C++ 进程的实现《C++多线程编程实战》

• PCB进程控制块.大致分为3类 : 1)进程表示数据; 2)进程状态数据; 3)进程控制数据.
  是管理进程的中心.
• NtProcessDemo.cpp
  演示如何获得一个进程的基本信息结构地址

#include <Windows.h>
#include <winternl.h> //包含了大部分Windows内部函数的原型和数据表示
#include <iostream>

using namespace std;

//OS在调用内核态和用户态之间的子例程时用到
//QEURYINFORMATIONPROCESS是从ntdll.dd中加载的NtQueryInformationProcess函数的别名
typedef NTSTATUS(NTAPI* QEURYINFORMATIONPROCESS)(
	IN HANDLE ProcessHandle,
	IN PROCESSINFOCLASS ProcessInformationClass,
	OUT PVOID ProcessInformation,
	IN ULONG ProcessInformationLength,
	OUT PULONG ReturnLength OPTIONAL
	);

int main(int argc, char* argv[])
{
	STARTUPINFO startupInfo = { 0 };
	PROCESS_INFORMATION processInformation = { 0 };

	BOOL bSuccess = CreateProcess(
		TEXT("C:\\Windows\\notepad.exe"), NULL, NULL,
		NULL, FALSE, NULL, NULL, NULL, &startupInfo,
		&processInformation);

	if (bSuccess)
	{
		cout << "Process started." << endl << "Process ID:\t"
			 << processInformation.dwProcessId << endl;

		PROCESS_BASIC_INFORMATION pbi;
		ULONG uLength = 0;

		HMODULE hDll = LoadLibrary(
			TEXT("C:\\Windows\\System32\\ntdll.dll"));

		if (hDll)
		{
			QEURYINFORMATIONPROCESS QueryInformationProcess =
				(QEURYINFORMATIONPROCESS)GetProcAddress(
					hDll, "NtQueryInformationProcess");

			if (QueryInformationProcess)
			{
				NTSTATUS ntStatus = QueryInformationProcess(
					processInformation.hProcess,
					PROCESSINFOCLASS::ProcessBasicInformation,
					&pbi, sizeof(pbi), &uLength);

				if (NT_SUCCESS(ntStatus))
				{
					cout << "Process ID (from PCB):\t"
						 << pbi.UniqueProcessId << endl;
				}
				else
				{
					cout << "Cannot open PCB!" << endl
						 << "Error code:\t" << GetLastError()
						 << endl;
				}
			}
			else
			{
				cout << "Cannot get "
					 << "NtQueryInformationProcess function!"
					 << endl << "Error code:\t"
					 << GetLastError() << endl;
			}
			FreeLibrary(hDll);
		}
		else
		{
			cout << "Cannot load ntdll.dll!" << endl
				 << "Error code:\t" << GetLastError() << endl;
		}
	}
	else
	{
		cout << "Cannot start process!" << endl
			 << "Error code:\t" << GetLastError() << endl;
	}
    return 0; 
}

---

• 运行结果