進程處理之進程保護

 

思路：查詢當前系統中啟動並執行進程的快照，如果欲保護的進程在快照中則表示進程處於運行狀態，如果欲保護進程不在快照中，則啟動進程。

步驟：

  建立線程函數

{

  檢查進程是否運行

  若未運行啟用進程

}

 

步驟一：

 

檢查某進程是否處於運行狀態，實現代碼如下：

運行：返回1

未運行或載入toolhelp.dll失敗：返回-1

int DetectProc(char * currentProcName,DWORD &pid)<br />{<br />HINSTANCE hDll;<br />hDll=LoadLibrary(L"toolhelp.dll");<br />if(hDll == NULL)<br />{<br />char * notice = "Load toolhelp failed!";<br />log(notice, strlen(notice));//寫入記錄檔<br />return -1;<br />}<br />typedef HANDLE (WINAPI *hcreatetool)(DWORD dwFlags, DWORD th32ProcessID);<br />typedef BOOL (WINAPI *hfirst)(HANDLE hSnapshot, LPPROCESSENTRY32 lppe);<br />typedef BOOL (WINAPI *hnext)(HANDLE hSnapshot, LPPROCESSENTRY32 lppe);<br />typedef BOOL (WINAPI *hclosetool)(HANDLE hSnapshot);<br />hcreatetool MCreateToolhelp32Snapshot = NULL;<br />hfirst MProcess32First = NULL;<br />hnext MProcess32Next = NULL;<br />hclosetool MCloseToolhelp32Snapshot = NULL;<br />MCreateToolhelp32Snapshot = (hcreatetool)GetProcAddress(hDll,L"CreateToolhelp32Snapshot");<br />if(MCreateToolhelp32Snapshot == NULL)<br />{<br />return -1;<br />}<br />MProcess32First = (hfirst)GetProcAddress(hDll,L"Process32First");<br />if(MProcess32First == NULL)<br />{<br />return -1;<br />}<br />MProcess32Next = (hnext)GetProcAddress(hDll,L"Process32Next");<br />if(MProcess32Next == NULL)<br />{<br />return -1;<br />}<br />MCloseToolhelp32Snapshot = (hclosetool)GetProcAddress(hDll,L"CloseToolhelp32Snapshot");<br />if(MCloseToolhelp32Snapshot == NULL)<br />{<br />return -1;<br />}<br />HANDLE hSnapShot = MCreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);<br />if(hSnapShot == INVALID_HANDLE_VALUE )<br />{<br />return -1;<br />}<br />PROCESSENTRY32 process;<br />process.dwSize = sizeof(PROCESSENTRY32);<br />int ret = -1;<br />if(MProcess32First(hSnapShot, &process))<br />{<br />while(TRUE)<br />{</p><p>if(process.szExeFile == NULL)<br />{<br />return ret;<br />}<br />MTCHAR tname = {0};<br />wcscpy(tname, process.szExeFile);<br />wToLower(tname);</p><p>char dec_notice[260] = "process.szExeFile:";<br />char * proName = wide2short(process.szExeFile);<br />upToLower(proName);<br />strcat(dec_notice, proName);<br />//log(dec_notice, strlen(dec_notice));//寫入記錄檔<br />char cur_notice[260] = "currentProcName:";<br />ZeroMemory(&cur_notice[strlen("currentProcName")+1],260-strlen("currentProcName")-1);<br />upToLower(currentProcName);<br />strcat(cur_notice, currentProcName);<br />//log(cur_notice, strlen(cur_notice));//寫入記錄檔<br />pid = process.th32ProcessID;<br />if(wcscmp(tname,short2wide(currentProcName)) == 0)<br />{<br />ret = 1;<br />/*pid = process.th32ProcessID;*/<br />break;<br />}<br />if(!MProcess32Next(hSnapShot, &process))<br />{<br />break;<br />}<br />}<br />}<br />MCloseToolhelp32Snapshot (hSnapShot);<br />if(ret == -1)<br />{<br />char * notice27 = "ret == -1";<br />//log(notice27, strlen(notice27));//寫入記錄檔<br />}<br />else if(ret == 1)<br />{<br />char * notice27 = "ret == 1";<br />//log(notice27, strlen(notice27));//寫入記錄檔<br />}<br />return ret;<br />}<br /> 

 

步驟二：

建立保護進程的線程

HANDLE m_hprotectProcthread;<br />BOOL g_bReturn = FALSE;<br />DWORD g_dwThreadID;<br />m_hprotectProcthread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)(&protectProcThread),NULL, 0, &g_dwThreadID);<br />void WINAPI protectProcThread()<br />{<br />while(true)<br />{<br />if(g_bReturn)<br />return;<br />if(!ProtectPro(protecteProcName))<br />{<br />char * notice = "保護進程失敗!";<br />log(notice, strlen(notice));//寫入記錄檔<br />}<br />Sleep(500);<br />}<br />}<br />void CDlgProtectProcDlg::OnBnClickedStopProtectproc()<br />{<br />// TODO: 在此添加控制項通知處理常式代碼<br />g_bReturn = true;<br />CloseHandle(m_hprotectProcthread);<br /> 

相關代碼的地址是：http://download.csdn.net/source/3324452，不需要資源分，支援共用！