使用WMI，我如何确定远程进程是32位还是64位？

Question

我有一个使用WMI从远程机器查询win32_process对象的集合。我如何确定每个进程是32位还是64位？

Answer 1

WMI没有此功能。解决方案是通过P/Invoke使用IsWow64Process测试每个进程的Handle。 This code应该可以帮助你明白。

Answer 2

试试这个：

/// <summary> 
/// Retrieves the platform information from the process architecture. 
/// </summary> 
/// <param name="path"></param> 
/// <returns></returns> 
public static string GetPlatform(string path) 
{ 
    string result = ""; 
    try 
    { 
     const int pePointerOffset = 60; 
     const int machineOffset = 4; 
     var data = new byte[4096]; 
     using (Stream s = new FileStream(path, FileMode.Open, FileAccess.Read)) 
     { 
      s.Read(data, 0, 4096); 
     } 
     // Dos header is 64 bytes, last element, long (4 bytes) is the address of 
     // the PE header 
     int peHeaderAddr = BitConverter.ToInt32(data, pePointerOffset); 
     int machineUint = BitConverter.ToUInt16(data, peHeaderAddr + 
                 machineOffset); 
     result = ((MachineType) machineUint).ToString(); 
    } 
    catch { } 

    return result; 
} 



public enum MachineType 
{ 
    Native = 0, 
    X86 = 0x014c, 
    Amd64 = 0x0200, 
    X64 = 0x8664 
}