How to determine if a particular process is a WPF application running or not?

advertisements

How to determine whether a particular process is a WPF application running or not?

In Snoop, the author uses this code below to check this condition ~

foreach (ProcessModule module in process.Modules)
{
     if (module.ModuleName.Contains("PresentationFramework.dll") ||
        module.ModuleName.Contains("PresentationFramework.ni.dll"))
    {
       isValid = true;
        break;
     }
}


Apparently a 32-bit process cannot enumerate the modules of a 64-bit process. It raises the following Win32Exception :

Only part of a ReadProcessMemory or WriteProcessMemory request was completed

That's probably a limitation of the Process class, there must be a way around it using API methods...

The same thing works fine if the process is also 64-bit...

Regarding Snoop, there isn't a 64-bit version available for download, but since the source is also available, you could compile it to x64

EDIT: if your process is 64-bit and the running WPF app is 32-bit, Process.Modules doesn't seem to contain PresentationFramework either...

System.Diagnostics.ProcessModule (TheWPFApp.exe)
System.Diagnostics.ProcessModule (ntdll.dll)
System.Diagnostics.ProcessModule (wow64.dll)
System.Diagnostics.ProcessModule (wow64win.dll)
System.Diagnostics.ProcessModule (wow64cpu.dll)