[cpp] view plain copy
- BOOL IsWow64ProcessEx(HANDLE hProcess)
- {
- // 如果系统是x86的,那么进程就不可能有x64
- bool isX86 = false;
- #ifndef _WIN64
- isX86 = GetProcAddress(GetModuleHandle(TEXT("ntdll")), "NtWow64DebuggerCall") == nullptr ? TRUE : FALSE;
- #endif
- if (isX86)
- return FALSE;
- // 进程架构未知,系统是x64的,可以利用IsWow64Process函数判断
- typedef BOOL(WINAPI *ISWOW64PROCESS)(HANDLE, PBOOL);
- ISWOW64PROCESS fnIsWow64Process;
- BOOL isWow64 = TRUE;
- fnIsWow64Process = (ISWOW64PROCESS)GetProcAddress(GetModuleHandle(TEXT("kernel32")), "IsWow64Process");
- if (fnIsWow64Process != nullptr)
- fnIsWow64Process(hProcess, &isWow64);
- return !isWow64;
- }
先用OpenProcess打开目标进程,再把句柄传进去就OK了。
http://blog.csdn.net/aqtata/article/details/18361209
时间: 2024-12-16 06:39:19