获取进程启动时间
函数接受一个进程ID和SYSTEMTIME时间结构体。
BOOL GetProcessStartTime(int iProcessId, SYSTEMTIME &lstCreation)
{
HANDLE process = NULL;
BOOL bRet = FALSE;
do
{
process = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, iProcessId);
if (process == NULL)
{
break;
}
FILETIME ftCreation, ftExit, ftKernel, ftUser;
SYSTEMTIME stCreation;
if (!GetProcessTimes(process, &ftCreation, &ftExit, &ftKernel, &ftUser))
{
break;
}
//FILETIME to SYSTEMTIME
FileTimeToSystemTime(&ftCreation, &stCreation);
//SYSTEMTIME转换成当前系统时区时间
SystemTimeToTzSpecificLocalTime(NULL, &stCreation, &lstCreation);
bRet = TRUE;
} while (FALSE);
if (process != NULL)
{
CloseHandle(process);
}
CString strTime;
strTime.Format(L"%04d-%02d-%02d %02d:%02d:%02d", lstCreation.wYear, lstCreation.wMonth, lstCreation.wDay, lstCreation.wHour, lstCreation.wMinute, lstCreation.wSecond);
return TRUE;
}
