Running this code as an administrator, you can use the following snippet as a method for determining the nature of a process on Windows 8 and whether it would seem that the running process is running in the new Modern UI shell (metro).
static void Main(string[] args) { var allProcesses = Process.GetProcesses().Where(p => { try { var pid = p.Id; var modules = p.Modules.Cast<ProcessModule>() .Where(m => m.FileName.Contains("System.Runtime.WindowsRuntime")); return modules.Count() > 0; } catch { return false; } }).OrderBy(p => p.MainModule.FileName).ToList(); for (int i = 0; i < allProcesses.Count(); i++) { var p = allProcesses[i]; Console.WriteLine(string.Format("{0}. {1}", i, p.MainModule.FileName)); } Console.ReadKey(); }
Modern UI / Metro applications are protected and cannot be easily interrogated by a non-administrative process. While you can get some basics about all processes, a standard user process isn’t allowed to look at the loaded modules for example.
In the code above, all processes are scanned for a particular DLL. In this case, System.Runtime.WindowsRuntime. I’m not 100% confident this is the best choice … there may be a few better options (or multiple that are required). (If you know of them, please leave a comment!). It did find the Modern UI / Metro applications running in my Windows 8 VM.
Once gathered, the code just outputs the basics to the console. (The name of the host, which is WWAHost.exe apparently some times).
Next step is to learn something useful via the process object.