EnumProcess 实现枚举进程

Posted 2021-01-11 priarienew

BOOL WINAPI  EnumProcesses (
                             _Out_writes_bytes_(cb) DWORD * lpidProcess,
                             _In_ DWORD cb,
                             _Out_ LPDWORD lpcbNeeded
                            );

HANDLE OpenProcess(  
                    DWORD dwDesiredAccess,  // access flag
                    BOOL bInheritHandle,    // handle inheritance option
                    DWORD dwProcessId       // process identifier
                   );


BOOL WINAPI QueryFullProcessImageNameA(
    _In_ HANDLE hProcess,
    _In_ DWORD dwFlags,
    _Out_writes_to_(*lpdwSize, *lpdwSize) LPSTR lpExeName,
    _Inout_ PDWORD lpdwSize
    );

函数使用起来都比较方便，参数不说了，需要注意使用EnumProcess要包涵#include <Psapi.h>，以及对应的导入库lib
具体代码示例如下：

#include "stdafx.h"
#include <Windows.h>
#include <string>
#include <Psapi.h>

#pragma comment (lib, "Psapi.lib")

using namespace std;

int _tmain(int argc, _TCHAR* argv[])
{
	DWORD dwProcessID[0x500] = { 0 };  //开始的预先分配较大的缓冲区，用来存放进程ID
	DWORD dwNeeded = 0;
	BOOL bEnumRes = EnumProcesses(dwProcessID, sizeof(dwProcessID), &dwNeeded);
	UINT uCount = dwNeeded / sizeof(DWORD);//获得枚举到进程的数量
	for (UINT i = 0; i < uCount; i++)
	{ 

               //只对进程进程枚举，所以申请QUERY权限，具体还得根据应用申请权限

		HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwProcessID[i]);
		if (NULL !=hProcess)
		{
			CHAR szProcessName[0x50] = { 0 };
			DWORD dwNameLen = 0x50;
			BOOL bRet = QueryFullProcessImageNameA(hProcess, 0, szProcessName, &dwNameLen);
			if (bRet)
			{
				printf("ID:%4d	processName(%s)
", dwProcessID[i], szProcessName);
			}
		}
	}
	getchar();
	return 0;
}