Под Windows 95 это возможно с использованием вспомогательных инфоpмационных функций (tool help functions).
Для получения списка пpоцессов надо делать следующее:
hSnapshot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); // - получение снимка состояния системы
;Process32First()
- получение инфоpмации о пеpвом пpоцессе в списке;Process32Next()
- получение инфоpмации о следующем
пpоцессе в списке.Dima Bogachev
(2:5020/1056.18)Пример:
unit KernlUtl; interface uses TlHelp32, Windows, Classes, Sysutils; procedure GetProcessList(List: TStrings); procedure GetModuleList(List: TStrings); function GetProcessHandle(ProcessID: DWORD): THandle; procedure GetParentProcessInfo(var ID: DWORD; var Path: String); const PROCESS_TERMINATE = $0001; PROCESS_CREATE_THREAD = $0002; PROCESS_VM_OPERATION = $0008; PROCESS_VM_READ = $0010; PROCESS_VM_WRITE = $0020; PROCESS_DUP_HANDLE = $0040; PROCESS_CREATE_PROCESS = $0080; PROCESS_SET_QUOTA = $0100; PROCESS_SET_INFORMATION = $0200; PROCESS_QUERY_INFORMATION = $0400; PROCESS_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED or SYNCHRONIZE or $0FFF; implementation procedure GetProcessList(List: TStrings); var I: Integer; hSnapshoot: THandle; pe32: TProcessEntry32; begin List.Clear; hSnapshoot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hSnapshoot = -1) then Exit; pe32.dwSize := SizeOf(TProcessEntry32); if (Process32First(hSnapshoot, pe32)) then repeat I := List.Add(Format('%x, %x: %s', [pe32.th32ProcessID, pe32.th32ParentProcessID, pe32.szExeFile])); List.Objects[I] := Pointer(pe32.th32ProcessID); until not Process32Next(hSnapshoot, pe32); CloseHandle (hSnapshoot); end; procedure GetModuleList(List: TStrings); var I: Integer; hSnapshoot: THandle; me32: TModuleEntry32; begin List.Clear; hSnapshoot := CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0); if (hSnapshoot = -1) then Exit; me32.dwSize := SizeOf(TModuleEntry32); if (Module32First(hSnapshoot, me32)) then repeat I := List.Add(me32.szModule); List.Objects[I] := Pointer(me32.th32ModuleID); until not Module32Next(hSnapshoot, me32); CloseHandle (hSnapshoot); end; procedure GetParentProcessInfo(var ID: DWORD; var Path: String); var ProcessID: DWORD; hSnapshoot: THandle; pe32: TProcessEntry32; begin ProcessID := GetCurrentProcessID; ID := -1; Path := ''; hSnapshoot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hSnapshoot = -1) then Exit; pe32.dwSize := SizeOf(TProcessEntry32); if (Process32First(hSnapshoot, pe32)) then repeat if pe32.th32ProcessID = ProcessID then begin ID := pe32.th32ParentProcessID; Break; end; until not Process32Next(hSnapshoot, pe32); if ID <> -1 then begin if (Process32First(hSnapshoot, pe32)) then repeat if pe32.th32ProcessID = ID then begin Path := pe32.szExeFile; Break; end; until not Process32Next(hSnapshoot, pe32); end; CloseHandle (hSnapshoot); end; function GetProcessHandle(ProcessID: DWORD): THandle; begin Result := OpenProcess(PROCESS_ALL_ACCESS, True, ProcessID); end; end.
Vladimir Gaitanoff
http://www.tsinet.ru/~vg/ (2:5020/880.5)Исходный текст на языке Си:
#include <windows.h> #include <stdio.h> typedef long (*NtQSI)(LONG, PVOID,LONG, LONG); struct ThreadInfo { FILETIME ftCreationTime; DWORD dwUnknown1; DWORD dwStartAddress; DWORD dwOwningPID; DWORD dwThreadID; DWORD dwCurrentPriority; DWORD dwBasePriority; DWORD dwContextSwitches; DWORD dwThreadState; DWORD dwUnknown2; DWORD dwUnknown3; DWORD dwUnknown4; DWORD dwUnknown5; DWORD dwUnknown6; DWORD dwUnknown7; }; struct ProcessInfo { DWORD dwOffset; // an offset to the next Process structure DWORD dwThreadCount; DWORD dwUnkown1[6]; FILETIME ftCreationTime; DWORD dwUnkown2; DWORD dwUnkown3; DWORD dwUnkown4; DWORD dwUnkown5; DWORD dwUnkown6; WCHAR* pszProcessName; DWORD dwBasePriority; DWORD dwProcessID; DWORD dwParentProcessID; DWORD dwHandleCount; DWORD dwUnkown7; DWORD dwUnkown8; DWORD dwVirtualBytesPeak; DWORD dwVirtualBytes; DWORD dwPageFaults; DWORD dwWorkingSetPeak; DWORD dwWorkingSet; DWORD dwUnkown9; DWORD dwPagedPool; // kbytes DWORD dwUnkown10; DWORD dwNonPagedPool; // kbytes DWORD dwPageFileBytesPeak; DWORD dwPageFileBytes; DWORD dwPrivateBytes; DWORD dwUnkown11; DWORD dwUnkown12; DWORD dwUnkown13; DWORD dwUnkown14; struct ThreadInfo ati[1]; }; NtQSI ntqsi; HANDLE h; int i; long j; long tt; char *vt; // UNICODE struct ThreadInfo *tinfo, *tinf2; struct ProcessInfo *pinfo; char buf[20480]; void main() { h=LoadLibrary("NTDLL.DLL"); ntqsi = (NtQSI)GetProcAddress(h,"NtQuerySystemInformation"); j = (*ntqsi)(5,buf,20480,0); pinfo = buf; for(;;){ vt = pinfo->pszProcessName; printf("%4lX|%13s|%8ld|%7lX|%7ld", pinfo->dwProcessID,vt, pinfo->dwThreadCount,pinfo->dwParentProcessID, pinfo->dwOffset); printf("|%4ld\n",pinfo->dwBasePriority); printf("\t| ID|Owner|State|Priority|Base Priority\n"); tinfo = &pinfo->ati[0]; for(i=0;i<pinfo->dwThreadCount;++i){ tinf2 = &tinfo[i]; printf("\t|%4lX|%5lX|%5lX|%8s|%8s\n", tinf2->dwThreadID, tinf2->dwOwningPID, tinf2->dwThreadState, tinf2->dwCurrentPriority, tinf2->dwBasePriority); } if(pinfo->dwOffset==0) break; pinfo = (struct ProcessInfo*)((char *)pinfo + pinfo->dwOffset); } }
Viktor Krapivin
(2:450/102.13)Исходный текст на языке Delphi's Object Pascal:
unit Unit1; interface uses Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs, StdCtrls; type TForm1 = class(TForm) Button1: TButton; lb: TListBox; procedure Button1Click(Sender: TObject); private { Private declarations } public { Public declarations } end; PThreadInfo = ^TThreadInfo; TThreadInfo = record ftCreationTime : TDateTime; dwUnknown1 : DWORD; dwStartAddress : DWORD; dwOwningPID : DWORD; dwThreadID : DWORD; dwCurrentPriority : DWORD; dwBasePriority : DWORD; dwContextSwitches : DWORD; dwThreadState : DWORD; dwUnknown2 : DWORD; dwUnknown3 : DWORD; dwUnknown4 : DWORD; dwUnknown5 : DWORD; dwUnknown6 : DWORD; dwUnknown7 : DWORD; end; PProcessInfo = ^TProcessInfo; TProcessInfo = record dwOffset : DWORD; dwThreadCount : DWORD; dwUnkown1 : array [1..6] of DWORD; ftCreationTime : TDateTime; dwUnkown2 : DWORD; dwUnkown3 : DWORD; dwUnkown4 : DWORD; dwUnkown5 : DWORD; dwUnkown6 : DWORD; pszProcessName : PWideChar; dwBasePriority : DWORD; dwProcessID : DWORD; dwParentProcessID : DWORD; dwHandleCount : DWORD; dwUnkown7 : DWORD; dwUnkown8 : DWORD; dwVirtualBytesPeak : DWORD; dwVirtualBytes : DWORD; dwPageFaults : DWORD; dwWorkingSetPeak : DWORD; dwWorkingSet : DWORD; dwUnkown9 : DWORD; dwPagedPool : DWORD; dwUnkown10 : DWORD; dwNonPagedPool : DWORD; dwPageFileBytesPeak : DWORD; dwPageFileBytes : DWORD; dwPrivateBytes : DWORD; dwUnkown11 : DWORD; dwUnkown12 : DWORD; dwUnkown13 : DWORD; dwUnkown14 : DWORD; ati : array [1..1] of TThreadInfo; end; TNtQSI = function(Nmb: integer; Ptr: Pointer; Size1, Size2: integer): DWORD; stdcall; var Form1: TForm1; var NtQSI : TNtQSI; Buf : array [1..20480] of char; ThrInfo : PThreadInfo; PrcInfo : PProcessInfo; implementation {$R *.DFM} procedure TForm1.Button1Click(Sender: TObject); var hLib : DWORD; Ptr : Pointer; Cur : DWORD; begin lb.Items.Clear; hLib := LoadLibrary('NTDLL.DLL'); if hLib>0 then begin @NtQSI := GetProcAddress(hLib,'NtQuerySystemInformation'); NtQSI(5,@Buf,20480,0); Cur := 1; Ptr := Addr(Buf[Cur]); PrcInfo := Ptr; lb.Items.Add(PrcInfo.pszProcessName); lb.Items.Add('-----> PID : '+ IntToStr(PrcInfo.dwProcessID)); repeat Cur := Cur + PrcInfo.dwOffset; Ptr := Addr(Buf[Cur]); PrcInfo := Ptr; lb.Items.Add(PrcInfo.pszProcessName); lb.Items.Add('-----> PID : '+ IntToStr(PrcInfo.dwProcessID)); until PrcInfo.dwOffset=0; end; FreeLibrary(hLib); end; end.
Anton Saburov
2:5030/730.9