39

I have a problem with getting a specific PID of a process, the problem with this process is that it's a hidden process, it's not showing on task manager / PowerShell, completely hidden.

What I have so far is the main window handle of this process, the question is, how can I get the pid of it.

What I'm trying to do is to read the memory of this process and edit it, but can't do so without the PID I guess (since I need to get it's base address in memory).

So, if anyone has any workaround or something for me, it will be great.

P.S: this process does not show in Process.GetProcesses().

ty!

Martin Prikryl
  • 188,800
  • 56
  • 490
  • 992
Amit Shadadi
  • 617
  • 2
  • 7
  • 20

2 Answers2

59

You can use the following Windows API:

[DllImport("user32.dll", SetLastError=true)]
static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint processId);

You pass in the HWND and use the out parameter to return the PID.

You can read more on this function here on MSDN.

Uwe Keim
  • 39,551
  • 56
  • 175
  • 291
Lloyd
  • 29,197
  • 4
  • 84
  • 98
10

You will need to use P/invoke with the Windows API.

Declare a function in your class like

 [DllImport("User32.dll")]
 static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId);

and then call it in your class.

See PInvoke.

bash.d
  • 13,029
  • 3
  • 29
  • 42