以下程序从我的计算机中检索所有进程信息。通过dll调用同一个应用程序时,它无法检索系统进程信息。
// TestSysInternals.cpp : Defines the entry point for the console application.
//
#include "stdafx.h"
#include <windows.h>
#include "ntdll.h"
#include <Winternl.h>
#define VISTA_FILETYPE 25
#define XP_FILETYPE 28
static PNtQuerySystemInformation NtQuerySystemInformation_dynamic = NULL;
static DWORD curPid = 0;
static int nFileHandleType;
#define STATUS_INFO_LENGTH_MISMATCH 0xC0000004
int _tmain(int argc, _TCHAR* argv[])
{
NtQuerySystemInformation_dynamic = (PNtQuerySystemInformation)GetProcAddress(GetModuleHandle(TEXT("ntdll.dll")), ("NtQuerySystemInformation"));
// (PNtQuerySystemInformation)GetProcAddress(GetModuleHandle(_T("ntdll.dll")), _("NtQuerySystemInformation"));
nFileHandleType = XP_FILETYPE;
NTSTATUS status;
DWORD size = sizeof(SYSTEM_HANDLE_INFORMATION);
PSYSTEM_HANDLE_INFORMATION pSysHandleInformation = (PSYSTEM_HANDLE_INFORMATION)malloc(size);
DWORD needed = 0;
int nfound = 0;
while (!NT_SUCCESS(status = NtQuerySystemInformation_dynamic(SystemHandleInformation, pSysHandleInformation, size, &needed)))
{
if (status != STATUS_INFO_LENGTH_MISMATCH
|| needed == 0)
{
//DBGLOG("==>Failed Status=%l(%#X) Needed=%lu", status, status, needed);
goto CLEAN;// some other error
}
// The previously supplied buffer wasn't enough.
size = needed + 1024;
pSysHandleInformation = (PSYSTEM_HANDLE_INFORMATION)realloc(pSysHandleInformation, size);
}
DWORD i;
for (i = 0; i < pSysHandleInformation->Count; i++)
{
DWORD handlePid = pSysHandleInformation->Handles[i].ProcessID;
}
CLEAN:
free(pSysHandleInformation);
return nfound;
return 0;
}
头文件
#ifndef NT_DLL_H_INCLUDED
#define NT_DLL_H_INCLUDED
#include <Winternl.h>
#include <Windows.h>
typedef DWORD(WINAPI *PNtQuerySystemInformation)(DWORD, VOID*, DWORD, ULONG*);
typedef struct _SYSTEM_HANDLE
{
DWORD ProcessID;
BYTE HandleType;
BYTE HandleFlags;
WORD HandleNumber;
DWORD KernelAddress;
DWORD Flags;
} SYSTEM_HANDLE, *PSYSTEM_HANDLE;
typedef struct _SYSTEM_HANDLE_INFORMATION
{
DWORD Count;
SYSTEM_HANDLE Handles[1];
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;
#define NT_SUCCESS_K(Status) ((NTSTATUS)(Status) >= 0)
#define SystemHandleInformation (DWORD)0x10
#endif
通过调试手表检查 pSysHandleInformation->Handle
s 数组时,我可以看到以下信息。
根据图片,它为 processID 值提供了真实的进程 ID。但是,当我将相同的代码放入 dll 中时,processID 值会得到非常大的值,这在我的电脑中确实不存在,以下是我通过 dll 运行相同代码时获得的进程 id 值的屏幕截图。我不知道为什么当通过 dll 运行相同的代码时应用程序的行为会有所不同。非常感谢对这种有线行为的任何想法。