Search code examples
c#wmi

Find suspended windows processes using WMI, why is "ExecutionState" always null?


I'm running the following code in a console program :-

 var query = string.Format("select * from Win32_Process");
            var searcher = new ManagementObjectSearcher(query);
            var collection = searcher.Get();
            foreach (ManagementObject o in collection)
            {         
                if(o["CommandLine"] == null) continue;
                if (o["ProcessId"] == null) continue;
                if( o["ExecutionState"] == null)continue;                
                var executionState =o["ExecutionState"].ToString();
                var commandLine = o["CommandLine"].ToString();
                var processId = o["ProcessId"];
                Console.WriteLine("{0}: {1} [{2}]", 
                   processId,
                   executionState,
                   commandLine);                
            }

However the Execution state is always null. Anyone know why? I've tried running as Administrator.

using process explorer, I definitely have a process in a suspended state :-

enter image description here


Solution

  • Looks like ExecutionState isn't implemented and is always null. The official docs don't mention it, but third-party docs do.