枚举进程的所有模块

最新推荐文章于 2022-07-12 21:33:51 发布

NemoHu

最新推荐文章于 2022-07-12 21:33:51 发布

阅读量421

点赞数

CC 4.0 BY-SA版权

分类专栏： VC实用代码文章标签： function module each list path output

本文链接：https://blog.youkuaiyun.com/qq7183316/article/details/6134709

VC实用代码专栏收录该内容

45 篇文章

订阅专栏

本文提供了一个使用C++编写的示例代码，展示了如何通过调用Windows API函数来枚举系统中每个进程的所有模块，包括获取模块文件的完整路径。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Enumerating All Modules For a Process

To determine which processes have loaded a particular DLL, you must enumerate the modules for each process. The following sample code uses the EnumProcessModules function to enumerate the modules of current processes in the system.

#include <windows.h> #include <stdio.h> #include "psapi.h" void PrintModules( DWORD processID ) { HMODULE hMods[1024]; HANDLE hProcess; DWORD cbNeeded; unsigned int i; // Print the process identifier. printf( "/nProcess ID: %u/n", processID ); // Get a list of all the modules in this process. hProcess = OpenProcess( PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processID ); if (NULL == hProcess) return; if( EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded)) { for ( i = 0; i < (cbNeeded / sizeof(HMODULE)); i++ ) { char szModName[MAX_PATH]; // Get the full path to the module's file. if ( GetModuleFileNameEx( hProcess, hMods[i], szModName, sizeof(szModName))) { // Print the module name and handle value. printf("/t%s (0x%08X)/n", szModName, hMods[i] ); } } } CloseHandle( hProcess ); } void main( ) { // Get the list of process identifiers. DWORD aProcesses[1024], cbNeeded, cProcesses; unsigned int i; if ( !EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) ) return; // Calculate how many process identifiers were returned. cProcesses = cbNeeded / sizeof(DWORD); // Print the name of the modules for each process. for ( i = 0; i < cProcesses; i++ ) PrintModules( aProcesses[i] ); }
The main function obtains a list of processes by using the EnumProcesses function. For each process, the main function calls the PrintModules function, passing it the process identifier. PrintModules in turn calls the OpenProcess function to obtain the process handle. If OpenProcess fails, the output shows only the process identifier. For example, OpenProcess fails for the Idle and CSRSS processes because their access restrictions prevent user-level code from opening them. Next, PrintModules calls the EnumProcessModules function to obtain the module handles function. Finally, PrintModules calls the GetModuleFileNameEx function, once for each module, to obtain the module names.