I think something like this should be sufficient for what you are trying to accomplish.
module Zer0
#-----------------------------------------------------------------------------
# * Constants
#-----------------------------------------------------------------------------
EnumProcesses = Win32API.new ('psapi', 'EnumProcesses', 'plp', 'i')
OpenProcess = Win32API.new('kernel32', 'OpenProcess', 'lil', 'l')
GetProcessImageFileName =
Win32API.new('psapi', 'GetProcessImageFileName', 'lpl', 'l')
#-----------------------------------------------------------------------------
# * Get Array of Running Executables on the System
#-----------------------------------------------------------------------------
def self.executable_names
exes = []
pids = self.process_ids
pids.each {|pid|
handle = OpenProcess.call(0x0400, 0, pid)
next if handle == 0
buffer = "\0" * 256
result = GetProcessImageFileName.call(handle, buffer, 256)
next if result == 0
exe = buffer.delete("\0").split('\\').pop
exes.push(exe)
}
return exes
end
#-----------------------------------------------------------------------------
# * Get Array of IDs of Processes Running on the System
#-----------------------------------------------------------------------------
def self.process_ids
pids = [0].pack ('L') * 1024
bytes = [0].pack ('L')
EnumProcesses.call(pids, 1024, bytes)
count = bytes.unpack('L')[0] / 4
return pids.unpack('L' * count)
end
#-----------------------------------------------------------------------------
# * Check if Specified Executable(s) is Running
#-----------------------------------------------------------------------------
def self.check_exe(*names)
exes = self.executable_names
names.each {|name| return true if exes.include?(name) }
return false
end
end
It basically allows to check for the executable name of running processes. With that, you can do your own checks on names and compare. I will leave it to you to expand on that aspect of it, although I did make a basic function at the end to demonstrate a simple way. If you need any help using or understanding it, just ask.
I haven't tested anything yet, so I am not sure if it is possible to change the exe name to fool the script. If so, might need to change how it works a little bit. I just went for the quick and simple way of getting it done.
EDIT:
Wow, it has been a long time since I have written code using Ruby...