Question

I am writing an C# plug-in for an auditing application, which need to fetch a list of 32 bit applications running inside a 64-bit OS. I got stuck up at this point on how to identify a 32-bit process.

Please help me.

Answer 1

You can use the IsWow64Process windows API call to determine if a process is running under 32bit emulation on a 64bit OS.

Here is the pinvoke link

Update: I benchmarked this a little bit, with the following results:

• Enumerating all the processes with Process.GetProcesses() takes the majority of the time with approx. 12ms on my laptop having 93 processes running
• Obtaining the handle and executing the IsWow64Process call took approx. 0.1ms per process on the same laptop.
• Obtaining all the processes with WMI took approx. 520ms on the same laptop (also 93 processes running).

Basically: If you can cope with the fact that the process might go away after you obtained the list and before you managed to query it then using the pinvoke way seems faster and snappier to me than using WMI. Although WMI might be the less intrusive way (from a process standpoint of view).