Question

好的，这是一个100万美元的问题。我正在开发一个应用程序来检查您的任何浏览器当前是否正在运行Flash应用程序。这是我的核心原生实现：

// Using CreateToolhelp32Snapshot allows to list all the modules loaded by a specific process.
internal static Boolean ProcessContainsModule(Process process, String moduleMask)
{
    IntPtr snapshotHandle;

    if (Environment.Is64BitProcess)
        snapshotHandle = CreateToolhelp32Snapshot((SnapshotFlags.Module | SnapshotFlags.Module32), (UInt32)process.Id);
    else
        snapshotHandle = CreateToolhelp32Snapshot(SnapshotFlags.Module, (UInt32)process.Id);

    if (snapshotHandle == IntPtr.Zero)
        return false;

    Boolean result = false;

    ModuleEntry entry = new ModuleEntry();
    entry.Size = ModuleEntry.SizeOf;

    if (Module32First(snapshotHandle, ref entry))
    {
        do
        {
            if (entry.ModuleName.FitsMask(moduleMask))
            {
                result = true;
                break;
            }

            entry = new ModuleEntry();
            entry.Size = ModuleEntry.SizeOf;
        }
        while (Module32Next(snapshotHandle, ref entry));
    }

    CloseHandle(snapshotHandle);

    return result;
}

// This is a simple wildcard matching implementation.
public static Boolean FitsMask(this String value, String mask)
{
    Regex regex;

    if (!s_MaskRegexes.TryGetValue(mask, out regex))
        s_MaskRegexes[mask] = regex = new Regex(String.Concat('^', Regex.Escape(mask.Replace(".", "__DOT__").Replace("*", "__STAR__").Replace("?", "__QM__")).Replace("__DOT__", "[.]").Replace("__STAR__", ".*").Replace("__QM__", "."), '$'), RegexOptions.IgnoreCase);

    return regex.IsMatch(value);
}

现在，Process Explorer在我的流程探索过程中非常有用。

使用Chrome检测此功能非常简单：

if ((process.ProcessName == "chrome") && NativeMethods.ProcessContainsModule(process, "PepFlashPlayer.dll"))

使用Firefox检测这一点也非常简单：

if ((process.ProcessName.StartsWith("FlashPlayerPlugin")) && NativeMethods.ProcessContainsModule(process, "NPSWF32*"))

与您一样，当您查看Internet Explorer时，一切都会发生变化。有关如何使用Microsoft浏览器检测到这一点的任何线索？

Answer 1

好的我找到了：

if ((process.ProcessName == "iexplore") && NativeMethods.ProcessContainsModule(process, "Flash32*"))

Answer 2

我已经修改了Zarathos的代码，使其实际可编辑，并添加了一些个人接触。

tl; dr：这适用于Firefox，有时适用于Chrome，而不适用于IE

首先，这里是基本代码：

using System;
using System.Linq;
using System.Runtime.InteropServices;
using System.Diagnostics;

#region pinvoke.net boilerplate

[Flags]
private enum SnapshotFlags : uint
{
    HeapList = 0x00000001,
    Process = 0x00000002,
    Thread = 0x00000004,
    Module = 0x00000008,
    Module32 = 0x00000010,
    Inherit = 0x80000000,
    All = 0x0000001F,
    NoHeaps = 0x40000000
}

private struct MODULEENTRY32
{
    private const int MAX_PATH = 255;
    internal uint dwSize;   
    internal uint th32ModuleID;
    internal uint th32ProcessID;
    internal uint GlblcntUsage;
    internal uint ProccntUsage;
    internal IntPtr modBaseAddr;
    internal uint modBaseSize;
    internal IntPtr hModule;
    [MarshalAs(UnmanagedType.ByValTStr, SizeConst = MAX_PATH + 1)]
    internal string szModule;
    [MarshalAs(UnmanagedType.ByValTStr, SizeConst = MAX_PATH + 5)]
    internal string szExePath;
}

[DllImport("kernel32", SetLastError = true, CharSet = System.Runtime.InteropServices.CharSet.Auto)]
static extern IntPtr CreateToolhelp32Snapshot([In]UInt32 dwFlags, [In]UInt32 th32ProcessID);

[DllImport("kernel32", SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool CloseHandle([In] IntPtr hObject);

[DllImport("kernel32.dll")]
static extern bool Module32First(IntPtr hSnapshot, ref MODULEENTRY32 lpme);

[DllImport("kernel32.dll")]
static extern bool Module32Next(IntPtr hSnapshot, ref MODULEENTRY32 lpme);

#endregion

static bool ProcessContainsModule(Process process, string searchTerm)
{
    bool result = false;

    //get handle to process
    IntPtr snapshotHandle = Environment.Is64BitProcess ?
        CreateToolhelp32Snapshot((UInt32)(SnapshotFlags.Module | SnapshotFlags.Module32), (UInt32)process.Id) :
        CreateToolhelp32Snapshot((UInt32)SnapshotFlags.Module, (UInt32)process.Id);
    if (snapshotHandle == IntPtr.Zero)
    {
        return result;
    }

    //walk the module list
    try
    {
        MODULEENTRY32 entry = new MODULEENTRY32() { dwSize = (uint)Marshal.SizeOf(typeof(MODULEENTRY32)) };

        if (Module32First(snapshotHandle, ref entry))
        {
            do
            {
                if (entry.szModule.IndexOf(searchTerm, StringComparison.OrdinalIgnoreCase) >= 0)
                {
                    result = true;
                    break;
                }

                entry = new MODULEENTRY32() { dwSize = (uint)Marshal.SizeOf(typeof(MODULEENTRY32)) };
            }
            while (Module32Next(snapshotHandle, ref entry));
        }

        return result;
    }
    finally
    {
        CloseHandle(snapshotHandle);
    }
}

您可以像这样使用它：

static bool IsFlashLoadedInFirefox()
{
    return Process.GetProcessesByName("plugin-container").Any(x => ProcessContainsModule(x, "NPSWF"));
}

static bool IsFlashLoadedInInternetExplorer()
{
    //This doesn't work. For some reason can't get modules from child processes
    return Process.GetProcessesByName("iexplore").Any(x => ProcessContainsModule(x, "Flash32"));
}

static bool IsFlashLoadedInChrome()
{
    //Doesn't work reliably. See description.
    return Process.GetProcessesByName("chrome").Any(x => ProcessContainsModule(x, "pepflashplayer"));
}

正如评论中所指出的，只有Firefox似乎可靠地运行。在IE（IE11）的情况下，Module32First()由于某种原因失败。就Chrome而言，事情变得更有趣：

如果新标签导航到youtube.com或任何YouTube视频，则代码可以正常使用
如果新的标签导航到YouTube上的播放列表，则代码会失败，因为pepFlashPlayer.dll不在进程的模块列表中（使用ProcessExplorer检查）。更重要的是，如果您继续导航到其他非播放列表的YouTube视频，它仍然无法显示。

请注意，这种检查进程加载的DLL的方法非常脆弱，如果任何浏览器决定更改它们加载的DLL或加载方式，那么代码就会中断。

<强>参考文献：

检测Internet Explorer进程是否正在运行Flash Player

2 个答案: