| 昨天在网上找监控程序,找了半天都没见到什么比较好的,有的呢,都只讲原理,没有给出一个可以直接运行的代码,没办法,参考了MSDN后写了下面的这个.这个并没有做文件的查找,因此,如果要对特定的文件作监控,修改路径与应用程序名.愿与大家共享,希望中国的明天有更多后继者.
原理都有很多人都讲过了,这里我就不再重复了,比较忙,没什么空写注释,请大家见谅.
适用平台:win NT以上
语言: C++
// testMonITor.cpp : 定义控制台应用程序的入口点。
//
#include "stdafx.h"
#include <cstdlib>
#include <windows.h>
#include <stdio.h>
#include <tchar.h>
#include <psapi.h>
#include <shellapi.h>
#pragma comment(lib, "psapi.lib")
void PrintProcessNameAndID( DWORD processID )
{
TCHAR szProcessName[MAX_PATH] = TEXT("<unknown>");
// Get a handle to the process.
HANDLE hProcess = OpenProcess( PROCESS_QUERY_INFORMATION |
PROCESS_VM_READ,
FALSE, processID );
// Get the process name.
if (NULL != hProcess )
{
HMODULE hMod;
DWORD cbNeeded;
if ( EnumProcessModules( hProcess, &hMod, sizeof(hMod),
&cbNeeded) )
{
GetModuleBaseName( hProcess, hMod, szProcessName,
sizeof(szProcessName)/sizeof(TCHAR) );
}
}
// Print the process name and identifier.
_tprintf( TEXT("%s (PID: %u)\n"), szProcessName, processID );
CloseHandle( hProcess );
}
void ReStartExe(DWORD processID)
{
TCHAR szProcessName[MAX_PATH] = TEXT("<unknown>");
// Get a handle to the process.
HANDLE hProcess = OpenProcess( PROCESS_QUERY_INFORMATION |
PROCESS_VM_READ,
FALSE, processID );
// Get the process name.
if (NULL != hProcess )
{
HMODULE hMod;
DWORD cbNeeded;
if ( EnumProcessModules( hProcess, &hMod, sizeof(hMod),
&cbNeeded) )
{
GetModuleBaseName( hProcess, hMod, szProcessName,
sizeof(szProcessName)/sizeof(TCHAR) );
}
}
// Print the process name and identifier.
_tprintf( TEXT("%s (PID: %u)\n"), szProcessName, processID );
CloseHandle( hProcess );
}
int _tmain(int argc, _TCHAR* argv[])
{
DWORD aProcesses[1024], cbNeeded, cProcesses;
unsigned int i;
while (true)
{
if ( !EnumProcesses( aProcesses, sizeof(aProcesses), &cbNeeded ) )
return 0;
// Calculate how many process identifiers were returned.
cProcesses = cbNeeded / sizeof(DWORD);
// Print the name and process identifier for each process.
TCHAR szProcessName[MAX_PATH] = TEXT("<unknown>");
TCHAR szFilePath[MAX_PATH] = TEXT("<unknown>");
TCHAR szFilePath2[MAX_PATH] = TEXT("<unknown>");
for ( i = 0; i < cProcesses; i++ )
{
DWORD processID = aProcesses[i];
// Get a handle to the process.
&nb [1] [2] 下一页
|
