通过进程名获取进程id

BOOL GetProcessInfo(wchar_t *szProcessName,ULONG * ProcessId)
{
	NTSTATUS	status;
	ULONG		RetLen;

	BOOL		bIsSuccess = FALSE;

	PVOID			ProcessInfo;
	SYSTEM_PROCESS_INFORMATION*	p;

	if (ProcessId == NULL || szProcessName == NULL)
	{
		return FALSE;
	}

	status = ZwQuerySystemInformation(SystemProcessInformation,0,0,&RetLen);
	if (status != STATUS_INFO_LENGTH_MISMATCH)
	{
		return bIsSuccess;
	}

	ProcessInfo = malloc(RetLen);
	if (ProcessInfo == NULL)
	{
		return bIsSuccess;
	}

	status = ZwQuerySystemInformation(SystemProcessInformation,ProcessInfo,RetLen,&RetLen);
	if (!NT_SUCCESS(status))
	{
		free(ProcessInfo);
		return bIsSuccess;
	}

	p = (SYSTEM_PROCESS_INFORMATION*)ProcessInfo;
	while(p->NextEntryOffset)
	{
		if (szProcessName != NULL &&
			 p->ImageName.Length >= wcslen(szProcessName) &&
			wcscmp(p->ImageName.Buffer,szProcessName) == 0)
		{
			bIsSuccess = TRUE;
			*ProcessId = (ULONG)p->ProcessId;
			break;
		}

		p = (SYSTEM_PROCESS_INFORMATION*)((ULONG)p + p->NextEntryOffset);
	}

	free(ProcessInfo);

	return bIsSuccess;
}

猜你喜欢

转载自blog.csdn.net/qq1841370452/article/details/78375539