C# ProcessHandle.GetImageFileName方法代码示例

        private void RefreshProcesses()
        {
            var processes = Windows.GetProcesses();

            listProcesses.BeginUpdate();
            listProcesses.Items.Clear();

            var generic_process = imageList.Images["generic_process"];
            imageList.Images.Clear();
            imageList.Images.Add("generic_process", generic_process);

            foreach (var process in processes.Values)
            {
                string userName = "";
                string fileName = null;

                try
                {
                    using (var phandle = new ProcessHandle(process.Process.ProcessId, OSVersion.MinProcessQueryInfoAccess))
                    {
                        using (var thandle = phandle.GetToken(TokenAccess.Query))
                        using (var sid = thandle.GetUser())
                            userName = sid.GetFullName(true);

                        fileName = FileUtils.GetFileName(phandle.GetImageFileName());
                    }
                }
                catch
                { }

                ListViewItem item = new ListViewItem(
                    new string[]
                    {
                        process.Process.ProcessId == 0 ? "System Idle Process" : process.Name,
                        process.Process.ProcessId.ToString(),
                        userName
                    });

                if (!string.IsNullOrEmpty(fileName))
                {
                    Icon fileIcon = FileUtils.GetFileIcon(fileName);

                    if (fileIcon != null)
                    {
                        imageList.Images.Add(process.Process.ProcessId.ToString(), fileIcon);
                        item.ImageKey = process.Process.ProcessId.ToString();
                    }
                }

                if (string.IsNullOrEmpty(item.ImageKey))
                    item.ImageKey = "generic_process";

                listProcesses.Items.Add(item);
            }

            listProcesses.EndUpdate();
        }

        private void AddProcessItem(
            ProcessHandle phandle,
            int pid,
            ref int totalCount, ref int hiddenCount, ref int terminatedCount,
            Func<int, bool> exists
            )
        {
            string fileName = phandle.GetImageFileName();

            if (fileName != null)
                fileName = FileUtils.GetFileName(fileName);

            if (pid == 0)
                pid = phandle.GetBasicInformation().UniqueProcessId.ToInt32();

            var item = listProcesses.Items.Add(new ListViewItem(new string[]
                    {
                        fileName,
                        pid.ToString()
                    }));

            // Check if the process has terminated. This is possible because 
            // a process can be terminated while its object is still being 
            // referenced.
            DateTime exitTime = DateTime.FromFileTime(0);

            try { exitTime = phandle.GetExitTime(); }
            catch { }

            if (exitTime.ToFileTime() != 0)
            {
                item.BackColor = Color.DarkGray;
                item.ForeColor = Color.White;
                terminatedCount++;
            }
            else
            {
                totalCount++;

                if (!exists(pid))
                {
                    item.BackColor = Color.Red;
                    item.ForeColor = Color.White;
                    hiddenCount++;
                }
            }
        }

        private void menuItem2_Click(object sender, EventArgs e)
        {
            SaveFileDialog sfd = new SaveFileDialog();

            try
            {
                using (var phandle = new ProcessHandle(_pid, Program.MinProcessQueryRights))
                {
                    string fileName = phandle.GetImageFileName();

                    sfd.FileName = fileName.Substring(fileName.LastIndexOf('\\') + 1) + "-" + Utils.FormatAddress(_address) + ".bin";
                }
            }
            catch
            {
                sfd.FileName = "memory.bin";
            }

            if (sfd.ShowDialog() == DialogResult.OK)
            {
                for (long i = 0; i < hexBoxMemory.ByteProvider.Length; i++)
                {
                    _data[i] = hexBoxMemory.ByteProvider.ReadByte(i);
                }

                System.IO.File.WriteAllBytes(sfd.FileName, _data);
            }
        }

        private static string GetProcessDetailsText(int pid)
        {
            // This function returns a string containing details about a process.

            // The string builder which will contain the result.
            StringBuilder sb = new StringBuilder();

            sb.AppendLine("Process PID " + pid.ToString() + ":");
            sb.AppendLine();

            try
            {
                using (var phandle = new ProcessHandle(pid, ProcessAccess.QueryLimitedInformation))
                {
                    var fileName = phandle.GetImageFileName();

                    sb.AppendLine("Native file name: " + fileName);
                    fileName = FileUtils.GetFileName(fileName);
                    sb.AppendLine("DOS file name: " + fileName);

                    try
                    {
                        var fileInfo = FileVersionInfo.GetVersionInfo(fileName);

                        sb.AppendLine("Description: " + fileInfo.FileDescription);
                        sb.AppendLine("Company: " + fileInfo.CompanyName);
                        sb.AppendLine("Version: " + fileInfo.FileVersion);
                    }
                    catch (Exception ex2)
                    {
                        sb.AppendLine("Version info section failed! " + ex2.Message);
                    }

                    sb.AppendLine("Started: " + phandle.GetCreateTime().ToString());

                    var memoryInfo = phandle.GetMemoryStatistics();

                    sb.AppendLine("WS: " + Utils.FormatSize(memoryInfo.WorkingSetSize));
                    sb.AppendLine("Pagefile usage: " + Utils.FormatSize(memoryInfo.PagefileUsage));
                }
            }
            catch (Exception ex)
            {
                sb.AppendLine("Basic info section failed! " + ex.Message);
            }

            try
            {
                using (var phandle = new ProcessHandle(pid, ProcessAccess.QueryLimitedInformation | ProcessAccess.VmRead))
                {
                    var commandLine = phandle.GetCommandLine();
                    var currentDirectory = phandle.GetPebString(PebOffset.CurrentDirectoryPath);

                    sb.AppendLine("Command line: " + commandLine);
                    sb.AppendLine("Current directory: " + currentDirectory);
                }
            }
            catch (Exception ex)
            {
                sb.AppendLine("PEB info section failed! " + ex.Message);
            }

            sb.AppendLine();
            sb.AppendLine("Modules:");
            sb.AppendLine();

            try
            {
                using (var phandle = new ProcessHandle(pid, ProcessAccess.QueryLimitedInformation | ProcessAccess.VmRead))
                {
                    foreach (var module in phandle.GetModules())
                    {
                        sb.AppendLine(module.FileName);
                        sb.Append("    [0x" + module.BaseAddress.ToInt32().ToString("x") + ", ");
                        sb.AppendLine(Utils.FormatSize(module.Size) + "] ");
                        sb.AppendLine("    Flags: " + module.Flags.ToString());

                        try
                        {
                            var fileInfo = FileVersionInfo.GetVersionInfo(module.FileName);

                            sb.AppendLine("    Description: " + fileInfo.FileDescription);
                            sb.AppendLine("    Company: " + fileInfo.CompanyName);
                            sb.AppendLine("    Version: " + fileInfo.FileVersion);
                        }
                        catch (Exception ex2)
                        {
                            sb.AppendLine("    Version info failed! " + ex2.Message);
                        }

                        sb.AppendLine();
                    }
                }
            }
            catch (Exception ex)
            {
                sb.AppendLine("Modules section failed! " + ex.Message);
            }

            sb.AppendLine("Token:");
//.........这里部分代码省略.........

        /// <summary>
        /// Gets whether the specified process is a system process.
        /// </summary>
        /// <param name="pid">The PID of a process to check.</param>
        /// <returns>Whether the process is a system process.</returns>
        public static bool IsDangerousPid(int pid)
        {
            if (pid == 4)
                return true;

            try
            {
                using (var phandle = new ProcessHandle(pid, OSVersion.MinProcessQueryInfoAccess))
                {
                    foreach (string s in DangerousNames)
                    {
                        if ((Environment.SystemDirectory + "\\" + s).Equals(
                            FileUtils.GetFileName(FileUtils.GetFileName(phandle.GetImageFileName())),
                            StringComparison.OrdinalIgnoreCase))
                        {
                            return true;
                        }
                    }
                }
            }
            catch
            { }

            return false;
        }