[Win32]获取指定进程的父进程PID

//
//

#include <Windows.h>
#include <winnt.h>
#include <winternl.h>

typedef NTSTATUS (__stdcall * NTQUERYINFORMATIONPROCESS)
(
	HANDLE ProcessHandle,
	PROCESSINFOCLASS ProcessInformationClass,
	PVOID ProcessInformation,
	ULONG ProcessInformationLength,
	PULONG ReturnLength
);

int _tmain(int argc, _TCHAR* argv[])
{
	int errCode = 0;

	HMODULE hMod = GetModuleHandle(L"NTDLL.DLL");
	if (hMod == NULL)
	{
		return 0;
	}

	NTQUERYINFORMATIONPROCESS ptrNtQueryInformationProcess = (NTQUERYINFORMATIONPROCESS)GetProcAddress(hMod, NtQueryInformationProcess");
	if (ptrNtQueryInformationProcess == NULL)
	{
		return 0;
	}

	PROCESS_BASIC_INFORMATION processBasicInformation;
	ULONG retLength = 0;
	NTSTATUS status = ptrNtQueryInformationProcess(GetCurrentProcess(), ProcessBasicInformation, processBasicInformation, sizeof(processBasicInformation), retLength);

	return errCode;
}

//

在 PROCESS_BASIC_INFORMATION 结构体中，Reserved3字段保存的是父进程ID，强制转换成DWORD即可。