取进程的用户(所有进程)

    typedef  struct  _UNICODE_STRING {
        USHORT Length;        
        USHORT MaximumLength; 
        PWSTR  Buffer;
    } UNICODE_STRING,  * PUNICODE_STRING;

     // SystemProcessInformation
    typedef  struct  _SYSTEM_PROCESS_INFORMATION
    {
        DWORD            dwNextEntryOffset;
        DWORD            dwNumberOfThreads;
        LARGE_INTEGER    qSpareLi1;
        LARGE_INTEGER    qSpareLi2;
        LARGE_INTEGER    qSpareLi3;
        LARGE_INTEGER    qCreateTime;
        LARGE_INTEGER    qUserTime;
        LARGE_INTEGER    qKernelTime;
        UNICODE_STRING    ImageName;
         int                 nBasePriority;
        DWORD            dwProcessId;
        DWORD            dwInheritedFromUniqueProcessId;
        DWORD            dwHandleCount;
        DWORD            dwSessionId;
        ULONG            dwSpareUl3;
        SIZE_T            tPeakVirtualSize;
        SIZE_T            tVirtualSize;
        DWORD            dwPageFaultCount;
        DWORD            dwPeakWorkingSetSize;
        DWORD            dwWorkingSetSize;
        SIZE_T            tQuotaPeakPagedPoolUsage;
        SIZE_T            tQuotaPagedPoolUsage;
        SIZE_T            tQuotaPeakNonPagedPoolUsage;
        SIZE_T            tQuotaNonPagedPoolUsage;
        SIZE_T            tPagefileUsage;
        SIZE_T            tPeakPagefileUsage;
        SIZE_T            tPrivatePageCount;
        LARGE_INTEGER    qReadOperationCount;
        LARGE_INTEGER    qWriteOperationCount;
        LARGE_INTEGER    qOtherOperationCount;
        LARGE_INTEGER    qReadTransferCount;
        LARGE_INTEGER    qWriteTransferCount;
        LARGE_INTEGER    qOtherTransferCount;
    }SYSTEM_PROCESS_INFORMATION;

     #define  SystemProcessInformation        5
     #define  SystemTimeOfDayInformation        3
     #define  SystemHandleInformation            16

     #define  STATUS_INFO_LENGTH_MISMATCH        ((LONG)0xC0000004L)

VOID  * GetDllProc(CHAR  *  pDllName, CHAR  * pProcName)
{
    HMODULE        hMod;
    hMod  =  LoadLibraryA(pDllName);
     if (hMod  ==  NULL)
         return  NULL;

     return  GetProcAddress(hMod, pProcName);
}

typedef LONG (WINAPI  * Fun_NtQuerySystemInformation) (
     int  SystemInformationClass,
    OUT PVOID SystemInformation,
    IN ULONG SystemInformationLength,
    OUT ULONG  *  pReturnLength OPTIONAL);

BOOL NSystem::GetSysProcInfo(SYSTEM_PROCESS_INFORMATION  **  ppSysProcInfo)
{
    Fun_NtQuerySystemInformation    _NtQuerySystemInformation;
    _NtQuerySystemInformation  =  (Fun_NtQuerySystemInformation)::GetDllProc( " NTDLL.DLL " ,  " NtQuerySystemInformation " );
     if (_NtQuerySystemInformation  ==  NULL)
         return  FALSE;

    DWORD        dwSize  =   1024 * 1024 ;
    VOID         *  pBuf  =  NULL;
    LONG        lRetVal;

     for (;;)
    {
         if (pBuf)
            free(pBuf);
        pBuf  =  (VOID  * )malloc(dwSize);
        lRetVal  =  _NtQuerySystemInformation(SystemProcessInformation, 
            pBuf, dwSize, NULL);
         if (STATUS_INFO_LENGTH_MISMATCH  !=  lRetVal)
             break ;
        dwSize  *=   2 ;
    }

     if (lRetVal  ==   0 )
    {
         * ppSysProcInfo  =  (SYSTEM_PROCESS_INFORMATION  * )pBuf;
         return  TRUE;
    }
    free(pBuf);
     return  FALSE;
}


typedef BYTE (WINAPI  * Fun_WinStationGetProcessSid)(HANDLE hServer,DWORD ProcessId , FILETIME ProcessStartTime,PBYTE pProcessUserSid ,PDWORD dwSidSize);
typedef VOID (WINAPI  * Fun_CachedGetUserFromSid)( PSID pSid , PWCHAR pUserName,PULONG cbUserName);


BOOL NSystem::GetProcessUser(DWORD dwPid, _bstr_t  * pbStrUser)
{
    Fun_WinStationGetProcessSid        _WinStationGetProcessSid;
    Fun_CachedGetUserFromSid        _CachedGetUserFromSid;

    _WinStationGetProcessSid  =  (Fun_WinStationGetProcessSid)
        GetDllProc( " Winsta.dll " ,  " WinStationGetProcessSid " );
    _CachedGetUserFromSid  =  (Fun_CachedGetUserFromSid)
        GetDllProc( " utildll.dll " ,  " CachedGetUserFromSid " );

     if (_WinStationGetProcessSid  ==  NULL  ||  _CachedGetUserFromSid  ==  NULL)
         return  FALSE;

    BYTE        cRetVal;
    FILETIME    ftStartTime;
    DWORD        dwSize;
    BYTE         *  pSid;
    BOOL        bRetVal, bFind;
    SYSTEM_PROCESS_INFORMATION     *     pProcInfo,  *  pCurProcInfo;

    bRetVal  =  GetSysProcInfo( & pProcInfo);
     if (bRetVal  ==  FALSE  ||  pProcInfo  ==  NULL)
         return  FALSE;

    bFind  =  FALSE;
    pCurProcInfo  =  pProcInfo;
     for (;;)
    {
         if (pCurProcInfo -> dwProcessId  ==  dwPid)
        {
            memcpy( & ftStartTime,  & pCurProcInfo -> qCreateTime,  sizeof (ftStartTime));
            bFind  =  TRUE;
             break ;
        }

         if (pCurProcInfo -> dwNextEntryOffset  ==   0 )
             break ;
        pCurProcInfo  =  (SYSTEM_PROCESS_INFORMATION  * )((BYTE  * )pCurProcInfo  +  
            pCurProcInfo -> dwNextEntryOffset);
    }
     if (bFind  ==  FALSE)
    {
        free(pProcInfo);
         return  FALSE;
    }

    cRetVal  =  _WinStationGetProcessSid(NULL, dwPid, ftStartTime, NULL,  & dwSize);
     if (cRetVal  !=   0 )
         return  FALSE;

    pSid  =   new  BYTE[dwSize];
    cRetVal  =  _WinStationGetProcessSid(NULL, dwPid, ftStartTime, pSid,  & dwSize);
     if (cRetVal  ==   0 )
    {
        delete [] pSid;
         return  FALSE;
    }

    WCHAR            szUserName[ 1024 ];
    dwSize  =   1024 ;
    _CachedGetUserFromSid(pSid, szUserName,  & dwSize);
    delete [] pSid;
     if (dwSize  ==   0 )
         return  FALSE;

     * pbStrUser  =  szUserName;
     return  TRUE;
}