获取当前进程是否是其它进程的子进程

获取当前进程是否是其它进程的子进程(这边如当前进程是否是Excel的)

// 获得当前进程信息 
 1     HMODULE hModule = LoadLibrary(L"NTdll.dll");
    if (hModule)
    {        
        NTSTATUS (__stdcall *NtQueryInformationProcess) (
                IN HANDLE ProcessHandle,
                IN PROCESSINFOCLASS ProcessInformationClass,
                OUT PVOID ProcessInformation,
                IN ULONG ProcessInformationLength,
                OUT PULONG ReturnLength OPTIONAL
        );
          
        (FARPROC &)NtQueryInformationProcess = GetProcAddress(hModule, "NtQueryInformationProcess");
        if (NtQueryInformationProcess)
        {
            DWORD dwProcessID = GetCurrentProcessId();         
                
            HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION,FALSE,dwProcessID);
            if( NULL != hProcess )    
            {
                LONG status;
                PROCESS_BASIC_INFORMATION pbi;
                status = NtQueryInformationProcess( hProcess,ProcessBasicInformation,(PVOID)&pbi,sizeof(PROCESS_BASIC_INFORMATION),NULL );
                if (!status)
                {                
                    g_bParentIsNotEXCEL_EXE = isNotEXCEL_EXE( ( DWORD )pbi.Reserved3 ); // pbi.Reserved3中也是进程信息
                }
            }            
        }
    }

// 获取进程的名称，如EXCEL.EXE。
// To retrieve the full path to the executable file。
// 1.使用CreateToolhelp32Snapshot()，并传入TH32CS_SNAPMODULE
// 2.call the Module32First function and check the szExePath member of the MODULEENTRY32 structure that is returned. However, if the calling process is a 32-bit process, you must call the QueryFullProcessImageName function to retrieve the full path of the executable file for a 64-bit process.
// To enumerate the heap or module states for all processes, specify TH32CS_SNAPALL and set th32ProcessID to zero. Then, for each additional process in the snapshot, call CreateToolhelp32Snapshot again, specifying its process identifier and the TH32CS_SNAPHEAPLIST or TH32_SNAPMODULE value. 
 1 BOOL g_bParentIsNotEXCEL_EXE = FALSE;
BOOL isNotEXCEL_EXE( DWORD dwProcessID )
{
  HANDLE hProcessSnap;
  PROCESSENTRY32 pe32;

  // Take a snapshot of all processes in the system.
  hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
  if( hProcessSnap == INVALID_HANDLE_VALUE )
  {
    return( FALSE );
  }

  // Set the size of the structure before using it.
  pe32.dwSize = sizeof( PROCESSENTRY32 );

  // Retrieve information about the first process, and exit if unsuccessful
  if( !Process32First( hProcessSnap, &pe32 ) )
  {    
    CloseHandle( hProcessSnap );    // Must clean up the  snapshot object!
    return( FALSE );
  }

  // Now walk the snapshot of processes, and display information about each process in turn
  do
  {

    if( pe32.th32ProcessID == dwProcessID )
    {
        CString strExeFile = pe32.szExeFile;    
        //AfxMessageBox( strExeFile);
        strExeFile.MakeUpper();
        if( strExeFile != _T("EXCEL.EXE") && strExeFile != _T("MATLAB.EXE"))
        {
            CloseHandle( hProcessSnap );    // Must clean up the  snapshot object!
            return TRUE;            
        }
        break;
    }    
  } while( Process32Next( hProcessSnap, &pe32 ) );
  CloseHandle( hProcessSnap );    // Must clean up the  snapshot object!
  return FALSE;
}

GetModuleFileNameEx

GetProcessImageFileName

QueryFullProcessImageName