Close VMWare properly from debug engine

[valentinbreiz]

See https://github.com/CosmosOS/Cosmos/pull/2258

[selkij]

Sooo this can be closed?

[valentinbreiz]

No, we currently force kill the vmware process. If you have multiple VMs running it will closes everything

[selkij]

Oh ok I tought bexause the pr was merged

[AnErrupTion]

I've had 2 ideas for this:

1. Get all open file handles for each vmware-vmx process. If one of those file handles contains "Cosmos User Kit" in the path, then it was opened by Cosmos and can be killed. However, it looks like you need to inject a kernel-level driver, so this is probably not a good idea.

2. Get the command-line for each vmware-vmx process. I found that, with Process Hacker, the command line for vmware-vmx.exe contained the VMX file used by Cosmos, so we could detect that. However, I wasn't able to get the command line for vmware-vmx.exe, it always returned an empty string. I tried using WMI and native NT functions. I have no idea how Process Hacker achieves this...

[quajak]

Is the vmware-vmx a child process of the process we kill or is there no relationship between the two we can use to identify it?

[AnErrupTion]

Is the vmware-vmx a child process of the process we kill or is there no relationship between the two we can use to identify it?

No it has no relation and it's not a child process either, although it seems to be started by vmware-authd.exe (which is registered as a service), but it has no useful information.