본문 바로가기
프로그래밍/Windows

process list 출력

by 즉흥 2015. 5. 20.
728x90
반응형

방법 1. NtQuerySystemInformation (windows 2000/NT 이상에서 가능)

(출처: http://www.rohitab.com/discuss/topic/40504-using-ntquerysysteminformation-to-get-process-list/)



방법 2. CreateToolhelp32Snapshot





아.. 슈방 옛날에 구현해놨었는데 당시 무슨 패기였는지 삭제해버려서 다시 정리.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
#include <stdio.h>
#include <Windows.h>
#include <winternl.h>
 
#pragma comment(lib,"ntdll.lib"// Need to link with ntdll.lib import library. You can find the ntdll.lib from the Windows DDK.
 
typedef struct _SYSTEM_PROCESS_INFO
{
    ULONG                   NextEntryOffset;
    ULONG                   NumberOfThreads;
    LARGE_INTEGER           Reserved[3];
    LARGE_INTEGER           CreateTime;
    LARGE_INTEGER           UserTime;
    LARGE_INTEGER           KernelTime;
    UNICODE_STRING          ImageName;
    ULONG                   BasePriority;
    HANDLE                  ProcessId;
    HANDLE                  InheritedFromProcessId;
}SYSTEM_PROCESS_INFO,*PSYSTEM_PROCESS_INFO;
 
int main()
{
    NTSTATUS status;
    PVOID buffer;
    PSYSTEM_PROCESS_INFO spi;
 
    buffer=VirtualAlloc(NULL,1024*1024,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE); // We need to allocate a large buffer because the process list can be large.
 
    if(!buffer)
    {
        printf("\nError: Unable to allocate memory for process list (%d)\n",GetLastError());
        return -1;
    }
 
    printf("\nProcess list allocated at address %#x\n",buffer);
    spi=(PSYSTEM_PROCESS_INFO)buffer;
 
    if(!NT_SUCCESS(status=NtQuerySystemInformation(SystemProcessInformation,spi,1024*1024,NULL)))
    {
        printf("\nError: Unable to query process list (%#x)\n",status);
 
        VirtualFree(buffer,0,MEM_RELEASE);
        return -1;
    }
 
    while(spi->NextEntryOffset) // Loop over the list until we reach the last entry.
    {
        printf("\nProcess name: %ws | Process ID: %d\n",spi->ImageName.Buffer,spi->ProcessId); // Display process information.
        spi=(PSYSTEM_PROCESS_INFO)((LPBYTE)spi+spi->NextEntryOffset); // Calculate the address of the next entry.
    }
     
    printf("\nPress any key to continue.\n");
    getchar();
 
    VirtualFree(buffer,0,MEM_RELEASE); // Free the allocated buffer.
    return 0;
}
cs




1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
//프로세스 리스트 구해오기
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
PROCESSENTRY32 ProcessEntry32 = { 0, };
ProcessEntry32.dwSize = sizeof(ProcessEntry32);
if (Process32First(hSnapshot, &ProcessEntry32)){
    int i = 0;
    do{
        wstring PID = to_wstring(ProcessEntry32.th32ProcessID);
        Li.iItem = i;
        ListView_InsertItem(hList, &Li);
        ListView_SetItemText(hList, i, 0, (LPWSTR)PID.c_str());
        ListView_SetItemText(hList, i++1, (LPWSTR)ProcessEntry32.szExeFile);
    } while (Process32Next(hSnapshot, &ProcessEntry32));
    CloseHandle(hSnapshot);
}
cs





아래 링크는 리스트 뷰 사용하는 방법


728x90
반응형

댓글