Declined Fix ISAPP

[vefatica]

Sometimes ".EXE" must be present.

v:\> if isapp outlook.exe echo yes
yes

v:\> if isapp outlook echo yes

v:\>

Sometimes ".EXE" must not be present.

v:\> if isapp wininit.exe echo yes

v:\> if isapp wininit echo yes
yes

v:\>

Sometimes they both work.

v:\> if isapp svchost.exe echo yes
yes

v:\> if isapp svchost echo yes
yes

 

[rconn]

WAD. You're not doing what you think you're doing.

Sometimes ".EXE" must be present.

v:\> if isapp outlook.exe echo yes
yes

v:\> if isapp outlook echo yes

Outlook's name in the tasklist is "outlook.exe". I could blindly add an ".exe" extension, but it would break the following cases ...

Sometimes ".EXE" must not be present.

v:\> if isapp wininit.exe echo yes

v:\> if isapp wininit echo yes
yes

Wininit's name in the tasklist (like many others) does not have an ".exe" extension.

Sometimes they both work.


v:\> if isapp svchost.exe echo yes
yes

v:\> if isapp svchost echo yes
yes

Nope - you're actually querying two different processes, one named "svchost" and another named "svchost.exe".

You can use a wildcard with ISAPP if you don't know whether the process has an extension in the name.

 

[vefatica]

What tasklist? In TCC's TASKLIST no process has "exe".

 

[rconn]

What tasklist? In TCC's TASKLIST no process has "exe".

The structure for the process list in Windows looks like this:

typedef struct tagPROCESSENTRY32W
{
DWORD dwSize;
DWORD cntUsage;
DWORD th32ProcessID; // this process
ULONG_PTR th32DefaultHeapID;
DWORD th32ModuleID; // associated exe
DWORD cntThreads;
DWORD th32ParentProcessID; // this process's parent process
LONG pcPriClassBase; // Base priority of process's threads
DWORD dwFlags;
WCHAR szExeFile[MAX_PATH]; // Path
} PROCESSENTRY32W;

ISAPP is trying to match the "szExeFile" name. Which sometimes has an .exe, and sometimes doesn't. And sometimes both for the same name (but which are different processes).