System.ComponentModel.Win32Exception (0x80004005)：访问被拒绝

Question

我有一个带有方法 GetParentProcess(IntPtr handle) 的结构，用于通过传递句柄返回父进程。

[StructLayout(LayoutKind.Sequential)]
public struct ParentProcessUtilities
{

    internal IntPtr Reserved1;
    internal IntPtr PebBaseAddress;
    internal IntPtr Reserved2_0;
    internal IntPtr Reserved2_1;
    internal IntPtr UniqueProcessId;
    internal IntPtr InheritedFromUniqueProcessId;

    [DllImport("ntdll.dll")]
    public static extern int NtQueryInformationProcess(IntPtr processHandle, int processInformationClass, ref ParentProcessUtilities processInformation, int processInformationLength, out int returnLength);


    public static Process GetParentProcess()
    {
        return GetParentProcess(Process.GetCurrentProcess().Handle);
    }


    public Process GetParentProcess(int id)
    {
        Process process = Process.GetProcessById(id);
        return GetParentProcess(process.Handle);
    }


    public static Process GetParentProcess(IntPtr handle)
    {
        ParentProcessUtilities pbi = new ParentProcessUtilities();
        int returnLength;
        int status = NtQueryInformationProcess(handle, 0, ref pbi, Marshal.SizeOf(pbi), out returnLength);
        if (status != 0)
            throw new Win32Exception(status);

        try
        {
            return Process.GetProcessById(pbi.InheritedFromUniqueProcessId.ToInt32());
        }
        catch (ArgumentException)
        {

            return null;
        }
    }
}

一切正常，直到我进入进程“smss.exe”。当我想获得该进程的父进程时，它会抛出这个异常

 Unexpected exception : System.ComponentModel.Win32Exception (0x80004005): Access is denied
   at System.Diagnostics.ProcessManager.OpenProcess(Int32 processId, Int32 access, Boolean throwIfExited)
   at System.Diagnostics.Process.GetProcessHandle(Int32 access, Boolean throwIfExited)
   at System.Diagnostics.Process.OpenProcessHandle(Int32 access)
   at System.Diagnostics.Process.get_Handle()

我正在以管理员权限运行应用程序。感谢帮助

Answer 1

smss.exe 是会话管理器子系统，有关详细信息，请参阅此Wikipedia article。它是 Windows 内核启动的第一个用户模式进程，并执行许多特权操作。因此，您的普通进程将无权管理此进程，因此“访问被拒绝”异常。