fibratus icon indicating copy to clipboard operation
fibratus copied to clipboard

Ensure only one instance of Fibratus can be run at a time

Open rabbitstack opened this issue 4 years ago • 0 comments

This can be accomplished by creating the event object via the CreateEvent API call. If it results in ERROR_ALREADY_EXISTS error code then we forbid spinning up a new instance. Otherwise, we permit launching the process.

Example C code:

bool CheckOneInstance()
{

    HANDLE  m_hStartEvent = CreateEventW( NULL, FALSE, FALSE, L"Global\\CSAPP" );

    if(m_hStartEvent == NULL)
    {
    CloseHandle( m_hStartEvent ); 
        return false;
    }


    if ( GetLastError() == ERROR_ALREADY_EXISTS ) {

        CloseHandle( m_hStartEvent ); 
        m_hStartEvent = NULL;
        // already exist
        // send message from here to existing copy of the application
        return false;
    }
    // the only instance, start in a usual way
    return true;
}

One instance check should be planted in:

  • the main run command including the filament variant
  • capture command
  • start service command

rabbitstack avatar Feb 24 '21 11:02 rabbitstack