枚举进程信息

1.PSAPI法

#include <Windows.h> #include <iostream> #include <tchar.h> #include "psapi.h" #pragma comment ( lib, "psapi.lib" ) int main() { setlocale(LC_ALL,"CHS"); //要设置控制台的Unicode属性 DWORD Pid[1024],cbNeededProcess,NumofProcess; if (!EnumProcesses(Pid,sizeof(Pid),&cbNeededProcess)) { printf("failed.\n"); } NumofProcess=cbNeededProcess/sizeof(DWORD); for (UINT i=0;i<NumofProcess;i++) { TCHAR szFilePath[MAX_PATH]=_T("unknow"); HANDLE hProcess=OpenProcess( PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,FALSE, Pid[i]); if (hProcess != NULL) { GetModuleFileNameEx(hProcess,NULL,szFilePath,sizeof(szFilePath)); _tprintf(_T("%04d %s\n"),Pid[i],szFilePath); CloseHandle(hProcess); } } _tprintf(_T("共有%d个进程\n"),NumofProcess); return 0; }

2.ToolHelpApi

#include <Windows.h> #include <tchar.h> #include <tlhelp32.h> #include <iostream> int main() { setlocale(LC_ALL,"CHS"); PROCESSENTRY32 pe32; pe32.dwSize=sizeof(pe32); BOOL bRet; UINT uNum=0; HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL); bRet = Process32First(hProcessSnap,&pe32); while (bRet) { HANDLE hModuleSnap=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,pe32.th32ProcessID); MODULEENTRY32 me32={0}; me32.dwSize=sizeof(MODULEENTRY32); Module32First(hModuleSnap,&me32); _tprintf(_T("%04d %s\n"),pe32.th32ProcessID,me32.szExePath); CloseHandle(hModuleSnap); uNum++; bRet=Process32Next(hProcessSnap,&pe32); } _tprintf(_T("共有%d个进程\n"),uNum); CloseHandle(hProcessSnap); return 0; }

3.WTSOpenServer法

// // WTSOpenServer 法 #include <Wtsapi32.h> #pragma comment(lib,"Wtsapi32.lib") 用nbtstat -an获取本机NetBios名称，并在命令行下输入即可 // char *szServerName = argv[1]; PWTS_PROCESS_INFO wts; DWORD dwCount; HANDLE hWtsServer = WTSOpenServer(szServerName); if(!WTSEnumerateProcesses(hWtsServer,0,1,&wts,&dwCount)) return 0; for (DWORD i=0;i<dwCount;i++) { printf("%s\n",wts[i].pProcessName); } return 0;

4.使用Native API我们使用NtQuerySystemInformation

#include <windows.h>
#include <iostream>
#include <tchar.h>
using namespace std;
#include "MyNtdll.h"//定义了函数指针和各种结构体

#define DEF_BUF_SIZE	0x1000
PFNNtQuerySystemInformation NtQuerySystemInformation ;

BOOL Initial ()
{
	// 检测当前进程中是否存在ntdll.dll
	HMODULE	hMod = GetModuleHandle(_T("ntdll.dll"));
	if ( hMod == NULL )
	{
		// 如果不存在，就使用LoadLibrary来加载
		hMod = LoadLibrary (_T("ntdll.dll")) ;
		if ( hMod == NULL )
			return FALSE ;
	}
	// 取得函数地址
	NtQuerySystemInformation =(PFNNtQuerySystemInformation)GetProcAddress(hMod,"NtQuerySystemInformation") ;
	return TRUE ;
}
VOID DisplayProcessInformation ( LPBYTE lpBuf )
{	
	cout << "///" << endl ;
	cout << "//                       Process Information                         //" << endl ;
	cout << "///" << endl ;
	PSYSTEM_PROCESSES pSysProcess = (PSYSTEM_PROCESSES)lpBuf ;
	while ( TRUE )
	{
		cout << "ProcessName:" << '\t' ; 
		if ( pSysProcess->ProcessName.Buffer != NULL )
			printf ("%30S", pSysProcess->ProcessName.Buffer ) ;
		cout << endl ;

		cout << "InheritedFromProcessId:\t\t" << pSysProcess->InheritedFromProcessId << endl ;
		cout << "ProcessId:\t\t\t" << pSysProcess->ProcessId << endl ;
		cout << "HandleCount:\t\t\t" << pSysProcess->HandleCount << endl ;
		cout << "ThreadCount:\t\t\t" << pSysProcess->ThreadCount << endl ;

		cout << "-------------------------------------------------------------------------" << endl ;
		if ( pSysProcess->NextEntryDelta == 0 )
			break ;
		pSysProcess = (PSYSTEM_PROCESSES)( (DWORD)pSysProcess + pSysProcess->NextEntryDelta ) ;
	}
}
VOID QuerySystemInformation (SYSTEM_INFORMATION_CLASS SystemInformationClass)
{
	NTSTATUS	status ;
	UINT		nSize = DEF_BUF_SIZE ;
	LPBYTE		lpBuf = NULL ;

	// 由于事先并不知道需要多少空间来存储进程信息
	// 因而采用循环测试法，
	while ( TRUE )
	{
		// 动态分配空间，用来存储进程信息
		if ( ( lpBuf = new BYTE [ nSize ] ) == NULL )
		{
			cout << "Allocate memory failed!" << endl ;
			return ;
		}

		// 枚举进程信息
		status = NtQuerySystemInformation(SystemInformationClass,lpBuf,nSize,0) ;
		if ( !NT_SUCCESS(status))
		{
			// 检测是否返回缓冲区不够大
			if ( status == STATUS_INFO_LENGTH_MISMATCH )
			{
				nSize += DEF_BUF_SIZE ;
				delete lpBuf ;
				continue ;
			}
			else
			{
				cout << "NtQuerySystemInformation ErrorCode=0x" << hex << status << endl ;
				return ;
			}
		}
		else
			break ;
	}

	// 输出进程信息
	DisplayProcessInformation (lpBuf) ;
	delete lpBuf ;
}
int main()
{
	if (Initial() == FALSE)
	{
		_tprintf(_T("Initial failed!"));
		return 0;
	}
	QuerySystemInformation(SystemProcessesAndThreadsInformation );
	return 0;
}