frmprocess.frm

武林外传外挂源代码

VERSION 5.00
Object = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}#2.0#0"; "mscomctl.ocx"
Begin VB.Form frmProcess 
   BorderStyle     =   4  'Fixed ToolWindow
   Caption         =   "进程列表"
   ClientHeight    =   3135
   ClientLeft      =   45
   ClientTop       =   315
   ClientWidth     =   3375
   LinkTopic       =   "Form1"
   MaxButton       =   0   'False
   MinButton       =   0   'False
   ScaleHeight     =   3135
   ScaleWidth      =   3375
   ShowInTaskbar   =   0   'False
   Begin MSComctlLib.ListView lvProcessList 
      Height          =   3135
      Left            =   0
      TabIndex        =   0
      Top             =   0
      Width           =   3375
      _ExtentX        =   5953
      _ExtentY        =   5530
      View            =   3
      LabelWrap       =   -1  'True
      HideSelection   =   -1  'True
      FullRowSelect   =   -1  'True
      _Version        =   393217
      ForeColor       =   -2147483640
      BackColor       =   -2147483643
      BorderStyle     =   1
      Appearance      =   1
      NumItems        =   2
      BeginProperty ColumnHeader(1) {BDD1F052-858B-11D1-B16A-00C0F0283628} 
         Text            =   "进程名"
         Object.Width           =   3528
      EndProperty
      BeginProperty ColumnHeader(2) {BDD1F052-858B-11D1-B16A-00C0F0283628} 
         SubItemIndex    =   1
         Text            =   "句柄"
         Object.Width           =   1764
      EndProperty
   End
End
Attribute VB_Name = "frmProcess"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Option Explicit '强制变量声明

'定义进程结构
Private Type PROCESSENTRY32
    dwSize As Long
    cntUsage As Long
    th32ProcessID As Long '进程号
    th32DefaultHeapID As Long '堆栈号
    th32ModuleID As Long '模块号
    cntThreads As Long
    th32ParentProcessID As Long '父进程号
    pcPriClassBase As Long
    dwFlags As Long
    szExeFile As String * 260
End Type

Private Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal dwFlags As Long, ByVal th32ProcessID As Long) As Long
'在进程队列中获取首个进程的地址
Private Declare Function Process32First Lib "kernel32" (ByVal hSnapshot As Long, lppe As PROCESSENTRY32) As Long
'进程队列指针下移
Private Declare Function Process32Next Lib "kernel32" (ByVal hSnapshot As Long, lppe As PROCESSENTRY32) As Long
'打开进程
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal blnheritHandle As Long, ByVal dwAppProcessId As Long) As Long
'关闭进程
Private Declare Function TerminateProcess Lib "kernel32" (ByVal ApphProcess As Long, ByVal uExitCode As Long) As Long
'释放句柄
Private Declare Sub CloseHandle Lib "kernel32" (ByVal hPass As Long)
Private Const TH32CS_SNAPPROCESS = &H2&

'获取进程列表
Public Sub GetProcessList()
    Dim hSnapshot As Long
    Dim hProcess As Long
    Dim lPE As PROCESSENTRY32
    Dim li As ListItem
    '清除显示
    lvProcessList.ListItems.Clear
    '创建进程队列快照
    hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0&)
    If hSnapshot <> -1 Then
        lPE.dwSize = Len(lPE)
        '取首个进程的地址
        hProcess = Process32First(hSnapshot, lPE)
        '循环搜索
        Do While hProcess
            '显示进程信息
            Set li = lvProcessList.ListItems.Add(, , LCase$(Left(lPE.szExeFile, InStr(1, lPE.szExeFile, Chr(0)) - 1)))
            li.SubItems(1) = CStr(lPE.th32ProcessID)
            '取下一个进程的地址
            hProcess = Process32Next(hSnapshot, lPE)
        Loop
        '释放快照句柄
        CloseHandle hSnapshot
    End If
End Sub

Private Sub Form_Load()
    GetProcessList
End Sub

'被双击进程的进程ID
Private Sub lvProcessList_DblClick()
    dwProcessId = lvProcessList.SelectedItem.SubItems(1)
    hWndGame = FindWindow("TianLongBaBu WndClass", vbNullString)
    Unload Me
End Sub