C# 如何以托管方式获取 .NET 中的父进程

How to get parent process in .NET in managed way

提问by abatishchev

I was looking a lot for method to get parent process in .NET, but found only P/Invoke way.

我一直在寻找在 .NET 中获取父进程的方法，但只找到了 P/Invoke 方式。

采纳答案by Michael Hale

This code provides a nice interface for finding the Parent process object and takes into account the possibility of multiple processes with the same name:

这段代码为查找父进程对象提供了一个很好的界面，并考虑了多个进程同名的可能性：

Usage:

用法：

Console.WriteLine("ParentPid: " + Process.GetProcessById(6972).Parent().Id);

Code:

代码：

public static class ProcessExtensions {
    private static string FindIndexedProcessName(int pid) {
        var processName = Process.GetProcessById(pid).ProcessName;
        var processesByName = Process.GetProcessesByName(processName);
        string processIndexdName = null;

        for (var index = 0; index < processesByName.Length; index++) {
            processIndexdName = index == 0 ? processName : processName + "#" + index;
            var processId = new PerformanceCounter("Process", "ID Process", processIndexdName);
            if ((int) processId.NextValue() == pid) {
                return processIndexdName;
            }
        }

        return processIndexdName;
    }

    private static Process FindPidFromIndexedProcessName(string indexedProcessName) {
        var parentId = new PerformanceCounter("Process", "Creating Process ID", indexedProcessName);
        return Process.GetProcessById((int) parentId.NextValue());
    }

    public static Process Parent(this Process process) {
        return FindPidFromIndexedProcessName(FindIndexedProcessName(process.Id));
    }
}

回答by Simon Mourier

Here is a solution. It uses p/invoke, but seems to work well, 32 or 64 cpu:

这是一个解决方案。它使用 p/invoke，但似乎运行良好，32 或 64 cpu：

    /// <summary>
    /// A utility class to determine a process parent.
    /// </summary>
    [StructLayout(LayoutKind.Sequential)]
    public struct ParentProcessUtilities
    {
        // These members must match PROCESS_BASIC_INFORMATION
        internal IntPtr Reserved1;
        internal IntPtr PebBaseAddress;
        internal IntPtr Reserved2_0;
        internal IntPtr Reserved2_1;
        internal IntPtr UniqueProcessId;
        internal IntPtr InheritedFromUniqueProcessId;

        [DllImport("ntdll.dll")]
        private static extern int NtQueryInformationProcess(IntPtr processHandle, int processInformationClass, ref ParentProcessUtilities processInformation, int processInformationLength, out int returnLength);

        /// <summary>
        /// Gets the parent process of the current process.
        /// </summary>
        /// <returns>An instance of the Process class.</returns>
        public static Process GetParentProcess()
        {
            return GetParentProcess(Process.GetCurrentProcess().Handle);
        }

        /// <summary>
        /// Gets the parent process of specified process.
        /// </summary>
        /// <param name="id">The process id.</param>
        /// <returns>An instance of the Process class.</returns>
        public static Process GetParentProcess(int id)
        {
            Process process = Process.GetProcessById(id);
            return GetParentProcess(process.Handle);
        }

        /// <summary>
        /// Gets the parent process of a specified process.
        /// </summary>
        /// <param name="handle">The process handle.</param>
        /// <returns>An instance of the Process class.</returns>
        public static Process GetParentProcess(IntPtr handle)
        {
            ParentProcessUtilities pbi = new ParentProcessUtilities();
            int returnLength;
            int status = NtQueryInformationProcess(handle, 0, ref pbi, Marshal.SizeOf(pbi), out returnLength);
            if (status != 0)
                throw new Win32Exception(status);

            try
            {
                return Process.GetProcessById(pbi.InheritedFromUniqueProcessId.ToInt32());
            }
            catch (ArgumentException)
            {
                // not found
                return null;
            }
        }
    }

回答by Jeremy Murray

Here's my try at a managed solution.

这是我对托管解决方案的尝试。

It polls the performance counters for all processes and returns a dictionary of child PID to parent PID. Then you can check the dictionary with your current PID to see your parent, grandparent, etc.

它轮询所有进程的性能计数器，并将子 PID 的字典返回给父 PID。然后你可以用你当前的 PID 检查字典，看看你的父母、祖父母等。

It is overkill in how much info it gets, for sure. Feel free to optimize.

肯定的是，它获得的信息量太大了。随意优化。

using System;
using System.Collections.Generic;
using System.Diagnostics;

namespace PidExamples
{
    class ParentPid
    {
        static void Main(string[] args)
        {
            var childPidToParentPid = GetAllProcessParentPids();
            int currentProcessId = Process.GetCurrentProcess().Id;

            Console.WriteLine("Current Process ID: " + currentProcessId);
            Console.WriteLine("Parent Process ID: " + childPidToParentPid[currentProcessId]);
        }

        public static Dictionary<int, int> GetAllProcessParentPids()
        {
            var childPidToParentPid = new Dictionary<int, int>();

            var processCounters = new SortedDictionary<string, PerformanceCounter[]>();
            var category = new PerformanceCounterCategory("Process");

            // As the base system always has more than one process running, 
            // don't special case a single instance return.
            var instanceNames = category.GetInstanceNames();
            foreach(string t in instanceNames)
            {
                try
                {
                    processCounters[t] = category.GetCounters(t);
                }
                catch (InvalidOperationException)
                {
                    // Transient processes may no longer exist between 
                    // GetInstanceNames and when the counters are queried.
                }
            }

            foreach (var kvp in processCounters)
            {
                int childPid = -1;
                int parentPid = -1;

                foreach (var counter in kvp.Value)
                {
                    if ("ID Process".CompareTo(counter.CounterName) == 0)
                    {
                        childPid = (int)(counter.NextValue());
                    }
                    else if ("Creating Process ID".CompareTo(counter.CounterName) == 0)
                    {
                        parentPid = (int)(counter.NextValue());
                    }
                }

                if (childPid != -1 && parentPid != -1)
                {
                    childPidToParentPid[childPid] = parentPid;
                }
            }

            return childPidToParentPid;
        }
    }
}    

In other news, I learned how many performance counters there were on my machine: 13401. Holy cow.

在其他新闻中，我了解到我的机器上有多少个性能计数器：13401。天哪。

回答by robert4

If accepting P/Invoke, there's a better way, which is more documented than NtQueryInformationProcess: namely PROCESSENTRY32 (CreateToolhelp32Snapshot, Process32First, Process32Next). It's shown in this post.

如果接受 P/Invoke，有一个更好的方法，它比 NtQueryInformationProcess 有更多的文档：即 PROCESSENTRY32 (CreateToolhelp32Snapshot, Process32First, Process32Next)。它显示在这篇文章中。

Pay attention to the subtle detailsand note that parent PID is not necessarily the creator PID, in fact these may be completely unrelated, as pointed out by the community comments at PROCESSENTRY32.

注意细微的细节，并注意父 PID 不一定是创建者 PID，事实上，正如PROCESSENTRY32 上的社区评论所指出的那样，它们可能完全无关 。

回答by Péter Major

This way:

这边走：

public static Process GetParent(this Process process)
{
  try
  {
    using (var query = new ManagementObjectSearcher(
      "SELECT * " +
      "FROM Win32_Process " +
      "WHERE ProcessId=" + process.Id))
    {
      return query
        .Get()
        .OfType<ManagementObject>()
        .Select(p => Process.GetProcessById((int)(uint)p["ParentProcessId"]))
        .FirstOrDefault();
    }
  }
  catch
  {
    return null;
  }
}

回答by Ken Kin

If you've ever digged the BCL, you shall find that the ways to find parent process are deliberately avoided, take this for example:

如果你曾经挖过 BCL，你会发现寻找父进程的方法是故意避免的，以这个为例：

https://referencesource.microsoft.com/#System/services/monitoring/system/diagnosticts/ProcessManager.cs,327

https://referencesource.microsoft.com/#System/services/monitoring/system/diagnosticts/ProcessManager.cs,327

As you can see in the source code, it contains comprehensive structures and imported native methods which are absolutely sufficient to get the job done. However, even if you access them via reflection(this is possible), you would not find a method for doing it directly. I can't answer why, yet this phenomenon causes questions like yours are asked for somewhat repeatedly; for example:

正如您在源代码中看到的那样，它包含全面的结构和导入的本地方法，绝对足以完成工作。但是，即使您通过反射访问它们（这是可能的），您也找不到直接执行此操作的方法。我无法回答为什么，但这种现象会导致像您这样的问题被反复询问；例如：

How can I get the PID of the parent process of my application

如何获取我的应用程序的父进程的 PID

For there is no answer along with some code using CreateToolhelp32Snapshotin this thread, I'd add it -- part of the structure definitions and names I steal from the MS' reference source :)

因为在这个线程中使用CreateToolhelp32Snapshot 的一些代码没有答案，我会添加它——我从 MS 的参考源中窃取的结构定义和名称的一部分:)

• Code

  using System.Diagnostics;
  using System.Runtime.InteropServices;
  using System.Collections.Generic;
  using System.Linq;
  using System;
  

  ---

  public static class Toolhelp32 {
      public const uint Inherit = 0x80000000;
      public const uint SnapModule32 = 0x00000010;
      public const uint SnapAll = SnapHeapList|SnapModule|SnapProcess|SnapThread;
      public const uint SnapHeapList = 0x00000001;
      public const uint SnapProcess = 0x00000002;
      public const uint SnapThread = 0x00000004;
      public const uint SnapModule = 0x00000008;
  
      [DllImport("kernel32.dll")]
      static extern bool CloseHandle(IntPtr handle);
      [DllImport("kernel32.dll")]
      static extern IntPtr CreateToolhelp32Snapshot(uint flags, int processId);
  
      public static IEnumerable<T> TakeSnapshot<T>(uint flags, int id) where T : IEntry, new() {
          using(var snap = new Snapshot(flags, id))
              for(IEntry entry = new T { }; entry.TryMoveNext(snap, out entry);)
                  yield return (T)entry;
      }
  
      public interface IEntry {
          bool TryMoveNext(Toolhelp32.Snapshot snap, out IEntry entry);
      }
  
      public struct Snapshot:IDisposable {
          void IDisposable.Dispose() {
              Toolhelp32.CloseHandle(m_handle);
          }
          public Snapshot(uint flags, int processId) {
              m_handle=Toolhelp32.CreateToolhelp32Snapshot(flags, processId);
          }
          IntPtr m_handle;
      }
  }
  

  ---

  [StructLayout(LayoutKind.Sequential)]
  public struct WinProcessEntry:Toolhelp32.IEntry {
      [DllImport("kernel32.dll")]
      public static extern bool Process32Next(Toolhelp32.Snapshot snap, ref WinProcessEntry entry);
  
      public bool TryMoveNext(Toolhelp32.Snapshot snap, out Toolhelp32.IEntry entry) {
          var x = new WinProcessEntry { dwSize=Marshal.SizeOf(typeof(WinProcessEntry)) };
          var b = Process32Next(snap, ref x);
          entry=x;
          return b;
      }
  
      public int dwSize;
      public int cntUsage;
      public int th32ProcessID;
      public IntPtr th32DefaultHeapID;
      public int th32ModuleID;
      public int cntThreads;
      public int th32ParentProcessID;
      public int pcPriClassBase;
      public int dwFlags;
      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
      public String fileName;
      //byte fileName[260];
      //public const int sizeofFileName = 260;
  }
  

  ---

  public static class Extensions {
      public static Process Parent(this Process p) {
          var entries = Toolhelp32.TakeSnapshot<WinProcessEntry>(Toolhelp32.SnapAll, 0);
          var parentid = entries.First(x => x.th32ProcessID==p.Id).th32ParentProcessID;
          return Process.GetProcessById(parentid);
      }
  }
  

• 代码

  using System.Diagnostics;
  using System.Runtime.InteropServices;
  using System.Collections.Generic;
  using System.Linq;
  using System;
  

  ---

  public static class Toolhelp32 {
      public const uint Inherit = 0x80000000;
      public const uint SnapModule32 = 0x00000010;
      public const uint SnapAll = SnapHeapList|SnapModule|SnapProcess|SnapThread;
      public const uint SnapHeapList = 0x00000001;
      public const uint SnapProcess = 0x00000002;
      public const uint SnapThread = 0x00000004;
      public const uint SnapModule = 0x00000008;
  
      [DllImport("kernel32.dll")]
      static extern bool CloseHandle(IntPtr handle);
      [DllImport("kernel32.dll")]
      static extern IntPtr CreateToolhelp32Snapshot(uint flags, int processId);
  
      public static IEnumerable<T> TakeSnapshot<T>(uint flags, int id) where T : IEntry, new() {
          using(var snap = new Snapshot(flags, id))
              for(IEntry entry = new T { }; entry.TryMoveNext(snap, out entry);)
                  yield return (T)entry;
      }
  
      public interface IEntry {
          bool TryMoveNext(Toolhelp32.Snapshot snap, out IEntry entry);
      }
  
      public struct Snapshot:IDisposable {
          void IDisposable.Dispose() {
              Toolhelp32.CloseHandle(m_handle);
          }
          public Snapshot(uint flags, int processId) {
              m_handle=Toolhelp32.CreateToolhelp32Snapshot(flags, processId);
          }
          IntPtr m_handle;
      }
  }
  

  ---

  [StructLayout(LayoutKind.Sequential)]
  public struct WinProcessEntry:Toolhelp32.IEntry {
      [DllImport("kernel32.dll")]
      public static extern bool Process32Next(Toolhelp32.Snapshot snap, ref WinProcessEntry entry);
  
      public bool TryMoveNext(Toolhelp32.Snapshot snap, out Toolhelp32.IEntry entry) {
          var x = new WinProcessEntry { dwSize=Marshal.SizeOf(typeof(WinProcessEntry)) };
          var b = Process32Next(snap, ref x);
          entry=x;
          return b;
      }
  
      public int dwSize;
      public int cntUsage;
      public int th32ProcessID;
      public IntPtr th32DefaultHeapID;
      public int th32ModuleID;
      public int cntThreads;
      public int th32ParentProcessID;
      public int pcPriClassBase;
      public int dwFlags;
      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
      public String fileName;
      //byte fileName[260];
      //public const int sizeofFileName = 260;
  }
  

  ---

  public static class Extensions {
      public static Process Parent(this Process p) {
          var entries = Toolhelp32.TakeSnapshot<WinProcessEntry>(Toolhelp32.SnapAll, 0);
          var parentid = entries.First(x => x.th32ProcessID==p.Id).th32ParentProcessID;
          return Process.GetProcessById(parentid);
      }
  }
  

And we can use it like:

我们可以像这样使用它：

• Test

  public class TestClass {
      public static void TestMethod() {
          var p = Process.GetCurrentProcess().Parent();
          Console.WriteLine("{0}", p.Id);
      }
  }
  

• 测试

  public class TestClass {
      public static void TestMethod() {
          var p = Process.GetCurrentProcess().Parent();
          Console.WriteLine("{0}", p.Id);
      }
  }
  

---

---

For alternative ending ..

对于替代结局..

According to the documentation, there are a pair of iteration methods per type of the entries such as Process32Firstand Process32Nextare for the iteration of processes; but I found the `xxxxFirst' methods are unnecessary, and then I thought why not put the iteration method with its corresponding entry type? It'd be easier to implement and be understood(I guess so ..).

根据文档，每种类型的条目都有一对迭代方法，例如Process32First和Process32Next用于流程的迭代；但是我发现`xxxxFirst'方法是不必要的，然后我想为什么不把迭代方法与其对应的条目类型放在一起呢？实施和理解会更容易（我猜是这样..）。

Just as Toolhelp32suffixed with help, I think a static helper class is proper, so that we can have the clear qualified names such as Toolhelp32.Snapshotor Toolhelp32.IEntrythough it'd be irrelevant here ..

就像Toolhelp32后缀help 一样，我认为静态帮助器类是合适的，这样我们就可以拥有明确的限定名称，例如Toolhelp32.Snapshot或Toolhelp32.IEntry虽然它在这里无关紧要..

Once the parent process is obtained, if you further want to get some detailed infos, you can extend with this easily, for example, iterate on its modules, then add:

获得父进程后，如果您还想获得一些详细信息，您可以轻松地扩展它，例如，迭代其模块，然后添加：

• Code - WinModuleEntry

  [StructLayout(LayoutKind.Sequential)]
  public struct WinModuleEntry:Toolhelp32.IEntry { // MODULEENTRY32
      [DllImport("kernel32.dll")]
      public static extern bool Module32Next(Toolhelp32.Snapshot snap, ref WinModuleEntry entry);
  
      public bool TryMoveNext(Toolhelp32.Snapshot snap, out Toolhelp32.IEntry entry) {
          var x = new WinModuleEntry { dwSize=Marshal.SizeOf(typeof(WinModuleEntry)) };
          var b = Module32Next(snap, ref x);
          entry=x;
          return b;
      }
  
      public int dwSize;
      public int th32ModuleID;
      public int th32ProcessID;
      public int GlblcntUsage;
      public int ProccntUsage;
      public IntPtr modBaseAddr;
      public int modBaseSize;
      public IntPtr hModule;
      //byte moduleName[256];
      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)]
      public string moduleName;
      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
      public string fileName;
      //byte fileName[260];
      //public const int sizeofModuleName = 256;
      //public const int sizeofFileName = 260;
  }
  

  ---

  and some test ..

  public class TestClass {
      public static void TestMethod() {
          var p = Process.GetCurrentProcess().Parent();
          Console.WriteLine("{0}", p.Id);
  
          var formatter = new CustomFormatter { };
          foreach(var x in Toolhelp32.TakeSnapshot<WinModuleEntry>(Toolhelp32.SnapModule, p.Id)) {
              Console.WriteLine(String.Format(formatter, "{0}", x));
          }
      }
  }
  
  public class CustomFormatter:IFormatProvider, ICustomFormatter {
      String ICustomFormatter.Format(String format, object arg, IFormatProvider formatProvider) {
          var type = arg.GetType();
          var fields = type.GetFields();
          var q = fields.Select(x => String.Format("{0}:{1}", x.Name, x.GetValue(arg)));
          return String.Format("{{{0}}}", String.Join(", ", q.ToArray()));
      }
  
      object IFormatProvider.GetFormat(Type formatType) {
          return typeof(ICustomFormatter)!=formatType ? null : this;
      }
  }
  

• 代码 - WinModuleEntry

  [StructLayout(LayoutKind.Sequential)]
  public struct WinModuleEntry:Toolhelp32.IEntry { // MODULEENTRY32
      [DllImport("kernel32.dll")]
      public static extern bool Module32Next(Toolhelp32.Snapshot snap, ref WinModuleEntry entry);
  
      public bool TryMoveNext(Toolhelp32.Snapshot snap, out Toolhelp32.IEntry entry) {
          var x = new WinModuleEntry { dwSize=Marshal.SizeOf(typeof(WinModuleEntry)) };
          var b = Module32Next(snap, ref x);
          entry=x;
          return b;
      }
  
      public int dwSize;
      public int th32ModuleID;
      public int th32ProcessID;
      public int GlblcntUsage;
      public int ProccntUsage;
      public IntPtr modBaseAddr;
      public int modBaseSize;
      public IntPtr hModule;
      //byte moduleName[256];
      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)]
      public string moduleName;
      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
      public string fileName;
      //byte fileName[260];
      //public const int sizeofModuleName = 256;
      //public const int sizeofFileName = 260;
  }
  

  ---

  和一些测试..

  public class TestClass {
      public static void TestMethod() {
          var p = Process.GetCurrentProcess().Parent();
          Console.WriteLine("{0}", p.Id);
  
          var formatter = new CustomFormatter { };
          foreach(var x in Toolhelp32.TakeSnapshot<WinModuleEntry>(Toolhelp32.SnapModule, p.Id)) {
              Console.WriteLine(String.Format(formatter, "{0}", x));
          }
      }
  }
  
  public class CustomFormatter:IFormatProvider, ICustomFormatter {
      String ICustomFormatter.Format(String format, object arg, IFormatProvider formatProvider) {
          var type = arg.GetType();
          var fields = type.GetFields();
          var q = fields.Select(x => String.Format("{0}:{1}", x.Name, x.GetValue(arg)));
          return String.Format("{{{0}}}", String.Join(", ", q.ToArray()));
      }
  
      object IFormatProvider.GetFormat(Type formatType) {
          return typeof(ICustomFormatter)!=formatType ? null : this;
      }
  }
  

In case you want a code example ..

如果你想要一个代码示例..

• https://github.com/kenkins/ToolHelp32ConsoleApp

• https://github.com/kenkins/ToolHelp32ConsoleApp