为什么EnumProcessModulesEx不能够全部枚举所有进程下的所在路径

[袁梦]

Option Explicit
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)
Private Declare Sub ZeroMemory Lib "kernel32" Alias "RtlZeroMemory" (Destination As Any, ByVal numBytes As Long)

'进程函数
Private Declare Function GetCurrentProcess Lib "kernel32" () As Long
Private Declare Function IsWow64Process Lib "kernel32" (ByVal hProcess As Long, Wow64Process As Boolean) As Boolean
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal Handle As Long) As Long
Private Const PROCESS_TERMINATE = &H1
Private Const PROCESS_VM_OPERATION = &H8
Private Const PROCESS_VM_READ = &H10
Private Const PROCESS_QUERY_INFORMATION = &H400
Private Const PROCESS_QUERY_LIMITED_INFORMATION = &H1000

Private Declare Function GetModuleHandle Lib "kernel32" Alias "GetModuleHandleA" (ByVal lpModuleName As String) As Long
Private Declare Function GetModuleFileName Lib "kernel32" Alias "GetModuleFileNameA" (ByVal hModule As Long, ByVal lpFileName As String, ByVal nSize As Long) As Long
Private Declare Function GetModuleFileNameEx Lib "Psapi" Alias "GetModuleFileNameExA" (ByVal hProcess As Long, ByVal hModule As Long, ByVal lpFileName As String, ByVal nSize As Long) As Long
Private Declare Function GetModuleBaseName Lib "Psapi" Alias "GetModuleBaseNameA" (ByVal hProcess As Long, ByVal hModule As Long, ByVal lpBaseName As String, ByVal nSize As Long) As Long
Private Declare Function GetMappedFileName Lib "Psapi" Alias "GetMappedFileNameA" (ByVal hProcess As Long, lpv As Any, ByVal lpFileName As String, ByVal nSize As Long) As Long
Private Declare Function GetModuleInformation Lib "Psapi" (ByVal hProcess As Long, ByVal hModule As Long, ModuleInfo As Any, ByVal nSize As Long) As Long
Private Declare Function GetProcessImageFileName Lib "Psapi" Alias "GetProcessImageFileNameA" (ByVal hProcess As Long, ByVal lpImageFileName As String, ByVal nSize As Long) As Long
Private Declare Function GetProcessMemoryInfo Lib "Psapi" (ByVal hProcess As Long, ppsmemCounters As Any, ByVal nSize As Long) As Long
Private Declare Function EnumProcessModules Lib "Psapi" (ByVal hProcess As Long, hModule As Long, ByVal cch As Long, lpcbNeeded As Long) As Long
Private Declare Function EnumProcessModulesEx Lib "Psapi" (ByVal hProcess As Long, hModule As Long, ByVal cch As Long, lpcbNeeded As Long, ByVal dwFilterFlag As Long) As Long
Private Declare Function CreateToolhelpSnapshot Lib "kernel32" Alias "CreateToolhelp32Snapshot" (ByVal lFlags As Long, ByVal lProcessID As Long) As Long
Private Declare Function ProcessFirst Lib "kernel32" Alias "Process32First" (ByVal hSnapShot As Long, uProcess As PROCESSENTRY32) As Long
Private Declare Function ProcessNext Lib "kernel32" Alias "Process32Next" (ByVal hSnapShot As Long, uProcess As PROCESSENTRY32) As Long
Private Type PROCESSENTRY32
    dwSize As Long
    cntUsage As Long
    th32ProcessID As Long
    th32DefaultHeapID As Long
    th32ModuleID As Long
    cntThreads As Long
    th32ParentProcessID As Long
    pcPriClassBase As Long
    dwFlags As Long
    szExeFile As String * 260
End Type
Private Declare Function ModuleFirst Lib "kernel32" Alias "Module32First" (ByVal hSnapShot As Long, lpModule As MODULEENTRY32) As Long
Private Declare Function ModuleNext Lib "kernel32" Alias "Module32Next" (ByVal hSnapShot As Long, lpModule As MODULEENTRY32) As Long
Private Const MAX_MODULE_NAME32 = 255
Private Type MODULEENTRY32
    dwSize As Long
    th32ModuleID As Long
    th32ProcessID As Long
    GlblcntUsage As Long
    ProccntUsage As Long
    modBaseAddr As Byte
    modBaseSize As Long
    hModule As Long
    szModule As String * 256
    szExePath As String * 260
End Type
Private Const TH32CS_SNAPPROCESS = &H2
Private Const TH32CS_SNAPMODULE = &H8
Private Const TH32CS_SNAPMODULE32 = &H10

'阅历路径
Private Function EnumPathFromProcess() As Long
Dim hProcess  As Long, hModule As Long, NeedByteCount As Long, hProcessSnap As Long, mProcessEntry As PROCESSENTRY32, ProcessCount As Long, sModuleFile As String, sProcessName As String
hProcessSnap = CreateToolhelpSnapshot(TH32CS_SNAPPROCESS, 0)
If hProcessSnap <> -1 Then
   mProcessEntry.dwSize = LenB(mProcessEntry)
   If ProcessFirst(hProcessSnap, mProcessEntry) Then
      Do
        sProcessName = mProcessEntry.szExeFile
        If InStr(sProcessName, vbNullChar) > 0 Then sProcessName = VBA.Left(sProcessName, InStr(sProcessName, vbNullChar) - 1)
        hProcess = OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ Or PROCESS_QUERY_LIMITED_INFORMATION, 0, mProcessEntry.th32ProcessID)
        If hProcess <> -1 Then
           EnumProcessModulesEx hProcess, ByVal 0, 0, NeedByteCount, 3
           If NeedByteCount > 0 Then
              EnumProcessModulesEx hProcess, hModule, 4, NeedByteCount, 3
              sModuleFile = String(260, vbNullChar)
              If GetModuleFileNameEx(hProcess, hModule, sModuleFile, 260) Then
                 If InStr(sModuleFile, vbNullChar) > 0 Then sModuleFile = VBA.Left(sModuleFile, InStr(sModuleFile, vbNullChar) - 1)
              Else
                 sModuleFile = ""
              End If
           End If
           CloseHandle hProcess
        End If
        ProcessCount = ProcessCount + 1
        Debug.Print mProcessEntry.th32ProcessID, mProcessEntry.cntThreads, ProcessCount, sProcessName, sModuleFile
      Loop While ProcessNext(hProcessSnap, mProcessEntry)
   End If
   CloseHandle hProcessSnap
End If
EnumPathFromProcess = ProcessCount
End Function

[赵4老师]

参考微软官网在线MSDN

[袁梦]

EnumProcessModulesEx、ZwQueryInformationProcess好像只能获取当前用户下的进程,算了就结贴吧