 2010 Location: Paris, France Posts: 9	I confirm the need for a 64 bit process killing ability. Anything planned about that?

2nd November 2010, 18:44	#8
demiller9 Senior Member Join Date: Mar 2006 Location: Dallas Posts: 462	Have you tried to use WMI? You should be able to query the processes (by name) and when you have the one you want to kill, call the Terminate method on the WMI process object.

11th February 2011, 11:14	#9
Javarome Junior Member Join Date: Oct 2010 Location: Paris, France Posts: 9	Yes WMI seems to be the recommended approach to implement it, but I was more expecting a support from NSIS (or a NSIS plugin). That said, I also found the EnumProcessModulesEx is your friend for listing both 32 and 64 bits processes, but with static linking issues however (not located in the same library since Win7).

11th February 2011, 15:12	#10
Afrow UK Moderator Join Date: Nov 2002 Location: Surrey, England Posts: 8,434	As I've already said, EnumProcessModulesEx is no good when the calling process is 32-bit. It will return the same results as EnumProcessModules (MSDN states this too). The only way is to use WMI (or write a 64-bit app to do it). Stu

21st July 2011, 20:26	#11
chironex Junior Member Join Date: Jul 2011 Posts: 1	I had the same problem and updated the code to use WMI as was suggested. http://chironexsoftware.com/blog/?p=34

9th January 2012, 00:24	#13
Afrow UK Moderator Join Date: Nov 2002 Location: Surrey, England Posts: 8,434	Did you use the DLL he provided? http://www.chironexsoftware.com/down...illProcWMI.zip Stu

9th January 2012, 16:23	#15
Brummelchen Major Dude Join Date: May 2003 Posts: 681	ofc - thats why i wonder it does not work. the major problem is that i can not compile the file!

9th January 2012, 18:38	#16
Afrow UK Moderator Join Date: Nov 2002 Location: Surrey, England Posts: 8,434	What do you mean it does not work? What do you mean you cannot compile the file? Please elaborate. Stu

9th January 2012, 21:01	#17
Brummelchen Major Dude Join Date: May 2003 Posts: 681	compiling KillProc::FindProcesses not compiling KillProcWMI::FindProcesses > Invalid command: KillProcWMI::FindProcesses if i rename KillProcWMI.dll to KillProc.dll and use the regular Killproc syntax > Invalid command: KillProc::FindProcesses bleh so what is the correct syntax? both dll are in \plugins

9th January 2012, 21:03	#18
Afrow UK Moderator Join Date: Nov 2002 Location: Surrey, England Posts: 8,434	There is only one function KillProcWMI::KillProc (if in doubt look at the source code, or look at the output from makensis which lists all plug-in functions). Stu

9th January 2012, 21:59	#19
Brummelchen Major Dude Join Date: May 2003 Posts: 681	omg how stupid ist that? ofc i can force terminating a thread but more polite is the option for user to end it manually so i try to find the process at first but there is no plugin for x64 which can do that.

14th January 2012, 16:24	#20
Brummelchen Major Dude Join Date: May 2003 Posts: 681	sorry, wont work here StrCpy $0 "filename.exe" KillProcWMI::KillProc any new hints for 64bit?

16th February 2012, 04:17	#21
Rapport12 Junior Member Join Date: Feb 2012 Posts: 3	I was successful using: KillProcWMI::KillProc "ProcessName.exe" In that way I guess it works more like the older KillProc Plug-in rather than the new one. However, I was able to terminate a 64-bit process on Windows Server 2008 R2 using it.

16th February 2012, 21:12	#22
Brummelchen Major Dude Join Date: May 2003 Posts: 681	i will try next days, actually i still need WMIC to determine task and to kill it.

20th February 2018, 14:33	#23
stass Senior Member Join Date: Nov 2012 Posts: 161	https://github.com/axelstudios/Mouse...illProcWMI.zip