Skip to main content

Introducing Winp: Windows Process Manipulation Library

Posted by kohsuke on March 16, 2008 at 6:23 PM PDT

I wrote a library called winp that lets you do lower-level process managements on Windows. So far it includes things like killing random processes (not just the ones you launched), killing a process recursively, or finding out the environment variables and command line arguments given to the process.

My short-term goal is to use this in Hudson so that I can clean up the run-away processes (which are often left by jobs that deal with daemons like application servers), but I thought this kind of features would hopefully be useful for other applications.

In this library, I created a DLL without linking to the C runtime library, which helps me keep the DLL file size rather small (currently around 6K.) To use this library, just put winp.jar in your classpath — As with all my other projects that deal with JNI (like com4j), there's no need to deal with a DLL separately.

Related Topics >>


Introducing Winp: Windows

I looked at the C source code and found few considerations.
C source:
Deprecated Win32 functions in use but I guess this was just a fallback code for older NT systems. Modern windowses use "KillProcessTreeWinHelper" helper function anyway.
KillProcessTreeWinHelper function
Recursive iteration over all processes, if parentPID=processPID then kills from bottom-to-up tree ordering.
This ok according to Microsoft documentation, but unfortunately at least WinXP (and maybe other winOSses) has a major bug. Chil processes may lose a terminated parent process anytime and child is left limbo. This is not an option inside OS process list so WinXP attaches limbo to a random process. New process now gets a child it was not supposed to have. Killing new parentPID will kill the new child it was not supposed to have.
Common solution is to use getProcessTimes function to doublecheck parent-child relation. ParentPID must be older than child process, if not then skip child process.
- iterate over processtree list, was earlier constructed
- get process creation times, compare parent and child timestamps, possibly removing child from the list
- kill remaining processes from bottom-to-up ordering
Limbo parent-child relation may happen if you have server running 24h/7d, run miscellaneous processes, processes come and go and sometimes is terminated. Its extremely hard to debug it may not happen for several days then once and wrong process was killed. I had to struggle this for 6 months before figured why server processes was randomly killed.
Its still always possible limbo child was attached to a new process that was created earlier thus creating a valid-but-invalid relation. But this fix solves most common problem when you kill a parent you can skip a new child that was started earlier.
Here is Delphi calls how to open a process handle, query_information flag should be used. Close handles after use.
procHandle := OpenProcess(PROCESS_QUERY_INFORMATION or SYNCHRONIZE, true, pid);
getProcessTimes(procHandle, createdTime, exitTime, kernelTime, userTime)

Amazing! But I can't find any

Amazing! But I can't find any native code? Could you please provide it as it is nessesary for my project..

Hello! Thank you for this very good piece of code. I'd like to add some functions to the DLL in order to monitor memory consumption of processes. However, I cannot find the source code of the winp.dll. Could you point me to that? Thanks a lot.

So far it includes things like killing random processes

Mmm, killing random processes! Sounds like a new variant of Russian Roulette! =)


Very nice. Do you have the source and notes on how you built the nice small .dll? MSVC? Gnu toolchain? The -sources.jar just has the .dll in it, none of the native code. Thanks for all the excellent work! -=- D. J.

I think in this situation, JNI was appropriate. This only works on 32bit Windows anyway, and JNA would have made this 10 times bigger.

I would like to use it in my work, may I know what license is used for Winp? Thank you.

djhagberg -- yes, the entire source code is in the Subversion repository of the project. I'll post a separate note about how to create a small DLL.

trembovetski -- Right. I guess I should have said "kill processes of your choice at will."

I took a look at the winp native code a few weeks ago and it looked like you could also implement it using JNA. No need for another native DLL. It might also be interesting to build out your library further, just as the JRuby folks are doing with their POSIX layer built on top of JNA.

MIT license. I updated the project site with this info.