1.提升进程访问权限
bool EnableDebugPriv()
{
HANDLE hToken;
LUID seDebugNameValue;
TOKEN_PRIVILEGES tkp;
OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,&hToken);
LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&seDebugNameValue);
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = seDebugNameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken,FALSE,&tkp,sizeof(tkp),NULL,NULL);
return true;
}2.根据进程名称得到ID，如果有多个运行实例，返回第一个枚举到的进程的ID
DWORD ProcessNameToId(LPCTSTR lpszProcessName)
{
HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
PROCESSENTRY32 pe;
pe.dwSize = sizeof(PROCESSENTRY32);
Process32First(hSnapShot,&pe);
do
{
if (!strcmp(lpszProcessName,pe.szExeFile))
{
return pe.th32ProcessID;
}
} while (Process32Next(hSnapShot,&pe));
}
3.
通过进程的PID得到进程的路径
CString GetProcessFullPath(DWORD idProcess)
{
CString str;
//得到进程句柄
HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,FALSE, idProcess);
if (NULL == hProcess)
return NULL;
//通过hProcess参数，得到指定进程的路径
DWORD dw = GetModuleFileNameEx(hProcess,
NULL,
str.GetBuffer(MAX_PATH),
MAX_PATH);
str.ReleaseBuffer();
CloseHandle(hProcess);
return str;
}
4.
通过PID得到进程调用的各个模块的全路径，显示在列表框
CString CModule::GetProcessModuleFullPath(DWORD PID)
{
HMODULE hMod[1024];
char szModName[MAX_PATH];
static TCHAR Buffer[MAX_PATH];
HANDLE hProcess;
DWORD cbNeed = 0;
m_listmod.DeleteAllItems();
hProcess = ::OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,FALSE,PID);
BOOL b = EnumProcessModules(hProcess, hMod, sizeof(hMod), &cbNeed);
if( hProcess == INVALID_HANDLE_VALUE && b == FALSE )
{
CloseHandle( hProcess );
return NULL;
}
for ( int i = 0; i <=(cbNeed / sizeof(HMODULE)); i++ )
{
if (GetModuleFileNameEx( hProcess, hMod[i], szModName,
sizeof(szModName)))
{
m_listmod.InsertItem(0,szModName);
wsprintf(Buffer,"0x%08x",hMod[i]);
m_listmod.SetItemText(0,1,Buffer);
}
}
CloseHandle( hProcess );
return NULL;
}
5.
通过点击，得到列表值
void OnClickProcessList()
{
UpdateData(TRUE);
//获得行号
int nItem = m_listpro.GetNextItem( -1, LVNI_ALL | LVNI_SELECTED);
//通过行号得到进程名
szFileName = m_listpro.GetItemText(nItem,0);
//通过行号得到PID
szPID= m_listpro.GetItemText(nItem,1);
}
posted on 2012-12-12 09:26
寻步 阅读(339)
评论(0) 编辑 收藏 引用 所属分类:
MFC