Skip to content

Instantly share code, notes, and snippets.

@arthurschreiber
Forked from anonymous/gist:41421
Created December 29, 2008 23:37
Show Gist options
  • Save arthurschreiber/41433 to your computer and use it in GitHub Desktop.
Save arthurschreiber/41433 to your computer and use it in GitHub Desktop.
require "Win32API"
module Windows
module Processes
EnumProcesses = Win32API.new("psapi","EnumProcesses",['P','L','P'],'L')
OpenProcess = Win32API.new("kernel32","OpenProcess",['L','L','L'],'L')
CloseHandle = Win32API.new("kernel32","CloseHandle",['L'],'L')
EnumProcessModules = Win32API.new("psapi","EnumProcessModules",['L','P','L','P'],'L')
GetModuleBaseName = Win32API.new("psapi","GetModuleBaseName",['L','L','P','L'],'L')
GetModuleFileNameEx = Win32API.new("psapi","GetModuleFileNameEx",['L','L','P','L'],'L')
GetProcessMemoryInfo = Win32API.new("psapi","GetProcessMemoryInfo",['L','P','L'],'L')
PROC_QUERY_INFO = 0x0400
PROC_VM_READ = 0x0010
MAX_PATH = 256
ProcTable = Struct.new("ProcTableStruct", :pid, :comm)
def self.get_process_info_struct(pid)
proc_name = "unknown"
h_process = OpenProcess.Call(PROC_QUERY_INFO | PROC_VM_READ,0,pid)
if h_process != 0
h_mod = "\0" * 1024 * 4
cb_needed = "\0" * 4
if EnumProcessModules.Call(h_process, h_mod, 1024, cb_needed) != 0
cb_needed = cb_needed.unpack('L')[0]
modules = h_mod.unpack('L*')[0,cb_needed / 4]
mod = modules[0]
proc_name = "\0" * MAX_PATH
GetModuleBaseName.Call(h_process,mod,proc_name,MAX_PATH)
proc_name.gsub!("\0","")
end
end
CloseHandle.Call(h_process)
ProcTable.new(pid,proc_name)
end
private_class_method :get_process_info_struct
def self.ps(arg=nil)
aProcesses = "\0" * 1024 * 4
cbNeeded = "\0" * 4
r = EnumProcesses.Call(aProcesses,1024,cbNeeded);
cbNeeded = cbNeeded.unpack('L')[0]
cProcesses = cbNeeded / 4
aProcesses = aProcesses.unpack('L*')[0,cProcesses]
return aProcesses.map { |pid| get_process_info_struct(pid) }
end
end
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment