The following example obtains a list of running processes. First, the GetProcessList function takes a snapshot of the currently executing processes in the system using the CreateToolhelp32Snapshot function, then it walks through the list recorded in the snapshot, using the Process32First and Process32Next functions. For each process, the function calls GetProcessModule, which is defined in Traversing the module list. #include <windows.h> #include <tlhelp32.h> #include <stdio.h>BOOL GetProcessList () { HANDLE hProcessSnap = NULL; BOOL bRet = FALSE; PROCESSENTRY32 pe32 = {0};
// Take a snapshot of all processes in the system. hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hProcessSnap == INVALID_HANDLE_VALUE) return (FALSE);
// Fill in the size of the structure before using it. pe32.dwSize = sizeof(PROCESSENTRY32);
// Walk the snapshot of the processes, and for each process, // display information. if (Process32First(hProcessSnap, &pe32)) { DWORD dwPriorityClass; BOOL bGotModule = FALSE; MODULEENTRY32 me32 = {0};
do { bGotModule = GetProcessModule(pe32.th32ProcessID, pe32.th32ModuleID, &me32, sizeof(MODULEENTRY32)); if (bGotModule) { HANDLE hProcess;
// Get the actual priority class. hProcess = OpenProcess (PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID); dwPriorityClass = GetPriorityClass (hProcess); CloseHandle (hProcess); // Print the process's information. printf( "\nPriority Class Base\t%d\n", pe32.pcPriClassBase); printf( "PID\t\t\t%d\n", pe32.th32ProcessID); printf( "Thread Count\t\t%d\n", pe32.cntThreads); printf( "Module Name\t\t%s\n", me32.szModule); printf( "Full Path\t\t%s\n\n", me32.szExePath); } } while (Process32Next(hProcessSnap, &pe32)); bRet = TRUE; } else bRet = FALSE; // could not walk the list of processes
// Do not forget to clean up the snapshot object. CloseHandle (hProcessSnap); return (bRet); } Process32First Retrieves information about the first process encountered in a system snapshot. BOOL WINAPI Process32First( HANDLE hSnapshot, LPPROCESSENTRY32 lppe ); Parameters hSnapshot [in] Handle to the snapshot returned from a previous call to the CreateToolhelp32Snapshot function. lppe [in/out] Pointer to a PROCESSENTRY32 structure. Return Values Returns TRUE if the first entry of the process list has been copied to the buffer or FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the GetLastError function if no processes exist or the snapshot does not contain process information.Res The calling application must set the dwSize member of PROCESSENTRY32 to the size, in bytes, of the structure. Process32First changes dwSize to the number of bytes written to the structure. This will never be greater than the initial value of dwSize, but it may be smaller. If the value is smaller, do not rely on the values of any members whose offsets are greater than this value. To retrieve information about other processes recorded in the same snapshot, use the Process32Next function.For an example, see Taking a Snapshot and Viewing Processes. Requirements Windows NT/2000 or later: Requires Windows 2000 or later. Windows 95/98/Me: Requires Windows 95 or later. Header: Declared in Tlhelp32.h. Library: Use Kernel32.lib.
#include <tlhelp32.h>
#include <stdio.h>BOOL GetProcessList ()
{
HANDLE hProcessSnap = NULL;
BOOL bRet = FALSE;
PROCESSENTRY32 pe32 = {0};
// Take a snapshot of all processes in the system. hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hProcessSnap == INVALID_HANDLE_VALUE)
return (FALSE);
// Fill in the size of the structure before using it. pe32.dwSize = sizeof(PROCESSENTRY32);
// Walk the snapshot of the processes, and for each process,
// display information. if (Process32First(hProcessSnap, &pe32))
{
DWORD dwPriorityClass;
BOOL bGotModule = FALSE;
MODULEENTRY32 me32 = {0};
do
{
bGotModule = GetProcessModule(pe32.th32ProcessID,
pe32.th32ModuleID, &me32, sizeof(MODULEENTRY32)); if (bGotModule)
{
HANDLE hProcess;
// Get the actual priority class.
hProcess = OpenProcess (PROCESS_ALL_ACCESS,
FALSE, pe32.th32ProcessID);
dwPriorityClass = GetPriorityClass (hProcess);
CloseHandle (hProcess); // Print the process's information.
printf( "\nPriority Class Base\t%d\n",
pe32.pcPriClassBase);
printf( "PID\t\t\t%d\n", pe32.th32ProcessID);
printf( "Thread Count\t\t%d\n", pe32.cntThreads);
printf( "Module Name\t\t%s\n", me32.szModule);
printf( "Full Path\t\t%s\n\n", me32.szExePath);
}
}
while (Process32Next(hProcessSnap, &pe32));
bRet = TRUE;
}
else
bRet = FALSE; // could not walk the list of processes
// Do not forget to clean up the snapshot object. CloseHandle (hProcessSnap);
return (bRet);
} Process32First
Retrieves information about the first process encountered in a system snapshot. BOOL WINAPI Process32First(
HANDLE hSnapshot,
LPPROCESSENTRY32 lppe
);
Parameters
hSnapshot
[in] Handle to the snapshot returned from a previous call to the CreateToolhelp32Snapshot function.
lppe
[in/out] Pointer to a PROCESSENTRY32 structure.
Return Values
Returns TRUE if the first entry of the process list has been copied to the buffer or FALSE otherwise. The ERROR_NO_MORE_FILES error value is returned by the GetLastError function if no processes exist or the snapshot does not contain process information.Res
The calling application must set the dwSize member of PROCESSENTRY32 to the size, in bytes, of the structure. Process32First changes dwSize to the number of bytes written to the structure. This will never be greater than the initial value of dwSize, but it may be smaller. If the value is smaller, do not rely on the values of any members whose offsets are greater than this value. To retrieve information about other processes recorded in the same snapshot, use the Process32Next function.For an example, see Taking a Snapshot and Viewing Processes. Requirements
Windows NT/2000 or later: Requires Windows 2000 or later.
Windows 95/98/Me: Requires Windows 95 or later.
Header: Declared in Tlhelp32.h.
Library: Use Kernel32.lib.
在 MSND 里找 EnumProcesses 有例子我写过这样的东西 向 一个播放器里注入 Dll
#include <windows.h>
#include <stdio.h>
#include "psapi.h"
#pragma comment(lib, "psapi")#include "LoadrealAVIWord.h"int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance,
PSTR szCmdLine, int iCmdShow)
{
HANDLE hProcess = GetRealPlayProcessHandle () ;
if (!hProcess)
{
MessageBox (NULL, "Can't find realplay! ", NULL, 0) ;
return 2 ;
}
if (!InsertDll (hProcess, "E:\\Visual Studio Projects\\VC Projects\\RealAVI_Word\\Debug\\RealAVI_Word.dll"))
{
MessageBox (NULL, "InsertDll failed! ", NULL, 0) ;
return 2 ;
}
return 1 ;
}
HANDLE GetRealPlayProcessHandle ()
{
DWORD aProcesses[1024], cbNeeded, cProcesses ;
unsigned int i ;
HANDLE hProcess ;
char szProcessName[MAX_PATH] = "unknown";
if (!EnumProcesses (aProcesses, sizeof (aProcesses), &cbNeeded))
return NULL ; // Calculate how many process identifiers were returned.
cProcesses = cbNeeded / sizeof(DWORD); // Print the name and process identifier for each process.
for (i = 0; i < cProcesses; i++ )
{
hProcess = OpenProcess (PROCESS_ALL_ACCESS, FALSE, aProcesses[i]) ;
if (NULL != hProcess)
{
HMODULE hMod ;
DWORD cbNeeded ; if (EnumProcessModules (hProcess, &hMod, sizeof(hMod), &cbNeeded))
{
GetModuleBaseName (hProcess, hMod, szProcessName, sizeof(szProcessName)) ;
if (strcmp (szProcessName, "realplay.exe") == 0)
return hProcess ;
}
else continue ;
}
else continue ;
CloseHandle (hProcess) ;
}
return NULL ;
}
bool InsertDll (HANDLE hProcess, LPCTSTR lpDllName)
{
LPVOID lpRemoteDllName = NULL ;
SIZE_T cb = strlen (lpDllName) ;
lpRemoteDllName = VirtualAllocEx (hProcess, NULL, cb, MEM_COMMIT, PAGE_READWRITE) ;
if (! lpRemoteDllName)
return false ;
if (! WriteProcessMemory (hProcess, lpRemoteDllName, (PVOID) lpDllName, cb, NULL))
return false ;
PTHREAD_START_ROUTINE pfnThreadRtn = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(TEXT("Kernel32")),
"LoadLibraryA");
CreateRemoteThread(hProcess, NULL, 0, pfnThreadRtn, lpRemoteDllName, 0, NULL);
return true ;
}
http://www.vccode.com/file_show.php?id=36
楼主去看看就知道了。
#pragma once#include <TlHelp32.h>
#pragma warning(disable:4244)
#pragma warning(disable:4312)
class CToolHelp
{
private:
HANDLE m_hSnapshot;
public:
CToolHelp(DWORD dwFlags=0,DWORD dwProcessID=0);
~CToolHelp(); BOOL CreateSnapshot(DWORD dwFlags,DWORD dwProcessID=0); BOOL ProcessFirst(LPPROCESSENTRY32 ppe) const;
BOOL ProcessNext(LPPROCESSENTRY32 ppe) const;
BOOL ProcessFind(DWORD dwProcessID,LPPROCESSENTRY32 ppe) const; BOOL ModuleFirst(PMODULEENTRY32 pme) const;
BOOL ModuleNext(PMODULEENTRY32 pme) const;
BOOL ModuleFind(PVOID pvBaseAddr,PMODULEENTRY32 pme) const;
BOOL ModuleFind(PTSTR pszModName,PMODULEENTRY32 pme) const; BOOL ThreadFirst(PTHREADENTRY32 pte) const;
BOOL ThreadNext(PTHREADENTRY32 pte) const; BOOL HeapListFirst(PHEAPLIST32 phl) const;
BOOL HeapListNext(PHEAPLIST32 phl) const;
int HowManyHeaps() const; BOOL HeapFirst(PHEAPENTRY32 phe,DWORD dwProcessID,DWORD dwHeapID) const;
BOOL HeapNext(PHEAPENTRY32 phe) const;
int HowManyBlocksInHeap(DWORD dwProcessID,DWORD dwHeapID) const;
BOOL IsAHeap(HANDLE hProcess,PVOID pvBlock,PDWORD pdwFlags) const;public:
static BOOL EnableDebugPrivilege(BOOL fEnable=TRUE);
static BOOL ReadProcessMemory(DWORD dwProcessID,LPCVOID lpBaseAddress,LPVOID pvBuffer,DWORD cbSize,PDWORD pdwNumberOfBytesRead=NULL);
static PVOID GetModulePreferredBaseAddr(DWORD dwProcessID,PVOID pvModuleRemote);
};inline CToolHelp::CToolHelp(DWORD dwFlags/* =0 */,DWORD dwProcessID/* =0 */){
m_hSnapshot = INVALID_HANDLE_VALUE;
CreateSnapshot(dwFlags,dwProcessID);
}inline CToolHelp::~CToolHelp(){
CloseHandle(m_hSnapshot);
}inline BOOL CToolHelp::CreateSnapshot(DWORD dwFlags,DWORD dwProcessID/* =0 */){
SAFE_CLOSE_HANDLE(m_hSnapshot);
if(dwFlags==0){
m_hSnapshot = INVALID_HANDLE_VALUE;
}else{
m_hSnapshot = CreateToolhelp32Snapshot(dwFlags,dwProcessID);
}
return m_hSnapshot!=INVALID_HANDLE_VALUE;
}inline BOOL CToolHelp::EnableDebugPrivilege(BOOL fEnable/* =TRUE */){
BOOL fOK = FALSE;
HANDLE hToken = NULL;
if(OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken)){
TOKEN_PRIVILEGES tp;
tp.PrivilegeCount =1;
LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&tp.Privileges[0].Luid);
tp.Privileges[0].Attributes = fEnable ? SE_PRIVILEGE_ENABLED : 0;
AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL,NULL);
fOK = (GetLastError()==ERROR_SUCCESS);
CloseHandle(hToken);
}
return fOK;
}inline BOOL CToolHelp::ReadProcessMemory(DWORD dwProcessID,LPCVOID lpBaseAddress,LPVOID pvBuffer,DWORD cbSize,PDWORD pdwNumberOfBytesRead/* =NULL */){
return Toolhelp32ReadProcessMemory(dwProcessID,lpBaseAddress,pvBuffer,cbSize,pdwNumberOfBytesRead);
}inline BOOL CToolHelp::ProcessFirst(LPPROCESSENTRY32 ppe)const{
BOOL fOK = Process32First(m_hSnapshot,ppe);
if(fOK && (ppe->th32ProcessID==0))
fOK = ProcessNext(ppe);
return fOK;
}inline BOOL CToolHelp::ProcessNext(LPPROCESSENTRY32 ppe)const{
BOOL fOK = Process32Next(m_hSnapshot,ppe);
if(fOK && (ppe->th32ProcessID==0))
fOK = ProcessNext(ppe);
return fOK;
}inline BOOL CToolHelp::ProcessFind(DWORD dwProcessID,LPPROCESSENTRY32 ppe)const{
BOOL bFound = FALSE;
for(BOOL fOK=ProcessFirst(ppe);fOK;fOK=ProcessNext(ppe)){
bFound =(ppe->th32ProcessID==dwProcessID);
if(bFound)break;
}
return bFound;
}inline BOOL CToolHelp::ModuleFirst(PMODULEENTRY32 pme)const{
return Module32First(m_hSnapshot,pme);
}inline BOOL CToolHelp::ModuleNext(PMODULEENTRY32 pme)const{
return Module32Next(m_hSnapshot,pme);
}inline BOOL CToolHelp::ModuleFind(PVOID pvBaseAddr,PMODULEENTRY32 pme) const{
BOOL bFound = FALSE;
for(BOOL fOK=ModuleFirst(pme);fOK;fOK=ModuleNext(pme)){
bFound =(pme->modBaseAddr==pvBaseAddr);
if(bFound)break;
}
return bFound;
}inline BOOL CToolHelp::ModuleFind(PTSTR pszModName,PMODULEENTRY32 pme)const{
BOOL bFound = FALSE;
for(BOOL fOK=ModuleFirst(pme);fOK;fOK=ModuleNext(pme)){
bFound =(lstrcmpi(pme->szModule,pszModName)==0) || (lstrcmpi(pme->szExePath,pszModName)==0);
if(bFound)break;
}
return bFound;
}inline BOOL CToolHelp::ThreadFirst(PTHREADENTRY32 pte)const{
return Thread32First(m_hSnapshot,pte);
}inline BOOL CToolHelp::ThreadNext(PTHREADENTRY32 pte)const{
return Thread32Next(m_hSnapshot,pte);
}inline int CToolHelp::HowManyHeaps() const{
int nHowManyHeaps=0;
HEAPLIST32 hl={sizeof(hl)};
for(BOOL fOK=HeapListFirst(&hl);fOK;fOK=HeapListNext(&hl))
++nHowManyHeaps;
return nHowManyHeaps;
}inline int CToolHelp::HowManyBlocksInHeap(DWORD dwProcessID,DWORD dwHeapID) const{
int nHowManyBlocksInHeap=0;
HEAPENTRY32 he={sizeof(he)};
for(BOOL fOK=HeapFirst(&he,dwProcessID,dwHeapID);fOK;fOK=HeapNext(&he))
++nHowManyBlocksInHeap;
return nHowManyBlocksInHeap;
}inline BOOL CToolHelp::HeapListFirst(PHEAPLIST32 phl) const{
return Heap32ListFirst(m_hSnapshot,phl);
}inline BOOL CToolHelp::HeapListNext(PHEAPLIST32 phl) const{
return Heap32ListNext(m_hSnapshot,phl);
}inline BOOL CToolHelp::HeapFirst(PHEAPENTRY32 phe,DWORD dwProcessID,DWORD dwHeapID) const{
return Heap32First(phe,dwProcessID,dwHeapID);
}
inline BOOL CToolHelp::HeapNext(PHEAPENTRY32 phe)const{
return Heap32Next(phe);
}inline BOOL CToolHelp::IsAHeap(HANDLE hProcess,PVOID pvBlock,PDWORD pdwFlags)const{
HEAPLIST32 hl={sizeof(hl)};
for(BOOL fOK=HeapListFirst(&hl);fOK;HeapListNext(&hl)){
HEAPENTRY32 he={sizeof(he)};
for(BOOL fOk=HeapFirst(&he,hl.th32ProcessID,hl.th32HeapID);fOk;fOk=HeapNext(&he)){
MEMORY_BASIC_INFORMATION mbi;
VirtualQueryEx(hProcess,(PVOID)he.dwAddress,&mbi,sizeof(mbi));
if(PBYTE(pvBlock)>=PBYTE(mbi.AllocationBase) && PBYTE(pvBlock)<=(PBYTE(mbi.AllocationBase)+mbi.RegionSize)){
*pdwFlags=hl.dwFlags;
}
}
return FALSE;
}
}inline PVOID CToolHelp::GetModulePreferredBaseAddr(DWORD dwProcessID,PVOID pvModuleRemote){
PVOID pvModulePreferredBaseAddr=NULL;
IMAGE_DOS_HEADER idh;
IMAGE_NT_HEADERS inth;
Toolhelp32ReadProcessMemory(dwProcessID,pvModuleRemote,&idh,sizeof(idh),NULL);
if(idh.e_magic==IMAGE_DOS_SIGNATURE){
Toolhelp32ReadProcessMemory(dwProcessID,(PBYTE)pvModuleRemote+idh.e_lfanew,&inth,sizeof(inth),NULL);
if(inth.Signature==IMAGE_NT_SIGNATURE){
pvModulePreferredBaseAddr=PVOID(inth.OptionalHeader.ImageBase);
}
}
return pvModulePreferredBaseAddr;
}
进程信息 CreateToolhelp32Snapshot Process32First Process32Next
{
//获得运行进程的用户身份，此处对于8以上的进程没问题，对于8，0进程无法列出(8是Win2000下的，WinXP下为4)
SID_NAME_USE peUse;
HANDLE hp;
HANDLE hToken;
int isok;
char buf[0x400];
char buf1[100];
char buf2[100];
DWORD dwNumBytesRet;
DWORD dwNumBytesRet1;hp=OpenProcess(0x400, 0, pid);//0x400 is PROCESS_QUERY_INFORMATION
isok=OpenProcessToken(hp, 0x20008, &hToken);//这个0x20008不知道什么，TOKEN_QUERY？
if(isok)
{
isok=GetTokenInformation(hToken, TokenUser, &buf, 0x400, &dwNumBytesRet);
if(isok)
{
dwNumBytesRet=100;
dwNumBytesRet1=100;
isok=LookupAccountSid(NULL, (DWORD *) (*(DWORD *)buf), buf1, &dwNumBytesRet, buf2, &dwNumBytesRet1, &peUse);
if(isok)
{
strPath.Format("Run Auth:%s\\%s", buf2, buf1);
strPathValid = strPath;
} CloseHandle(hToken);
}
}CloseHandle(hp);
}
用户名,内存使用，CPU使用时间可以得到。
但是CPU使用率，和内存使用率我还没有找到代码:(