How to get parent process in .NET in managed way

后端 未结 6 593
伪装坚强ぢ
伪装坚强ぢ 2020-11-22 03:39

I was looking a lot for method to get parent process in .NET, but found only P/Invoke way.

6条回答
  •  醉酒成梦
    2020-11-22 04:29

    Here is a solution. It uses p/invoke, but seems to work well, 32 or 64 cpu:

        /// 
        /// A utility class to determine a process parent.
        /// 
        [StructLayout(LayoutKind.Sequential)]
        public struct ParentProcessUtilities
        {
            // These members must match PROCESS_BASIC_INFORMATION
            internal IntPtr Reserved1;
            internal IntPtr PebBaseAddress;
            internal IntPtr Reserved2_0;
            internal IntPtr Reserved2_1;
            internal IntPtr UniqueProcessId;
            internal IntPtr InheritedFromUniqueProcessId;
    
            [DllImport("ntdll.dll")]
            private static extern int NtQueryInformationProcess(IntPtr processHandle, int processInformationClass, ref ParentProcessUtilities processInformation, int processInformationLength, out int returnLength);
    
            /// 
            /// Gets the parent process of the current process.
            /// 
            /// An instance of the Process class.
            public static Process GetParentProcess()
            {
                return GetParentProcess(Process.GetCurrentProcess().Handle);
            }
    
            /// 
            /// Gets the parent process of specified process.
            /// 
            /// The process id.
            /// An instance of the Process class.
            public static Process GetParentProcess(int id)
            {
                Process process = Process.GetProcessById(id);
                return GetParentProcess(process.Handle);
            }
    
            /// 
            /// Gets the parent process of a specified process.
            /// 
            /// The process handle.
            /// An instance of the Process class.
            public static Process GetParentProcess(IntPtr handle)
            {
                ParentProcessUtilities pbi = new ParentProcessUtilities();
                int returnLength;
                int status = NtQueryInformationProcess(handle, 0, ref pbi, Marshal.SizeOf(pbi), out returnLength);
                if (status != 0)
                    throw new Win32Exception(status);
    
                try
                {
                    return Process.GetProcessById(pbi.InheritedFromUniqueProcessId.ToInt32());
                }
                catch (ArgumentException)
                {
                    // not found
                    return null;
                }
            }
        }
    

提交回复
热议问题