在Windows中获取另一个进程的命令行参数

如何在C语言中使用WMI获取Windows中所有正在运行的进程的命令行参数?

Solutions Collecting From Web of "在Windows中获取另一个进程的命令行参数"

您必须使用Win32_Process WMI类,并检查CommandLine属性的值,也看看这篇文章How do I get the command line of another process解释该字符串是...just "preinitialized variable", a process could in principle (and many do in practice, although usually inadvertently) write to the memory that holds the command line How do I get the command line of another process ...just "preinitialized variable", a process could in principle (and many do in practice, although usually inadvertently) write to the memory that holds the command line

更新

C样品

 #define _WIN32_WINNT 0x0400 #define _WIN32_DCOM #include <stdio.h> #include <tchar.h> #include <windows.h> #include <wbemidl.h> void _tmain(int argc, _TCHAR* argv[]) { HRESULT hr = 0; IWbemLocator *WbemLocator = NULL; IWbemServices *WbemServices = NULL; IEnumWbemClassObject *EnumWbem = NULL; //initializate the Windows security hr = CoInitializeEx(0, COINIT_MULTITHREADED); hr = CoInitializeSecurity(NULL, -1, NULL, NULL, RPC_C_AUTHN_LEVEL_DEFAULT, RPC_C_IMP_LEVEL_IMPERSONATE, NULL, EOAC_NONE, NULL); hr = CoCreateInstance(&CLSID_WbemLocator, 0, CLSCTX_INPROC_SERVER, &IID_IWbemLocator, (LPVOID *) &WbemLocator); //connect to the WMI hr = WbemLocator->lpVtbl->Connectserver(WbemLocator, L"ROOT\\CIMV2", NULL, NULL, NULL, 0, NULL, NULL, &WbemServices); //Run the WQL Query hr = WbemServices->lpVtbl->ExecQuery(WbemServices, L"WQL", L"SELECT ProcessId,CommandLine FROM Win32_Process", WBEM_FLAG_FORWARD_ONLY, NULL, &EnumWbem); // Iterate over the enumerator if (EnumWbem != NULL) { IWbemClassObject *result = NULL; ULONG returnedCount = 0; while((hr = EnumWbem->lpVtbl->Next(EnumWbem, WBEM_INFINITE, 1, &result, &returnedCount)) == S_OK) { VARIANT ProcessId; VARIANT CommandLine; // access the properties hr = result->lpVtbl->Get(result, L"ProcessId", 0, &ProcessId, 0, 0); hr = result->lpVtbl->Get(result, L"CommandLine", 0, &CommandLine, 0, 0); if (!(CommandLine.vt==VT_NULL)) wprintf(L"%u %s \r\n", ProcessId.uintVal, CommandLine.bstrVal); result->lpVtbl->Release(result); } } // Release the resources EnumWbem->lpVtbl->Release(EnumWbem); WbemServices->lpVtbl->Release(WbemServices); WbemLocator->lpVtbl->Release(WbemLocator); CoUninitialize(); getchar(); } 

Borland C ++示例

 #pragma hdrstop #include <iostream> using namespace std; #include <wbemcli.h> #include <comdef.h> //CREDENTIAL structure //http://msdn.microsoft.com/en-us/library/windows/desktop/aa374788%28v=vs.85%29.aspx #define CRED_MAX_USERNAME_LENGTH 513 #define CRED_MAX_CREDENTIAL_BLOB_SIZE 512 #define CREDUI_MAX_USERNAME_LENGTH CRED_MAX_USERNAME_LENGTH #define CREDUI_MAX_PASSWORD_LENGTH (CRED_MAX_CREDENTIAL_BLOB_SIZE / 2) // The Win32_Process class represents a sequence of events on a Win32 system. Any sequence consisting of the interaction of one or more processors or interpreters, some executable code, and a set of inputs, is a descendent (or member) of this class. // Example: A client application running on a Win32 system. #pragma argsused int main(int argc, char* argv[]) { wchar_t pszName[CREDUI_MAX_USERNAME_LENGTH+1] = L"user"; wchar_t pszPwd[CREDUI_MAX_PASSWORD_LENGTH+1] = L"password"; BSTR strNetworkResource; //To use a WMI remote connection set localconn to false and configure the values of the pszName, pszPwd and the name of the remote machine in strNetworkResource bool localconn = true; strNetworkResource = localconn ? L"\\\\.\\root\\CIMV2" : L"\\\\remote--machine\\root\\CIMV2"; COAUTHIDENTITY *userAcct = NULL ; COAUTHIDENTITY authIdent; // Initialize COM. ------------------------------------------ HRESULT hres; hres = CoInitializeEx(0, COINIT_MULTITHREADED); if (FAILED(hres)) { cout << "Failed to initialize COM library. Error code = 0x" << hex << hres << endl; cout << _com_error(hres).ErrorMessage() << endl; cout << "press enter to exit" << endl; cin.get(); return 1; // Program has failed. } // Set general COM security levels -------------------------- if (localconn) hres = CoInitializeSecurity( NULL, -1, // COM authentication NULL, // Authentication services NULL, // Reserved RPC_C_AUTHN_LEVEL_DEFAULT, // Default authentication RPC_C_IMP_LEVEL_IMPERSONATE, // Default Impersonation NULL, // Authentication info EOAC_NONE, // Additional capabilities NULL // Reserved ); else hres = CoInitializeSecurity( NULL, -1, // COM authentication NULL, // Authentication services NULL, // Reserved RPC_C_AUTHN_LEVEL_DEFAULT, // Default authentication RPC_C_IMP_LEVEL_IDENTIFY, // Default Impersonation NULL, // Authentication info EOAC_NONE, // Additional capabilities NULL // Reserved ); if (FAILED(hres)) { cout << "Failed to initialize security. Error code = 0x" << hex << hres << endl; cout << _com_error(hres).ErrorMessage() << endl; CoUninitialize(); cout << "press enter to exit" << endl; cin.get(); return 1; // Program has failed. } // Obtain the initial locator to WMI ------------------------- IWbemLocator *pLoc = NULL; hres = CoCreateInstance(CLSID_WbemLocator, 0, CLSCTX_INPROC_SERVER, IID_IWbemLocator, (LPVOID *) &pLoc); if (FAILED(hres)) { cout << "Failed to create IWbemLocator object." << " Err code = 0x" << hex << hres << endl; cout << _com_error(hres).ErrorMessage() << endl; CoUninitialize(); cout << "press enter to exit" << endl; cin.get(); return 1; // Program has failed. } // Connect to WMI through the IWbemLocator::Connectserver method IWbemServices *pSvc = NULL; if (localconn) hres = pLoc->Connectserver( strNetworkResource, // Object path of WMI namespace NULL, // User name. NULL = current user NULL, // User password. NULL = current 0, // Locale. NULL indicates current NULL, // Security flags. 0, // Authority (eg Kerberos) 0, // Context object &pSvc // pointer to IWbemServices proxy ); else hres = pLoc->Connectserver( strNetworkResource, // Object path of WMI namespace pszName, // User name pszPwd, // User password NULL, // Locale NULL, // Security flags NULL, // Authority NULL, // Context object &pSvc // IWbemServices proxy ); if (FAILED(hres)) { cout << "Could not connect. Error code = 0x" << hex << hres << endl; cout << _com_error(hres).ErrorMessage() << endl; pLoc->Release(); CoUninitialize(); cout << "press enter to exit" << endl; cin.get(); return 1; // Program has failed. } cout << "Connected to root\\CIMV2 WMI namespace" << endl; // Set security levels on the proxy ------------------------- if (localconn) hres = CoSetProxyBlanket( pSvc, // Indicates the proxy to set RPC_C_AUTHN_WINNT, // RPC_C_AUTHN_xxx RPC_C_AUTHZ_NONE, // RPC_C_AUTHZ_xxx NULL, // server principal name RPC_C_AUTHN_LEVEL_CALL, // RPC_C_AUTHN_LEVEL_xxx RPC_C_IMP_LEVEL_IMPERSONATE, // RPC_C_IMP_LEVEL_xxx NULL, // client identity EOAC_NONE // proxy capabilities ); else { // Create COAUTHIDENTITY that can be used for setting security on proxy memset(&authIdent, 0, sizeof(COAUTHIDENTITY)); authIdent.PasswordLength = wcslen (pszPwd); authIdent.Password = (USHORT*)pszPwd; authIdent.User = (USHORT*)pszName; authIdent.UserLength = wcslen(pszName); authIdent.Domain = 0; authIdent.DomainLength = 0; authIdent.Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE; userAcct = &authIdent; hres = CoSetProxyBlanket( pSvc, // Indicates the proxy to set RPC_C_AUTHN_DEFAULT, // RPC_C_AUTHN_xxx RPC_C_AUTHZ_DEFAULT, // RPC_C_AUTHZ_xxx COLE_DEFAULT_PRINCIPAL, // server principal name RPC_C_AUTHN_LEVEL_PKT_PRIVACY, // RPC_C_AUTHN_LEVEL_xxx RPC_C_IMP_LEVEL_IMPERSONATE, // RPC_C_IMP_LEVEL_xxx userAcct, // client identity EOAC_NONE // proxy capabilities ); } if (FAILED(hres)) { cout << "Could not set proxy blanket. Error code = 0x" << hex << hres << endl; cout << _com_error(hres).ErrorMessage() << endl; pSvc->Release(); pLoc->Release(); CoUninitialize(); cout << "press enter to exit" << endl; cin.get(); return 1; // Program has failed. } // Use the IWbemServices pointer to make requests of WMI ---- IEnumWbemClassObject* pEnumerator = NULL; hres = pSvc->ExecQuery( L"WQL", L"SELECT CommandLine,ProcessId FROM Win32_Process", WBEM_FLAG_FORWARD_ONLY | WBEM_FLAG_RETURN_IMMEDIATELY, NULL, &pEnumerator); if (FAILED(hres)) { cout << "ExecQuery failed" << " Error code = 0x" << hex << hres << endl; cout << _com_error(hres).ErrorMessage() << endl; pSvc->Release(); pLoc->Release(); CoUninitialize(); cout << "press enter to exit" << endl; cin.get(); return 1; // Program has failed. } // Secure the enumerator proxy if (!localconn) { hres = CoSetProxyBlanket( pEnumerator, // Indicates the proxy to set RPC_C_AUTHN_DEFAULT, // RPC_C_AUTHN_xxx RPC_C_AUTHZ_DEFAULT, // RPC_C_AUTHZ_xxx COLE_DEFAULT_PRINCIPAL, // server principal name RPC_C_AUTHN_LEVEL_PKT_PRIVACY, // RPC_C_AUTHN_LEVEL_xxx RPC_C_IMP_LEVEL_IMPERSONATE, // RPC_C_IMP_LEVEL_xxx userAcct, // client identity EOAC_NONE // proxy capabilities ); if (FAILED(hres)) { cout << "Could not set proxy blanket on enumerator. Error code = 0x" << hex << hres << endl; cout << _com_error(hres).ErrorMessage() << endl; pEnumerator->Release(); pSvc->Release(); pLoc->Release(); CoUninitialize(); cout << "press enter to exit" << endl; cin.get(); return 1; // Program has failed. } } // Get the data from the WQL sentence IWbemClassObject *pclsObj = NULL; ULONG uReturn = 0; while (pEnumerator) { HRESULT hr = pEnumerator->Next(WBEM_INFINITE, 1, &pclsObj, &uReturn); if(0 == uReturn || FAILED(hr)) break; VARIANT vtProp; hr = pclsObj->Get(L"CommandLine", 0, &vtProp, 0, 0);// String if (!FAILED(hr)) { if ((vtProp.vt==VT_NULL) || (vtProp.vt==VT_EMPTY)) wcout << "CommandLine : " << ((vtProp.vt==VT_NULL) ? "NULL" : "EMPTY") << endl; else if ((vtProp.vt & VT_ARRAY)) wcout << "CommandLine : " << "Array types not supported (yet)" << endl; else wcout << "CommandLine : " << vtProp.bstrVal << endl; } VariantClear(&vtProp); hr = pclsObj->Get(L"ProcessId", 0, &vtProp, 0, 0);// Uint32 if (!FAILED(hr)) { if ((vtProp.vt==VT_NULL) || (vtProp.vt==VT_EMPTY)) wcout << "ProcessId : " << ((vtProp.vt==VT_NULL) ? "NULL" : "EMPTY") << endl; else if ((vtProp.vt & VT_ARRAY)) wcout << "ProcessId : " << "Array types not supported (yet)" << endl; else wcout << "ProcessId : " << vtProp.uintVal << endl; } VariantClear(&vtProp); pclsObj->Release(); pclsObj=NULL; } // Cleanup pSvc->Release(); pLoc->Release(); pEnumerator->Release(); if (pclsObj!=NULL) pclsObj->Release(); CoUninitialize(); cout << "press enter to exit" << endl; cin.get(); return 0; // Program successfully completed. }