作者：@wordmeng

模块功能

添加当前模块大概功能的描述，希望不要把所有接口文档写在一个文件中，至少按模块分类。

  • 列表
  • 点击列表添加颜色
  • 右键某一列内容出现菜单



    代码实现

    ```cpp

    include “dialog_main.h”

    include

    include “dialog_pe.h”

    include “dialog_about.h”

    include “pe_tool.h”

// MAIN Dialog 消息处理函数 BOOL CALLBACK DialogProc(HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lParam) { BOOL result = TRUE; switch (uMsg) { case WM_INITDIALOG: // 对话框初始化消息 InitListViewProcess(hwndDlg); // 初始化Process ListCtrl InitListViewModules(hwndDlg); // 初始化Modules ListCtrl g_hwndMain = hwndDlg; break;

  1. case WM_CLOSE:
  2.     // 处理窗口关闭消息
  3.     EndDialog(hwndDlg, 0);
  4.     break;
  5. case WM_DESTROY:
  6.     PostQuitMessage(0);
  7.     break;
  9. case WM_COMMAND:
  10.     // 子控件消息处理
  11.     switch (LOWORD(wParam))
  12.     {
  13.     case IDC_BUTTON_EXIT:
  14.         EndDialog(hwndDlg, 0);
  15.         break;
  16.     case IDC_BUTTON_ABOUT:
  17.         DialogBox(g_hInstance, MAKEINTRESOURCE(IDD_DIALOG_ABOUT), hwndDlg, DialogAboutProc);
  18.         break;
  19.     case IDC_BUTTON_PE:
  20.         ShowPeDialog();
  21.         // PE对话框
  22.         break;
  24.     default:
  25.         result = FALSE;
  26.     }
  28. case WM_NOTIFY:
  29. {
  30.                   NMHDR *pNmhdr = (NMHDR*)lParam;
  31.                   if (wParam == IDC_LIST_PROCESS && pNmhdr->code == NM_CLICK)
  32.                   {
  33.                       InitListContentModule();
  34.                   }
  35.                   else if (wParam == IDC_LIST_MODULES && pNmhdr->code == NM_DBLCLK)
  36.                   {
  37.                       CopyModulePath();
  38.                   }
  40. }
  41. default:
  42.     result = FALSE;
  43. }
  45. return result;

}

void InitListViewProcess(HWND hwndDlg) { LV_COLUMN lv = { 0 }; HWND hwndList;

  1. // 获取句柄
  2. hwndList = GetDlgItem(hwndDlg, IDC_LIST_PROCESS);
  3. // 设置整行选中
  4. SendMessage(hwndList, LVM_SETEXTENDEDLISTVIEWSTYLE, LVS_EX_FULLROWSELECT, LVS_EX_FULLROWSELECT);
  6. lv.mask = LVCF_TEXT | LVCF_WIDTH | LVCF_SUBITEM;
  8. // 第一列
  9. lv.pszText = TEXT("进程名");
  10. lv.cx = 180;
  11. lv.iSubItem = 0;
  12. ListView_InsertColumn(hwndList, 0, &lv);
  15. // 第二列
  16. lv.pszText = TEXT("PID");
  17. lv.cx = 50;
  18. lv.iSubItem = 1;
  19. ListView_InsertColumn(hwndList, 1, &lv);
  21. // 第三列
  22. lv.pszText = TEXT("镜像地址");
  23. lv.cx = 80;
  24. lv.iSubItem = 2;
  25. ListView_InsertColumn(hwndList, 2, &lv);
  27. // 第四列
  28. lv.pszText = TEXT("镜像大小");
  29. lv.cx = 80;
  30. lv.iSubItem = 3;
  31. ListView_InsertColumn(hwndList, 3, &lv);
  33. // 遍历进程列表
  34. InitListContentProcess(hwndList);
  36. g_hwndListProcess = hwndList;

}

void InitListViewModules(HWND hwndDlg) {

  1. LV_COLUMN lv = { 0 };
  2. HWND hwndList;
  4. // 获取句柄
  5. hwndList = GetDlgItem(hwndDlg, IDC_LIST_MODULES);
  6. // 设置整行选中
  7. SendMessage(hwndList, LVM_SETEXTENDEDLISTVIEWSTYLE, LVS_EX_FULLROWSELECT, LVS_EX_FULLROWSELECT);
  9. lv.mask = LVCF_TEXT | LVCF_WIDTH | LVCF_SUBITEM;
  11. // 第一列
  12. lv.pszText = TEXT("模块名称");
  13. lv.cx = 100;
  14. lv.iSubItem = 0;
  15. ListView_InsertColumn(hwndList, 0, &lv);
  17. // 第二列
  18. lv.pszText = TEXT("模块位置");
  19. lv.cx = 300;
  20. lv.iSubItem = 1;
  21. ListView_InsertColumn(hwndList, 1, &lv);
  23. g_hwndListModules = hwndList;

}

void InitListContentProcess(hwndList) { // 1. 取得所有进程 // 2. 获取进程信息(进程名称, 主模块ImageBase, 主模块ImageSize, 主模块EOP) // 3. 填充列表数据

  1. //// 1. 获取所有进程ID
  2. //DWORD processIds[1024] = { 0 };
  3. //DWORD dwNumberOfIds = 0;
  4. //if (GetAllProcessId(processIds, sizeof(processIds), &dwNumberOfIds) == FALSE)
  5. //{
  6. //    MessageBox(g_hwndMain, TEXT("获取进程列表!"), TEXT("WARRING"), MB_OK);
  7. //    return;
  8. //}
  10. HANDLE lpSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  11. if (lpSnapshot == INVALID_HANDLE_VALUE)
  12. {
  13.     MessageBox(g_hwndMain, TEXT("创建快照失败"), TEXT("ERROR"), MB_OK);
  14.     return;
  15. }
  17. PROCESSENTRY32 p32;
  18. p32.dwSize = sizeof(p32);
  19. BOOL pr = Process32First(lpSnapshot, &p32);
  20. // 遍历所有进程
  22. for (int row = 0; pr; row++)
  23. {
  24.     // 进程ID
  25.     DWORD dwPid = p32.th32ProcessID;
  26.     // 进程名
  27.     LPTSTR name = p32.szExeFile;
  28.     // 主模块信息
  29.     MODULEINFO mi = { 0 };
  30.     BOOL miResult = FALSE;
  31.     miResult = GetMainModuleInfo(dwPid, &mi);
  33.     LV_ITEM vitem = { 0 };
  34.     vitem.mask = LVIF_TEXT;
  35.     vitem.iItem = row;
  37.     // 第一列(进程名)
  38.     vitem.pszText = name;
  39.     vitem.iSubItem = 0;
  40.     ListView_InsertItem(hwndList, &vitem);
  42.     // 第二列(PID)
  43.     TCHAR buffer[16];
  44.     wsprintf(buffer, TEXT("%d"), dwPid);
  45.     vitem.pszText = buffer;
  46.     vitem.iSubItem = 1;
  47.     ListView_SetItem(hwndList, &vitem);
  49.     if (miResult)
  50.     {
  51.         // 第三列(主模块基地址)
  52.         wsprintf(buffer, TEXT("%p"), mi.lpBaseOfDll);
  53.         vitem.pszText = buffer;
  54.         vitem.iSubItem = 2;
  55.         ListView_SetItem(hwndList, &vitem);
  57.         // 第四列(镜像大小)
  58.         wsprintf(buffer, TEXT("%p"), mi.SizeOfImage);
  59.         vitem.pszText = buffer;
  60.         vitem.iSubItem = 3;
  61.         ListView_SetItem(hwndList, &vitem);
  62.     }
  65.     pr = Process32Next(lpSnapshot, &p32);
  66. }

}

void InitListContentModule() { // 1. 获取到进程的ID // 2. 遍历模块 // 3. 填充数据. 数据获取失败. 清空列表

  1. DWORD dwRowId;
  2. TCHAR szPid[0x20] = { 0 };
  4. dwRowId = SendMessage(g_hwndListProcess, LVM_GETNEXTITEM, -1, LVNI_SELECTED);
  5. if (dwRowId == -1)
  6. {
  7.     return;
  8. }
  9. // 清空所有数据行
  10. ListView_DeleteAllItems(g_hwndListModules);
  14. // 获取PID
  15. LV_ITEM lv = { 0 };
  16. lv.iSubItem = 1;
  17. lv.pszText = szPid;
  18. lv.cchTextMax = 0x20;
  19. SendMessage(g_hwndListProcess, LVM_GETITEMTEXT, dwRowId, (DWORD)&lv);
  21. DWORD dwPid = StrToInt(szPid);
  24. // 遍历模块
  25. DWORD dwNumOfModules = 0;
  26. BOOL bResult = FALSE;
  27. HMODULE hModules[1024];
  28. HANDLE hProcess;
  30. bResult = GetAllModules(dwPid, hModules, 1024, &dwNumOfModules);
  31. hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
  32. if (bResult == FALSE || hProcess == NULL || dwNumOfModules == 0)
  33. {
  34.     return;
  35. }
  38. // 填充所有行数据
  39. for (int row = 0; row < dwNumOfModules; row++)
  40. {
  41.     // 获取模块数据: 模块名称,模块地址
  42.     TCHAR strBaseName[1024] = { 0 };
  43.     TCHAR strFileName[1024] = { 0 };
  45.     GetModuleBaseName(hProcess, hModules[row], strBaseName, 1024);
  46.     GetModuleFileNameEx(hProcess, hModules[row], strFileName, 1024);
  48.     LV_ITEM vitem = { 0 };
  49.     vitem.mask = LVIF_TEXT;
  50.     vitem.iItem = row;
  52.     // 第一列(模块名称)
  53.     vitem.pszText = strBaseName;
  54.     vitem.iSubItem = 0;
  55.     ListView_InsertItem(g_hwndListModules, &vitem);
  57.     // 第二列(模块位置)
  58.     vitem.pszText = strFileName;
  59.     vitem.iSubItem = 1;
  60.     ListView_SetItem(g_hwndListModules, &vitem);
  63.     MODULEINFO mi;
  64.     if (GetModuleInformation(hProcess, hModules[row], &mi, sizeof(MODULEINFO)))
  65.     {
  67.         mi.lpBaseOfDll;
  68.         vitem.pszText = strFileName;
  69.         vitem.iSubItem = 1;
  70.         ListView_SetItem(g_hwndListModules, &vitem);
  72.     }
  73. }
  75. CloseHandle(hProcess);

}

void ShowPeDialog() { // 选择文件 // 加载PE

  1. // 弹出文件选择器
  2. TCHAR strFeFileExt[128] = TEXT("PE File(*.exe,*.dll,*.sys)\0*.exe;*.dll*;.sys\0") \
  3.     TEXT("All File(*.*)\0*.*\0\0");
  4. TCHAR strFileName[256] = { 0 };
  5. OPENFILENAMEW st = { 0 };
  6. ZeroMemory(&st, sizeof(OPENFILENAME));
  7. st.lStructSize = sizeof(OPENFILENAME);
  8. st.Flags = OFN_FILEMUSTEXIST | OFN_PATHMUSTEXIST;
  9. st.hwndOwner = g_hwndMain;
  10. st.lpstrFilter = strFeFileExt;
  11. st.lpstrFile = strFileName;
  12. st.nMaxFile = MAX_PATH;
  14. if (GetOpenFileName(&st) == FALSE)
  15. {
  16.     SetStaticMessage(TEXT("未选择文件!"));
  17.     return;
  18. }
  20. //PVOID g_pFileBuffer = NULL;
  21. //DWORD g_dwFileSize = 0;
  22. if (ReadPeFile(strFileName, &g_pFileBuffer, &g_dwFileSize) == FALSE)
  23. {
  24.     SetStaticMessage(TEXT("加载PE文件失败!"));
  25.     return;
  26. }
  29. TCHAR buf[1024];
  30. wsprintf(buf, TEXT("已打开文件 %s"), strFileName);
  31. SetStaticMessage(buf);
  33. DialogBox(g_hInstance, MAKEINTRESOURCE(IDD_DIALOG_PE), g_hwndMain, DialogPeProc);

}

BOOL GetAllModules(DWORD dwPid, HMODULE pModuel, int nSize, DWORD dwNumOfModules) {

  1. HANDLE hProcess;
  2. hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
  3. if (hProcess == NULL)
  4. {
  5.     return FALSE;
  6. }
  8. DWORD cbNeeded;
  9. if (EnumProcessModules(hProcess, pModuel, nSize, &cbNeeded) == FALSE)
  10. {
  11.     CloseHandle(hProcess);
  12.     return FALSE;
  13. }
  15. *dwNumOfModules = cbNeeded / sizeof(DWORD);
  16. return TRUE;

}

BOOL GetAllProcessId(DWORD *pPids, DWORD cb, PDWORD lpNumberOfPids) { DWORD cbNeeded; if (!EnumProcesses(pPids, cb, &cbNeeded)) { return FALSE; }

  1. *lpNumberOfPids = cbNeeded / sizeof(DWORD);
  2. return TRUE;

}

BOOL GetMainModuleInfo(DWORD dwPid, MODULEINFO* mi) { HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid); if (hProcess == NULL) { return FALSE; }

  1. HMODULE hModules[1];
  2. DWORD cbNeeded;
  3. if (EnumProcessModules(hProcess, hModules, sizeof(hModules), &cbNeeded) == FALSE)
  4. {
  5.     CloseHandle(hProcess);
  6.     return FALSE;
  7. }
  9. MODULEINFO info;
  10. DWORD cb;
  11. if (GetModuleInformation(hProcess, hModules[0], &info, &cb) == FALSE)
  12. {
  13.     CloseHandle(hProcess);
  14.     return FALSE;
  15. }
  17. *mi = info;
  18. CloseHandle(hProcess);
  19. return TRUE;

}

void SetStaticMessage(LPCTSTR str) { HWND hwndStatic = GetDlgItem(g_hwndMain, IDC_STATIC1); SetWindowText(hwndStatic, str); }

void CopyModulePath() {

  1. DWORD dwRowId;
  2. TCHAR strPath[4096] = { 0 };
  4. dwRowId = SendMessage(g_hwndListModules, LVM_GETNEXTITEM, -1, LVNI_SELECTED);
  5. if (dwRowId == -1)
  6. {
  7.     return;
  8. }
  11. // 获取路径
  12. LV_ITEM lv = { 0 };
  13. lv.iSubItem = 1;
  14. lv.pszText = strPath;
  15. lv.cchTextMax = 4096;
  16. SendMessage(g_hwndListModules, LVM_GETITEMTEXT, dwRowId, (DWORD)&lv);
  18. TCHAR buf[1024];
  19. wsprintf(buf, TEXT("已复制 %s"), strPath);
  20. SetStaticMessage(buf);
  22. CopyTextToClipboard(strPath, sizeof(TCHAR));

}

BOOL CopyTextToClipboard(LPCTSTR strText) { // 打开剪贴板
if (!OpenClipboard(NULL) || !EmptyClipboard()) { SetStaticMessage(TEXT(“打开或清空剪切板出错”)); return; }

  1. HGLOBAL hMen;
  3. // 分配全局内存    
  5. hMen = GlobalAlloc(GMEM_MOVEABLE, ((_tcslen(strText) + 1)*sizeof(TCHAR)));
  7. if (!hMen)
  8. {
  9.     SetStaticMessage(TEXT("分配全局内存出错!"));
  10.     // 关闭剪切板    
  11.     CloseClipboard();
  12.     return;
  13. }
  15. // 把数据拷贝考全局内存中   
  16. // 锁住内存区    
  17. LPTSTR lpStr = (LPTSTR)GlobalLock(hMen);
  19. // 内存复制   
  20. memcpy(lpStr, strText, ((_tcslen(strText))*sizeof(TCHAR)));
  21. // 字符结束符    
  23. lpStr[_tcslen(strText)] = (TCHAR)0;
  24. // 释放锁    
  25. GlobalUnlock(hMen);
  27. // 把内存中的数据放到剪切板上   
  28. DWORD flag = sizeof(TCHAR) == 2 ? CF_UNICODETEXT : CF_TEXT;
  29. SetClipboardData(CF_UNICODETEXT, hMen);
  30. CloseClipboard();
  32. return;

}

```

结果展示