1、process_net_info.h头文件
#pragma once
#include <Windows.h>
#include <iostream>
#include <vector>enum TcpOrUdp
{TcpType,UdpType
};
//=====================================================================================//
//Name: DWORD GetProcessIdByPort() //
// //
//Descripion: 根据端口号求出打开该端口号的进程 ID(支持 XP，Server 2003，Vista，Win7) //
// //
//=====================================================================================//
DWORD GetProcessIdByPort(TcpOrUdp type, DWORD dwPort);
DWORD GetAllPortByProcessId(TcpOrUdp type, DWORD dwProcessId, DWORD* dwAllPort, DWORD dwMaxLen);//---------------------------------------------------------------------------
//
// 由进程号获得进程名称
//
char* ProcessPidToName(DWORD ProcessId);
//---------------------------------------------------------------------------
//
// 由进程号获得全路径文件名
// x86编译出只能查32位系统程序， x64编译可以查32、64位程序
//
char* ProcessPidToPathName(DWORD ProcessId);
BOOL GetProcessPathByPId(const DWORD dwProcessId, CHAR* cstrPath);
2、process_net_info.cpp文件
//Netstat -anb
#include "process_net_info.h"
#include "Psapi.h"
#include <Iprtrmib.h>#pragma comment(lib,"Psapi.lib")
#pragma comment(lib,"Iphlpapi.Lib")
#pragma comment(lib,"WS2_32.lib")
#include <TlHelp32.h>using namespace std;
using std::vector;typedef struct
{DWORD dwState; //连接状态DWORD dwLocalAddr; //本地地址DWORD dwLocalPort; //本地端口DWORD dwRemoteAddr; //远程地址DWORD dwRemotePort; //远程端口DWORD dwProcessId; //进程标识}MIB_TCPEXROW, * PMIB_TCPEXROW;typedef struct
{DWORD dwLocalAddr; //本地地址DWORD dwLocalPort; //本地端口DWORD dwProcessId; //进程标识}MIB_UDPEXROW, * PMIB_UDPEXROW;typedef struct
{DWORD dwState; //连接状态DWORD dwLocalAddr; //本地地址DWORD dwLocalPort; //本地端口DWORD dwRemoteAddr; //远程地址DWORD dwRemotePort; //远程端口DWORD dwProcessId; //进程标识DWORD Unknown; //待定标识}MIB_TCPEXROW_VISTA, * PMIB_TCPEXROW_VISTA;typedef struct
{DWORD dwNumEntries;MIB_TCPEXROW table[ANY_SIZE];}MIB_TCPEXTABLE, * PMIB_TCPEXTABLE;typedef struct
{DWORD dwNumEntries;MIB_TCPEXROW_VISTA table[ANY_SIZE];}MIB_TCPEXTABLE_VISTA, * PMIB_TCPEXTABLE_VISTA;typedef struct
{DWORD dwNumEntries;MIB_UDPEXROW table[ANY_SIZE];}MIB_UDPEXTABLE, * PMIB_UDPEXTABLE;//=====================================================================================//
//Name: DWORD AllocateAndGetTcpExTableFromStack() //
// //
//Descripion: 该函数仅仅只在 Windows XP，Windows Server 2003 下有效 //
// //
//=====================================================================================//
typedef DWORD(WINAPI* PFNAllocateAndGetTcpExTableFromStack)(PMIB_TCPEXTABLE* pTcpTabel,bool bOrder,HANDLE heap,DWORD zero,DWORD flags);//=====================================================================================//
//Name: DWORD AllocateAndGetUdpExTableFromStack() //
// //
//Descripion: 该函数仅仅只在 XP，Windows Server 2003 下有效 //
// //
//=====================================================================================//
typedef DWORD(WINAPI* PFNAllocateAndGetUdpExTableFromStack)(PMIB_UDPEXTABLE* pUdpTable,bool bOrder,HANDLE heap,DWORD zero,DWORD flags);//=====================================================================================//
//Name: DWORD InternalGetTcpTable2() //
// //
//Descripion: 该函数在 Windows Vista 以及 Windows 7 下面效 //
// //
//=====================================================================================//
typedef DWORD(WINAPI* PFNInternalGetTcpTable2)(PMIB_TCPEXTABLE_VISTA* pTcpTable_Vista,HANDLE heap,DWORD flags);//=====================================================================================//
//Name: DWORD InternalGetUdpTableWithOwnerPid() //
// //
//Descripion: 该函数在 Windows Vista 以及 Windows 7 下面效 //
// //
//=====================================================================================//
typedef DWORD(WINAPI* PFNInternalGetUdpTableWithOwnerPid)(PMIB_UDPEXTABLE* pUdpTable,HANDLE heap,DWORD flags);//=====================================================================================//
//Name: DWORD GetProcessIdByPort() //
// //
//Descripion: 根据端口号求出打开该端口号的进程 ID(支持 XP，Server 2003，Vista，Win7) //
// //
//=====================================================================================//
DWORD GetProcessIdByPort(TcpOrUdp type, DWORD dwPort)
{HMODULE hModule = LoadLibraryW(L"iphlpapi.dll");if (hModule == NULL){return 0;}if (type == TcpType){// 表明查询的是 TCP 信息PFNAllocateAndGetTcpExTableFromStack pAllocateAndGetTcpExTableFromStack;pAllocateAndGetTcpExTableFromStack =(PFNAllocateAndGetTcpExTableFromStack)GetProcAddress(hModule, "AllocateAndGetTcpExTableFromStack");if (pAllocateAndGetTcpExTableFromStack != NULL){// 表明为 XP 或者 Server 2003 操作系统PMIB_TCPEXTABLE pTcpExTable = NULL;if (pAllocateAndGetTcpExTableFromStack(&pTcpExTable, TRUE, GetProcessHeap(), 0, AF_INET) != 0){if (pTcpExTable){HeapFree(GetProcessHeap(), 0, pTcpExTable);}FreeLibrary(hModule);hModule = NULL;return 0;}for (UINT i = 0; i < pTcpExTable->dwNumEntries; i++){// 过滤掉数据，只查询我们需要的进程数据if (dwPort == ntohs(0x0000FFFF & pTcpExTable->table[i].dwLocalPort)){DWORD dwProcessId = pTcpExTable->table[i].dwProcessId;if (pTcpExTable){HeapFree(GetProcessHeap(), 0, pTcpExTable);}FreeLibrary(hModule);hModule = NULL;return dwProcessId;}}if (pTcpExTable){HeapFree(GetProcessHeap(), 0, pTcpExTable);}FreeLibrary(hModule);hModule = NULL;return 0;}else{// 表明为 Vista 或者 7 操作系统PMIB_TCPEXTABLE_VISTA pTcpExTable = NULL;PFNInternalGetTcpTable2 pInternalGetTcpTable2 =(PFNInternalGetTcpTable2)GetProcAddress(hModule, "InternalGetTcpTable2");if (pInternalGetTcpTable2 == NULL){if (pTcpExTable){HeapFree(GetProcessHeap(), 0, pTcpExTable);}FreeLibrary(hModule);hModule = NULL;return 0;}if (pInternalGetTcpTable2(&pTcpExTable, GetProcessHeap(), 1)){if (pTcpExTable){HeapFree(GetProcessHeap(), 0, pTcpExTable);}FreeLibrary(hModule);hModule = NULL;return 0;}for (UINT i = 0; i < pTcpExTable->dwNumEntries; i++){// 过滤掉数据，只查询我们需要的进程数据if (dwPort == ntohs(0x0000FFFF & pTcpExTable->table[i].dwLocalPort)){DWORD dwProcessId = pTcpExTable->table[i].dwProcessId;if (pTcpExTable){HeapFree(GetProcessHeap(), 0, pTcpExTable);}FreeLibrary(hModule);hModule = NULL;return dwProcessId;}}if (pTcpExTable){HeapFree(GetProcessHeap(), 0, pTcpExTable);}FreeLibrary(hModule);hModule = NULL;return 0;}}else if (type == UdpType){// 表明查询的是 UDP 信息PMIB_UDPEXTABLE pUdpExTable = NULL;PFNAllocateAndGetUdpExTableFromStack pAllocateAndGetUdpExTableFromStack;pAllocateAndGetUdpExTableFromStack =(PFNAllocateAndGetUdpExTableFromStack)GetProcAddress(hModule, "AllocateAndGetUdpExTableFromStack");if (pAllocateAndGetUdpExTableFromStack != NULL){// 表明为 XP 或者 Server 2003 操作系统if (pAllocateAndGetUdpExTableFromStack(&pUdpExTable, TRUE, GetProcessHeap(), 0, AF_INET) != 0){if (pUdpExTable){HeapFree(GetProcessHeap(), 0, pUdpExTable);}FreeLibrary(hModule);hModule = NULL;return 0;}for (UINT i = 0; i < pUdpExTable->dwNumEntries; i++){// 过滤掉数据，只查询我们需要的进程数据if (dwPort == ntohs(0x0000FFFF & pUdpExTable->table[i].dwLocalPort)){DWORD dwProcessId = pUdpExTable->table[i].dwProcessId;if (pUdpExTable){HeapFree(GetProcessHeap(), 0, pUdpExTable);}FreeLibrary(hModule);hModule = NULL;return dwProcessId;}}if (pUdpExTable){HeapFree(GetProcessHeap(), 0, pUdpExTable);}FreeLibrary(hModule);hModule = NULL;return 0;}else{// 表明为 Vista 或者 7 操作系统PFNInternalGetUdpTableWithOwnerPid pInternalGetUdpTableWithOwnerPid;pInternalGetUdpTableWithOwnerPid =(PFNInternalGetUdpTableWithOwnerPid)GetProcAddress(hModule, "InternalGetUdpTableWithOwnerPid");if (pInternalGetUdpTableWithOwnerPid != NULL){if (pInternalGetUdpTableWithOwnerPid(&pUdpExTable, GetProcessHeap(), 1)){if (pUdpExTable){HeapFree(GetProcessHeap(), 0, pUdpExTable);}FreeLibrary(hModule);hModule = NULL;return 0;}for (UINT i = 0; i < pUdpExTable->dwNumEntries; i++){// 过滤掉数据，只查询我们需要的进程数据if (dwPort == ntohs(0x0000FFFF & pUdpExTable->table[i].dwLocalPort)){DWORD dwProcessId = pUdpExTable->table[i].dwProcessId;if (pUdpExTable){HeapFree(GetProcessHeap(), 0, pUdpExTable);}FreeLibrary(hModule);hModule = NULL;return dwProcessId;}}}if (pUdpExTable){HeapFree(GetProcessHeap(), 0, pUdpExTable);}FreeLibrary(hModule);hModule = NULL;return 0;}}else{FreeLibrary(hModule);hModule = NULL;return -1;}
}//=====================================================================================//
//Name: DWORD GetAllPortByProcessId() //
// //
//Descripion: 根据进程 ID 来求出该进程所打开的所有的端口号，并且在 dwAllPort 数组中返回所有端口号 //
// 其中 dwMaxLen 为数组的长度，函数的返回值为进程所打开的端口的数目 //
// (支持 XP，Server 2003，Vista，Win7) //
// //
//=====================================================================================//
DWORD GetAllPortByProcessId(TcpOrUdp type, DWORD dwProcessId, DWORD* dwAllPort, DWORD dwMaxLen)
{DWORD dwPortCount = 0;HMODULE hModule = LoadLibraryW(L"iphlpapi.dll");if (hModule == NULL){return dwPortCount;}if (type == TcpType){// 表明查询的是 UDP 信息PFNAllocateAndGetTcpExTableFromStack pAllocateAndGetTcpExTableFromStack;pAllocateAndGetTcpExTableFromStack = (PFNAllocateAndGetTcpExTableFromStack)GetProcAddress(hModule, "AllocateAndGetTcpExTableFromStack");if (pAllocateAndGetTcpExTableFromStack != NULL){// 表明为 XP 或者 Server 2003 操作系统PMIB_TCPEXTABLE pTcpExTable = NULL;if (pAllocateAndGetTcpExTableFromStack(&pTcpExTable, TRUE, GetProcessHeap(), 0, AF_INET) != 0){if (pTcpExTable){HeapFree(GetProcessHeap(), 0, pTcpExTable);}FreeLibrary(hModule);hModule = NULL;return dwPortCount;}for (UINT i = 0; i < pTcpExTable->dwNumEntries; i++){// 过滤掉数据，只获取我们要查询的进程的 Port 信息if (dwProcessId == pTcpExTable->table[i].dwProcessId){if (dwPortCount < dwMaxLen){dwAllPort[dwPortCount] = ntohs(0x0000FFFF & pTcpExTable->table[i].dwLocalPort);dwPortCount++;}}}if (pTcpExTable){HeapFree(GetProcessHeap(), 0, pTcpExTable);}FreeLibrary(hModule);hModule = NULL;return dwPortCount;}else{// 表明为 Vista 或者 7 操作系统PMIB_TCPEXTABLE_VISTA pTcpExTable = NULL;PFNInternalGetTcpTable2 pInternalGetTcpTable2 = (PFNInternalGetTcpTable2)GetProcAddress(hModule, "InternalGetTcpTable2");if (pInternalGetTcpTable2 == NULL){if (pTcpExTable){HeapFree(GetProcessHeap(), 0, pTcpExTable);}FreeLibrary(hModule);hModule = NULL;return dwPortCount;}if (pInternalGetTcpTable2(&pTcpExTable, GetProcessHeap(), 1)){if (pTcpExTable){HeapFree(GetProcessHeap(), 0, pTcpExTable);}FreeLibrary(hModule);hModule = NULL;return dwPortCount;}for (UINT i = 0; i < pTcpExTable->dwNumEntries; i++){// 过滤掉数据，只获取我们要查询的进程的 TCP Port 信息if (dwProcessId == pTcpExTable->table[i].dwProcessId){if (dwPortCount < dwMaxLen){dwAllPort[dwPortCount] = ntohs(0x0000FFFF & pTcpExTable->table[i].dwLocalPort);dwPortCount++;}}}if (pTcpExTable){HeapFree(GetProcessHeap(), 0, pTcpExTable);}FreeLibrary(hModule);hModule = NULL;return dwPortCount;}}else if (type == UdpType){// 表明查询的是 UDP 信息PMIB_UDPEXTABLE pUdpExTable = NULL;PFNAllocateAndGetUdpExTableFromStack pAllocateAndGetUdpExTableFromStack;pAllocateAndGetUdpExTableFromStack = (PFNAllocateAndGetUdpExTableFromStack)GetProcAddress(hModule, "AllocateAndGetUdpExTableFromStack");if (pAllocateAndGetUdpExTableFromStack != NULL){// 表明为 XP 或者 Server 2003 操作系统if (pAllocateAndGetUdpExTableFromStack(&pUdpExTable, TRUE, GetProcessHeap(), 0, AF_INET) != 0){if (pUdpExTable){HeapFree(GetProcessHeap(), 0, pUdpExTable);}FreeLibrary(hModule);hModule = NULL;return dwPortCount;}for (UINT i = 0; i < pUdpExTable->dwNumEntries; i++){// 过滤掉数据，只获取我们要查询的进程的 UDP Port信息if (dwProcessId == pUdpExTable->table[i].dwProcessId){if (dwPortCount < dwMaxLen){dwAllPort[dwPortCount] = ntohs(0x0000FFFF & pUdpExTable->table[i].dwLocalPort);dwPortCount++;}}}if (pUdpExTable){HeapFree(GetProcessHeap(), 0, pUdpExTable);}FreeLibrary(hModule);hModule = NULL;return dwPortCount;}else{// 表明为 Vista 或者 7 操作系统PFNInternalGetUdpTableWithOwnerPid pInternalGetUdpTableWithOwnerPid;pInternalGetUdpTableWithOwnerPid = (PFNInternalGetUdpTableWithOwnerPid)GetProcAddress(hModule, "InternalGetUdpTableWithOwnerPid");if (pInternalGetUdpTableWithOwnerPid != NULL){if (pInternalGetUdpTableWithOwnerPid(&pUdpExTable, GetProcessHeap(), 1)){if (pUdpExTable){HeapFree(GetProcessHeap(), 0, pUdpExTable);}FreeLibrary(hModule);hModule = NULL;return dwPortCount;}for (UINT i = 0; i < pUdpExTable->dwNumEntries; i++){// 过滤掉数据，只获取我们要查询的进程的 UDP Port信息if (dwProcessId == pUdpExTable->table[i].dwProcessId){if (dwPortCount < dwMaxLen){dwAllPort[dwPortCount] = ntohs(0x0000FFFF & pUdpExTable->table[i].dwLocalPort);dwPortCount++;}}}}if (pUdpExTable){HeapFree(GetProcessHeap(), 0, pUdpExTable);}FreeLibrary(hModule);hModule = NULL;return dwPortCount;}}else{FreeLibrary(hModule);hModule = NULL;return dwPortCount;}
}//---------------------------------------------------------------------------
//
// 由进程号获得进程名称
//
char* ProcessPidToName(DWORD ProcessId)
{HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);//HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0);PROCESSENTRY32 processEntry = { 0 };processEntry.dwSize = sizeof(PROCESSENTRY32);static char ProcessName[256];lstrcpy(ProcessName, "Idle");if (hProcessSnap == INVALID_HANDLE_VALUE)return ProcessName;BOOL bRet = Process32First(hProcessSnap, &processEntry);while (bRet){if (processEntry.th32ProcessID == ProcessId){lstrcpy(ProcessName, processEntry.szExeFile);return ProcessName;}bRet = Process32Next(hProcessSnap, &processEntry);}CloseHandle(hProcessSnap);return ProcessName;
}//---------------------------------------------------------------------------
//
// 由进程号获得全路径文件名
// x86编译出只能查32位系统程序， x64编译可以查32、64位程序
//
char* ProcessPidToPathName(DWORD ProcessId)
{HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);//HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0);PROCESSENTRY32 processEntry = { 0 };processEntry.dwSize = sizeof(PROCESSENTRY32);static char ProcessName[256];lstrcpy(ProcessName, "Idle");if (hProcessSnap == INVALID_HANDLE_VALUE)return ProcessName;BOOL bRet = Process32First(hProcessSnap, &processEntry);while (bRet){if (processEntry.th32ProcessID == ProcessId){MODULEENTRY32 me32 = { 0 };me32.dwSize = sizeof(MODULEENTRY32);HANDLE hModuleSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, processEntry.th32ProcessID);Module32First(hModuleSnap, &me32); // 获得全程路径. lstrcpy(ProcessName, me32.szExePath);CloseHandle(hProcessSnap);return ProcessName;}bRet = Process32Next(hProcessSnap, &processEntry);}CloseHandle(hProcessSnap);return ProcessName;
}BOOL GetProcessPathByPId(const DWORD dwProcessId, CHAR* cstrPath)
{HANDLE hProcess = NULL;BOOL bSuccess = FALSE;hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, dwProcessId);do{if (NULL == hProcess){break;}PDWORD d = new DWORD;*d = MAX_PATH;CHAR szPath[MAX_PATH + 1] = { 0 };HMODULE hMod = NULL;DWORD cbNeeded = 0;if (FALSE == EnumProcessModules(hProcess, &hMod, sizeof(hMod), &cbNeeded)){break;}//QueryFullProcessImageName GetProcessImageFileNameA GetProcessImageFileName/*if (0 == GetProcessImageFileName(hProcess, szPath, MAX_PATH)){break;}*/if (0 == QueryFullProcessImageName(hProcess, 0, szPath, d)){break;}/*if (0 == GetModuleFileNameEx(hProcess, hMod, szPath, MAX_PATH)){break;}*/strcpy(cstrPath, szPath);bSuccess = TRUE;} while (0);if (NULL != hProcess){CloseHandle(hProcess);hProcess = NULL;}return bSuccess;
}
3、调用方法
DWORD dwResult = GetProcessIdByPort(UdpType, pUDPHeader->SrcPort);//获取进程id
char* _dwStr = ProcessPidToName(dwResult);//获取进程名称