获取系统进程快照 c语言实现

[cpp]  view plain copy

1. /************************************************************************/  
2. /* 云守护 
3.     email：542335496@qq.com                                                                     */  
4. /************************************************************************/  
5. #include <stdio.h>  
6. #include <windows.h>  
7. #include <TLHELP32.H>  
8. #include <ntsecapi.h>  
9. //需升级windows sdk,静态调用  
10. #include    "psapi.h"  
11. #pragma comment (lib,"psapi.lib")  
12.   
13.   
14. //设置字体颜色  
15. void SetColor(unsigned short ForeColor=4,unsigned short BackGroundColor=0)  
16. {  
17.     HANDLE hCon = GetStdHandle(STD_OUTPUT_HANDLE);//获得缓冲区句柄  
18.     SetConsoleTextAttribute(hCon,ForeColor|BackGroundColor);//设置文本及背景颜色，可以使用color -?查看  
19. };  
20. //通过系统快照获取进程  
21. BOOL GetProcessList(){  
22.   
23.     HANDLE hProcessSnap;  
24.     HANDLE hModuleSnap;  
25.     BOOL bRet=FALSE;  
26.     BOOL bModule=FALSE;  
27.     PROCESSENTRY32 pe32={0};  
28.     MODULEENTRY32 me32={0};  
29.     pe32.dwSize=sizeof(PROCESSENTRY32);  
30.     me32.dwSize=sizeof(MODULEENTRY32);  
31.     hProcessSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);  
32.     bRet=Process32First(hProcessSnap,&pe32);  
33.     while(bRet){  
34.           
35.         SetColor(0,2);  
36.         printf("进程：%s\n",pe32.szExeFile);  
37.         SetColor(0,7);  
38.         hModuleSnap=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,0);  
39.         bModule=Module32First(hModuleSnap,&me32);  
40.         while(bModule){  
41.             printf("\t模块：%s\n",me32.szExePath);  
42.             bModule=Module32Next(hModuleSnap,&me32);  
43.   
44.         }  
45.         bRet=Process32Next(hProcessSnap,&pe32);  
46.     }  
47.     CloseHandle(hProcessSnap);  
48.     CloseHandle(hModuleSnap);  
49.   
50.     return TRUE;  
51. }  
52. //第二种方法 PSAPI 静态调用  
53. BOOL GetProcessListByPSAPi(){  
54.   
55.     DWORD ProcessCount;  
56.     DWORD cbNeeded;  
57.     DWORD ProcessId[1024];  
58.       
59.     EnumProcesses(ProcessId,sizeof(ProcessId),&cbNeeded);  
60.     ProcessCount = cbNeeded/sizeof(DWORD);  
61.       
62.     HMODULE hModule;  
63.     char    szPath[MAX_PATH];  
64.       
65.     for(DWORD i = 0; i < ProcessCount; i ++)  
66.     {  
67.         HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,FALSE,ProcessId[i]);  
68.         if(hProcess)  
69.         {  
70.             EnumProcessModules(hProcess,&hModule,sizeof(hModule),&cbNeeded);  
71.             GetModuleFileNameEx(hProcess,hModule,szPath,sizeof(szPath));  
72.             SetColor(0,6);  
73.             printf("PID:%d ",ProcessId[i]);  
74.             SetColor(0,7);  
75.             printf("\t%s\n",szPath);  
76.         }  
77.         else  
78.             continue;  
79.     }  
80.     return TRUE;  
81.   
82. }  
83.   
84. //第三种方法 WTSAPI  
85. typedef struct _WTS_PROCESS_INFO{  
86.     DWORD SessionId;  
87.     DWORD ProcessId;  
88.     LPTSTR pProcessName;  
89.     PSID pUserSid;  
90. }WTS_PROCESS_INFO,*PWTS_PROCESS_INFO;  
91.   
92. typedef HANDLE (WINAPI *WTSOPENSERVER)(LPTSTR pServerName);  
93.   
94. typedef BOOL (WINAPI *WTSENUMRATEPROCESSES)(HANDLE hServer,DWORD Reserved,DWORD Version,PWTS_PROCESS_INFO* ppProcessInfo,DWORD *pCount);  
95.   
96. //动态调用,合适用于windows NT/2000终端服务  
97. BOOL GetProcessByWTSAPI(){  
98.   
99.     HMODULE hWtsApi32 = LoadLibrary("wtsapi32.dll");  
100.     if(hWtsApi32==NULL){  
101.         printf("请升级sdk，没有找到wtsapi.dll");  
102.         return FALSE;  
103.     }  
104.     WTSOPENSERVER pWtsOpenServer = (WTSOPENSERVER)GetProcAddress(hWtsApi32,"WTSOpenSeverA");  
105.     WTSENUMRATEPROCESSES pWtsEnumrateProcesses = (WTSENUMRATEPROCESSES)GetProcAddress(hWtsApi32,"WTSEnumrateProcessesA");  
106.     //终端服务名字,可以使用nbtstat -an 命令查看  
107.     char *szServerName = " 1FB978629C104D4";  
108.     HANDLE hWtsServer = pWtsOpenServer(szServerName);  
109.       
110.     PWTS_PROCESS_INFO pWtsapi;  
111.     DWORD dwCount;  
112.       
113.     if(!pWtsEnumrateProcesses(hWtsServer,0,1,&pWtsapi,&dwCount))  
114.         return FALSE;  
115.       
116.     for(DWORD i = 0; i < dwCount; i ++)  
117.     {  
118.         printf("ProcessID: %d (%s)\n",pWtsapi[i].ProcessId,pWtsapi[i].pProcessName);  
119.     }  
120.   
121.     return TRUE;  
122. }  
123. //第四种方法  
124. #define SystemProcessesAndThreadsInformation    5  
125. // 动态调用  
126. typedef DWORD (WINAPI *ZWQUERYSYSTEMINFORMATION) (DWORD,  
127.                                                   PVOID,  
128.                                                   DWORD,  
129.                                                   PDWORD);  
130. // 结构定义  
131. typedef struct _SYSTEM_PROCESS_INFORMATION{  
132.     DWORD       NextEntryDelta;  
133.     DWORD       ThreadCount;  
134.     DWORD       Reserved1[6];  
135.     FILETIME    ftCreateTime;  
136.     FILETIME    ftUserTime;  
137.     FILETIME    ftKernelTime;  
138.     UNICODE_STRING ProcessName;  
139.     DWORD       BasePriority;  
140.     DWORD       ProcessId;  
141.     DWORD       InheritedFromProcessId;  
142.     DWORD       HandleCount;  
143.     DWORD       Reserved2[2];  
144.     DWORD       VmCounters;  
145.     DWORD       dCommitCharge;  
146.     PVOID       ThreadInfos[1];  
147. }SYSTEM_PROCESS_INFORMATION, *PSYSTEM_PROCESS_INFORMATION;  
148.   
149.   
150. BOOL GetProcessListByNTDLL(){  
151.   
152.     // 导出函数  
153.     HMODULE hNtDll = GetModuleHandle("ntdll.dll");  
154.     ZWQUERYSYSTEMINFORMATION ZwQuerySystemInformation = (ZWQUERYSYSTEMINFORMATION)GetProcAddress(hNtDll,"ZwQuerySystemInformation");  
155.       
156.     ULONG  cbBuffer = 0x10000;  
157.     LPVOID pBuffer  = NULL;  
158.       
159.     pBuffer = malloc(cbBuffer);  
160.     if(pBuffer == NULL)  
161.         return -1;    
162.     // 获取进程信息  
163.     ZwQuerySystemInformation(SystemProcessesAndThreadsInformation,pBuffer,cbBuffer,NULL);  
164.     // 指针指向链表头部  
165.     PSYSTEM_PROCESS_INFORMATION pInfo = (PSYSTEM_PROCESS_INFORMATION)pBuffer;     
166.     // 输出结果  
167.     for(;;)  
168.     {  
169.         SetColor(0,13);  
170.         printf("PID:%d  ",pInfo->ProcessId);  
171.         SetColor(0,7);  
172.         printf("\t%ls\n",pInfo->ProcessName.Buffer);  
173.         if(pInfo->NextEntryDelta == 0)  
174.             break;        
175.         // 读取下一个节点  
176.         pInfo = (PSYSTEM_PROCESS_INFORMATION)(((PUCHAR)pInfo)+pInfo->NextEntryDelta);  
177.     }  
178.     // 释放缓冲区  
179.     free(pBuffer);  
180.   
181.     return TRUE;  
182. }  
183. void main(){  
184.   
185.     //GetProcessList();  
186.     //GetProcessListByPSAPi();  
187.     //GetProcessByWTSAPI();  
188.     GetProcessListByNTDLL();  
189. }  

原文地址

http://blog.csdn.net/earbao/article/details/8464715