Logging all ancestor processes

(cherry picked from commit 5e3ef0de129b2cab06b757aff818a08d34d99d4a)

Source commit: aab97a779eb5de58d6b35ab95ed00f540e0be10e

source/core/Common.cpp

@@ -4131,6 +4131,41 @@ DWORD __fastcall GetParentProcessId(HANDLE Snapshot, DWORD ProcessId)
   return Result;
 }
 //---------------------------------------------------------------------------
+static UnicodeString GetProcessName(DWORD ProcessId)
+{
+  UnicodeString Result;
+  if (ProcessId == 0)
+  {
+    Result = L"err-notfound";
+  }
+  else
+  {
+    HANDLE Process = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, ProcessId);
+    if (!Process)
+    {
+      // is common, when the parent process is installer, so we ignore it
+      Result = UnicodeString();
+    }
+    else
+    {
+      Result.SetLength(MAX_PATH);
+      DWORD Len = GetModuleFileNameEx(Process, NULL, Result.c_str(), Result.Length());
+      if (Len == 0)
+      {
+        // is common too, for some reason
+        Result = UnicodeString();
+      }
+      else
+      {
+        Result.SetLength(Len);
+        Result = ExtractProgramName(FormatCommand(Result, UnicodeString()));
+      }
+      CloseHandle(Process);
+    }
+  }
+  return Result;
+}
+//---------------------------------------------------------------------------
 UnicodeString ParentProcessName;
 //---------------------------------------------------------------------------
 UnicodeString __fastcall GetAncestorProcessName(int Levels)
@@ -4149,40 +4184,21 @@ UnicodeString __fastcall GetAncestorProcessName(int Levels)
 
       DWORD ProcessId = GetCurrentProcessId();
 
-      while ((Levels > 0) && (ProcessId != 0))
+      // Either more to go (>0) or collecting all levels (-1 from GetAncestorProcessNames)
+      while ((Levels != 0) &&
+             (ProcessId != 0))
       {
         ProcessId = GetParentProcessId(Snapshot, ProcessId);
+        if ((Levels < 0) && (ProcessId != 0))
+        {
+          AddToList(Result, GetProcessName(ProcessId), L", ");
+        }
         Levels--;
       }
 
-      if (ProcessId == 0)
+      if (Levels >= 0)
       {
-        Result = L"err-notfound";
-      }
-      else
-      {
-        HANDLE Process = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, ProcessId);
-        if (!Process)
-        {
-          // is common, when the parent process is installer, so we ignore it
-          Result = UnicodeString();
-        }
-        else
-        {
-          Result.SetLength(MAX_PATH);
-          DWORD Len = GetModuleFileNameEx(Process, NULL, Result.c_str(), Result.Length());
-          if (Len == 0)
-          {
-            // is common too, for some reason
-            Result = UnicodeString();
-          }
-          else
-          {
-            Result.SetLength(Len);
-            Result = ExtractProgramName(FormatCommand(Result, UnicodeString()));
-          }
-          CloseHandle(Process);
-        }
+        Result = GetProcessName(ProcessId);
       }
 
       CloseHandle(Snapshot);
@@ -4199,3 +4215,14 @@ UnicodeString __fastcall GetAncestorProcessName(int Levels)
   }
   return Result;
 }
+//---------------------------------------------------------------------------
+UnicodeString AncestorProcessNames;
+//---------------------------------------------------------------------------
+UnicodeString GetAncestorProcessNames()
+{
+  if (AncestorProcessNames.IsEmpty())
+  {
+    AncestorProcessNames = GetAncestorProcessName(-1);
+  }
+  return AncestorProcessNames;
+}

source/core/Common.h

@@ -185,6 +185,7 @@ UnicodeString GetOSInfo();
 UnicodeString GetEnvironmentInfo();
 void SetStringValueEvenIfEmpty(TStrings * Strings, const UnicodeString & Name, const UnicodeString & Value);
 UnicodeString __fastcall GetAncestorProcessName(int Levels = 1);
+UnicodeString GetAncestorProcessNames();
 //---------------------------------------------------------------------------
 struct TSearchRecSmart : public TSearchRec
 {

source/core/SessionInfo.cpp

@@ -1175,7 +1175,7 @@ void __fastcall TSessionLog::DoAddStartupInfo(TSessionData * Data)
     ADF(L"Local account: %s", (UserName));
     ADF(L"Working directory: %s", (GetCurrentDir()));
     ADF(L"Process ID: %d", (int(GetCurrentProcessId())));
-    ADF(L"Parent process: %s", (GetAncestorProcessName()));
+    ADF(L"Ancestor processes: %s", (GetAncestorProcessNames()));
     ADF(L"Command-line: %s", (GetCmdLineLog()));
     if (FConfiguration->ActualLogProtocol >= 1)
     {