function GetModuleBaseName(hProcess: THandle; hModule: HMODULE; lpBaseName: pchar; nSize: DWord):
integer; stdcall; external 'PSAPI.DLL' name 'GetModuleBaseNameA';
function EnableDebugPrivilege(): Boolean;
var
hToken: THANDLE;
tkp: TOKEN_PRIVILEGES;
Nothing: Cardinal;
begin
OpenProcessToken(GetCurrentProcess, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, hToken);
LookupPrivilegeValue(nil, 'SeDebugPrivilege', tkp.Privileges[0].Luid);
tkp.PrivilegeCount := 1;
tkp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, FALSE, tkp, 0, nil, Nothing);
end;
function ProcessName(ProcessId: Cardinal): string;
var
hProcess: Cardinal;
ModName: array[0..MAX_PATH] of Char;
begin
//0,4,8固定的系统进程,不能被其他进程打开的.直接返回
case ProcessId of
0:
begin
Result := 'System Idle Process';
Exit;
end;
4, 8: //2000里面是8;XP里面是4
begin
Result := 'System';
Exit;
end;
end;
EnableDebugPrivilege(); //使当前程序有调试权限,否则有些系统进程是不能被打开的
hProcess := OpenProcess(PROCESS_ALL_ACCESS, False, ProcessId);
SetString(Result, ModName, GetModuleBaseName(hProcess, 0, ModName, MAX_PATH));
CloseHandle(hProcess);
end;
procedure TForm1.Button1Click(Sender: TObject);
begin
//
ShowMessage(ProcessName(720));
end;