如何从句柄确定进程是32还是64位？

How can I get the information from a Process handle acquired using OpenProcess whether a Process is 32 or 64 Bit?

如何从使用OpenProcess获取的Process句柄中获取信息,无论Process是32位还是64位?

3 个解决方案

#1

Yes, IsWow64Process is annoyingly useless. It really means "is 32-bit emulation enabled" and that returns false if you run on a 32-bit operating system, it doesn't need any emulation.

是的,IsWow64Process令人讨厌无用。它实际上意味着“启用32位仿真”,如果您在32位操作系统上运行,则返回false,它不需要任何仿真。

You'll only get a good value out of it if you know for a fact that you're running on a 64-bit operating system. Which is tricky to find out. The IntPtr.Size == 8 test proofs that you run 64-bit, but it doesn't proof that it is definitely not a 64-bit operating system. The 64-bit version of the framework might not have been installed. Or your code might be running from an .exe that had the Platform Target forced to x86. Which is not uncommon for code that's interested in bitness.

如果你知道你在64位操作系统上运行,那么你只能从中获得很好的价值。找出来很棘手。 IntPtr.Size == 8测试证明您运行64位,但它并不能证明它绝对不是64位操作系统。可能尚未安装64位版本的框架。或者您的代码可能是从平台目标强制为x86的.exe运行的。对于对位数感兴趣的代码并不少见。

You'll need to P/Invoke GetNativeSystemInfo(). If that throws (or GetProcAddress returns IntPtr.Zero), you know for a fact that it is a 32-bit operating system. If it doesn't, inspect the value of SYSTEM_INFO.wProcessorArchitecture. It will be 9 for x64, 6 for Titanium, 0 for x86. So if you get 9, then use IsWow64Process. Visit pinvoke.net for the declarations.

你需要P / Invoke GetNativeSystemInfo()。如果抛出(或GetProcAddress返回IntPtr.Zero),您就知道它是一个32位操作系统。如果没有,请检查SYSTEM_INFO.wProcessorArchitecture的值。 x64为9,Titanium为6,x86为0。所以,如果你得到9,那么使用IsWow64Process。访问pinvoke.net获取声明。

Note that the new .NET 4.0 Environment.Is64BitOperatingSystem is flawed the same way.

请注意,新的.NET 4.0 Environment.Is64BitOperatingSystem以同样的方式存在缺陷。

#2

You can test it using following code:

您可以使用以下代码进行测试:

     bool is64BitProcess = (IntPtr.Size == 8);
     bool is64BitOperatingSystem = is64BitProcess || InternalCheckIsWow64();

     [DllImport("kernel32.dll", SetLastError = true, CallingConvention =  CallingConvention.Winapi)]
      [return: MarshalAs(UnmanagedType.Bool)]
       public static extern bool IsWow64Process(
       [In] IntPtr hProcess,
       [Out] out bool wow64Process
   );

     [MethodImpl(MethodImplOptions.NoInlining)]
        private static bool InternalCheckIsWow64()
    {
         if ((Environment.OSVersion.Version.Major == 5 && Environment.OSVersion.Version.Minor >= 1) ||
    Environment.OSVersion.Version.Major >= 6)
           {
             using (Process p = Process.GetCurrentProcess())
               {
                    bool retVal;
                    if (!IsWow64Process(p.Handle, out retVal))
                    {
                       return false;
                    }
                    return retVal;
               }
           }
            else
            {
                  return false;
         }
 }

#3

This is C code with some Python involved but it gives you an idea. Here's a polished version:

这是涉及一些Python的C代码,但它给你一个想法。这是一个抛光版本:

int is64bit(long pid) {
    SYSTEM_INFO sysinfo;
    HANDLE hProcess;
    BOOL isWow64;

    // if OS is not 64 bit, no process will be either    
    GetNativeSystemInfo(&sysinfo);
    if (sysinfo.wProcessorArchitecture != PROCESSOR_ARCHITECTURE_AMD64) 
        return 0;

    hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pid);;
    if (hProcess == NULL)
        return -1;

    if (! IsWow64Process(hProcess, &isWow64)) {
        CloseHandle(hProcess);
        return -1;
    }
    CloseHandle(hProcess);
    if (isWow64)
        return 0;
    else
        return 1;
}

#1