Win32使用Psapi库枚举系统进程信息

最新推荐文章于 2021-09-28 21:28:49 发布

Fenice

最新推荐文章于 2021-09-28 21:28:49 发布

阅读量2.8k

点赞数

分类专栏：操作系统OS MFC/C++

本文链接：https://blog.csdn.net/Kevin_Samuel/article/details/29381239

版权

MFC/C++ 同时被 2 个专栏收录

47 篇文章 0 订阅

订阅专栏

操作系统OS

1 篇文章 0 订阅

订阅专栏

原文地址：http://my.oschina.net/u/111188/blog/178643

一、枚举当前的所有进程（64位的程序暂时不会处理）

通过EnumProcesses得到当前所有的进程的进程ID，然后调用OpenProcess通过进程ID得到进程句柄，再调用EnumProcessModules来得到该进程的模块句柄，GetModuleBaseName通过进程模块句柄得到进程的名字，GetModuleFileNameEx通过进程模块句柄得到进程的可执行文件名。上面所有函数的参数信息，自行F1到MSDN查询。

DWORD aProcesses[1024], cbNeeded, cProcesses;  
if( !::EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) )
{
    return;  
}

cProcesses = cbNeeded / sizeof(DWORD); //计算得到的进程个数  
for (unsigned int i = 0; i< cProcesses; ++i) 
{
    ProcessInfo oneProcess;
    const DWORD& processID=  aProcesses[i]; //进程ID

    //通过进程ID获得进程句柄
    HANDLE hProcess = ::OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,FALSE, processID);
    if (nullptr != hProcess )  
    {  
        HMODULE hMod;  
        DWORD cbNeeded;  

  //目前该函数只能对32位进程进行处理
        if(::EnumProcessModules( hProcess, &hMod, sizeof(hMod), &cbNeeded) )
        {  
            //获得进程名
TCHAR processName[MAX_PATH];
            ::GetModuleBaseName(hProcess, hMod, oneProcess.processName, sizeof(processName)/sizeof(TCHAR) );

            //获得进程执行文件名
TCHAR moduleName[MAX_PATH];
            ::GetModuleFileNameEx(hProcess, hMod, oneProcess.moduleName, sizeof(moduleName)/sizeof(TCHAR));
        }  
        CloseHandle(hProcess);  
    }  
}

二、获取进程的内存使用信息

通过线程ID，调用OpenProcess来获得进程句柄，获得进程句柄之后调用GetProcessMemoryInfo，来取得该进程的内存使用信息

//取得进程的内存使用信息
PROCESS_MEMORY_COUNTERS processMemCounters ;
if( ::GetProcessMemoryInfo (porcessHandle, &processMemCounters, sizeof(processMemCounters) ) )
{
    processMemCounters.WorkingSetSize; //当前进程的内存使用量单位是byte，该结构体的其他成员的作用请参考MSDN
}

三、获取进程的当前的线程数

通过CreateToolhelp32Snapshot来获取系统中的所有线程快照，第二个参数指定需要包含在内的进程ID,然后通过Thread32First和Thread32Next来遍历该进程快照，通过比对进程ID来确定线程归属于哪个进程。

   //得到当前系统中所有线程的快照
   HANDLE hSnapThread = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, processID);
   if (INVALID_HANDLE_VALUE == hSnapThread)
   {
       return false;
   }

   THREADENTRY32 te32 = {sizeof(te32)};
   DWORD nCount = 0;
   if (Thread32First(hSnapThread, &te32))
   {
//遍历当前的所有线程
       do
       {
    //该线程所属的进程ID
           if( te32.th32OwnerProcessID == processID)
           {
	//如果进程ID符合，线程计数加1
               ++nCount;
           }
       } while (Thread32Next(hSnapThread, &te32));
   }
   CloseHandle(hSnapThread);

   if(nCount)
   {
//nCount就是该进程的线程数
   }
   else
   {
//如果线程数为0说明该进程已经退出
   }

四、获取进程的当前CPU使用率

通过通过进程ID，调用OpenProcess来获得进程句柄，通过进程句柄，调用GetProcessTimes来得到该进程从开始到现在所使用

FILETIME createTime;
FILETIME exitTime;
FILETIME kernelTime;
FILETIME userTime;
//获取该进程从开始到现在使用的CPU时间
BOOL bRetCode = ::GetProcessTimes(porcessHandle, &createTime, &exitTime, &kernelTime, &userTime);

if (!bRetCode)
{
    return false;
}
LARGE_INTEGER lgKernelTime;
lgKernelTime.HighPart = kernelTime.dwHighDateTime;
lgKernelTime.LowPart = kernelTime.dwLowDateTime;

LARGE_INTEGER lgUserTime;
lgUserTime.HighPart = userTime.dwHighDateTime;
lgUserTime.LowPart = userTime.dwLowDateTime;


//从进程启动到现在已经使用的CPU时间, 然后在一段时间后再取一次该值， 用差值除以经过的时间差，就是使用率
LARGE_INTEGER nowCPUTime;
nowCPUTime.QuadPart = (lgKernelTime.QuadPart + lgUserTime.QuadPart)/m_processStatus.numberOfProcessors;

五、自己封装的一个类

接口GetAllProcess来获取当前系统中所有的进程的信息，

OpenMonitorProcess来打开需要开始进行监控的进程，参数是需要进程ID

如果进程打开成功，则调用GetProcessStatus获取当前进程的状态信息，如果返回空则说明进程有可能已经退出。两次调用之间相隔最好大于1秒，这样才会使CPU使用率更好计算。

CloseMonitorProcess用来关闭监控进程，并清理相关资源

//ProcessMonitor.h
#pragma once
#include <windows.h>
#include <vector>

//目前只支持32位的程序 64位的程序会失败EnumProcessModules不支持64
class CProcessMonitor
{
public:
    struct ProcessStatus
    {
        ProcessStatus()
        {
            memset(this, 0,sizeof(ProcessStatus));
        }


        DWORD processID;
        HANDLE porcessHandle;

        TCHAR processName[MAX_PATH];
        TCHAR moduleName[MAX_PATH];
        SYSTEMTIME processCreateTime;

        SIZE_T nowUseMem;
        SIZE_T maxUseMem;
        SYSTEMTIME maxUseMemTime;

        DWORD nowThreadCount;
        DWORD maxThreadCount;
        SYSTEMTIME maxThreadCountTime;

        DWORD numberOfProcessors;
        LARGE_INTEGER lastCheckCPUTime;
        LARGE_INTEGER lastCPUTime;
        DWORD nowCPUUse;
        DWORD maxCPUUse;
        SYSTEMTIME maxCPUUseTime;
    };

    struct ProcessInfo
    {
        ProcessInfo()
            :processID(-1)//PID=0 是windows系统的一个固定进程
        {
            lstrcpyn(processName, TEXT("Unknown"), _countof(processName));
            lstrcpyn(moduleName, TEXT("Unknown"), _countof(processName));
        }
        DWORD processID;
        TCHAR processName[MAX_PATH];
        TCHAR moduleName[MAX_PATH];
    };
public:
	CProcessMonitor(void);
	~CProcessMonitor(void);

	static std::vector<ProcessInfo> GetAllProcess();

	bool OpenMonitorProcess(DWORD processID);
	void CloseMonitorProcess();

	const ProcessStatus* GetProcessStatus();

private:
	bool GetMemUse();
	bool GetThreadCount();
	bool GetCPUUse();

private:
	ProcessStatus m_processStatus;
};

//ProcessMonitro.cpp
#include "stdafx.h"
#include "ProcessMonitor.h"

#include <Psapi.h>
#pragma comment(lib,"psapi.lib")
#include <TlHelp32.h>


CProcessMonitor::CProcessMonitor(void)
{
	SYSTEM_INFO sysInfo;
	GetSystemInfo(&sysInfo);
	m_processStatus.numberOfProcessors= sysInfo.dwNumberOfProcessors;
    m_processStatus.numberOfProcessors= 1; //与任务管理器对比 好像是两倍  所以暂时不使用这个

    //进程提权  不明觉厉 好像没效果
    HANDLE hToken;
    if ( OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken) )
    {
        TOKEN_PRIVILEGES tkp;
        LookupPrivilegeValue( nullptr,SE_DEBUG_NAME,&tkp.Privileges[0].Luid );//修改进程权限
        tkp.PrivilegeCount=1;
        tkp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
        AdjustTokenPrivileges( hToken,FALSE,&tkp,sizeof tkp,nullptr,nullptr );//通知系统修改进程权限
    }
}


CProcessMonitor::~CProcessMonitor(void)
{
	CloseMonitorProcess();
}

std::vector<CProcessMonitor::ProcessInfo> CProcessMonitor::GetAllProcess()
{

    std::vector<ProcessInfo> processList;
    // Get the list of process identifiers.  
    DWORD aProcesses[1024], cbNeeded, cProcesses;  
    if( !EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) )
    {
        return processList;  
    }

    cProcesses = cbNeeded / sizeof(DWORD); //计算进程个数  
    for (unsigned int i = 0; i< cProcesses; ++i) 
    {
        ProcessInfo oneProcess;
        oneProcess.processID= aProcesses[i];

        HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,FALSE, oneProcess.processID);

        if (nullptr != hProcess )  
        {  
            HMODULE hMod;  
            DWORD cbNeeded;  
            if( EnumProcessModules( hProcess, &hMod, sizeof(hMod), &cbNeeded) )
            {  
                //取得进程名
                ::GetModuleBaseName(hProcess, hMod, oneProcess.processName, sizeof(oneProcess.processName)/sizeof(TCHAR) );

                //取得全文件名
                ::GetModuleFileNameEx(hProcess, hMod, oneProcess.moduleName, sizeof(oneProcess.moduleName)/sizeof(TCHAR));

                processList.push_back(oneProcess);
            }  
            CloseHandle( hProcess );  
        }  
    }

    return processList;
}

bool CProcessMonitor::OpenMonitorProcess(DWORD processID)
{
	if(m_processStatus.porcessHandle)
	{
		return false;
	}

	m_processStatus.processID= processID;
	m_processStatus.porcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,FALSE, processID); //获得进程句柄  

	if (m_processStatus.porcessHandle)  
	{  
		HMODULE hMod;  
		DWORD cbNeeded;  
		if(EnumProcessModules(m_processStatus.porcessHandle, &hMod, sizeof(hMod), &cbNeeded) ) //枚举进程模块信息  
		{  
			//取得进程名
			::GetModuleBaseName(m_processStatus.porcessHandle, hMod, m_processStatus.processName, sizeof(m_processStatus.processName)/sizeof(TCHAR) );

			//取得全文件名
			TCHAR szModuleName[MAX_PATH] = TEXT("<unknown>");  
			::GetModuleFileNameEx(m_processStatus.porcessHandle, hMod, m_processStatus.moduleName, sizeof(m_processStatus.moduleName)/sizeof(TCHAR) ) ;

			//获取进程创建时间  //记录当前进程的CPU使用量
			FILETIME createTime;
			FILETIME exitTime;
			FILETIME kernelTime;
			FILETIME userTime;
			auto bRetCode = GetProcessTimes(m_processStatus.porcessHandle, &createTime, &exitTime, &kernelTime, &userTime);
			if (bRetCode)
			{
				FILETIME localFileTime;
				FileTimeToLocalFileTime(&createTime, &localFileTime);
				FileTimeToSystemTime(&localFileTime, &m_processStatus.processCreateTime);

				LARGE_INTEGER lgKernelTime;
				lgKernelTime.HighPart = kernelTime.dwHighDateTime;
				lgKernelTime.LowPart = kernelTime.dwLowDateTime;

				LARGE_INTEGER lgUserTime;
				lgUserTime.HighPart = userTime.dwHighDateTime;
				lgUserTime.LowPart = userTime.dwLowDateTime;

				LARGE_INTEGER nowCPUTime;
				nowCPUTime.QuadPart = (lgKernelTime.QuadPart + lgUserTime.QuadPart)/m_processStatus.numberOfProcessors;

				//当前的时间
				LARGE_INTEGER nowCheckCPUTime;
				FILETIME now;
				GetSystemTimeAsFileTime(&now);
				nowCheckCPUTime.HighPart= now.dwHighDateTime;
				nowCheckCPUTime.LowPart= now.dwLowDateTime;


				m_processStatus.lastCheckCPUTime = nowCheckCPUTime;
				m_processStatus.lastCPUTime = nowCPUTime;

				m_processStatus.maxCPUUseTime= m_processStatus.processCreateTime;

                Sleep(1000);//GerProcess在短时间内被调用会造成错误
				return true;
			}
		}
	}

	CloseMonitorProcess();
	return false;
}

void CProcessMonitor::CloseMonitorProcess()
{
	if(m_processStatus.porcessHandle)
	{
		CloseHandle(m_processStatus.porcessHandle);  
		m_processStatus.porcessHandle= nullptr;
	}
}

bool CProcessMonitor::GetMemUse()
{
    if(!m_processStatus.porcessHandle)
    {
        return false;
    }

    //取得进程的内存使用信息
    PROCESS_MEMORY_COUNTERS processMemCounters ;
    if( !::GetProcessMemoryInfo (m_processStatus.porcessHandle, &processMemCounters, sizeof(processMemCounters) ) )
    {
        return false;
    }

    m_processStatus.nowUseMem= processMemCounters.WorkingSetSize/1024;   //现在的内存使用量 单位是K
    if(m_processStatus.nowUseMem > m_processStatus.maxUseMem)
    {
        m_processStatus.maxUseMem= m_processStatus.nowUseMem;
        GetLocalTime(&m_processStatus.maxUseMemTime);
    }
    processMemCounters.PeakWorkingSetSize;  //内存使用高峰
    return true;
}

bool CProcessMonitor::GetThreadCount()
{
    if (!(m_processStatus.porcessHandle && m_processStatus.processID))
    {
        return false;
    }

    HANDLE hSnapThread = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, m_processStatus.processID);
    if (INVALID_HANDLE_VALUE == hSnapThread)
    {
        return false;
    }

    THREADENTRY32 te32 = {sizeof(te32)};
    DWORD nCount = 0;
    if (Thread32First(hSnapThread, &te32))
    {
        do
        {
            if( te32.th32OwnerProcessID == m_processStatus.processID)
            {
                ++nCount;
            }
        } while (Thread32Next(hSnapThread, &te32));
    }
    CloseHandle(hSnapThread);

    if(!nCount)
    {
        return false;
    }

    m_processStatus.nowThreadCount = nCount;
    if(m_processStatus.nowThreadCount > m_processStatus.maxThreadCount)
    {
        m_processStatus.maxThreadCount= m_processStatus.nowThreadCount;
        GetLocalTime(&m_processStatus.maxThreadCountTime);
    }
    return true;
}

bool CProcessMonitor::GetCPUUse()
{
    if(!(m_processStatus.porcessHandle && m_processStatus.numberOfProcessors))
    {
        return false;
    }
    FILETIME createTime;
    FILETIME exitTime;
    FILETIME kernelTime;
    FILETIME userTime;
    auto bRetCode = GetProcessTimes(m_processStatus.porcessHandle, &createTime, &exitTime, &kernelTime, &userTime);

    if (!bRetCode)
    {
        return false;
    }
    LARGE_INTEGER lgKernelTime;
    lgKernelTime.HighPart = kernelTime.dwHighDateTime;
    lgKernelTime.LowPart = kernelTime.dwLowDateTime;

    LARGE_INTEGER lgUserTime;
    lgUserTime.HighPart = userTime.dwHighDateTime;
    lgUserTime.LowPart = userTime.dwLowDateTime;


    //从进程启动到现在已经使用的CPU时间, 然后在一段时间后再取一次该值， 用差值除以经过的时间差，就是使用率
    LARGE_INTEGER nowCPUTime;
    nowCPUTime.QuadPart = (lgKernelTime.QuadPart + lgUserTime.QuadPart)/m_processStatus.numberOfProcessors;

    //当前的时间
    LARGE_INTEGER nowCheckCPUTime;
    FILETIME now;
    GetSystemTimeAsFileTime(&now);
    nowCheckCPUTime.HighPart= now.dwHighDateTime;
    nowCheckCPUTime.LowPart= now.dwLowDateTime;

    m_processStatus.nowCPUUse= 100*(nowCPUTime.QuadPart - m_processStatus.lastCPUTime.QuadPart)/(nowCheckCPUTime.QuadPart - m_processStatus.lastCheckCPUTime.QuadPart);

    m_processStatus.lastCheckCPUTime = nowCheckCPUTime;
    m_processStatus.lastCPUTime = nowCPUTime;
    if(m_processStatus.nowCPUUse > m_processStatus.maxCPUUse)
    {
        m_processStatus.maxCPUUse= m_processStatus.nowCPUUse;
        GetLocalTime(&m_processStatus.maxCPUUseTime);
    }

}

const CProcessMonitor::ProcessStatus* CProcessMonitor::GetProcessStatus()
{
	if( GetMemUse()
	    && GetCPUUse()
	    && GetThreadCount()
    )
    {
        return &m_processStatus;
    }
    else
    {
        return nullptr;
    }
}

Fenice

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
Win32使用Psapi库枚举系统进程信息

一、枚举当前的所有进程（64位的程序暂时不会处理）通过EnumProcesses得到当前所有的进程的进程ID，然后调用OpenProcess通过进程ID得到进程句柄，再调用EnumProcessModules来得到该进程的模块句柄，GetModuleBaseName通过进程模块句柄得到进程的名字，GetModuleFileNameEx通过进程模块句柄得到进程的可执行文件名。上面所有
复制链接

扫一扫