windows系统调用 进程快照

#include "windows.h"
#include "tlhelp32.h"
#include "iostream"
using namespace std;

#pragma comment(lib,"kernel32.lib")

DWORD GetKernelModePercentage(const FILETIME& ftKernel,
                              const FILETIME& ftUser
                              ){
                                 ULONGLONG qwKernel=(((ULONGLONG)ftKernel.dwHighDateTime)<<32)+ftKernel.dwLowDateTime;
                                 ULONGLONG qwUser=(((ULONGLONG)ftUser.dwHighDateTime)<<32)+ftUser.dwLowDateTime;
                                 ULONGLONG qwTotal=qwKernel+qwUser;
                                 DWORD dwPct=(DWORD)(((ULONGLONG)100*qwKernel)/qwTotal);
                                 return (dwPct);


}

void main(){
    HANDLE hSnapshot=CreateToolhelp32Snapshot(
        TH32CS_SNAPPROCESS,
        0
        );

    PROCESSENTRY32 pe;

    ZeroMemory(&pe,sizeof(pe));
    pe.dwSize=sizeof(pe);

    BOOL bMore=Process32First(hSnapshot,&pe);

    while(bMore){
        HANDLE hProcess=OpenProcess(
            PROCESS_QUERY_INFORMATION,
            FALSE,
            pe.th32ProcessID
            );

        if(hProcess!=NULL){
            FILETIME ftCreation,ftKernelMode,ftUserMode,ftExit;
            GetProcessTimes(
                hProcess,
                &ftCreation,
                &ftExit,
                &ftKernelMode,
                &ftUserMode    );

        DWORD dwPctKernel=GetKernelModePercentage(
            ftKernelMode,
            ftUserMode
            );

        cout<<"process ID："<<pe.th32ProcessID
            <<",EXE file:"<<pe.szExeFile
            <<",% in Kernel mode:"<<dwPctKernel<<endl;

        CloseHandle(hProcess);
        }
        bMore=Process32Next(hSnapshot,&pe);
    }


    getchar();
}