actually I made it by looking at the /proc file system, when you fork the process the dir named as the child pid is created, in that folder, there's a sym link to the binary file, that is my parent, until the exec finish, then is the new binary path, I just keep checking it until it change.
Maybe it isn't a very good solution but it seems to be working good
now I'm playing with mime-types, and as n00b as I am, I'm going to open a new post because I can't figure it out :S
