程序如何判斷另一個進程是否作爲服務運行？

Question

我有一個Win32程序，可以直接監視另一個Win32進程。

我想找到一種方法讓監視程序確定被監視的進程是否作爲Win32服務運行。

並非所有服務都以SYSTEM身份運行，並非所有服務都將services.exe作爲直接父級，所以我並不認爲這些顯而易見的技術足夠強大。

要清楚，就是我正在尋找的是自己寫函數的方式：

布爾isService（HANDLE aProcessHandle）{...}

Answer 1

爲此，您可以輕鬆地利用WMI。我意識到你沒有指定C＃，但WMI api在所有平臺上都可以非常相似的方式使用。

首先，我們需要狀如Win32_Service

public class Win32_Service 
{ 
    public Win32_Service(ManagementBaseObject obj) 
    { 

     AcceptPause = (bool)(obj["AcceptPause"] ?? false); 
     AcceptStop = (bool)(obj["AcceptStop"] ?? false); 
     Caption = (string)(obj["Caption"] ?? ""); 
     CheckPoint = (UInt32)(obj["CheckPoint"] ?? 0); 
     CreationClassName = (string)(obj["CreationClassName"] ?? ""); 
     Description = (string)(obj["Description"] ?? ""); 
     DesktopInteract = (bool)(obj["DesktopInteract"] ?? false); 
     DisplayName = (string)(obj["DisplayName"] ?? ""); 
     ErrorControl = (string)(obj["ErrorControl"] ?? ""); 
     ExitCode = (UInt32)(obj["ExitCode"] ?? 0); 
     InstallDate = (DateTime)(obj["InstallDate"] ?? DateTime.MinValue); 
     Name = (string)(obj["Name"] ?? ""); 
     PathName = (string)(obj["PathName"] ?? ""); 
     ProcessId = (UInt32)(obj["ProcessId"] ?? 0); 
     ServiceSpecificExitCode = (UInt32)(obj["ServiceSpecificExitCode"] ?? 0); 
     ServiceType = (string)(obj["ServiceType"] ?? ""); 
     Started = (bool)(obj["Started"] ?? false); 
     StartMode = (string)(obj["StartMode"] ?? ""); 
     StartName = (string)(obj["StartName"] ?? ""); 
     State = (string)(obj["State"] ?? ""); 
     Status = (string)(obj["Status"] ?? ""); 
     SystemCreationClassName = (string)(obj["SystemCreationClassName"] ?? ""); 
     SystemName = (string)(obj["SystemName"] ?? ""); 
     TagId = (UInt32)(obj["TagId"] ?? 0); 
     WaitHint = (UInt32)(obj["WaitHint"] ?? 0); 
    } 
    bool AcceptPause; 
    bool AcceptStop; 
    string Caption; 
    UInt32 CheckPoint; 
    string CreationClassName; 
    string Description; 
    bool DesktopInteract; 
    string DisplayName; 
    string ErrorControl; 
    UInt32 ExitCode; 
    DateTime InstallDate; 
    string Name; 
    string PathName; 
    UInt32 ProcessId; 
    UInt32 ServiceSpecificExitCode; 
    string ServiceType; 
    bool Started; 
    string StartMode; 
    string StartName; 
    string State; 
    string Status; 
    string SystemCreationClassName; 
    string SystemName; 
    UInt32 TagId; 
    UInt32 WaitHint; 
}; 

對象現在我們查詢WMI的服務。在這裏，我只提取所有服務。如果你有更具體的標準，只需修改查詢"Select * from Win32_Service"

var services = new System.Collections.Generic.List<Win32_Service>(); 
using (ManagementObjectSearcher searcher = new ManagementObjectSearcher("Select * from Win32_Service")) 
{ 
    using (ManagementObjectCollection results = searcher.Get()) 
    { 
     foreach (ManagementObject obj in results) 
     { 
      services.Add(new Win32_Service(obj)); 
     } 
    } 
} 

現在你可以使用LINQ查詢services。

參考：http://msdn.microsoft.com/en-us/library/ms974579.aspx