CreateToolhelp32Snapshot快照查看进程模块及线程

 

 

#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>

void printError(const WCHAR *format, ...)
{
  DWORD eNum;
  WCHAR sysMsg[256]={0};

  eNum = GetLastError( );
  FormatMessageW( FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
    NULL, eNum,
    MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), // Default language
    sysMsg, 256, NULL );

  WCHAR msg[1024];
  va_list arg;  
  va_start(arg, format);
  int charSize = vswprintf_s(msg, format, arg);
  va_end(arg);

  // Display the message
  wprintf_s( L"\n  WARNING: %s failed with error %08X (%s)\n", msg, eNum, sysMsg );
}

BOOL ListProcessThread(DWORD dwOwnerPID) 
{ 
  HANDLE        hThreadSnap = NULL; 
  BOOL          bRet        = FALSE; 
  THREADENTRY32 te32        = {0}; 

  // Take a snapshot of all threads currently in the system. 

  hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); 
  if (hThreadSnap == (HANDLE)-1) 
  {
    printError(L"CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD)");
    return (FALSE); 
  }

  // Fill in the size of the structure before using it. 
  te32.dwSize = sizeof(te32);  
  // Walk the thread snapshot to find all threads of the process. 
  // If the thread belongs to the process, add its information 
  // to the display list. 
  if (Thread32First(hThreadSnap, &te32)) 
  { 
    do 
    { 
      if (te32.th32OwnerProcessID == dwOwnerPID) 
      { 
        wprintf( L"\n   TID             %d", te32.th32ThreadID); 
        wprintf( L"\n   Owner PID       %d", te32.th32OwnerProcessID); 
        wprintf( L"\n   Delta Priority  %d", te32.tpDeltaPri); 
        wprintf( L"\n   Base Priority   %d\n", te32.tpBasePri); 
        bRet = TRUE; 
      } 
    }while (Thread32Next(hThreadSnap, &te32)); 
  } 
  else 
  {
    printError(L"Thread32First(hThreadSnap)");
    bRet = FALSE;          // could not walk the list of threads 
  }

  // Do not forget to clean up the snapshot object. 
  CloseHandle (hThreadSnap); 

  return (bRet); 
} 

BOOL ListProcessModules( DWORD dwPID ) 
{ 
  BOOL bRet = FALSE;
  HANDLE hModuleSnap = INVALID_HANDLE_VALUE; 
  MODULEENTRY32W me32; 

  //  Take a snapshot of all modules in the specified process. 
  hModuleSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwPID ); 
  if( hModuleSnap != INVALID_HANDLE_VALUE ) 
  {
    //  Set the size of the structure before using it. 
    me32.dwSize = sizeof( me32 ); 

    //  Retrieve information about the first module, 
    //  and exit if unsuccessful 
    if( Module32FirstW( hModuleSnap, &me32 ) ) 
    {
      //  Now walk the module list of the process, 
      //  and display information about each module 
      do 
      { 
        wprintf( L"\n\n   MODULE NAME:     %s",             me32.szModule ); 
        wprintf( L"\n     executable     = %s",             me32.szExePath ); 
        wprintf( L"\n     process ID     = 0x%08X",         me32.th32ProcessID ); 
        wprintf( L"\n     ref count (g)  =     0x%04X",     me32.GlblcntUsage ); 
        wprintf( L"\n     ref count (p)  =     0x%04X",     me32.ProccntUsage ); 
        wprintf( L"\n     base address   = 0x%p",           me32.modBaseAddr ); 
        wprintf( L"\n     base size      = %d",             me32.modBaseSize ); 

      } while( Module32NextW( hModuleSnap, &me32 ) ); 

      bRet = TRUE; 
    }
    else
    { 
      printError( L"Module32First" );  // Show cause of failure 
    } 
    //  Do not forget to clean up the snapshot object. 
    CloseHandle( hModuleSnap ); 
  }
  else
  { 
    printError( L"CreateToolhelp32Snapshot (of modules %d)", dwPID); 
  } 
  return( bRet ); 
} 

BOOL GetProcessList() 
{ 
  HANDLE         hProcessSnap = NULL; 
  BOOL           bRet      = FALSE; 
  PROCESSENTRY32W pe32      = {0}; 

  //  Take a snapshot of all processes in the system. 

  hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); 

  if (hProcessSnap == (HANDLE)-1) 
  {
    printError( L"CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS)");
    return (FALSE); 
  }

  //  Fill in the size of the structure before using it. 

  pe32.dwSize = sizeof(pe32); 

  //  Walk the snapshot of the processes, and for each process, 
  //  display information. 

  if (Process32FirstW(hProcessSnap, &pe32)) 
  { 
    DWORD         dwPriorityClass; 

    do 
    { 
      // Get the actual priority class. 
      HANDLE hProcess; 
      hProcess = OpenProcess (PROCESS_ALL_ACCESS, 
        FALSE, pe32.th32ProcessID); 
      dwPriorityClass = GetPriorityClass (hProcess); 
      CloseHandle (hProcess); 

      // Print the process's information. 
      wprintf( L"\nPriority Class Base/t%d\n", 
        pe32.pcPriClassBase); 
      wprintf( L"PID/t/t/t%d\n", pe32.th32ProcessID);
      wprintf( L"Thread Count/t/t%d\n", pe32.cntThreads);

      ListProcessModules(pe32.th32ProcessID);
      ListProcessThread(pe32.th32ProcessID);

    }while (Process32NextW(hProcessSnap, &pe32)); 
    bRet = TRUE; 
  } 
  else 
  {
    printError( L"Process32First(hProcessSnap)" );
    bRet = FALSE;    // could not walk the list of processes 
  }

  // Do not forget to clean up the snapshot object. 
  CloseHandle (hProcessSnap); 
  return (bRet); 
}