獲得系統(tǒng)中運行的程序及使用的DLL文件
發(fā)表時間:2023-08-05 來源:明輝站整理相關軟件相關文章人氣:
[摘要]在Microsoft Visual Studio中提供了一個可以查看當前運行的程序的工具Process Viewer 可以查看系統(tǒng)中當前運行的程序,下面我來介紹在你的程序中如何實現(xiàn)這種功能。 ...
在Microsoft Visual Studio中提供了一個可以查看當前運行的程序的工具Process Viewer
可以查看系統(tǒng)中當前運行的程序,下面我來介紹在你的程序中如何實現(xiàn)這種功能。
Windows提供了一系列的API函數(shù)可以建立當前的程序、模塊、線程的“快照”(SnapShot)
利用這些“快照”函數(shù)就可以獲得當前的程序、模塊等的信息。
下面實現(xiàn)的步驟:
1、在Form1中加入一個CommandButton控件、兩個ListBox控件
2、在Form1中加入如下代碼:
Private Declare Function CreateToolhelp32Snapshot Lib "kernel32" _
(ByVal dwFlags As Long, ByVal th32ProcessID As Long) As Long
Private Declare Function Process32First Lib "kernel32" _
(ByVal hSnapshot As Long, lppe As PROCESSENTRY32) As Long
Private Declare Function Process32Next Lib "kernel32" _
(ByVal hSnapshot As Long, lppe As PROCESSENTRY32) As Long
Private Declare Function Module32First Lib "kernel32" _
(ByVal hSnapshot As Long, lppe As MODULEENTRY32) As Long
Private Declare Function Module32Next Lib "kernel32" _
(ByVal hSnapshot As Long, lppe As MODULEENTRY32) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal _
hObject As Long) As Long
Private Declare Function SendMessage Lib "user32" Alias _
"SendMessageA" (ByVal hwnd As Long, ByVal wMsg As _
Long, ByVal wParam As Long, lParam As Any) As Long
Private Type PROCESSENTRY32
dwSize As Long
cntUsage As Long
th32ProcessID As Long
th32DefaultHeapID As Long
th32ModuleID As Long
cntThreads As Long
th32ParentProcessID As Long
pcPriClassBase As Long
dwFlags As Long
szExeFile As String * 1024
End Type
Private Type MODULEENTRY32
dwSize As Long
th32ModuleID As Long
th32ProcessID As Long
GlblcntUsage As Long
ProccntUsage As Long
modBaseAddr As Byte
modBaseSize As Long
hModule As Long
szModule As String * 256
szExePath As String * 1024
End Type
Const LB_SETHORIZONTALEXTENT = &H194
Const TH32CS_SNAPHEAPLIST = &H1
Const TH32CS_SNAPPROCESS = &H2
Const TH32CS_SNAPTHREAD = &H4
Const TH32CS_SNAPMODULE = &H8
Const TH32CS_SNAPALL = (TH32CS_SNAPHEAPLIST Or TH32CS_SNAPPROCESS _
Or TH32CS_SNAPTHREAD Or TH32CS_SNAPMODULE)
Const TH32CS_INHERIT = &H80000000
Dim MyEntry(100) As PROCESSENTRY32
Private Sub Command1_Click()
Dim my As PROCESSENTRY32
Dim l As Long
List1.Clear
l = SendMessage(List1.hwnd, &H194, 640, 0)
'建立當前程序快照
l = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
If l Then
my.dwSize = 1060
If (Process32First(l, my)) Then '遍歷第一個程序
'遍歷所有程序直到返回值為False
Do
List1.AddItem (Trim$(my.szExeFile))
MyEntry(List1.ListCount - 1) = my
Loop Until (Process32Next(l, my) < 1)
End If
'關閉快照句柄
CloseHandle l
End If
End Sub
Private Sub Form_Load()
Command1_Click
End Sub
Private Sub List1_Click()
Dim l As Long
Dim mm As MODULEENTRY32
Dim lm As Long
Dim astr As String
If MyEntry(List1.ListIndex).th32ProcessID <> 0 Then
l = SendMessage(List2.hwnd, &H194, 640, 0)
List2.Clear
'根據(jù)程序快照句柄建立程序的模塊句柄
lm = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, _
MyEntry(List1.ListIndex).th32ProcessID)
If lm > 0 Then
mm.dwSize = Len(mm)
'獲得第一個模塊
If Module32First(lm, mm) Then
'遍歷所有模塊知道返回值為False
Do
If MyEntry(List1.ListIndex).th32ProcessID = _
mm.th32ProcessID Then
astr = Left$(mm.szModule, (InStr(1, _
mm.szModule, Chr(0)) - 1))
List2.AddItem astr
End If
Loop Until (Module32Next(lm, mm) < 1)
End If
CloseHandle (lm)
End If
End If
End Sub
運行程序,List1中就列出當前運行的所有的程序的名稱及路徑,點擊其中任一個列表,
在List2中就會列出這個程序所使用的DLL的文件名。按下Command1重新獲得系統(tǒng)中運行的程序。
上面只是通過簡單的程序介紹了“快照”的建立和使用,只要稍加改造,就可以獲得諸如
程序的線程數(shù)、模塊尺寸、模塊在內(nèi)存的基地址等信息。
以上程序在Windows95、VB5.0下運行通過。