C/C++ 进程线程操作技术

手动创建单进程: 下面通过一个实例来分别演示进程的创建函数.

#include <windows.h>
#include <stdio.h>

BOOL WinExec(char *pszExePath, UINT uiCmdShow)
{
    UINT uiRet = 0;
    uiRet = ::WinExec(pszExePath, uiCmdShow);
    if (31 < uiRet)
    {
        return TRUE;
    }
    return FALSE;
}

BOOL ShellExecute(char *pszExePath, UINT uiCmdShow)
{
    HINSTANCE hInstance = 0;
    hInstance = ::ShellExecute(NULL, NULL, pszExePath, NULL, NULL, uiCmdShow);
    if (32 < (DWORD)hInstance)
    {
        return TRUE;
    }
    return FALSE;
}

BOOL Exec_Run(LPCSTR exe_file)
{
    PROCESS_INFORMATION pi = { 0 };
    STARTUPINFO si = { 0 };
    si.cb = sizeof(STARTUPINFO);

    BOOL bRet = CreateProcessA(exe_file,
        NULL, NULL, NULL, FALSE,
        NULL, NULL, NULL, &si, &pi);

    if (bRet != FALSE)
    {
        CloseHandle(pi.hThread);
        CloseHandle(pi.hProcess);
        return TRUE;
    }
    return FALSE;
}

int main(int argc, char * argv[])
{
    int ret = 0;
    ret = Exec_Run("c:\\windows\\system32\\notepad.exe");
    printf("执行状态: %d \n", ret);

    system("pause");
    return 0;
}

手动创建多线程: 多线程的创建需要使用CreateThread()其内部应该传递进去ThreadProc()线程执行函数,运行结束后恢复.

#include <Windows.h>
#include <iostream>

int Global_One = 0;
CRITICAL_SECTION g_cs;

// 定义一个线程函数
DWORD WINAPI ThreadProc(LPVOID lpParam)
{
    // 加锁防止线程数据冲突
    EnterCriticalSection(&g_cs);
    for (int x = 0; x < 10; x++)
    {
        Global_One++;
        Sleep(1);
    }
    // 执行完修改以后,需要释放锁
    LeaveCriticalSection(&g_cs);
    return 0;
}

int main()
{
    // 初始化锁
    InitializeCriticalSection(&g_cs);

    HANDLE hThread[10] = { 0 };

    for (int x = 0; x < 10; x++)
    {
        // 循环创建线程
        hThread[x] = CreateThread(NULL, 0, ThreadProc, NULL, 0, NULL);
    }
    // 等待多个线程执行结束.
    WaitForMultipleObjects(10, hThread, TRUE, INFINITE);

    // 最后循环释放资源
    for (int x = 0; x < 10; x++)
    {
        CloseHandle(hThread[x]);
    }

    printf("Global: %d \n", Global_One);
    DeleteCriticalSection(&g_cs);

    system("pause");
    return 0;
}

强制终止一个进程: 在进程正常进行退出时,会调用ExitProcess()正常关闭程序,也可以调用TerminateProcess()强制销毁进程.

#include <windows.h>
#include <stdio.h>

int Get_ProcessID(LPCSTR path)
{
    HWND hWnd = FindWindow(NULL, path);
    if (hWnd != NULL)
    {
        DWORD dwPid = 0;
        GetWindowThreadProcessId(hWnd, &dwPid);
        if (dwPid != 0)
            return dwPid;
    }
    return -1;
}

int main(int argc,char * argv [])
{
    int pid = 0;

    pid = Get_ProcessID("新建文本文档.txt - 记事本");
    printf("进程PID为: %d \n", pid);

    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
    if (hProcess != NULL)
    {
        TerminateProcess(hProcess, 0);   // 终止进程
    }

    system("pause");
    return 0;
}

判断进程是否存在: 通过循环遍历所有进程,并对比szExeFile名称是否与pName一致,来实现判断进程是否正在运行中.

#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>

int Get_Process_Status(const char *procressName)
{
    char pName[MAX_PATH];
    strcpy(pName, procressName);                           // 拷贝数组
    CharLowerBuff(pName, MAX_PATH);                        // 将名称转换为小写

    PROCESSENTRY32 currentProcess;                                    // 存放快照进程信息的一个结构体
    currentProcess.dwSize = sizeof(currentProcess);                   // 在使用这个结构之前,先设置它的大小
    HANDLE hProcess = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); // 给系统内的所有进程拍一个快照

    if (INVALID_HANDLE_VALUE != hProcess)
    {
        BOOL bMore = Process32First(hProcess, &currentProcess);
        while (bMore)
        {
            CharLowerBuff(currentProcess.szExeFile, MAX_PATH);        // 将进程名转换为小写
            if (strcmp(currentProcess.szExeFile, pName) == 0)         // 比较是否存在此进程
            {
                CloseHandle(hProcess);
                return 1;
            }
            bMore = Process32Next(hProcess, &currentProcess);
        }
        CloseHandle(hProcess);
    }
    return -1;
}

int main(int argc,char * argv [])
{
    int ret = Get_Process_Status("qq.exe");

    if (ret == 1)
        printf("正在运行. \n");
    else
        printf("没有运行. \n");

    system("pause");
    return 0;
}

遍历获取进程PID:

#include <windows.h>
#include <stdio.h>
#include <TlHelp32.h>

DWORD FindProcessID(LPCTSTR szProcessName)
{
    DWORD dwPID = 0xFFFFFFFF;
    HANDLE hSnapShot = INVALID_HANDLE_VALUE;
    PROCESSENTRY32 pe;
    pe.dwSize = sizeof(PROCESSENTRY32);
    hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, NULL);
    Process32First(hSnapShot, &pe);
    do
    {
        if (!_tcsicmp(szProcessName, (LPCTSTR)pe.szExeFile))
        {
            dwPID = pe.th32ProcessID;
            break;
        }
    } while (Process32Next(hSnapShot, &pe));
    CloseHandle(hSnapShot);
    return dwPID;
}

int main(int argc,char *argv[])
{
    DWORD PID = FindProcessID(L"qq.exe");
    printf("该进程PID是: %d \n", PID);

    system("pause");
    return 0;
}

枚举系统中所有进程:

#include <windows.h>
#include <stdio.h>
#include <TlHelp32.h>

int EnumProcess()
{
    PROCESSENTRY32 pe32 = { 0 };
    pe32.dwSize = sizeof(PROCESSENTRY32);

    // 获取全部进程快照
    HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (INVALID_HANDLE_VALUE != hProcessSnap)
    {
        // 获取快照中第一条信息
        BOOL bRet = Process32First(hProcessSnap, &pe32);
        while (bRet)
        {
            printf("进程ID: %-5d --> 进程名: %s \n", pe32.th32ProcessID, pe32.szExeFile);
            // 获取快照中下一条信息
            bRet = Process32Next(hProcessSnap, &pe32);
        }
        CloseHandle(hProcessSnap);
    }
    return -1;
}

int main(int argc,char * argv [])
{
    EnumProcess();

    system("pause");
    return 0;

}

枚举指定进程中的DLL模块: 枚举出指定PID进程中所加载的DLL

#include <windows.h>
#include <stdio.h>
#include <TlHelp32.h>

int EnumProcessModule(DWORD Pid)
{
    MODULEENTRY32 me32 = { 0 };
    me32.dwSize = sizeof(MODULEENTRY32);
    // 获取指定进程全部模块的快照
    HANDLE hModuleSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, Pid);

    if (INVALID_HANDLE_VALUE != hModuleSnap)
    {
        // 获取快照中第一条信息
        BOOL bRet = Module32First(hModuleSnap, &me32);
        while (bRet)
        {
            printf("模块基址: 0x%p --> 大小: %-8d --> 模块名: %-25s -> 路径: %s \n",
                me32.modBaseAddr, me32.modBaseSize, me32.szModule,me32.szExePath);

            // 获取快照中下一条信息
            bRet = Module32Next(hModuleSnap, &me32);
        }
        CloseHandle(hModuleSnap);
        return 0;
    }
    return -1;
}

int main(int argc,char * argv [])
{
    EnumProcessModule(1920);

    system("pause");
    return 0;
}

枚举进程中线程ID:

#include <windows.h>
#include <stdio.h>
#include <TlHelp32.h>

int EnumThread(DWORD Pid)
{
    THREADENTRY32 te32 = { 0 };
    te32.dwSize = sizeof(THREADENTRY32);
    int index = 0;

    // 获取全部线程快照
    HANDLE hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
    if (INVALID_HANDLE_VALUE != hThreadSnap)
    {
        // 获取快照中第一条信息
        BOOL bRet = Thread32First(hThreadSnap, &te32);
        while (bRet)
        {
            // 只过滤出 Owner Process ID = pid 的线程ID
            if (Pid == te32.th32OwnerProcessID)
            {
                printf("线程ID: %6d --> 大小: %d \n", te32.th32ThreadID,te32.dwSize);
                ++index;
            }

            // 获取快照中下一条信息
            bRet = Thread32Next(hThreadSnap, &te32);
        }
        CloseHandle(hThreadSnap);
        return index;
    }
    return -1;
}

int main(int argc,char * argv [])
{
    int tid_count = EnumThread(9868);
    printf("线程数: %d \n", tid_count);

    system("pause");
    return 0;
}

判断进程是否重复运行:

#include <Windows.h>
#include <stdio.h>

// 判断是否重复运行
BOOL IsAlreadyRun()
{
    HANDLE hMutex = NULL;
    hMutex = CreateMutex(NULL, FALSE, "RUN");
    if (hMutex)
    {
        if (ERROR_ALREADY_EXISTS == GetLastError())
            return TRUE;
    }
    return FALSE;
}

int main(int argc, const char * argv[])
{
    if (IsAlreadyRun() == TRUE)
        printf("重复运行 \n");
    else
        printf("没有重复运行 \n");

    system("pause");
    return 0;
}

循环干掉特定进程: 该方式只能干掉普通的检测程序，无法干掉带有自保护的杀软，需要加载驱动。

#include <stdio.h>
#include <windows.h>
#include <tlhelp32.h>

int Kill_AV_Process(char *kill_list[],int Count)
{
    PROCESSENTRY32 currentProcess;
    currentProcess.dwSize = sizeof(currentProcess); 
    HANDLE hProcess = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

    if (INVALID_HANDLE_VALUE != hProcess)
    {
        BOOL bMore = Process32First(hProcess, &currentProcess);
        while (bMore)
        {
            CharLowerBuff(currentProcess.szExeFile, MAX_PATH);

            for (int each = 0; each < Count; each++)
            {
                if (strcmp(currentProcess.szExeFile, kill_list[each]) == 0)
                {
                    // printf("干掉进程 --> %s \n", kill_list[each]);
                    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, currentProcess.th32ProcessID);
                    TerminateProcess(hProcess, 0);
                }
            }
            bMore = Process32Next(hProcess, &currentProcess);
        }
        CloseHandle(hProcess);
    }
    return -1;
}

int main(int argc, char * argv[])
{
    // 填写杀毒软件的进程名称,然后循环干掉进程
    char *fuck[10] = { "chrome.exe", "360.exe","qqpctray.exe","qqpcrtp.exe","qmdl.exe" };
    Kill_AV_Process(fuck,5);

    system("pause");
    return 0;
}

暂停/恢复指定的线程:

#include <windows.h>
#include <stdio.h>
#include <TlHelp32.h>

int Start_Stop_Thread(DWORD Pid,DWORD ThreadID)
{
    THREADENTRY32 te32 = { 0 };
    te32.dwSize = sizeof(THREADENTRY32);

    // 获取全部线程快照
    HANDLE hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
    if (INVALID_HANDLE_VALUE != hThreadSnap)
    {
        // 获取快照中第一条信息
        BOOL bRet = Thread32First(hThreadSnap, &te32);
        while (bRet)
        {
            // 只过滤出 pid 里面的线程
            if (Pid == te32.th32OwnerProcessID)
            {
                // 判断是否为ThreadID,暂停指定的TID
                if (ThreadID == te32.th32ThreadID)
                {
                    // 打开线程
                    HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te32.th32ThreadID);

                    SuspendThread(hThread);     // 暂停线程
                    //ResumeThread(hThread);    // 恢复线程
                    CloseHandle(hThreadSnap);
                }
            }
            // 获取快照中下一条信息
            bRet = Thread32Next(hThreadSnap, &te32);
        }
        return 0;
    }
    return -1;
}

int main(int argc, char * argv[])
{
    // 暂停或恢复进程ID = 4204 里面的线程ID = 10056
    int ret = Start_Stop_Thread(4204,10056);
    printf("状态: %d \n", ret);

    system("pause");
    return 0;
}

枚举进程内存权限:

#include <stdio.h>
#include <ShlObj.h>
#include <Windows.h>

void ScanMemoryAttribute()
{
    DWORD Addres = 0, Size = 0;
    MEMORY_BASIC_INFORMATION Basicinfo = {};

    // 遍历进程所有分页, 输出内容
    while (VirtualQuery((LPCVOID)Addres, &Basicinfo, sizeof(MEMORY_BASIC_INFORMATION)))
    {
        Size = Basicinfo.RegionSize;
        printf("地址: %08p 类型: %7d 大小: %7d 状态: ", Basicinfo.BaseAddress,Basicinfo.Type,Basicinfo.RegionSize);
        switch (Basicinfo.State)
        {
        case MEM_FREE:      printf("空闲 \n"); break;
        case MEM_RESERVE:   printf("保留 \n"); break;
        case MEM_COMMIT:    printf("提交 \n"); break;
        default: printf("未知 \n"); break;
        }

        // 如果是提交状态的内存区域，那么遍历所有块中的信息
        if (Basicinfo.State == MEM_COMMIT)
        {
            // 遍历所有基址是 Address
            LPVOID BaseBlockAddress = (LPVOID)Addres;
            DWORD BlockAddress = Addres;
            DWORD dwBlockSize = 0;
            // 遍历大内存块中的小内存块
            while (VirtualQuery((LPVOID)BlockAddress, &Basicinfo, sizeof(Basicinfo)))
            {
                if (BaseBlockAddress != Basicinfo.AllocationBase)
                {
                    break;
                }
                printf("--> %08X", BlockAddress);
                // 查看内存状态，映射方式
                switch (Basicinfo.Type)
                {
                case MEM_PRIVATE:   printf("私有  "); break;
                case MEM_MAPPED:    printf("映射  "); break;
                case MEM_IMAGE:     printf("镜像  "); break;
                default: printf("未知  "); break;
                }

                if (Basicinfo.Protect == 0)
                    printf("---");
                else if (Basicinfo.Protect & PAGE_EXECUTE)
                    printf("E--");
                else if (Basicinfo.Protect & PAGE_EXECUTE_READ)
                    printf("ER-");
                else if (Basicinfo.Protect & PAGE_EXECUTE_READWRITE)
                    printf("ERW");
                else if (Basicinfo.Protect & PAGE_READONLY)
                    printf("-R-");
                else if (Basicinfo.Protect & PAGE_READWRITE)
                    printf("-RW");
                else if (Basicinfo.Protect & PAGE_WRITECOPY)
                    printf("WCOPY");
                else if (Basicinfo.Protect & PAGE_EXECUTE_WRITECOPY)
                    printf("EWCOPY");
                printf("\n");

                // 计算所有相同块大小
                dwBlockSize += Basicinfo.RegionSize;
                // 累加内存块的位置
                BlockAddress += Basicinfo.RegionSize;
            }
            // 内有可能大小位空
            Size = dwBlockSize ? dwBlockSize : Basicinfo.RegionSize;
        }
        // 下一个区域内存信息
        Addres += Size;
    }
}

int main(int argc, char * argv[])
{
    ScanMemoryAttribute();
    system("pause");
    return 0;
}

查询进程所具备的权限:

#include <stdio.h>
#include <ShlObj.h>
#include <Windows.h>

BOOL QueryPrivileges()
{
    // 1. 获得本进程的令牌
    HANDLE hToken = NULL;
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken))
        return false;

    // 2. 获取提升类型
    TOKEN_ELEVATION_TYPE ElevationType = TokenElevationTypeDefault;
    BOOL  bIsAdmin = false;
    DWORD dwSize = 0;

    if (GetTokenInformation(hToken, TokenElevationType, &ElevationType, sizeof(TOKEN_ELEVATION_TYPE), &dwSize))
    {
        // 2.1 创建管理员组的对应SID
        BYTE adminSID[SECURITY_MAX_SID_SIZE];
        dwSize = sizeof(adminSID);
        CreateWellKnownSid(WinBuiltinAdministratorsSid, NULL, &adminSID, &dwSize);

        // 2.2 判断当前进程运行用户角色是否为管理员
        if (ElevationType == TokenElevationTypeLimited)
        {
            // a. 获取连接令牌的句柄
            HANDLE hUnfilteredToken = NULL;
            GetTokenInformation(hToken, TokenLinkedToken, (PVOID)&hUnfilteredToken, sizeof(HANDLE), &dwSize);
            // b. 检查这个原始的令牌是否包含管理员的SID
            if (!CheckTokenMembership(hUnfilteredToken, &adminSID, &bIsAdmin))
                return false;
            CloseHandle(hUnfilteredToken);
        }
        else
        {
            bIsAdmin = IsUserAnAdmin();
        }
    }

    // 3. 判断具体的权限状况
    BOOL bFullToken = false;
    switch (ElevationType) 
    {
        case TokenElevationTypeDefault: /* 默认的用户或UAC被禁用 */
            if (IsUserAnAdmin())
                bFullToken = true;      // 默认用户有管理员权限
            else
                bFullToken = false;     // 默认用户不是管理员组
            break;

        case TokenElevationTypeFull:    /* 已经成功提高进程权限 */
            if (IsUserAnAdmin())
                bFullToken = true;      // 当前以管理员权限运行
            else
                bFullToken = false;     // 当前未以管理员权限运行
            break;

        case TokenElevationTypeLimited: /* 进程在以有限的权限运行 */
            if (bIsAdmin)
                bFullToken = false;     // 用户有管理员权限，但进程权限有限
            else
                bFullToken = false;     // 用户不是管理员组，且进程权限有限
            break;
    }
    return bFullToken;
}

int main(int argc, char * argv[])
{
    BOOL ret = QueryPrivileges();
    printf("具备权限: %d \n", ret);

    system("pause");
    return 0;
}

枚举指定进程权限:

#include <stdio.h>
#include <ShlObj.h>
#include <Windows.h>

void ShowPrviliges(HANDLE process)
{
    // 通过进程句柄获取到进程令牌
    HANDLE hToken;
    OpenProcessToken(process, TOKEN_QUERY, &hToken);

    // 获取查询道德令牌信息
    DWORD dwSize;
    GetTokenInformation(hToken,TokenPrivileges, NULL, NULL, &dwSize);

    // 根据令牌中的大小分配空间
    char *pBuf = new char[dwSize] {};
    GetTokenInformation(hToken,TokenPrivileges, pBuf, dwSize, &dwSize);

    // 将内存中的内容用要查询数据结构体解析
    TOKEN_PRIVILEGES* pTp = (TOKEN_PRIVILEGES*)pBuf;
    DWORD dwCount = pTp->PrivilegeCount;               // 解析出权限个数
    LUID_AND_ATTRIBUTES* pluid = pTp->Privileges;      // 具备的权限类型

    for (int i = 0; i < dwCount; i++, pluid++)
    {
        char szName[100] = {};
        DWORD dwLen = sizeof(szName);
        LookupPrivilegeNameA(0, &pluid->Luid, szName, &dwLen);
        switch (pluid->Attributes)
        {
        case 0:
            printf("[ID: %3d] ---> [关闭]      ---> %s \n", i,szName); break;
        case 1:
            printf("[ID: %3d] ---> [默认]      ---> %s \n", i,szName); break;
        case 2:
            printf("[ID: %3d] ---> [开启]      ---> %s \n", i,szName); break;
        case 3:
            printf("[ID: %3d] ---> [默认开启]  ---> %s \n", i,szName); break;
        }
    }
    delete pBuf;
}

int main(int argc ,char *argv[])
{
    // 拿到PID为9656程序的句柄
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 9656);
    ShowPrviliges(hProcess);

    // 拿到自身程序的句柄
    HANDLE LocalProcess = GetCurrentProcess();
    ShowPrviliges(LocalProcess);

    system("pause");
    return 0;
}

提升指定进程权限:

#include <windows.h>
#include <stdio.h>

int EnbalePrivileges(HANDLE hProcess, char *pszPrivilegesName)
{
    HANDLE hToken = NULL;
    LUID luidValue = { 0 };
    TOKEN_PRIVILEGES tokenPrivileges = { 0 };
    BOOL bRet = FALSE;
    DWORD dwRet = 0;

    // 打开进程令牌并获取具有 TOKEN_ADJUST_PRIVILEGES 权限的进程令牌句柄
    bRet = OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES, &hToken);
    if (bRet != FALSE)
    {
        // 获取本地系统的 pszPrivilegesName 特权的LUID值
        bRet = LookupPrivilegeValue(NULL, pszPrivilegesName, &luidValue);
        if (bRet == FALSE)
            return -1;
    }

    // 设置提升权限信息
    tokenPrivileges.PrivilegeCount = 1;
    tokenPrivileges.Privileges[0].Luid = luidValue;
    tokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

    // 提升进程令牌访问权限
    bRet = AdjustTokenPrivileges(hToken, FALSE, &tokenPrivileges, 0, NULL, NULL);
    if (bRet != FALSE)
    {
        // 根据错误码判断是否特权都设置成功
        dwRet = GetLastError();
        if (ERROR_SUCCESS == dwRet)
        {
            return 1;
        }
    }
    return -1;
}

int main(int argc,char * argv [])
{
    // 获取当前自身进程句柄
    HANDLE Local_Pid = GetCurrentProcess();

    // 修改当前进程令牌访问权限
    if (FALSE != EnbalePrivileges(Local_Pid, SE_DEBUG_NAME))
        printf("提权成功 \n");

    system("pause");
    return 0;
}