＋设为首页 ＋添加到收藏夹
if (CreateFile(PChar("\\\\.\\filemon"),
GENERIC_READ||GENERIC_WRITE,
FILE_SHARE_READ || FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
0) !=INVALID_HANDLE_VALUE)
MessageBox("检测到filemon");
else
MessageBox("没有filemon");
为什么着段代码检测不到filemon呢？
谁告诉你用这这种方法检测的阿！？
msdn的例子，我改了一下，以一个写字本是否在运行为例！
#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>
#include <iostream.h>
// Forward declarations:
BOOL GetProcessList( );
void printError( TCHAR* msg );
void main( )
{
GetProcessList( );
}
BOOL GetProcessList( )
{
HANDLE hProcessSnap;
HANDLE hProcess;
PROCESSENTRY32 pe32;
BOOL bIsRuning = FALSE;
// Take a snapshot of all processes in the system.
hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
if( hProcessSnap == INVALID_HANDLE_VALUE )
{
printError( "CreateToolhelp32Snapshot (of processes)" );
return( FALSE );
}
// Set the size of the structure before using it.
pe32.dwSize = sizeof( PROCESSENTRY32 );
// Retrieve information about the first process,
// and exit if unsuccessful
if( !Process32First( hProcessSnap, &pe32 ) )
{
printError( "Process32First" ); // Show cause of failure
CloseHandle( hProcessSnap ); // Must clean up the snapshot object!
return( FALSE );
}
// Now walk the snapshot of processes, and
// display information about each process in turn
do
{
// Retrieve the priority class.
if( ! strcmp( "notepad.exe", pe32.szExeFile ))
{
bIsRuning = true;
}
} while( Process32Next( hProcessSnap, &pe32 ) );
if ( bIsRuning )
cout<<"the notepad is runing" << endl;
else
cout<<"the notepad is not runing" << endl;
CloseHandle( hProcessSnap );
while(1);
return( TRUE );
}
void printError( TCHAR* msg )
{
DWORD eNum;
TCHAR sysMsg[256];
TCHAR* p;
eNum = GetLastError( );
FormatMessage( FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
NULL, eNum,
MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // Default language
sysMsg, 256, NULL );
// Trim the end of the line and terminate it with a null
p = sysMsg;
while( ( *p > 31 ) || ( *p == 9 ) )
++p;
do { *p-- = 0; } while( ( p >= sysMsg ) &&
( ( *p == . ) || ( *p < 33 ) ) );
// Display the message
printf( "\n WARNING: %s failed with error %d (%s)", msg, eNum, sysMsg );
}
同一楼上的方法！
枚举进程模块，CreateToolhelp32Snapshot 然后比较模块名称来判断
或简单的用FindWindow等来查找
二楼已有正解！
二楼
正解
楼主有必要
看看 MSDN ！！
在下列网址
http://www.yesky.com/184/1739684.shtml
其中if (CreateFile(PChar("\\\\.\\filemon"), 一句变为
if (CreateFile(PChar("\\\\.\\FILEVXD"),
