How to get Process executable path using ManagementEventWatcher

496 Views Asked by At

I know how to get ProcessID and ProcessName using ManagementEventWatcher. My code is working good.                                             

What i need?
I want to get a Path of Process.
I want to Print ProcessID, ProcessName and ProcessPath.

MY CODE :

Dim processStartEvent As ManagementEventWatcher = New ManagementEventWatcher("SELECT * FROM Win32_ProcessStartTrace")
Dim processStopEvent As ManagementEventWatcher = New ManagementEventWatcher("SELECT * FROM Win32_ProcessStopTrace")

Public Sub New()
    InitializeComponent()
    AddHandler processStartEvent.EventArrived, AddressOf Me.processStartEvent_EventArrived
    processStartEvent.Start()
    AddHandler processStopEvent.EventArrived, AddressOf Me.processStopEvent_EventArrived
    processStopEvent.Start()

End Sub

Private Sub processStartEvent_EventArrived(EventArrivedEventArgs, e)
    Dim processName As String = e.NewEvent.Properties("ProcessName").Value.ToString
    Dim processID As String = Convert.ToInt32(e.NewEvent.Properties("ProcessID").Value).ToString
    FileIO.WriteToFile("Process ID: " & processID & vbNewLine)
    FileIO.WriteToFile("Process Name: " & processName & vbNewLine)
End Sub

Private Sub processStopEvent_EventArrived(EventArrivedEventArgs, e)
    Dim processName As String = e.NewEvent.Properties("ProcessName").Value.ToString
    Dim processID As String = Convert.ToInt32(e.NewEvent.Properties("ProcessID").Value).ToString
    FileIO.WriteToFile("Process ID: " & processID & vbNewLine)
    FileIO.WriteToFile("Process Name: " & processName & vbNewLine)
End Sub

if you are not familiar with VB.net you can answer in C# as well.

1

There are 1 best solutions below

0
On

What about get process path from processID .? like that

System.Diagnostics.Process.GetProcessById(processID).MainModule.FileName;

Here some infromation about MainModule Process.MainModule Property

And i don't know why here you convert from string to int then from int to string

Dim processID As String = Convert.ToInt32(e.NewEvent.Properties("ProcessID").Value).ToString()