#include <iostream>
#include <Windows.h>
#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
#define STATUS_SUCCESS ((NTSTATUS)0x00000000)
#define SystemProcessesAndThreadsInformation 5 // 功能号
#define NTAPI __stdcall
typedef
LONG
KPRIORITY;
typedef
struct
_UNICODE_STRING
{
USHORT
Length;
USHORT
MaximumLength;
PWSTR
Buffer;
} UNICODE_STRING, *PUNICODE_STRING;
typedef
struct
_VM_COUNTERS
{
SIZE_T
PeakVirtualSize;
SIZE_T
VirtualSize;
ULONG
PageFaultCount;
SIZE_T
PeakWorkingSetSize;
SIZE_T
WorkingSetSize;
SIZE_T
QuotaPeakPagedPoolUsage;
SIZE_T
QuotaPagedPoolUsage;
SIZE_T
QuotaPeakNonPagedPoolUsage;
SIZE_T
QuotaNonPagedPoolUsage;
SIZE_T
PagefileUsage;
SIZE_T
PeakPagefileUsage;
} VM_COUNTERS;
typedef
struct
_CLIENT_ID
{
DWORD
UniqueProcess;
DWORD
UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
typedef
enum
_THREAD_STATE
{
StateInitialized,
StateReady,
StateRunning,
StateStandby,
StateTerminated,
StateWait,
StateTransition,
StateUnknown
}THREAD_STATE;
typedef
enum
_KWAIT_REASON
{
Executive,
FreePage,
PageIn,
PoolAllocation,
DelayExecution,
Suspended,
UserRequest,
WrExecutive,
WrFreePage,
WrPageIn,
WrPoolAllocation,
WrDelayExecution,
WrSuspended,
WrUserRequest,
WrEventPair,
WrQueue,
WrLpcReceive,
WrLpcReply,
WrVirtualMemory,
WrPageOut,
WrRendezvous,
Spare2,
Spare3,
Spare4,
Spare5,
Spare6,
WrKernel,
MaximumWaitReason
}KWAIT_REASON;
typedef
struct
_SYSTEM_THREAD_INFORMATION
{
LARGE_INTEGER KernelTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER CreateTime;
ULONG
WaitTime;
PVOID
StartAddress;
CLIENT_ID ClientId;
KPRIORITY Priority;
KPRIORITY BasePriority;
ULONG
ContextSwitchCount;
LONG
State;
LONG
WaitReason;
} SYSTEM_THREAD_INFORMATION , *PSYSTEM_THREAD_INFORMATION;
typedef
struct
_SYSTEM_PROCESS_INFRMATION
{
ULONG
NextEntryDelta;
ULONG
ThreadCount;
ULONG
Reserved1[6];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
ULONG
ProcessId;
ULONG
InheritedFromProcessId;
ULONG
HandleCount;
ULONG
Reserved2[2];
VM_COUNTERS VmCounters;
IO_COUNTERS IoCounters;
SYSTEM_THREAD_INFORMATION Threads[1];
}SYSTEM_PROCESS_INFORMATION , *PSYSTEM_PROCESS_INFORMATION;
typedef
DWORD
(WINAPI* PQUERYSYSTEM)(
UINT
,
PVOID
,
DWORD
, PDWORD);
int
IsThreadSuspend(
DWORD
dwProcessID,
DWORD
dwThreadID)
{
int
ret = 0;
NTSTATUS Status = 0;
PQUERYSYSTEM NtQuerySystemInformation = NULL;
PSYSTEM_PROCESS_INFORMATION pInfo = { 0 };
NtQuerySystemInformation=(PQUERYSYSTEM)GetProcAddress(LoadLibrary(L
"ntdll.dll"
),
"NtQuerySystemInformation"
);
DWORD
dwSize = 0;
Status = NtQuerySystemInformation(5,NULL, 0, &dwSize);
char
* pBuff =
new
char
[dwSize];
pInfo =(PSYSTEM_PROCESS_INFORMATION) pBuff;
if
(pInfo == NULL)
return
-1;
Status = NtQuerySystemInformation(5, pInfo, dwSize, &dwSize);
if
(!NT_SUCCESS(Status))
{
printf
(
"失败"
);
delete
[] pInfo;
return
-1;
}
while
(1)
{
if
(pInfo->NextEntryDelta == 0)
break
;
if
(pInfo->ProcessId == dwProcessID)
{
for
(
DWORD
i = 0; i < pInfo->ThreadCount; i++)
{
if
(pInfo->Threads[i].ClientId.UniqueThread == dwThreadID)
{
printf
(
"线程状态为%ld\n"
, pInfo->Threads[i].State);
if
(pInfo->Threads[i].State == StateRunning)
{
ret = 1;
break
;
}
if
(pInfo->Threads[i].State == StateWait)
{
if
(pInfo->Threads[i].WaitReason == Suspended)
printf
(
"等待原因:Suspended!\n"
);
ret = 2;
break
;
}
}
}
break
;
}
pInfo = (PSYSTEM_PROCESS_INFORMATION)((
PUCHAR
)pInfo + pInfo->NextEntryDelta);
}
delete
[] pBuff;
return
ret;
}
BOOL
IsThreadAlive(
DWORD
dwThreadID)
{
BOOL
ret = FALSE;
DWORD
ExitCode = 0;
HANDLE
hThread = OpenThread(THREAD_QUERY_INFORMATION, FALSE, dwThreadID);
if
(hThread != NULL) {
if
(GetExitCodeThread(hThread, &ExitCode)) {
if
(ExitCode == STILL_ACTIVE)
ret= TRUE;
}
CloseHandle(hThread);
}
return
ret;
}
#define PID 11372 //进程ID
#define TID 32 //线程ID
int
main()
{
if
(IsThreadAlive(TID))
printf
(
"线程存活\n"
);
else
printf
(
"线程已结束\n"
);
int
ret = IsThreadSuspend(PID,TID);
switch
(ret)
{
case
1:
printf
(
"线程运行状态"
);
break
;
case
2:
printf
(
"线程等待状态"
);
break
;
default
:
printf
(
"线程不是运行或等待状态"
);
break
;
}
}