奇怪的问题枚举 windows进程的问题

dalixux 2008-09-28 09:38:30

下面是我写的枚举进程的代码直接运行的时候可以正常工作枚举进程但是OD加载进去后 Process32Next这个函数返回值是0 运行不成功
加入GetLastError（）返回的错误代码也是0
拷贝了MSDN 上的代码也是同样的问题直接运行可以但是 OD加载了运行就不行各位帮看下是不是我机器的问题
用汇编重写了下汇编里直接运行也是Process32Next错误返回的错误代码是参数不合法
#include "windows.h"
#include "stdio.h"
#include "stdlib.h"
#include <tlhelp32.h>

void main(void)
{
PROCESSENTRY32 Process;
HANDLE hSap;
int bret;
hSap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if(hSap == INVALID_HANDLE_VALUE)
{
printf("create snap error\n");
return;
}
RtlZeroMemory(&Process, sizeof (PROCESSENTRY32));
Process.dwSize = sizeof (PROCESSENTRY32);
bret = Process32First(hSap, &Process);
if(!bret)
{
printf("first error\n");
return;
}
do
{
printf("%s\n",Process.szExeFile);
if(0 == lstrcmp(Process.szExeFile, "taskmgr.exe"))
break;
}while(Process32Next(hSap,&Process));

}

汇编：
.386
.model flat,stdcall
option casemap:none

include windows.inc
include kernel32.inc
includelib kernel32.lib
include user32.inc
includelib user32.lib

.data
szTask db "taskmgr.exe",0
ProcessIds dd 1024 dup(0)
szText db "success",0
.data?
hProcess dd ?
stProcess PROCESSENTRY32 <?>
hSnap dd ?

.code

start:
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,0
.if eax == INVALID_HANDLE_VALUE
ret
.endif
mov hSnap,eax
invoke RtlZeroMemory,addr stProcess,sizeof PROCESSENTRY32
mov stProcess.dwSize,sizeof PROCESSENTRY32
invoke Process32First,hSnap,addr stProcess
.if eax == FALSE
ret
.endif
invoke lstrcmp,addr szTask,addr stProcess.szExeFile
.if eax != 0
@mm:
invoke Process32Next,hSnap, offset stProcess
.if eax == FALSE
invoke MessageBox,NULL,NULL,NULL,MB_OK
ret
.endif
invoke lstrcmp,addr szTask, addr stProcess.szExeFile
or eax,eax
jnz @mm
.endif
invoke MessageBox,NULL,szText,NULL,MB_OK
ret

end start

...全文

112 8 打赏收藏转发到动态举报

写回复

用AI写文章

8 条回复

切换为时间正序

请发表友善的回复…

发表回复

dalixux 2008-09-28

打赏
举报

俺还想知道汇编的有问题么？
C的我这里运行也正常只是调试器加载以后不正常可能是被OD 的隐藏插件给HOOK了
汇编的无调试器直接运行也是 Process32Next那边调用不成功返回的错误代码是参数不合法
Process32First 调用成功谁能看下我汇编的代码哪里错了？
[Quote=引用 4 楼 xkyx_cn 的回复:]
我这儿运行没问题：
C/C++ code

/*
[System Process]
System
smss.exe
csrss.exe
wininit.exe
csrss.exe
services.exe
lsass.exe
lsm.exe
winlogon.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
audiodg.exe
SLsvc.exe
svchost.exe
svchost.exe
spoolsv.exe
svchost.exe
taskeng.exe
dwm.exe
explorer.exe
taskeng.exe
MSASCui.exe
GrooveMonitor.exe
WebThunder.exe
rundll32.exe
rundll32.…
[/Quote]

xkyx_cn 2008-09-28

打赏
举报

我这儿运行没问题：



/*

[System Process]

System

smss.exe

csrss.exe

wininit.exe

csrss.exe

services.exe

lsass.exe

lsm.exe

winlogon.exe

svchost.exe

svchost.exe

svchost.exe

svchost.exe

svchost.exe

svchost.exe

audiodg.exe

SLsvc.exe

svchost.exe

svchost.exe

spoolsv.exe

svchost.exe

taskeng.exe

dwm.exe

explorer.exe

taskeng.exe

MSASCui.exe

GrooveMonitor.exe

WebThunder.exe

rundll32.exe

rundll32.exe

sidebar.exe

ehtray.exe

msnmsgr.exe

wmpnscfg.exe

ONENOTEM.EXE

ehmsas.exe

sqlservr.exe

svchost.exe

sqlwriter.exe

svchost.exe

vmware-authd.exe

vmount2.exe

vmnat.exe

svchost.exe

SearchIndexer.exe

vmnetdhcp.exe

wmpnetwk.exe

usnsvc.exe

MSDEV.EXE

Maxthon.exe

TrustedInstaller.exe

MSDEV.EXE

conime.exe

VCSPAWN.EXE

kitscode.exe

Press any key to continue

*/