/// <summary> /// Gets the parent process of a specified process. /// </summary> /// <param name="handle">The process handle.</param> /// <returns>An instance of the Process class.</returns> public static Process GetParentProcess(IntPtr handle) { ProcessInformation pi = new ProcessInformation(); int returnLength; int status = NtQueryInformationProcess(handle, 0, ref pi, Marshal.SizeOf(pi), out returnLength); if (status != 0) { throw new Win32Exception(status); } try { return Process.GetProcessById(pi.InheritedFromUniqueProcessId.ToInt32()); } catch (ArgumentException) { // not found return null; } }
private static extern int NtQueryInformationProcess(IntPtr processHandle, int processInformationClass, ref ProcessInformation processInformation, int processInformationLength, out int returnLength);