第3章进程

charszProcessName[MAX_PATH]=\

//得到一个进程句柄

HANDLEhProcess=OpenProcess(PROCESS_QUERY_INFORMATION| PROCESS_VM_READ, FALSE,processID);

//得到进程的名称 if(NULL!=hProcess) {

HMODULEhMod; DWORDcbNeeded;

if(EnumProcessModules(hProcess,&hMod,sizeof(hMod), &cbNeeded)) {

GetModuleBaseName(hProcess,hMod,szProcessName, sizeof(szProcessName)); }

elsereturn; }

elsereturn;

//打印进程名称及其标识符

printf(\CloseHandle(hProcess); }

voidPrintModules(DWORDprocessID) {

HMODULEhMods[1024]; HANDLEhProcess; DWORDcbNeeded; unsignedinti;

//打印进程标识符

printf(\//得到进程中所有模块的列表

hProcess=OpenProcess(PROCESS_QUERY_INFORMATION| PROCESS_VM_READ, FALSE,processID);

if(NULL==hProcess)return;

if(EnumProcessModules(hProcess,hMods,sizeof(hMods),&cbNeeded)) {

for(i=0;i<(cbNeeded/sizeof(HMODULE));i++) {

charszModName[MAX_PATH]; //得到模块的完整路径

if(GetModuleFileNameEx(hProcess,hMods[i],szModName, sizeof(szModName)))

{

//打印模块名及其句柄

printf(\} } }

CloseHandle(hProcess); }

voidmain() {

//得到进程标识符列表

DWORDaProcesses[1024],cbNeeded,cProcesses; unsignedinti;

if(!EnumProcesses(aProcesses,sizeof(aProcesses),&cbNeeded)) return;

//计算返回的进程标识符个数

cProcesses=cbNeeded/sizeof(DWORD);

//打印每个进程的名称和标识符 for(i=0;i

PrintProcessNameAndID(aProcesses[i]); PrintModules(aProcesses[i]); } }

3.5进程的终止

终止当前进程的运行比较容易。终止另外一个进程的运行，需要调用TerminateProcess 函数，这个函数需要一个进程句柄标识参数。为了获得这个句柄参数，用户可以根据上 一节的进程枚举函数获得正在运行的进程列表，然后得到对应的进程名称或者完整路 径，与要终止的进程进行比较，进而调用这个函数终止进程运行。 注意：

武断地调用TerminiateProcess函数是个坏主意，它会导致程序强行退出，丢失没

有保存的文件，也会造成一些系统资源不被释放。最好的办法是向程序各个窗口发送 退出消息通知，由运行进程处理资源回收和文件保存等工作。 例3-6进程终止举例。 #include\#include #include\#include

#include//forusingbstr_tclass

/***************************************************************** *通过性能数据导航*

*****************************************************************/ PPERF_OBJECT_TYPEFirstObject(PPERF_DATA_BLOCKPerfData) {

return((PPERF_OBJECT_TYPE)((PBYTE)PerfData+

PerfData->HeaderLength)); }

PPERF_OBJECT_TYPENextObject(PPERF_OBJECT_TYPEPerfObj) {

return((PPERF_OBJECT_TYPE)((PBYTE)PerfObj+ PerfObj->TotalByteLength)); }

PPERF_INSTANCE_DEFINITIONFirstInstance(PPERF_OBJECT_TYPEPerfObj) {

return((PPERF_INSTANCE_DEFINITION)((PBYTE)PerfObj+ PerfObj->DefinitionLength)); }

PPERF_INSTANCE_DEFINITIONNextInstance( PPERF_INSTANCE_DEFINITIONPerfInst) {

PPERF_COUNTER_BLOCKPerfCntrBlk;

PerfCntrBlk=(PPERF_COUNTER_BLOCK)((PBYTE)PerfInst+ PerfInst->ByteLength);

return((PPERF_INSTANCE_DEFINITION)((PBYTE)PerfCntrBlk+ PerfCntrBlk->ByteLength)); }

PPERF_COUNTER_DEFINITIONFirstCounter(PPERF_OBJECT_TYPEPerfObj) {

return((PPERF_COUNTER_DEFINITION)((PBYTE)PerfObj+ PerfObj->HeaderLength)); }

PPERF_COUNTER_DEFINITIONNextCounter( PPERF_COUNTER_DEFINITIONPerfCntr) {

return((PPERF_COUNTER_DEFINITION)((PBYTE)PerfCntr+ PerfCntr->ByteLength)); }

PPERF_COUNTER_BLOCKCounterBlock(PPERF_INSTANCE_DEFINITIONPerfInst) {

return(PPERF_COUNTER_BLOCK)((LPBYTE)PerfInst+ PerfInst->ByteLength); }

#defineTOTALBYTES64*1024 #defineBYTEINCREMENT1024

#definePROCESS_OBJECT_INDEX230 #definePROC_ID_COUNTER784

voidGetProcessID(LPCTSTRpProcessName,std::vector&SetOfPID) {

PPERF_DATA_BLOCKpPerfData=NULL;

PPERF_OBJECT_TYPEpPerfObj;

PPERF_INSTANCE_DEFINITIONpPerfInst;

PPERF_COUNTER_DEFINITIONpPerfCntr,pCurCntr; PPERF_COUNTER_BLOCKPtrToCntr; DWORDBufferSize=TOTALBYTES; DWORDi,j; LONGk;

//为性能数据准备缓冲区

pPerfData=(PPERF_DATA_BLOCK)malloc(BufferSize); charszKey[32];

sprintf(szKey,\LONGlRes;

while((lRes=RegQueryValueEx(HKEY_PERFORMANCE_DATA, szKey, NULL, NULL,

(LPBYTE)pPerfData,

&BufferSize))==ERROR_MORE_DATA) {

BufferSize+=BYTEINCREMENT;

pPerfData=(PPERF_DATA_BLOCK)realloc(pPerfData，BufferSize); }

//得到第一个对象类型

pPerfObj=FirstObject(pPerfData);

//遍历所有对象

for(i=0;iNumObjectTypes;i++) {

if(pPerfObj->ObjectNameTitleIndex!=PROCESS_OBJECT_INDEX) {

pPerfObj=NextObject(pPerfObj); continue; }

SetOfPID.clear(); //得到第一个计数

pPerfCntr=FirstCounter(pPerfObj);

//得到第一个实例

pPerfInst=FirstInstance(pPerfObj); _bstr_tbstrProcessName,bstrInput; //获得所有实例

for(k=0;kNumInstances;k++) {

pCurCntr=pPerfCntr;

bstrInput=pProcessName;

bstrProcessName=(wchar_t*)((PBYTE)pPerfInst+