Get a List of Child Processes from Parent Process in C and C++ (Cross-Platform, No Command Line)

Question

How to get a list of child process ID's from a given parent process ID in a cross-platform manner in C and C++ without using command line? I provided an answer myself below which covers Win32, macOS, Linux, FreeBSD, DragonFly BSD, OpenBSD, NetBSD, and Darwin, in C++.

Feel free to convert my code to a C solution, (along with native API's or POSIX as needed), or provide your own solutions using a different API or approach, but without using stuff like popen() or system(). Adding support for more platforms is obviously also welcome.

For example: Illumos variants, mobile platforms, etc.

Answer 1

The code below was mostly pulled from this command line app I wrote.

Win32

#include <algorithm>
#include <vector>

#include "childpids.h"

#include <windows.h>
#include <tlhelp32.h>

using std::vector;

void ProcIdFromParentProcId(PROCID parentProcId, PROCID **procId, int *size) {
  vector<PROCID> vec; int i = 0;
  HANDLE hp = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  PROCESSENTRY32 pe = { 0 };
  pe.dwSize = sizeof(PROCESSENTRY32);
  if (Process32First(hp, &pe)) {
    do {
      if (pe.th32ParentProcessID == parentProcId) {
        vec.push_back(pe.th32ProcessID); i++;
      }
    } while (Process32Next(hp, &pe));
  }
  CloseHandle(hp);
  *procId = (PROCID *)malloc(sizeof(PROCID) * vec.size());
  if (procId) {
    std::copy(vec.begin(), vec.end(), *procId);
    *size = i;
  }
}

macOS & Darwin

#include <algorithm>
#include <vector>

#include "childpids.h"

#include <sys/proc_info.h>
#include <libproc.h>

using std::vector;

void ParentProcIdFromProcId(PROCID procId, PROCID *parentProcId) {
  proc_bsdinfo proc_info;
  if (proc_pidinfo(procId, PROC_PIDTBSDINFO, 0, &proc_info, sizeof(proc_info)) > 0) {
    *parentProcId = proc_info.pbi_ppid;
  }
}

void ProcIdFromParentProcId(PROCID parentProcId, PROCID **procId, int *size) {
  vector<PROCID> vec; int i = 0;
  int cntp = proc_listpids(PROC_ALL_PIDS, 0, nullptr, 0);
  vector<PROCID> proc_info(cntp);
  std::fill(proc_info.begin(), proc_info.end(), 0);
  proc_listpids(PROC_ALL_PIDS, 0, &proc_info[0], sizeof(PROCID) * cntp);
  // this Darwin API ^ lists them in reverse order from other platforms
  for (int j = cntp - 1; j >= 0; j--) {
    if (proc_info[j] == 0) { continue; }
    PROCID ppid; ParentProcIdFromProcId(proc_info[j], &ppid);
    if (proc_info[j] > 0 && ppid >= 0 && ppid == parentProcId) {
      vec.push_back(proc_info[j]); i++;
    }
  }
  *procId = (PROCID *)malloc(sizeof(PROCID) * vec.size());
  if (procId) {
    std::copy(vec.begin(), vec.end(), *procId);
    *size = i;
  }
}

Linux (link with: -lprocps)

// Note: Ubuntu/Debian need to install libprocps-dev for the development headers.
// All major Linux distros *should* have the actual library installed by default.
// Arch-Linux/Gentoo are exceptions if users did not install a DE which needs it.

#include <algorithm>
#include <vector>

#include "childpids.h"

#include <proc/readproc.h>

using std::vector;

void ProcIdFromParentProcId(PROCID parentProcId, PROCID **procId, int *size) {
  vector<PROCID> vec; int i = 0;
  PROCTAB *proc = openproc(PROC_FILLSTAT);
  while (proc_t *proc_info = readproc(proc, nullptr)) {
    if (proc_info->ppid == parentProcId) {
      vec.push_back(proc_info->tgid); i++;
    }
    freeproc(proc_info);
  }
  *procId = (PROCID *)malloc(sizeof(PROCID) * vec.size());
  if (procId) {
    std::copy(vec.begin(), vec.end(), *procId);
    *size = i;
  }
}

FreeBSD (link with: -lutil -lc)

#include <algorithm>
#include <vector>

#include <cstdlib>

#include "childpids.h"

#include <sys/types.h>
#include <sys/user.h>

#include <libutil.h>

using std::vector;

void ProcIdFromParentProcId(PROCID parentProcId, PROCID **procId, int *size) {
  vector<PROCID> vec; int i = 0; int cntp;
  if (kinfo_proc *proc_info = kinfo_getallproc(&cntp)) {
    for (int j = 0; j < cntp; j++) {
      if (proc_info[j].ki_ppid == parentProcId) {
        vec.push_back(proc_info[j].ki_pid); i++;
      }
    }
    free(proc_info);
  }
  *procId = (PROCID *)malloc(sizeof(PROCID) * vec.size());
  if (procId) {
    std::copy(vec.begin(), vec.end(), *procId);
    *size = i;
  }
}

DragonFly BSD (link with: -lkvm -lc)

#include <algorithm>
#include <vector>

#include <cstdlib>
#include <climits>

#include "childpids.h"

#include <fcntl.h>

#include <sys/param.h>
#include <sys/sysctl.h>
#include <sys/user.h>

#include <kvm.h>

using std::vector;

void ProcIdFromParentProcId(PROCID parentProcId, PROCID **procId, int *size) {
  vector<PROCID> vec; int i = 0;
  char errbuf[_POSIX2_LINE_MAX];
  static kvm_t *kd = nullptr; kinfo_proc *proc_info = nullptr;
  const char *nlistf, *memf; nlistf = memf = "/dev/null";
  kd = kvm_openfiles(nlistf, memf, nullptr, O_RDONLY, errbuf); if (!kd) return;
  int cntp = 0; if ((proc_info = kvm_getprocs(kd, KERN_PROC_ALL, 0, &cntp))) {
    for (int j = 0; j < cntp; j++) {
      if (proc_info[j].kp_pid > 0 && proc_info[j].kp_ppid >= 0 && 
        proc_info[j].kp_ppid == parentProcId) {
        vec.push_back(proc_info[j].kp_pid); i++;
      }
    }
  }
  kvm_close(kd);
  *procId = (PROCID *)malloc(sizeof(PROCID) * vec.size());
  if (procId) {
    std::copy(vec.begin(), vec.end(), *procId);
    *size = i;
  }
}

OpenBSD (link with: -lkvm -lc)

#include <algorithm>
#include <vector>

#include <cstdlib>
#include <climits>

#include "childpids.h"

#include <sys/param.h>
#include <sys/sysctl.h>
#include <sys/user.h>

#include <kvm.h>

using std::vector;

void ProcIdFromParentProcId(PROCID parentProcId, PROCID **procId, int *size) {
  vector<PROCID> vec; int i = 0;
  char errbuf[_POSIX2_LINE_MAX]; int cntp = 0;
  static kvm_t *kd = nullptr; kinfo_proc *proc_info = nullptr; 
  kd = kvm_openfiles(nullptr, nullptr, nullptr, KVM_NO_FILES, errbuf); if (!kd) return;
  if ((proc_info = kvm_getprocs(kd, KERN_PROC_ALL, 0, sizeof(struct kinfo_proc), &cntp))) {
    // this API ^ on OpenBSD lists the them in reverse order like Darwin
    for (int j = cntp - 1; j >= 0; j--) {
      if (proc_info[j].p_pid > 0 && proc_info[j].p_ppid >= 0 &&
        proc_info[j].p_ppid == parentProcId) {
        vec.push_back(proc_info[j].p_pid); i++;
      }
    }
  }
  kvm_close(kd);
  *procId = (PROCID *)malloc(sizeof(PROCID) * vec.size());
  if (procId) {
    std::copy(vec.begin(), vec.end(), *procId);
    *size = i;
  }
}

NetBSD (link with: -lkvm -lc)

#include <algorithm>
#include <vector>

#include <cstdlib>
#include <climits>

#include "childpids.h"

#include <sys/param.h>
#include <sys/sysctl.h>

#include <kvm.h>

using std::vector;

void ProcIdFromParentProcId(PROCID parentProcId, PROCID **procId, int *size) {
  vector<PROCID> vec; int i = 0;
  char errbuf[_POSIX2_LINE_MAX]; int cntp = 0;
  static kvm_t *kd = nullptr; kinfo_proc2 *proc_info = nullptr;
  kd = kvm_openfiles(nullptr, nullptr, nullptr, KVM_NO_FILES, errbuf); if (!kd) return;
  if ((proc_info = kvm_getproc2(kd, KERN_PROC_ALL, 0, sizeof(struct kinfo_proc2), &cntp))) {
    // this API ^ on NetBSD lists the them in reverse order like Darwin and OpenBSD
    for (int j = cntp - 1; j >= 0; j--) {
      if (proc_info[j].p_pid > 0 && proc_info[j].p_ppid >= 0 &&
        proc_info[j].p_ppid == parentProcId) {
        vec.push_back(proc_info[j].p_pid); i++;
      }
    }
  }
  kvm_close(kd);
  *procId = (PROCID *)malloc(sizeof(PROCID) * vec.size());
  if (procId) {
    std::copy(vec.begin(), vec.end(), *procId);
    *size = i;
  }
}

childpids.h

#ifdef _WIN32
typedef unsigned long PROCID;
#else
typedef int PROCID;
#endif

void ProcIdFromParentProcId(PROCID parentProcId, PROCID **procId, int *size);

childpids.cpp

#include <iostream>
#include <vector>

#include <cstring>

#include "childpids.h"

using std::vector;

void PrintPidFromPpidRecursive(PROCID parentProcId) {
  PROCID *procId; int size;
  ProcIdFromParentProcId(parentProcId, &procId, &size);
  if (procId) {
    for (int i = 0; i < size; i++) {
      if (procId[i] == 0) { break; }
      PrintPidFromPpidRecursive(procId[i]);
      std::cout << procId[i] << std::endl;
    }
    free(procId);
  }
}

int main(int argc, char *argv[]) {
  PROCID parentProcId = (argc == 2) ? strtoul(argv[1], nullptr, 10) : 0;
  PrintPidFromPpidRecursive(parentProcId);
  return 0;
}