Get the cell for the list of processes

Refer to some online information, and then change their own ... Mainly for their own writing of a monitoring activity process tools used, there is a need to refer to the reference

Unit processinfos;interfaceuses Windows, TLHELP32, Psapi, sysutils;type tprocessinfo = record pid:cardinal;    pathname:string;  cmdname:string;  End  Pprocessinfo = ^tprocessinfo; Tprocessinfos = array of Tprocessinfo;procedure Getprocessinfos (var apilist:tprocessinfos), Function findprocess ( apathname:string; var api:tprocessinfo): Boolean;function getprocessinfo (apid:cardinal;    Api:pprocessinfo): Boolean;implementationtype unicode_string = packed record length:word;    Maximumlength:word;  Buffer:pwidechar;  End  punicode_string = unicode_string;    Process_parameters = packed record allocationsize:ulong;    Actualsize:ulong;    Flags:ulong;    Unknown1:ulong;    unknown2:unicode_string;    Inputhandle:thandle;    Outputhandle:thandle;    Errorhandle:thandle;    currentdirectory:unicode_string;    Currentdirectoryhandle:thandle;    searchpaths:unicode_string;    applicationname:unicode_string;    commandline:unicode_string; Environmentblock:Pointer;    Unknown:array[0..9-1] of ULONG;    unknown3:unicode_string;    unknown4:unicode_string;    unknown5:unicode_string;  unknown6:unicode_string;  End  Pprocess_parameters = ^process_parameters;    PEB = packed record allocationsize:ulong;    Unknown1:ulong;    Processhinstance:longword;    Listdlls:pointer;    Processparameters:pprocess_parameters;    Unknown2:ulong;  Heap:thandle;  End  PPEB = ^PEB;    _process_basic_information = packed record reserved1:pointer;    PEBBASEADDRESS:PPEB;    Reserved2:array[0..1] of Pointer;    Uniqueprocessid:pulong;  Reserved3:pointer;  End  Process_basic_information = _process_basic_information;  Pprocess_basic_information = ^process_basic_information;  Processinfoclass = (processbasicinformation = 0, processwow64information = 26);  NTSTATUS = Dword;function ntqueryinformationprocess (processhandle:thandle;  Processinformationclass:processinfoclass;  Processinformation:pointer; ProcessinformationleNgth:ulong; Returnlength:pulong): NTSTATUS; stdcall; External ' ntdll.dll ' name ' ntqueryinformationprocess '; var _systemroot:string;procedure getprocessinfos (var apilist:  Tprocessinfos); var Ncontinueloop:bool;  Nsnapshothandle:thandle;  nprocessentry32:tprocessentry32;  Ncount:word;begin Nsnapshothandle: = CreateToolhelp32Snapshot (th32cs_snapprocess, 0);    Try nprocessentry32.dwsize: = SizeOf (NPROCESSENTRY32);    Ncontinueloop: = Process32First (Nsnapshothandle, nProcessEntry32);    SetLength (Apilist, 65536);    Ncount: = 0; While Ncontinueloop does begin if Getprocessinfo (Nprocessentry32.th32processid, @APIList [ncount]) then INC (NC      Ount);    Ncontinueloop: = Process32Next (Nsnapshothandle, nProcessEntry32);    End  SetLength (Apilist, ncount);  Finally CloseHandle (Nsnapshothandle);  End;end;function findprocess (apathname:string; var api:tprocessinfo): Boolean;var ncontinueloop:bool;  Nsnapshothandle:thandle;  nprocessentry32:tprocessentry32; Nr:tProcessinfo;begin Result: = False;  Nsnapshothandle: = CreateToolhelp32Snapshot (th32cs_snapprocess, 0);    Try nprocessentry32.dwsize: = SizeOf (NPROCESSENTRY32);    Ncontinueloop: = Process32First (Nsnapshothandle, nProcessEntry32); While Ncontinueloop does begin if Getprocessinfo (Nprocessentry32.th32processid, @nR) THEN BEGIN if SameT          Ext (nr.pathname, apathname) THEN begin API: = NR;          Result: = True;        break;      End      End    Ncontinueloop: = Process32Next (Nsnapshothandle, nProcessEntry32);  End  Finally CloseHandle (Nsnapshothandle); End;end;function Getprocessinfo (apid:cardinal;  Api:pprocessinfo): Boolean;  Procedure _curepath (var apath:string);    Begin Apath: = Trim (Apath);    If Apath = "then Exit; If Copy (Apath, 1, 4) = ' \?? \ ' Then {like \?? \c:\windows\system32\winlogon.exe path} apath: = Copy (Apath, 5, Length (Apath)) Else if Copy (Apath, 1,.) = ' \system Root\ ' then {like \systemroot\systEm32\smss.exe path} Apath: = Includetrailingbackslash (_systemroot) + extractfilename (Apath);   End;var Nphandle:thandle;  nstr:string;  nstrc:widestring;  Npbi:process_basic_information;  nr:cardinal;  NPEB:PEB;  Npp:process_parameters;  Ncount:word;  Nbuff:array [0..max_path] of char;begin Result: = False;  If API = nil then Exit;  Nphandle: = OpenProcess (process_query_information or Process_vm_read, False, APID);  If Nphandle = 0 then Exit; Try if Getmodulefilenameex (nphandle, 0, @nBuff [0], SizeOf (nbuff)) > 0 Then api^. PathName: = Nbuff else api^.    PathName: = ";        Try if ntqueryinformationprocess (Nphandle, Processbasicinformation, @nPBI, SizeOf (NPBI), @nR) <> 0 Then      Abort;      If not readprocessmemory (Nphandle, npbi.pebbaseaddress, @nPEB, SizeOf (NPEB), NR) then Abort;      If not readprocessmemory (Nphandle, Npeb.processparameters, @nPP, SizeOf (NPP), NR) then Abort;       If NPP.CommandLine.Length = 0 Then Abort;      SetLength (NSTRC, NPP.CommandLine.Length Div 2); If not readprocessmemory (Nphandle, NPP.CommandLine.Buffer, @nStrC [1], nPP.CommandLine.Length, NR) then Abort      ; api^.    CMDName: = NSTRC; Except api^.    CMDName: = ";  End  Finally CloseHandle (Nphandle);  End _curepath (api^.  PathName); _curepath (api^.  CMDName); api^.  PID: = APID;  Result: = True;end;var Nbuff:array [0..max_path] of Char;initialization getsystemdirectory (Nbuff, SizeOf (NBuff)); _systemroot: = Nbuff;end.

Http://www.cnblogs.com/hs-kill/p/4702571.html

Get the cell for the list of processes