enumprocspa.cpp

《Windows应用程序捆绑核心编程》配套源码

// enumprocspa.cpp:枚举当前进程.
//
#include <windows.h>
#include <stdio.h>

typedef BOOL (WINAPI * ENUMPROCESSES)(
    DWORD * lpidProcess,  // 指向进程ID数组链.
    DWORD   cb,           // ID数组的大小，用字节计数. 
    DWORD * cbNeeded      // 返回的字节. 
);

typedef BOOL (WINAPI * ENUMPROCESSMODULES)(
    HANDLE hProcess,      // 进程句柄.
    HMODULE *lphModule,   // 指向模块句柄数组链.
    DWORD cb,             // 模块句柄数组大小，字节计数. 
    LPDWORD lpcbNeeded    // 存储所有模块句柄所需的字节数.
); 


typedef DWORD (WINAPI * GETMODULEFILENAMEEXA)(
    HANDLE hProcess,      // 进程句柄.
    HMODULE hModule,      // 模块句柄.
    LPSTR lpFilename,     // 存放模块全路径名. 
    DWORD nSize           // 缓冲区大小，字符计算.
);

BOOL UpdateProcessPrivilege( HANDLE hProcess, 
             LPCTSTR lpPrivilegeName = SE_DEBUG_NAME );

void main()
{
	UpdateProcessPrivilege(GetCurrentProcess());
	HMODULE hPsDll = LoadLibrary("PSAPI.DLL");
	
	ENUMPROCESSES pEnumProcesses  = 
		(ENUMPROCESSES)GetProcAddress(hPsDll, "EnumProcesses");
	
	ENUMPROCESSMODULES pEnumProcessModules =(ENUMPROCESSMODULES)
		GetProcAddress(hPsDll, "EnumProcessModules");
	
	GETMODULEFILENAMEEXA pGetModuleFileNameExA  =
		(GETMODULEFILENAMEEXA)
		GetProcAddress(hPsDll, "GetModuleFileNameExA");

	DWORD processcount;
	DWORD cbNeeded;
	DWORD ProcessId[1024];

	pEnumProcesses(ProcessId, sizeof(ProcessId), &cbNeeded);
	processcount=cbNeeded/sizeof(DWORD);

	HMODULE hModule;
    char szPath[MAX_PATH];
	
	for (DWORD i=0;i<processcount;i++)
	{
		//打开进程
		HANDLE hProcess=OpenProcess(
			PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,
			FALSE, ProcessId[i]);

		memset(szPath,0,sizeof(szPath));

		if (hProcess)
		{
			pEnumProcessModules(hProcess, 
				   &hModule, sizeof(hModule), &cbNeeded);
			pGetModuleFileNameExA(hProcess,
				   hModule, szPath, sizeof(szPath));
		    printf("ProcessID: %d (%s)\n",ProcessId[i],szPath);
		}
		else
			printf("Failed!!!\n");

		CloseHandle(hProcess);
	}

	getchar();  // 暂停.
}

BOOL UpdateProcessPrivilege( HANDLE hProcess, LPCTSTR lpPrivilegeName)
{
	HANDLE hToken;
	int iResult;
	TOKEN_PRIVILEGES TokenPrivileges;

	if (OpenProcessToken( hProcess, TOKEN_ALL_ACCESS, &hToken ) ) 
	{
		LUID destLuid;
		if (LookupPrivilegeValue( NULL, lpPrivilegeName, &destLuid ) ) 
		{
			TokenPrivileges.PrivilegeCount = 1;
			TokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
			TokenPrivileges.Privileges[0].Luid = destLuid;

			if ( iResult =AdjustTokenPrivileges( hToken, FALSE, 
				&TokenPrivileges, 0, NULL, NULL )) {
				return TRUE;    
			}
		}
	}
	return FALSE;
}