假設我有以下代碼可以獲取行程的句柄：
pid = 1234
procHandle = win32api.OpenProcess(win32con.MAXIMUM_ALLOWED,pywintypes.FALSE,pid)
我將如何列出并獲取其執行緒的句柄？
uj5u.com熱心網友回復：
據我所知，不存在列舉行程中的執行緒的公共 api。但存在NtQuerySystemInformation和SystemProcessInformation或SystemExtendedProcessInformation- 它回傳系統中所有行程和執行緒的串列。通過使用它，您可以通過 id 找到行程中的所有執行緒，不需要打開行程
NTSTATUS DumpProcessThreads(_Out_ ULONG_PTR dwProcessId)
{
NTSTATUS status;
ULONG cb = 0x10000;
do
{
status = STATUS_NO_MEMORY;
if (PVOID buf = LocalAlloc(0, cb 0x1000))
{
if (0 <= (status = NtQuerySystemInformation(SystemExtendedProcessInformation, buf, cb, &cb)))
{
status = STATUS_INVALID_CID;
union {
PVOID pv;
PBYTE pb;
PSYSTEM_PROCESS_INFORMATION pspi;
};
pv = buf;
ULONG NextEntryOffset = 0;
do
{
pb = NextEntryOffset;
if (pspi->UniqueProcessId == (HANDLE)dwProcessId)
{
status = STATUS_SUCCESS;
if (ULONG NumberOfThreads = pspi->NumberOfThreads)
{
PSYSTEM_EXTENDED_THREAD_INFORMATION TH = pspi->TH;
do
{
DbgPrint("%p: %p(%p) [%p]\n",
TH->ClientId.UniqueThread,
TH->StartAddress,
TH->Win32StartAddress,
TH->TebAddress);
} while (TH , --NumberOfThreads);
}
break;
}
} while (NextEntryOffset = pspi->NextEntryOffset);
}
LocalFree(buf);
}
} while (status == STATUS_INFO_LENGTH_MISMATCH);
return status;
}
轉載請註明出處，本文鏈接：https://www.uj5u.com/houduan/475666.html