windows vc++通过tcp、udp端口号获取对应进程的id和名称

4 篇文章 0 订阅
2 篇文章 0 订阅

1、process_net_info.h头文件

#pragma once
#include <Windows.h>
#include <iostream>
#include <vector>

enum TcpOrUdp
{
    TcpType,
    UdpType
};
//=====================================================================================//
//Name: DWORD GetProcessIdByPort()                //
//                                                                                     //
//Descripion: 根据端口号求出打开该端口号的进程 ID(支持 XP,Server 2003,Vista,Win7)      //
//                                                         //
//=====================================================================================//
DWORD GetProcessIdByPort(TcpOrUdp type, DWORD dwPort);
DWORD GetAllPortByProcessId(TcpOrUdp type, DWORD dwProcessId, DWORD* dwAllPort, DWORD dwMaxLen);


//---------------------------------------------------------------------------  
//  
// 由进程号获得进程名称
//  
char* ProcessPidToName(DWORD ProcessId);
//---------------------------------------------------------------------------  
//  
// 由进程号获得全路径文件名
// x86编译出只能查32位系统程序, x64编译可以查32、64位程序
//  
char* ProcessPidToPathName(DWORD ProcessId);
BOOL GetProcessPathByPId(const DWORD dwProcessId, CHAR* cstrPath);

 

2、process_net_info.cpp文件

//Netstat -anb
#include "process_net_info.h"
#include "Psapi.h"
#include <Iprtrmib.h>

#pragma  comment(lib,"Psapi.lib")
#pragma  comment(lib,"Iphlpapi.Lib")
#pragma  comment(lib,"WS2_32.lib")
#include <TlHelp32.h>

using namespace std;
using std::vector;

typedef struct
{
    DWORD dwState;      //连接状态
    DWORD dwLocalAddr;  //本地地址
    DWORD dwLocalPort;  //本地端口
    DWORD dwRemoteAddr; //远程地址
    DWORD dwRemotePort; //远程端口
    DWORD dwProcessId;  //进程标识

}MIB_TCPEXROW, * PMIB_TCPEXROW;


typedef struct
{
    DWORD dwLocalAddr;  //本地地址
    DWORD dwLocalPort;  //本地端口
    DWORD dwProcessId;  //进程标识

}MIB_UDPEXROW, * PMIB_UDPEXROW;


typedef struct
{
    DWORD dwState;      //连接状态
    DWORD dwLocalAddr;  //本地地址
    DWORD dwLocalPort;  //本地端口
    DWORD dwRemoteAddr; //远程地址
    DWORD dwRemotePort; //远程端口
    DWORD dwProcessId;  //进程标识
    DWORD Unknown;      //待定标识

}MIB_TCPEXROW_VISTA, * PMIB_TCPEXROW_VISTA;


typedef struct
{
    DWORD dwNumEntries;
    MIB_TCPEXROW table[ANY_SIZE];

}MIB_TCPEXTABLE, * PMIB_TCPEXTABLE;


typedef struct
{
    DWORD dwNumEntries;
    MIB_TCPEXROW_VISTA table[ANY_SIZE];

}MIB_TCPEXTABLE_VISTA, * PMIB_TCPEXTABLE_VISTA;


typedef struct
{
    DWORD dwNumEntries;
    MIB_UDPEXROW table[ANY_SIZE];

}MIB_UDPEXTABLE, * PMIB_UDPEXTABLE;


//=====================================================================================//
//Name: DWORD AllocateAndGetTcpExTableFromStack()               //
//                                                                                     //
//Descripion: 该函数仅仅只在 Windows XP,Windows Server 2003 下有效         //
//                                                         //
//=====================================================================================//
typedef DWORD(WINAPI* PFNAllocateAndGetTcpExTableFromStack)(
    PMIB_TCPEXTABLE* pTcpTabel,
    bool bOrder,
    HANDLE heap,
    DWORD zero,
    DWORD flags
    );

//=====================================================================================//
//Name: DWORD AllocateAndGetUdpExTableFromStack()               //
//                                                                                     //
//Descripion: 该函数仅仅只在 XP,Windows Server 2003 下有效                 //
//                                                         //
//=====================================================================================//
typedef DWORD(WINAPI* PFNAllocateAndGetUdpExTableFromStack)(
    PMIB_UDPEXTABLE* pUdpTable,
    bool bOrder,
    HANDLE heap,
    DWORD zero,
    DWORD flags
    );

//=====================================================================================//
//Name: DWORD InternalGetTcpTable2()               //
//                                                                                     //
//Descripion: 该函数在 Windows Vista 以及 Windows 7 下面效           //
//                                                         //
//=====================================================================================//
typedef DWORD(WINAPI* PFNInternalGetTcpTable2)(
    PMIB_TCPEXTABLE_VISTA* pTcpTable_Vista,
    HANDLE heap,
    DWORD flags
    );

//=====================================================================================//
//Name: DWORD InternalGetUdpTableWithOwnerPid()             //
//                                                                                     //
//Descripion: 该函数在 Windows Vista 以及 Windows 7 下面效           //
//                                                         //
//=====================================================================================//
typedef DWORD(WINAPI* PFNInternalGetUdpTableWithOwnerPid)(
    PMIB_UDPEXTABLE* pUdpTable,
    HANDLE heap,
    DWORD flags
    );


//=====================================================================================//
//Name: DWORD GetProcessIdByPort()                //
//                                                                                     //
//Descripion: 根据端口号求出打开该端口号的进程 ID(支持 XP,Server 2003,Vista,Win7)      //
//                                                         //
//=====================================================================================//
DWORD GetProcessIdByPort(TcpOrUdp type, DWORD dwPort)
{
    HMODULE hModule = LoadLibraryW(L"iphlpapi.dll");
    if (hModule == NULL)
    {
        return 0;
    }

    if (type == TcpType)
    {
        // 表明查询的是 TCP 信息
        PFNAllocateAndGetTcpExTableFromStack pAllocateAndGetTcpExTableFromStack;
        pAllocateAndGetTcpExTableFromStack =
            (PFNAllocateAndGetTcpExTableFromStack)GetProcAddress(hModule, "AllocateAndGetTcpExTableFromStack");
        if (pAllocateAndGetTcpExTableFromStack != NULL)
        {
            // 表明为 XP 或者 Server 2003 操作系统
            PMIB_TCPEXTABLE pTcpExTable = NULL;
            if (pAllocateAndGetTcpExTableFromStack(&pTcpExTable, TRUE, GetProcessHeap(), 0, AF_INET) != 0)
            {
                if (pTcpExTable)
                {
                    HeapFree(GetProcessHeap(), 0, pTcpExTable);
                }

                FreeLibrary(hModule);
                hModule = NULL;

                return 0;
            }

            for (UINT i = 0; i < pTcpExTable->dwNumEntries; i++)
            {
                // 过滤掉数据,只查询我们需要的进程数据
                if (dwPort == ntohs(0x0000FFFF & pTcpExTable->table[i].dwLocalPort))
                {
                    DWORD dwProcessId = pTcpExTable->table[i].dwProcessId;
                    if (pTcpExTable)
                    {
                        HeapFree(GetProcessHeap(), 0, pTcpExTable);
                    }

                    FreeLibrary(hModule);
                    hModule = NULL;

                    return dwProcessId;
                }
            }

            if (pTcpExTable)
            {
                HeapFree(GetProcessHeap(), 0, pTcpExTable);
            }

            FreeLibrary(hModule);
            hModule = NULL;

            return 0;
        }
        else
        {
            // 表明为 Vista 或者 7 操作系统
            PMIB_TCPEXTABLE_VISTA pTcpExTable = NULL;
            PFNInternalGetTcpTable2 pInternalGetTcpTable2 =
                (PFNInternalGetTcpTable2)GetProcAddress(hModule, "InternalGetTcpTable2");
            if (pInternalGetTcpTable2 == NULL)
            {
                if (pTcpExTable)
                {
                    HeapFree(GetProcessHeap(), 0, pTcpExTable);
                }

                FreeLibrary(hModule);
                hModule = NULL;

                return 0;
            }

            if (pInternalGetTcpTable2(&pTcpExTable, GetProcessHeap(), 1))
            {
                if (pTcpExTable)
                {
                    HeapFree(GetProcessHeap(), 0, pTcpExTable);
                }

                FreeLibrary(hModule);
                hModule = NULL;

                return 0;
            }

            for (UINT i = 0; i < pTcpExTable->dwNumEntries; i++)
            {
                // 过滤掉数据,只查询我们需要的进程数据
                if (dwPort == ntohs(0x0000FFFF & pTcpExTable->table[i].dwLocalPort))
                {
                    DWORD dwProcessId = pTcpExTable->table[i].dwProcessId;
                    if (pTcpExTable)
                    {
                        HeapFree(GetProcessHeap(), 0, pTcpExTable);
                    }

                    FreeLibrary(hModule);
                    hModule = NULL;

                    return dwProcessId;
                }
            }

            if (pTcpExTable)
            {
                HeapFree(GetProcessHeap(), 0, pTcpExTable);
            }

            FreeLibrary(hModule);
            hModule = NULL;

            return 0;
        }
    }
    else if (type == UdpType)
    {
        // 表明查询的是 UDP 信息
        PMIB_UDPEXTABLE pUdpExTable = NULL;
        PFNAllocateAndGetUdpExTableFromStack pAllocateAndGetUdpExTableFromStack;
        pAllocateAndGetUdpExTableFromStack =
            (PFNAllocateAndGetUdpExTableFromStack)GetProcAddress(hModule, "AllocateAndGetUdpExTableFromStack");
        if (pAllocateAndGetUdpExTableFromStack != NULL)
        {
            // 表明为 XP 或者 Server 2003 操作系统
            if (pAllocateAndGetUdpExTableFromStack(&pUdpExTable, TRUE, GetProcessHeap(), 0, AF_INET) != 0)
            {
                if (pUdpExTable)
                {
                    HeapFree(GetProcessHeap(), 0, pUdpExTable);
                }

                FreeLibrary(hModule);
                hModule = NULL;

                return 0;
            }

            for (UINT i = 0; i < pUdpExTable->dwNumEntries; i++)
            {
                // 过滤掉数据,只查询我们需要的进程数据
                if (dwPort == ntohs(0x0000FFFF & pUdpExTable->table[i].dwLocalPort))
                {
                    DWORD dwProcessId = pUdpExTable->table[i].dwProcessId;
                    if (pUdpExTable)
                    {
                        HeapFree(GetProcessHeap(), 0, pUdpExTable);
                    }

                    FreeLibrary(hModule);
                    hModule = NULL;

                    return dwProcessId;
                }
            }

            if (pUdpExTable)
            {
                HeapFree(GetProcessHeap(), 0, pUdpExTable);
            }

            FreeLibrary(hModule);
            hModule = NULL;

            return 0;
        }
        else
        {
            // 表明为 Vista 或者 7 操作系统
            PFNInternalGetUdpTableWithOwnerPid pInternalGetUdpTableWithOwnerPid;
            pInternalGetUdpTableWithOwnerPid =
                (PFNInternalGetUdpTableWithOwnerPid)GetProcAddress(hModule, "InternalGetUdpTableWithOwnerPid");
            if (pInternalGetUdpTableWithOwnerPid != NULL)
            {
                if (pInternalGetUdpTableWithOwnerPid(&pUdpExTable, GetProcessHeap(), 1))
                {
                    if (pUdpExTable)
                    {
                        HeapFree(GetProcessHeap(), 0, pUdpExTable);
                    }

                    FreeLibrary(hModule);
                    hModule = NULL;

                    return 0;
                }

                for (UINT i = 0; i < pUdpExTable->dwNumEntries; i++)
                {
                    // 过滤掉数据,只查询我们需要的进程数据
                    if (dwPort == ntohs(0x0000FFFF & pUdpExTable->table[i].dwLocalPort))
                    {
                        DWORD dwProcessId = pUdpExTable->table[i].dwProcessId;
                        if (pUdpExTable)
                        {
                            HeapFree(GetProcessHeap(), 0, pUdpExTable);
                        }

                        FreeLibrary(hModule);
                        hModule = NULL;

                        return dwProcessId;
                    }
                }
            }

            if (pUdpExTable)
            {
                HeapFree(GetProcessHeap(), 0, pUdpExTable);
            }

            FreeLibrary(hModule);
            hModule = NULL;

            return 0;
        }
    }
    else
    {
        FreeLibrary(hModule);
        hModule = NULL;

        return -1;
    }
}


//=====================================================================================//
//Name: DWORD GetAllPortByProcessId()               //
//                                                                                     //
//Descripion: 根据进程 ID 来求出该进程所打开的所有的端口号,并且在 dwAllPort 数组中返回所有端口号    //
//     其中 dwMaxLen 为数组的长度,函数的返回值为进程所打开的端口的数目        //
//     (支持 XP,Server 2003,Vista,Win7)             //
//                                                         //
//=====================================================================================//
DWORD GetAllPortByProcessId(TcpOrUdp type, DWORD dwProcessId, DWORD* dwAllPort, DWORD dwMaxLen)
{
    DWORD dwPortCount = 0;
    HMODULE hModule = LoadLibraryW(L"iphlpapi.dll");
    if (hModule == NULL)
    {
        return dwPortCount;
    }

    if (type == TcpType)
    {
        // 表明查询的是 UDP 信息
        PFNAllocateAndGetTcpExTableFromStack pAllocateAndGetTcpExTableFromStack;
        pAllocateAndGetTcpExTableFromStack = (PFNAllocateAndGetTcpExTableFromStack)GetProcAddress(hModule, "AllocateAndGetTcpExTableFromStack");
        if (pAllocateAndGetTcpExTableFromStack != NULL)
        {
            // 表明为 XP 或者 Server 2003 操作系统
            PMIB_TCPEXTABLE pTcpExTable = NULL;
            if (pAllocateAndGetTcpExTableFromStack(&pTcpExTable, TRUE, GetProcessHeap(), 0, AF_INET) != 0)
            {
                if (pTcpExTable)
                {
                    HeapFree(GetProcessHeap(), 0, pTcpExTable);
                }

                FreeLibrary(hModule);
                hModule = NULL;

                return dwPortCount;
            }

            for (UINT i = 0; i < pTcpExTable->dwNumEntries; i++)
            {
                // 过滤掉数据,只获取我们要查询的进程的 Port 信息
                if (dwProcessId == pTcpExTable->table[i].dwProcessId)
                {
                    if (dwPortCount < dwMaxLen)
                    {
                        dwAllPort[dwPortCount] = ntohs(0x0000FFFF & pTcpExTable->table[i].dwLocalPort);
                        dwPortCount++;
                    }
                }
            }

            if (pTcpExTable)
            {
                HeapFree(GetProcessHeap(), 0, pTcpExTable);
            }

            FreeLibrary(hModule);
            hModule = NULL;

            return dwPortCount;
        }
        else
        {
            // 表明为 Vista 或者 7 操作系统
            PMIB_TCPEXTABLE_VISTA pTcpExTable = NULL;
            PFNInternalGetTcpTable2 pInternalGetTcpTable2 = (PFNInternalGetTcpTable2)GetProcAddress(hModule, "InternalGetTcpTable2");
            if (pInternalGetTcpTable2 == NULL)
            {
                if (pTcpExTable)
                {
                    HeapFree(GetProcessHeap(), 0, pTcpExTable);
                }

                FreeLibrary(hModule);
                hModule = NULL;

                return dwPortCount;
            }

            if (pInternalGetTcpTable2(&pTcpExTable, GetProcessHeap(), 1))
            {
                if (pTcpExTable)
                {
                    HeapFree(GetProcessHeap(), 0, pTcpExTable);
                }

                FreeLibrary(hModule);
                hModule = NULL;

                return dwPortCount;
            }

            for (UINT i = 0; i < pTcpExTable->dwNumEntries; i++)
            {
                // 过滤掉数据,只获取我们要查询的进程的 TCP Port 信息
                if (dwProcessId == pTcpExTable->table[i].dwProcessId)
                {
                    if (dwPortCount < dwMaxLen)
                    {
                        dwAllPort[dwPortCount] = ntohs(0x0000FFFF & pTcpExTable->table[i].dwLocalPort);
                        dwPortCount++;
                    }
                }
            }

            if (pTcpExTable)
            {
                HeapFree(GetProcessHeap(), 0, pTcpExTable);
            }

            FreeLibrary(hModule);
            hModule = NULL;

            return dwPortCount;
        }
    }
    else if (type == UdpType)
    {
        // 表明查询的是 UDP 信息
        PMIB_UDPEXTABLE pUdpExTable = NULL;
        PFNAllocateAndGetUdpExTableFromStack pAllocateAndGetUdpExTableFromStack;
        pAllocateAndGetUdpExTableFromStack = (PFNAllocateAndGetUdpExTableFromStack)GetProcAddress(hModule, "AllocateAndGetUdpExTableFromStack");
        if (pAllocateAndGetUdpExTableFromStack != NULL)
        {
            // 表明为 XP 或者 Server 2003 操作系统
            if (pAllocateAndGetUdpExTableFromStack(&pUdpExTable, TRUE, GetProcessHeap(), 0, AF_INET) != 0)
            {
                if (pUdpExTable)
                {
                    HeapFree(GetProcessHeap(), 0, pUdpExTable);
                }

                FreeLibrary(hModule);
                hModule = NULL;

                return dwPortCount;
            }

            for (UINT i = 0; i < pUdpExTable->dwNumEntries; i++)
            {
                // 过滤掉数据,只获取我们要查询的进程的 UDP Port信息
                if (dwProcessId == pUdpExTable->table[i].dwProcessId)
                {
                    if (dwPortCount < dwMaxLen)
                    {
                        dwAllPort[dwPortCount] = ntohs(0x0000FFFF & pUdpExTable->table[i].dwLocalPort);
                        dwPortCount++;
                    }
                }
            }

            if (pUdpExTable)
            {
                HeapFree(GetProcessHeap(), 0, pUdpExTable);
            }

            FreeLibrary(hModule);
            hModule = NULL;

            return dwPortCount;
        }
        else
        {
            // 表明为 Vista 或者 7 操作系统
            PFNInternalGetUdpTableWithOwnerPid pInternalGetUdpTableWithOwnerPid;
            pInternalGetUdpTableWithOwnerPid = (PFNInternalGetUdpTableWithOwnerPid)GetProcAddress(hModule, "InternalGetUdpTableWithOwnerPid");
            if (pInternalGetUdpTableWithOwnerPid != NULL)
            {
                if (pInternalGetUdpTableWithOwnerPid(&pUdpExTable, GetProcessHeap(), 1))
                {
                    if (pUdpExTable)
                    {
                        HeapFree(GetProcessHeap(), 0, pUdpExTable);
                    }

                    FreeLibrary(hModule);
                    hModule = NULL;

                    return dwPortCount;
                }

                for (UINT i = 0; i < pUdpExTable->dwNumEntries; i++)
                {
                    // 过滤掉数据,只获取我们要查询的进程的 UDP Port信息
                    if (dwProcessId == pUdpExTable->table[i].dwProcessId)
                    {
                        if (dwPortCount < dwMaxLen)
                        {
                            dwAllPort[dwPortCount] = ntohs(0x0000FFFF & pUdpExTable->table[i].dwLocalPort);
                            dwPortCount++;
                        }
                    }
                }
            }

            if (pUdpExTable)
            {
                HeapFree(GetProcessHeap(), 0, pUdpExTable);
            }

            FreeLibrary(hModule);
            hModule = NULL;

            return dwPortCount;
        }
    }
    else
    {
        FreeLibrary(hModule);
        hModule = NULL;

        return dwPortCount;
    }
}

//---------------------------------------------------------------------------  
//  
// 由进程号获得进程名称
//  
char* ProcessPidToName(DWORD ProcessId)
{
    HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    //HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0);
    PROCESSENTRY32 processEntry = { 0 };
    processEntry.dwSize = sizeof(PROCESSENTRY32);
    static char ProcessName[256];

    lstrcpy(ProcessName, "Idle");
    if (hProcessSnap == INVALID_HANDLE_VALUE)
        return ProcessName;

    BOOL bRet = Process32First(hProcessSnap, &processEntry);

    while (bRet)
    {
        if (processEntry.th32ProcessID == ProcessId)
        {
            lstrcpy(ProcessName, processEntry.szExeFile);
            return ProcessName;
        }

        bRet = Process32Next(hProcessSnap, &processEntry);
    }

    CloseHandle(hProcessSnap);
    return ProcessName;
}

//---------------------------------------------------------------------------  
//  
// 由进程号获得全路径文件名
// x86编译出只能查32位系统程序, x64编译可以查32、64位程序
//  
char* ProcessPidToPathName(DWORD ProcessId)
{
    HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    //HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0);
    PROCESSENTRY32 processEntry = { 0 };
    processEntry.dwSize = sizeof(PROCESSENTRY32);
    static char ProcessName[256];

    lstrcpy(ProcessName, "Idle");
    if (hProcessSnap == INVALID_HANDLE_VALUE)
        return ProcessName;

    BOOL bRet = Process32First(hProcessSnap, &processEntry);

    while (bRet)
    {
        if (processEntry.th32ProcessID == ProcessId)
        {
            MODULEENTRY32 me32 = { 0 };
            me32.dwSize = sizeof(MODULEENTRY32);
            HANDLE hModuleSnap = CreateToolhelp32Snapshot
            (TH32CS_SNAPMODULE, processEntry.th32ProcessID);

            Module32First(hModuleSnap, &me32); // 获得全程路径.  
            lstrcpy(ProcessName, me32.szExePath);
            CloseHandle(hProcessSnap);
            return ProcessName;
        }

        bRet = Process32Next(hProcessSnap, &processEntry);
    }

    CloseHandle(hProcessSnap);
    return ProcessName;
}

BOOL GetProcessPathByPId(const DWORD dwProcessId, CHAR* cstrPath)
{
    HANDLE hProcess = NULL;
    BOOL bSuccess = FALSE;
    hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, dwProcessId);
    do
    {
        if (NULL == hProcess)
        {
            break;
        }
        PDWORD d = new DWORD;
        *d = MAX_PATH;
        CHAR szPath[MAX_PATH + 1] = { 0 };
        HMODULE hMod = NULL;
        DWORD cbNeeded = 0;
        if (FALSE == EnumProcessModules(hProcess, &hMod, sizeof(hMod), &cbNeeded))
        {
            break;
        }
        //QueryFullProcessImageName GetProcessImageFileNameA GetProcessImageFileName
        /*if (0 == GetProcessImageFileName(hProcess, szPath, MAX_PATH))
        {
            break;
        }*/
        if (0 == QueryFullProcessImageName(hProcess, 0, szPath, d))
        {
            break;
        }
        /*if (0 == GetModuleFileNameEx(hProcess, hMod, szPath, MAX_PATH))
        {
            break;
        }*/
        strcpy(cstrPath, szPath);
        bSuccess = TRUE;
    } while (0);
    if (NULL != hProcess)
    {
        CloseHandle(hProcess);
        hProcess = NULL;
    }
    return bSuccess;
}

 

3、调用方法

DWORD dwResult = GetProcessIdByPort(UdpType, pUDPHeader->SrcPort);//获取进程id
char* _dwStr = ProcessPidToName(dwResult);//获取进程名称

 

  • 1
    点赞
  • 7
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值