Interacting with Windows Process Using C#

In this post, we are going to explore how to interact with the Windows Process using C#. It seems many developers have the impression that interacting with Windows Process is a tedious task. However, learning the basics can help get you started.

Introduction

 

Many Windows folks are aware of the Windows Task Manager, probably because of its popularity among Windows users. Moreover, developers have probably used it in some way or another to stop or end a program that appears to be in the “Process” tab. If you haven’t heard of or tried it, you can Google search it, or just press CTRL + SHIFT + ESC from your keyboard and it will appear.

 

Going back to our main goal in this article, we are going to explore the Windows process by answering the question of what it is, its role and how to interact with it via C# code samples.

 

What is a Windows Process?

 

Even before the .NET Framework came out, the concept of a “process” has existed since the early days of Windows OS. We can define a process as a running program that is being processed by the computer processor in an isolated manner. In addition, a process could be a background application that we don’t normally see running on our computer. A good example could be a printer driver program that runs in the background and watches the ink level attached to our computer. 

 

The Role of Windows Process

 

For instance, when a developer runs an executable(*.exe) program once it is loaded into memory, the operating system creates a separate and isolated process for its use during its lifetime. Then, several processes may be associated with the same program; for instance, opening 2 instances of notepad results in more than one process being executed. This approach is called, “application isolation” which results in a stable runtime environment and considering that the failure of one process does not affect the function of the other running processes.

 

Things to Remember When Dealing with Windows Processes

• Every Windows process has a unique process identifier (PID)
• It can be loaded and unloaded by the operating system as well as programmatically.

Getting started interacting with Windows Processes using C#

 

Enumerate Windows Processes

[TestMethod]
public void Test_Enumerating_Running_Processes()
{
    string localMachineName = Environment.MachineName;

    var runningProcess = Process.GetProcesses(localMachineName);

    foreach (var process in runningProcess)
    {
        string processName = process.ProcessName;
        string processId = process.Id.ToString();

        Console.WriteLine($"Process Id: {processId} Process Name: {processName}");

        Assert.IsNotNull(processName);
    }
}

Inspect a Specific Windows Process

[TestMethod]
public void Test_Check_And_Inspect_A_Specific_Process()
{
    string localMachineName = Environment.MachineName;

    var process = Process.GetProcesses(localMachineName)
                            .FirstOrDefault(p => p.ProcessName.Contains("chrome"));

    if(process != null)
    {
        Assert.IsNotNull(process);
    }
}

Investigate a Process’s Thread Details

[TestMethod]
public void Test_Process_Thread_Set()
{
    string localMachineName = Environment.MachineName;

    var process = Process.GetProcesses(localMachineName)
                            .FirstOrDefault(p => p.ProcessName.Contains("chrome"));

    if (process != null)
    {
        foreach (ProcessThread thread in process.Threads)
        {
            string outputString = string.Empty;

            outputString = $"Thread ID: {thread.Id} {Environment.NewLine}";
            outputString += $"Thread ID: {thread.StartTime.ToShortDateString()}";
            outputString += $"Priority: {thread.PriorityLevel}";

            Console.WriteLine(outputString);
        }
    }
}

Investigate Process Module Details

[TestMethod]
[ExpectedException(typeof(Win32Exception))]
public void Test_Process_Module_Set_Of_Details_1_Using_ProcessObject()
{
    string localMachineName = Environment.MachineName;

    var process = Process.GetProcesses(localMachineName)
                            .FirstOrDefault(p => p.ProcessName.Contains("chrome"));

    if (process != null)
    {
        foreach (ProcessModule module in process.Modules)
        {
            string outputString = string.Empty;

            outputString = $"Module Name: {module.ModuleName} {Environment.NewLine}";
            outputString += $"Module Filename: {module.FileName}";

            Console.WriteLine(outputString);
        }
    }
}

The sample code above works well. However; there is one issue with this approach. When you are running this code in a 32bit mode, you'll be having an issue accessing the 64bit application paths. I do recommend to change your "Active solution platform" to x64. 

 

Investigate a Process’s Module Details II

 

Another example if you are having problems with your current platform.

[TestMethod]
public void Test_Process_Module_Set_Of_Details_2_Using_ManagementObject()
{
    string localMachineName = Environment.MachineName;

    var process = Process.GetProcesses(localMachineName)
                            .FirstOrDefault(p => p.ProcessName.Contains("chrome"));

    if (process != null)
    {
        string query = $"SELECT ProcessId, ExecutablePath, CommandLine FROM Win32_Process WHERE ProcessId={process.Id}" ;

        using(var search = new ManagementObjectSearcher(query))
        {
            using(var results = search.Get())
            {

                var processModuleDetails = results.Cast<ManagementObject>().FirstOrDefault();

                if (processModuleDetails != null)
                {
                    var stringResult = $"Module Name: {processModuleDetails.GetPropertyValue("CommandLine")}{Environment.NewLine}";
                        stringResult += $"Module Filename:{processModuleDetails.GetPropertyValue("ExecutablePath")}{Environment.NewLine}";
                        stringResult += $"Process Id: {processModuleDetails.GetPropertyValue("ProcessId")}";


                    Console.WriteLine(stringResult);
                }
            }
        }
    }
}

Start and Stop/Kill Windows Process 

[TestMethod]
public void Test_Process_Start_Process()
{
    string acrobatReaderName = "AcroRd32";

    try
    {
        /*
         * For the complete argument list see the link below.
         * https://www.adobe.com/content/dam/acom/en/devnet/acrobat/pdfs/pdf_open_parameters.pdf
         */

        var acrobatReaderProcess = Process.Start(acrobatReaderName, "/n");
    }
    catch (InvalidOperationException ex)
    {
        Console.WriteLine(ex.Message);
    }
}

[TestMethod]
public void Test_Process_Stop_Process()
{
    string acrobatReaderName = "AcroRd32";

    try
    {
        var acrobatReaderProcess = Process.GetProcessesByName(acrobatReaderName);

        if (acrobatReaderProcess != null)
        {
            foreach (var item in acrobatReaderProcess)
            {
                item.Kill();

                Console.WriteLine($"{item.ProcessName} has been killed!");
            }
        }
    }
    catch (Win32Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}

Summary and Remarks

 

In this blog post, we have seen how to interact with the Windows processes using C#. To summarize the code sample, see the bulleted list below.

• Enumerate Windows Processes
• Inspect a Specific Process
• Investigate a Process’s Thread Details
• Investigate a Process’s Module Details
• Start and Stop/Kill Process

I’m hoping with the help of these sample codes can get you started with it. You can download it here or you can go to GitHub. Lastly, I hope you have enjoyed this blog post until next time. Happy programming!