15,473
社区成员




#if !defined NTSTATUS
typedef LONG NTSTATUS;
#endif
#if !defined PROCESSINFOCLASS
typedef LONG PROCESSINFOCLASS;
#endif
#if !defined PPEB
typedef struct _PEB *PPEB;
#endif
#if !defined PROCESS_BASIC_INFORMATION
typedef struct _PROCESS_BASIC_INFORMATION {
PVOID Reserved1;
PPEB PebBaseAddress;
PVOID Reserved2[2];
ULONG_PTR UniqueProcessId;
PVOID Reserved3;
} PROCESS_BASIC_INFORMATION;
#endif;
typedef NTSTATUS (WINAPI * PFN_ZWQUERYINFORMATIONPROCESS)(HANDLE, PROCESSINFOCLASS,
PVOID, ULONG, PULONG);
DWORD GetProcessIDbyProcessHandleZw(HANDLE hProcess)
{
HINSTANCE hNtDll = LoadLibraryW(L"ntdll.dll");
if (hNtDll == NULL) return 0xffffffff;
PFN_ZWQUERYINFORMATIONPROCESS fnProcInfo = PFN_ZWQUERYINFORMATIONPROCESS(
::GetProcAddress(hNtDll, "ZwQueryInformationProcess"));
if (fnProcInfo == NULL)
{
CloseHandle(hNtDll);
return 0xffffffff;
}
PROCESS_BASIC_INFORMATION pbi;
ZeroMemory(&pbi, sizeof(PROCESS_BASIC_INFORMATION));
if (fnProcInfo(hProcess, 0, &pbi, sizeof(PROCESS_BASIC_INFORMATION), NULL) == 0)
{
CloseHandle(hNtDll);
return pbi.UniqueProcessId;
}
else
{
CloseHandle(hNtDll);
return 0xffffffff;
}
}
DWORD GetProcessIDbyProcessHandleZw(HANDLE hProcess)
{
HINSTANCE hNtDll = LoadLibraryW(L"ntdll.dll");
if (hNtDll == NULL) return 0xffffffff;
PFN_ZWQUERYINFORMATIONPROCESS fnProcInfo = PFN_ZWQUERYINFORMATIONPROCESS(
::GetProcAddress(hNtDll, "ZwQueryInformationProcess"));
if (fnProcInfo == NULL)
{
CloseHandle(hNtDll);
return 0xffffffff;
}
PROCESS_BASIC_INFORMATION pbi;
ZeroMemory(&pbi, sizeof(PROCESS_BASIC_INFORMATION));
if (fnProcInfo(hProcess, 0, &pbi, sizeof(PROCESS_BASIC_INFORMATION), NULL) == 0)
{
CloseHandle(hNtDll);
return pbi.UniqueProcessId;
}
else
{
CloseHandle(hNtDll);
return 0xffffffff;
}
}
后面的就是
EnumWindows
GetWindowThreadProcessId
枚举所有窗口,比较其ProcessId