private static IntPtr GetPeb32(IntPtr hProcess)
{
if (System.Environment.Is64BitProcess)
{
var ptr = IntPtr.Zero;
int res_len = 0;
int pbiSize = IntPtr.Size;
ProcessNativeMethods.NtQueryInformationProcess(
hProcess,
ProcessNativeMethods.ProcessWow64Information,
ref ptr,
pbiSize,
ref res_len);
if (res_len != pbiSize)
{
throw new Win32Exception("Unable to query process information.");
}
return(ptr);
}
else
{
return(GetPebNative(hProcess));
}
}
public static Process GetParentProcess(this Process process)
{
IntPtr processHandle;
if (!process.TryGetProcessHandle(out processHandle))
{
return(null);
}
var pbi = new ProcessNativeMethods.ProcessInformation();
try
{
int returnLength;
int status = ProcessNativeMethods.NtQueryInformationProcess(processHandle, 0, ref pbi, Marshal.SizeOf(pbi), out returnLength);
if (status != 0)
{
throw new Win32Exception(status);
}
return(Process.GetProcessById(pbi.InheritedFromUniqueProcessId.ToInt32()));
}
catch
{
return(null);
}
}
/// <summary>
/// Get parent process.
/// </summary>
public static Process GetParentProcess(this Process process, ITracer tracer)
{
IntPtr processHandle;
if (!process.TryGetProcessHandle(out processHandle))
{
return(null);
}
var pbi = new ProcessNativeMethods.ProcessInformation();
try
{
int returnLength;
int status = ProcessNativeMethods.NtQueryInformationProcess(processHandle, 0, ref pbi, Marshal.SizeOf(pbi), out returnLength);
if (status != 0)
{
throw new Win32Exception(status);
}
return(Process.GetProcessById(pbi.InheritedFromUniqueProcessId.ToInt32()));
}
catch (Exception ex)
{
if (!process.ProcessName.Equals("w3wp", StringComparison.OrdinalIgnoreCase))
{
tracer.Trace("GetParentProcess of {0}({1}) failed with {2}", process.ProcessName, process.Id, ex);
}
return(null);
}
}
/// <summary>
/// Get parent process.
/// </summary>
public static Process GetParentProcess(this Process process, ITracer tracer)
{
try
{
if (!OSDetector.IsOnWindows())
{
return(process.GetParentProcessLinux(tracer));
}
IntPtr processHandle;
if (!process.TryGetProcessHandle(out processHandle))
{
return(null);
}
var pbi = new ProcessNativeMethods.ProcessInformation();
int returnLength;
int status = ProcessNativeMethods.NtQueryInformationProcess(processHandle, 0, ref pbi, Marshal.SizeOf(pbi), out returnLength);
if (status != 0)
{
throw new Win32Exception(status);
}
return(Process.GetProcessById(pbi.InheritedFromUniqueProcessId.ToInt32()));
}
catch (Exception ex)
{
var processName = process.SafeGetProcessName() ?? "(null)";
if (!processName.Equals("w3wp", StringComparison.OrdinalIgnoreCase))
{
tracer.TraceError(ex, "GetParentProcess of {0}({1}) failed.", processName, process.Id);
}
return(null);
}
}
private static IntPtr GetPebNative(IntPtr hProcess)
{
var pbi = new ProcessNativeMethods.ProcessInformation();
int res_len = 0;
int pbiSize = Marshal.SizeOf(pbi);
ProcessNativeMethods.NtQueryInformationProcess(
hProcess,
ProcessNativeMethods.ProcessBasicInformation,
ref pbi,
pbiSize,
out res_len);
if (res_len != pbiSize)
{
throw new Win32Exception("Unable to query process information.");
}
return(pbi.PebBaseAddress);
}