On Windows IoT (but also on the normal Windows 10), you can enable keyboard filter and shell launcher.
I enabled UWF, KB-Filter and Shell Launcher.
Now, I can't get the parameters of my keyboardfilter with a simple C#.NET program.
ManagementScope scope = new ManagementScope(#"root\standardcimv2\embedded");
using (ManagementClass mc = new ManagementClass(scope.Path.Path, "WEKF_Settings", null))
{
ManagementObjectCollection moc = mc.GetInstances();
foreach (ManagementObject mo in moc)
{
}
}
The UWF_Filter is working. WEKF_Settings and WESL_UserSetting are not working, even if they are enabled on the OS.
I get always the exception Provider Load Failure, even if the application is started as administrator.
In powershell, I get the class without any problem:
Get-CimClass wekf_settings \\.\root\standardcimv2\embedded | select -expand cimclassqualifiers
So the question: why can't I get the instances (with GetInstances()) in C# but only with powershell?
Just as info (if you get the same error):
The query fails also on Powershell, if this is 32-bit.
You need to compile the program as 64bit. Then the code will be able to query the keyboard filter.
This was the solution.
Related
I try to close running user apps (Application Programs) in windows by C# like word, forxitReader, whatsApp , etc.
I try to make a desktop App to secure an online exam like Safe Exam Browser.
My senario is:
1 - get the process of them only as a list (not System programs.)
2 - Kill them by Process.kill();
But I don't know how to do the first step.
How can I get a list of these programs only?
I understand you need to check the process owner to know if its a system or non-system process, and to my knowledge there is no way to get the process owner via .NET api, but you can get active process and their owner in powershell via
Get-Process -IncludeUserName
Now doing this in C# is a bit tricky because out of the box, the Process class is lacking and making CLI calls is complicated, but I was able to write this solution with only Cake.Powershell nuget package.
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Management.Automation;
using (var powershell = PowerShell.Create())
{
List<string> illegalProcesses = new List<string>() { "dota2" };
powershell.AddScript("Get-Process -IncludeUserName");
var results = powershell.Invoke();
var nonSystemResults = results.Where(x => !x.Properties["Username"].Value.ToString().StartsWith("NT AUTHORITY"));
foreach (var result in results)
{
var processOwner = result.Properties["Username"].Value as string;
if (processOwner != null && !processOwner.StartsWith("NT AUTHORITY"))
{
var processName = result.Properties["Name"].Value as string;
if (illegalProcesses.Contains(processName))
{
var processID = result.Properties["ID"].Value as int?;
var doomedProcess = Process.GetProcessById(processID.Value);
doomedProcess?.Kill();
}
}
}
}
I've made the assumption that system processes are the ones owned by users that start with NT AUTHORITY but you might find for your particular use case you want different filters. That said there are tons of properties you can get on processes that should allow you to write your own filters.
I know it is possible to check the dirty bit status of a unit by running the command fsutil dirty query c: from an elevated prompt. On windows 10 it is also possible to know if C: dirty bit is set without the need of admin privileges simply going into the System and Maintenance page, if dirty bit is set there will be an advice telling it is necessary to reboot in order to repair a damage in the file sistem. How could the dirty bit status (of any unit or even only C:) be checked from a C# program?
Thanks in Advance to anyone will answer
You can get this information using a WMI query
var q = new ObjectQuery("Select * FROM Win32_Volume");
using (var searcher = new ManagementObjectSearcher(q))
using (var moc = searcher.Get())
{
foreach (ManagementObject volume in moc)
{
String label = (String)volume["Label"];
Boolean dirtyBitSet = (Boolean)(volume["DirtyBitSet"] ?? false);
Console.WriteLine($"{label} => {dirtyBitSet}");
}
}
You should add a reference to the System.Management assembly and also run your program using an elevated prompt
I developed a Winform in c#. I need to get a full path of my windows service that i installed before.
i can get some properties of the service with the following code:
ServiceController ctl = new ServiceController("MyCustomService");
the service .exe resides here:
C:\Program Files (x86)\Manufacturer\MyCustomService
but i need to get that path dinamically, from code... Is it possible?
Thanks in advance...
The Service Controller Class wont provide the full path of a windows service, You have to use either a WMI or registry
WqlObjectQuery wqlObjectQuery = new WqlObjectQuery(string.Format("SELECT * FROM Win32_Service WHERE Name = '{0}'", serviceName));
ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher(wqlObjectQuery);
ManagementObjectCollection managementObjectCollection = managementObjectSearcher.Get();
foreach (ManagementObject managementObject in managementObjectCollection)
{
return managementObject.GetPropertyValue("PathName").ToString();
}
This link provide nice example of how to use registry to find the full path of service
1. I need list of all device names and types (playback or recording). How can I get them?
2. I also need to determine if device is Playback or Recording device.
By device names I mean names visible here under Playback and Recording tab (screenshot below). Im not familiar with audio under windows, i don't know if these devices are ASIO, DirectSound or something else.
My application should be comaptybile with Windows Vista/7/8, so I decided to use .NET 3.5, but I can use any .NET version supported by Windows Vista/7/8.
Edit: I tried to get these from WMI "SELECT * FROM Win32_SoundDevice", but this is not what I mean. It returns hardware devices, not devices visible in windows sound configuration.
Use How to enumerate audio out devices in c#:
ManagementObjectSearcher objSearcher = new ManagementObjectSearcher(
"SELECT * FROM Win32_SoundDevice");
ManagementObjectCollection objCollection = objSearcher.Get();
foreach (ManagementObject obj in objCollection)
{
foreach (PropertyData property in obj.Properties)
{
Console.Out.WriteLine(String.Format("{0}:{1}", property.Name, property.Value));
}
}
How can I find which Silverlight OOB app is running?
If I get a list of processes, the SL OOB apps are running under the sllauncher.exe process. They are invoked with arguments with the ID of the SL app, but I can't see the arguments in Process.StartInfo.Arguments.
Is there a way to see what app is actually running under sllauncher.exe?
There is no point using Process.StartInfo.Arguments for processes that you did not start. It only contains meaningful data if your program have started the process using these arguments.
You can use WMI though, like so:
var processQuery = new SelectQuery("SELECT Commandline FROM Win32_Process");
var scope = new System.Management.ManagementScope(#"\\.\root\CIMV2");
var searcher = new ManagementObjectSearcher(scope, processQuery);
ManagementObjectCollection processes = searcher.Get();
foreach (var process in processes)
{
Console.WriteLine(process["Commandline"]);
}