API了解的多了,很容易混乱,在调试一节中,提到打开进程和创建进程。
从名字上来说,创建进程,就是创建了一个新的进程,而打开进程,是为了获取已经运行了的进程的句柄。
MSDN解释,说的很清楚
OpenProcess
function: Opens an existing local process object.
return: If the function succeeds, the return value is an open handle to the specified process.
HANDLE WINAPI OpenProcess(
_In_ DWORD dwDesiredAccess,
_In_ BOOL bInheritHandle,
_In_ DWORD dwProcessId
);
CreateProcess
function: Creates a new process and its primary thread. The new process runs in the security context of the calling process.
return: If the function succeeds, the return value is nonzero.
BOOL WINAPI CreateProcess(
_In_opt_ LPCTSTR lpApplicationName,
_Inout_opt_ LPTSTR lpCommandLine,
_In_opt_ LPSECURITY_ATTRIBUTES lpProcessAttributes,
_In_opt_ LPSECURITY_ATTRIBUTES lpThreadAttributes,
_In_ BOOL bInheritHandles,
_In_ DWORD dwCreationFlags,
_In_opt_ LPVOID lpEnvironment,
_In_opt_ LPCTSTR lpCurrentDirectory,
_In_ LPSTARTUPINFO lpStartupInfo,
_Out_ LPPROCESS_INFORMATION lpProcessInformation
);
也就是说,打开进程,该进程有PID,是正在运行的程序 ,而创建进程是创建一个新的进程,此时该程序没有PID,创建完成之后就有了。