Getting the package full name of a Windows Store app, given the process ID

Last time I talked about enumerating audio sessions and showed an example which listed several Desktop apps and one Windows Store app.

Session instance identifier: {0.0.0.00000000}.{125eeed2-3cd2-48cf-aac9-8ae0157564ad}|DeviceHarddiskVolume1WindowsSystem32WWAHost.exe%b{00000000-0000-0000-0000-000000000000}|1%b11812

It’s possible to guess that this is a Windows Store app by the presence of the WWAHost.exe string in the session instance identifier. Don’t rely on this, though; the session identifiers are opaque strings, and their formula can change at any time.

We were able to get some additional information on the Desktop apps by enumerating their top-level windows and reading the window text. But how do we get more information on the Windows Store app? And how do we even know it’s a Windows Store app without cracking the session identifier?

By using the Application Model APIs – for example, GetPackageFullName.

Pseudocode:

… get a process ID…

OpenProcess(PROCESS_QUERY_LIMITED_USER_INFORMATION, FALSE, pid);

GetPackageFullName(…)

if APPMODEL_ERROR_NO_PACKAGE then the process has no associated package and is therefore not a Windows Store app.

Updated sample output:

— Active session #4 —
Icon path:
Display name:
Grouping parameter: {8dbd87b0-9fce-4c27-b7ff-4b20b0dae1a3}
Process ID: 11644 (single-process)
Session identifier: {0.0.0.00000000}.{125eeed2-3cd2-48cf-aac9-8ae0157564ad}|DeviceHarddiskVolume1WindowsSystem32WWAHost.exe%b{00000000-0000-0000-0000-000000000000}
Session instance identifier: {0.0.0.00000000}.{125eeed2-3cd2-48cf-aac9-8ae0157564ad}|DeviceHarddiskVolume1WindowsSystem32WWAHost.exe%b{00000000-0000-0000-0000-000000000000}|1%b11644
System sounds session: no
Peak value: 0.395276
Package full name: Microsoft.ZuneMusic_2.0.132.0_x64__8wekyb3d8bbwe

Browse source

Download meters.exe

One thought on “Getting the package full name of a Windows Store app, given the process ID

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s