枚举进程（汇编）

;----------------
;编译模式="CON"
;----------------
.386
.model flat, stdcall
option casemap :none

include windows.inc
include user32.inc
include kernel32.inc
include masm32.inc
include Psapi.inc

includelib user32.lib
includelib kernel32.lib
includelib masm32.lib
includelib Psapi.lib
;-------------------------------------------------------

Error_Handler   proto :DWORD, :DWORD, :DWORD, :DWORD
Print_Handler   proto :DWORD,  :DWORD,:DWORD
DlgProc proto :DWORD,:DWORD,:DWORD,:DWORD
RetriveProcess proto :DWORD

szText MACRO Name, Text:VARARG
          LOCAL lbl
            jmp lbl
              Name db Text,0
            lbl:
          ENDM

.const
 DLG_MAIN equ 1
 ITEM_LIST  equ 1001

.DATA
 szMsg db "Hello World!",13,10,0
 proID dd 512 dup(0)
 szDbg db 256 dup(0),0
 szProcessName db 256 dup(0),0
 szNewLine db " ",13,10,0 
 szDlgName    db "MAIN_DIALOG", 0

.DATA?
 dwRet dd ?
 hm HMODULE ?
 dwHmRet dd ?
 hProcess HANDLE ?
 hProcessHandle HANDLE ?
 hProcessID dd ? 
 hInstance dd ?

.CODE
START:
 assume fs:nothing
 push  offset Error_Handler
 push  fs:[0]
 mov   fs:[0],esp

 invoke GetModuleHandle,NULL
 mov hInstance,eax
 invoke DialogBoxParam,hInstance,ADDR szDlgName,0,offset DlgProc,0
 
 pop  fs:[0]
 pop   eax

 invoke ExitProcess,0

DlgProc proc hWnd,uMsg,wParam,lParam
.if uMsg==WM_INITDIALOG
 invoke LoadIcon,hInstance,DLG_MAIN
 invoke SendMessage,hWnd,WM_SETICON,ICON_SMALL,eax
 ;LOCAL  hItem:HANDLE
 ;invoke GetDlgItem,hWnd,ITEM_LIST
 ;mov  [hItem] , eax
 invoke SendMessage,hWnd,WM_SETTEXT,0,ADDR szMsg
.elseif uMsg==WM_COMMAND
 mov eax,wParam
 .if ax==3002
  invoke EndDialog,hWnd,TRUE
 .endif
 .if ax == 1002 ;;process
  invoke RetriveProcess,hWnd
 .endif
.elseif uMsg==WM_CLOSE
 invoke EndDialog,hWnd,FALSE
.else
 mov eax,FALSE
 ret
.endif
mov eax,TRUE
ret
DlgProc endp

Print_Handler   proc  processname:DWORD , processid:DWORD,hDlg:DWORD
 LOCAL  hItem:HANDLE
 LOCAL szOutPut[256]:BYTE 
 szText szFormat,"%s(%d)"
 invoke GetDlgItem,hDlg,ITEM_LIST
 mov  [hItem] , eax
 invoke wsprintf,ADDR szOutPut,ADDR szFormat,processname,processid
 invoke SendMessage,[hItem],LB_ADDSTRING ,0,ADDR szOutPut;LB_ADDSTRING
 ret
Print_Handler endp

RetriveProcess proc hDlg:DWORD  
 invoke EnumProcesses,ADDR proID,512*4,ADDR dwRet
 test eax , eax
 jz   @EnumOver
 mov   ecx,[dwRet]
 SAR   ecx , 2
 mov [dwRet], ecx  

 push 0
 push offset proID   
 
@OpenProcess:
 mov  eax , [esp]  
 mov  ecx , [esp+4] 
 cmp  ecx , [dwRet]  
 jz   @EnumOver
 SAL  ecx , 2
 add  eax , ecx
 mov  eax , [eax]
 mov  [hProcessID],eax
 invoke OpenProcess,PROCESS_QUERY_INFORMATION or PROCESS_VM_READ,0,eax
 mov [hProcessHandle], eax
 test eax , eax 
 jnz @EnumProcessModules
 invoke GetLastError
 mov ecx , [esp+4]
 inc ecx
 mov [esp+4] ,  ecx
 jmp @OpenProcess
 
@EnumProcessModules:
 invoke EnumProcessModules,eax,ADDR hm,4,ADDR dwHmRet  
 test eax , eax
 jnz @GetModuleFileNameEx  
 invoke GetLastError
 mov ecx , [esp+4]
 inc ecx
 mov [esp+4] ,  ecx
 jmp @OpenProcess 
 
@GetModuleFileNameEx:
 invoke GetModuleFileNameEx,[hProcessHandle],[hm],ADDR szProcessName,256 
 invoke Print_Handler,ADDR szProcessName,[hProcessID],hDlg
 
   mov ecx , [esp+4]
 inc ecx
 mov [esp+4] ,  ecx  
 jmp @OpenProcess   

@EnumOver: 
 pop eax
 pop eax
 ret
RetriveProcess endp

Error_Handler proc uses ecx  lpExceptRecord:DWORD, lpFrame:DWORD, lpContext:DWORD, lpDispatch:DWORD
 mov eax , 1
 ret
Error_Handler endp

end START