I'm trying to understand the terminology Microsoft is using. When IsImmersiveProcess returns TRUE does it also mean that the process is a UWP app as reported by the TokenIsAppContainer query on its token?
Here's a small code snippet to illustrate what I mean:
HANDLE hProc = ::OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid);
if (hProc)
{
HANDLE hToken;
if (::OpenProcessToken(hProc, TOKEN_QUERY, &hToken))
{
DWORD dwAppContainer = 0;
DWORD dwDummy = 0;
if (::GetTokenInformation(hToken, TokenIsAppContainer, &dwAppContainer, sizeof(dwAppContainer), &dwDummy))
{
wprintf(L"isUWP=%d\n", dwAppContainer);
}
::CloseHandle(hToken);
}
wprintf(L"isImmersive=%d\n", ::IsImmersiveProcess(hProc));
::CloseHandle(hProc);
}
In other words, can a process be UWP and not Immersive, and vice versa?
EDIT: Looking inside IsImmersiveProcess API shows the following quite simple logic. Unfortunately NtUserGetProcessUIContextInformation and PROCESS_UICONTEXT_INFORMATION seem to be undocumented. I can only guess that the value 0 stands for "regular" Win32 process and 1 and 2 for immersive app. Not sure what would differ 1 from 2 though?
EDIT2: According to eryksun's find below in comments the NtUserGetProcessUIContextInformation function may've been declared as such:
enum PROCESS_UICONTEXT{
PROCESS_UICONTEXT_DESKTOP = 0,
PROCESS_UICONTEXT_IMMERSIVE,
PROCESS_UICONTEXT_IMMERSIVE_BROKER,
PROCESS_UICONTEXT_IMMERSIVE_BROWSER
};
enum PROCESS_UI_FLAGS{
PROCESS_UIF_NONE = 0,
PROCESS_UIF_AUTHORING_MODE,
PROCESS_UIF_RESTRICTIONS_DISABLED
};
struct PROCESS_UICONTEXT_INFORMATION{
PROCESS_UICONTEXT Context;
PROCESS_UI_FLAGS flags;
};
BOOL WINAPI NtUserGetProcessUIContextInformation(HANDLE hProc, PROCESS_UICONTEXT_INFORMATION* pProcInfo);
