Как узнать родителя процесса:
Imports System.ComponentModel
Imports System.Runtime.InteropServices
<DllImport("ntdll.dll", EntryPoint:="NtQueryInformationProcess")> _
Public Function NtQueryInformationProcess(ByVal handle As IntPtr, _
ByVal processinformationclass As UInteger, _
ByRef ProcessInformation As Process_Basic_Information, _
ByVal ProcessInformationLength As Integer, _
ByRef ReturnLength As UInteger) As Integer
End Function
Public Structure Process_Basic_Information
Public ExitStatus As IntPtr
Public PepBaseAddress As IntPtr
Public AffinityMask As IntPtr
Public BasePriority As IntPtr
Public UniqueProcessID As IntPtr
Public InheritedFromUniqueProcessId As IntPtr
End Structure
'Получение родителя процесса
Public Function ParentID(ByRef Proc As Process) As IntPtr
Dim PBI = New Process_Basic_Information()
Dim writed As Integer
Try
If NtQueryInformationProcess(Proc.Handle, 0, PBI, Marshal.SizeOf(PBI), writed) <> 0 Then
Throw New Win32Exception(Marshal.GetLastWin32Error())
End If
#If DEBUG Then
MsgBox("Process Name: " & Proc.ProcessName & vbCrLf & _
"Parent ID: " & Convert.ToString(PBI.InheritedFromUniqueProcessId), _
MsgBoxStyle.OkOnly)
#End If
Return PBI.InheritedFromUniqueProcessId
Catch ex As Exception
#If DEBUG Then
MsgBox("Error:" & vbCrLf & ex.Message, MsgBoxStyle.OkOnly, ex.Source)
#End If
Return 0
End Try
End Function
Public Function ParentID(ByVal ProcID As IntPtr) As IntPtr
Dim PBI = New Process_Basic_Information()
Dim writed As Integer
Dim Proc As Process
Try
Proc = Process.GetProcessById(ProcID)
Try
If NtQueryInformationProcess(Proc.Handle, 0, PBI, Marshal.SizeOf(PBI), writed) <> 0 Then
Throw New Win32Exception(Marshal.GetLastWin32Error())
End If
#If DEBUG Then
MsgBox("Process Name: " & Proc.ProcessName & vbCrLf & _
"Parent ID: " & Convert.ToString(PBI.InheritedFromUniqueProcessId), _
MsgBoxStyle.OkOnly)
#End If
Return PBI.InheritedFromUniqueProcessId
Catch ex As Exception
#If DEBUG Then
MsgBox("Error:" & vbCrLf & ex.Message, MsgBoxStyle.OkOnly, ex.Source)
#End If
Return 0
End Try
Catch ex As Exception
#If DEBUG Then
MsgBox("Error:" & vbCrLf & ex.Message, MsgBoxStyle.OkOnly, ex.Source)
#End If
Return 0
End Try
End Function