如何根据进程的开关来终止进程
我想杀死一个进程,尽管只用特定的开关杀死一个进程,例如
taskkill "cmd.exe" /s /k Pushd
你能做到吗?
I would like to kill a process, although only kill a process with a specific switch, e.g.
taskkill "cmd.exe" /s /k pushd
Can you do this?
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(2)
我会使用 Windows 列出所有正在运行的进程进程状态API。之后,尝试获取进程的命令行,就像 Process Explorer 所做的那样(它似乎这可以通过未记录的 API 来完成。接下来,只需使用上面提到的相同 PSAPI 终止符合您条件的进程即可。
I would go for listing all running processes using the Windows Process Status API. After that, try to get the process's command line, like Process Explorer does (it seems that this can be done through an undocumented API). Next, just kill the process that matches your criteria using the same PSAPI above mentioned.
您可以使用
NtQueryInformationProcess
功能。 PROCESS_BASIC_INFORMATION 结构有一个成员 PebBaseAddress ,它是一个指向PEB
结构。从那里您可以检查ProcessParameters
成员,它是指向RTL_USER_PROCESS_PARAMETERS
结构。最后您可以检查其CommandLine
成员。You can use the
NtQueryInformationProcess
function. ThePROCESS_BASIC_INFORMATION
struct has a memberPebBaseAddress
witch is a pointer to thePEB
structure. From there you can check theProcessParameters
member which is a pointer to aRTL_USER_PROCESS_PARAMETERS
structure. Finally you can check itsCommandLine
member.