惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

T
Threatpost
V
Vulnerabilities – Threatpost
TaoSecurity Blog
TaoSecurity Blog
C
Cybersecurity and Infrastructure Security Agency CISA
P
Proofpoint News Feed
G
GRAHAM CLULEY
S
Securelist
P
Palo Alto Networks Blog
MongoDB | Blog
MongoDB | Blog
A
Arctic Wolf
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
WordPress大学
WordPress大学
Project Zero
Project Zero
T
Threat Research - Cisco Blogs
L
Lohrmann on Cybersecurity
C
Cyber Attacks, Cyber Crime and Cyber Security
F
Fortinet All Blogs
博客园 - 叶小钗
B
Blog RSS Feed
C
Cisco Blogs
Google DeepMind News
Google DeepMind News
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
Apple Machine Learning Research
Apple Machine Learning Research
G
Google Developers Blog
K
Kaspersky official blog
D
Docker
Latest news
Latest news
Cisco Talos Blog
Cisco Talos Blog
T
Tor Project blog
Cyberwarzone
Cyberwarzone
Security Latest
Security Latest
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
D
Darknet – Hacking Tools, Hacker News & Cyber Security
Spread Privacy
Spread Privacy
Microsoft Azure Blog
Microsoft Azure Blog
C
Check Point Blog
J
Java Code Geeks
Simon Willison's Weblog
Simon Willison's Weblog
T
Tenable Blog
Recent Announcements
Recent Announcements
T
Tailwind CSS Blog
H
Help Net Security
L
LINUX DO - 热门话题
T
The Exploit Database - CXSecurity.com
Jina AI
Jina AI
S
SegmentFault 最新的问题
MyScale Blog
MyScale Blog
NISL@THU
NISL@THU
美团技术团队
腾讯CDC

博客园 - 方正

jquery技巧总结 学习jquery Apache+Tomcat关于Session Sticky模式的负载均衡 关于用户体验 哪种人投身互联网才能获得大成功?什么样的人适合做互联网? 你的网站的为什么没有人访问--50个原因值得你去思考 需求分析 好的Web 2.0产品 Web产品经理思考 令人头疼的正则表达式 C#实现QQ接口软件--QQ的HTTP接口协议探究 WMI使用技巧集 在c#中调用windows命令程序 (转)WEB专用服务器的安全管理 谈web2.0网站初期规划应该考虑的问题[转载] 网络速度10M指的是位还是字节?--10M带宽到底是多快?和磁盘的1M有什么区别? 一只烂苹果 虚拟团队的运作与协调 网络虚拟团队的成功
如何使用WMI获取进程信息
方正 · 2007-12-24 · via 博客园 - 方正

以下示例演示如何使用WMI获得本地机器的进程列表(当然,WMI也能获得远程机器的进程列表,远不只例子中的功能),示例代码是我简化codeproject的例子而来:

//用于表示进程信息的结构

public struct structProcessInfo

{

    //进程名

     public string stringName;

    //进程ID

     public string stringProcessID;

    //父进程ID

     public string stringParentProcessID;

    //用户名

     public string stringUserName;

}

public class ProcessesInfo

{

     private structProcessInfo _value;

     public structProcessInfo Value

     {

         get {return _value;}

         set {_value = value;}

     }

}

//用于保存进程信息的字典类,继承于NameObjectCollectionBase

public class ProcessesDictionary : NameObjectCollectionBase

{

    public void Clear()

    {

        BaseClear();

    }

    public void Add(string name, ProcessesInfo processObj)

    {

        BaseAdd(name, processObj);

    }

    public void Remove(string name)

    {

        BaseRemove(name);

    }

    public void RemoveAt(int index)

    {

        BaseRemoveAt(index);

    }

    public ProcessesInfo this[int index]

    {

        get { return (ProcessesInfo)BaseGet(index); }

        set { BaseSet(index, value); }

    }

    public ProcessesInfo this[string name]

    {

        get { return (ProcessesInfo)BaseGet(name); }

        set { BaseSet(name, value); }

    }

}

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

//用于表示进程CPU及内存使用情况的结构

public struct structPerformance

{

    public string stringPercentProcessorTime;

    public string stringVirtualBytes;

}

public class ProcessPerf

{

    private structPerformance _value;

    public structPerformance Value

    {

        get { return _value; }

        set { _value = value; }

    }

}

//用于保存进程CPU及内存使用情况的字典类

public class ProcessesPerformanceDictionary : NameObjectCollectionBase

{

    public void Clear()

    {

        BaseClear();

    }

    public void Add(string name, ProcessPerf processPerformance)

    {

        BaseAdd(name, processPerformance);

    }

    public void Remove(string name)

    {

        BaseRemove(name);

    }

   public void RemoveAt(int index)

    {

        BaseRemoveAt(index);

    }

    public ProcessPerf this[int index]

    {

        get { return (ProcessPerf)BaseGet(index); }

        set { BaseSet(index, value); }

    }

    public ProcessPerf this[string name]

    {

        get { return (ProcessPerf)BaseGet(name); }

        set { BaseSet(name, value); }

    }

}

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

//表示ManagementObject对象的异步调用方法是否完成

public class MyHandler

{

    private bool isComplete = false;

    private ManagementBaseObject returnObject;

    public void Done(object sender, ObjectReadyEventArgs e)

    {

        isComplete = true;

        returnObject = e.NewObject;

    }

    public bool IsComplete

    {

        get

        {

            return isComplete;

        }

    }

    public ManagementBaseObject ReturnObject

    {

        get

        {

            return returnObject;

        }

    }

}

= = = = = = = = = = = = = = = = = = = = =  = = = = = = = = =

一个窗体,添加一个ListView:lvProcess,一个Button:btList用于显示进程列表,一个Button:btClose用于关闭窗体:

private void btList_Click(object sender, EventArgs e)

{

    this.lvProcess.Items.Clear();

    ManagementOperationObserver observer = new ManagementOperationObserver();

    MyHandler invokeHandler = new MyHandler();

    observer.ObjectReady += new ObjectReadyEventHandler(invokeHandler.Done);

    ProcessesDictionary pDict = new ProcessesDictionary();

    ProcessesPerformanceDictionary perDict = new ProcessesPerformanceDictionary();

    ProcessesInfo pInfo;

    structProcessInfo pStruct;

    ProcessPerf perInfo;

    structPerformance perStruct;

    string[] lvData = new string[5];

    #region获取进程名称、ID、父进程ID、进程所属用户名

    ManagementObjectCollection moc = this.ExecSearch("SELECT * FROM Win32_Process");

    if (moc == null)

    {

        MessageBox.Show("Error:null");

        return;

    }

    foreach (ManagementObject mo in moc)

    {

        pInfo = new ProcessesInfo();

        pStruct = new structProcessInfo();

        pStruct.stringName = mo["Name"].ToString();

        pStruct.stringProcessID = mo["ProcessID"].ToString();

        pStruct.stringParentProcessID = mo["ParentProcessID"].ToString();

        mo.InvokeMethod(observer, "GetOwner", null);

        while (!invokeHandler.IsComplete)

        {

            System.Threading.Thread.Sleep(500);

        }

        //判断获取用户名的操作是否成功

        if (invokeHandler.ReturnObject["returnValue"].ToString() == "0")

        {

            pStruct.stringUserName = invokeHandler.ReturnObject.Properties["User"].Value.ToString();

        }

        else

        {

            pStruct.stringUserName = "";

        }

        //保存该进程信息到字典类中

        pInfo.Value = pStruct;

        pDict.Add(mo["ProcessID"].ToString(), pInfo);

    }

    #endregion

    #region获得进程的CPU及内存使用情况

    ManagementObjectCollection moc1 = this.ExecSearch("SELECT * FROM Win32_PerfFormattedData_PerfProc_Process");

    if (moc1 == null)

    {

        MessageBox.Show("Error:null");

        return;

    }

    foreach (ManagementObject mo1 in moc1)

    {

        perInfo = new ProcessPerf();

        perStruct = new structPerformance();

        perStruct.stringPercentProcessorTime = mo1.Properties["PercentProcessorTime"].Value.ToString();

        perStruct.stringVirtualBytes = mo1["VirtualBytes"].ToString();

        //添加CPU及内存使用情况到字典类中

        perInfo.Value = perStruct;

        perDict.Add(mo1["IDProcess"].ToString(), perInfo);

        perInfo = null;

    }

    #endregion

    #region显示列表

    foreach (string stringProcessID in pDict)

    {

        pStruct = pDict[stringProcessID].Value;

        lvData[0] = pStruct.stringName.ToString();

        lvData[4] = pStruct.stringProcessID.ToString();

        lvData[1] = pStruct.stringUserName.ToString();

        try

        {

            lvData[2] = perDict[pStruct.stringProcessID.ToString()].Value.stringPercentProcessorTime.ToString();

            lvData[3] = perDict[pStruct.stringProcessID.ToString()].Value.stringVirtualBytes.ToString();

        }

        catch (NullReferenceException)

        {

            //无法获取CPU及内存情况

            lvData[2] = "0";

            lvData[3] = "0";

        }

        ListViewItem lvItem = new ListViewItem(lvData, 0);

        lvProcess.Items.Add(lvItem);

    }

    #endregion

    pDict.Clear();

    pDict = null;

    perDict.Clear();

    perDict = null;

}

///<summary>

///执行查询

///</summary>

///<param name="command">查询语句</param>

///<returns></returns>

private ManagementObjectCollection ExecSearch(string command)

{

    ManagementObjectCollection moc = null;

    ObjectQuery objQuery = new ObjectQuery(command);

    string stringMachineName = "localhost";

    ManagementScope scope = new ManagementScope(\\\\ + stringMachineName + "\\root\\cimv2");

    ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, objQuery);

    try

    {

        moc = searcher.Get();

    }

    catch (Exception x)

    {

        MessageBox.Show("Error:" + x.Message);

    }

    return moc;

}

private void btClose_Click(object sender, EventArgs e)

{

    this.Close();

}

用C#+WMI获取w3wp进程对应的程序池

using System; 
  
using System.Text; 
  
using System.Text.RegularExpressions; 
  
using System.Diagnostics; 
  
using System.Management; 
  
using System.Windows.Forms; 
   
  
namespace TextConvertor 
  

   
/**//// <summary> 
   
/// W3wp 的摘要说明。 
   
/// </summary> 

   public class W3wp 
   

   
private W3wp(){} 
   
public static string GetAllW3wp(string input) 
   

   ObjectQuery oQuery 
= new ObjectQuery("select * from Win32_Process where Name='w3wp.exe'"); 
   ManagementObjectSearcher oSearcher 
= new ManagementObjectSearcher(oQuery); 
   ManagementObjectCollection oReturnCollection 
= oSearcher.Get(); 
   
   
string pid; 
   
string cmdLine; 
   StringBuilder sb 
= new StringBuilder() ; 
   
foreach(ManagementObject oReturn in oReturnCollection) 
   

   pid 
= oReturn.GetPropertyValue("ProcessId").ToString(); 
   cmdLine 
= (string)oReturn.GetPropertyValue("CommandLine"); 
   
   
string pattern = "-ap \"(.*)\"" ; 
   Regex regex 
= new Regex(pattern, RegexOptions.IgnoreCase) ; 
   Match match 
= regex.Match(cmdLine) ; 
   
string appPoolName = match.Groups[1].ToString() ; 
   sb.AppendFormat(
"W3WP.exe PID: {0} AppPoolId:{1}\r\n", pid, appPoolName ); 
   }
 
   
   
return sb.ToString(); 
   }
 
   }
 
  }