枚举windows全系列(98 NT 2000以及后系列)进程--3

最新推荐文章于 2025-07-01 15:20:02 发布

conhacker

最新推荐文章于 2025-07-01 15:20:02 发布

阅读量2.1k

点赞数

CC 4.0 BY-SA版权

文章标签： windows winapi module null file callback

本文链接：https://blog.youkuaiyun.com/conhacker/article/details/530600

这段代码展示了如何使用WinAPI函数遍历Windows NT系统下的所有进程，包括获取进程ID，模块信息，并特别处理NTVDM.EXE进程内的16位任务。通过加载PSAPI.DLL和VDMDBG.DLL库，调用相关函数实现进程和模块的枚举。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

#ifndef WINNT_PROCESS
#define WINNT_PROCESS
#define WIN32_LEAN_AND_MEAN

#include "StdAfx.h"
#include <windows.h>
#include <vdmdbg.h>
#include <psapi.h>

//全局变量,保存进程数目
strings FunProcessCount;

//Windows NT Functions
typedef BOOL (WINAPI *ENUMPROCESSES)(
          DWORD * lpidProcess, // array to receive the process identifiers
          DWORD cb,       ;       // size of the array
          DWORD * cbNeeded      // receives the number of bytes returned
          );

typedef BOOL (WINAPI *ENUMPROCESSMODULES)(
            HANDLE hProcess,      // handle to the process
            HMODULE * lphModule, // array to receive the module handles
            DWORD cb,             // size of the array
            LPDWORD lpcbNeeded    // receives the number of bytes returned
            );

typedef DWORD (WINAPI *GETMODULEFILENAME)(
            HANDLE hProcess,  // handle to the process
            HMODULE hModule,  // handle to the module
            LPTSTR lpstrFileName, // array to receive filename
            DWORD nSize   // size of filename array.
            );

typedef DWORD (WINAPI *GETMODULEBASENAME)(
            HANDLE hProcess,  // handle to the process
            HMODULE hModule,  // handle to the module
            LPTSTR lpstrFileName, // array to receive base name of module
            DWORD nSize   // size of module name array.
            );

typedef INT (WINAPI *VDMENUMTASKWOWEX)(
            DWORD dwProcessId, // ID of NTVDM process
            TASKENUMPROCEX fp, // address of our callback function
            LPARAM lparam);  // anything we want to pass to the callback function.

BOOL WINAPI show_processNT(DWORD dwThreadId,
                     WORD hMod16,
                     WORD hTask16,
                     PSZ pszModName,
                     PSZ FileName,
                     LPARAM lpUserDefined)
{
FunProcessCount.push_back(FileName);
    return TRUE;
}

void show_process (char const *FileName, DWORD ProcessID)
{
FunProcessCount.push_back(FileName);
}

void WinNT_Process(strings &ProcessList)
{
int iResult = 0;
//char string[256];
enum { max_num = 1024 };
DWORD process_ids [max_num];
DWORD num_processes;
    HANDLE psapi;
HANDLE vdmdbg;

    ENUMPROCESSES       EnumProcesses;
    GETMODULEFILENAME   GetModuleFileName;
    ENUMPROCESSMODULES EnumProcessModules;
VDMENUMTASKWOWEX VDMEnumTaskWOWEx;
GETMODULEBASENAME GetModuleBaseName;

psapi = LoadLibrary("PSAPI.DLL");
    vdmdbg = LoadLibrary("VDMDBG.DLL");

if ( NULL == psapi || NULL == vdmdbg )
        return;

VDMEnumTaskWOWEx = (VDMENUMTASKWOWEX)GetProcAddress(
        (HINSTANCE)vdmdbg, "VDMEnumTaskWOWEx");

EnumProcesses =(ENUMPROCESSES)GetProcAddress(
  (HINSTANCE)psapi, "EnumProcesses");

GetModuleFileName = (GETMODULEFILENAME)GetProcAddress(
  (HINSTANCE)psapi, "GetModuleFileNameExA");

GetModuleBaseName = (GETMODULEBASENAME)GetProcAddress(
  (HINSTANCE)psapi, "GetModuleBaseNameA");

EnumProcessModules = (ENUMPROCESSMODULES)GetProcAddress(
  (HINSTANCE)psapi, "EnumProcessModules");

if (
  NULL == VDMEnumTaskWOWEx ||
  NULL == EnumProcesses  ||
  NULL == GetModuleFileName ||
  NULL == GetModuleBaseName ||
  NULL == EnumProcessModules )
{
        return;
}
int success = EnumProcesses(process_ids, sizeof(process_ids),&num_processes);

    num_processes /= sizeof(process_ids[0]);

    if ( !success )
{
        return ;
    }

    for ( unsigned i=0; i<num_processes; i++)
{
        HANDLE process = OpenProcess(
            PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,
            FALSE,
            process_ids[i]);

        HMODULE modules[max_num];
        DWORD num_modules;
        char file_name[MAX_PATH];

        iResult = EnumProcessModules(process,modules,sizeof(modules), &num_modules);
  if(!iResult)
  {
   continue;
   iResult = GetLastError();
  }

        num_modules /= sizeof(modules[0]);

        if (GetModuleFileName(process,modules[0],file_name,sizeof(file_name)))
        {
   show_process(file_name, process_ids[i]);

   GetModuleBaseName(process,modules[0],file_name,sizeof(file_name));

            if ( 0 == _stricmp(file_name, "NTVDM.EXE"))
            {
                // We've got an NT VDM -- enumerate the processes
                // it contains.
                VDMEnumTaskWOWEx(process_ids[i], show_processNT, (long)&num_processes);
            }
        }
  else
  {
   continue;
   iResult = GetLastError();
  }
        CloseHandle(process);
    }
//拷贝所有的进程到主程序进程句柄
/*vector<string>::iterator tete;
for(tete=FunProcessCount.begin();tete!=FunProcessCount.end();tete++)
{
  printf("%s/n",(*tete).c_str());
  //cout<<(*tete).c_str()<<endl;
}*/
//copy(FunProcessCount.begin(),FunProcessCount.end(),ProcessList.begin());
ProcessList.clear();
ProcessList = FunProcessCount;

FreeLibrary((HINSTANCE)vdmdbg);
FreeLibrary((HINSTANCE)psapi);
}