Windows 10 Camera frame server, identify actual app using webcam

Question

On windows 10, apps that need access to webcam, communicate with frame server which is a service that runs under svchost.

I filter out the webcam stream and the process id i get is of svchost. I want to identify the actual process that is using the webcam.

Is there a definite way to identify programmatically what is the actual app that is using the webcam? I have looked into enumerating handles of processes(have to deal with NtQueryObject() hang as well), but i am looking for a better definite solution.

Answer 1

I doubt you can identify the applications capturing video using frame server (well, actually the same applies to those applications not using frame server in current or older versions of Windows).

Microsoft added frame server to insert a proxy between video capture applications and actual drivers implementing such capture. Even though the declared intention is to share video camera device between applications, I don't think it is operational and frame server is at all remains almost undocumented. My personal understanding is that Microsoft needed to hook in in the convenient way to enable access to video cameras for their Windows Hello technology and so they tee'd the media pipeline. No further steps were done to offer any new options to user applications.

Minimalistic desktop video capture applications trying to share a webcam still receive a failure suggesting that sharing is impossible for general purpose applications (I guess Microsoft's like Hello are likely to have an undocumented backdoor in frame server for camera sharing purposes, or alternatively sharing is enabled for specific class of clients such as using Capture Engine API or alike):

That is, there is no API to enumerate frame server clients, and overall application are not even aware of whether they are talking to real driver or frame server proxy.

I think that attempts to obtain related information indirectly, such as by checking which applications use video related modules, is not reliable and even more confusing in case of multiple video capture devices, including virtual ones.