nt上获取父进程

用ToolHelp APi 取进程列表，获取父进程的代码， NT下无效

 

1. uses TLHelp32  
2.   
3.   
4.   tagPROCESSENTRY32 = packed record  
5.     dwSize: DWORD;  
6.     cntUsage: DWORD;  
7.     th32ProcessID: DWORD;       // this process  
8.     th32DefaultHeapID: DWORD;  
9.     th32ModuleID: DWORD;        // associated exe  
10.     cntThreads: DWORD;  
11.     th32ParentProcessID: DWORD; // this process's parent process  
12.     pcPriClassBase: Longint;    // Base priority of process's threads  
13.     dwFlags: DWORD;  
14.     szExeFile: array[0..MAX_PATH - 1] of Char;// Path  
15.   end;  
16.   
17. var  
18.   Pn: TProcesseNtry32;  
19.   sHandle: THandle;  
20.   ..  
21. begin  
22.   ...  
23.   sHandle := CreateToolHelp32SnapShot(TH32CS_SNAPALL, 0);  
24.   Found := Process32First(sHandle, Pn);  
25.   while Found do  
26.   begin  
27.     PnName:= UpperCase(ExtractFileName(Pn.szExeFile));  
28.     if PnName = UpperCase(ExtractFileName(ParamStr(0))) then  
29.     begin  
30.       ParentProc := Pn.th32ParentProcessID;  
31.     ...  
32.     Found:= Process32Next(sHandl, Pn);  
33.   end;  

所以用nt.dll 中 NtQueryInformationProcess 又写了一个

 

1. {*******************************************************}  
2. {                                                       }  
3. {  Parent_P.dpr                                         }  
4. {    show How can retrive parent process ID on WinNT    }  
5. {                                                       }  
6. {  (c) by explorer 20070905                             }  
7. {                                                       }  
8. {  http://explorer.iteye.com                          }  
9. {                                                       }  
10. {*******************************************************}  
11.   
12.   
13. program parent_P;  
14.   
15. {$APPTYPE CONSOLE}  
16.   
17. uses  
18.   SysUtils,  
19.   Windows;  
20.   
21. type  
22.   PROCESS_BASIC_INFORMATION = packed Record  
23.     ExitStatus: DWORD;  
24.     PebBaseAddress: DWORD;  
25.     AffinityMask: DWORD;  
26.     BasePriority: DWORD;  
27.     UniqueProcessId: ULONG;  
28.     InheritedFromUniqueProcessId: ULONG;  
29.   end;  
30.   
31. type  
32.   TNtQueryInformationProcess = function (ProcessHandle: THANDLE; InformationClass: UINT;  
33.     ProcessInformation: Pointer; ProcessInformationLength: uLong; ReturnLength: PULONG): DWORD stdcall;  
34.       
35. Const  
36.   ProcessBasicInformation = 0;  
37.   
38. // ntdll!NtQueryInformationProcess (NT specific!)  
39. //  
40. // The function copies the process information of the  
41. // specified type into a buffer  
42. //  
43. // NTSYSAPI  
44. // NTSTATUS  
45. // NTAPI  
46. // NtQueryInformationProcess(  
47. //    IN HANDLE ProcessHandle,              // handle to process  
48. //    IN PROCESSINFOCLASS InformationClass, // information type  
49. //    OUT PVOID ProcessInformation,         // pointer to buffer  
50. //    IN ULONG ProcessInformationLength,    // buffer size in bytes  
51. //    OUT PULONG ReturnLength OPTIONAL      // pointer to a 32-bit  
52. //                                          // variable that receives  
53. //                                          // the number of bytes  
54. //                                          // written to the buffer   
55. // );    
56.   
57. function GetParentProcessID(dwId: DWORD):DWORD;  
58. var  
59.   NtQueryInformationProcess: TNtQueryInformationProcess;  
60.   hProcess: THandle;  
61.   status: DWORD;  
62.   pbi: PROCESS_BASIC_INFORMATION;  
63. begin  
64.   Result:= High(DWORD);  
65.     
66.   @NtQueryInformationProcess:= GetProcAddress(GetModuleHandle('ntdll'),  
67.                                               Pchar('NtQueryInformationProcess'));  
68.   
69.   if Assigned(NtQueryInformationProcess) then begin  
70.   
71.     hProcess := OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwId);  
72.     if Not LongBool(hProcess) then Exit;  
73.   
74.     status:= NtQueryInformationProcess(hProcess,  
75.                                        ProcessBasicInformation,  
76.                                        Pointer(@pbi),  
77.                                        Sizeof(PROCESS_BASIC_INFORMATION),  
78.                                        nil);  
79.   
80.     if Not LongBool(status) then  
81.       Result:= pbi.InheritedFromUniqueProcessId;  
82.   
83.     CloseHandle(hProcess);    
84.   end;  
85. end;  
86.   
87. var  
88.   dwID: DWORD;  
89.   
90. begin  
91.   { TODO -oUser -cConsole Main : Insert code here }  
92.   if ParamCount < 1 then begin  
93.     Writeln('Usgae parent_P ProcId '#13#10);  
94.     Exit;  
95.   end;  
96.                                               
97.   dwID:= StrToIntDef( ParamStr(1) , 0);  
98.   
99.   Writeln(Format('Parent PID for %d is %d', [dwId, GetParentProcessID(dwId)]) );  
100. end.