vb Code:
Public Const PROCESSBASICINFORMATION As UInteger = 0
<System.Runtime.InteropServices.StructLayoutAttribute(System.Runtime.InteropServices.LayoutKind.Sequential, Pack:=1)> _
Public Structure Process_Basic_Information
Public ExitStatus As IntPtr
Public PepBaseAddress As IntPtr
Public AffinityMask As IntPtr
Public BasePriority As IntPtr
Public UniqueProcessID As IntPtr
Public InheritedFromUniqueProcessId As IntPtr
End Structure
<System.Runtime.InteropServices.DllImport("ntdll.dll", EntryPoint:="NtQueryInformationProcess")> _
Public Shared Function NtQueryInformationProcess(ByVal handle As IntPtr, ByVal processinformationclass As UInteger, ByRef ProcessInformation As Process_Basic_Information, ByVal ProcessInformationLength As Integer, ByRef ReturnLength As UInteger) As Integer
End Function
Now this is one of the weirdest Windows APIs I have ever worked with - according to the MSDN documentation all of those members of the Process_Basic_Information structure should not be able to just be declared as IntPtr but that is the ONLY way that I can find to make this thing work in .NET (the only other way that worked was declaring them all as Integer if on a 32 bit system or UInt64 on a 64 bit system). Anyway, here's an example of how to use it:
vb Code:
'Create an instance of our API structure - we will pass
'this to the API function in a moment
Dim ProccessInfo As New Process_Basic_Information
'A quick and dirty example of getting the handle of a specific process
Dim ProcHandle As IntPtr = Process.GetProcessesByName("Notepad")(0).Handle
'Used as an output parameter by the API function
Dim RetLength As UInteger
'Here we actually call the function and pass in the relevant information
NtQueryInformationProcess(ProcHandle, PROCESSBASICINFORMATION, ProccessInfo, Marshal.SizeOf(ProccessInfo), RetLength)
'We should really check to make sure the function returned 0 before we try to
'use the data but this is just an example
'Show the parent process ID in a messagebox
MessageBox.Show("Parent ID: " & ProccessInfo.InheritedFromUniqueProcessId.ToString)