Акжан в сети - На уровень вверх(W32) Как получить хэндлы всех пpоцессов, котоpые запущены на данный момент в системе?

Windows 95/98

Под Windows 95 это возможно с использованием вспомогательных инфоpмационных функций (tool help functions).

Для получения списка пpоцессов надо делать следующее:

Dima Bogachev

(2:5020/1056.18)

Пример:

unit KernlUtl;

interface
uses TlHelp32, Windows, Classes, Sysutils;

procedure GetProcessList(List: TStrings);
procedure GetModuleList(List: TStrings);
function GetProcessHandle(ProcessID: DWORD): THandle;
procedure GetParentProcessInfo(var ID: DWORD; var Path: String);

const

  PROCESS_TERMINATE         =  $0001;
  PROCESS_CREATE_THREAD     =  $0002;
  PROCESS_VM_OPERATION      =  $0008;
  PROCESS_VM_READ           =  $0010;
  PROCESS_VM_WRITE          =  $0020;
  PROCESS_DUP_HANDLE        =  $0040;
  PROCESS_CREATE_PROCESS    =  $0080;
  PROCESS_SET_QUOTA         =  $0100;
  PROCESS_SET_INFORMATION   =  $0200;
  PROCESS_QUERY_INFORMATION =  $0400;
  PROCESS_ALL_ACCESS        =
    STANDARD_RIGHTS_REQUIRED or SYNCHRONIZE or $0FFF;


implementation

procedure GetProcessList(List: TStrings);
var
  I: Integer;
  hSnapshoot: THandle;
  pe32: TProcessEntry32;
begin
  List.Clear;
  hSnapshoot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

  if (hSnapshoot = -1) then
      Exit;
  pe32.dwSize := SizeOf(TProcessEntry32);
  if (Process32First(hSnapshoot, pe32)) then
  repeat
    I := List.Add(Format('%x, %x: %s',
      [pe32.th32ProcessID, pe32.th32ParentProcessID, pe32.szExeFile]));
    List.Objects[I] := Pointer(pe32.th32ProcessID);
  until not Process32Next(hSnapshoot, pe32);

  CloseHandle (hSnapshoot);
end;

procedure GetModuleList(List: TStrings);
var
  I: Integer;
  hSnapshoot: THandle;
  me32: TModuleEntry32;
begin
  List.Clear;
  hSnapshoot := CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0);
  if (hSnapshoot = -1) then
      Exit;
  me32.dwSize := SizeOf(TModuleEntry32);
  if (Module32First(hSnapshoot, me32)) then
  repeat
    I := List.Add(me32.szModule);
    List.Objects[I] := Pointer(me32.th32ModuleID);
  until not Module32Next(hSnapshoot, me32);

  CloseHandle (hSnapshoot);
end;

procedure GetParentProcessInfo(var ID: DWORD; var Path: String);
var
  ProcessID: DWORD;
  hSnapshoot: THandle;
  pe32: TProcessEntry32;
begin
  ProcessID := GetCurrentProcessID;
  ID := -1;
  Path := '';

  hSnapshoot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

  if (hSnapshoot = -1) then
      Exit;

  pe32.dwSize := SizeOf(TProcessEntry32);
  if (Process32First(hSnapshoot, pe32)) then
  repeat
    if pe32.th32ProcessID = ProcessID then
    begin
      ID := pe32.th32ParentProcessID;
      Break;
    end;
  until not Process32Next(hSnapshoot, pe32);

  if ID <> -1 then
  begin
    if (Process32First(hSnapshoot, pe32)) then
    repeat
      if pe32.th32ProcessID = ID then
      begin
        Path := pe32.szExeFile;
        Break;
      end;
    until not Process32Next(hSnapshoot, pe32);
  end;
  CloseHandle (hSnapshoot);
end;

function GetProcessHandle(ProcessID: DWORD): THandle;
begin
  Result := OpenProcess(PROCESS_ALL_ACCESS, True, ProcessID);
end;

end.

Vladimir Gaitanoff

http://www.tsinet.ru/~vg/
(2:5020/880.5)

Windows NT/2000

Исходный текст на языке Си:

#include <windows.h>

#include <stdio.h>

typedef long   (*NtQSI)(LONG, PVOID,LONG, LONG);

struct ThreadInfo
{
        FILETIME ftCreationTime;
        DWORD dwUnknown1;
        DWORD dwStartAddress;
        DWORD dwOwningPID;
        DWORD dwThreadID;
        DWORD dwCurrentPriority;
        DWORD dwBasePriority;
        DWORD dwContextSwitches;
        DWORD dwThreadState;
        DWORD dwUnknown2;
        DWORD dwUnknown3;
        DWORD dwUnknown4;
        DWORD dwUnknown5;
        DWORD dwUnknown6;
        DWORD dwUnknown7;
};

struct ProcessInfo
{
        DWORD dwOffset; // an offset to the next Process structure
        DWORD dwThreadCount;
        DWORD dwUnkown1[6];
        FILETIME ftCreationTime;
        DWORD dwUnkown2;
        DWORD dwUnkown3;
        DWORD dwUnkown4;
        DWORD dwUnkown5;
        DWORD dwUnkown6;
        WCHAR* pszProcessName;
        DWORD dwBasePriority;
        DWORD dwProcessID;
        DWORD dwParentProcessID;
        DWORD dwHandleCount;
        DWORD dwUnkown7;
        DWORD dwUnkown8;
        DWORD dwVirtualBytesPeak;
        DWORD dwVirtualBytes;
        DWORD dwPageFaults;
        DWORD dwWorkingSetPeak;
        DWORD dwWorkingSet;
        DWORD dwUnkown9;
        DWORD dwPagedPool; // kbytes
        DWORD dwUnkown10;
        DWORD dwNonPagedPool; // kbytes
        DWORD dwPageFileBytesPeak;
        DWORD dwPageFileBytes;
        DWORD dwPrivateBytes;
        DWORD dwUnkown11;
        DWORD dwUnkown12;
        DWORD dwUnkown13;
        DWORD dwUnkown14;
        struct ThreadInfo ati[1];
};


    NtQSI ntqsi;
    HANDLE h;
    int i;
    long j;
    long tt;
    char *vt; // UNICODE

    struct ThreadInfo  *tinfo, *tinf2;
    struct ProcessInfo *pinfo;

    char buf[20480];

void main()
{
    h=LoadLibrary("NTDLL.DLL");
    ntqsi = (NtQSI)GetProcAddress(h,"NtQuerySystemInformation");

    j = (*ntqsi)(5,buf,20480,0);
    pinfo = buf;

    for(;;){
       vt = pinfo->pszProcessName;
       printf("%4lX|%13s|%8ld|%7lX|%7ld",
          pinfo->dwProcessID,vt,
          pinfo->dwThreadCount,pinfo->dwParentProcessID,
          pinfo->dwOffset);
       printf("|%4ld\n",pinfo->dwBasePriority);
       printf("\t|  ID|Owner|State|Priority|Base Priority\n");
       tinfo = &pinfo->ati[0];

       for(i=0;i<pinfo->dwThreadCount;++i){
          tinf2 = &tinfo[i];
          printf("\t|%4lX|%5lX|%5lX|%8s|%8s\n",
             tinf2->dwThreadID,
             tinf2->dwOwningPID,
             tinf2->dwThreadState,
             tinf2->dwCurrentPriority,
             tinf2->dwBasePriority);
       }
       if(pinfo->dwOffset==0) break;
       pinfo = (struct ProcessInfo*)((char *)pinfo + pinfo->dwOffset);
    }
}

Viktor Krapivin

(2:450/102.13)

Исходный текст на языке Delphi's Object Pascal:

unit Unit1;

interface

uses
  Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
  StdCtrls;

type
  TForm1 = class(TForm)
    Button1: TButton;
    lb: TListBox;
    procedure Button1Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

  PThreadInfo = ^TThreadInfo;
  TThreadInfo = record
    ftCreationTime    : TDateTime;
    dwUnknown1        : DWORD;
    dwStartAddress    : DWORD;
    dwOwningPID       : DWORD;
    dwThreadID        : DWORD;
    dwCurrentPriority : DWORD;
    dwBasePriority    : DWORD;
    dwContextSwitches : DWORD;
    dwThreadState     : DWORD;
    dwUnknown2        : DWORD;
    dwUnknown3        : DWORD;
    dwUnknown4        : DWORD;
    dwUnknown5        : DWORD;
    dwUnknown6        : DWORD;
    dwUnknown7        : DWORD;
  end;

  PProcessInfo = ^TProcessInfo;
  TProcessInfo = record
    dwOffset            : DWORD;
    dwThreadCount       : DWORD;
    dwUnkown1           : array [1..6] of DWORD;
    ftCreationTime      : TDateTime;
    dwUnkown2           : DWORD;
    dwUnkown3           : DWORD;
    dwUnkown4           : DWORD;
    dwUnkown5           : DWORD;
    dwUnkown6           : DWORD;
    pszProcessName      : PWideChar;
    dwBasePriority      : DWORD;
    dwProcessID         : DWORD;
    dwParentProcessID   : DWORD;
    dwHandleCount       : DWORD;
    dwUnkown7           : DWORD;
    dwUnkown8           : DWORD;
    dwVirtualBytesPeak  : DWORD;
    dwVirtualBytes      : DWORD;
    dwPageFaults        : DWORD;
    dwWorkingSetPeak    : DWORD;
    dwWorkingSet        : DWORD;
    dwUnkown9           : DWORD;
    dwPagedPool         : DWORD;
    dwUnkown10          : DWORD;
    dwNonPagedPool      : DWORD;
    dwPageFileBytesPeak : DWORD;
    dwPageFileBytes     : DWORD;
    dwPrivateBytes      : DWORD;
    dwUnkown11          : DWORD;
    dwUnkown12          : DWORD;
    dwUnkown13          : DWORD;
    dwUnkown14          : DWORD;
    ati                 : array [1..1] of TThreadInfo;
  end;

  TNtQSI = function(Nmb: integer; Ptr: Pointer; Size1, Size2: integer): DWORD; stdcall;

var
  Form1: TForm1;

var
  NtQSI : TNtQSI;

  Buf   : array [1..20480] of char;

  ThrInfo : PThreadInfo;
  PrcInfo : PProcessInfo;

implementation

{$R *.DFM}

procedure TForm1.Button1Click(Sender: TObject);
var hLib : DWORD;
    Ptr  : Pointer;
    Cur  : DWORD;
begin
  lb.Items.Clear;
  hLib := LoadLibrary('NTDLL.DLL');

  if hLib>0 then

   begin
    @NtQSI := GetProcAddress(hLib,'NtQuerySystemInformation');
    NtQSI(5,@Buf,20480,0);

    Cur := 1;
    Ptr := Addr(Buf[Cur]);
    PrcInfo := Ptr;
    lb.Items.Add(PrcInfo.pszProcessName);
    lb.Items.Add('-----> PID : '+ IntToStr(PrcInfo.dwProcessID));
    repeat
      Cur := Cur + PrcInfo.dwOffset;
      Ptr := Addr(Buf[Cur]);
      PrcInfo := Ptr;
      lb.Items.Add(PrcInfo.pszProcessName);
      lb.Items.Add('-----> PID : '+ IntToStr(PrcInfo.dwProcessID));
    until PrcInfo.dwOffset=0;
   end;
  FreeLibrary(hLib);
end;

end.

Anton Saburov

2:5030/730.9