根据父进程名称判断是否被调试
本文地址：http://tongxinmao.com/Article/Detail/id/380
#include"tlhelp32.h"
BOOL isdbg()
{
int ret=0;
DWORD ExplorerId = 0;
PROCESSENTRY32 pe32 = {0};
String str;
BOOL bIsDebug = FALSE;
DWORD ProcessId = GetCurrentProcessId();
// 获取 Explorer 进程ID
::GetWindowThreadProcessId(::FindWindow("Progman", NULL), &ExplorerId);
HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);
if (hProcessSnap != INVALID_HANDLE_VALUE)
{
pe32.dwSize = sizeof(PROCESSENTRY32);
if (Process32First(hProcessSnap, &pe32))
{
do
{
if (ProcessId == pe32.th32ProcessID)
{
str.sprintf("进程ID:%d 父进程ID:%d Explorer进程ID:%d", ProcessId, pe32.th32ParentProcessID, ExplorerId);
if (pe32.th32ParentProcessID != ExplorerId)
{
bIsDebug = TRUE;
break;
}
}
}
while (Process32Next(hProcessSnap, &pe32));
}
// AfxMessageBox(str);
}
if (bIsDebug)
{
// AfxMessageBox(L"检测到调试器");
ret=1;
}
else
{
// AfxMessageBox(L"没有检测到调试器");
ret=0;
}
CloseHandle (hProcessSnap);
}