c# - Directory enumeration is missing csrss.exe and lsass.exe (c#)

Question

I'm trying to enumerate files in C:\Windows\system32 and C:\Windows\SysWow64. But I'm missing files csrss.exe and lsass.exe and possibly more, I only checked these two files. Those files are there, I can see them in total commander and in explorer. They are just not in the enumeration result.

List<string> result = new List<string>(Directory.EnumerateFiles("C:\\Windows\\system32", "*.exe", SearchOption.TopDirectoryOnly));

I tried using DirectoryInfo instead of Directory with same result. Also tried this:

List<string> result = new List<string>(Directory.EnumerateFileSystemEntries("C:\\Windows\\system32", "*.exe", SearchOption.TopDirectoryOnly));

And this:

var dir = new DirectoryInfo("C:\\Windows\\system32");
var result = dir.EnumerateFiles("*.exe", SearchOption.TopDirectoryOnly);

Variable 'result' is not empty, but it doesn't contain mentioned files.

Framework version: v4.0.30319

Windows7: 6.1.7601 x64

Note: I know I can use workaround: dir /a-d /b C:\Windows\system32 and then parse output. But I would like to avoid this.

Answer 1

这是因为文件系统重定向器将您的请求重定向到 SysWOW64，它不包含这两个可执行文件（它们只需要操作系统，它将始终以 64 位模式运行）。

将项目构建为 64 位时，假设您的进程具有足够的权限，您应该会看到结果中包含这两个文件。

Wow64DisableWow64FsRedirection或者，您可以在调用禁用文件系统重定向之前执行 P/invoke 调用EnumerateFiles- 只需确保在完成后重新启用它。

该函数的 Pinvoke 签名如下：

[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool Wow64DisableWow64FsRedirection(ref IntPtr ptr);