易语言枚举进程所有句柄源码

系统结构:获取系统所有句柄信息,获取句柄名,获取句柄类型,获取句柄引用数,List,Count,GetItem,GetCurrentProcessId,GetCurrentProcess,RtlMoveMemory_SYSTEM_HANDLE_INFORMATION,DuplicateHandle,OpenProcess,CloseHandle,ZwQuerySystemInformation,ZwQueryObject,ZwQueryObject_SYSTEM_HANDLE_STATE,RtlUnicodeStringToAnsiString,RtlFreeAnsiString,

======程序集1
           |  |
           |  |------ _启动子程序
           |  |
           |  |
======窗口程序集_窗口1
           |  |
           |  |------ _窗口1_创建完毕
           |  |
           |  |------ _按钮1_被单击
           |  |
           |  |------ 获取系统所有句柄信息
           |  |
           |  |------ 获取句柄名
           |  |
           |  |------ 获取句柄类型
           |  |
           |  |------ 获取句柄引用数
           |  |
           |  |
======List
           |  |
           |  |------ _初始化
           |  |
           |  |------ _销毁
           |  |
           |  |------ List
           |  |
           |  |------ Count
           |  |
           |  |------ GetItem
           |  |
           |  |
======程序集2
           |  |
           |  |
======调用的Dll
           |  |
           |  |---[dll]------   GetCurrentProcessId
           |  |
           |  |---[dll]------   GetCurrentProcess
           |  |
           |  |---[dll]------   RtlMoveMemory_SYSTEM_HANDLE_INFORMATION
           |  |
           |  |---[dll]------   DuplicateHandle
           |  |
           |  |---[dll]------   OpenProcess
           |  |
           |  |---[dll]------   CloseHandle
           |  |
           |  |---[dll]------   ZwQuerySystemInformation
           |  |
           |  |---[dll]------   ZwQueryObject
           |  |
           |  |---[dll]------   ZwQueryObject_SYSTEM_HANDLE_STATE
           |  |
           |  |---[dll]------   RtlUnicodeStringToAnsiString
           |  |
           |  |---[dll]------   RtlFreeAnsiString

调用的DLL命令:

.DLL命令 GetCurrentProcessId, 整数型, "kernel32.dll", "GetCurrentProcessId"

.DLL命令 GetCurrentProcess, 整数型, "kernel32.dll", "GetCurrentProcess"

.DLL命令 RtlMoveMemory_SYSTEM_HANDLE_INFORMATION, , "kernel32.dll", "RtlMoveMemory"
    .参数 Destination, SYSTEM_HANDLE_INFORMATION
    .参数 Source, 整数型
    .参数 Length, 整数型

.DLL命令 DuplicateHandle, 逻辑型, "kernel32.dll", "DuplicateHandle"
    .参数 hSourceProcessHandle, 整数型
    .参数 hSourceHandle, 整数型
    .参数 hTargetProcessHandle, 整数型
    .参数 lpTargetHandle, 整数型, 传址
    .参数 dwDesiredAccess, 整数型
    .参数 bInheritHandle, 逻辑型
    .参数 dwOptions, 整数型

.DLL命令 OpenProcess, 整数型, "kernel32.dll", "OpenProcess"
    .参数 dwDesiredAccess, 整数型
    .参数 bInheritHandle, 逻辑型
    .参数 dwProcessId, 整数型

.DLL命令 CloseHandle, 逻辑型, "kernel32.dll", "CloseHandle"
    .参数 hObject, 整数型

.DLL命令 ZwQuerySystemInformation, 整数型, "ntdll.dll", "ZwQuerySystemInformation"
    .参数 SystemInformationClass, 整数型
    .参数 SystemInformation, 字节集
    .参数 SystemInformationLength, 整数型
    .参数 ReturnLength, 整数型, 传址

.DLL命令 ZwQueryObject, 整数型, "ntdll.dll", "ZwQueryObject"
    .参数 ObjectHandle, 整数型
    .参数 ObjectInformationClass, 整数型
    .参数 ObjectInformation, 字节集
    .参数 ObjectInformationLength, 整数型
    .参数 ReturnLength, 整数型, 传址

.DLL命令 ZwQueryObject_SYSTEM_HANDLE_STATE, 整数型, "ntdll.dll", "ZwQueryObject"
    .参数 ObjectHandle, 整数型
    .参数 ObjectInformationClass, 整数型
    .参数 ObjectInformation, SYSTEM_HANDLE_STATE
    .参数 ObjectInformationLength, 整数型
    .参数 ReturnLength, 整数型, 传址

.DLL命令 RtlUnicodeStringToAnsiString, 整数型, "ntdll.dll", "RtlUnicodeStringToAnsiString"
    .参数 DestinationString, STRING
    .参数 SourceString, 字节集
    .参数 AllocateDestinationString, 逻辑型

.DLL命令 RtlFreeAnsiString, 整数型, "ntdll.dll", "RtlFreeAnsiString"
    .参数 AnsiString, STRING