How to get parent process in .NET in managed way

Question

I was looking a lot for method to get parent process in .NET, but found only P/Invoke way.

Answer 1

If you've ever digged the BCL, you shall find that the ways to find parent process are deliberately avoided, take this for example:

https://referencesource.microsoft.com/#System/services/monitoring/system/diagnosticts/ProcessManager.cs,327

As you can see in the source code, it contains comprehensive structures and imported native methods which are absolutely sufficient to get the job done. However, even if you access them via reflection(this is possible), you would not find a method for doing it directly. I can't answer why, yet this phenomenon causes questions like yours are asked for somewhat repeatedly; for example:

How can I get the PID of the parent process of my application

For there is no answer along with some code using CreateToolhelp32Snapshot in this thread, I'd add it -- part of the structure definitions and names I steal from the MS' reference source :)

• Code

  using System.Diagnostics;
  using System.Runtime.InteropServices;
  using System.Collections.Generic;
  using System.Linq;
  using System;
  

  ---

  public static class Toolhelp32 {
      public const uint Inherit = 0x80000000;
      public const uint SnapModule32 = 0x00000010;
      public const uint SnapAll = SnapHeapList|SnapModule|SnapProcess|SnapThread;
      public const uint SnapHeapList = 0x00000001;
      public const uint SnapProcess = 0x00000002;
      public const uint SnapThread = 0x00000004;
      public const uint SnapModule = 0x00000008;
  
      [DllImport("kernel32.dll")]
      static extern bool CloseHandle(IntPtr handle);
      [DllImport("kernel32.dll")]
      static extern IntPtr CreateToolhelp32Snapshot(uint flags, int processId);
  
      public static IEnumerable TakeSnapshot(uint flags, int id) where T : IEntry, new() {
          using(var snap = new Snapshot(flags, id))
              for(IEntry entry = new T { }; entry.TryMoveNext(snap, out entry);)
                  yield return (T)entry;
      }
  
      public interface IEntry {
          bool TryMoveNext(Toolhelp32.Snapshot snap, out IEntry entry);
      }
  
      public struct Snapshot:IDisposable {
          void IDisposable.Dispose() {
              Toolhelp32.CloseHandle(m_handle);
          }
          public Snapshot(uint flags, int processId) {
              m_handle=Toolhelp32.CreateToolhelp32Snapshot(flags, processId);
          }
          IntPtr m_handle;
      }
  }
  

  ---

  [StructLayout(LayoutKind.Sequential)]
  public struct WinProcessEntry:Toolhelp32.IEntry {
      [DllImport("kernel32.dll")]
      public static extern bool Process32Next(Toolhelp32.Snapshot snap, ref WinProcessEntry entry);
  
      public bool TryMoveNext(Toolhelp32.Snapshot snap, out Toolhelp32.IEntry entry) {
          var x = new WinProcessEntry { dwSize=Marshal.SizeOf(typeof(WinProcessEntry)) };
          var b = Process32Next(snap, ref x);
          entry=x;
          return b;
      }
  
      public int dwSize;
      public int cntUsage;
      public int th32ProcessID;
      public IntPtr th32DefaultHeapID;
      public int th32ModuleID;
      public int cntThreads;
      public int th32ParentProcessID;
      public int pcPriClassBase;
      public int dwFlags;
      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
      public String fileName;
      //byte fileName[260];
      //public const int sizeofFileName = 260;
  }
  

  ---

  public static class Extensions {
      public static Process Parent(this Process p) {
          var entries = Toolhelp32.TakeSnapshot(Toolhelp32.SnapAll, 0);
          var parentid = entries.First(x => x.th32ProcessID==p.Id).th32ParentProcessID;
          return Process.GetProcessById(parentid);
      }
  }
  

And we can use it like:

• Test

  public class TestClass {
      public static void TestMethod() {
          var p = Process.GetCurrentProcess().Parent();
          Console.WriteLine("{0}", p.Id);
      }
  }
  

---

For alternative ending ..

According to the documentation, there are a pair of iteration methods per type of the entries such as Process32First and Process32Next are for the iteration of processes; but I found the `xxxxFirst' methods are unnecessary, and then I thought why not put the iteration method with its corresponding entry type? It'd be easier to implement and be understood(I guess so ..).

Just as Toolhelp32 suffixed with help, I think a static helper class is proper, so that we can have the clear qualified names such as Toolhelp32.Snapshot or Toolhelp32.IEntry though it'd be irrelevant here ..

Once the parent process is obtained, if you further want to get some detailed infos, you can extend with this easily, for example, iterate on its modules, then add:

• Code - WinModuleEntry

  [StructLayout(LayoutKind.Sequential)]
  public struct WinModuleEntry:Toolhelp32.IEntry { // MODULEENTRY32
      [DllImport("kernel32.dll")]
      public static extern bool Module32Next(Toolhelp32.Snapshot snap, ref WinModuleEntry entry);
  
      public bool TryMoveNext(Toolhelp32.Snapshot snap, out Toolhelp32.IEntry entry) {
          var x = new WinModuleEntry { dwSize=Marshal.SizeOf(typeof(WinModuleEntry)) };
          var b = Module32Next(snap, ref x);
          entry=x;
          return b;
      }
  
      public int dwSize;
      public int th32ModuleID;
      public int th32ProcessID;
      public int GlblcntUsage;
      public int ProccntUsage;
      public IntPtr modBaseAddr;
      public int modBaseSize;
      public IntPtr hModule;
      //byte moduleName[256];
      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)]
      public string moduleName;
      [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
      public string fileName;
      //byte fileName[260];
      //public const int sizeofModuleName = 256;
      //public const int sizeofFileName = 260;
  }
  

  ---

  and some test ..

  public class TestClass {
      public static void TestMethod() {
          var p = Process.GetCurrentProcess().Parent();
          Console.WriteLine("{0}", p.Id);
  
          var formatter = new CustomFormatter { };
          foreach(var x in Toolhelp32.TakeSnapshot(Toolhelp32.SnapModule, p.Id)) {
              Console.WriteLine(String.Format(formatter, "{0}", x));
          }
      }
  }
  
  public class CustomFormatter:IFormatProvider, ICustomFormatter {
      String ICustomFormatter.Format(String format, object arg, IFormatProvider formatProvider) {
          var type = arg.GetType();
          var fields = type.GetFields();
          var q = fields.Select(x => String.Format("{0}:{1}", x.Name, x.GetValue(arg)));
          return String.Format("{{{0}}}", String.Join(", ", q.ToArray()));
      }
  
      object IFormatProvider.GetFormat(Type formatType) {
          return typeof(ICustomFormatter)!=formatType ? null : this;
      }
  }
  

In case you want a code example ..

• https://github.com/kenkins/ToolHelp32ConsoleApp