获取进程信息的两种方式

第一种（CreateToolhelp32Snapshot）：
#include "StdAfx.h" 　　
#include "windows.h" 　　
#include "tlhelp32.h" 　　
#include "stdio.h" 　　
int GetProcInfo（）
{ 　　
PROCESSENTRY32 pe32; 　　
pe32.dwSize = sizeof(pe32); 　　
　　
HANDLE hProcessSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); 　　
if (hProcessSnap == INVALID_HANDLE_VALUE) 　　
{ 　　return -1; 　　} 　　
//遍历进程快照，轮流显示每个进程的信息 　　
BOOL bMore = ::Process32First(hProcessSnap,&pe32); 　　
while (bMore) 　　
{ 　　printf("进程名称：%s\n",pe32.szExeFile); 　　
printf("进程ID：%u\n\n",pe32.th32ProcessID); 　　
bMore = ::Process32Next(hProcessSnap,&pe32); 　　
} 　　
//不要忘记清除掉snapshot对象 　　
::CloseHandle(hProcessSnap); 　　
return 0; 　　}

第二种（EnumProcesses）：
#include <windows.h>
#include <stdio.h>
#include "psapi.h"

#pragma comment(lib, "psapi.lib")

void PrintMemoryInfo( DWORD processID )；

void GetInfo( )
{
 DWORD aProcesses[1024], cbNeeded, cProcesses;
 unsigned int i;

 if ( !EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) )
  return;

 // Calculate how many process identifiers were returned
 cProcesses = cbNeeded / sizeof(DWORD);

 for ( i = 0; i < cProcesses; i++ )
  PrintMemoryInfo( aProcesses[i] );
}

 

void PrintMemoryInfo( DWORD processID )
{
 HANDLE hProcess;
 PROCESS_MEMORY_COUNTERS pmc;

 // Print the process identifier.
 printf( "\nProcess ID: %u\n", processID );

 // Print information about the memory usage of the process.
 hProcess = OpenProcess(  PROCESS_QUERY_INFORMATION |
  PROCESS_VM_READ,
  FALSE, processID );
 if (NULL == hProcess)
  return;

 if ( GetProcessMemoryInfo( hProcess, &pmc, sizeof(pmc)) )
 {
  printf( "\tPageFaultCount: %d\n", pmc.PageFaultCount );
  printf( "\tPageFaultCount: 0x%08X\n", pmc.PageFaultCount );
  printf( "\tPeakWorkingSetSize: 0x%08X\n",
   pmc.PeakWorkingSetSize );
  printf( "\tWorkingSetSize: 0x%08X\n", pmc.WorkingSetSize );
  printf( "\tQuotaPeakPagedPoolUsage: 0x%08X\n",
   pmc.QuotaPeakPagedPoolUsage );
  printf( "\tQuotaPagedPoolUsage: 0x%08X\n",
   pmc.QuotaPagedPoolUsage );
  printf( "\tQuotaPeakNonPagedPoolUsage: 0x%08X\n",
   pmc.QuotaPeakNonPagedPoolUsage );
  printf( "\tQuotaNonPagedPoolUsage: 0x%08X\n",
   pmc.QuotaNonPagedPoolUsage );
  printf( "\tPagefileUsage: 0x%08X\n", pmc.PagefileUsage );
  printf( "\tPeakPagefileUsage: 0x%08X\n",
   pmc.PeakPagefileUsage );
 }

 CloseHandle( hProcess );
}

 

命令行信息：

 void Get（）

｛

TCHAR szPath[512];  

HANDLE hProcess;  

 if(argc != 2)  return 1;  

  hProcess = OpenProcess(PROCESS_VM_READ, FALSE, _tcstoul(argv[1], NULL, 10));  

  if(hProcess)  

  {  

  if(GetProcessCommandLine(hProcess, szPath, sizeof(szPath)))  

   {  

  printf("%s\n", szPath);  

 }  

CloseHandle(hProcess);  

 }  

｝

 

BOOL GetProcessCommandLine(HANDLE hProcess, LPTSTR pszCmdLine, DWORD cchCmdLine)  

{  

 BOOL            bRet;  

DWORD           dwPos;  

   LPBYTE          lpAddr;  

 DWORD           dwRetLen;  

 bRet = FALSE;  

  dwPos = 0;  

    lpAddr = (LPBYTE)GetCommandLine;  

 

//Win7:  

  if(lpAddr[dwPos] == 0xeb && lpAddr[dwPos + 1] == 0x05)  

  {     

   dwPos += 2;  

dwPos += 5;  

//Win8:  

     if(lpAddr[dwPos] == 0xff && lpAddr[dwPos + 1] == 0x25)  

       {  

        dwPos += 2;  

         lpAddr = *(LPBYTE*)(lpAddr + dwPos);  

   dwPos = 0;  

          lpAddr = *(LPBYTE*)lpAddr;  

//WinXp:  

        if(lpAddr[dwPos] == 0xa1)  

       {      

  dwPos += 1;  

    lpAddr = *(LPBYTE*)(lpAddr + dwPos);  

             bRet = ReadProcessMemory(hProcess,  

                lpAddr,  

                    &lpAddr,  

                    sizeof(LPBYTE),  

                    &dwRetLen);  

                if(bRet)  

                {  

                   bRet = ReadProcessMemory(hProcess,  

                        lpAddr,  

                        pszCmdLine,  

                        cchCmdLine,  

                        &dwRetLen);  

                }  

            }  

        }  

        else  

        {             

            goto WinXp;  

        }  

    }  

    else  

    {  

        goto Win8;  

    }  

  

    return bRet;  

}  

 

相关代码：

http://download.csdn.net/download/flyingleo1981/4543420

http://download.csdn.net/detail/howean/3341483