Process.MainModule --> "Access is denied"

Question

I want to handle this differently, ie. determine if I have access or not.

Is it possible to see if you have access to the main module or not?

foreach (Process p in Process.GetProcesses())
        {
            try
            {
                //This throws error for some processes.
                if (p.MainModule.FileName.ToLower().EndsWith(ExeName, StringComparison.CurrentCultureIgnoreCase))
            {
                 //Do some stuff
            }

            }
            catch (Exception)
            {  
                //Acess denied 
            }
        }

Here we go again. Have a look @ http://stackoverflow.com/questions/2774527/access-denied-while-using-system-diagnostics-process — leppie, Dec 08 '11 at 12:56

score 13 · Answer 1 · edited Nov 01 '19 at 14:49

  [Flags]
  private enum ProcessAccessFlags : uint
  {
      QueryLimitedInformation = 0x00001000
  }

  [DllImport("kernel32.dll", SetLastError = true)]  
  private static extern bool QueryFullProcessImageName(
        [In] IntPtr hProcess,
        [In] int dwFlags,
        [Out] StringBuilder lpExeName,
        ref int lpdwSize);

    [DllImport("kernel32.dll", SetLastError = true)]
  private static extern IntPtr OpenProcess(
     ProcessAccessFlags processAccess,
     bool bInheritHandle,
     int processId);

String GetProcessFilename(Process p)
{ 
 int capacity = 2000;
 StringBuilder builder = new StringBuilder(capacity);
 IntPtr ptr = OpenProcess(ProcessAccessFlags.QueryLimitedInformation, false, p.Id);
 if (!QueryFullProcessImageName(ptr, 0, builder, ref capacity))
 {
    return String.Empty;
 }

 return builder.ToString();
}

Use pinvoke with ProcessAccessFlags.QueryLimitedInformation. This will allow you to grab the filename of the process without having special admin privileges and works across x32 and x64 processes.

Probably something specific to your system - either privileges or the process itself. — user99999991, Sep 13 '21 at 06:38
This code works, but I'm curious as to why `QueryLimitedInformation = 0x00001000` works where as in the documentation it is `0x1000` which in my case gives access denied? Thank you for the snippet, it was a life saver! — shoaib30, Apr 22 '22 at 04:02

score 3 · Answer 2 · answered Dec 08 '11 at 13:51

I see two possible causes of the exception:

It may be that your process is x86 and the process being queried is x64 or vice versa.
Every process has a so called ACL (Access control list) that describes who can interact with it, the processes you are having problems with have for security reasons an empty ACL so even as administrator you cannot mess with them. For example, there's a handfull of processes (audiodg, System, and Idle from the top of my head) that throw an exception due to the access rights.

Just use a try/catch to your loop to deal with those processes.

Process.MainModule --> "Access is denied"

2 Answers2

Linked