获取所有进程的用户名(包括NETWORK SERVICE和LOCAL SERVICE)

最新推荐文章于 2024-08-25 23:14:36 发布

oldmtn

最新推荐文章于 2024-08-25 23:14:36 发布

阅读量3.3k

点赞数

文章标签： service network integer winapi system null

以下代码实现获取某个进程所属的用户名，比如RavMonD.exe的进程PID是1300，那么修改这条语句就OK
GetProcessUser(1300,&bs);它的获取结果是：SYSTEM。
-----------------------------------------------------
#include <windows.h>
#include <iostream.h>
#include <COMDEF.H>
#include <stdio.h>

typedef struct _UNICODE_STRING {
         USHORT Length;
         USHORT MaximumLength;
         PWSTR   Buffer;
} UNICODE_STRING, *PUNICODE_STRING;

//SystemProcessInformation
typedef struct _SYSTEM_PROCESS_INFORMATION
{
         DWORD             dwNextEntryOffset;
         DWORD             dwNumberOfThreads;
         LARGE_INTEGER     qSpareLi1;
         LARGE_INTEGER     qSpareLi2;
         LARGE_INTEGER     qSpareLi3;
         LARGE_INTEGER     qCreateTime;
         LARGE_INTEGER     qUserTime;
         LARGE_INTEGER     qKernelTime;
         UNICODE_STRING     ImageName;
         int                 nBasePriority;
         DWORD             dwProcessId;
         DWORD             dwInheritedFromUniqueProcessId;
         DWORD             dwHandleCount;
         DWORD             dwSessionId;
         ULONG             dwSpareUl3;
         SIZE_T             tPeakVirtualSize;
         SIZE_T             tVirtualSize;
         DWORD             dwPageFaultCount;
         DWORD             dwPeakWorkingSetSize;
         DWORD             dwWorkingSetSize;
         SIZE_T             tQuotaPeakPagedPoolUsage;
         SIZE_T             tQuotaPagedPoolUsage;
         SIZE_T             tQuotaPeakNonPagedPoolUsage;
         SIZE_T             tQuotaNonPagedPoolUsage;
         SIZE_T             tPagefileUsage;
         SIZE_T             tPeakPagefileUsage;
         SIZE_T             tPrivatePageCount;
         LARGE_INTEGER     qReadOperationCount;
         LARGE_INTEGER     qWriteOperationCount;
         LARGE_INTEGER     qOtherOperationCount;
         LARGE_INTEGER     qReadTransferCount;
         LARGE_INTEGER     qWriteTransferCount;
         LARGE_INTEGER     qOtherTransferCount;
}SYSTEM_PROCESS_INFORMATION;

/*----------------------------------------------------
       函数说明：动态加载动库文件
           输入参数： pDllName 库文件名称，pProcName导出函数名字
           输出参数：无
           返回值   ：返回函数的的地址
----------------------------------------------------*/
VOID *GetDllProc(CHAR * pDllName, CHAR *pProcName)
{
     HMODULE         hMod;
     hMod = LoadLibraryA(pDllName);
     if(hMod == NULL)
         return NULL;

     return GetProcAddress(hMod, pProcName);
}

//宏定义函数的指针
typedef LONG (WINAPI *Fun_NtQuerySystemInformation) (int SystemInformationClass,
                                                                                             OUT PVOID SystemInformation,
                                                                                             IN ULONG SystemInformationLength,
                                                                                             OUT ULONG * pReturnLength OPTIONAL);

typedef BYTE (WINAPI *Fun_WinStationGetProcessSid)(HANDLE hServer,DWORD ProcessId ,

FILETIME ProcessStartTime, PBYTE pProcessUserSid , PDWORD dwSidSize);

typedef VOID (WINAPI *Fun_CachedGetUserFromSid)( PSID pSid , PWCHAR pUserName,PULONG cbUserName);

#define STATUS_INFO_LENGTH_MISMATCH ((LONG)0xC0000004L)

#define SystemProcessInformation         5

/*------------------------------------------------------------------
     函数说明：获取系统进程的信息
         输入参数： SYSTEM_PROCESS_INFORMATION
         输出参数：无

--------------------------------------------------------------------*/
BOOL GetSysProcInfo(SYSTEM_PROCESS_INFORMATION ** ppSysProcInfo)
{
     Fun_NtQuerySystemInformation     _NtQuerySystemInformation;
     _NtQuerySystemInformation = (Fun_NtQuerySystemInformation)::GetDllProc("NTDLL.DLL", "NtQuerySystemInformation");
     if(_NtQuerySystemInformation == NULL)
         return FALSE;

     DWORD         dwSize = 1024*1024;
     VOID         * pBuf = NULL;
     LONG         lRetVal;

     for(;;)
     {
         if(pBuf)
             free(pBuf);
         pBuf = (VOID *)malloc(dwSize);
         lRetVal = _NtQuerySystemInformation(SystemProcessInformation,
             pBuf, dwSize, NULL);
         if(STATUS_INFO_LENGTH_MISMATCH != lRetVal)
             break;
         dwSize *= 2;
     }

     if(lRetVal == 0)
     {
         *ppSysProcInfo = (SYSTEM_PROCESS_INFORMATION *)pBuf;
         return TRUE;
     }
     free(pBuf);
     return FALSE;
}

BOOL GetProcessUser(DWORD dwPid, _bstr_t *pbStrUser)
{         Fun_WinStationGetProcessSid         _WinStationGetProcessSid;
     Fun_CachedGetUserFromSid         _CachedGetUserFromSid;

     _WinStationGetProcessSid = (Fun_WinStationGetProcessSid)
         GetDllProc("Winsta.dll", "WinStationGetProcessSid");
     _CachedGetUserFromSid = (Fun_CachedGetUserFromSid)
         GetDllProc("utildll.dll", "CachedGetUserFromSid");

     if(_WinStationGetProcessSid == NULL || _CachedGetUserFromSid == NULL)
         return FALSE;

     BYTE         cRetVal;
     FILETIME     ftStartTime;
     DWORD         dwSize;
     BYTE         * pSid;
     BOOL         bRetVal, bFind;
     SYSTEM_PROCESS_INFORMATION     *     pProcInfo, * pCurProcInfo;

     bRetVal = GetSysProcInfo(&pProcInfo);
     if(bRetVal == FALSE || pProcInfo == NULL)
         return FALSE;

     bFind = FALSE;
     pCurProcInfo = pProcInfo;
     for(;;)
     {
         if(pCurProcInfo->dwProcessId == dwPid)
         {
             memcpy(&ftStartTime, &pCurProcInfo->qCreateTime, sizeof(ftStartTime));
             bFind = TRUE;
             break;
         }

         if(pCurProcInfo->dwNextEntryOffset == 0)
             break;
         pCurProcInfo = (SYSTEM_PROCESS_INFORMATION *)((BYTE *)pCurProcInfo +
             pCurProcInfo->dwNextEntryOffset);
     }
     if(bFind == FALSE)
     {
         free(pProcInfo);
         return FALSE;
     }

     cRetVal = _WinStationGetProcessSid(NULL, dwPid, ftStartTime, NULL, &dwSize);
     if(cRetVal != 0)
         return FALSE;

     pSid = new BYTE[dwSize];
     cRetVal = _WinStationGetProcessSid(NULL, dwPid, ftStartTime, pSid, &dwSize);
     if(cRetVal == 0)
     {
         delete [] pSid;
         return FALSE;
     }

     WCHAR   szUserName[1024];
     dwSize = 1024;
     _CachedGetUserFromSid(pSid, szUserName, &dwSize);
     delete [] pSid;
     if(dwSize == 0)
         return FALSE;

     *pbStrUser = szUserName;
     return TRUE;
}

int main()
{

         char ch[256] = {0};
         _bstr_t bs;

         memcpy(&bs,ch,sizeof(bs));

         GetProcessUser(1300,&bs); //第一个参数写的是你的进程ID

         printf(bs);
         printf("/n");
         return 0;
}