使用win32api (Python)获取进程的所有线程

Question

假设我有以下代码来获取一个进程的句柄:

pid = 1234
procHandle = win32api.OpenProcess(win32con.MAXIMUM_ALLOWED,pywintypes.FALSE,pid)

我如何列出并得到它的线程句柄?

Answer 1

据我所知，不存在枚举进程中线程的公共API。但存在NtQuerySystemInformation、SystemProcessInformation或SystemExtendedProcessInformation，它返回系统中所有进程和线程的列表。通过使用这个，你可以通过id找到进程中的所有线程，而不需要打开进程

NTSTATUS DumpProcessThreads(_Out_ ULONG_PTR dwProcessId)
{
NTSTATUS status;
ULONG cb = 0x10000;
do 
{
status = STATUS_NO_MEMORY;
if (PVOID buf = LocalAlloc(0, cb + 0x1000))
{
if (0 <= (status = NtQuerySystemInformation(SystemExtendedProcessInformation, buf, cb, &cb)))
{
status = STATUS_INVALID_CID;
union {
PVOID pv;
PBYTE pb;
PSYSTEM_PROCESS_INFORMATION pspi;
};
pv = buf;
ULONG NextEntryOffset = 0;
do 
{
pb += NextEntryOffset;
if (pspi->UniqueProcessId == (HANDLE)dwProcessId)
{
status = STATUS_SUCCESS;
if (ULONG NumberOfThreads = pspi->NumberOfThreads)
{
PSYSTEM_EXTENDED_THREAD_INFORMATION TH = pspi->TH;
do 
{
DbgPrint("%p: %p(%p) [%p]n", 
TH->ClientId.UniqueThread, 
TH->StartAddress, 
TH->Win32StartAddress, 
TH->TebAddress);
} while (TH++, --NumberOfThreads);
}
break;
}
} while (NextEntryOffset = pspi->NextEntryOffset);
}
LocalFree(buf);
}
} while (status == STATUS_INFO_LENGTH_MISMATCH);
return status;
}