Directory enumeration is missing csrss.exe and lsass.exe (c#)

Question

I'm trying to enumerate files in C:\Windows\system32 and C:\Windows\SysWow64. But I'm missing files csrss.exe and lsass.exe and possibly more, I only checked these two files. Those files are there, I can see them in total commander and in explorer. They are just not in the enumeration result.

List<string> result = new List<string>(Directory.EnumerateFiles("C:\\Windows\\system32", "*.exe", SearchOption.TopDirectoryOnly));

I tried using DirectoryInfo instead of Directory with same result. Also tried this:

List<string> result = new List<string>(Directory.EnumerateFileSystemEntries("C:\\Windows\\system32", "*.exe", SearchOption.TopDirectoryOnly));

And this:

var dir = new DirectoryInfo("C:\\Windows\\system32");
var result = dir.EnumerateFiles("*.exe", SearchOption.TopDirectoryOnly);

Variable 'result' is not empty, but it doesn't contain mentioned files.

Framework version: v4.0.30319

Windows7: 6.1.7601 x64

Note: I know I can use workaround: dir /a-d /b C:\Windows\system32 and then parse output. But I would like to avoid this.

Is your project 32-bit? If so your request for the system32 folder may be redirected to syswow64 which probably doesn't have those files. You can build for 64-bit or disable WOW64 folder redirection to see the real system32. — nobody, May 06 '15 at 11:53

score 3 · Accepted Answer · answered May 06 '15 at 11:55

This is because of the File System Redirector redirecting your request to SysWOW64, which doesn't contain those two executables (they're only ever needed by the OS, which will always run them in 64-bit mode).

When building your project as 64 bits, you should see those two files included in the results, assuming your process has sufficient permissions.

Alternatively, you can do a P/invoke call to Wow64DisableWow64FsRedirection before your EnumerateFiles call to disable file system redirection - just make sure to re-enable it when you're done.

The Pinvoke signature for this function is as follows:

[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool Wow64DisableWow64FsRedirection(ref IntPtr ptr);

Directory enumeration is missing csrss.exe and lsass.exe (c#)

1 Answers1