易语言取进程环境源码

系统结构:GetPeb,ZwQueryInformationProcess,OpenProcess,CloseHandle,CopyMemory_PROCESS_BASIC_INFORMATION,

======窗口程序集1
           |  |
           |  |------ __启动窗口_创建完毕
           |  |
           |  |------ GetPeb
           |  |
           |  |
======调用的Dll
           |  |
           |  |---[dll]------   ZwQueryInformationProcess
           |  |
           |  |---[dll]------   OpenProcess
           |  |
           |  |---[dll]------   CloseHandle
           |  |
           |  |---[dll]------   CopyMemory_PROCESS_BASIC_INFORMATION

调用的DLL命令:

.DLL命令 ZwQueryInformationProcess, 整数型, "NTDLL.DLL"
    .参数 ProcessHandle, 整数型
    .参数 ProcessInformationClass, 整数型, , PROCESSINFOCLASS
    .参数 ProcessInformation, 字节集
    .参数 ProcessInformationLength, 整数型
    .参数 ReturnLength, 整数型, 传址

.DLL命令 OpenProcess, 整数型, "kernel32.dll", "OpenProcess"
    .参数 dwDesiredAccess, 整数型
    .参数 bInheritHandle, 逻辑型, , 是否继承
    .参数 dwProcessId, 整数型

.DLL命令 CloseHandle, 整数型, , "CloseHandle"
    .参数 hwnd, 整数型

.DLL命令 CopyMemory_PROCESS_BASIC_INFORMATION, , "kernel32", "RtlMoveMemory"
    .参数 Destination, PROCESS_BASIC_INFORMATION
    .参数 Source, 字节集
    .参数 Length, 整数型