35

i have a problem with getting a specific PID of a process, the problem with this process is that it's a hidden process, it's not showing on task manager / powershell, completely hidden.

what i have do far is the main window handle of this process, the question is, how can i get the pid of it.

what i'm trying to do is to read the memory of this process and edit it, but can't do so without the PID i guess (since i need to get it's base address in memory).

So, if anyone has any workaround or something for me, it will be great.

P.S: this process does not show in Process.GetProcesses().

ty!

Amit Shadadi
  • 583
  • 2
  • 6
  • 18

2 Answers2

53

You can use the following Windows API:

[DllImport("user32.dll", SetLastError=true)]
static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint processId);

You pass in the HWND and use the out parameter to return the PID.

You can read more on this function here on MSDN.

Uwe Keim
  • 38,279
  • 56
  • 171
  • 280
Lloyd
  • 28,624
  • 4
  • 82
  • 95
9

You will need to use P/invoke with the Windows API.

Declare a function in your class like

 [DllImport("User32.dll")]
 static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId);

and then call it in your class.

See PInvoke.

bash.d
  • 12,737
  • 3
  • 26
  • 38