- PCB进程控制块.大致分为3类 : 1)进程表示数据; 2)进程状态数据; 3)进程控制数据.
是管理进程的中心. - NtProcessDemo.cpp
演示如何获得一个进程的基本信息结构地址
#include <Windows.h>
#include <winternl.h> //包含了大部分Windows内部函数的原型和数据表示
#include <iostream>
using namespace std;
//OS在调用内核态和用户态之间的子例程时用到
//QEURYINFORMATIONPROCESS是从ntdll.dd中加载的NtQueryInformationProcess函数的别名
typedef NTSTATUS(NTAPI* QEURYINFORMATIONPROCESS)(
IN HANDLE ProcessHandle,
IN PROCESSINFOCLASS ProcessInformationClass,
OUT PVOID ProcessInformation,
IN ULONG ProcessInformationLength,
OUT PULONG ReturnLength OPTIONAL
);
int main(int argc, char* argv[])
{
STARTUPINFO startupInfo = { 0 };
PROCESS_INFORMATION processInformation = { 0 };
BOOL bSuccess = CreateProcess(
TEXT("C:\\Windows\\notepad.exe"), NULL, NULL,
NULL, FALSE, NULL, NULL, NULL, &startupInfo,
&processInformation);
if (bSuccess)
{
cout << "Process started." << endl << "Process ID:\t"
<< processInformation.dwProcessId << endl;
PROCESS_BASIC_INFORMATION pbi;
ULONG uLength = 0;
HMODULE hDll = LoadLibrary(
TEXT("C:\\Windows\\System32\\ntdll.dll"));
if (hDll)
{
QEURYINFORMATIONPROCESS QueryInformationProcess =
(QEURYINFORMATIONPROCESS)GetProcAddress(
hDll, "NtQueryInformationProcess");
if (QueryInformationProcess)
{
NTSTATUS ntStatus = QueryInformationProcess(
processInformation.hProcess,
PROCESSINFOCLASS::ProcessBasicInformation,
&pbi, sizeof(pbi), &uLength);
if (NT_SUCCESS(ntStatus))
{
cout << "Process ID (from PCB):\t"
<< pbi.UniqueProcessId << endl;
}
else
{
cout << "Cannot open PCB!" << endl
<< "Error code:\t" << GetLastError()
<< endl;
}
}
else
{
cout << "Cannot get "
<< "NtQueryInformationProcess function!"
<< endl << "Error code:\t"
<< GetLastError() << endl;
}
FreeLibrary(hDll);
}
else
{
cout << "Cannot load ntdll.dll!" << endl
<< "Error code:\t" << GetLastError() << endl;
}
}
else
{
cout << "Cannot start process!" << endl
<< "Error code:\t" << GetLastError() << endl;
}
return 0;
}
- 运行结果