Windows核心編程：第4章 進程

Github

https://github.com/gongluck/Windows-Core-Program.git

//第4章 進程.cpp: 定義應用程序的入口點。
//

#include "stdafx.h"
#include "第4章 進程.h"

#include <shellapi.h>
#pragma warning(disable:4996)//GetVersionEx

int APIENTRY wWinMain(_In_ HINSTANCE hInstance,
                     _In_opt_ HINSTANCE hPrevInstance,
                     _In_ LPWSTR    lpCmdLine,
                     _In_ int       nCmdShow)
{
    HMODULE hModule = GetModuleHandle(nullptr);//獲取主調進程的可執行文件的基地址(只檢查主調進程的地址空間)
    HMODULE hMoudle2 = nullptr;
    GetModuleHandleEx(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, (LPTSTR)wWinMain, &hMoudle2);//獲取wWinMain所在模塊的基地址,對於dll頗有用的

    //獲取模塊路徑
    TCHAR moudlename[_MAX_PATH] = { 0 };
    DWORD dret = GetModuleFileName(hMoudle2, moudlename, sizeof(moudlename));
    dret = GetLongPathName(moudlename, moudlename, sizeof(moudlename));

    TCHAR* cmdline = GetCommandLine();
    int argsnum = 0;
    PWSTR* ppArgv = CommandLineToArgvW(GetCommandLineW(), &argsnum);//切分命令行參數
    for (int i = 0; i < argsnum; ++i)
    {
        ppArgv[i];//第i個參數
    }
    HeapFree(GetProcessHeap(), 0, ppArgv);
    ppArgv = nullptr;

    LPTSTR envirstr = GetEnvironmentStrings();//獲取完整的環境變量字符串
    FreeEnvironmentStrings(envirstr);
    envirstr = nullptr;

    //獲取一個環境變量
    DWORD len = GetEnvironmentVariable(TEXT("一個環境變量名"), nullptr, 0);
    PTSTR pszvalue = new TCHAR[len];
    GetEnvironmentVariable(TEXT("一個環境變量名"), pszvalue, len);
    //擴展環境變量字符串
    len = ExpandEnvironmentStrings(pszvalue, nullptr, 0);
    PTSTR pszvalue2 = new TCHAR[len];
    ExpandEnvironmentStrings(pszvalue, pszvalue2, len);
    delete[] pszvalue2;
    delete[] pszvalue;
    pszvalue = nullptr;

    SetEnvironmentVariable(TEXT("一個環境變量名"), TEXT("1"));//添加or修改
    SetEnvironmentVariable(TEXT("一個環境變量名"), nullptr);//刪除

    //工做目錄
    len = GetCurrentDirectory(0, nullptr);
    PTSTR dir = new TCHAR[len];
    GetCurrentDirectory(len, dir);
    delete[] dir;
    dir = nullptr;

    dir = new TCHAR[_MAX_PATH];
    GetFullPathName(TEXT("Windows核心編程.sln"), _MAX_PATH, dir, nullptr);//很差用,但這個函數能夠獲取每一個驅動器對應的當前目錄~
    delete[] dir;
    dir = nullptr;

    //系統版本
    OSVERSIONINFOEX ver = { 0 };
    ver.dwOSVersionInfoSize = sizeof(ver);
    GetVersionEx((LPOSVERSIONINFO)&ver);

    //比較版本差別
    //構造一個版本
    OSVERSIONINFOEX osver = { 0 };
    osver.dwOSVersionInfoSize = sizeof(osver);
    osver.dwMajorVersion = 6;
    osver.dwPlatformId = VER_PLATFORM_WIN32_NT;
    //比較標記
    DWORDLONG condition = 0;
    VER_SET_CONDITION(condition, VER_MAJORVERSION, VER_EQUAL);//要求VER_MAJORVERSION相等
    VER_SET_CONDITION(condition, VER_MINORVERSION, VER_EQUAL);
    VER_SET_CONDITION(condition, VER_PLATFORMID, VER_EQUAL);
    //比較版本
    BOOL verret = VerifyVersionInfo(&osver, VER_MAJORVERSION | VER_MINORVERSION | VER_PLATFORMID, condition);//返回FALSE，用GetLastError查看緣由

    ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    SECURITY_ATTRIBUTES sap, sat;
    sap.nLength = sizeof(sap);
    sap.lpSecurityDescriptor = nullptr;
    sap.bInheritHandle = TRUE;//進程可繼承
    sat.nLength = sizeof(sat);
    sat.lpSecurityDescriptor = nullptr;
    sat.bInheritHandle = FALSE;//線程不可繼承
    STARTUPINFO si = { sizeof(si) };
    PROCESS_INFORMATION pi;
    TCHAR processcmd[] = TEXT("README.TXT");
    BOOL bret = CreateProcess(TEXT("C:\\WINDOWS\\SYSTEM32\\NOTEPAD.EXE"), processcmd, &sap, &sat, TRUE/*新進程繼承句柄*/, CREATE_SUSPENDED | NORMAL_PRIORITY_CLASS, nullptr, nullptr, &si, &pi);
    //此時進程內核引用計數==2
    ResumeThread(pi.hThread);
    TerminateProcess(pi.hProcess, 10);//(異步)終止進程
    WaitForSingleObject(pi.hProcess, INFINITE);
    GetExitCodeProcess(pi.hProcess, &dret);//==1
    CloseHandle(pi.hProcess);//==0
    CloseHandle(pi.hThread);//==0

    //手動提高進程權限
    SHELLEXECUTEINFO sei = { sizeof(sei) };
    sei.lpVerb = TEXT("runas");//特權提高
    sei.lpFile = TEXT("NOTEPAD.EXE");
    sei.lpParameters = TEXT("README.TXT");
    sei.nShow = SW_SHOWNORMAL;
    sei.fMask = SEE_MASK_NOCLOSEPROCESS;//使返回進程句柄
    bret = ShellExecuteEx(&sei);

    //進程令牌
    HANDLE htoken = nullptr;
    bret = OpenProcessToken(sei.hProcess, TOKEN_QUERY, &htoken);
    TOKEN_ELEVATION_TYPE elevationtype;//獲取啓動類型
    bret = GetTokenInformation(htoken, TokenElevationType, &elevationtype, sizeof(elevationtype), &len);
    CloseHandle(htoken);
    htoken = nullptr;

    bret = CloseHandle(sei.hProcess);//SEE_MASK_NOCLOSEPROCESS

    system("pause");
    return 0;
}