学步园

使用说明：

该工具来自 codeproject，使用 PSAPI 获取内核模式和用户模式进程并将用户模式进程的启动时间和结束时间记入日志。本文工具程序名为 ProcessTime。运行程序后，它启动一个线程，该线程在后台执行每隔一定时间监控是否有新启动进程或退出进程。

英文信息请参考：http://www.codeproject.com/threads/ProcessTime.asp

运行截图：

相关代码：

void CProcessTimeDlg::AddProcessToList(DWORD processID )<br /> {<br /> //<br /> // Adds the process name and ID to the ListCtrl<br /> //<br /> // first update the process time<br /> UpdateProcessTime();<br /> CListCtrl *pList = (CListCtrl*)GetDlgItem(IDC_LSTPROCESS);<br /> int nCount = pList->GetItemCount();</p> <p> ST_PROCESSINFO *pstProcessInfo;<br /> char szBuff[MAX_PATH];<br /> char szProcessName[MAX_PATH] = "unknown";<br /> // in case EnumProcessModules fails<br /> char szItemString[MAX_PATH+64];<br /> // open the process to query the time information<br /> // this handle will remain open until ClearProcessList call<br /> // This should remain open to get the process terminated time<br /> HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ,<br /> FALSE, processID);<br /> if(!hProcess)<br /> return;</p> <p> for(int i=0;i<nCount; i++)<br /> {<br /> ST_PROCESSINFO *pstPrvProcessInfo =<br /> (ST_PROCESSINFO *)pList->GetItemData(i);</p> <p> // If the passed process id is same<br /> // as the already updated process in the ListCtrl<br /> // then check whether it is a terminated process<br /> // if not then return immediately<br /> // without updating (to avoid flicker)<br /> if(pstPrvProcessInfo->dwProcessId == processID)<br /> {<br /> CString cszText = pList->GetItemText(i,4);<br /> cszText.TrimRight();<br /> if(cszText == "")<br /> return;<br /> }<br /> }</p> <p> HMODULE hMod;<br /> DWORD cbNeeded;<br /> if(EnumProcessModules( hProcess, &hMod, sizeof(hMod), &cbNeeded))<br /> GetModuleBaseName( hProcess, hMod, szProcessName,<br /> sizeof(szProcessName));<br /> wsprintf(szItemString, "%u", processID);<br /> wsprintf(szBuff,"%d", nCount);<br /> // fill the structure and store the info for later updates<br /> pstProcessInfo = new ST_PROCESSINFO();<br /> pstProcessInfo->dwProcessId = processID;<br /> pstProcessInfo->hProcess = hProcess;<br /> pList->InsertItem(nCount,szItemString);<br /> pList->SetItemText(nCount,2,szProcessName);<br /> pList->SetItemText(nCount,1,szBuff);<br /> pList->SetItemData(nCount,(DWORD)pstProcessInfo);<br /> }

// this will update the process start time and end time<br /> // (end time, only if the process has terminated)<br /> void CProcessTimeDlg::UpdateProcessTime()<br /> {<br /> CListCtrl *pList = (CListCtrl*)GetDlgItem(IDC_LSTPROCESS);<br /> FILETIME ftCreate, ftExit, ftKernel, ftUser;</p> <p> int nCount = pList->GetItemCount();<br /> // loop all the process in the list box<br /> for(int i=0;i<nCount;i++)<br /> {<br /> ST_PROCESSINFO *pstProcessInfo =<br /> (ST_PROCESSINFO *)pList->GetItemData(i);<br /> if(!pstProcessInfo->hProcess)<br /> continue;<br /> if(GetProcessTimes(pstProcessInfo->hProcess,<br /> &ftCreate, &ftExit, &ftKernel, &ftUser))<br /> {<br /> // Horrible, disgusting hack!<br /> // The two lines below basically grab the<br /> // contents of a FILETIME structure<br /> // and store it in a 64 bit integer.<br /> LONGLONG tUser64 = *(LONGLONG *)&ftUser;<br /> LONGLONG tKernel64 = *(LONGLONG *)&ftKernel;</p> <p> DWORD tUser, tKernel;<br /> // The LONGLONGs contain the time in 100 nanosecond intervals (now<br /> // there's a useful unit of measurement...). Divide each of them by<br /> // 10000 to convert into milliseconds, and store the results in a<br /> // DWORD. This means that the max time before overflowing is around<br /> // 4 Million seconds (about 49 days)<br /> tUser = (DWORD)(tUser64 / 10000);<br /> tKernel = (DWORD)(tKernel64 / 10000);</p> <p> // Format the user and kernel times, and add to the process node<br /> char szItem[128];<br /> char szFileDate[32] = { 0 };<br /> char szFileTime[32] = { 0 };<br /> if(!ftCreate.dwHighDateTime&&!ftCreate.dwLowDateTime)<br /> {<br /> strcpy(szFileDate,"");<br /> strcpy(szFileTime,"");<br /> }<br /> else<br /> { // formatting the date & time<br /> GetFileDateAsString(&ftCreate, szFileDate, sizeof(szFileDate));<br /> GetFileTimeAsString(&ftCreate, szFileTime, sizeof(szFileTime));<br /> }<br /> wsprintf(szItem, "%s %s", szFileDate, szFileTime);<br /> CString cszText = pList->GetItemText(i,3);<br /> // if already exists then don't update, this will reduce the flicker<br /> if(cszText != szItem)<br /> pList->SetItemText(i,3,szItem);<br /> if(!ftExit.dwHighDateTime&&!ftExit.dwLowDateTime)<br /> {<br /> strcpy(szFileDate,"");<br /> strcpy(szFileTime,"");<br /> }<br /> else<br /> { // formatting the date & time<br /> GetFileDateAsString(&ftExit, szFileDate, sizeof(szFileDate));<br /> GetFileTimeAsString(&ftExit, szFileTime, sizeof(szFileTime));<br /> }<br /> wsprintf(szItem, "%s %s", szFileDate, szFileTime);<br /> cszText = pList->GetItemText(i,4);<br /> // if already exists then don't update, this will reduce the flicker<br /> if(cszText != szItem)<br /> pList->SetItemText(i,4,szItem);<br /> }<br /> }<br /> }

下载地址：

http://www.codeproject.com/KB/threads/ProcessTime/ProcessTime_src.zip

http://download.csdn.net/source/1883332