几个常用函数

GetProcessIdByName proc szName: LPCSTR

local Process32Info: PROCESSENTRY32

local hSnapshot: HANDLE



        invoke CreateToolhelp32Snapshot, TH32CS_SNAPPROCESS, NULL

        mov hSnapshot, eax

        test eax, eax

        jz @done

        mov Process32Info.dwSize, sizeof PROCESSENTRY32

        invoke Process32First, hSnapshot, addr Process32Info

        test eax, eax

        jz @done ; failed

@searchforprocess:

        invoke lstrcmpi, szName, addr Process32Info.szExeFile

        test eax, eax

        jnz @F

        mov eax, Process32Info.th32ProcessID

        jmp @done

@@:

        invoke Process32Next, hSnapshot, addr Process32Info

        test eax, eax

        jnz @searchforprocess

@done:

        cmp hSnapshot, 0

        jz @F

        push eax

        invoke CloseHandle, hSnapshot

        pop eax

@@:

        ret

GetProcessIdByName endp


FindProcessThread proc PID

LOCAL hThreadSnap:dword

LOCAL te32:THREADENTRY32



        invoke CreateToolhelp32Snapshot,TH32CS_SNAPTHREAD,0

        mov hThreadSnap,eax

        mov te32.dwSize,sizeof THREADENTRY32

        invoke Thread32First,hThreadSnap,addr te32

        .if eax!=0

@@:

                mov eax,[te32.th32OwnerProcessID]

                .if eax!=PID

                        invoke Thread32Next,hThreadSnap,addr te32

                        .if eax==0

                                jmp @exit

                        .else

                                jmp @b

                        .endif

                .endif

                mov eax,te32.th32ThreadID

        .endif

        push eax

        invoke CloseHandle,hThreadSnap

        pop eax

@exit:

        ret

FindProcessThread endp


GetParentProcess proc

LOCAL ourPID :dword

LOCAL hProcessSnap :dword

LOCAL pe32 :PROCESSENTRY32

        invoke GetCurrentProcessId

        mov ourPID,eax

        invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,0

        mov hProcessSnap,eax

        mov pe32.dwSize,sizeof PROCESSENTRY32

        invoke Process32First,hProcessSnap,addr pe32

        .if eax==0

                jmp @exit

        .endif

@@:

        mov eax,pe32.th32ProcessID

        .if eax!=ourPID

                invoke Process32Next,hProcessSnap,addr pe32

                .if eax!=0

                        jmp @b

                .endif

        .endif

@exit:

        invoke CloseHandle,hProcessSnap

        mov eax,pe32.th32ParentProcessID

        ret



GetParentProcess endp


GetShell32Base proc uses ebx esi edi remoteproid:dword ,modname:dword

            LOCAL hSnapshot:dword

            LOCAL modinfo:MODULEENTRY32



        mov modinfo.dwSize,sizeof MODULEENTRY32

        invoke CreateToolhelp32Snapshot,TH32CS_SNAPMODULE,remoteproid

        mov hSnapshot,eax

        invoke Module32First,hSnapshot,addr modinfo

        .while eax

        lea ecx,modinfo.szModule

        invoke lstrcmpi,modname,ecx

        .if eax == 0

                mov eax,modinfo.modBaseAddr

                ret

        .endif

        invoke Module32Next,hSnapshot,addr modinfo

        .endw

        invoke CloseHandle,hSnapshot

        ret

GetShell32Base endp


KillProcess proc lpszExecutable:LPSTR

    LOCAL bLoop:BOOL

    LOCAL bResult:BOOL

    LOCAL pe32:PROCESSENTRY32

    LOCAL hProcess:HANDLE

    LOCAL hProcesses:HANDLE

    mov bLoop,TRUE

    mov bResult,FALSE

    invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,0

    mov hProcesses,eax ; Did not need 2 copies of your snap shot

    mov pe32.dwSize,SIZEOF PROCESSENTRY32



    invoke Process32First,hProcesses,ADDR pe32

    .IF eax

        .WHILE bLoop

            invoke CompareString, LOCALE_USER_DEFAULT, NORM_IGNORECASE, addr pe32.szExeFile, -1, lpszExecutable, -1

            .IF eax==2

                invoke OpenProcess, PROCESS_TERMINATE, FALSE, pe32.th32ProcessID ; With having addr pe32.th32ProcessID you were getting an invalid PID..

                .IF eax!=NULL

                    mov hProcess, eax ; Need to save the process handle to terminate

                    invoke TerminateProcess, hProcess, 0

                    invoke CloseHandle, hProcess

                    mov bResult,TRUE;

                .endif

            .endif

            invoke Process32Next, hProcesses, ADDR pe32

            mov bLoop,eax

        .endw

        invoke CloseHandle,hProcesses

    .endif

    mov eax,bResult

    ret

KillProcess endp