获得调用者进程信息

DWORD ShowParentProcessInfo()  
{
    typedef LONG (WINAPI *PROCNTQSIP)(HANDLE,UINT,PVOID,ULONG,PULONG);  
    PROCNTQSIP NtQueryInformationProcess;  
    NtQueryInformationProcess = (PROCNTQSIP)GetProcAddress(  
        GetModuleHandle(_T("ntdll")),  
        "NtQueryInformationProcess"  
        );  

    if (!NtQueryInformationProcess)  
        return 0;  

    DWORD dwId = ::GetCurrentProcessId();
    LONG                      status;  
    DWORD                     dwParentPID = 0;  
    HANDLE                    hProcess;  
    W_PROCESS_BASIC_INFORMATION pbi;  

    // Get process handle  
    hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, NULL, dwId);  
    if (!hProcess)  
        return 0;  

    // Retrieve information  
    status = NtQueryInformationProcess( hProcess,  
        ProcessBasicInformation,  
        (PVOID)&pbi,  
        sizeof(W_PROCESS_BASIC_INFORMATION),  
        NULL  
        );  

    // Copy parent Id on success  
    if  (!status)  
    {
        dwParentPID = pbi.InheritedFromUniqueProcessId;  
        HANDLE hParentProcess = NULL;
        hParentProcess = OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ, NULL, dwParentPID);  
        if (hParentProcess)
        {
            TCHAR szTemp[MAX_PATH] = {0};
            TCHAR szProcessName[MAX_PATH] = {0};
            DWORD dwErr = ::GetModuleFileNameEx(hParentProcess,NULL,szTemp,MAX_PATH);
            ::GetLongPathName(szTemp, szProcessName, MAX_PATH);
            if (dwErr)
                Log4cxx(LOG4CXX__INFO, MODULENAME , _T("Caller=%s, ParentProcessID=%d"), szProcessName, dwParentPID);
            else
                Log4cxx(LOG4CXX__INFO, MODULENAME , _T("Caller=%s, ParentProcessID=%d, LastError=%d"), szProcessName, dwParentPID, dwErr);
        }
        CloseHandle (hParentProcess);
    }

    CloseHandle (hProcess);  

    return dwParentPID;  
}  

结果

Caller=C:Program Files (x86)WindWind.NET.ClientWindNETinwmain.exe, ParentProcessID=6012