How to determine whether a particular process is a WPF application running or not?

Question

How to determine whether a particular process is a WPF application running or not?

In Snoop, the author uses this code below to check this condition ~

foreach (ProcessModule module in process.Modules)
{
     if (module.ModuleName.Contains("PresentationFramework.dll") ||
        module.ModuleName.Contains("PresentationFramework.ni.dll"))
    {
       isValid = true;
        break;
     }
}

Answer 1

I just tested this on 64-bit Vista, and it works well. The WPF process contains PresentationFramework.ni.dll from the native images folder (where assemblies go when they have been ngen'd).

Can you elaborate on why you think this does not work?

Answer 2

Apparently a 32-bit process cannot enumerate the modules of a 64-bit process. It raises the following Win32Exception :

Only part of a ReadProcessMemory or WriteProcessMemory request was completed

That's probably a limitation of the Process class, there must be a way around it using API methods...

The same thing works fine if the process is also 64-bit...

Regarding Snoop, there isn't a 64-bit version available for download, but since the source is also available, you could compile it to x64

EDIT: if your process is 64-bit and the running WPF app is 32-bit, Process.Modules doesn't seem to contain PresentationFramework either...

System.Diagnostics.ProcessModule (TheWPFApp.exe)
System.Diagnostics.ProcessModule (ntdll.dll)
System.Diagnostics.ProcessModule (wow64.dll)
System.Diagnostics.ProcessModule (wow64win.dll)
System.Diagnostics.ProcessModule (wow64cpu.dll)