C++扫描系统进程源码

标签：pid   进程和线程   process   base   sea   invalid   als   过程   扫描   

#include <windows.h>  
#include <tlhelp32.h>  
#include <tchar.h>  
#include <stdio.h>  
#include<iostream>  
using namespace std;  
int main()  
{  
    HANDLE hProcessSnap;  
    HANDLE hProcess;  

    if(hProcessSnap == INVALID_HANDLE_VALUE)  
    {  
        cout<<"快照创建失败"<<endl;  
        return 0;  
    }  
    pe32.dwSize = sizeof(PROCESSENTRY32);  
    if(Process32First( hProcessSnap, &pe32) == NULL)  
    {  
        cout<<"error"<<endl;  
        CloseHandle(hProcessSnap);  

    }  
    int i = 0;  
    do{  
        cout<<"------------"<<i++<<"个进程------------------------"<<endl;  
        _tprintf( TEXT("nPROCESS NAME: %s"), pe32.szExeFile );  
        cout<<endl;  
        cout<< "Process ID = "<< pe32.th32ProcessID <<endl;  
        cout<< "Thread count = "<<pe32.cntThreads <<endl;   
        cout<< "Parent process ID = "<< pe32.th32ParentProcessID <<endl;;   
        cout<< "Priority base = "<< pe32.pcPriClassBase <<endl;   
    }while( Process32Next( hProcessSnap, &pe32) );  
    return 0;  

}  

当然，上面程序是我从一个程序中摘出来的，这是源程序，忘了引用的哪了，如果作者看到，请告知引用地址。这个程序实现了对系统进程，单个进程和线程的快照，主要还是拿几个函数，有时间的话做一个可视化的，和大家分享

#include <windows.h>  
#include <tlhelp32.h>  
#include <tchar.h>  
#include <stdio.h>  
BOOL GetProcessList( );  
BOOL ListProcessModules( DWORD dwPID );  
BOOL ListProcessThreads( DWORD dwOwnerPID );  
void main( )  
{   
    GetProcessList( );  
}  
BOOL GetProcessList( )  
{   
    HANDLE hProcessSnap;   
    HANDLE hProcess;   
    hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );   
    CreateToolhelp32Snapshot函数为指定的进程、进程使用的堆[HEAP]、模块[MODULE]、线程[THREAD]）建立一个快照[snapshot]。 　　 
    if( hProcessSnap == INVALID_HANDLE_VALUE )   
    {   
        printError( TEXT("CreateToolhelp32Snapshot (of processes)") );   
        return( FALSE );   
    if( !Process32First( hProcessSnap, &pe32 ) )   
    {   
        ( FALSE );   
    do {  
        printf( "nn=====================================================" );   
        _tprintf( TEXT("nPROCESS NAME: %s"), pe32.szExeFile );   
        dwPriorityClass = 0;   
        hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID );   
        OpenProcess 函数用来打开一个已存在的进程对象,并返回进程的句柄。　　 
        if( hProcess == NULL )  
            printError( TEXT("OpenProcess") );   
        else {   
            dwPriorityClass = GetPriorityClass( hProcess );   
            if( !dwPriorityClass )   
                printError( TEXT("GetPriorityClass") );   
            CloseHandle( hProcess );   
        }   
        printf( "n Process ID = 0x%08X", pe32.th32ProcessID );   
        printf( "n Thread count = %d", pe32.cntThreads );   
        printf( "n Parent process ID = 0x%08X", pe32.th32ParentProcessID );   
        printf( "n Priority base = %d", pe32.pcPriClassBase );   
        if( dwPriorityClass )   
    } while( Process32Next( hProcessSnap, &pe32 ) );  
    CloseHandle( hProcessSnap );   
    return( TRUE );  
}  
BOOL ListProcessModules( DWORD dwPID )  
{  
    HANDLE hModuleSnap = INVALID_HANDLE_VALUE;   
    hModuleSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwPID );  
    if( hModuleSnap == INVALID_HANDLE_VALUE )   
    {  
        printError( TEXT("CreateToolhelp32Snapshot (of modules)") );   
        return( FALSE );  
    if( !Module32First( hModuleSnap, &me32 ) )   
    {  
        return( FALSE );  
    do {  
        _tprintf( TEXT("nn MODULE NAME: %s"), me32.szModule );  
        _tprintf( TEXT("n Executable = %s"), me32.szExePath );  
        printf( "n Process ID = 0x%08X", me32.th32ProcessID );  
        printf( "n Ref count (g) = 0x%04X", me32.GlblcntUsage );  
        printf( "n Ref count (p) = 0x%04X", me32.ProccntUsage );  
        printf( "n Base address = 0x%08X", (DWORD) me32.modBaseAddr );   
        printf( "n Base size = %d", me32.modBaseSize );  
    } while( Module32Next( hModuleSnap, &me32 ) );   
    CloseHandle( hModuleSnap );   
    return( TRUE );  
}  
BOOL ListProcessThreads( DWORD dwOwnerPID )   
{   
    HANDLE hThreadSnap = INVALID_HANDLE_VALUE;   
    hThreadSnap = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 );   
    if( hThreadSnap == INVALID_HANDLE_VALUE )   
    if( !Thread32First( hThreadSnap, &te32 ) )   
    {  
        return( FALSE );  
    do {   
        if( te32.th32OwnerProcessID == dwOwnerPID )   
        {   
            printf( "nn THREAD ID = 0x%08X", te32.th32ThreadID );   
            printf( "n Base priority = %d", te32.tpBasePri );  
            printf( "n Delta priority = %d", te32.tpDeltaPri );   
        }   
    } while( Thread32Next(hThreadSnap, &te32 ) );   
    CloseHandle( hThreadSnap );   
    return( TRUE );  
}  
{   
    DWORD eNum;   
    TCHAR sysMsg[256];   
    eNum = GetLastError( );   
    p = sysMsg;  
        ++p;   
    do {  
    _tprintf( TEXT("n WARNING: %s failed with error %d (%s)"), msg, eNum, sysMsg );  
}   

C++扫描系统进程源码

标签：pid   进程和线程   process   base   sea   invalid   als   过程   扫描   

原文地址：http://blog.51cto.com/14141172/2333203