Win32_ProcessStopTrace

[goblin]

Help please, tell where I was mistaken... I took this code:

 Const SW_NORMAL = 1
strComputer = "."
strCommand = "Notepad.exe" 
Set objWMIService = GetObject("winmgmts:" _
  & "{impersonationLevel=impersonate}!\\" _
  & strComputer & "\root\cimv2")

Set objStartup = objWMIService.Get("Win32_ProcessStartup")
Set objConfig = objStartup.SpawnInstance_

objConfig.ShowWindow = SW_NORMAL
Set objProcess = objWMIService.Get("Win32_Process")
intReturn = objProcess.Create _
  (strCommand, Null, objConfig, intProcessID)
If intReturn <> 0 Then
  Wscript.Echo "Process could not be created." & _
    vbNewLine & "Command line: " & strCommand & _
    vbNewLine & "Return value: " & intReturn
Else
  Wscript.Echo "Process created." & _
    vbNewLine & "Command line: " & strCommand & _
    vbNewLine & "Process ID: " & intProcessID  
  Set colProcessStopTrace = objWMIService.ExecNotificationQuery _
    ("SELECT * FROM Win32_ProcessStopTrace")
    WScript.Echo "Waiting for process to stop ..."
  Do
    Set objLatestEvent = colProcessStopTrace.NextEvent
    If objLatestEvent.ProcessId = intProcessID Then
      Wscript.Echo "StoppedProcess Name: " _
        & objLatestEvent.ProcessName
      Wscript.Echo "Process ID: " & objLatestEvent.ProcessId
      WScript.Echo "Exit code: " & objLatestEvent.ExitStatus
  End If
 Loop
End If

From: http://msdn2.microsoft.com/en-us/library/aa394376.aspx

Also has copied it in SWFKit so:

SW_NORMAL = 1
strCommand = "Notepad.exe"
var wbemLocator = new ActiveXObject("WbemScripting.SWbemLocator");
objWMIService = wbemLocator.ConnectServer("localhost", "root\\cimv2");

var objStartup = objWMIService.Get("Win32_ProcessStartup")
var objConfig = objStartup.SpawnInstance

objConfig.ShowWindow = SW_NORMAL
var objProcess = objWMIService.Get("Win32_Process")
intReturn = objProcess.Create(strCommand, null, objConfig)
if(intReturn != 0){
	Dialogs.msgBox("Process could not be created.Command line: "+strCommand+"Return value: "+intReturn)
}else{
	Dialogs.msgBox( "Process created.Command line: "+strCommand+"Process ID: "+intProcessID)
	var colProcessStopTrace = bjWMIService.ExecNotificationQuery("SELECT * FROM Win32_ProcessStopTrace")
	Dialogs.msgBox("Waiting for process to stop ...")
	Dialogs.msgBox("colProcessStopTrace.count::",colProcessStopTrace.count)
	var enumProcesses = new Enumerator(colProcessStopTrace);
	while (!enumProcesses.atEnd()) {
		var objLatestEvent = enumProcesses.item().NextEvent()
		
		//if(objLatestEvent.ProcessId == intProcessID){
			Dialogs.msgBox("StoppedProcess Name: "+objLatestEvent.ProcessName+"Process ID: "+objLatestEvent.ProcessId+"Exit code: "+objLatestEvent.ExitStatus)
		//}
		enumProcesses.moveNext();
	}
}

But at me it is deduced:

Process created.
Command line: Notepad.exe
Process ID: undefined
Waiting for process to stop...
colProcessStopTrace.count::
StoppedProcess Name: undefined
Process ID: undefined
Exit Code undefined
StoppedProcess Name: undefined
Process ID: undefined
Exit Code undefined
StoppedProcess Name: undefined
Process ID: undefined
Exit Code undefined
...

:-[

[SWFKit]

SW_NORMAL = 1
strCommand = "Notepad.exe"
var wbemLocator = new ActiveXObject("WbemScripting.SWbemLocator");
objWMIService = wbemLocator.ConnectServer("localhost", "root\\cimv2");

var objStartup = objWMIService.Get("Win32_ProcessStartup")
var objConfig = objStartup.SpawnInstance_
objConfig.properties_.item("ShowWindow").value = SW_NORMAL;

var objProcess = objWMIService.Get("Win32_Process")
intReturn = objProcess.Create(strCommand, null, objConfig)

if(intReturn != 0){
	trace("Process could not be created.Command line: "+strCommand+"Return value: "+intReturn)
}else{
	trace( "Process created.Command line: "+strCommand+"Process ID: "+intProcessID)
	var colProcessStopTrace = objWMIService.ExecNotificationQuery("SELECT * FROM Win32_ProcessStopTrace")
	trace("Waiting for process to stop ...")
	
	while (1) {
		var objLatestEvent = colProcessStopTrace.nextEvent();
		trace(objLatestEvent.processName + " has been closed!");
		if (objLatestEvent.processName == 'notepad.exe') break;
	}
}

The "create" method of the "win32_process" object has an out parameter "processid". However, ffish script cannot handle out parameters; that is to say, you cannot get the id of the newly created process, so you will have to use process name to check whether the process has been terminated.