walk all Process(psapi)

#include <Windows.h>
#include <stdio.h>
#include <Psapi.h>
#pragma  comment(lib, "psapi.lib")
#include <varargs.h>



#define LOGON 1
#if LOGON
#define Log log
#else
#define Log //
#endif

void log(const char* format, ...)
{
    char Buf[1024];

    va_list vList;
    va_start(vList, format); 
    vsprintf(Buf, format, vList);
    va_end(vList);

    OutputDebugString(Buf);

}

#define  MAX_PROCESS 200

bool EnableDebugPrivilege()   ;

void WalkAllProcess();



int main()
{
    WalkAllProcess();

    return 0;
}

void WalkAllProcess()
{
    DWORD     dwProcessIDs[MAX_PROCESS];
    DWORD     dwBytesReturn                    =  0;

    EnumProcesses( dwProcessIDs
        , sizeof(DWORD) * MAX_PROCESS
        , &dwBytesReturn);

    DWORD dwProcessCount        = dwBytesReturn / sizeof(DWORD) ; //number of process

    for(int nIndex = 0; nIndex < dwProcessCount; ++nIndex)
    {
        CHAR   szProcName[MAX_PATH]         =    {0};
        CHAR   szProcPath[MAX_PATH]            =    {0};
        HMODULE    hModule[1024];
        DWORD   dwByteNeed;
        DWORD   dwModules;

        //EnableDebugPrivilege();
        HANDLE hProcess    = OpenProcess(PROCESS_ALL_ACCESS, NULL, dwProcessIDs[nIndex]);
        if(hProcess == 0 && GetLastError)
        {
            SetLastError(0);
            //continue;
        }
        SetLastError(0);
        EnumProcessModules(hProcess, hModule, sizeof(hModule), &dwByteNeed);

        dwModules = dwByteNeed / sizeof(DWORD);
        
        for(int i = 0; i< dwModules; ++i)
        {
            GetModuleBaseName(hProcess, hModule[i], szProcName, MAX_PATH);
            log("MODULE: %s\n", szProcName);
            
        }
    
        GetModuleBaseName(hProcess, hModule[0], szProcName, MAX_PATH);
        GetModuleFileNameEx(hProcess, hModule[0], szProcPath,  MAX_PATH);
        log("ID: %-6d\t NAME: %-15s Path:%s\n", dwProcessIDs[nIndex]
                                                , szProcName
                                                 ,szProcPath);

    }

}
    

bool EnableDebugPrivilege()     
{     
    HANDLE hToken;     
    LUID sedebugnameValue;     
    TOKEN_PRIVILEGES tkp;     
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))  
    {     
        return   FALSE;     
    }     
    if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue))    
    {     
        CloseHandle(hToken);     
        return false;     
    }     
    tkp.PrivilegeCount = 1;     
    tkp.Privileges[0].Luid = sedebugnameValue;     
    tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;     
    if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))   
    {     
        CloseHandle(hToken);     
        return false;     
    }     
    return true;     
     typedef int (* type_RtlAdjustPrivilege)(int, bool, bool, int*);
    type_RtlAdjustPrivilege RtlAdjustPrivilege = (type_RtlAdjustPrivilege)GetProcAddress(::GetModuleHandle("ntdll.dll"), "RtlAdjustPrivilege");

    int nOld;
    RtlAdjustPrivilege(0x20, true, true, &nOld);

     return true;

} 

 

posted on 2013-03-13 15:53  All IN  阅读(286)  评论(0)    收藏  举报

导航