//窗体创建时,创建ImageList,并且要设置给Treeview
LRESULT OnCreate(...)
{
int nSmallCx = ::GetSystemMetrics(SM_CXSMICON);
int nSmallCy = ::GetSystemMetrics(SM_CYSMICON);
m_ImgList.Create(nSmallCx, nSmallCy, ILC_MASK|ILC_COLOR32, 0, 1);
m_treeview.SetImageList(m_ImgList);
}
//往Treeview添加节点,图标从指定exe或dll文件获取,如果获取失败,使用指定序号图标
HTREEITEM AddTreeItem(CTreeViewCtrl& treeCtrl, LPCTSTR szText, LPCTSTR szFilePath,
int defIndex=0, DWORD dwParam=0, HTREEITEM hParent=TVI_ROOT, HTREEITEM hAfter=TVI_LAST)
{
HTREEITEM hItem = NULL;
SHFILEINFO sfi;
memset(&sfi, 0, sizeof(sfi));
if(0 != SHGetFileInfo(szFilePath, NULL, &sfi, sizeof(sfi), SHGFI_ICON))
{
int index = treeCtrl.GetImageList().AddIcon(sfi.hIcon);
hItem = treeCtrl.InsertItem(TVIF_TEXT|TVIF_IMAGE|TVIF_PARAM|TVIF_SELECTEDIMAGE, szText, index, index, 0, 0, dwParam, hParent, hAfter);
}
else
{
hItem = treeCtrl.InsertItem(TVIF_TEXT|TVIF_IMAGE|TVIF_PARAM|TVIF_SELECTEDIMAGE, szText, defIndex, defIndex, 0, 0, dwParam, hParent, hAfter);
}
return hItem;
}
void ListProcessModules(DWORD dwPId)
{
m_treeview.SetRedraw(FALSE);
m_treeview.DeleteAllItems();
CImageList& imageList = m_treeview.GetImageList();
imageList.RemoveAll();
//添加系统EXE图标
imageList.AddIcon(LoadIcon(NULL, IDI_APPLICATION));
//添加系统dll图标
TCHAR szSysPath[MAX_PATH] = {0};
::GetSystemDirectory(szSysPath, sizeof(szSysPath)/sizeof(szSysPath[0]));
_tcscat_s(szSysPath, _T("//Shell32.dll"));
SHFILEINFO sfi;
memset(&sfi, 0, sizeof(sfi));
if(0 != SHGetFileInfo(szSysPath, NULL, &sfi, sizeof(sfi), SHGFI_ICON))
{
int index = imageList.AddIcon(sfi.hIcon);
}
//打开进程,枚举模块
HANDLE hProcess = ::OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ|PROCESS_VM_OPERATION, FALSE, dwPId);
if (hProcess)
{
HMODULE hMods[1024];
DWORD cbNeeded = 0;
if( ::EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded))
{
HTREEITEM hRoot = TVI_ROOT;
TCHAR szText[MAX_PATH] = {0};
TCHAR szProcessName[MAX_PATH] = _T("<unknown>");
::GetModuleFileNameEx( hProcess, hMods[0], szProcessName, sizeof(szProcessName)/sizeof(TCHAR) );
_stprintf_s(szText, _T("[0x%X]/t%s"), dwPId, szProcessName );
//添加进程节点
hRoot = AddTreeItem(m_treeview, szText, szProcessName);
for (DWORD i = 0; i < (cbNeeded / sizeof(HMODULE)); i++ )
{
TCHAR szModName[MAX_PATH];
if ( ::GetModuleFileNameEx( hProcess, hMods[i], szModName, sizeof(szModName)/sizeof(TCHAR)))
{
_stprintf_s(szText, _T("[0x%08X]/t%s"), hMods[i], szModName );
//添加模块子节点
AddTreeItem(m_treeview, szText, szModName, 1, 0, hRoot);
}
}
m_treeview.Expand(hRoot);
}
::CloseHandle(hProcess);
}
m_treeview.SetRedraw();
}