使用WMI查找暂停的windows个进程，为什么“ExecutionState”总是null？

Question

I'm running the following code in a console program:-

 var query = string.Format("select * from Win32_Process");
            var searcher = new ManagementObjectSearcher(query);
            var collection = searcher.Get();
            foreach (ManagementObject o in collection)
            {         
                if(o["CommandLine"] == null) continue;
                if (o["ProcessId"] == null) continue;
                if( o["ExecutionState"] == null)continue;                
                var executionState =o["ExecutionState"].ToString();
                var commandLine = o["CommandLine"].ToString();
                var processId = o["ProcessId"];
                Console.WriteLine("{0}: {1} [{2}]", 
                   processId,
                   executionState,
                   commandLine);                
            }

However the Execution state is always null. Anyone know why? I've tried running as Administrator.

using process explorer, I definitely have a process in a suspended state:-

Answer 1

Looks like ExecutionState isn't implemented and is always null . The official docs don't mention it, but third-party docs do.

Answer 2

You can use 'ThreadCount' to test if it is 0. Zombie processes have 0 because any normal process has at least 1.

Another possibility is to use 'OpenProcess' and ask 'GetExitCodeProcess'. If the process is running it will return 'STILL_ACTIVE' while Zombies will return their exit code. But this is a little bit slower than the first method. A bit unclear what happens if a process sets his exit code to 'STILL_ACTIVE'. I guess Win32 won't allow that.