{"id":340,"date":"2026-10-06T09:00:16","date_gmt":"2026-10-06T16:00:16","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/insidemsix\/?p=340"},"modified":"2026-09-27T22:45:08","modified_gmt":"2026-09-28T05:45:08","slug":"find-package-identity-with-apis","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/insidemsix\/find-package-identity-with-apis\/","title":{"rendered":"Is it MSIX? Part 2: Finding Package Identity with APIs"},"content":{"rendered":"<p>We <a href=\"https:\/\/devblogs.microsoft.com\/insidemsix\/how-to-tell-if-a-process-is-packaged\/\">previously<\/a> determined how to tell if a process is packaged or unpackaged using <strong>Task Manager<\/strong>. Now let&#8217;s find its package and application identity in code.<\/p>\n<p>Windows provides APIs to retrieve package and application identity for a process:<\/p>\n<table>\n<thead>\n<tr>\n<th>Identity<\/th>\n<th>Current Process<\/th>\n<th>By Process <code>HANDLE<\/code><\/th>\n<th>By Token<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><a href=\"https:\/\/learn.microsoft.com\/windows\/win32\/api\/appmodel\/ns-appmodel-package_id\">PACKAGE_ID<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/windows\/win32\/api\/appmodel\/nf-appmodel-getcurrentpackageid\">GetCurrentPackageId()<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/windows\/win32\/api\/appmodel\/nf-appmodel-getpackageid\">GetPackageId()<\/a><\/td>\n<td>N\/A<\/td>\n<\/tr>\n<tr>\n<td>PackageFullName<\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/windows\/win32\/api\/appmodel\/nf-appmodel-getcurrentpackagefullname\">GetCurrentPackageFullName()<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/windows\/win32\/api\/appmodel\/nf-appmodel-getpackagefullname\">GetPackageFullName()<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/windows\/win32\/api\/appmodel\/nf-appmodel-getpackagefullnamefromtoken\">GetPackageFullNameFromToken()<\/a><\/td>\n<\/tr>\n<tr>\n<td>PackageFamilyName<\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/windows\/win32\/api\/appmodel\/nf-appmodel-getcurrentpackagefamilyname\">GetCurrentPackageFamilyName()<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/windows\/win32\/api\/appmodel\/nf-appmodel-getpackagefamilyname\">GetPackageFamilyName()<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/windows\/win32\/api\/appmodel\/nf-appmodel-getpackagefamilynamefromtoken\">GetPackageFamilyNameFromToken()<\/a><\/td>\n<\/tr>\n<tr>\n<td>ApplicationUserModelId<\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/windows\/win32\/api\/appmodel\/nf-appmodel-getcurrentapplicationusermodelid\">GetCurrentApplicationUserModelId()<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/windows\/win32\/api\/appmodel\/nf-appmodel-getapplicationusermodelid\">GetApplicationUserModelId()<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/windows\/win32\/api\/appmodel\/nf-appmodel-getapplicationusermodelidfromtoken\">GetApplicationUserModelIdFromToken()<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>If you prefer WinRT:<\/p>\n<table>\n<thead>\n<tr>\n<th>Class<\/th>\n<th>Current Process<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><a href=\"https:\/\/learn.microsoft.com\/uwp\/api\/windows.applicationmodel.packageid\">PackageId<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/uwp\/api\/windows.applicationmodel.package.current\">Windows.ApplicationModel.Package.Current<\/a>.Id<\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/learn.microsoft.com\/uwp\/api\/windows.applicationmodel.appinfo\">AppInfo<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/uwp\/api\/windows.applicationmodel.appinfo.current\">Windows.ApplicationModel.AppInfo.Current<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Kernel mode<\/h2>\n<p>What about kernel mode? Nearly all MSIX APIs require a user-mode caller. The <a href=\"https:\/\/learn.microsoft.com\/windows-hardware\/drivers\/download-the-wdk\">Windows Driver Kit (WDK)<\/a> provides <a href=\"https:\/\/learn.microsoft.com\/windows-hardware\/drivers\/ddi\/ntifs\/nf-ntifs-rtlquerypackageidentity\">RtlQueryPackageIdentity()<\/a> and <a href=\"https:\/\/learn.microsoft.com\/windows-hardware\/drivers\/ddi\/ntifs\/nf-ntifs-rtlquerypackageidentityex\">RtlQueryPackageIdentityEx()<\/a> for querying package identity from a token.<\/p>\n<h2>Tools?<\/h2>\n<p>What about tools to do the same? Onward to Part 3&#8230;<\/p>\n<hr \/>\n<p><sup>1<\/sup> <code>RtlQueryPackageIdentity[Ex]()<\/code> returns <code>PackageFullName<\/code> but provides only the Package-Relative Application ID (PRAID) portion of application identity. Additional work is required to compose an <code>ApplicationUserModelId<\/code>. This is advanced territory best left to a future blog post.\ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"<p>We previously determined how to tell if a process is packaged or unpackaged using Task Manager. Now let&#8217;s find its package and application identity in code. Windows provides APIs to retrieve package and application identity for a process: Identity Current Process By Process HANDLE By Token PACKAGE_ID GetCurrentPackageId() GetPackageId() N\/A PackageFullName GetCurrentPackageFullName() GetPackageFullName() GetPackageFullNameFromToken() PackageFamilyName [&hellip;]<\/p>\n","protected":false},"author":911,"featured_media":101,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[17,9,11,2,34],"class_list":["post-340","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-msix","tag-application","tag-code","tag-identity","tag-msix","tag-runtime"],"acf":[],"blog_post_summary":"<p>We previously determined how to tell if a process is packaged or unpackaged using Task Manager. Now let&#8217;s find its package and application identity in code. Windows provides APIs to retrieve package and application identity for a process: Identity Current Process By Process HANDLE By Token PACKAGE_ID GetCurrentPackageId() GetPackageId() N\/A PackageFullName GetCurrentPackageFullName() GetPackageFullName() GetPackageFullNameFromToken() PackageFamilyName [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/posts\/340","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/users\/911"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/comments?post=340"}],"version-history":[{"count":2,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/posts\/340\/revisions"}],"predecessor-version":[{"id":356,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/posts\/340\/revisions\/356"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/media\/101"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/media?parent=340"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/categories?post=340"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/insidemsix\/wp-json\/wp\/v2\/tags?post=340"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}