如何访问C＃中的系统进程属性？

Question

我想查找系统进程的可执行路径，我遵循WMI方法，我使用Process.EnterDebugMode（）为我的进程获取访问OS进程属性的特权，但仍然在调用ManagementObject.GetPropertyValue（“ExecutablePath” ）返回null，我试图为smss.exe进程。

下面是代码：

static void Main(string[] args) 
    { 

     int processID = 536; // Just trying with the PID of smss.exe running in my system 

     System.Diagnostics.Process.EnterDebugMode(); 

     ConnectionOptions options = new ConnectionOptions(); 
     options.EnablePrivileges = true; 
     options.Impersonation = ImpersonationLevel.Impersonate; 

     ManagementScope scope = new ManagementScope(@"\\.\root\cimv2", options); 

     string NameProperty = "Name"; 
     string PidProperty = "ProcessId"; 
     string FullPathProperty = "ExecutablePath"; 
     string query; 
     query = string.Format("select {0}, {1}, {2} from Win32_Process where {1} = {3}", NameProperty, PidProperty, FullPathProperty, processID); 
     ObjectQuery objectQuery = new ObjectQuery(query); 
     ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, objectQuery); 

     foreach (ManagementObject processEntry in searcher.Get()) 
     { 
      if (processEntry.GetPropertyValue(PidProperty) != null) 
      { 
       int value = Convert.ToInt32(processEntry.GetPropertyValue(PidProperty)); 
       if (value == processID) 
       { 
        if (processEntry.GetPropertyValue(FullPathProperty) != null) 
        { 
         System.Windows.Forms.MessageBox.Show(processEntry[FullPathProperty].ToString()); 
        } 

       } 
      } 
     }  
    } 

Answer 1

你不能得到这个信息使用wmismss.exe过程：

wmic process where "Caption='smss.exe'" get /value 

上面的命令以及任务管理器显示空CommandLine和ExecutablePath ：

==> wmic process where "Caption='smss.exe'" get Caption, CommandLine, ExecutablePath, ProcessID 
Caption CommandLine ExecutablePath ProcessId 
smss.exe        248 

但是，您可以（白白）使用where command得到smss.exe可执行文件路径：在Critical System Services MSDN文章

==> where smss.exe 
C:\Windows\System32\smss.exe 

更多信息。

关键系统服务不能没有重新启动系统停止和重新启动由 重启管理器。对其中一个服务正在使用的任何文件或 资源的更新需要重新启动系统。