CHAPTER 17 PROCESSES, APPDOMAINS, AND OBJECT CONTEXTS
-> PID: 592
Name: lsm
-> PID: 660
Name: devenv
-> PID: 684
Name: svchost
-> PID: 760
Name: svchost
-> PID: 832
Name: svchost
-> PID: 844
Name: svchost
-> PID: 856
Name: svchost
-> PID: 900
Name: svchost
-> PID: 924
Name: svchost
-> PID: 956
Name: VMwareService
-> PID: 1116
Name: spoolsv
-> PID: 1136
Name: ProcessManipulator.vshost
************************************
Investigating a Specific Process
In addition to obtaining a full and complete list of all running processes on a given machine, the static
Process.GetProcessById() method allows you to obtain a single Process object via the associated PID. If
you request access to a nonexistent PID, an ArgumentException exception is thrown. For example, if you
were interested in obtaining a Process object representing a process with the PID of 987, you could write
the following code:
// If there is no process with the PID of 987, a
// runtime exception will be thrown.
static void GetSpecificProcess()
{
Process theProc = null;
try
{
theProc = Process.GetProcessById(987);
}
catch(ArgumentException ex)
{
Console.WriteLine(ex.Message);
}
}
At this point, you have learned how to get a list of all processes, or a specific process on a machine
via a PID lookup. While it is somewhat useful to discover PIDs and process names, the Process class also
allows you to discover the set of current threads and libraries used within a given process. Let’s see how
to do so.
Investigating a Process’s Thread Set
The set of threads is represented by the strongly typed ProcessThreadCollection collection, which
contains some number of individual ProcessThread objects. To illustrate, assume the following
additional static helper function has been added to your current application:
static void EnumThreadsForPid(int pID)
{
Process theProc = null;
629