| 发表于:2007-01-10 17:00:232楼 得分:25 |
要返tracer,或检查是否有调试器跟踪,只需检查当前进程的父进程是不是explorer.exe dword dwcurprocessid = ::getcurrentprocessid(); handle hsnapshot = ::createtoolhelp32snapshot(th32cs_snapall, 0); processentry32 ppe; ppe.dwsize = sizeof(processentry32); bool bfound = ::process32first(hsnapshot, &ppe); while (bfound) { if (ppe.th32processid == dwcurprocessid) { dword dwparentprocessid = ppe.th32parentprocessid; handle hexplorer = ::openprocess(process_all_access, true, dwparentprocessid); hmodule hmodule; dword cbneeded; ::enumprocessmodules(hexplorer, &hmodule, sizeof(hmodule), &cbneeded); tchar szexplorername[_max_path] = {0}; ::getmodulebasename(hexplorer, hmodule, szexplorername, _max_path); if (::lstrcmpi(szexplorername, "explorer.exe ") != 0) { //父进程不是explorer.exe } ::closehandle(hexplorer); } bfound = ::process32next(hsnapshot, &ppe); } ::closehandle(hsnapshot); | | |
|