3

I'm trying to get all the filepaths for the running processes on the OS which I get from Process.GetProcesses() method, it works perfect under an x64 .NET application but the thing changes If I try to iterate the processes list from an x86 .NET application because the Process.MainModule.FileName property throws a Win32 exception (in my local language) saying something like: A 32 bit process can't access to 64 bit process modules, ok, I understand the problem, but how I can fix it?.

A code example that throws this exception (under an x86 .NET solution, not AnyCPU):

Dim path As String = 
    Process.GetProcessesByName("Myx64Process").First.MainModule.FileName

I saw an alternative way to get a 64 bit process filepath using WMI queries, but this way does not seem the more efficient way, I'm looking for something better maybe through .NET framework class library without messing with WMI interface, if possibly.

5
  • 1
    Could you please provide example code that recreates the exception? Commented Sep 29, 2014 at 23:53
  • 1
    Just use WMI, it works fine. Why doesn't it seem like an efficient way? The API to get the process executable path isn't there in .NET's Process. You could get around by using P/Invoke, but that's definitely worse than using WMI.
    – Luaan
    Commented Oct 3, 2014 at 7:57
  • Oh, and can't close this question because of the bounty, but it's a duplicate - stackoverflow.com/questions/5497064/…
    – Luaan
    Commented Oct 3, 2014 at 7:58
  • 1
    use WMI,it works fine. Why doesn't it seem like an efficient way? Honestly did you performed a simple performance test to compare or to be sure about what you are talking?. Running an WMI query like this: SELECT ExecutablePath FROM Win32_Process Where Name = '{0}.exe' it takes around 3-5 seconds to iterate all the running processes (like only 30-35) to get that information for only 1 process,while iterating all the processes with Process Class to do the same it takes less than 100 ms. Of course you can note a big difference, WMI usage is not efficient for be updating a list of processes. Commented Oct 3, 2014 at 14:40
  • 1
    Also, I don't know in what way you say this post is duplicated, because it isn't, I didn't saw any new in that url that you linked and anything about x64 which is related to my question. thanks for your comment Commented Oct 3, 2014 at 14:41

2 Answers 2

4
+50

Querying WMI for each process is going to be painfully slow. What you should do is to return all classes and then do a "managed comparison" by process id. In the following example I read all properties of each class and map each class to its corresponding Process. Execution time: 165.53 ms. Note, this includes Process.GetProcesses(). And no, I don't have a supercomputer.

(Note: You need to add a reference to System.Management.dll)

Imports System.Management 

Public Class Win32Process

    Public Property Caption() As String
    Public Property CommandLine() As String
    Public Property CreationClassName() As String
    Public Property CreationDate() As DateTime?
    Public Property CSCreationClassName() As String
    Public Property CSName() As String
    Public Property Description() As String
    Public Property ExecutablePath() As String
    Public Property ExecutionState() As UInt16?
    Public Property Handle() As String
    Public Property HandleCount() As UInt32?
    Public Property InstallDate() As DateTime?
    Public Property KernelModeTime() As UInt64?
    Public Property MaximumWorkingSetSize() As UInt32?
    Public Property MinimumWorkingSetSize() As UInt32?
    Public Property Name() As String
    Public Property OSCreationClassName() As String
    Public Property OSName() As String
    Public Property OtherOperationCount() As UInt64?
    Public Property OtherTransferCount() As UInt64?
    Public Property PageFaults() As UInt32?
    Public Property PageFileUsage() As UInt32?
    Public Property ParentProcessId() As UInt32?
    Public Property PeakPageFileUsage() As UInt32?
    Public Property PeakVirtualSize() As UInt64?
    Public Property PeakWorkingSetSize() As UInt32?
    Public Property Priority() As UInt32?
    Public Property PrivatePageCount() As UInt64?
    Public Property ProcessId() As UInt32?
    Public Property QuotaNonPagedPoolUsage() As UInt32?
    Public Property QuotaPagedPoolUsage() As UInt32?
    Public Property QuotaPeakNonPagedPoolUsage() As UInt32?
    Public Property QuotaPeakPagedPoolUsage() As UInt32?
    Public Property ReadOperationCount() As UInt64?
    Public Property ReadTransferCount() As UInt64?
    Public Property SessionId() As UInt32?
    Public Property Status() As String
    Public Property TerminationDate() As DateTime?
    Public Property ThreadCount() As UInt32?
    Public Property UserModeTime() As UInt64?
    Public Property VirtualSize() As UInt64?
    Public Property WindowsVersion() As String
    Public Property WorkingSetSize() As UInt64?
    Public Property WriteOperationCount() As UInt64?
    Public Property WriteTransferCount() As UInt64?

    Public Shared Function GetProcesses() As Win32Process()
        Using searcher As New ManagementObjectSearcher("select * from Win32_Process")
            Return (
                From
                    item As ManagementObject
                In
                    searcher.[Get]().Cast(Of ManagementObject)()
                Select New Win32Process() With {
                    .Caption = CType(item.Properties("Caption").Value, String),
                    .CommandLine = CType(item.Properties("CommandLine").Value, String),
                    .CreationClassName = CType(item.Properties("CreationClassName").Value, String),
                    .CreationDate = ManagementUtils.ToDateTime(item.Properties("CreationDate").Value),
                    .CSCreationClassName = CType(item.Properties("CSCreationClassName").Value, String),
                    .CSName = CType(item.Properties("CSName").Value, String),
                    .Description = CType(item.Properties("Description").Value, String),
                    .ExecutablePath = CType(item.Properties("ExecutablePath").Value, String),
                    .ExecutionState = CType(item.Properties("ExecutionState").Value, UInt16?),
                    .Handle = CType(item.Properties("Handle").Value, String),
                    .HandleCount = CType(item.Properties("HandleCount").Value, UInt32?),
                    .InstallDate = ManagementUtils.ToDateTime(item.Properties("InstallDate").Value),
                    .KernelModeTime = CType(item.Properties("KernelModeTime").Value, UInt64?),
                    .MaximumWorkingSetSize = CType(item.Properties("MaximumWorkingSetSize").Value, UInt32?),
                    .MinimumWorkingSetSize = CType(item.Properties("MinimumWorkingSetSize").Value, UInt32?),
                    .Name = CType(item.Properties("Name").Value, String),
                    .OSCreationClassName = CType(item.Properties("OSCreationClassName").Value, String),
                    .OSName = CType(item.Properties("OSName").Value, String),
                    .OtherOperationCount = CType(item.Properties("OtherOperationCount").Value, UInt64?),
                    .OtherTransferCount = CType(item.Properties("OtherTransferCount").Value, UInt64?),
                    .PageFaults = CType(item.Properties("PageFaults").Value, UInt32?),
                    .PageFileUsage = CType(item.Properties("PageFileUsage").Value, UInt32?),
                    .ParentProcessId = CType(item.Properties("ParentProcessId").Value, UInt32?),
                    .PeakPageFileUsage = CType(item.Properties("PeakPageFileUsage").Value, UInt32?),
                    .PeakVirtualSize = CType(item.Properties("PeakVirtualSize").Value, UInt64?),
                    .PeakWorkingSetSize = CType(item.Properties("PeakWorkingSetSize").Value, UInt32?),
                    .Priority = CType(item.Properties("Priority").Value, UInt32?),
                    .PrivatePageCount = CType(item.Properties("PrivatePageCount").Value, UInt64?),
                    .ProcessId = CType(item.Properties("ProcessId").Value, UInt32?),
                    .QuotaNonPagedPoolUsage = CType(item.Properties("QuotaNonPagedPoolUsage").Value, UInt32?),
                    .QuotaPagedPoolUsage = CType(item.Properties("QuotaPagedPoolUsage").Value, UInt32?),
                    .QuotaPeakNonPagedPoolUsage = CType(item.Properties("QuotaPeakNonPagedPoolUsage").Value, UInt32?),
                    .QuotaPeakPagedPoolUsage = CType(item.Properties("QuotaPeakPagedPoolUsage").Value, UInt32?),
                    .ReadOperationCount = CType(item.Properties("ReadOperationCount").Value, UInt64?),
                    .ReadTransferCount = CType(item.Properties("ReadTransferCount").Value, UInt64?),
                    .SessionId = CType(item.Properties("SessionId").Value, UInt32?),
                    .Status = CType(item.Properties("Status").Value, String),
                    .TerminationDate = ManagementUtils.ToDateTime(item.Properties("TerminationDate").Value),
                    .ThreadCount = CType(item.Properties("ThreadCount").Value, UInt32?),
                    .UserModeTime = CType(item.Properties("UserModeTime").Value, UInt64?),
                    .VirtualSize = CType(item.Properties("VirtualSize").Value, UInt64?),
                    .WindowsVersion = CType(item.Properties("WindowsVersion").Value, String),
                    .WorkingSetSize = CType(item.Properties("WorkingSetSize").Value, UInt64?),
                    .WriteOperationCount = CType(item.Properties("WriteOperationCount").Value, UInt64?),
                    .WriteTransferCount = CType(item.Properties("WriteTransferCount").Value, UInt64?)
                }
            ).ToArray()
        End Using
    End Function

End Class

Friend Class ManagementUtils

    Friend Shared Function ToDateTime(value As Object) As DateTime?
        If (value Is Nothing) Then
            Return CType(Nothing, DateTime?)
        End If
        Return ManagementDateTimeConverter.ToDateTime(CType(value, String))
    End Function

End Class

Test

Dim watch As New Stopwatch()

watch.[Start]()

Dim result As New Dictionary(Of Process, Win32Process)
Dim processes As Win32Process() = Win32Process.GetProcesses()

Process.GetProcesses().AsParallel().ForAll(
    Sub(p As Process)
        SyncLock result
            result.Add(p, (From item In processes.AsEnumerable() Where (item.ProcessId.HasValue AndAlso (CUInt(p.Id) = item.ProcessId.Value)) Select item).FirstOrDefault())
        End SyncLock
    End Sub)

watch.[Stop]()

Debug.WriteLine("Time: {0} ms, Win32ProcessCount={1}, ProcessCount={1}", watch.Elapsed.TotalMilliseconds, processes.Length, result.Count)
Debug.WriteLine("**************")
Debug.WriteLine(String.Join(Environment.NewLine, (From pair As KeyValuePair(Of Process, Win32Process) In result Select String.Format("Id={0}, Matched={1}", pair.Key.Id.ToString("X8"), (Not pair.Value Is Nothing)))))

Result

Time: 165.53 ms, Win32ProcessCount=96, ProcessCount=96
**************
Id=00001B1C, Matched=True
Id=000019FC, Matched=True
Id=000006EC, Matched=True
Id=000007B0, Matched=True
Id=00001CC0, Matched=True
Id=00001024, Matched=True
Id=00000AC0, Matched=True
Id=0000078C, Matched=True
Id=00001BA8, Matched=True
Id=00000B7C, Matched=True
Id=00000304, Matched=True
Id=0000079C, Matched=True
Id=00000238, Matched=True
Id=00000F80, Matched=True
Id=000003C0, Matched=True
Id=00000170, Matched=True
Id=00000234, Matched=True
Id=00001634, Matched=True
Id=00000230, Matched=True
Id=00001B94, Matched=True
Id=00000540, Matched=True
Id=00001254, Matched=True
Id=00001A04, Matched=True
Id=000002EC, Matched=True
Id=00000474, Matched=True
Id=00000910, Matched=True
Id=000005B8, Matched=True
Id=000004F0, Matched=True
Id=00000114, Matched=True
Id=000015D8, Matched=True
Id=00000738, Matched=True
Id=0000144C, Matched=True
Id=0000133C, Matched=True
Id=00001384, Matched=True
Id=000007F8, Matched=True
Id=00000294, Matched=True
Id=000012BC, Matched=True
Id=00000D58, Matched=True
Id=00000B08, Matched=True
Id=00001F08, Matched=True
Id=00000AFC, Matched=True
Id=00000B04, Matched=True
Id=00001750, Matched=True
Id=000008B0, Matched=True
Id=0000199C, Matched=True
Id=000001C0, Matched=True
Id=00000970, Matched=True
Id=00000720, Matched=True
Id=0000136C, Matched=True
Id=000001B8, Matched=True
Id=000001B4, Matched=True
Id=000012A0, Matched=True
Id=00000D3C, Matched=True
Id=0000093C, Matched=True
Id=00001890, Matched=True
Id=000012D0, Matched=True
Id=000003F8, Matched=True
Id=00000330, Matched=True
Id=00000AE0, Matched=True
Id=00000954, Matched=True
Id=000002B4, Matched=True
Id=00000C64, Matched=True
Id=00000574, Matched=True
Id=00001FD4, Matched=True
Id=000018BC, Matched=True
Id=00001A44, Matched=True
Id=00000B94, Matched=True
Id=00000630, Matched=True
Id=000003E0, Matched=True
Id=00000004, Matched=True
Id=0000102C, Matched=True
Id=000005C0, Matched=True
Id=00000000, Matched=True
Id=000009D0, Matched=True
Id=00000C1C, Matched=True
Id=00000218, Matched=True
Id=00000A88, Matched=True
Id=00000B70, Matched=True
Id=000002D4, Matched=True
Id=00000398, Matched=True
Id=0000020C, Matched=True
Id=000009B8, Matched=True
Id=0000082C, Matched=True
Id=00001298, Matched=True
Id=000009B0, Matched=True
Id=00000760, Matched=True
Id=00000F40, Matched=True
Id=00000758, Matched=True
Id=00001128, Matched=True
Id=000005C8, Matched=True
Id=00000C24, Matched=True
Id=00001900, Matched=True
Id=0000124C, Matched=True
Id=00001148, Matched=True
Id=0000120C, Matched=True
Id=00000CA8, Matched=True

0
3

The fact is that you cannot do that.

Here is the reason: "Note: A 32-bit processes cannot access the modules of a 64-bit process. If you try to get information about a 64-bit process from a 32-bit process, you will get a Win32Exception exception."

And also, as you can see here, Process.MainModule property throws a Win32Exception whenever "A 32-bit process is trying to access the modules of a 64-bit process.".

This question states that you should "trap the exception and keep going".

It seems that through Process.MainModule you are directly accessing the module, so a 32-bit assembly won't be able to access a 64-bit module. Better explanations here.

Make sure that you really need a 32-bit version of your application (if you are not referencing any 32-bit DLL, then you should compile your assembly as "Any CPU", which will avoid the problem).

2
  • 1
    Thanks but as I pointed in my question I know and I understand why happens the problem, I'm asking for solutions, not for explanations about the problem. I seen many x86 task-managers developed in C/C++ that can list x64 processes and manage its "properties" (and of course those apps I'm sure don't use WMI queries because that is too slow to update the list of processes each 100-500 ms). Thanks for your answer Commented Oct 6, 2014 at 16:24
  • @ElektroStudios have a read here stackoverflow.com/questions/3801517/… at the first answer. also, his answer is not entirely correct, as you can load ntdlls' wow64 functions on runtime and use them to read the memory of a 64bit process from a 32bit process running under wow64. I haven't found a way yet to access the modules this way(I am looking). Will try to update when I do, though I'm using C++.
    – Noobay
    Commented Oct 25, 2016 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.