获取进程列表、进程命令行、结束进程

ゝ一世哀愁。 2022-08-13 13:55 313阅读 0赞

CString MyGetProcess()
 {
 	CString csTemp = "", csPid;
 	HANDLE hSnapshot, mehandle;
 	
 	hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
 
 	PROCESSENTRY32 pe;
 	MODULEENTRY32 me;
 
 	pe.dwSize = sizeof(PROCESSENTRY32);
 
 	Process32First(hSnapshot, &pe);
 	
 	do
 	{
 		mehandle = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pe.th32ProcessID);
 
 		me.dwSize = sizeof(MODULEENTRY32);
 
 		Module32First(mehandle, &me);
 
 		csPid.Format("%d", pe.th32ProcessID);
 
 		if (pe.th32ProcessID == 0)
 		{
 			csTemp = csTemp + pe.szExeFile + "/t" + csPid + "/tSystem" + "/r/n" ;
 		}
 		else
 		{
 			csTemp = csTemp + pe.szExeFile + "/t" + csPid + "/t" + me.szExePath + "/r/n" ;
 		}
 
 		CloseHandle(mehandle);
 
 	}while(Process32Next(hSnapshot, &pe));
 	
 	CloseHandle(hSnapshot);
 	
 	return csTemp;
 }

以上为转载，装载地址：[http://blog.csdn.net/hgreminem/article/details/4305084][http_blog.csdn.net_hgreminem_article_details_4305084]

就是获取进程的相关信息。

获取特定进程命令行：第三个参数为进程ID

TCHAR szPath[1024];
 HANDLE hProcess;
 hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,pe.th32ProcessID);
 GetProcessCommandLine(hProcess, szPath, 1024)

//获取进程命令行
 BOOL GetProcessCommandLine(HANDLE hProcess, LPTSTR pszCmdLine, DWORD cchCmdLine)
 {
 	BOOL bRet;
 	DWORD dwPos;
 	LPBYTE lpAddr;
 	DWORD_PTR dwRetLen;
 
 	bRet = FALSE;
 
 	dwPos = 0;
 	lpAddr = (LPBYTE)GetCommandLine;
 Win7:
 	if(lpAddr[dwPos] == 0xeb && lpAddr[dwPos + 1] == 0x05)
 	{
 		dwPos += 2;
 		dwPos += 5;
 Win8:
 		if(lpAddr[dwPos] == 0xff && lpAddr[dwPos + 1] == 0x25)
 		{
 			dwPos += 2;
 			lpAddr = *(LPBYTE*)(lpAddr + dwPos);
 
 			dwPos = 0;
 			lpAddr = *(LPBYTE*)lpAddr;
 WinXp:
 			if(lpAddr[dwPos] == 0xa1)
 			{
 				dwPos += 1;
 				lpAddr = *(LPBYTE*)(lpAddr + dwPos);
 				bRet = ReadProcessMemory(hProcess,
 					lpAddr,
 					&lpAddr,
 					sizeof(LPBYTE),
 					&dwRetLen);
 				if(bRet)
 				{
 					bRet = ReadProcessMemory(hProcess,
 						lpAddr,
 						pszCmdLine,
 						cchCmdLine,
 						&dwRetLen);
 				}
 			}
 		}
 		else
 		{ 
 			goto WinXp;
 		}
 	}
 	else
 	{
 		goto Win8;
 	}
 	return bRet;
 }

结束一个进程，在这里要特别注意一个问题，hProcess = OpenProcess(PROCESS\_ALL\_ACCESS,FALSE,pe.th32ProcessID);第一个参数必须为获取所有权限，否则会出现结束进程失败。这也是很容易犯的一个错误！

BOOL nRes = TerminateProcess(hProcess, 999 );
 int ierror=GetLastError();
 if( nRes == 0 )
 {
 MessageBox( _T("结束进程失败！") );
 }

[http_blog.csdn.net_hgreminem_article_details_4305084]: http://blog.csdn.net/hgreminem/article/details/4305084