使用Python调用Windows API获取进程相关信息

介绍如何使用Python调用Windows API中的一些函数获取进程PID、路径、命令行等相关信息的实现方法。

'''
import ctypes
from ctypes import wintypes

# 调用Windows API中的函数获取进程相关信息
kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
OpenProcess = kernel32.OpenProcess
OpenProcess.argtypes = [wintypes.DWORD, wintypes.BOOL, wintypes.DWORD]
OpenProcess.restype = wintypes.HANDLE

GetModuleFileNameExW = kernel32.GetModuleFileNameExW
GetModuleFileNameExW.argtypes = [wintypes.HANDLE, wintypes.HANDLE, wintypes.LPWSTR, wintypes.DWORD]
GetModuleFileNameExW.restype = wintypes.DWORD

GetCommandLineW = kernel32.GetCommandLineW
GetCommandLineW.argtypes = []
GetCommandLineW.restype = wintypes.LPWSTR

# 获取指定进程的路径、命令行等信息
pid = 1234
process_handle = OpenProcess(0x0400 | 0x0010, False, pid) # PROCESS_QUERY_INFORMATION | PROCESS_VM_READ
if process_handle:
    path = ctypes.create_unicode_buffer(wintypes.MAX_PATH)
    length = GetModuleFileNameExW(process_handle, None, path, wintypes.MAX_PATH)
    if length:
        print(f'进程路径：{path.value}')

    command_line = GetCommandLineW()
    if command_line:
        print(f'进程命令行：{command_line}')

    kernel32.CloseHandle(process_handle)
else:
    print('获取进程句柄失败')
'''

免责申明：文章和图片全部来源于公开网络，如有侵权，请通知删除 server@dude6.com