C# Only part of a ReadProcessMemory or WriteProcessMemory request was completed during Process.Kill()

Question

I have been researching this issue pretty extensively and cannot seem to find an answer.

I know that the Only part of a ReadProcessMemory or WriteProcessMemory

Answer 1

There are only some issues regarding the handling of the processes and the locking that I would change:

object lockObject = new object();
List<Process> processesToRemove = new List<Process>();
foreach (Process p in _runningProcesses)
{
    foreach (ProcessModule module in p.Modules)
    {
        string[] strs = text.Split('\\');

        if (module.ModuleName.Equals(strs[strs.Length - 1]))
        {
            processesToRemove.Add(p);
            break;
        }
    }                    
}                
lock (lockObject)
{
    foreach (Process p in processesToRemove)
    {                 
        p.Kill();
        _runningProcesses.Remove(p);
    }                
}

I'm not answering for the bounty, just wanted to give some ideas. This code isn't tested because I don't exactly know what you are trying to do there.

Just consider not to lock the process-list and to keep the lock as short as possible.

Answer 2

I agree with @sprinter252 that _runningProcesses should not be used as your sync object here.

//Somewhere that is accessible to both the thread getting the process list and the thread the 
//code below will be running, declare your sync, lock while adjusting _runningProcesses
public static readonly object Sync = new object();

IList<Process> runningProcesses;
lock(Sync)
{
    runningProcesses = _runningProcesses.ToList();
}
Process processToRemove = null;
foreach (Process p in _runningProcesses)
{
    foreach (ProcessModule module in p.Modules)
    {
        string[] strs = text.Split('\\');
        if (module.ModuleName.Equals(strs[strs.Length - 1]))
        {
            processToRemove = p;
            break;
        }
    }
    if (processToRemove != null)
    {
        break;
    }
}
if (processToRemove != null)
{
    //If we've got a process that needs killing, re-lock on Sync so that we may 
    //safely modify the shared collection
    lock(Sync)
    {
        processToRemove.Kill();
        _runningProcesses.Remove(processToRemove);
    }
}

If this code is wrapped in a loop to continue to check _runningProcesses for the process you wish to kill, consider changing processToRemove to processesToRemove and change it's type to a collection, iterate over that list in the bottom block after a check for a non-zero count and lock outside of that loop to decrease the overhead of obtaining and releasing locks per process to kill.

Answer 3

As detailed in the comments of the MSDN page for Process.Modules and this thread there is a known issue in Process.Modules when enumerating 32 bit processes from a 64 bit process and visa-versa:

Internally .NET's Process.Modules is using function EnumProcessModules from PSAPI.dll. This function has a known issue that it cannot work across 32/64 bit process boundary. Therefore enumerating another 64-bit process from 32-bit process or vice versa doesn't work correctly.

The solution seems to be to use the EnumProcessModulesEx function, (which must be called via P/Invoke), however this function is only available on later versions of Windows.

We fixed this issue by adding a new function called EnumProcessModulesEx to PSAPI.dll (http://msdn2.microsoft.com/en-us/library/ms682633.aspx), but we currently cannot use it in this case:

• it only works on Windows Vista or Windows Server 2008
• currently .NET 2.0 Framework don't have a service pack or hotfix to make Process.Modules use this new API