在Windows上通过ctypes遍历进程

最新推荐文章于 2025-04-29 14:13:09 发布

原创最新推荐文章于 2025-04-29 14:13:09 发布 · 3.1k 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#windows #import #class

c++程序员学python3.1.2 专栏收录该内容

16 篇文章

订阅专栏

该博客介绍了如何在Python中利用ctypes库遍历Windows系统的进程信息。通过调用CreateToolhelp32Snapshot、Process32First和Process32Next等Windows API，获取并打印出进程的exe文件名、父进程ID和进程ID。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

import ctypes
import sys

TH32CS_SNAPPROCESS = 0x00000002
class PROCESSENTRY32(ctypes.Structure):
     _fields_ = [("dwSize", ctypes.c_ulong),
                 ("cntUsage", ctypes.c_ulong),
                 ("th32ProcessID", ctypes.c_ulong),
                 ("th32DefaultHeapID", ctypes.c_ulong),
                 ("th32ModuleID", ctypes.c_ulong),
                 ("cntThreads", ctypes.c_ulong),
                 ("th32ParentProcessID", ctypes.c_ulong),
                 ("pcPriClassBase", ctypes.c_ulong),
                 ("dwFlags", ctypes.c_ulong),
                 ("szExeFile", ctypes.c_char * 260)]

def getProcList():
    CreateToolhelp32Snapshot = ctypes.windll.kernel32.CreateToolhelp32Snapshot
    Process32First = ctypes.windll.kernel32.Process32First
    Process32Next = ctypes.windll.kernel32.Process32Next
    CloseHandle = ctypes.windll.kernel32.CloseHandle
    
    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
    
    pe32 = PROCESSENTRY32()
    pe32.dwSize = ctypes.sizeof(PROCESSENTRY32)
    if Process32First(hProcessSnap,ctypes.byref(pe32)) == False:
        return
    while True:
        yield pe32
        if Process32Next(hProcessSnap,ctypes.byref(pe32)) == False:
            break
    CloseHandle(hProcessSnap)


if __name__ =='__main__':
    procList = getProcList()
    for proc in procList:
        print("proc.szExeFile=%s, proc.th32ParentProcessID=%d, proc.th32ProcessID=%d" % (proc.szExeFile, proc.th32ParentProcessID, proc.th32ProcessID))