netstat_o.cpp

通过调用系统函数来遍历当前系统中所有进程并获取所有进程的PID

#include <windows.h>  
#include <stdio.h>  
   
  #define   NT_SUCCESS(Status)                    ((NTSTATUS)(Status)   >=   0)  
  #define   STATUS_INFO_LENGTH_MISMATCH           ((NTSTATUS)0xC0000004L)  
  #define   STATUS_BUFFER_TOO_SMALL               ((NTSTATUS)0xC0000023L)  
  #pragma   comment   (lib,"ws2_32.lib")    
  #pragma   comment   (lib,"advapi32.lib")    
   
   
  typedef   long         NTSTATUS;  
   
  typedef   struct   _IO_STATUS_BLOCK    
  {  
          NTSTATUS         Status;  
          ULONG            Information;  
  }   IO_STATUS_BLOCK,   *PIO_STATUS_BLOCK;  
   
  typedef   struct   _UNICODE_STRING    
  {  
          USHORT             Length;  
          USHORT             MaximumLength;  
          PWSTR              Buffer;  
  }   UNICODE_STRING,   *PUNICODE_STRING;  
   
   
  typedef   struct   _ANSI_STRING   {  
          USHORT   Length;  
          USHORT   MaximumLength;  
          PCHAR   Buffer;  
  }ANSI_STRING,*PANSI_STRING;  
   
  typedef   struct   _OBJECT_ATTRIBUTES    
  {  
          ULONG               Length;  
          HANDLE              RootDirectory;  
          PUNICODE_STRING     ObjectName;  
          ULONG               Attributes;  
          PVOID               SecurityDescriptor;  
          PVOID               SecurityQualityOfService;  
  }   OBJECT_ATTRIBUTES,   *POBJECT_ATTRIBUTES;        
   
  /*typedef   struct   _MIB_TCPROW  
  {  
          DWORD                 dwState;  
          DWORD                 dwLocalAddr;  
          DWORD                 dwLocalPort;  
          DWORD                 dwRemoteAddr;  
          DWORD                 dwRemotePort;  
  }   MIB_TCPROW,   *PMIB_TCPROW;*/ 
  typedef struct _MIB_TCPROW
  {  
	  DWORD	dwState; 
	  DWORD dwLocalAddr;  
	  DWORD dwLocalPort;  
	  DWORD dwRemoteAddr;
	  DWORD dwRemotePort;
	  DWORD dwOwningPid;
} MIB_TCPROW, *PMIB_TCPROW;//MIB_TCPROW_OWNER_PID

   
  typedef   struct   _MIB_UDPROW  
  {  
          DWORD                 dwLocalAddr;  
          DWORD                 dwLocalPort;  
  }   MIB_UDPROW,   *PMIB_UDPROW;  
   
  typedef   struct   _MIB_UDPTABLE   {      
          DWORD   dwNumEntries;    
          MIB_UDPROW   table[1];  
  }   MIB_UDPTABLE,   *PMIB_UDPTABLE;  
   
  typedef   struct   _MIB_TCPTABLE   {      
          DWORD   dwNumEntries;    
          MIB_TCPROW   table[1];  
  }   MIB_TCPTABLE,   *PMIB_TCPTABLE;  
   
  //*   Structure   of   an   entity   ID.  
  typedef   struct   TDIEntityID   {  
          ULONG               tei_entity;  
          ULONG               tei_instance;  
  }   TDIEntityID;  
   
  //*   Structure   of   an   object   ID.  
  typedef   struct   TDIObjectID   {  
          TDIEntityID   toi_entity;  
          ULONG               toi_class;  
          ULONG               toi_type;  
          ULONG               toi_id;  
  }   TDIObjectID;  
   
  typedef   struct   _MIB_TCPSTATS  
  {  
          DWORD                 dwRtoAlgorithm;  
          DWORD                 dwRtoMin;  
          DWORD                 dwRtoMax;  
          DWORD                 dwMaxConn;  
          DWORD                 dwActiveOpens;  
          DWORD                 dwPassiveOpens;  
          DWORD                 dwAttemptFails;  
          DWORD                 dwEstabResets;  
          DWORD                 dwCurrEstab;  
          DWORD                 dwInSegs;  
          DWORD                 dwOutSegs;  
          DWORD                 dwRetransSegs;  
          DWORD                 dwInErrs;  
          DWORD                 dwOutRsts;  
          DWORD                 dwNumConns;  
  }   MIB_TCPSTATS,   *PMIB_TCPSTATS;  
   
  typedef   struct   _MIB_UDPSTATS  
  {  
          DWORD                 dwInDatagrams;  
          DWORD                 dwNoPorts;  
          DWORD                 dwInErrors;  
          DWORD                 dwOutDatagrams;  
          DWORD                 dwNumAddrs;  
  }   MIB_UDPSTATS,*PMIB_UDPSTATS;  
   
  #define   MIB_TCP_STATE_CLOSED               1  
  #define   MIB_TCP_STATE_LISTEN               2  
  #define   MIB_TCP_STATE_SYN_SENT             3  
  #define   MIB_TCP_STATE_SYN_RCVD             4  
  #define   MIB_TCP_STATE_ESTAB                5  
  #define   MIB_TCP_STATE_FIN_WAIT1            6  
  #define   MIB_TCP_STATE_FIN_WAIT2            7  
  #define   MIB_TCP_STATE_CLOSE_WAIT           8  
  #define   MIB_TCP_STATE_CLOSING              9  
  #define   MIB_TCP_STATE_LAST_ACK             10  
  #define   MIB_TCP_STATE_TIME_WAIT            11  
  #define   MIB_TCP_STATE_DELETE_TCB           12  
   
  //  
  //   Possible   TCP   endpoint   states  
  //  
  static   char   TcpState[][32]   =   {  
          "???",  
          "CLOSED",  
          "LISTENING",  
          "SYN_SENT",  
          "SEN_RECEIVED",  
          "ESTABLISHED",  
          "FIN_WAIT",  
          "FIN_WAIT2",  
          "CLOSE_WAIT",  
          "CLOSING",  
          "LAST_ACK",  
          "TIME_WAIT"  
  };  
   
   
  #define   CONTEXT_SIZE                                 16  
   
  //#define       CO_TL_ENTITY                          0x400  
  //#define       INFO_CLASS_PROTOCOL                   0x200  
  //#define       INFO_TYPE_PROVIDER                    0x100  
   
  //#define       TCP_MIB_ADDRTABLE_ENTRY_ID            0x101  
  //#define       INFO_TYPE_CONNECTION                  0x300  
  //#define       CO_TL_TCP                             0x404  
  //   QueryInformationEx   IOCTL.   The   return   buffer   is   passed   as   the   OutputBuffer  
  //   in   the   DeviceIoControl   request.   This   structure   is   passed   as   the  
  //   InputBuffer.  
  //  
  struct tcp_request_query_information_ex {  
          TDIObjectID     ID;                                        //   object   ID   to   query.  
          ULONG   *     Context[CONTEXT_SIZE/sizeof(ULONG   *)];     //   multi-request   context.   Zeroed  
                                                                     //   for   the   first   request.  
  };  
   
  typedef struct tcp_request_query_information_ex  
                  TCP_REQUEST_QUERY_INFORMATION_EX,  
                  *PTCP_REQUEST_QUERY_INFORMATION_EX;  
   
  typedef  
  void  
  (NTAPI   *PIO_APC_ROUTINE)   (  
          IN   PVOID   ApcContext,  
          IN   PIO_STATUS_BLOCK   IoStatusBlock,  
          IN   ULONG   Reserved  
          );  
   
  typedef NTSTATUS (NTAPI *P_ZW_OPEN_FILE)(  
          OUT   PHANDLE   FileHandle,  
          IN   ACCESS_MASK   DesiredAccess,  
          IN   POBJECT_ATTRIBUTES   ObjectAttributes,  
          OUT   PIO_STATUS_BLOCK   IoStatusBlock,  
          IN   ULONG   ShareAccess,  
          IN   ULONG   OpenOptions  
          ); 
   P_ZW_OPEN_FILE pZwOpenFile;
   
  typedef    
  NTSTATUS  
  (NTAPI * P_NT_DEVICE_IO_CONTROL_FILE)(  
   
          IN   HANDLE                                 FileHandle,  
          IN   HANDLE                                 Event   OPTIONAL,  
          IN   PIO_APC_ROUTINE                        ApcRoutine   OPTIONAL,  
          IN   PVOID                                  ApcContext   OPTIONAL,  
          OUT   PIO_STATUS_BLOCK                      IoStatusBlock,  
          IN   ULONG                                  IoControlCode,  
          IN   PVOID                                  InputBuffer   OPTIONAL,  
          IN   ULONG                                  InputBufferLength,  
          OUT   PVOID                                 OutputBuffer   OPTIONAL,  
          IN   ULONG                                  OutputBufferLength   ); 
  P_NT_DEVICE_IO_CONTROL_FILE pNtDeviceIoControlFile;
  
  typedef ULONG (NTAPI *P_RTL_Nt_STATUS_TO_DOS_ERROR)(  
          IN   NTSTATUS   Status  
  );
  P_RTL_Nt_STATUS_TO_DOS_ERROR pRtlNtStatusToDosError;
   
  typedef  void   
  (NTAPI * P_RTL_INIT_UNICODE_STRING)(  
          PUNICODE_STRING   DestinationString,  
          PCWSTR   SourceString  
          );  
  P_RTL_INIT_UNICODE_STRING pRtlInitUnicodeString;
   
  extern   char   *get_error(void)  
  {  
          LPVOID   lpMsgBuf;