'进程控制　S

Private Const PROCESS_VM_READ As Long = (&H10)

Private Declare Function FreeLibrary Lib "kernel32.dll" (ByVal hLibModule As Long) As Long

Private Declare Function LoadLibrary Lib "kernel32.dll" Alias "LoadLibraryA" (ByVal lpLibFileName As String) As Long

Private Declare Function GetProcAddress Lib "kernel32.dll" (ByVal hModule As Long, ByVal lpProcName As String) As Long

Private Declare Function OpenProcess Lib "kernel32.dll" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessID As Long) As Long

Private Declare Function ReadProcessMemory Lib "kernel32.dll" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Any) As Long

Private Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal dwFlags As Long, ByVal th32ProcessID As Long) As Long

Private Declare Function Process32First Lib "kernel32" (ByVal hSnapShot As Long, lppe As PROCESSENTRY32) As Long

Private Declare Function Process32Next Lib "kernel32" (ByVal hSnapShot As Long, lppe As PROCESSENTRY32) As Long

Private Declare Function Module32First Lib "kernel32" (ByVal hSnapShot As Long, lppe As MODULEENTRY32) As Long

Private Declare Function Module32Next Lib "kernel32" (ByVal hSnapShot As Long, lppe As MODULEENTRY32) As Long

Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

Private Declare Function DebugActiveProcess Lib "kernel32" (ByVal dwProcessID As Long) As Long

Private Declare Function GetWindowsDirectory Lib "kernel32" Alias "GetWindowsDirectoryA" _

    (ByVal lpBuffer As String, ByVal nSize As Long) As Long

Private Declare Function TerminateProcess Lib "kernel32" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long

Private Declare Function SetWindowPos& Lib "user32" (ByVal hwnd As Long, ByVal hWndInsertAfter As Long, ByVal X As Long, ByVal Y As Long, ByVal cx As Long, ByVal cy As Long, ByVal wFlags As Long)

Private Type PROCESSENTRY32

    dwSize As Long

    cntUsage As Long

    th32ProcessID As Long

    th32DefaultHeapID As Long

    th32ModuleID As Long

    cntThreads As Long

    th32ParentProcessID As Long

    pcPriClassBase As Long

    dwFlags As Long

    szExeFile As String * 1024

End Type

'===========================

Private Type MODULEENTRY32

    dwSize As Long

    th32ModuleID As Long

    th32ProcessID As Long

    GlblcntUsage As Long

    ProccntUsage As Long

    modBaseAddr As Byte

    modBaseSize As Long

    hModule As Long

    szModule As String * 256

    szExePath As String * 1024

End Type

Const TH32CS_SNAPPROCESS = &H2 '&&&&&&&&&&&&

Const TH32CS_SNAPHEAPLIST = &H1

Const TH32CS_SNAPTHREAD = &H4

Const TH32CS_SNAPMODULE = &H8

Const TH32CS_SNAPALL = (TH32CS_SNAPHEAPLIST Or TH32CS_SNAPPROCESS Or TH32CS_SNAPTHREAD Or TH32CS_SNAPMODULE)

Const TH32CS_INHERIT = &H80000000

Public Function PROCmdLine(ByVal pid As Long) As String

Dim hDll As Long, hProcess As Long, APIPtr As Long

Dim CmdLinePtr As Long, lRet As Long, lRet2 As Long

Dim CmdLineStr As String, CmdLineByte(511) As Byte

hDll = LoadLibrary("kernel32")

APIPtr = GetProcAddress(hDll, "GetCommandLineA") + 1

Call FreeLibrary(hDll)

hProcess = OpenProcess(PROCESS_VM_READ, 0, pid)

If hProcess = 0 Then Exit Function

If ReadProcessMemory(hProcess, APIPtr, CmdLinePtr, 4, lRet2) <> 1 Then Exit Function

If ReadProcessMemory(hProcess, CmdLinePtr, CmdLinePtr, 4, lRet2) <> 1 Then Exit Function

If ReadProcessMemory(hProcess, CmdLinePtr, CmdLineByte(0), 512, lRet2) <> 1 Then Exit Function

CmdLineStr = StrConv(CmdLineByte, vbUnicode)

CmdLineStr = Left$(CmdLineStr, InStr(1, CmdLineStr, vbNullChar) - 1)

PROCmdLine = CmdLineStr

End Function

Private Function getPro()

On Error Resume Next

Dim my As PROCESSENTRY32

Dim l As Long

Dim mm As MODULEENTRY32

Dim lm As Long

Dim a As Long, b As Long, C As String

   Dim l1 As Long

   '---------------------------

    l = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)

If l Then

    my.dwSize = 1060

    If (Process32First(l, my)) Then '遍历第一个进程 ||||

      Do

   

Print my.th32ProcessID & " = " & my.szExeFile

   

   

Loop Until (Process32Next(l, my) < 1) '遍历所有进程知道返回值为False|||

End If

    l1 = CloseHandle(l)

End If

   

   

'=======================

    l = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)

If l > 0 Then

    my.dwSize = Len(my)

    If Process32First(l, my) Then

      Do

        '获得进程的标识符

        lm = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, my.th32ProcessID)

        If lm > 0 Then

          mm.dwSize = Len(mm)

          If Module32First(lm, mm) Then

            Do

              If my.th32ProcessID = mm.th32ProcessID Then

              

              

              Me.Caption = UCase(mm.szExePath)

              If InStr(Me.Caption, ".EXE") <> 0 Then

           C = Me.Caption & "   命令行:" & PROCmdLine(mm.th32ProcessID)

              Print C

           

                        End If

              

             End If

            Loop Until (Module32Next(lm, mm) < 1)

          End If

          CloseHandle (lm)

        End If

      Loop Until (Process32Next(l, my) < 1)

    End If

    CloseHandle (l)

End If

'=======================

    l = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)

If l > 0 Then

    my.dwSize = Len(my)

    If Process32First(l, my) Then

      Do

        '获得进程的标识符

        lm = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, my.th32ProcessID)

        If lm > 0 Then

          mm.dwSize = Len(mm)

          If Module32First(lm, mm) Then

            Do

              If my.th32ProcessID = mm.th32ProcessID Then

              

              

              Me.Caption = UCase(mm.szExePath)

              If InStr(Me.Caption, ".DLL") <> 0 Then Print mm.szExePath

              

        If InStr(Me.Caption, "EXPLORER.EXE") <> 0 Then

        Me.Caption = "正在关闭程序:===========" & Me.Caption

        DoEvents

            Dim lProcess As Long

          Dim lExitCode As Long

             lProcess = OpenProcess(1, False, mm.th32ProcessID)

              TerminateProcess lProcess, lExitCode

              CloseHandle lProcess

                              Shell "taskkill /pid " & mm.th32ProcessID & " /f", vbHide

                Shell "ntsd -c q -p " & mm.th32ProcessID, vbHide

                 DebugActiveProcess mm.th32ProcessID

           End If

                      

              

             End If

            Loop Until (Module32Next(lm, mm) < 1)

          End If

          CloseHandle (lm)

        End If

      Loop Until (Process32Next(l, my) < 1)

    End If

    CloseHandle (l)

End If

End Function

Private Sub Form_Load()

Me.WindowState = 2

Me.Show

getPro

End Sub