#pragma once

 #ifndef __PROCESSFUN_H__

 #define __PROCESSFUN_H__

 #include <iostream>

 #include <string>

 #include <algorithm>

 #include <windows.h>

 #include <psapi.h>

 using namespace std;

 #include "Ntdll.h"

 #pragma comment(lib, "psapi.lib")

 #pragma warning(disable: 4996)

 BOOL EnablePrivilege(ULONG Privilege = SE_DEBUG_PRIVILEGE, BOOL Enable = TRUE);

 DWORD NtEnumProcess(LPDWORD lpProcess);

 BOOL GetSystemProcess(DWORD dwPid, SYSTEM_PROCESSES &SystemProcess);

 HANDLE NtOpenProcess(DWORD dwPid);

 HANDLE DoOpenProcess(DWORD dwPid);

 HANDLE PowerOpenProcess(DWORD dwPid);

 BOOL IsProcessExit(HANDLE hProcess);

 BOOL NtTerminateProcess(HANDLE hProcess);

 BOOL JoTerminateProcess(HANDLE hProcess);

 BOOL CrtTerminateProcess(HANDLE hProcess);

 BOOL WvmTerminateProcess(HANDLE hProcess);

 BOOL PowerTerminateProcess(HANDLE hProcess);

 BOOL GetProcessFilePath(HANDLE hProcess, LPSTR lpFilePath);

 BOOL DosPathToNtPath(LPCSTR lpDosPath, LPSTR lpNtPath);

 DWORD GetEProcess(DWORD dwPid);

 DWORD GetParentProcessId(DWORD dwPid);

 BOOL GetProcessName(DWORD dwPid, LPSTR lpProcessName);

 LARGE_INTEGER GetProcessCreateTime(DWORD dwPid);

 #endif    //    __PROCESSFUN_H__

ProcessFun.h

 #include "ProcessFun.h"

 BOOL EnablePrivilege(ULONG Privilege, BOOL Enable)

 {

     HANDLE hToken = NULL;

     if (!NT_SUCCESS(NtOpenProcessToken(NtCurrentProcess(), TOKEN_ALL_ACCESS, &hToken)) || hToken == NULL)

         return FALSE;

     TOKEN_PRIVILEGES tp = {};

     tp.PrivilegeCount = ;

     tp.Privileges[].Luid.LowPart = Privilege;

     tp.Privileges[].Attributes = Enable ? SE_PRIVILEGE_ENABLED : SE_PRIVILEGE_REMOVED;

     return NT_SUCCESS(NtAdjustPrivilegesToken(hToken, FALSE, &tp, sizeof(tp), NULL, NULL));

 }

 DWORD NtEnumProcess(LPDWORD lpProcess)

 {

     DWORD dwSize = NULL;

     PSYSTEM_PROCESSES lpbaSP = NULL;

     if (!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, NULL, NULL, &dwSize) || dwSize == NULL))

         return NULL;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpbaSP,

                                             NULL,

                                             &dwSize,

                                             MEM_COMMIT,

                                             PAGE_READWRITE)) ||

         lpbaSP == NULL)

         return NULL;

     if (!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, (PVOID)lpbaSP, dwSize, NULL)))

     {

         NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpbaSP, &dwSize, MEM_RELEASE);

         return NULL;

     }

     DWORD dwLenth = ;

     PSYSTEM_PROCESSES lpSP = lpbaSP;

     while (lpSP->NextEntryDelta != NULL)

     {

         lpProcess[dwLenth++] = lpSP->ProcessId;

         lpSP = (PSYSTEM_PROCESSES)((ULONG)lpSP + lpSP->NextEntryDelta);

     }

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpbaSP, &dwSize, MEM_RELEASE);

     sort(lpProcess, lpProcess + dwLenth);

     return dwLenth;

 }

 BOOL GetSystemProcess(DWORD dwPid, SYSTEM_PROCESSES &SystemProcess)

 {

     SystemProcess = {};

     DWORD dwSize = NULL;

     PSYSTEM_PROCESSES lpbaSP = NULL;

     if (!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, NULL, NULL, &dwSize) || dwSize == NULL))

         return FALSE;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpbaSP,

                                             NULL,

                                             &dwSize,

                                             MEM_COMMIT,

                                             PAGE_READWRITE)) ||

         lpbaSP == NULL)

         return FALSE;

     if (!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, (PVOID)lpbaSP, dwSize, NULL)))

     {

         NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpbaSP, &dwSize, MEM_RELEASE);

         return FALSE;

     }

     BOOL status = FALSE;

     PSYSTEM_PROCESSES lpSP = lpbaSP;

     while (lpSP->NextEntryDelta != NULL)

     {

         if (dwPid == lpSP->ProcessId)

         {

             SystemProcess = *lpSP;

             status = TRUE;

             break;

         }

         lpSP = (PSYSTEM_PROCESSES)((ULONG)lpSP + lpSP->NextEntryDelta);

     }

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpbaSP, &dwSize, MEM_RELEASE);

     return status;

 }

 HANDLE NtOpenProcess(DWORD dwPid)

 {

     HANDLE hProcess = NULL;

     OBJECT_ATTRIBUTES oa = {};

     oa.Length = sizeof(oa);

     CLIENT_ID cid = {};

     cid.UniqueProcess = (HANDLE)(dwPid %  ? dwPid : dwPid + );

     NtOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &oa, &cid);

     return hProcess;

 }

 HANDLE DoOpenProcess(DWORD dwPid)

 {

     PCHAR lpBuf = NULL;

     DWORD dwPreSize = 0x1000, dwSize = NULL;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpBuf,

                                             NULL, &dwPreSize,

                                             MEM_COMMIT, PAGE_READWRITE)) ||

         lpBuf == NULL)

         return NULL;

     NtQuerySystemInformation(SystemHandleInformation, (PVOID)lpBuf, dwPreSize, &dwSize);

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpBuf, &dwPreSize, MEM_RELEASE);

     lpBuf = NULL;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpBuf,

                                             NULL, &dwSize,

                                             MEM_COMMIT,

                                             PAGE_READWRITE)) ||

         lpBuf == NULL)

         return NULL;

     NtQuerySystemInformation(SystemHandleInformation, (PVOID)lpBuf, dwSize, NULL);

     DWORD dwNumberOfHandle = *(DWORD *)lpBuf;

     PSYSTEM_HANDLE_INFORMATION lpSHI = (PSYSTEM_HANDLE_INFORMATION)((PCHAR)lpBuf + sizeof(dwNumberOfHandle));

     HANDLE hTgtProc = NULL;

     for (DWORD i = ; i < dwNumberOfHandle; i++, lpSHI++)

     {

         if (lpSHI->ObjectTypeNumber != OB_TYPE_PROCESS && lpSHI->ObjectTypeNumber != OB_TYPE_JOB)

             continue;

         HANDLE hSrcProc = NtOpenProcess(lpSHI->ProcessId);

         if (hSrcProc == NULL)

             continue;

         HANDLE hTmpProc = NULL;

         NtDuplicateObject(hSrcProc,

                           (HANDLE)lpSHI->Handle,

                           NtCurrentProcess(),

                           &hTmpProc,

                           PROCESS_ALL_ACCESS,

                           NULL,

                           NULL);

         PROCESS_BASIC_INFORMATION pbi = {};

         NtQueryInformationProcess(hTmpProc, ProcessBasicInformation, &pbi, sizeof(pbi), NULL);

         if (hTmpProc != NULL && pbi.UniqueProcessId != NULL && pbi.UniqueProcessId == dwPid)

             /*{

                 hTgtProc = hTmpProc;

                 printf("%d %d 0x%llX\n", lpSHI->ProcessId, pbi.UniqueProcessId, (DWORD64)lpSHI->Object);

             }*/

             hTgtProc = hTmpProc;

         NtClose(hSrcProc);

         if (hTgtProc != NULL)

             break;

         if (hTmpProc != NULL)

             NtClose(hTmpProc);

     }

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpBuf, &dwSize, MEM_RELEASE);

     return hTgtProc;

 }

 HANDLE PowerOpenProcess(DWORD dwPid)

 {

     HANDLE hProcess = NtOpenProcess(dwPid);

     if (hProcess != NULL && GetProcessId(hProcess) == dwPid)

         return hProcess;

     hProcess = DoOpenProcess(dwPid);

     if (hProcess != NULL && GetProcessId(hProcess) == dwPid)

         return hProcess;

     return NULL;

 }

 BOOL IsProcessExit(HANDLE hProcess)

 {

     DWORD dwExitCode = NULL;

     GetExitCodeProcess(hProcess, &dwExitCode);

     return dwExitCode != STILL_ACTIVE;

 }

 BOOL NtTerminateProcess(HANDLE hProcess)

 {

     return NT_SUCCESS(NtTerminateProcess(hProcess, NULL)) && IsProcessExit(hProcess);

 }

 BOOL JoTerminateProcess(HANDLE hProcess)

 {

     HANDLE hJob = NULL;

     OBJECT_ATTRIBUTES oa = {};

     oa.Length = sizeof(oa);

     if (!NT_SUCCESS(NtCreateJobObject(&hJob, JOB_OBJECT_ALL_ACCESS, &oa)))

         return FALSE;

     BOOL status = NT_SUCCESS(NtAssignProcessToJobObject(hJob, hProcess));

     if (status)

         status |= NT_SUCCESS(NtTerminateJobObject(hJob, NULL));

     NtClose(hJob);

     return status && IsProcessExit(hProcess);

 }

 BOOL CrtTerminateProcess(HANDLE hProcess)

 {

     //

     return FALSE;

 }

 BOOL WvmTerminateProcess(HANDLE hProcess)

 {

     BOOL status = FALSE;

     PVOID lpBuf = NULL;

     DWORD dwSize = 0x1000, dwRet = NULL;

     NtAllocateVirtualMemory(NtCurrentProcess(), (PVOID *)&lpBuf, NULL, &dwSize, MEM_COMMIT, PAGE_READWRITE);

     for (INT64 i = 0x70000000; i < 0x7FFEFFFF; i += dwSize)

     {

         status |= NT_SUCCESS(NtUnmapViewOfSection(hProcess, (PVOID)i));

         status |= NT_SUCCESS(NtProtectVirtualMemory(hProcess, (PVOID *)i, &dwSize, PAGE_READWRITE, &dwRet));

         status |= NT_SUCCESS(NtWriteVirtualMemory(hProcess, (PVOID)i, lpBuf, dwSize, (PULONG)&dwRet));

     }

     NtFreeVirtualMemory(hProcess, (PVOID *)&lpBuf, &dwSize, MEM_RELEASE);

     if (status)

         Sleep();

     return status && IsProcessExit(hProcess);

 }

 BOOL PowerTerminateProcess(HANDLE hProcess)

 {

     if (NtTerminateProcess(hProcess))

         return TRUE;

     if (JoTerminateProcess(hProcess))

         return TRUE;

     if (WvmTerminateProcess(hProcess))

         return TRUE;

     return FALSE;

 }

 BOOL GetProcessFilePath(HANDLE hProcess, LPSTR lpFilePath)

 {

     if (hProcess == NULL || lpFilePath == NULL)

         return FALSE;

     strcpy(lpFilePath, "");

     CHAR szDosPath[MAX_PATH] = "";

     if (!GetProcessImageFileNameA(hProcess, szDosPath, MAX_PATH))

         return FALSE;

     return DosPathToNtPath(szDosPath, lpFilePath);

 }

 BOOL DosPathToNtPath(LPCSTR lpDosPath, LPSTR lpNtPath)

 {

     CHAR szDriveList[MAX_PATH] = "";

     if (!GetLogicalDriveStringsA(MAX_PATH, szDriveList))

         return FALSE;

     for (int i = ; szDriveList[i]; i += )

     {

         if (stricmp(&szDriveList[i], "A:\\") ==  || stricmp(&szDriveList[i], "B:\\") == )

             continue;

         CHAR szNtDrive[MAX_PATH] = "", szDosDrive[MAX_PATH] = "";

         strcpy(szNtDrive, &szDriveList[i]);

         szNtDrive[] = '\0';

         if (!QueryDosDeviceA(szNtDrive, szDosDrive, MAX_PATH) ||

             strncmp(szDosDrive, lpDosPath, strlen(szDosDrive)) != )

             continue;

         strcpy(lpNtPath, szNtDrive);

         strcat(lpNtPath, &lpDosPath[strlen(szDosDrive)]);

         return TRUE;

     }

     return FALSE;

 }

 DWORD GetEProcess(DWORD dwPid)

 {

     PCHAR lpBuf = NULL;

     DWORD dwPreSize = 0x1000, dwSize = NULL;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpBuf,

                                             NULL, &dwPreSize,

                                             MEM_COMMIT, PAGE_READWRITE)) ||

         lpBuf == NULL)

         return NULL;

     NtQuerySystemInformation(SystemHandleInformation, (PVOID)lpBuf, dwPreSize, &dwSize);

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpBuf, &dwPreSize, MEM_RELEASE);

     lpBuf = NULL;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpBuf,

                                             NULL, &dwSize,

                                             MEM_COMMIT,

                                             PAGE_READWRITE)) ||

         lpBuf == NULL)

         return NULL;

     NtQuerySystemInformation(SystemHandleInformation, (PVOID)lpBuf, dwSize, NULL);

     DWORD dwNumberOfHandle = *(DWORD *)lpBuf;

     PSYSTEM_HANDLE_INFORMATION lpSHI = (PSYSTEM_HANDLE_INFORMATION)((PCHAR)lpBuf + sizeof(dwNumberOfHandle));

     DWORD dwEProcess = NULL;

     for (DWORD i = ; i < dwNumberOfHandle; i++, lpSHI++)

     {

         if (lpSHI->ObjectTypeNumber != OB_TYPE_PROCESS && lpSHI->ObjectTypeNumber != OB_TYPE_JOB)

             continue;

         HANDLE hSrcProc = NtOpenProcess(lpSHI->ProcessId);

         if (hSrcProc == NULL)

             continue;

         HANDLE hTmpProc = NULL;

         NtDuplicateObject(hSrcProc,

                           (HANDLE)lpSHI->Handle,

                           NtCurrentProcess(),

                           &hTmpProc,

                           PROCESS_ALL_ACCESS,

                           NULL,

                           NULL);

         PROCESS_BASIC_INFORMATION pbi = {};

         NtQueryInformationProcess(hTmpProc, ProcessBasicInformation, &pbi, sizeof(pbi), NULL);

         if (hTmpProc != NULL && pbi.UniqueProcessId != NULL && pbi.UniqueProcessId == dwPid)

             dwEProcess = (DWORD)lpSHI->Object;

         NtClose(hSrcProc);

         if (dwEProcess != NULL)

             break;

         if (hTmpProc != NULL)

             NtClose(hTmpProc);

     }

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpBuf, &dwSize, MEM_RELEASE);

     return dwEProcess;

 }

 DWORD GetParentProcessId(DWORD dwPid)

 {

     SYSTEM_PROCESSES sp = {};

     GetSystemProcess(dwPid, sp);

     return sp.InheritedFromProcessId;

 }

 BOOL GetProcessName(DWORD dwPid, LPSTR lpProcessName)

 {

     strcpy(lpProcessName, "");

     DWORD dwSize = NULL;

     PSYSTEM_PROCESSES lpbaSP = NULL;

     if (!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, NULL, NULL, &dwSize) || dwSize == NULL))

         return FALSE;

     if (!NT_SUCCESS(NtAllocateVirtualMemory(NtCurrentProcess(),

                                             (PVOID *)&lpbaSP,

                                             NULL,

                                             &dwSize,

                                             MEM_COMMIT,

                                             PAGE_READWRITE)) ||

         lpbaSP == NULL)

         return FALSE;

     if (!NT_SUCCESS(NtQuerySystemInformation(SystemProcessInformation, (PVOID)lpbaSP, dwSize, NULL)))

     {

         NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpbaSP, &dwSize, MEM_RELEASE);

         return FALSE;

     }

     BOOL status = FALSE;

     PSYSTEM_PROCESSES lpSP = lpbaSP;

     while (lpSP->NextEntryDelta != NULL)

     {

         if (dwPid == lpSP->ProcessId)

         {

             wcstombs(lpProcessName, lpSP->ProcessName.Buffer, MAX_PATH);

             status = TRUE;

             break;

         }

         lpSP = (PSYSTEM_PROCESSES)((ULONG)lpSP + lpSP->NextEntryDelta);

     }

     NtFreeVirtualMemory(NtCurrentProcess(), (PVOID *)&lpbaSP, &dwSize, MEM_RELEASE);

     return status;

 }

 LARGE_INTEGER GetProcessCreateTime(DWORD dwPid)

 {

     SYSTEM_PROCESSES sp = {};

     GetSystemProcess(dwPid, sp);

     return sp.CreateTime;

 }

ProcessFun.cpp

ProcessFun的更多相关文章

  1. 网络编程并发 多进程 进程池,互斥锁,信号量,IO模型

    进程:程序正在执行的过程,就是一个正在执行的任务,而负责执行任务的就是cpu 操作系统:操作系统就是一个协调.管理和控制计算机硬件资源和软件资源的控制程序. 操作系统的作用: 1:隐藏丑陋复杂的硬件接 ...

  2. multimap的使用 in C++，同一个关键码存在多个值

    #include <iostream> #include <string> #include <vector> #include <algorithm> ...

  3. 入门大数据---Flink学习总括

    第一节 初识 Flink 在数据激增的时代,催生出了一批计算框架.最早期比较流行的有MapReduce,然后有Spark,直到现在越来越多的公司采用Flink处理.Flink相对前两个框架真正做到了高 ...

随机推荐

  1. MFC不同窗口之间传递数据

    问题的由来: 最近在学习串口通信编程,参考的例子大多数都是在一个对话框中同时完成对串口的配置及数据收发的功能.这种方式不太适合于写自己的应用程序(会使得程序界面比较混乱,无法突出程序的重点),因此想让 ...

  2. Who Saw My Blog

    I found that my blog has visitors!!! I wonder who has watched my blog and what did they feel at that ...

  3. 探索Redis设计与实现1：Redis 的基础数据结构概览

    本文转自互联网 本系列文章将整理到我在GitHub上的<Java面试指南>仓库,更多精彩内容请到我的仓库里查看 https://github.com/h2pl/Java-Tutorial ...

  4. ARM 是什么

    ARM Advanced RISC Machines. RISC 就是reduced instruction set computer 精简指令集计算机DSP digtal signal Proces ...

  5. Name your feature branches by convention

    https://docs.microsoft.com/en-us/azure/devops/repos/git/git-branching-guidance?view=azure-devops Nam ...

  6. 运放参数的详细解释和分析-part1，输入偏置电流和输入失调电流【转】

    一般运放的datasheet中会列出众多的运放参数,有些易于理解,我们常关注,有些可能会被忽略了.在接下来的一些主题里,将对每一个参数进行详细的说明和分析.力求在原理和对应用的影响上把运放参数阐述清楚 ...

  7. Excel2016怎么批量删除空白行 如何删除空白行

    我们在编辑Excel文档的时候,如果表格中有大量的空白行,这时我们怎么样把它们批量删除呢?下面我们就一起来看看操作的方法吧.   工具/原料   Excel2016 方法/步骤     首先在电脑上打 ...

  8. GDB can't continue if no space left

    [root@premta ~]# df -hFilesystem Size Used Avail Use% Mounted on/dev/sda3 36G 36G 0 100% /tmpfs 1.5G ...

  9. PAT_A1089#Insert or Merge

    Source: PAT A1089 Insert or Merge (25 分) Description: According to Wikipedia: Insertion sort iterate ...

  10. activiti7查询流程定义的相关信息

    package com.zcc.activiti02; import org.activiti.engine.ProcessEngine;import org.activiti.engine.Proc ...