Как узнать родителя процесса

Как узнать родителя процесса:

Imports System.ComponentModel

Imports System.Runtime.InteropServices
    <DllImport("ntdll.dll", EntryPoint:="NtQueryInformationProcess")> _
    Public Function NtQueryInformationProcess(ByVal handle As IntPtr, _
                                              ByVal processinformationclass As UInteger, _
                                              ByRef ProcessInformation As Process_Basic_Information, _
                                              ByVal ProcessInformationLength As Integer, _
                                              ByRef ReturnLength As UInteger) As Integer
    End Function

    Public Structure Process_Basic_Information
        Public ExitStatus As IntPtr
        Public PepBaseAddress As IntPtr
        Public AffinityMask As IntPtr
        Public BasePriority As IntPtr
        Public UniqueProcessID As IntPtr
        Public InheritedFromUniqueProcessId As IntPtr
    End Structure

   'Получение родителя процесса
    Public Function ParentID(ByRef Proc As Process) As IntPtr
        Dim PBI = New Process_Basic_Information()
        Dim writed As Integer

        Try
            If NtQueryInformationProcess(Proc.Handle, 0, PBI, Marshal.SizeOf(PBI), writed) <> 0 Then
                Throw New Win32Exception(Marshal.GetLastWin32Error())
            End If
#If DEBUG Then
            MsgBox("Process Name: " & Proc.ProcessName & vbCrLf & _
                   "Parent ID: " & Convert.ToString(PBI.InheritedFromUniqueProcessId), _
                   MsgBoxStyle.OkOnly)
#End If
            Return PBI.InheritedFromUniqueProcessId
        Catch ex As Exception
#If DEBUG Then
            MsgBox("Error:" & vbCrLf & ex.Message, MsgBoxStyle.OkOnly, ex.Source)
#End If
            Return 0
        End Try
    End Function

    Public Function ParentID(ByVal ProcID As IntPtr) As IntPtr
        Dim PBI = New Process_Basic_Information()
        Dim writed As Integer
        Dim Proc As Process

        Try
            Proc = Process.GetProcessById(ProcID)
            Try
                If NtQueryInformationProcess(Proc.Handle, 0, PBI, Marshal.SizeOf(PBI), writed) <> 0 Then
                    Throw New Win32Exception(Marshal.GetLastWin32Error())
                End If
#If DEBUG Then
                MsgBox("Process Name: " & Proc.ProcessName & vbCrLf & _
                       "Parent ID: " & Convert.ToString(PBI.InheritedFromUniqueProcessId), _
                       MsgBoxStyle.OkOnly)
#End If
                Return PBI.InheritedFromUniqueProcessId
            Catch ex As Exception
#If DEBUG Then
                MsgBox("Error:" & vbCrLf & ex.Message, MsgBoxStyle.OkOnly, ex.Source)
#End If
                Return 0
            End Try
        Catch ex As Exception
#If DEBUG Then
            MsgBox("Error:" & vbCrLf & ex.Message, MsgBoxStyle.OkOnly, ex.Source)
#End If
            Return 0
        End Try
    End Function
Реклама