遍历系统进程和对应模块以及创建进程

创建进程

int main(int argc, char* argv[])
{	
	//create process
	LPCTSTR lpApplicationName = "C:\\Program Files\\Internet Explorer\\IEXPLORE.exe";
	PROCESS_INFORMATION lpProcessInformation;
	ZeroMemory(&lpProcessInformation, sizeof(lpProcessInformation));
	CreateChildProcess(lpApplicationName,NULL,&lpProcessInformation); 
}

BOOL CreateChildProcess(LPCTSTR lpApplicationName, LPTSTR lpCommandLine, 	PROCESS_INFORMATION* lpProcessInformation)
{
	STARTUPINFO lpStartupInfo;
	ZeroMemory(&lpStartupInfo, sizeof(lpStartupInfo));
	lpStartupInfo.cb = sizeof(STARTUPINFO);

SECURITY_ATTRIBUTES sa;
sa.nLength = sizeof(sa);
sa.bInheritHandle = TRUE;
sa.lpSecurityDescriptor  =NULL;


if(!CreateProcess(
	lpApplicationName,                 // name of executable module
	lpCommandLine,                      // command line string
	NULL,
	NULL,
    true,                      // handle inheritance option
	0,                     // creation flags
	NULL,                      // new environment block
	NULL,                // current directory name
	&lpStartupInfo,               // startup information
	lpProcessInformation // process information
	))
	{
		printf("CreateChildProcess Error:%d\n",GetLastError());
		return FALSE;
	}
	return true;
}

获取方法

• win32api中有两种方法获取进程信息
• psapi和toolhelp
• psapi——EnumProcesses()获取所有进程ID，然后OpenProcess()获取进程句柄——EnumProcessModules()获取所有关联模块

VOID EnumAllProcess()
{

	DWORD lpidArray[1024];
	DWORD cb = sizeof(lpidArray);
	DWORD cbNeed = cb/(sizeof(DWORD));

	HMODULE lphModule[1024];
	DWORD cbModule = sizeof(lphModule);
	DWORD lpcbNeeded = cbModule/(sizeof(HMODULE));

	TCHAR lpBaseName[256];

	if(EnumProcesses(lpidArray, cb, &cbNeed))
	{
		int count=0;
		for (int i=0; i<cbNeed/sizeof(DWORD); i++)
		{
			if(HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, lpidArray[i]))
			{
				count++;
				if(EnumProcessModules(handle, lphModule, cbModule, &lpcbNeeded))
				{
					
					if(GetModuleBaseName(handle, lphModule[0], lpBaseName, sizeof(lpBaseName)))
					{
						printf("num-- %d ---pid--%d--%s\n", i+1, lpidArray[i], lpBaseName);							
					}
						
				}else{	printf("num-- %d ---pid--%d--%d\n", i+1, lpidArray[i], GetLastError());}
					CloseHandle(handle);
			}else{	printf("num-- %d ---pid--%d--%d\n", i+1, lpidArray[i], GetLastError());}
			
		}
		printf("current process count - %d\n", cbNeed/sizeof(DWORD));
		printf("Log process count - %d\n", count);

	}
	
	
}

• toolHelp——CreateToolHelpSnapShot——获取快照句柄——ProcessFirst——ProcessNext遍历进程，或者ModuleFirst——ModuleNext遍历模块

说几个关键注意事项

• 另外遍历进程的时候需要提升自身权限

BOOL EnablePriv()
{
	HANDLE hToken;
	if ( OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken) )
	{
		TOKEN_PRIVILEGES tkp;
		
		if(LookupPrivilegeValue( NULL,SE_DEBUG_NAME,&tkp.Privileges[0].Luid )==FALSE){CloseHandle(hToken); return FALSE;}//修改进程权限
		tkp.PrivilegeCount=1;
		tkp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;
		if(AdjustTokenPrivileges( hToken,FALSE,&tkp,sizeof(tkp),NULL,NULL )==FALSE){ CloseHandle(hToken);return FALSE;}//通知系统修改进程权限
		
		CloseHandle(hToken);
		return TRUE;
	}
	return FALSE;
}

• 如果想要使用psapi需要以下几个步骤
• xp系统需要下载对应platform sdk 最后一个支持vc6的是windows sdk2003
• 下载后需要对vc6进行设置，点击tools——options——direc——分别设置Include，lib,Executable files [这个设置 bin bin\winnt]
• 当链接时候依旧会出现无法解析的外部符号，需要在Project——setting——link modules中加上 psapi.lib
• 然后就可以使用了

几点疑惑

• 无法打印System进程和System IdleProcess进程
• GetLastError（）