
还有一个变通的技巧:
先备份源程序,然后尝试删除之,如果删除成辩配功,说明没有运行,
还原备份文件,否则,说派灶李明程序已运行尘迟,删除备份文件。。
这个用批处理就可以解决了。。
#include<windows.h>#include <stdio.h>
#include "PSAPI.H"
#pragma comment( lib, "PSAPI.LIB" )
BOOL EnablePrivilege(HANDLE hToken,LPCSTR szPrivName)
int main(void)
{
DWORD processid[1024],needed,processcount,i
HANDLE hProcess
HMODULE hModule
char path[MAX_PATH] = "",temp[256]
HANDLE hToken
printf("ShowProcessPath 2.0 with [Process Status API]\n\n")
if ( OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken) )
{
if (EnablePrivilege(hToken,SE_DEBUG_NAME))
{
EnumProcesses(processid, sizeof(processid), &needed)
processcount=needed/sizeof(DWORD)
for (i=0i<processcounti++)
{
hProcess=OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,false,processid[i])
if (hProcess)
{
EnumProcessModules(hProcess, &hModule, sizeof(hModule), &needed)
GetModuleFileNameEx(hProcess, hModule, path, sizeof(path))
>>>>宽蠢在这里判断是否是你所需要的文件
GetShortPathName(path,path,256)
itoa(processid[i],temp,10)
printf("%s --- %s\n",path,temp)
}
else
printf("友巧困好念Failed!!!\n")
}
}
}
CloseHandle(hProcess)
CloseHandle(hModule)
itoa(processcount,temp,10)
printf("\nProcess Count:%s\n\n",temp)
return 0
}
BOOL EnablePrivilege(HANDLE hToken,LPCSTR szPrivName)
{
TOKEN_PRIVILEGES tkp
LookupPrivilegeValue( NULL,szPrivName,&tkp.Privileges[0].Luid )//修改进程权限
tkp.PrivilegeCount=1
tkp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED
AdjustTokenPrivileges( hToken,FALSE,&tkp,sizeof tkp,NULL,NULL )//通知系统修改进程权限
return( (GetLastError()==ERROR_SUCCESS) )
}
欢迎分享,转载请注明来源:内存溢出
微信扫一扫
支付宝扫一扫
评论列表(0条)