获取进程模块
程序代码:
// 获取进程的pid、加载模块 #include <windows.h> #include <stdio.h> #include <tlhelp32.h> DWORD name2processID(char *img_name,int flag); int help_info(); int main(int argc,char *argv[]) { char *name; int i=1,pro_number=argc-1; DWORD pro_id[pro_number]; if( argc==1 ) help_info(); else if ( 0 == strcmp(argv[1] , "-h")) help_info(); else if ( 0 == strcmp(argv[1] , "-l")) name2processID(NULL,1); else if ( 0 == strcmp(argv[1] , "-m")) if(argc == 2) { printf("[+]missing ProcessName.\n"); return -1; } else name2processID(argv[2],2); else if ( 0 == strcmp(argv[2] , "-m")) name2processID(argv[1],2); else if ( argv[1][0] == '-') { printf("unknown parameter."); return -1; } else{ while(i<=pro_number) { pro_id[i-1]=name2processID(argv[i],0); ++i; } i=1; printf("\n[+]processname processpid\n"); while(i<=pro_number) { printf("\n--%s \t\t %d\n",argv[i],pro_id[i-1]); ++i; } } return 0; } DWORD name2processID(char *img_name, int flag) { HANDLE process_snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);//获得快照句柄 if(process_snap == (HANDLE)-1) return 0; //pe32中的dwSize字段必须赋初值,否则在执行Process32First函数时会出错 PROCESSENTRY32 process_enter; [local]1[/local] process_enter.dwSize = sizeof(PROCESSENTRY32);//列举所有进程信息 if(!Process32First(process_snap,&process_enter)) return -1; if( 1 == flag ) { printf("[pid]\t\t [FileName]\n"); do { printf("%d\t\t %s\n",process_enter.th32ProcessID,process_enter.szExeFile); }while (Process32Next(process_snap,&process_enter)); } else if ( 0 == flag) { do { if(0 == strcmpi(img_name, process_enter.szExeFile)) return process_enter.th32ProcessID; }while (Process32Next(process_snap,&process_enter)); } else if ( 2 == flag) { HANDLE hSnapshot; MODULEENTRY32 hMod; hMod.dwSize=sizeof(MODULEENTRY32); do { if(0 == strcmpi(img_name, process_enter.szExeFile)) break; }while (Process32Next(process_snap,&process_enter)); hSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, process_enter.th32ProcessID); if(TRUE == Module32First(hSnapshot, &hMod)) { printf("\n+ProcessPid = %d \n",process_enter.th32ProcessID); printf("[Module name] \t\t [Module Full Path]\n"); do { printf("\n%s \t\t %s",hMod.szModule,hMod.szExePath); }while(Module32Next(hSnapshot, &hMod)); puts("\n"); } } else return -1; CloseHandle(process_snap); return 0; } int help_info() { char help[]= "\n[write by rs]\n\n" "Options:\n" "-h to get this info.\n" "-l to list all the process and it's pid\n" "-m processname to list All the Modules in a Processes.\n\n" "Usage: getpid -m ProcessName\n" " getpid -l\n" " getpid [processname] [processname] ...\n"; puts(help); return 0; }
getpid.rar
(6.6 KB)