Windows API中沒有提供直接獲取指定程序父程序編號的函式。為此可以通過程序快照來遍歷所有程序，從而獲取程序的父程序編號。本文通過NTDLL.dll中未公開API NtQueryInformationProcess來獲取程序的相關資訊，其中就包含了程序的父程序編號。見程式碼：

#define NTSTATUS LONG #define ProcessBasicInformation 0 typedef UINT PROCESSINFOCLASS; typedef NTSYSAPI NTSTATUS (NTAPI *Func_NtQueryInformationProcess)( IN HANDLE ProcessHandle, // 程序控制代碼 IN PROCESSINFOCLASS InformationClass, // 資訊型別 OUT PVOID ProcessInformation, // 緩衝指標 IN ULONG ProcessInformationLength, // 以位元組為單位的緩衝大小 OUT PULONG ReturnLength OPTIONAL // 寫入緩衝的位元組數 ); typedef struct { DWORD ExitStatus; // 接收程序終止狀態 DWORD PebBaseAddress; // 接收程序環境塊地址 DWORD AffinityMask; // 接收程序關聯掩碼 DWORD BasePriority; // 接收程序的優先順序類 ULONG UniqueProcessId; // 接收程序ID ULONG InheritedFromUniqueProcessId; //接收父程序ID } PROCESS_BASIC_INFORMATION; VOID GetParentProcessId(DWORD dwProcessId) { PROCESS_BASIC_INFORMATION pbi = {0}; HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwProcessId); Func_NtQueryInformationProcess NtQueryInformationProcess = (Func_NtQueryInformationProcess)GetProcAddress(GetModuleHandle(TEXT("NTDLL")) , "NtQueryInformationProcess"); NtQueryInformationProcess(hProcess, ProcessBasicInformation , (PVOID)&pbi, sizeof(PROCESS_BASIC_INFORMATION), NULL); CloseHandle(hProcess); return pbi.InheritedFromUniqueProcessId; }