C# Get list od running Apps and their paths for string scan

Question

I'm developing a very simple 3rd party anti-cheat app in C#. I've managed to create a code that will scan any .exe for forbidden strings like "aimbot" and "hack". But the way I did it is, you browse for a file to scan and click a button to scan it - and this works great. What I want now is that my tool will check the running user processes and scan them automatically. Is that even doable?

Answer 1

If you already know the process names you want to go for, you can go with this.

    Process[] processMame = Process.GetProcessesByName("yourProcess");
    if (processMame.Length > 0)
    {
        /// You got your process here
        /// Do whatever you want 
    }


    Process[] processlist = Process.GetProcesses();
    foreach (Process process in processlist)
    {
        Console.WriteLine($"Process: {process.ProcessName} ID: {process.Id} Path: {process.MainModule.FileName}");
    }

You might want to make sure your app runs on administrator mode to do so. If you want the executable path you'd find it here on process.MainModule.FileName

Update:

I tried out opening a running executable and I was right on the fact that I would end up in an access violation even if Im administrator as that file is being used by other process now.

My suggestion would be if you want to check out an existing process, kill/dispose it, open it and do whatever you're supposed to do and if you feel this is not harmless, you restore it back.

You might need to make sure that your app has administrator privileges through manifest defined here.

For going for processes in current session:

If you want to have the processes in current active session (current active user who is logged in), you might want to go for something like:

    Process[] runningProcesses = Process.GetProcesses();
    var sessionId = Process.GetCurrentProcess().SessionId;

    var currentSessionProcesses = runningProcesses.Where(c => c.SessionId == sessionId).ToList();

    foreach (var process in currentSessionProcesses)
    {
        Console.WriteLine($"Process: {process.ProcessName} ID: {process.Id} Path: {process.MainModule.FileName}");
    }