如何获取所有正在运行的进程的全名，包括 Windows 上的内核进程

Question

I'm trying to list all of the processes running in windows similar to how ProcessExplorer does, however i get lots of unknown processes using the code found here

I think these are kernel processes, but would there be any way to view their names?

Answer 1

The reason you are seeing <unknown> in the process name is that they are system processes as you rightly predicted. OpenProcess which is trying to open with required permissions is failing and defaulting to unknown for system processes.

You can use WTSEnumerateSessions instead if you are looking for only process names and PIDs.

WTS_PROCESS_INFO* pWtsProcessInfo = NULL;
DWORD dwProcessCount = 0;
if (WTSEnumerateProcesses(NULL, NULL, 1, &pWtsProcessInfo, &dwProcessCount))    {
    for (DWORD i = 0; i < dwProcessCount; i++)      {
        printf("%ws : %d\n", pWtsProcessInfo[i].pProcessName, pWtsProcessInfo[i].ProcessId); // %s if the project is not in unicode
    }
}