如何监视本机程序的运行？ ( 积分: 50 )

能检测到本机上程序的执行并记录相就的processID,谢谢

能检测到本机上程序的执行并记录相就的processID,谢谢

网上找的，先看看，主要是EnumProcesses<br><br>1.列举进程<br>procedure TForm1.rzbtnListClick(Sender: TObject);<br>var<br> &nbsp;I &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : Integer;<br> <br> &nbsp;LAProcess, LAModule: array[0..1023] of Cardinal;<br> &nbsp;hProcess &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: THandle;<br> &nbsp;LLi &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : TListItem;<br> &nbsp;cNeeded, cProcess : DWORD;<br>begin<br> &nbsp;rzlvProcess.Clear;<br> &nbsp;if not EnumProcesses(@LAProcess, SizeOf(LAProcess), cNeeded) then<br> &nbsp; &nbsp;exit; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; //error<br> &nbsp;rzlvProcess.Items.BeginUpdate;<br> &nbsp;try<br> &nbsp; &nbsp;for I := 0 to cNeeded div SizeOf(DWORD) - 1 do // Iterate<br> &nbsp; &nbsp; &nbsp;begin<br> &nbsp; &nbsp; &nbsp; &nbsp;if LAProcess = 0 then &nbsp; Continue;<br> &nbsp; &nbsp; &nbsp; &nbsp;hProcess := OpenProcess({PROCESS_ALL_ACCESS, &nbsp;//}<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;PROCESS_QUERY_INFORMATION or PROCESS_VM_READ,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;False, LAProcess);<br> &nbsp; &nbsp; &nbsp; &nbsp;if (hProcess &lt;&gt; 0) and (<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;EnumProcessModules(hProcess, @LAModule, SizeOf(LAModule),<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cProcess)) then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;begin<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LLi := rzlvProcess.Items.Add;<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LLi.Caption := IntToHex(LAProcess, 4);//记下PID <br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LLi.SubItems.Add(MyGetModuleBaseName(hProcess, LAModule[0]));//进程可执行程序名字<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LLi.SubItems.Add(MyGetModulePath(hProcess, LAModule[0]));//位置<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;CloseHandle(hProcess);<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;end;<br> &nbsp; &nbsp; &nbsp;end; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// for<br> &nbsp;finally<br> &nbsp; &nbsp;rzlvProcess.Items.EndUpdate;<br> &nbsp;end;<br>end;<br>2. 杀死进程，根据PID<br>procedure TForm1.rzbtnEndTaskClick(Sender: TObject);<br>var<br> &nbsp;hProcess &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;: THandle;<br> &nbsp;Msg &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : string;<br>begin<br> &nbsp;with rzlvProcess do<br> &nbsp; &nbsp;begin<br> &nbsp; &nbsp; &nbsp;if Selected &lt;&gt; nil then<br> &nbsp; &nbsp; &nbsp; &nbsp;begin<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Msg := 'PID: ' + Selected.Caption + ' &nbsp; &nbsp;Name: ' + Selected.SubItems[0]<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;+ #13'End Task ?';<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if IDYES = MessageBox(Application.Handle, Pchar(Msg), 'Query',<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;MB_YESNO or MB_ICONINFORMATION or MB_APPLMODAL or MB_DEFBUTTON2)<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;begin<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;hProcess := OpenProcess(PROCESS_TERMINATE,<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;False, StrToInt('$' + rzlvProcess.Selected.Caption));<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;//rzlvProcess.Selected.Caption 上一个函数记下的进程 PID <br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;if (hProcess &lt;&gt; 0) then<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;begin<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;TerminateProcess(hProcess, 0);<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;CloseHandle(hProcess);<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;end;<br> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;end;<br> &nbsp; &nbsp; &nbsp; &nbsp;end;<br> &nbsp; &nbsp;end;<br>end;<br><br>function TForm1.MyGetModuleBaseName(hProcess: THandle;<br> &nbsp;hModule: HMODULE): string;<br>begin<br> &nbsp;SetLength(Result, MAX_PATH);<br> &nbsp;SetLength(Result,<br> &nbsp; &nbsp;GetModuleBaseName(hProcess, hModule, @Result[1], MAX_PATH));<br>end;<br><br>function TForm1.MyGetModulePath(hProcess: THandle;<br> &nbsp;hModule: HMODULE): string;<br>begin<br> &nbsp;SetLength(Result, MAX_PATH);<br> &nbsp;SetLength(Result,<br> &nbsp; &nbsp;GetModuleFileNameEx(hProcess, hModule, @Result[1], MAX_PATH));<br> &nbsp;Result := ExtractFilePath(Result);<br>end;

打开任务管理器……

楼上方法不错，到时候监视任务管理器的列表就好了[][][]

谢谢chenybin大大的提示，这段程序太爽了。。。

接受答案了.