wchar_t Mutex[]= L"MutexDragonNest"; DWORD dwSize = 0; PSYSTEM_HANDLE_INFORMATION pmodule = NULL; POBJECT_NAME_INFORMATION pNameInfo; POBJECT_NAME_INFORMATION pNameType; PVOID pbuffer = NULL; NTSTATUS Status; int nIndex = 0; DWORD dwFlags = 0; char szType[128] = {0}; char szName[512] = {0}; if(ZwQuerySystemInformation==NULL) { AfxMessageBox("ZwQuerySystemInformation失败!"); exit(0); } pbuffer = VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE); if(pbuffer==NULL) { AfxMessageBox("pbuffer 0x1000失败!"); exit(0); } Status = ZwQuerySystemInformation(SystemHandleInformation, pbuffer, 0x1000, &dwSize); if(NT_SUCCESS(Status)==NULL) { if (STATUS_INFO_LENGTH_MISMATCH != Status) { AfxMessageBox("Status失败!"); exit(0); } else { // 这里大家可以保证程序的正确性使用循环分配稍好 if (NULL != pbuffer) { VirtualFree(pbuffer, 0, MEM_RELEASE); } if (dwSize*2 > 0x4000000) // MAXSIZE { AfxMessageBox("dwSize溢出!"); exit(0); } pbuffer = VirtualAlloc(NULL, dwSize*2, MEM_COMMIT, PAGE_READWRITE); if(pbuffer==NULL) { AfxMessageBox("pbuffer dwSize失败!"); exit(0); } Status = ZwQuerySystemInformation(SystemHandleInformation, pbuffer, dwSize*2, NULL); if(NT_SUCCESS(Status)==NULL) { AfxMessageBox("pbuffer dwSize失败!"); exit(0); } } } pmodule = (PSYSTEM_HANDLE_INFORMATION)((PULONG)pbuffer+1); dwSize = *((PULONG)pbuffer); for(nIndex = 0; nIndex < dwSize; nIndex++) { Status = NtQueryObject((HANDLE)pmodule[nIndex].Handle, ObjectNameInformation, szName, 512, &dwFlags); if (NT_SUCCESS(Status)==NULL) { AfxMessageBox("Status name失败!"); exit(0); } Status = NtQueryObject((HANDLE)pmodule[nIndex].Handle, ObjectTypeInformation, szType, 128, &dwFlags); if (NT_SUCCESS(Status)==NULL) { AfxMessageBox("Status type失败!"); exit(0); } pNameInfo = (POBJECT_NAME_INFORMATION)szName; pNameType = (POBJECT_NAME_INFORMATION)szType; GetDlgItem(IDC_EDIT1)->SetWindowText(szType); GetDlgItem(IDC_EDIT2)->SetWindowText(szName); if (0 == wcscmp((wchar_t *)pNameType->Name.Buffer, L"Mutant")) { if (wcsstr((wchar_t *)pNameInfo->Name.Buffer, Mutex)) { CloseHandle((HANDLE)pmodule[nIndex].Handle); AfxMessageBox("已经可以再开启游戏!"); break; } } } if(nIndex == dwSize) AfxMessageBox("关闭互斥句柄失败!"); if (NULL != pbuffer) { VirtualFree(pbuffer, 0, MEM_RELEASE); }