通过进程查询它打开的文件，通过文件查询打开它的进程

最新推荐文章于 2024-09-10 19:16:08 发布

qq1282867270

最新推荐文章于 2024-09-10 19:16:08 发布

阅读量999

点赞数

文章标签：操作系统程序员 c语言 windows c++

本文链接：https://blog.csdn.net/qq1282867270/article/details/43154473

版权

本文介绍如何在Windows系统中通过进程ID获取进程名，以及通过进程名找到对应ID。作者分享了一段C++代码，用于查询进程打开的文件，并讨论了代码注释的重要性。文章还探讨了代码注释的两种观点，强调程序员应根据实际情境灵活运用。

摘要由CSDN通过智能技术生成

#ifndef GETFILEHANDLE_H__
#define GETFILEHANDLE_H__

#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
#define STATUS_SUCCESS 0x00000000
#define STATUS_UNSUCCESSFUL 0xC0000001
#define STATUS_NOT_IMPLEMENTED 0xC0000002
#define STATUS_INFO_LENGTH_MISMATCH 0xC0000004//
//#define STATUS_INVALID_PARAMETER 0xC000000D
#define STATUS_ACCESS_DENIED 0xC0000022
#define STATUSBUFFER_TOO_SMALL 0xC0000023
#define STATUS_BUFFER_OVERFLOW           0x80000005
//#define OBJ_KERNEL_HANDLE 0x00000200
//#define SystemModuleInformation 11
//#define SystemHandleInformation 0x10
//typedef struct _UNICODE_STRING { USHORT Length; USHORT MaximumLength; PWST Buffer; } UNICODE_STRING, *PUNICODE_STRING; 
//typedef enum _PROCESSINFOCLASS { ProcessBasicInformation, ProcessQuotaLimits, ProcessIoCounters, ProcessVmCounters ProcessTimes, ProcessBasePriority, ProcessRaisePriority, ProcessDebugPort, ProcessExceptionPort, ProcessAccessToken, ProcessLdtInformation, ProcessLdtSize, ProcessDefaultHardErrorMode, ProcessIoPortHandlers, ProcessPooledUsageAndLimits, ProcessWorkingSetWatch, ProcessUserModeIOPL, ProcessEnableAlignmentFaultFixup, ProcessPriorityClass, ProcessWx86Information, ProcessHandleCount, ProcessAffinityMask, ProcessPriorityBoost, ProcessDeviceMap, ProcessSessionInformation, ProcessForegroundInformation, ProcessWow64Information, ProcessImageFileName, ProcessLUIDDeviceMapsEnabled, ProcessBreakOnTermination, ProcessDebugObjectHandle, ProcessDebugFlags, ProcessHandleTracing, ProcessUnknown33, ProcessUnknown34, ProcessUnknown35, ProcessCookie, MaxProcessInfoClass } PROCESSINFOCLASS;
//typedef NTSTATUS(WINAPI *PFN_ZwQueryInformationProcess)(HANDLE ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, PVOID ProcessInformation, ULONG ProcessInformationLength, PULONG ReturnLength);
//typedef NTSTATUS(WINAPI *PFN_IoVolumeDeviceToDosName)(PVOID VolumeDeviceObject, PUNICODE_STRING DosName); 
//int main(int argn, TCHAR argv[]){
//	HMODULE hDll = LoadLibrary(_T("Ntdll.dll")); PFN_ZwQueryInformationProcess pFn_ZwQueryInformationProcess; PFN_IoVolumeDeviceToDosName pFn_IoVolumeDeviceToDosName; if (NULL != hDll) { pFn_ZwQueryInformationProcess = (PFN_ZwQueryInformationProcess)GetProcAddress(hDll, "ZwQueryInformationProcess"); if (NULL != pFn_ZwQueryInformationProcess) { printf("Found it!!!ZwQueryInformationProcess\n"); }pFn_IoVolumeDeviceToDosName = (PFN_IoVolumeDeviceToDosName)GetProcAddress(hDll, "IoVolumeDeviceToDosName"); if (NULL != pFn_IoVolumeDeviceToDosName) { printf("Found it!!!IoVolumeDeviceToDosName\n"); } }
//	PROCESSINFOCLASS aFileName = ProcessImageFileName; UNICODE_STRING usRet; ULONG ulRet; HANDLE hProcess = GetCurrentProcess(); NTSTATUS stRet = pFn_ZwQueryInformationProcess(hProcess, aFileName, &usRet, 0, &ulRet);
//	if (stRet == STATUS_INFO_LENGTH_MISMATCH){
//		usRet.Length = ulRet; usRet.MaximumLength = ulRet;//usRet.Buffer = (TCHAR*)malloc(sizeof(TCHAR) * (ulRet) );}
//		stRet = pFn_ZwQueryInformationProcess(hProcess, aFileName, &usRet, ulRet, &ulRet); if (NT_SUCCESS(stRet)){ _tprintf(TEXT("FileName:%s\n"), usRet.Buffer); } if (NULL != hDll) { FreeLibrary(hDll); hDll = NULL; }if (NULL != usRet.Buffer)free(usRet.Buffer); _tsystem(TEXT("pause")); return 0;
//	}
//
typedef struct _SYSTEM_HANDLE
{
	ULONG  uIdProcess;
	UCHAR  ObjectType;    // OB_TYPE_* (OB_TYPE_TYPE, etc.)
	UCHAR  Flags;         // HANDLE_FLAG_* (HANDLE_FLAG_INHERIT, etc.)
	USHORT  Handle;
	PVOID  pObject;
	ACCESS_MASK GrantedAccess;
} SYSTEM_HANDLE, *PSYSTEM_HANDLE;


typedef struct _SYSTEM_HANDLE_INFORMATION
{
	ULONG   uCount;
	SYSTEM_HANDLE aSH[];
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;




typedef enum _SYSTEMINFOCLASS
{
	SystemBasicInformation1,             // 0x002C
	SystemProcessorInformation,         // 0x000C
	SystemPerformanceInformation1,       // 0x0138
	SystemTimeInformation,              // 0x0020
	SystemPathInformation,              // not implemented
	SystemProcessInformation1,           // 0x00C8+ per process
	SystemCallInformation,              // 0x0018 + (n * 0x0004)
	Sys