win32获取进程树，以及命令行参数

1.先上代码

package main

import (
	"bytes"
	"errors"
	"flag"
	"fmt"
	"io"
	"os"
	"sort"
	"syscall"
	"unsafe"
)

func main() {
   
	out := flag.String("o", "-", "write result to file, - eq stdout")
	flag.Parse()

	procMap := make(map[uint32]*Process, 32)
	err := ForEachProcessEntry(func(entry *syscall.ProcessEntry32) error {
   
		cmdline, err := GetCmdline(entry.ProcessID)
		if err != nil {
   
			return err
		}
		procMap[entry.ProcessID] = &Process{
   
			Pid:      entry.ProcessID,
			Ppid:     entry.ParentProcessID,
			Name:     syscall.UTF16ToString(entry.ExeFile[:]),
			Cmdline:  cmdline,
			Children: make(map[uint32]*Process),
		}
		return nil
	})
	if err != nil {
   
		fmt.Println("ForEachProcessEntry:", err)
		return
	}
	proc := make(ProcessSlice, 0, 32)
	for _, v := range procMap {
   
		if v.Pid == 0 {
   
			proc = append(proc, v)
			continue // 系统进程
		}
		tmp, ok := procMap[v.Ppid]
		if ok {
   
			tmp.Children[v.Pid] = v
		} else {
   
			proc = append(proc, v)
		}
	}
	sort.Sort(proc)

	var fmtOut *os.File
	if *out == "-" {
   
		fmtOut = os.Stdout
	} else {
   
		fmtOut, err = os.Create(*out)
		if err != nil {
   
			fmt.Println("os.Create:", *out, ",error:", err)
			return
		}
		defer fmtOut.Close()
	}

	str := bytes.NewBufferString("%10d,%10d:")
	for _, v := range proc {
   
		fmt.Fprintf(fmtOut, "%10d,%10d: name:[%s], cmdline:[%s]\n", v.Pid, v.Ppid, v.Name, v.Cmdline)
		WriteChildren(fmtOut, v.Children, str, 1)
	}
}

func WriteChildren(w io.Writer, children map[uint32]*Process, strFmt *bytes.Buffer, layer int) {
   
	if len(children) == 0 {
   
		return
	}
	strFmt.Truncate(10 /* len("%10d,%10d:") */)
	for i := 0; i < layer*4; i++ {
   
		if i > 0 && i%4 == 0 {
   
			strFmt.WriteByte('|')
		}
		strFmt.WriteByte(' ')
	}
	strFmt.WriteString("\\_ name:[%s], cmdline:[%s]\n")
	fmtStr := strFmt.String()
	layer++
	for _, v := range children {
   
		fmt.Fprintf(w, fmtStr, v.Pid, v.Ppid, v.Name, v.Cmdline)
		WriteChildren(w, v.Children, strFmt, layer) // 递归打印子进程
	}
}

type (
	Process struct {
   
		Pid, Ppid uint32
		Name      string
		Cmdline   string
		Children  map[uint32]*Process
	}
	ProcessSlice []*Process
)

func (d ProcessSlice) Less(i, j int) bool {
   
	return d[i].Pid < d[j].Pid
}

func (d ProcessSlice) Swap(i, j int) {
   
	d[i], d[j] = d[j], d[i]
}

func (d ProcessSlice)