[原创]进程多开检测-2016腾讯游戏安全大赛-PC-第二轮-第一题-逆向工程-看雪安全社区

**自己顺便写的,不喜欢勿喷
没有写全,写出常用的方法就行了**

目标:能拿到pidlist就拿pidlist,不能拿到就获取当前进程实例数量

``` 
#pragma once
#include <ntstatus.h>
#include <stdio.h>
#include <windows.h>
#include <vector>
#include <set>
#include <iostream>
#include <string>

#include <Psapi.h>
#include <tlhelp32.h>

#include <Windows.h>
#include <vector>
#include <string>
#include <sstream>  // 添加此头文件以支持字符串流
#include <algorithm>

#pragma comment(lib, "Psapi.lib")

#define CURRENT_PROCESS_NAME L"TCTF.exe"
#define MAX_INSTANCES 100

typedef enum _KWAIT_REASON {
	Executive,
	FreePage,
	PageIn,
	PoolAllocation,
	DelayExecution,
	Suspended1,
	UserRequest,
	WrExecutive,
	WrFreePage,
	WrPageIn,
	WrPoolAllocation,
	WrDelayExecution,
	WrSuspended,
	WrUserRequest,
	WrSpare0,
	WrQueue,
	WrLpcReceive,
	WrLpcReply,
	WrVirtualMemory,
	WrPageOut,
	WrRendezvous,
	WrKeyedEvent,
	WrTerminated,
	WrProcessInSwap,
	WrCpuRateControl,
	WrCalloutStack,
	WrKernel,
	WrResource,
	WrPushLock,
	WrMutex,
	WrQuantumEnd,
	WrDispatchInt,
	WrPreempted,
	WrYieldExecution,
	WrFastMutex,
	WrGuardedMutex,
	WrRundown,
	WrAlertByThreadId,
	WrDeferredPreempt,
	WrPhysicalFault,
	MaximumWaitReason
} KWAIT_REASON;

typedef struct _CLIENT_ID {
	HANDLE UniqueProcess;
	HANDLE UniqueThread;
} CLIENT_ID, * PCLIENT_ID;

typedef struct _LSA_UNICODE_STRING {
	USHORT Length;
	USHORT MaximumLength;
	PWSTR  Buffer;
} LSA_UNICODE_STRING, * PLSA_UNICODE_STRING, UNICODE_STRING, * PUNICODE_STRING;

typedef LONG KPRIORITY;

typedef struct _SYSTEM_THREAD_INFORMATION
{
	LARGE_INTEGER KernelTime;
	LARGE_INTEGER UserTime;
	LARGE_INTEGER CreateTime;
	ULONG WaitTime;
	PVOID StartAddress;
	CLIENT_ID ClientId;			//拥有者的进程和线程ID
	KPRIORITY Priority;
	LONG BasePriority;
	ULONG ContextSwitches;
	ULONG ThreadState;
	KWAIT_REASON WaitReason;
}SYSTEM_THREAD_INFORMATION, * PSYSTEM_THREAD_INFORMATION;

typedef struct _SYSTEM_PROCESS_INFORMATION
{
	ULONG						NextEntryOffset;		//下个进程数据偏移
	ULONG						NumberOfThreads;		//线程数量
	LARGE_INTEGER				Reserved[3];
	LARGE_INTEGER				CreateTime;
	LARGE_INTEGER				UserTime;
	LARGE_INTEGER				KernelTime;
	UNICODE_STRING				ImageName;
	KPRIORITY					BasePriority;
	HANDLE						UniqueProcessId;		//当前进程PID
	HANDLE						InheritedFromProcessId;	//父进程PID
	ULONG						HandleCount;			//句柄数量
	BYTE						Reserved4[4];
	PVOID						Reserved5[11];
	SIZE_T						PeakPagefileUsage;
	SIZE_T						PrivatePageCount;
	LARGE_INTEGER				Reserved6[6];
	SYSTEM_THREAD_INFORMATION	Threads[0];				//线程信息数组
}SYSTEM_PROCESS_INFORMATION, * PSYSTEM_PROCESS_INFORMATION;

typedef enum _SYSTEM_INFORMATION_CLASS {
	SystemBasicInformation, // q: SYSTEM_BASIC_INFORMATION
	SystemProcessorInformation, // q: SYSTEM_PROCESSOR_INFORMATION
	SystemPerformanceInformation, // q: SYSTEM_PERFORMANCE_INFORMATION
	SystemTimeOfDayInformation, // q: SYSTEM_TIMEOFDAY_INFORMATION
	SystemPathInformation, // not implemented
	SystemProcessInformation, // q: SYSTEM_PROCESS_INFORMATION
	SystemCallCountInformation, // q: SYSTEM_CALL_COUNT_INFORMATION
	SystemDeviceInformation, // q: SYSTEM_DEVICE_INFORMATION
	SystemProcessorPerformanceInformation, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION
	SystemFlagsInformation, // q: SYSTEM_FLAGS_INFORMATION
	SystemCallTimeInformation, // not implemented // SYSTEM_CALL_TIME_INFORMATION // 10
	SystemModuleInformation, // q: RTL_PROCESS_MODULES
	SystemLocksInformation, // q: RTL_PROCESS_LOCKS
	SystemStackTraceInformation, // q: RTL_PROCESS_BACKTRACES
	SystemPagedPoolInformation, // not implemented
	SystemNonPagedPoolInformation, // not implemented
	SystemHandleInformation, // q: SYSTEM_HANDLE_INFORMATION
	SystemObjectInformation, // q: SYSTEM_OBJECTTYPE_INFORMATION mixed with SYSTEM_OBJECT_INFORMATION
	SystemPageFileInformation, // q: SYSTEM_PAGEFILE_INFORMATION
	SystemVdmInstemulInformation, // q
	SystemVdmBopInformation, // not implemented // 20
	SystemFileCacheInformation, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemCache)
	SystemPoolTagInformation, // q: SYSTEM_POOLTAG_INFORMATION
	SystemInterruptInformation, // q: SYSTEM_INTERRUPT_INFORMATION
	SystemDpcBehaviorInformation, // q: SYSTEM_DPC_BEHAVIOR_INFORMATION; s: SYSTEM_DPC_BEHAVIOR_INFORMATION (requires SeLoadDriverPrivilege)
	SystemFullMemoryInformation, // not implemented
	SystemLoadGdiDriverInformation, // s (kernel-mode only)
	SystemUnloadGdiDriverInformation, // s (kernel-mode only)
	SystemTimeAdjustmentInformation, // q: SYSTEM_QUERY_TIME_ADJUST_INFORMATION; s: SYSTEM_SET_TIME_ADJUST_INFORMATION (requires SeSystemtimePrivilege)
	SystemSummaryMemoryInformation, // not implemented
	SystemMirrorMemoryInformation, // s (requires license value "Kernel-MemoryMirroringSupported") (requires SeShutdownPrivilege) // 30
	SystemPerformanceTraceInformation, // q; s: (type depends on EVENT_TRACE_INFORMATION_CLASS)
	SystemObsolete0, // not implemented
	SystemExceptionInformation, // q: SYSTEM_EXCEPTION_INFORMATION
	SystemCrashDumpStateInformation, // s (requires SeDebugPrivilege)
	SystemKernelDebuggerInformation, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION
	SystemContextSwitchInformation, // q: SYSTEM_CONTEXT_SWITCH_INFORMATION
	SystemRegistryQuotaInformation, // q: SYSTEM_REGISTRY_QUOTA_INFORMATION; s (requires SeIncreaseQuotaPrivilege)
	SystemExtendServiceTableInformation, // s (requires SeLoadDriverPrivilege) // loads win32k only
	SystemPrioritySeperation, // s (requires SeTcbPrivilege)
	SystemVerifierAddDriverInformation, // s (requires SeDebugPrivilege) // 40
	SystemVerifierRemoveDriverInformation, // s (requires SeDebugPrivilege)
	SystemProcessorIdleInformation, // q: SYSTEM_PROCESSOR_IDLE_INFORMATION
	SystemLegacyDriverInformation, // q: SYSTEM_LEGACY_DRIVER_INFORMATION
	SystemCurrentTimeZoneInformation, // q; s: RTL_TIME_ZONE_INFORMATION
	SystemLookasideInformation, // q: SYSTEM_LOOKASIDE_INFORMATION
	SystemTimeSlipNotification, // s (requires SeSystemtimePrivilege)
	SystemSessionCreate, // not implemented
	SystemSessionDetach, // not implemented
	SystemSessionInformation, // not implemented (SYSTEM_SESSION_INFORMATION)
	SystemRangeStartInformation, // q: SYSTEM_RANGE_START_INFORMATION // 50
	SystemVerifierInformation, // q: SYSTEM_VERIFIER_INFORMATION; s (requires SeDebugPrivilege)
	SystemVerifierThunkExtend, // s (kernel-mode only)
	SystemSessionProcessInformation, // q: SYSTEM_SESSION_PROCESS_INFORMATION
	SystemLoadGdiDriverInSystemSpace, // s (kernel-mode only) (same as SystemLoadGdiDriverInformation)
	SystemNumaProcessorMap, // q
	SystemPrefetcherInformation, // q: PREFETCHER_INFORMATION; s: PREFETCHER_INFORMATION // PfSnQueryPrefetcherInformation
	SystemExtendedProcessInformation, // q: SYSTEM_PROCESS_INFORMATION
	SystemRecommendedSharedDataAlignment, // q
	SystemComPlusPackage, // q; s
	SystemNumaAvailableMemory, // 60
	SystemProcessorPowerInformation, // q: SYSTEM_PROCESSOR_POWER_INFORMATION
	SystemEmulationBasicInformation,
	SystemEmulationProcessorInformation,
	SystemExtendedHandleInformation, // q: SYSTEM_HANDLE_INFORMATION_EX
	SystemLostDelayedWriteInformation, // q: ULONG
	SystemBigPoolInformation, // q: SYSTEM_BIGPOOL_INFORMATION
	SystemSessionPoolTagInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION
	SystemSessionMappedViewInformation, // q: SYSTEM_SESSION_MAPPED_VIEW_INFORMATION
	SystemHotpatchInformation, // q; s: SYSTEM_HOTPATCH_CODE_INFORMATION
	SystemObjectSecurityMode, // q: ULONG // 70
	SystemWatchdogTimerHandler, // s (kernel-mode only)
	SystemWatchdogTimerInformation, // q (kernel-mode only); s (kernel-mode only)
	SystemLogicalProcessorInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION
	SystemWow64SharedInformationObsolete, // not implemented
	SystemRegisterFirmwareTableInformationHandler, // s (kernel-mode only)
	SystemFirmwareTableInformation, // SYSTEM_FIRMWARE_TABLE_INFORMATION
	SystemModuleInformationEx, // q: RTL_PROCESS_MODULE_INFORMATION_EX
	SystemVerifierTriageInformation, // not implemented
	SystemSuperfetchInformation, // q; s: SUPERFETCH_INFORMATION // PfQuerySuperfetchInformation
	SystemMemoryListInformation, // q: SYSTEM_MEMORY_LIST_INFORMATION; s: SYSTEM_MEMORY_LIST_COMMAND (requires SeProfileSingleProcessPrivilege) // 80
	SystemFileCacheInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (same as SystemFileCacheInformation)
	SystemThreadPriorityClientIdInformation, // s: SYSTEM_THREAD_CID_PRIORITY_INFORMATION (requires SeIncreaseBasePriorityPrivilege)
	SystemProcessorIdleCycleTimeInformation, // q: SYSTEM_PROCESSOR_IDLE_CYCLE_TIME_INFORMATION[]
	SystemVerifierCancellationInformation, // not implemented // name:wow64:whNT32QuerySystemVerifierCancellationInformation
	SystemProcessorPowerInformationEx, // not implemented
	SystemRefTraceInformation, // q; s: SYSTEM_REF_TRACE_INFORMATION // ObQueryRefTraceInformation
	SystemSpecialPoolInformation, // q; s (requires SeDebugPrivilege) // MmSpecialPoolTag, then MmSpecialPoolCatchOverruns != 0
	SystemProcessIdInformation, // q: SYSTEM_PROCESS_ID_INFORMATION
	SystemErrorPortInformation, // s (requires SeTcbPrivilege)
	SystemBootEnvironmentInformation, // q: SYSTEM_BOOT_ENVIRONMENT_INFORMATION // 90
	SystemHypervisorInformation, // q; s (kernel-mode only)
	SystemVerifierInformationEx, // q; s: SYSTEM_VERIFIER_INFORMATION_EX
	SystemTimeZoneInformation, // s (requires SeTimeZonePrivilege)
	SystemImageFileExecutionOptionsInformation, // s: SYSTEM_IMAGE_FILE_EXECUTION_OPTIONS_INFORMATION (requires SeTcbPrivilege)
	SystemCoverageInformation, // q; s // name:wow64:whNT32QuerySystemCoverageInformation; ExpCovQueryInformation
	SystemPrefetchPatchInformation, // not implemented
	SystemVerifierFaultsInformation, // s (requires SeDebugPrivilege)
	SystemSystemPartitionInformation, // q: SYSTEM_SYSTEM_PARTITION_INFORMATION
	SystemSystemDiskInformation, // q: SYSTEM_SYSTEM_DISK_INFORMATION
	SystemProcessorPerformanceDistribution, // q: SYSTEM_PROCESSOR_PERFORMANCE_DISTRIBUTION // 100
	SystemNumaProximityNodeInformation,
	SystemDynamicTimeZoneInformation, // q; s (requires SeTimeZonePrivilege)
	SystemCodeIntegrityInformation, // q: SYSTEM_CODEINTEGRITY_INFORMATION // SeCodeIntegrityQueryInformation
	SystemProcessorMicrocodeUpdateInformation, // s
	SystemProcessorBrandString, // q // HaliQuerySystemInformation -> HalpGetProcessorBrandString, info class 23
	SystemVirtualAddressInformation, // q: SYSTEM_VA_LIST_INFORMATION[]; s: SYSTEM_VA_LIST_INFORMATION[] (requires SeIncreaseQuotaPrivilege) // MmQuerySystemVaInformation
	SystemLogicalProcessorAndGroupInformation, // q: SYSTEM_LOGICAL_PROCESSOR_INFORMATION_EX // since WIN7 // KeQueryLogicalProcessorRelationship
	SystemProcessorCycleTimeInformation, // q: SYSTEM_PROCESSOR_CYCLE_TIME_INFORMATION[]
	SystemStoreInformation, // q; s: SYSTEM_STORE_INFORMATION // SmQueryStoreInformation
	SystemRegistryAppendString, // s: SYSTEM_REGISTRY_APPEND_STRING_PARAMETERS // 110
	SystemAitSamplingValue, // s: ULONG (requires SeProfileSingleProcessPrivilege)
	SystemVhdBootInformation, // q: SYSTEM_VHD_BOOT_INFORMATION
	SystemCpuQuotaInformation, // q; s // PsQueryCpuQuotaInformation
	SystemNativeBasicInformation, // not implemented
	SystemSpare1, // not implemented
	SystemLowPriorityIoInformation, // q: SYSTEM_LOW_PRIORITY_IO_INFORMATION
	SystemTpmBootEntropyInformation, // q: TPM_BOOT_ENTROPY_NT_RESULT // ExQueryTpmBootEntropyInformation
	SystemVerifierCountersInformation, // q: SYSTEM_VERIFIER_COUNTERS_INFORMATION
	SystemPagedPoolInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypePagedPool)
	SystemSystemPtesInformationEx, // q: SYSTEM_FILECACHE_INFORMATION; s (requires SeIncreaseQuotaPrivilege) (info for WorkingSetTypeSystemPtes) // 120
	SystemNodeDistanceInformation,
	SystemAcpiAuditInformation, // q: SYSTEM_ACPI_AUDIT_INFORMATION // HaliQuerySystemInformation -> HalpAuditQueryResults, info class 26
	SystemBasicPerformanceInformation, // q: SYSTEM_BASIC_PERFORMANCE_INFORMATION // name:wow64:whNtQuerySystemInformation_SystemBasicPerformanceInformation
	SystemQueryPerformanceCounterInformation, // q: SYSTEM_QUERY_PERFORMANCE_COUNTER_INFORMATION // since WIN7 SP1
	SystemSessionBigPoolInformation, // q: SYSTEM_SESSION_POOLTAG_INFORMATION // since WIN8
	SystemBootGraphicsInformation, // q; s: SYSTEM_BOOT_GRAPHICS_INFORMATION (kernel-mode only)
	SystemScrubPhysicalMemoryInformation, // q; s: MEMORY_SCRUB_INFORMATION
	SystemBadPageInformation,
	SystemProcessorProfileControlArea, // q; s: SYSTEM_PROCESSOR_PROFILE_CONTROL_AREA
	SystemCombinePhysicalMemoryInformation, // s: MEMORY_COMBINE_INFORMATION, MEMORY_COMBINE_INFORMATION_EX, MEMORY_COMBINE_INFORMATION_EX2 // 130
	SystemEntropyInterruptTimingCallback,
	SystemConsoleInformation, // q: SYSTEM_CONSOLE_INFORMATION
	SystemPlatformBinaryInformation, // q: SYSTEM_PLATFORM_BINARY_INFORMATION
	SystemThrottleNotificationInformation,
	SystemHypervisorProcessorCountInformation, // q: SYSTEM_HYPERVISOR_PROCESSOR_COUNT_INFORMATION
	SystemDeviceDataInformation, // q: SYSTEM_DEVICE_DATA_INFORMATION
	SystemDeviceDataEnumerationInformation,
	SystemMemoryTopologyInformation, // q: SYSTEM_MEMORY_TOPOLOGY_INFORMATION
	SystemMemoryChannelInformation, // q: SYSTEM_MEMORY_CHANNEL_INFORMATION
	SystemBootLogoInformation, // q: SYSTEM_BOOT_LOGO_INFORMATION // 140
	SystemProcessorPerformanceInformationEx, // q: SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION_EX // since WINBLUE
	SystemSpare0,
	SystemSecureBootPolicyInformation, // q: SYSTEM_SECUREBOOT_POLICY_INFORMATION
	SystemPageFileInformationEx, // q: SYSTEM_PAGEFILE_INFORMATION_EX
	SystemSecureBootInformation, // q: SYSTEM_SECUREBOOT_INFORMATION
	SystemEntropyInterruptTimingRawInformation,
	SystemPortableWorkspaceEfiLauncherInformation, // q: SYSTEM_PORTABLE_WORKSPACE_EFI_LAUNCHER_INFORMATION
	SystemFullProcessInformation, // q: SYSTEM_PROCESS_INFORMATION with SYSTEM_PROCESS_INFORMATION_EXTENSION (requires admin)
	SystemKernelDebuggerInformationEx, // q: SYSTEM_KERNEL_DEBUGGER_INFORMATION_EX
	SystemBootMetadataInformation, // 150
	SystemSoftRebootInformation, // q: ULONG
	SystemElamCertificateInformation, // s: SYSTEM_ELAM_CERTIFICATE_INFORMATION
	SystemOfflineDumpConfigInformation,
	SystemProcessorFeaturesInformation, // q: SYSTEM_PROCESSOR_FEATURES_INFORMATION
	SystemRegistryReconciliationInformation,
	SystemEdidInformation,
	SystemManufacturingInformation, // q: SYSTEM_MANUFACTURING_INFORMATION // since THRESHOLD
	SystemEnergyEstimationConfigInformation, // q: SYSTEM_ENERGY_ESTIMATION_CONFIG_INFORMATION
	SystemHypervisorDetailInformation, // q: SYSTEM_HYPERVISOR_DETAIL_INFORMATION
	SystemProcessorCycleStatsInformation, // q: SYSTEM_PROCESSOR_CYCLE_STATS_INFORMATION // 160
	SystemVmGenerationCountInformation,
	SystemTrustedPlatformModuleInformation, // q: SYSTEM_TPM_INFORMATION
	SystemKernelDebuggerFlags, // SYSTEM_KERNEL_DEBUGGER_FLAGS
	SystemCodeIntegrityPolicyInformation, // q: SYSTEM_CODEINTEGRITYPOLICY_INFORMATION
	SystemIsolatedUserModeInformation, // q: SYSTEM_ISOLATED_USER_MODE_INFORMATION
	SystemHardwareSecurityTestInterfaceResultsInformation,
	SystemSingleModuleInformation, // q: SYSTEM_SINGLE_MODULE_INFORMATION
	SystemAllowedCpuSetsInformation,
	SystemVsmProtectionInformation, // q: SYSTEM_VSM_PROTECTION_INFORMATION (previously SystemDmaProtectionInformation)
	SystemInterruptCpuSetsInformation, // q: SYSTEM_INTERRUPT_CPU_SET_INFORMATION // 170
	SystemSecureBootPolicyFullInformation, // q: SYSTEM_SECUREBOOT_POLICY_FULL_INFORMATION
	SystemCodeIntegrityPolicyFullInformation,
	SystemAffinitizedInterruptProcessorInformation,
	SystemRootSiloInformation, // q: SYSTEM_ROOT_SILO_INFORMATION
	SystemCpuSetInformation, // q: SYSTEM_CPU_SET_INFORMATION // since THRESHOLD2
	SystemCpuSetTagInformation, // q: SYSTEM_CPU_SET_TAG_INFORMATION
	SystemWin32WerStartCallout,
	SystemSecureKernelProfileInformation, // q: SYSTEM_SECURE_KERNEL_HYPERGUARD_PROFILE_INFORMATION
	SystemCodeIntegrityPlatformManifestInformation, // q: SYSTEM_SECUREBOOT_PLATFORM_MANIFEST_INFORMATION // since REDSTONE
	SystemInterruptSteeringInformation, // 180
	SystemSupportedProcessorArchitectures,
	SystemMemoryUsageInformation, // q: SYSTEM_MEMORY_USAGE_INFORMATION
	SystemCodeIntegrityCertificateInformation, // q: SYSTEM_CODEINTEGRITY_CERTIFICATE_INFORMATION
	SystemPhysicalMemoryInformation, // q: SYSTEM_PHYSICAL_MEMORY_INFORMATION // since REDSTONE2
	SystemControlFlowTransition,
	SystemKernelDebuggingAllowed, // s: ULONG
	SystemActivityModerationExeState, // SYSTEM_ACTIVITY_MODERATION_EXE_STATE
	SystemActivityModerationUserSettings, // SYSTEM_ACTIVITY_MODERATION_USER_SETTINGS
	SystemCodeIntegrityPoliciesFullInformation,
	SystemCodeIntegrityUnlockInformation, // SYSTEM_CODEINTEGRITY_UNLOCK_INFORMATION // 190
	SystemIntegrityQuotaInformation,
	SystemFlushInformation, // q: SYSTEM_FLUSH_INFORMATION
	SystemProcessorIdleMaskInformation, // q: ULONG_PTR // since REDSTONE3
	SystemSecureDumpEncryptionInformation,
	SystemWriteConstraintInformation, // SYSTEM_WRITE_CONSTRAINT_INFORMATION
	SystemKernelVaShadowInformation, // SYSTEM_KERNEL_VA_SHADOW_INFORMATION
	SystemHypervisorSharedPageInformation, // SYSTEM_HYPERVISOR_SHARED_PAGE_INFORMATION // since REDSTONE4
	SystemFirmwareBootPerformanceInformation,
	SystemCodeIntegrityVerificationInformation, // SYSTEM_CODEINTEGRITYVERIFICATION_INFORMATION
	SystemFirmwarePartitionInformation, // SYSTEM_FIRMWARE_PARTITION_INFORMATION // 200
	SystemSpeculationControlInformation, // SYSTEM_SPECULATION_CONTROL_INFORMATION // (CVE-2017-5715) REDSTONE3 and above.
	SystemDmaGuardPolicyInformation, // SYSTEM_DMA_GUARD_POLICY_INFORMATION
	SystemEnclaveLaunchControlInformation, // SYSTEM_ENCLAVE_LAUNCH_CONTROL_INFORMATION
	SystemWorkloadAllowedCpuSetsInformation, // SYSTEM_WORKLOAD_ALLOWED_CPU_SET_INFORMATION // since REDSTONE5
	SystemCodeIntegrityUnlockModeInformation,
	SystemLeapSecondInformation, // SYSTEM_LEAP_SECOND_INFORMATION
	SystemFlags2Information, // q: SYSTEM_FLAGS_INFORMATION
	SystemSecurityModelInformation, // SYSTEM_SECURITY_MODEL_INFORMATION // since 19H1
	SystemCodeIntegritySyntheticCacheInformation,
	MaxSystemInfoClass
} SYSTEM_INFORMATION_CLASS, * PSYSTEM_INFORMATION_CLASS;

using namespace std;

typedef NTSTATUS(WINAPI* pNtQuerySystemInformation)(
	DWORD32 SystemInformationClass,
	PVOID                    SystemInformation,
	ULONG                    SystemInformationLength,
	PULONG                   ReturnLength
	);

bool IsTargetProcess(DWORD pid, const wchar_t* targetProcessName) {
	// 验证输入参数有效性
	if (pid == 0 || targetProcessName == nullptr || targetProcessName[0] == L'\0') {
		return false;
	}

// 尝试以不同权限级别打开进程
	HANDLE hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid);
	if (hProcess == nullptr) {
		// 回退到更高权限尝试
		hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
		if (hProcess == nullptr) {
			return false;
		}
	}

wchar_t processPath[MAX_PATH] = L"";
	bool success = false;

// 优先使用更高效的API（Windows Vista+）
	if (GetProcessImageFileNameW(hProcess, processPath, MAX_PATH) != 0) {
		success = true;
	}
	// 回退到兼容XP的方法
	else if (K32GetModuleFileNameExW(hProcess, nullptr, processPath, MAX_PATH) != 0) {
		success = true;
	}

CloseHandle(hProcess);

if (!success) {
		return false;
	}

// 直接从路径中提取文件名（避免创建std::wstring）
	const wchar_t* fileName = wcsrchr(processPath, L'\\');
	fileName = fileName ? fileName + 1 : processPath;

// 获取目标进程名的长度
	const size_t targetLen = wcslen(targetProcessName);

// 比较文件名（不区分大小写）
	for (size_t i = 0; ; i++) {
		wchar_t c1 = towlower(fileName[i]);
		wchar_t c2 = towlower(targetProcessName[i]);

if (c1 != c2) {
			return false;
		}

// 到达目标字符串末尾时检查是否匹配
		if (c2 == L'\0') {
			return true;
		}

// 防止文件名比目标名短导致越界
		if (c1 == L'\0') {
			return false;
		}
	}
}

//1.进程遍历
vector<DWORD> GetProcessIdByProcessEnum(const wchar_t* cwstProcessName) {
	vector<DWORD> vPidList;
	DWORD dwProcessCount = FALSE;
	HMODULE hModuleNtdll = NULL;
	hModuleNtdll = LoadLibrary(L"ntdll.dll");
	DWORD32 SystemProcessInformation = 5;
	PVOID pSystemInformation = NULL;
	ULONG dwRetLen = 0;
	pNtQuerySystemInformation pfnNtQuerySystemInformation = NULL;
	NTSTATUS ntStatus = STATUS_UNSUCCESSFUL;
	DWORD nCurrPID = GetCurrentProcessId();
	WCHAR wstrCurrPath[MAX_PATH] = { 0 };
	do {
		if (NULL == hModuleNtdll) {
			break;
		}
		pfnNtQuerySystemInformation = (pNtQuerySystemInformation)GetProcAddress(hModuleNtdll, "NtQuerySystemInformation");
		if (NULL == pfnNtQuerySystemInformation) {
			break;
		}

ntStatus = pfnNtQuerySystemInformation(SystemProcessInformation, NULL, NULL, &dwRetLen);	//第一次获取需要分配的内存大小,**即使内存太小,也会写入一部分数据在内存中,可以用这个方法反ScyllaHide插件
		if (NULL == dwRetLen) {
			break;
		}
		pSystemInformation = malloc(dwRetLen);
		if (nullptr == pSystemInformation) {
			break;
		}
		memset(pSystemInformation, 0, dwRetLen);
		ntStatus = pfnNtQuerySystemInformation(SystemProcessInformation, pSystemInformation, dwRetLen, &dwRetLen);
		if (ntStatus != STATUS_SUCCESS) {
			break;
		}

if (!GetModuleFileNameW(NULL, wstrCurrPath, sizeof(wstrCurrPath)))break;
		PSYSTEM_PROCESS_INFORMATION pProcessInfo = (PSYSTEM_PROCESS_INFORMATION)pSystemInformation;
		while (TRUE) {
			// 检查进程名称是否匹配
			if (pProcessInfo->ImageName.Buffer != NULL && cwstProcessName != NULL) {
				// 比较进程名（不区分大小写）
				if (_wcsicmp(pProcessInfo->ImageName.Buffer, cwstProcessName) == 0) {
					vPidList.push_back((DWORD)pProcessInfo->UniqueProcessId);
					// 输出匹配进程的详细信息
					//printf("找到匹配进程: PID=%d, 名称=%ws\n", (DWORD)pProcessInfo->UniqueProcessId, pProcessInfo->ImageName.Buffer);
				}
			}
			// 移动到下一个进程条目
			if (pProcessInfo->NextEntryOffset == 0) {
				break;
			}
			pProcessInfo = (PSYSTEM_PROCESS_INFORMATION)((BYTE*)pProcessInfo + pProcessInfo->NextEntryOffset);
		}
	} while (false);

if (hModuleNtdll)FreeLibrary(hModuleNtdll);
	hModuleNtdll = NULL;
	if (pSystemInformation)free(pSystemInformation);
	pSystemInformation = NULL;
	return vPidList;
}

//2.窗口枚举回调函数
// 窗口查找参数结构体
// 定义匹配模式枚举
enum MatchMode {
	EXACT_MATCH,    // 精确匹配
	CONTAINS_MATCH, // 包含匹配
	IGNORE_MATCH    // 忽略此条件
};
struct WindowSearchParams {
	LPCWSTR className;      // 目标类名
	MatchMode classMatch;    // 类名匹配模式
	LPCWSTR windowTitle;     // 目标窗口标题
	MatchMode titleMatch;    // 标题匹配模式
	bool visibleOnly;        // 是否只检查可见窗口
	std::vector<DWORD> pidSet; // 存储结果的PID集合
};
BOOL CALLBACK EnumWindowsProc(HWND hwnd, LPARAM lParam) {
	WindowSearchParams* params = reinterpret_cast<WindowSearchParams*>(lParam);

// 检查窗口可见性
	if (params->visibleOnly && !IsWindowVisible(hwnd)) {
		return TRUE;
	}

// 检查窗口类名
	if (params->classMatch != IGNORE_MATCH) {
		wchar_t className[256] = { 0 };
		GetClassNameW(hwnd, className, ARRAYSIZE(className));

if (params->classMatch == EXACT_MATCH) {
			if (lstrcmpW(className, params->className) != 0) {
				return TRUE;
			}
		}
		else if (params->classMatch == CONTAINS_MATCH) {
			if (wcsstr(className, params->className) == NULL) {
				return TRUE;
			}
		}
	}

// 检查窗口标题
	if (params->titleMatch != IGNORE_MATCH) {
		wchar_t windowTitle[256] = { 0 };
		GetWindowTextW(hwnd, windowTitle, ARRAYSIZE(windowTitle));

if (params->titleMatch == EXACT_MATCH) {
			if (lstrcmpW(windowTitle, params->windowTitle) != 0) {
				return TRUE;
			}
		}
		else if (params->titleMatch == CONTAINS_MATCH) {
			if (wcsstr(windowTitle, params->windowTitle) == NULL) {
				return TRUE;
			}
		}
	}

// 获取进程ID
	DWORD pid = 0;
	GetWindowThreadProcessId(hwnd, &pid);

// 添加到PID集合
	if (pid != 0) {
		params->pidSet.push_back(pid);
	}

return TRUE;
}

//3.互斥体检测
bool IsMutexExist(const wchar_t* mutexName) {
	HANDLE hMutex = CreateMutexW(NULL, TRUE, mutexName);
	if (ERROR_ALREADY_EXISTS == GetLastError()) {
		return true;
	}
	if (hMutex != NULL) {
		//CloseHandle(hMutex);
		return true;
	}
	return false;
}

DWORD GetProcessCountByMutexW() {

//Global\\TCTF_1  Global\\TCTF_2   CreateMutexW去打开或者创建  GetLastError() == ERROR_ALREADY_EXISTS
	std::vector<DWORD> existingInstances;
	static bool bCreated = false;
	static DWORD myInstanceId = 0;  // 新增：记录自己的实例ID
	static HANDLE hMyMutex = NULL;

for (DWORD i = 1; i <= MAX_INSTANCES; i++) {
		WCHAR mutexName[32];
		swprintf_s(mutexName, _countof(mutexName), L"Global\\TCTF_%lu", i);

if (!bCreated) {
			HANDLE hMutex = CreateMutexW(NULL, FALSE, mutexName);
			if (hMutex) {
				if (GetLastError() == ERROR_ALREADY_EXISTS) {
					// 其他进程创建的互斥体
					existingInstances.push_back(i);
					CloseHandle(hMutex);
				}
				else {
					// 自己成功创建的互斥体
					bCreated = true;
					myInstanceId = i;  // 记录自己的ID
					hMyMutex = hMutex;
					// 将自己也计入总数
					existingInstances.push_back(i);
				}
			}
			else {
				// 创建失败，但可能因为权限等原因互斥体存在
				HANDLE hTest = OpenMutexW(SYNCHRONIZE, FALSE, mutexName);
				if (hTest) {
					existingInstances.push_back(i);
					CloseHandle(hTest);
				}
			}
		}
		else {
			// 已经创建了自己的互斥体，检测其他实例
			HANDLE hMutex = OpenMutexW(SYNCHRONIZE, FALSE, mutexName);
			if (hMutex) {
				existingInstances.push_back(i);
				CloseHandle(hMutex);
			}
		}
	}

return existingInstances.size();
}

//4.文件写入检测
std::vector<DWORD> GetProcessIdByFileW() {
	// 获取当前进程信息
	const DWORD currentPid = GetCurrentProcessId();
	wchar_t exePath[MAX_PATH] = { 0 };
	GetModuleFileNameW(nullptr, exePath, MAX_PATH);

// 从完整路径中提取程序目录
	std::wstring programDir = exePath;
	size_t lastBackslash = programDir.find_last_of(L"\\/");
	if (lastBackslash != std::wstring::npos) {
		programDir = programDir.substr(0, lastBackslash);
	}
	else {
		programDir = L".";
	}

// 创建PID文件路径
	std::wstring pidFilePath = programDir + L"\\TCTF_PIDS.lock";

// 打开或创建PID文件（带独占锁）
	HANDLE hFile = CreateFileW(
		pidFilePath.c_str(),
		GENERIC_READ | GENERIC_WRITE,
		0,  // 独占访问
		nullptr,
		OPEN_ALWAYS,  // 总是打开或创建
		FILE_ATTRIBUTE_NORMAL,
		nullptr
	);

if (hFile == INVALID_HANDLE_VALUE) {
		return {};
	}

// 获取文件锁（确保独占访问）
	OVERLAPPED overlapped = { 0 };
	LockFileEx(hFile, LOCKFILE_EXCLUSIVE_LOCK, 0, MAXDWORD, MAXDWORD, &overlapped);

// 读取文件内容
	DWORD fileSize = GetFileSize(hFile, nullptr);
	std::string fileContent;

if (fileSize > 0) {
		fileContent.resize(fileSize);
		DWORD bytesRead = 0;
		SetFilePointer(hFile, 0, nullptr, FILE_BEGIN);
		ReadFile(hFile, &fileContent[0], fileSize, &bytesRead, nullptr);
	}

// 解析PID列表
	std::vector<DWORD> pidList;
	std::istringstream stream(fileContent);
	DWORD pid;
	while (stream >> pid) {
		pidList.push_back(pid);
	}

// 添加当前进程PID（如果不存在）
	if (std::find(pidList.begin(), pidList.end(), currentPid) == pidList.end()) {
		pidList.push_back(currentPid);
	}

// 过滤有效PID
	std::vector<DWORD> validPids;
	for (DWORD pid : pidList) {
		if (IsTargetProcess(pid, L"TCTF.exe")) {
			validPids.push_back(pid);
		}
	}

// 更新PID文件内容
	std::ostringstream newContent;
	for (DWORD pid : validPids) {
		newContent << pid << "\n";
	}
	std::string newContentStr = newContent.str();

// 写入更新后的内容
	SetFilePointer(hFile, 0, nullptr, FILE_BEGIN);
	SetEndOfFile(hFile);  // 清空文件
	DWORD bytesWritten = 0;
	WriteFile(hFile, newContentStr.c_str(), static_cast<DWORD>(newContentStr.size()), &bytesWritten, nullptr);

// 解锁并关闭文件
	UnlockFileEx(hFile, 0, MAXDWORD, MAXDWORD, &overlapped);
	CloseHandle(hFile);

return validPids;
}

//5.注册表检测
DWORD GetProcessCountByRegeditW()
{
	static DWORD cachedInstance = 0;
	static std::vector<DWORD> runningInstances;

// 如果已经缓存且不为0，直接返回
	if (cachedInstance > 0 && !runningInstances.empty()) {
		return runningInstances.size();
	}

// 获取当前进程名
	wchar_t processName[MAX_PATH];
	GetModuleFileNameW(NULL, processName, MAX_PATH);
	wchar_t* baseName = wcsrchr(processName, L'\\');
	baseName = baseName ? baseName + 1 : processName;

// 构建注册表路径
	wchar_t regPath[MAX_PATH];
	swprintf_s(regPath, MAX_PATH, L"Software\\%s_Instances", baseName);

HKEY hKey;
	LONG result = RegCreateKeyExW(HKEY_CURRENT_USER, regPath, 0, NULL,
		0, KEY_READ | KEY_WRITE, NULL, &hKey, NULL);

if (result != ERROR_SUCCESS) {
		return 0;
	}

DWORD currentPid = GetCurrentProcessId();
	bool currentProcessRegistered = false;
	runningInstances.clear();

// 第一遍：收集所有有效的PID并清理无效项
	for (DWORD i = 1; i <= MAX_INSTANCES; i++) {
		wchar_t valueName[32];
		swprintf_s(valueName, _countof(valueName), L"%lu", i);

DWORD storedPid = 0;
		DWORD size = sizeof(DWORD);
		DWORD type = 0;

result = RegGetValueW(hKey, NULL, valueName, RRF_RT_REG_DWORD, &type, &storedPid, &size);

if (result == ERROR_SUCCESS && type == REG_DWORD) {
			// 检查进程是否存在且是目标进程
			if (IsTargetProcess(storedPid, baseName)) {
				// 添加到运行实例列表
				runningInstances.push_back(i);

// 检查是否是当前进程
				if (storedPid == currentPid) {
					cachedInstance = i;
					currentProcessRegistered = true;
				}
			}
			else {
				// 进程不存在或不是目标进程，删除无效注册表项
				RegDeleteValueW(hKey, valueName);
			}
		}
	}

// 如果当前进程尚未注册，找到空闲位置注册
	if (!currentProcessRegistered) {
		for (DWORD i = 1; i <= MAX_INSTANCES; i++) {
			// 检查这个位置是否已经被我们检测为运行中
			bool positionOccupied = std::find(runningInstances.begin(), runningInstances.end(), i) != runningInstances.end();

if (!positionOccupied) {
				wchar_t valueName[32];
				swprintf_s(valueName, _countof(valueName), L"%lu", i);

DWORD storedPid = 0;
				DWORD size = sizeof(DWORD);

// 再次确认这个位置确实是空闲的
				if (RegGetValueW(hKey, NULL, valueName, RRF_RT_REG_DWORD, NULL, &storedPid, &size) != ERROR_SUCCESS) {
					// 注册当前PID
					if (RegSetValueExW(hKey, valueName, 0, REG_DWORD,
						reinterpret_cast<const BYTE*>(&currentPid), sizeof(DWORD)) == ERROR_SUCCESS) {
						cachedInstance = i;
						runningInstances.push_back(i);  // 将当前进程加入运行实例列表
						currentProcessRegistered = true;
						break;
					}
				}
			}
		}
	}

RegCloseKey(hKey);

// 如果没有成功注册当前进程，返回0
	if (!currentProcessRegistered) {
		runningInstances.clear();
		return 0;
	}

return runningInstances.size();
}

//5.共享内存检测
// 共享内存结构体
struct SharedMemoryData {
	volatile LONG lock;           // 原子锁
	DWORD processIds[MAX_INSTANCES];  // 存储进程PID
};

vector<DWORD> GetProcessIdBySharedMemory() {
	static SharedMemoryData* pSharedData = nullptr;
	static HANDLE hMapFile = nullptr;
	static DWORD cachedInstance = 0;
	static std::vector<DWORD> runningInstances;

// 如果已经缓存且不为0，直接返回
	if (cachedInstance > 0 && !runningInstances.empty()) {
		return runningInstances;
	}

// 获取当前进程的可执行文件名
	wchar_t exePath[MAX_PATH];
	GetModuleFileNameW(NULL, exePath, MAX_PATH);
	wchar_t* exeName = wcsrchr(exePath, L'\\');
	exeName = exeName ? exeName + 1 : exePath;

// 如果共享内存未初始化，进行初始化
	if (!pSharedData) {
		// 创建基于可执行文件名的共享内存名称
		wchar_t sharedMemName[MAX_PATH];
		swprintf_s(sharedMemName, L"Global\\%s_SharedInstances", exeName);

// 创建/打开共享内存
		hMapFile = CreateFileMappingW(
			INVALID_HANDLE_VALUE,
			NULL,
			PAGE_READWRITE | SEC_COMMIT,
			0,
			sizeof(SharedMemoryData),
			sharedMemName
		);

if (hMapFile == NULL) {
			return runningInstances;
		}

// 映射共享内存
		pSharedData = (SharedMemoryData*)MapViewOfFile(
			hMapFile,
			FILE_MAP_ALL_ACCESS,
			0,
			0,
			sizeof(SharedMemoryData)
		);

if (pSharedData == NULL) {
			CloseHandle(hMapFile);
			hMapFile = nullptr;
			return runningInstances;
		}

// 如果是新创建的共享内存，初始化
		if (GetLastError() != ERROR_ALREADY_EXISTS) {
			ZeroMemory(pSharedData, sizeof(SharedMemoryData));
		}

// 注册进程退出时的清理函数
		static bool cleanupRegistered = false;
		if (!cleanupRegistered) {
			atexit([]() {
				if (pSharedData && cachedInstance > 0 && cachedInstance <= MAX_INSTANCES) {
					// 进入临界区
					while (::InterlockedExchange(&pSharedData->lock, 1) != 0) {
						_mm_pause();
					}

// 清除当前进程的条目
					pSharedData->processIds[cachedInstance - 1] = 0;

// 释放锁
					::InterlockedExchange(&pSharedData->lock, 0);
				}

if (pSharedData) {
					UnmapViewOfFile(pSharedData);
					pSharedData = nullptr;
				}

if (hMapFile) {
					CloseHandle(hMapFile);
					hMapFile = nullptr;
				}
				});
			cleanupRegistered = true;
		}
	}

DWORD currentPid = GetCurrentProcessId();
	bool currentProcessRegistered = false;
	runningInstances.clear();

// 进入临界区 - 自旋锁
	while (::InterlockedExchange(&pSharedData->lock, 1) != 0) {
		_mm_pause();
	}

// 第一遍：收集所有有效的PID并清理无效项
	for (DWORD i = 0; i < MAX_INSTANCES; i++) {
		DWORD pid = pSharedData->processIds[i];

if (pid == 0) {
			continue; // 空位置，跳过
		}

// 检查进程是否存在且是目标进程
		if (IsTargetProcess(pid, exeName)) {
			// 添加到运行实例列表
			runningInstances.push_back(i + 1);

// 检查是否是当前进程
			if (pid == currentPid) {
				cachedInstance = i + 1;
				currentProcessRegistered = true;
			}
		}
		else {
			// 进程不存在或不是目标进程，清除条目
			pSharedData->processIds[i] = 0;
		}
	}

// 如果当前进程尚未注册，找到空闲位置注册
	if (!currentProcessRegistered) {
		for (DWORD i = 0; i < MAX_INSTANCES; i++) {
			// 检查这个位置是否已经被我们检测为运行中
			bool positionOccupied = std::find(runningInstances.begin(), runningInstances.end(), i + 1) != runningInstances.end();

if (!positionOccupied) {
				// 再次确认这个位置确实是空闲的
				if (pSharedData->processIds[i] == 0) {
					// 注册当前PID
					pSharedData->processIds[i] = currentPid;
					cachedInstance = i + 1;
					runningInstances.push_back(i + 1);  // 将当前进程加入运行实例列表
					currentProcessRegistered = true;
					break;
				}
			}
		}
	}

// 释放锁
	::InterlockedExchange(&pSharedData->lock, 0);

// 如果没有成功注册当前进程，返回0
	if (!currentProcessRegistered) {
		runningInstances.clear();
		cachedInstance = 0;
		return runningInstances;
	}

return runningInstances;
}

vector<DWORD> GetProcessIdByEnumPIDS() {
	vector<DWORD> vPidList;
	for (size_t i = 0; i < MAXDWORD32; i+=4)
	{
		if (IsTargetProcess(i, CURRENT_PROCESS_NAME)) {
			vPidList.push_back((DWORD)i);
		}
	}
	return vPidList;
}

DWORD GetProcessCountBySemaphoreW() {
	// 创建或打开全局信号量
	HANDLE hSemaphore = CreateSemaphoreW(
		nullptr,            // 默认安全属性
		MAX_INSTANCES,      // 初始计数
		MAX_INSTANCES,      // 最大计数
		L"Global\\TCTF_Semaphore"      // 信号量名称
	);

if (hSemaphore == nullptr) {
		std::cerr << "CreateSemaphoreW 失败. 错误代码: " << GetLastError() << std::endl;
		return 0xFFFFFFFF;  // 返回错误值
	}

// 非阻塞方式获取信号量
	DWORD waitResult = WaitForSingleObject(hSemaphore, 0);

if (waitResult == WAIT_TIMEOUT) {
		std::cerr << "已达到最大实例数量 (" << MAX_INSTANCES << ")" << std::endl;
		CloseHandle(hSemaphore);
		return 0xFFFFFFFF;  // 返回错误值
	}
	else if (waitResult != WAIT_OBJECT_0) {
		std::cerr << "等待信号量失败. 错误代码: " << GetLastError() << std::endl;
		CloseHandle(hSemaphore);
		return 0xFFFFFFFF;  // 返回错误值
	}

// 获取当前信号量计数
	LONG previousCount = 0;
	if (!ReleaseSemaphore(hSemaphore, 1, &previousCount)) {
		std::cerr << "获取计数失败. 错误代码: " << GetLastError() << std::endl;
		CloseHandle(hSemaphore);
		return 0xFFFFFFFF;
	}

// 重新获取信号量（恢复之前的状态）
	WaitForSingleObject(hSemaphore, 0);

// 计算已占用实例数 = MAX_INSTANCES - (previousCount - 1)
	// 因为ReleaseSemaphore增加了计数，我们需要减1得到真实计数
	DWORD occupiedInstances = MAX_INSTANCES - previousCount;

// 注意：这里不关闭句柄，保持信号量处于获取状态
	return occupiedInstances;
}

DWORD GetProcessCountByEventW()
{
	static bool bInitialized = false;
	static DWORD myInstanceId = 0;
	static HANDLE hMyEvent = NULL;
	std::vector<DWORD> existingInstances;

for (DWORD i = 1; i <= MAX_INSTANCES; i++) {
		WCHAR eventName[32];
		swprintf_s(eventName, _countof(eventName), L"Global\\TCTF_Event_%lu", i);

if (!bInitialized) {
			// 尝试创建事件对象
			HANDLE hEvent = CreateEventW(
				NULL,               // 默认安全属性
				TRUE,               // 手动重置事件
				FALSE,              // 初始状态为无信号
				eventName           // 事件名称
			);

if (hEvent) {
				if (GetLastError() == ERROR_ALREADY_EXISTS) {
					// 事件已存在 - 表示另一个进程实例正在使用此ID
					existingInstances.push_back(i);
					CloseHandle(hEvent);
				}
				else {
					// 成功创建新事件 - 表示此ID被当前进程占用
					bInitialized = true;
					myInstanceId = i;
					hMyEvent = hEvent;
					existingInstances.push_back(i);

// 设置事件为有信号状态，表示此实例处于活动状态
					SetEvent(hMyEvent);
				}
			}
			else {
				// 创建失败，尝试打开现有事件
				HANDLE hTest = OpenEventW(EVENT_MODIFY_STATE | SYNCHRONIZE, FALSE, eventName);
				if (hTest) {
					existingInstances.push_back(i);
					CloseHandle(hTest);
				}
			}
		}
		else {
			// 已经初始化，只需检查其他实例
			HANDLE hEvent = OpenEventW(SYNCHRONIZE, FALSE, eventName);
			if (hEvent) {
				// 检查事件是否处于有信号状态（表示实例处于活动状态）
				DWORD waitResult = WaitForSingleObject(hEvent, 0);
				if (waitResult == WAIT_OBJECT_0 || waitResult == WAIT_ABANDONED) {
					existingInstances.push_back(i);
				}
				CloseHandle(hEvent);
			}
		}
	}

// 返回检测到的活动实例数量
	return existingInstances.size();
}

// 全局作业对象句柄
static HANDLE g_hJob = NULL;

bool CheckJobObject()
{
	// 尝试创建/打开作业对象（使用本地命名空间，不需要管理员权限）
	g_hJob = CreateJobObjectA(NULL, "Local\\MyUniqueJobObject");

if (g_hJob == NULL) {
		return false; // 创建失败
	}

// 检查作业对象是否已存在
	if (GetLastError() == ERROR_ALREADY_EXISTS) {
		CloseHandle(g_hJob);
		g_hJob = NULL;
		return false; // 不是第一个实例
	}

// 设置作业限制：仅允许1个活动进程
	JOBOBJECT_EXTENDED_LIMIT_INFORMATION jeli = { 0 };
	jeli.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_ACTIVE_PROCESS;
	jeli.BasicLimitInformation.ActiveProcessLimit = 1;

if (!SetInformationJobObject(
		g_hJob,
		JobObjectExtendedLimitInformation,
		&jeli,
		sizeof(jeli))) {
		CloseHandle(g_hJob);
		g_hJob = NULL;
		return false; // 设置限制失败
	}

// 将当前进程加入作业
	if (!AssignProcessToJobObject(g_hJob, GetCurrentProcess())) {
		CloseHandle(g_hJob);
		g_hJob = NULL;
		return false; // 加入作业失败
	}

return true; // 是第一个实例
}

```

## 调用案例
```
#include "selfDefine.h"

int main() {
	//能拿到pidlist就拿pidlist,不能拿到就获取当前进程实例数量

printf("当前进程ID:%d\n", GetCurrentProcessId());
	//进程遍历检测
	DWORD r1 = GetProcessIdByProcessEnum(CURRENT_PROCESS_NAME).size();
	printf("GetProcessIdByProcessEnum:%d\n", r1);

//窗口遍历
	WindowSearchParams params;
	params.className = L"ConsoleWindowClass";
	params.classMatch = EXACT_MATCH;
	params.windowTitle = L"TCTF";
	params.titleMatch = CONTAINS_MATCH;
	params.visibleOnly = true;
	EnumWindows(EnumWindowsProc, reinterpret_cast<LPARAM>(&params));	//FindWindow只能找到第一个窗口,EnumWindows能找到所有窗口
	DWORD r2 = params.pidSet.size();
	printf("EnumWindows:%d\n", r2);

////互斥体
	//DWORD r3 = (DWORD)IsMutexExist(L"Mutex_TCTF");
	//printf("IsMutexExist:%d 0表示第一个程序,1表示多个程序\n", r3);
	DWORD r4 = GetProcessCountByMutexW();
	printf("GetProcessCountByMutexW:%d\n", r4);

DWORD r5 = GetProcessIdByFileW().size();
	printf("GetProcessIdByFileW:%d\n", r5);

DWORD r6 = GetProcessCountByRegeditW();	
	printf("GetProcessCountByRegeditW:%d\n", r6);

DWORD r7 = GetProcessIdBySharedMemory().size();	
	printf("GetProcessIdBySharedMemory:%d\n", r7);

//DWORD r8 = GetProcessIdByEnumPIDS().size();     //进程pid是4的倍数,内核pid的含义决定的   
	//printf("GetProcessIdByEnumPIDS:%d\n", r8);

DWORD r9 = GetProcessCountBySemaphoreW();
	printf("只能显示历史GetProcessCountBySemaphoreW:%d\n", r9);	//除非注册

DWORD r10 = GetProcessCountByEventW();
	printf("GetProcessCountByEventW:%d\n", r10);	//除非注册

//CheckJobObject();

system("pause");
	return 0;
}
```

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。

最后于 2025-12-1 23:40 被CreateSun编辑，原因：