获取进程及父进程的两种方式

最新推荐文章于 2022-09-05 15:15:50 发布

weixin_30580341

最新推荐文章于 2022-09-05 15:15:50 发布

阅读量371

点赞数

CC 4.0 BY-SA版权

原文链接：http://www.cnblogs.com/jkcx/p/7463506.html

本文提供了一种方法来获取指定进程的ID及其父进程的ID。通过使用Windows API函数和自定义函数，实现了从进程名称查找进程ID，并进一步获取其父进程ID的功能。

#include <windows.h>
#include <TlHelp32.h>
#include <stdio.h>
#include <wtypes.h>
#include <iostream>

#define ProcessBasicInformation 0  

typedef struct
{
    DWORD ExitStatus;
    DWORD PebBaseAddress;
    DWORD AffinityMask;
    DWORD BasePriority;
    ULONG UniqueProcessId;
    ULONG InheritedFromUniqueProcessId;
}   PROCESS_BASIC_INFORMATION;


// ntdll!NtQueryInformationProcess (NT specific!)  
//  
// The function copies the process information of the  
// specified type into a buffer  
//  
// NTSYSAPI  
// NTSTATUS  
// NTAPI  
// NtQueryInformationProcess(  
//    IN HANDLE ProcessHandle,              // handle to process  
//    IN PROCESSINFOCLASS InformationClass, // information type  
//    OUT PVOID ProcessInformation,         // pointer to buffer  
//    IN ULONG ProcessInformationLength,    // buffer size in bytes  
//    OUT PULONG ReturnLength OPTIONAL      // pointer to a 32-bit  
//                                          // variable that receives  
//                                          // the number of bytes  
//                                          // written to the buffer   
// ); 
typedef LONG(__stdcall *PROCNTQSIP)(HANDLE, UINT, PVOID, ULONG, PULONG);


DWORD GetParentProcessIDBYID(DWORD dwProcessId)
{
    LONG                        status;
    DWORD                       dwParentPID = (DWORD)-1;
    HANDLE                      hProcess;
    PROCESS_BASIC_INFORMATION   pbi;

    PROCNTQSIP NtQueryInformationProcess = (PROCNTQSIP)GetProcAddress(
        GetModuleHandle(L"ntdll"), "NtQueryInformationProcess");

    if (NULL == NtQueryInformationProcess)
    {
        return (DWORD)-1;
    }
    // Get process handle
    hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwProcessId);
    if (!hProcess)
    {
        return (DWORD)-1;
    }

    // Retrieve information
    status = NtQueryInformationProcess(hProcess,
        ProcessBasicInformation,
        (PVOID)&pbi,
        sizeof(PROCESS_BASIC_INFORMATION),
        NULL
        );

    // Copy parent Id on success
    if (!status)
    {
        dwParentPID = pbi.InheritedFromUniqueProcessId;
    }

    CloseHandle(hProcess);

    return dwParentPID;

}






int GetProcessID(WCHAR* ProcessName)
{

    HANDLE PHANDLE = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
    if (PHANDLE == INVALID_HANDLE_VALUE)
    {
        printf_s("创建进行快照失败\n");
        return -1;
    }

    PROCESSENTRY32 pe32;
    pe32.dwSize = sizeof(pe32);
    pe32.dwFlags = sizeof(pe32);
    BOOL hProcess = Process32First(PHANDLE, &pe32);

    while (hProcess)
    {
        //std::wcout << pe32.szExeFile << "\r\n";
        //std::wcout << pe32.th32ParentProcessID << "\r\n";

        if (!wcscmp(pe32.szExeFile, ProcessName))
        {
            return pe32.th32ProcessID;
        }

        hProcess = Process32Next(PHANDLE, &pe32);
    }

    return 0; // operation failed (process was not found)
}

int GetParentProcessID(WCHAR* ProcessName)
{

    HANDLE PHANDLE = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
    if (PHANDLE == INVALID_HANDLE_VALUE)
    {
        printf_s("创建进行快照失败\n");
        return -1;
    }

    PROCESSENTRY32 pe32;
    pe32.dwSize = sizeof(pe32);
    pe32.dwFlags = sizeof(pe32);
    BOOL hProcess = Process32First(PHANDLE, &pe32);

    while (hProcess)
    {
        //std::wcout << pe32.szExeFile << "\r\n";
        //std::wcout << pe32.th32ParentProcessID << "\r\n";

        if (!wcscmp(pe32.szExeFile, ProcessName))
        {
            return pe32.th32ParentProcessID;
        }

        hProcess = Process32Next(PHANDLE, &pe32);
    }

    return 0; // operation failed (process was not found)
}



void C2W(const char* szSrc, WCHAR* wszDst, int nMaxLen)

{

    int vMinLen = MultiByteToWideChar(CP_ACP, 0, szSrc, -1, NULL, 0);

    if (vMinLen > nMaxLen)

    {

        MessageBoxA(NULL, szSrc, "转换成UNICODE字串失败", MB_ICONWARNING);

        return;

    }

    MultiByteToWideChar(CP_ACP, 0, szSrc, -1, wszDst, vMinLen);

}

void main()
{
    
    char proc[64];
    WCHAR buf[64];
    scanf_s("%s", &proc, 63);
    
    //printf("进程:%s\n", proc);

    C2W(proc, buf, sizeof(buf));

    int pid = GetProcessID(buf);
    printf("进程ID:%d\n", pid);

    int ppid = GetParentProcessID(buf);
    printf("父进程ID:%d\n", ppid);

    int ppid2 = GetParentProcessIDBYID(pid);
    printf("父进程ID2:%d\n", ppid2);
    //printf("%d", Attach(buf));
    system("pause\n");
}

转载于:https://www.cnblogs.com/jkcx/p/7463506.html