检查父进程是不是explorer

 

#include <iostream>
#include <stdio.h>
#include <stdlib.h>
#include <Windows.h>
#include <process.h>
#include <Winternl.h>
#include <Tlhelp32.h.>
#include <tchar.h>

using std::cout;
using std::endl;

DWORD get_explore_pid() {

	/*
	const TCHAR szExplorer[] = TEXT("explorer.exe");
	PROCESSENTRY32 pe;
	pe.dwSize = sizeof PROCESSENTRY32;
	DWORD dwPID = 0;

	HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

	bool bFind = Process32First(hSnap, &pe);
	while (bFind) {
		if (0 == _tcscmp(pe.szExeFile, szExplorer)) {
			dwPID = pe.th32ProcessID;
			break;
		}
		bFind = Process32Next(hSnap, &pe);
	}
	CloseHandle(hSnap);
	return dwPID;
	*/
	DWORD pid = 0;
	GetWindowThreadProcessId(
		GetShellWindow(),
		&pid
	);
	return pid;
}

DWORD get_ppid(DWORD dwTargetPID) {
	PROCESSENTRY32 pe;
	pe.dwSize = sizeof PROCESSENTRY32;
	DWORD ppid = 0;

	HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

	bool bFind = Process32First(hSnap, &pe);
	while (bFind) {
		if (pe.th32ProcessID == dwTargetPID) {
			ppid = pe.th32ParentProcessID;
			break;
		}
		bFind = Process32Next(hSnap, &pe);
	}
	CloseHandle(hSnap);
	return ppid;
}

bool check_is_create_by_explorer() {
	DWORD ppid = get_ppid(GetCurrentProcessId());

	if (ppid  == get_explore_pid()) {
		return true;
	}
	return false;
}

int main(){
    cout << check_is_create_by_explorer() << endl;
return 0;
}