/// <summary>
/// Retrieves the process ID of Windows Logon component for the specified session identifier.
/// </summary>
/// <param name="sessionId">The ID of the session winlogon.exe should be running in.</param>
/// <returns>The system-unique identifier of the Windows Logon component. If this function fails it returns zero.</returns>
private static int GetWinLogonProcessId(uint sessionId)
{
const string winLogonName = "winlogon";
foreach (var process in ProcessNative.GetProcesses())
{
if (process.Name.Equals(winLogonName) && ProcessNative.ProcessIdToSessionId((uint)process.Id, out var winLogonSessionId) && winLogonSessionId == sessionId)
{
return(process.Id);
}
}
return(0);
}
/// <summary>
/// Creates a read-only record of the provided process info.
/// </summary>
/// <param name="id">The system-unique identifier of the process.</param>
/// <param name="parentProcessId">The system-unique identifier of the process object that created the current process.</param>
/// <param name="image">The name of the executable belonging to the process.</param>
/// <param name="commandLine">The command-line string passed to the process.</param>
/// <param name="workingDirectory">The current working directory of the process.</param>
/// <param name="creationTime">The time at which the process object was created on the system.</param>
public ProcessInfo(int id,
int parentProcessId,
string image,
string commandLine,
string workingDirectory,
long creationTime)
{
Id = id;
ParentProcessId = parentProcessId;
Image = image;
CommandLine = commandLine;
WorkingDirectory = workingDirectory;
Name = Path.GetFileNameWithoutExtension(Image);
CreationDate = DateTime.FromFileTime(creationTime);
if (ProcessNative.ProcessIdToSessionId((uint)Id, out var sessionId))
{
SessionId = (int)sessionId;
}
}