Function isProcessZombie

backend/xray/process_windows.go:187–233

isProcessZombie checks if a process is a zombie on Windows On Windows, we check if the process exists but parent doesn't exist or is invalid

(pid int)

// isProcessZombie checks if a process is a zombie on Windows
// On Windows, we check if the process exists but parent doesn't exist or is invalid
func isProcessZombie(pid int) bool {
	// Get process info to check parent
	cmd := exec.Command("wmic", "process", "where", fmt.Sprintf("ProcessId=%d", pid), "get", "ParentProcessId", "/format:list")
	output, err := cmd.Output()
	if err != nil {
		return false
	}

	lines := strings.Split(string(output), "\n")
	var ppidStr string
	for _, line := range lines {
		line = strings.TrimSpace(line)
		if strings.HasPrefix(line, "ParentProcessId=") {
			ppidStr = strings.TrimPrefix(line, "ParentProcessId=")
			ppidStr = strings.TrimSpace(ppidStr)
			break
		}
	}

	if ppidStr == "" {
		return false
	}

	ppid, err := strconv.Atoi(ppidStr)
	if err != nil {
		return false
	}

	// Check if parent process exists
	// If parent doesn't exist but this process does, it might be orphaned
	// However, on Windows, orphaned processes are typically adopted by init (PID 0 or 4)
	// So we check if parent is system process and this process still exists
	if ppid <= 4 {
		// Parent is system process, check if this process is still running
		// but might be in a bad state
		return isProcessRunning(pid)
	}

	// Check if parent process exists
	parentExists := isProcessRunning(ppid)
	if !parentExists && isProcessRunning(pid) {
		// Process exists but parent doesn't - likely orphaned/zombie
		return true
	}

	return false
}