How to determine whether a particular process is a WPF application running or not?
In Snoop, the author uses this code below to check this condition ~
foreach (ProcessModule module in process.Modules)
{
if (module.ModuleName.Contains("PresentationFramework.dll") ||
module.ModuleName.Contains("PresentationFramework.ni.dll"))
{
isValid = true;
break;
}
}
Apparently a 32-bit process cannot enumerate the modules of a 64-bit process. It raises the following Win32Exception :
Only part of a ReadProcessMemory or WriteProcessMemory request was completed
That's probably a limitation of the Process class, there must be a way around it using API methods...
The same thing works fine if the process is also 64-bit...
Regarding Snoop, there isn't a 64-bit version available for download, but since the source is also available, you could compile it to x64
EDIT: if your process is 64-bit and the running WPF app is 32-bit, Process.Modules doesn't seem to contain PresentationFramework either...
System.Diagnostics.ProcessModule (TheWPFApp.exe)
System.Diagnostics.ProcessModule (ntdll.dll)
System.Diagnostics.ProcessModule (wow64.dll)
System.Diagnostics.ProcessModule (wow64win.dll)
System.Diagnostics.ProcessModule (wow64cpu.dll)