获取父进程备忘

#include <winternl.h>
DWORD GetParentProcessPid()			//获取父进程pid
{
	typedef LONG (WINAPI *pfnNtQueryInformationProcess)(HANDLE,UINT,PVOID,ULONG,PULONG);
	pfnNtQueryInformationProcess _NtQueryInformationProcess;
	PROCESS_BASIC_INFORMATION pbi;
	DWORD     pid=   ::GetCurrentProcessId(); 
	_NtQueryInformationProcess = (pfnNtQueryInformationProcess)GetProcAddress(GetModuleHandleA("ntdll"),"NtQueryInformationProcess");
	HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION,FALSE,pid);

	long status = _NtQueryInformationProcess( hProcess,
		ProcessBasicInformation,
		(PVOID)&pbi,
		sizeof(PROCESS_BASIC_INFORMATION),
		NULL
		);
	DWORD  parentPid= (DWORD)pbi.Reserved3;
	return parentPid;
}

#include <atlstr.h>
#include <Psapi.h>
#pragma comment(lib,"Psapi.lib")
CString GetProcessFullNameByPid(DWORD pid)	//由pid得到进程路径
{
	CString processName;
	HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ ,FALSE,pid);
	if (hProcess!=INVALID_HANDLE_VALUE)
	{
		GetModuleFileNameEx(hProcess,NULL,processName.GetBuffer(MAX_PATH),MAX_PATH);
		processName.ReleaseBuffer();
		CloseHandle(hProcess);
	}
	return processName;
}