[C++] 纯文本查看 复制代码
#ifndef UNICODE
#define UNICODE
#endif // UNICODE
#ifndef _UNICODE
#define _UNICODE
#endif // _UNICODE
#include <stdio.h>
#include <tchar.h>
#include <Windows.h>
#include <winternl.h>
#include <Shlwapi.h>
/*
/// GetProcessImageFileName 函数
//windows7: kernel32.dll|.lib
// windows r8+: psapi.dll|.lib
#include <psapi.h>
*/
#pragma comment(lib, "shlwapi.lib")
#define SETVALUEFROMPOINTER(p, v) (*p=v)
#if defined(UNICODE) || defined(_UNICODE)
#define OutPutStr(f, v) wprintf_s(L##f, v)
#else
#define OutPutStr(f, v) printf_s(f, v)
#endif
DWORD GetParentPIDAndName( DWORD ProcessID, LPTSTR lpszBuffer_Parent_Name, PDWORD ErrCodeForBuffer );
int main(int argc, const char* argv[]) {
DWORD pid;
TCHAR buf[BUFSIZ] = {0};
DWORD err_code;
pid = GetParentPIDAndName(GetCurrentProcessId(), buf, &err_code);
if ( err_code ) {
fprintf(stderr, "GetProcessName--> err code: %lu\n", err_code);
}
OutPutStr("ParentProcessPID: %lu\n", pid);
OutPutStr("ParentProcessFullName: %s\n", buf);
PathStripPath(buf);
OutPutStr("ParentProcessName: %s\n", buf);
return 0;
}
typedef
__kernel_entry NTSTATUS
(NTAPI*NQIP)(
IN HANDLE ProcessHandle,
IN PROCESSINFOCLASS ProcessInformationClass,
OUT PVOID ProcessInformation,
IN ULONG ProcessInformationLength,
OUT PULONG ReturnLength OPTIONAL
);
DWORD GetParentPIDAndName( DWORD ProcessID, LPTSTR lpszBuffer_Parent_Name, PDWORD ErrCodeForBuffer ) {
/// 打开给定进程PID
HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, ProcessID);
if ( !ProcessID ) {
DWORD err_code = GetLastError();
fprintf_s(stderr, "[OpenProcess]err code: %lu\n", err_code);
return 0;
}
/// 下面是获取函数 NtQueryInformationProcess 的函数指针
HMODULE hNtdll = GetModuleHandle(_T("ntdll.dll"));
if ( !hNtdll ) {
DWORD err_code = GetLastError();
fprintf_s(stderr, "[GetModuleHandle]err code: %lu\n", err_code);
CloseHandle(hProcess);
return 0;
}
NQIP _NtQueryInformationProcess = (NQIP)GetProcAddress(hNtdll, "NtQueryInformationProcess");
if ( !_NtQueryInformationProcess ) {
DWORD err_code = GetLastError();
fprintf_s(stderr, "[GetProcAddress]err code: %lu\n", err_code);
CloseHandle(hProcess);
return 0;
}
//***
/// 获取打开的进程的进程进程信息
PROCESS_BASIC_INFORMATION pbi;
NTSTATUS status = _NtQueryInformationProcess(
hProcess,
ProcessBasicInformation,
(LPVOID)&pbi, sizeof(PROCESS_BASIC_INFORMATION),
NULL);
DWORD dwParentID = 0;
if ( NT_SUCCESS(status) ) {
/// 结构体 PROCESS_BASIC_INFORMATION 的 "Reserved3"字段 是父进程的PID
dwParentID = (LONG_PTR)pbi.Reserved3;
if ( NULL != lpszBuffer_Parent_Name ) {
HANDLE hParentProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwParentID);
if ( hParentProcess ) {
/// 用来接收进程文件名和路径的长度(必须!)
DWORD bufs;
/// 获取进程路径
BOOL ret = QueryFullProcessImageName(hParentProcess, 0, lpszBuffer_Parent_Name, &bufs);
if ( TRUE == ret )
SETVALUEFROMPOINTER(ErrCodeForBuffer, 0);
else
SETVALUEFROMPOINTER(ErrCodeForBuffer, GetLastError());
/*
/// 结果是DOS路径+文件名
TCHAR buf[BUFSIZ];
GetProcessImageFileName(hParentProcess, buf, BUFSIZ);
cout << "[GetProcessImageFileName]: " << buf << endl;
*/
}
else {
SETVALUEFROMPOINTER(ErrCodeForBuffer, GetLastError());
}
if ( hParentProcess )
CloseHandle(hParentProcess);
}
}
else {
DWORD err_code = GetLastError();
fprintf_s(stderr, "[NtQueryInformationProcess]err code: %lu\n", err_code);
}
CloseHandle(hProcess);
return dwParentID;
}