如何以托管方式在.NET中获取父进程

Question

我在.NET中寻找了很多获取父进程的方法，但只找到了P/Invoke方式。

Answer 1

这是一个解决方案。它使用 p/invoke，但似乎运行良好，32 或 64 cpu:

/// <summary>
/// A utility class to determine a process parent.
/// </summary>
[StructLayout(LayoutKind.Sequential)]
public struct ParentProcessUtilities
{
    // These members must match PROCESS_BASIC_INFORMATION
    internal IntPtr Reserved1;
    internal IntPtr PebBaseAddress;
    internal IntPtr Reserved2_0;
    internal IntPtr Reserved2_1;
    internal IntPtr UniqueProcessId;
    internal IntPtr InheritedFromUniqueProcessId;

    [DllImport("ntdll.dll")]
    private static extern int NtQueryInformationProcess(IntPtr processHandle, int processInformationClass, ref ParentProcessUtilities processInformation, int processInformationLength, out int returnLength);

    /// <summary>
    /// Gets the parent process of the current process.
    /// </summary>
    /// <returns>An instance of the Process class.</returns>
    public static Process GetParentProcess()
    {
        return GetParentProcess(Process.GetCurrentProcess().Handle);
    }

    /// <summary>
    /// Gets the parent process of specified process.
    /// </summary>
    /// <param name="id">The process id.</param>
    /// <returns>An instance of the Process class.</returns>
    public static Process GetParentProcess(int id)
    {
        Process process = Process.GetProcessById(id);
        return GetParentProcess(process.Handle);
    }

    /// <summary>
    /// Gets the parent process of a specified process.
    /// </summary>
    /// <param name="handle">The process handle.</param>
    /// <returns>An instance of the Process class.</returns>
    public static Process GetParentProcess(IntPtr handle)
    {
        ParentProcessUtilities pbi = new ParentProcessUtilities();
        int returnLength;
        int status = NtQueryInformationProcess(handle, 0, ref pbi, Marshal.SizeOf(pbi), out returnLength);
        if (status != 0)
            throw new Win32Exception(status);

        try
        {
            return Process.GetProcessById(pbi.InheritedFromUniqueProcessId.ToInt32());
        }
        catch (ArgumentException)
        {
            // not found
            return null;
        }
    }
}

Answer 2

这段代码提供了一个很好的接口来查找父进程对象，并考虑到多个进程具有相同名称的可能性：

用途：

Console.WriteLine("ParentPid: " + Process.GetProcessById(6972).Parent().Id);

代码：

public static class ProcessExtensions {
    private static string FindIndexedProcessName(int pid) {
        var processName = Process.GetProcessById(pid).ProcessName;
        var processesByName = Process.GetProcessesByName(processName);
        string processIndexdName = null;

        for (var index = 0; index < processesByName.Length; index++) {
            processIndexdName = index == 0 ? processName : processName + "#" + index;
            var processId = new PerformanceCounter("Process", "ID Process", processIndexdName);
            if ((int) processId.NextValue() == pid) {
                return processIndexdName;
            }
        }

        return processIndexdName;
    }

    private static Process FindPidFromIndexedProcessName(string indexedProcessName) {
        var parentId = new PerformanceCounter("Process", "Creating Process ID", indexedProcessName);
        return Process.GetProcessById((int) parentId.NextValue());
    }

    public static Process Parent(this Process process) {
        return FindPidFromIndexedProcessName(FindIndexedProcessName(process.Id));
    }
}

Answer 3

这样：

public static Process GetParent(this Process process)
{
  try
  {
    using (var query = new ManagementObjectSearcher(
      "SELECT * " +
      "FROM Win32_Process " +
      "WHERE ProcessId=" + process.Id))
    {
      return query
        .Get()
        .OfType<ManagementObject>()
        .Select(p => Process.GetProcessById((int)(uint)p["ParentProcessId"]))
        .FirstOrDefault();
    }
  }
  catch
  {
    return null;
  }
}

Answer 4

这是我对托管解决方案的尝试。

它会轮询所有进程的性能计数器，并将子 PID 的字典返回给父 PID。然后你可以用你当前的PID查字典来查看你的父母、祖父母等。

它获得的信息量确实是多余的。随意优化。

using System;
using System.Collections.Generic;
using System.Diagnostics;

namespace PidExamples
{
    class ParentPid
    {
        static void Main(string[] args)
        {
            var childPidToParentPid = GetAllProcessParentPids();
            int currentProcessId = Process.GetCurrentProcess().Id;

            Console.WriteLine("Current Process ID: " + currentProcessId);
            Console.WriteLine("Parent Process ID: " + childPidToParentPid[currentProcessId]);
        }

        public static Dictionary<int, int> GetAllProcessParentPids()
        {
            var childPidToParentPid = new Dictionary<int, int>();

            var processCounters = new SortedDictionary<string, PerformanceCounter[]>();
            var category = new PerformanceCounterCategory("Process");

            // As the base system always has more than one process running, 
            // don't special case a single instance return.
            var instanceNames = category.GetInstanceNames();
            foreach(string t in instanceNames)
            {
                try
                {
                    processCounters[t] = category.GetCounters(t);
                }
                catch (InvalidOperationException)
                {
                    // Transient processes may no longer exist between 
                    // GetInstanceNames and when the counters are queried.
                }
            }

            foreach (var kvp in processCounters)
            {
                int childPid = -1;
                int parentPid = -1;

                foreach (var counter in kvp.Value)
                {
                    if ("ID Process".CompareTo(counter.CounterName) == 0)
                    {
                        childPid = (int)(counter.NextValue());
                    }
                    else if ("Creating Process ID".CompareTo(counter.CounterName) == 0)
                    {
                        parentPid = (int)(counter.NextValue());
                    }
                }

                if (childPid != -1 && parentPid != -1)
                {
                    childPidToParentPid[childPid] = parentPid;
                }
            }

            return childPidToParentPid;
        }
    }
}

在其他新闻中，我了解到我的机器上有多少个性能计数器：13401。天啊。

Answer 5

如果接受 P/Invoke，有一个更好的方法，比 NtQueryInformationProcess：即PROCESSENTRY32（CreateToolhelp32Snapshot、Process32First、Process32Next）。它显示在这篇文章中。

注意细微的细节请注意，父 PID 不一定是创建者 PID，事实上，正如社区评论所指出的，这些可能完全无关流程输入32.

Answer 6

不幸的是，从 .NET 9 开始，仍然没有托管的跨平台解决方案来获取父进程。

此问题正在 .NET 存储库上讨论（自 2017 年 12 月 12 日起）：通过 System.Diagnostics.Process 公开父/子进程信息 (#24423).

Answer 7

如果你挖掘过BCL，你会发现寻找父进程的方法都被刻意回避了，比如：

https://referencesource.microsoft.com/#System/services/monitoring/system/diagnosticts/ProcessManager.cs,327

正如您在源代码中看到的，它包含全面的结构和导入的本机方法，这绝对足以完成工作。但是，即使您通过反射访问它们（这是可能的），您也找不到直接执行此操作的方法。我无法回答为什么，但这种现象会导致像你这样的问题被反复问到；例如：

如何获取我的应用程序父进程的PID

由于在这个线程中没有答案以及使用 CreateToolhelp32Snapshot 的一些代码，我将添加它 - 我从 MS 的参考源中窃取的部分结构定义和名称:)

代码

using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Collections.Generic;
using System.Linq;
using System;

public static class Toolhelp32 {
    public const uint Inherit = 0x80000000;
    public const uint SnapModule32 = 0x00000010;
    public const uint SnapAll = SnapHeapList|SnapModule|SnapProcess|SnapThread;
    public const uint SnapHeapList = 0x00000001;
    public const uint SnapProcess = 0x00000002;
    public const uint SnapThread = 0x00000004;
    public const uint SnapModule = 0x00000008;

    [DllImport("kernel32.dll")]
    static extern bool CloseHandle(IntPtr handle);
    [DllImport("kernel32.dll")]
    static extern IntPtr CreateToolhelp32Snapshot(uint flags, int processId);

    public static IEnumerable<T> TakeSnapshot<T>(uint flags, int id) where T : IEntry, new() {
        using(var snap = new Snapshot(flags, id))
            for(IEntry entry = new T { }; entry.TryMoveNext(snap, out entry);)
                yield return (T)entry;
    }

    public interface IEntry {
        bool TryMoveNext(Toolhelp32.Snapshot snap, out IEntry entry);
    }

    public struct Snapshot:IDisposable {
        void IDisposable.Dispose() {
            Toolhelp32.CloseHandle(m_handle);
        }
        public Snapshot(uint flags, int processId) {
            m_handle=Toolhelp32.CreateToolhelp32Snapshot(flags, processId);
        }
        IntPtr m_handle;
    }
}

[StructLayout(LayoutKind.Sequential)]
public struct WinProcessEntry:Toolhelp32.IEntry {
    [DllImport("kernel32.dll")]
    public static extern bool Process32Next(Toolhelp32.Snapshot snap, ref WinProcessEntry entry);

    public bool TryMoveNext(Toolhelp32.Snapshot snap, out Toolhelp32.IEntry entry) {
        var x = new WinProcessEntry { dwSize=Marshal.SizeOf(typeof(WinProcessEntry)) };
        var b = Process32Next(snap, ref x);
        entry=x;
        return b;
    }

    public int dwSize;
    public int cntUsage;
    public int th32ProcessID;
    public IntPtr th32DefaultHeapID;
    public int th32ModuleID;
    public int cntThreads;
    public int th32ParentProcessID;
    public int pcPriClassBase;
    public int dwFlags;
    [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
    public String fileName;
    //byte fileName[260];
    //public const int sizeofFileName = 260;
}

public static class Extensions {
    public static Process Parent(this Process p) {
        var entries = Toolhelp32.TakeSnapshot<WinProcessEntry>(Toolhelp32.SnapAll, 0);
        var parentid = entries.First(x => x.th32ProcessID==p.Id).th32ParentProcessID;
        return Process.GetProcessById(parentid);
    }
}

我们可以这样使用它：

测试

public class TestClass {
    public static void TestMethod() {
        var p = Process.GetCurrentProcess().Parent();
        Console.WriteLine("{0}", p.Id);
    }
}

对于替代结局..

根据文档，每种类型的条目都有一对迭代方法，例如

Process32First

和

Process32Next

用于流程的迭代；但我发现‘xxxxFirst’方法是不必要的，然后我想为什么不把迭代方法与其对应的入口类型放在一起呢？它会更容易实现和理解（我想是这样..）。

就像

Toolhelp32

后缀为 help 一样，我认为静态帮助器类是合适的，这样我们就可以拥有清晰的限定名称，例如

Toolhelp32.Snapshot

或

Toolhelp32.IEntry

，尽管它在这里无关紧要..

获取父进程后，如果您还想获取一些详细信息，您可以轻松地对此进行扩展，例如迭代其模块，然后添加：

代码 - WinModuleEntry

[StructLayout(LayoutKind.Sequential)]
public struct WinModuleEntry:Toolhelp32.IEntry { // MODULEENTRY32
    [DllImport("kernel32.dll")]
    public static extern bool Module32Next(Toolhelp32.Snapshot snap, ref WinModuleEntry entry);

    public bool TryMoveNext(Toolhelp32.Snapshot snap, out Toolhelp32.IEntry entry) {
        var x = new WinModuleEntry { dwSize=Marshal.SizeOf(typeof(WinModuleEntry)) };
        var b = Module32Next(snap, ref x);
        entry=x;
        return b;
    }

    public int dwSize;
    public int th32ModuleID;
    public int th32ProcessID;
    public int GlblcntUsage;
    public int ProccntUsage;
    public IntPtr modBaseAddr;
    public int modBaseSize;
    public IntPtr hModule;
    //byte moduleName[256];
    [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)]
    public string moduleName;
    [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
    public string fileName;
    //byte fileName[260];
    //public const int sizeofModuleName = 256;
    //public const int sizeofFileName = 260;
}

还有一些测试..

public class TestClass {
    public static void TestMethod() {
        var p = Process.GetCurrentProcess().Parent();
        Console.WriteLine("{0}", p.Id);

        var formatter = new CustomFormatter { };
        foreach(var x in Toolhelp32.TakeSnapshot<WinModuleEntry>(Toolhelp32.SnapModule, p.Id)) {
            Console.WriteLine(String.Format(formatter, "{0}", x));
        }
    }
}

public class CustomFormatter:IFormatProvider, ICustomFormatter {
    String ICustomFormatter.Format(String format, object arg, IFormatProvider formatProvider) {
        var type = arg.GetType();
        var fields = type.GetFields();
        var q = fields.Select(x => String.Format("{0}:{1}", x.Name, x.GetValue(arg)));
        return String.Format("{{{0}}}", String.Join(", ", q.ToArray()));
    }

    object IFormatProvider.GetFormat(Type formatType) {
        return typeof(ICustomFormatter)!=formatType ? null : this;
    }
}

如果您想要代码示例..

https://github.com/kenkins/ToolHelp32ConsoleApp

如何以托管方式在.NET中获取父进程

问题描述投票：0回答：7

7个回答

最新问题

如何以托管方式在.NET中获取父进程

问题描述 投票：0回答：7

7个回答

最新问题

问题描述投票：0回答：7