求结束多个进程名称其中一个的方法

qq724174 · 发表于 2011-3-27 18:27:07

本帖最后由 qq724174 于 2011-3-27 18:37 编辑

例如有3个abc.exe进程
路径分别是
C:\WINDOWS\ABC.EXE
C:\WINDOWS\SYSTEM32\ABC.EXE
C:\WINDOWS\SYSTEM32\TEST\ABC.EXE

要结束C:\WINDOWS\SYSTEM32\TEST\ABC.EXE却不影响其他两个ABC.exe
求大家指点。

或者告诉我个已经进程全路径取进程PID的方法也行，谢谢了。

破帽遮颜 · 发表于 2011-3-27 19:55:15

#include <WinAPI.au3>
#include <array.au3>
Global Const $PROCESS_VM_READ=0x10
Global Const $PROCESS_QUERY_INFORMATION = 0x400
_GetPrivilege_SEDEBUG()
$list=ProcessList()
Redim $list[ubound($list,1)][3]
for $i=1 to ubound($list,1)-1
$list[$i][2]=_WinAPI_GetCommandLineFromPID($list[$i][1])
Next
_ArrayDisplay($list)
Exit
Func _WinAPI_GetCommandLineFromPID($PID)
$ret1=DllCall("kernel32.dll", 'int', 'OpenProcess', 'int', $PROCESS_VM_READ+$PROCESS_QUERY_INFORMATION, 'int', False, 'int', $PID)
$tag_PROCESS_BASIC_INFORMATION = "int ExitStatus;" & _
"ptr PebBaseAddress;" & _
"ptr AffinityMask;" & _
"ptr BasePriority;" & _
"ulong UniqueProcessId;" & _
"ulong InheritedFromUniqueProcessId;"
$PBI=DllStructCreate($tag_PROCESS_BASIC_INFORMATION)
DllCall("ntdll.dll", "int", "ZwQueryInformationProcess", "hwnd", $ret1[0], "int", 0, "ptr", DllStructGetPtr($PBI), "int", _
DllStructGetSize($PBI), "int",0)
$dw=DllStructCreate("ptr")
DllCall("kernel32.dll", "int", "ReadProcessMemory", "hwnd", $ret1[0], _
"ptr", DllStructGetData($PBI,2)+0x10, _
"ptr", DllStructGetPtr($dw), "int", 4, "ptr", 0)
$unicode_string = DllStructCreate("ushort Length;ushort MaxLength;ptr String")
DllCall("kernel32.dll", "int", "ReadProcessMemory", "hwnd", $ret1[0], _
"ptr", DllStructGetData($dw, 1)+0x40, _
"ptr", DllStructGetPtr($unicode_string), "int", DllStructGetSize($unicode_string), "ptr", 0)
$ret=DllCall("kernel32.dll", "int", "ReadProcessMemory", "hwnd", $ret1[0], _
"ptr", DllStructGetData($unicode_string, "String"), _
"wstr", 0, "int", DllStructGetData($unicode_string, "Length") + 2, "int*", 0)
DllCall("kernel32.dll", 'int', 'CloseHandle', "hwnd", $ret1[0])
If $ret[5] Then Return $ret[3]
Return ""
EndFunc
Func _GetPrivilege_SEDEBUG()
Local $tagLUIDANDATTRIB = "int64 Luid;dword Attributes"
Local $count = 1
Local $tagTOKENPRIVILEGES = "dword PrivilegeCount;byte LUIDandATTRIB[" & $count * 12 & "]"
Local $TOKEN_ADJUST_PRIVILEGES = 0x20
Local $call = DllCall("advapi32.dll", "int", "OpenProcessToken", "ptr", _WinAPI_GetCurrentProcess(), "dword", $TOKEN_ADJUST_PRIVILEGES, "ptr*", "")
Local $hToken = $call[3]
$call = DllCall("advapi32.dll", "int", "LookupPrivilegeValue", "str", Chr(0), "str", "SeDebugPrivilege", "int64*", "")
Local $iLuid = $call[3]
Local $TP = DllStructCreate($tagTOKENPRIVILEGES)
Local $LUID = DllStructCreate($tagLUIDANDATTRIB, DllStructGetPtr($TP, "LUIDandATTRIB"))
DllStructSetData($TP, "PrivilegeCount", $count)
DllStructSetData($LUID, "Luid", $iLuid)
DllStructSetData($LUID, "Attributes", $SE_PRIVILEGE_ENABLED)
$call = DllCall("advapi32.dll", "int", "AdjustTokenPrivileges", "ptr", $hToken, "int", 0, "ptr", DllStructGetPtr($TP), "dword", 0, "ptr", Chr(0), "ptr", Chr(0))
Return ($call[0] <> 0)
EndFunc

复制代码

zitoy · 发表于 2011-3-27 20:33:38

本帖最后由 zitoy 于 2011-3-27 20:35 编辑

通过PID获取路径，再对比。

;~ 查找进程对应文件路径
Func _Processpath($iPID)
Local $aProc = DllCall('kernel32.dll', 'hwnd', 'OpenProcess', 'int', BitOR(0x0400, 0x0010), 'int', 0, 'int', $iPID)
If $aProc[0] = 0 Then Return SetError(1, 0, '')
Local $vStruct = DllStructCreate('int[1024]')
DllCall('psapi.dll', 'int', 'EnumProcessModules', 'hwnd', $aProc[0], 'ptr', DllStructGetPtr($vStruct), 'int', DllStructGetSize($vStruct), 'int_ptr', 0)
Local $aReturn = DllCall('psapi.dll', 'int', 'GetModuleFileNameEx', 'hwnd', $aProc[0], 'int', DllStructGetData($vStruct, 1), 'str', '', 'int', 2048)
If StringLen($aReturn[3]) = 0 Then Return SetError(2, 0, '')
Return $aReturn[3]
EndFunc ;==>_Processpath

wsfda · 发表于 2011-3-27 21:25:47

学习了，收藏，日后备用

haijie1223 · 发表于 2011-3-28 15:54:18

收藏备用 3#的思路不错值得学习一下 2#代码有些高深看上去比较眼晕

		自动登录	找回密码
密码			加入

[系统综合] 求结束多个进程名称其中一个的方法

相关帖子

评分