DWORD FindProcess(char *strProcessName) { DWORD aProcesses[1024], cbNeeded, cbMNeeded; HMODULE hMods; HANDLE hProcess; char szProcessName[MAX_PATH];
if ( !EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) ) return 0; for(int i=0; i< (int) (cbNeeded / sizeof(DWORD)); i++) { //_tprintf(_T("%d\t"), aProcesses[i]);
hProcess = OpenProcess( PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, aProcesses[i]); EnumProcessModules(hProcess, &hMods, sizeof(hMods), &cbMNeeded); GetModuleFileNameEx( hProcess, hMods, szProcessName,sizeof(szProcessName)); //GetModuleBaseName(hProcess,hMods,chBuf,nBufSize))
if(strstr(szProcessName, strProcessName)) { //_tprintf(_T("%s;"), szProcessName);
TRACE("找到执行的文件名");
return(aProcesses[i]); } //_tprintf(_T("\n"));
} return 0; }
BOOL GetDebugPriv() { HANDLE hToken; LUID sedebugnameValue; TOKEN_PRIVILEGES tkp;
if ( ! OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) ) { return FALSE; }
if ( ! LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &sedebugnameValue ) ) { CloseHandle( hToken ); return FALSE; }
tkp.PrivilegeCount = 1; tkp.Privileges[0].Luid = sedebugnameValue; tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges( hToken, FALSE, &tkp, sizeof tkp, NULL, NULL ) ) { CloseHandle( hToken ); return FALSE; }
return TRUE; }
|