I’m new to C and am working with the Win32 API to create a process with CreateProcessW()
. This is my first C program. It opens notepad.exe
and outputs the process ID using dwProcessId
. But the PID that is outputted is always different from the PID of the open notepad.exe
process I see in Task Manager. Why is this?
C code:
#include <stdio.h>
#include <windows.h>
int main (void){
STARTUPINFOW si = { sizeof(si) };
PROCESS_INFORMATION pi = { 0 };
if (!CreateProcessW(
L"C:\Windows\System32\notepad.exe",
NULL, // Command line arguments
NULL, // Process security attributes
NULL, // Thread security attributes
FALSE, // Handle inheritance
0, // Creation flags
NULL, // Environment block
NULL, // Current directory
&si, // Startup information
&pi)) // Process information
{
printf("(-) failed to create process, error: %ldn", GetLastError());
return EXIT_FAILURE;
}
// Print PID
printf("Process ID: %lun", pi.dwProcessId);
Sleep(9000); // Wait for 5 seconds
// Close process and thread handles
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
return EXIT_SUCCESS;
}
For example, the console output when run is “Process ID: 35692”, but when searching for Notepad in Task Manager, the PID shown is 20736.
What am I doing wrong?
14
I’ve found that if you open Notepad first and then create a notepad.exe process. The PID of the notepad.exe in taskmanager is the same as pi.dwProcessId.
1
Accoring to Hans Passant’s suggestion:
You could try to turn of app execution aliases for your account in Windows 11:
Settings -> Apps -> Advanced app settings -> App execution aliases
The PID of the notepad.exe in taskmanager is the same as pi.dwProcessId.
1