-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathidea.cs
56 lines (44 loc) · 1.26 KB
/
idea.cs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
// nolaunchernag -c|q "c:\path\original_run.exe"
class ProcessList
{
int parent_pid;
List<ProcessList> childs;
void FollowTheTrail(int process_pid, string process_name)
{
var child_pids = new List<int>();
boolean found_new = true;
while (found_new)
{
found_new = false;
foreach (var pid in list)
{
var new_list = GetChildPid(pid);
if (new_list.length > 0)
{
found_new = true;
list.add(new_list);
}
}
}
}
public void GetChildPid()
{
using (var searcher = new ManagementObjectSearcher(String.Format(
"SELECT ProcessId FROM Win32_Process WHERE ParentProcessId = {0}", parent_pid)))
{
foreach (var result in searcher.Get())
{
try
{
var result_pid = Convert.ToInt32(result["ProcessId"]);
var child = new ProcessList(result_pid);
this.childs.add(child);
}
catch (Exception ex)
{
continue;
}
}
}
}
}