private static ParentProcess GetParentProcess(IntPtr handle)
{
var pbi = new ParentProcessInfo();
int returnLength;
var status = NtQueryInformationProcess(handle, 0, ref pbi, Marshal.SizeOf(pbi), out returnLength);
if (status != 0)
{
return(null);
}
try
{
var processId = pbi.InheritedFromUniqueProcessId.ToInt32();
var serviceName = GetService(processId);
if (!string.IsNullOrEmpty(serviceName))
{
return(new ServiceProcess(processId, Process.GetProcessById(processId).MainModule.FileName, serviceName));
}
return(new ConsoleProcess(processId, Process.GetProcessById(processId).MainModule.FileName));
}
catch (ArgumentException)
{
// not found
return(null);
}
}
private static extern int NtQueryInformationProcess(IntPtr processHandle, int processInformationClass, ref ParentProcessInfo processInformation, int processInformationLength, out int returnLength);
