源代码如下:procedure CheckParentProc();
var //检查自己的进程的父进程
Pn: TProcesseNtry32;
Handle :THandle;
H, ParentProc, ExplorerProc: Hwnd;
Found : Boolean;
begin
H := 0;
ParentProc := 0;
ExplorerProc := 0; //得到所有进程的列表快照
Handle := CreateToolhelp32Snapshot(TH32CS_SNAPALL, 0);
Found := Process32First(Handle, Pn); //查找进程 if Found then
ShowMessage('Found = True')
else
ShowMessage('Found = False'); while Found do //遍历所有进程
begin
if UpperCase(StrPas(Pn.szExeFile)) = UpperCase(ExtractFileName(ParamStr(0))) then //自己的进程
begin
ParentProc := Pn.th32ParentProcessID; //得到父进程的进程ID
H := OpenProcess(PROCESS_ALL_ACCESS, True, Pn.th32ParentProcessID); //父进程的句柄 returns a handle of an existing process object.
end
else if UpperCase(StrPas(Pn.szExeFile)) = 'EXPLORER.EXE' then
ExplorerProc := Pn.th32ProcessID; //Explorer的PID Form1.ListBox1.Items.Add(StrPas(Pn.szExeFile));
Found := Process32Next(Handle, Pn); //查找下一个
end;
CloseHandle(Handle); //if (ParentProc) = (ExplorerProc) then
ShowMessage('Sucess!!');
end;
==================================
当if (ParentProc) = (ExplorerProc) then 被注释掉时,Found 为真。当不注释掉时,Found 为假。我就不清楚了,为真为假跟if有什么关系呀?请教一下。
var //检查自己的进程的父进程
Pn: TProcesseNtry32;
Handle :THandle;
H, ParentProc, ExplorerProc: Hwnd;
Found : Boolean;
begin
H := 0;
ParentProc := 0;
ExplorerProc := 0; //得到所有进程的列表快照
Handle := CreateToolhelp32Snapshot(TH32CS_SNAPALL, 0);
Found := Process32First(Handle, Pn); //查找进程 if Found then
ShowMessage('Found = True')
else
ShowMessage('Found = False'); while Found do //遍历所有进程
begin
if UpperCase(StrPas(Pn.szExeFile)) = UpperCase(ExtractFileName(ParamStr(0))) then //自己的进程
begin
ParentProc := Pn.th32ParentProcessID; //得到父进程的进程ID
H := OpenProcess(PROCESS_ALL_ACCESS, True, Pn.th32ParentProcessID); //父进程的句柄 returns a handle of an existing process object.
end
else if UpperCase(StrPas(Pn.szExeFile)) = 'EXPLORER.EXE' then
ExplorerProc := Pn.th32ProcessID; //Explorer的PID Form1.ListBox1.Items.Add(StrPas(Pn.szExeFile));
Found := Process32Next(Handle, Pn); //查找下一个
end;
CloseHandle(Handle); //if (ParentProc) = (ExplorerProc) then
ShowMessage('Sucess!!');
end;
==================================
当if (ParentProc) = (ExplorerProc) then 被注释掉时,Found 为真。当不注释掉时,Found 为假。我就不清楚了,为真为假跟if有什么关系呀?请教一下。
The calling application must set the dwSize member of PROCESSENTRY32 to the size, in bytes, of the structure. 谢谢了!!