CrystalicCore/SRCC
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
dev
SRCC/docs/winapi-process-launch.md
T

944 lines
27 KiB
Markdown
Raw Permalink Normal View History

b1.0
2026-06-22 11:33:18 +08:00
# WinAPI 进程启动方案
> 基于 Windows API 的进程创建方案，覆盖完整生命周期（创建、监控、终止），适用于 Go 项目。
---
## 1. 现状分析
当前项目中进程启动使用以下方式：
| 位置 | 方式 | 用途 |
|------|------|------|
| `DoConnect.go` | `exec.Command("cmd", "/c", cmd)` | 启动 EasyTier 核心进程 |
| `main.go` | `exec.Command("cmd", "/c", "start", url)` | 打开外部网页 |
| `Perm.go` | `ShellExecuteW` + `"runas"` | 管理员提权重启自身 |
**现有方案的不足：**
- 依赖 `cmd.exe` 中间层，会短暂闪现控制台窗口
- 无法精确控制子进程的窗口状态（如隐藏窗口）
- 进程终止仅通过 `Kill()`，无法优雅退出
- 无法实时捕获子进程 stdout/stderr
- 无法将子进程纳入 Job Object 统一管理生命周期
---
## 2. WinAPI 进程启动方案总览
| 方案 | 适用场景 | 控制粒度 |
|------|----------|----------|
| **CreateProcess** | 启动任意可执行文件，完全控制 | ★★★★★ |
| **CreateProcessAsUser** | 以指定用户身份启动进程 | ★★★★★ |
| **CreateProcessWithTokenW** | 以显式 Token 启动（含降权） | ★★★★★ |
| **ShellExecuteEx** | 关联文件/URL/提权启动 | ★★★☆☆ |
| **CreateProcess + Job Object** | 进程组统一管理 | ★★★★★ |
---
## 3. 方案一：CreateProcess（推荐默认方案）
### 3.1 核心 API
```go
// kernel32.dll
syscall.CreateProcess(
lpApplicationName *uint16, // 可执行文件路径（可为 nil）
lpCommandLine *uint16, // 命令行字符串
lpProcessAttributes *syscall.SecurityAttributes, // 进程安全属性
lpThreadAttributes *syscall.SecurityAttributes, // 线程安全属性
bInheritHandles bool, // 是否继承句柄
dwCreationFlags uint32, // 创建标志
lpEnvironment *uint16, // 环境变量（nil=继承）
lpCurrentDirectory *uint16, // 当前目录（nil=继承）
lpStartupInfo *syscall.StartupInfo, // 启动信息
lpProcessInformation *syscall.ProcessInformation, // 输出：进程信息
)
```
### 3.2 基础封装
```go
package main
import (
"fmt"
"syscall"
"unsafe"
)
const (
CREATE_NO_WINDOW = 0x08000000 // 不创建窗口（控制台程序隐藏）
CREATE_NEW_CONSOLE = 0x00000010 // 创建新控制台
CREATE_SUSPENDED = 0x00000004 // 挂起创建
CREATE_BREAKAWAY_FROM_JOB = 0x01000000
CREATE_DEFAULT_ERROR_MODE = 0x04000000
NORMAL_PRIORITY_CLASS = 0x00000020
CREATE_UNICODE_ENVIRONMENT = 0x00000400
)
// RunProcessCreate 使用 CreateProcess 启动程序
func RunProcessCreate(exePath string, args string, hidden bool) (*syscall.ProcessInformation, error) {
// 完整命令行：exe路径 + 空格 + 参数
cmdLine := fmt.Sprintf(`"%s" %s`, exePath, args)
exePtr, err := syscall.UTF16PtrFromString(exePath)
if err != nil {
return nil, fmt.Errorf("exe路径转换失败: %w", err)
}
cmdPtr, err := syscall.UTF16PtrFromString(cmdLine)
if err != nil {
return nil, fmt.Errorf("命令行转换失败: %w", err)
}
var si syscall.StartupInfo
si.Cb = uint32(unsafe.Sizeof(si))
if hidden {
si.Flags = syscall.STARTF_USESHOWWINDOW
si.ShowWindow = 0 // SW_HIDE
}
// 默认不显示窗口，不强制开启新控制台
flags := uint32(NORMAL_PRIORITY_CLASS)
if hidden {
flags |= CREATE_NO_WINDOW
}
var pi syscall.ProcessInformation
kernel32 := syscall.NewLazyDLL("kernel32.dll")
procCreateProcess := kernel32.NewProc("CreateProcessW")
ret, _, lastErr := procCreateProcess.Call(
uintptr(unsafe.Pointer(exePtr)), // lpApplicationName
uintptr(unsafe.Pointer(cmdPtr)), // lpCommandLine
0, // lpProcessAttributes (NULL)
0, // lpThreadAttributes (NULL)
0, // bInheritHandles (FALSE)
uintptr(flags), // dwCreationFlags
0, // lpEnvironment (NULL)
0, // lpCurrentDirectory (NULL)
uintptr(unsafe.Pointer(&si)), // lpStartupInfo
uintptr(unsafe.Pointer(&pi)), // lpProcessInformation
)
if ret == 0 {
return nil, fmt.Errorf("CreateProcess 失败: %v", lastErr)
}
return &pi, nil
}
// 使用示例
func ExampleCreateProcess() {
pi, err := RunProcessCreate(
`C:\tools\easytier-core.exe`,
`--network-name mynet --network-secret mysecret --peers tcp://host:11010 -d`,
true, // hidden=true 隐藏窗口
)
if err != nil {
fmt.Println("启动失败:", err)
return
}
defer func() {
syscall.CloseHandle(pi.Process)
syscall.CloseHandle(pi.Thread)
}()
fmt.Printf("进程已启动, PID=%d\n", pi.ProcessId)
// 等待进程结束（最多 30 秒）
// 或使用 WaitForSingleObject 无限等待
// syscall.WaitForSingleObject(pi.Process, syscall.INFINITE)
}
```
### 3.3 优势对比
| 特性 | `os/exec` | `CreateProcess` |
|------|-----------|-----------------|
| 隐藏窗口 | 需 HOOK 或 cmd 包装 | `CREATE_NO_WINDOW` 原生支持 |
| 进程挂起启动 | 不支持 | `CREATE_SUSPENDED` |
| 环境变量注入 | `cmd.Env` | `lpEnvironment` 直接传 |
| 工作目录 | `cmd.Dir` | `lpCurrentDirectory` |
| 优先级控制 | 不支持 | `*_PRIORITY_CLASS` 系列 |
| 额外依赖 | 无 | 无（纯 WinAPI） |
---
## 4. 方案二：CreateProcess + 句柄重定向（实时输出捕获）
### 4.1 匿名管道重定向 stdout/stderr
```go
func RunProcessCapture(exePath string, args string) (*syscall.ProcessInformation, syscall.Handle, syscall.Handle, error) {
// 创建管道
var sa syscall.SecurityAttributes
sa.Length = uint32(unsafe.Sizeof(sa))
sa.InheritHandle = 1 // 句柄可继承
var stdoutRead, stdoutWrite syscall.Handle
var stderrRead, stderrWrite syscall.Handle
kernel32 := syscall.NewLazyDLL("kernel32.dll")
procCreatePipe := kernel32.NewProc("CreatePipe")
// 创建 stdout 管道
ret, _, err := procCreatePipe.Call(
uintptr(unsafe.Pointer(&stdoutRead)),
uintptr(unsafe.Pointer(&stdoutWrite)),
uintptr(unsafe.Pointer(&sa)),
0, // 缓冲区大小，0=默认
)
if ret == 0 {
return nil, 0, 0, fmt.Errorf("创建stdout管道失败: %v", err)
}
// 创建 stderr 管道
ret, _, err = procCreatePipe.Call(
uintptr(unsafe.Pointer(&stderrRead)),
uintptr(unsafe.Pointer(&stderrWrite)),
uintptr(unsafe.Pointer(&sa)),
0,
)
if ret == 0 {
syscall.CloseHandle(stdoutRead)
syscall.CloseHandle(stdoutWrite)
return nil, 0, 0, fmt.Errorf("创建stderr管道失败: %v", err)
}
// 配置 StartupInfo 重定向
var si syscall.StartupInfo
si.Cb = uint32(unsafe.Sizeof(si))
si.Flags = syscall.STARTF_USESTDHANDLES | syscall.STARTF_USESHOWWINDOW
si.ShowWindow = 0 // SW_HIDE
si.StdOutput = stdoutWrite
si.StdErr = stderrWrite
cmdLine := fmt.Sprintf(`"%s" %s`, exePath, args)
cmdPtr, _ := syscall.UTF16PtrFromString(cmdLine)
var pi syscall.ProcessInformation
procCreateProcess := kernel32.NewProc("CreateProcessW")
ret, _, lastErr := procCreateProcess.Call(
0,
uintptr(unsafe.Pointer(cmdPtr)),
0, 0,
1, // bInheritHandles = TRUE
uintptr(CREATE_NO_WINDOW | NORMAL_PRIORITY_CLASS),
0, 0,
uintptr(unsafe.Pointer(&si)),
uintptr(unsafe.Pointer(&pi)),
)
if ret == 0 {
syscall.CloseHandle(stdoutRead)
syscall.CloseHandle(stdoutWrite)
syscall.CloseHandle(stderrRead)
syscall.CloseHandle(stderrWrite)
return nil, 0, 0, fmt.Errorf("CreateProcess 失败: %v", lastErr)
}
// 关闭子进程端的写句柄，父进程只保留读句柄
syscall.CloseHandle(stdoutWrite)
syscall.CloseHandle(stderrWrite)
return &pi, stdoutRead, stderrRead, nil
}
// ReadFromPipe 从管道读取数据（非阻塞轮询）
func ReadFromPipe(handle syscall.Handle, bufSize uint32) (string, error) {
kernel32 := syscall.NewLazyDLL("kernel32.dll")
procReadFile := kernel32.NewProc("ReadFile")
buf := make([]byte, bufSize)
var bytesRead uint32
ret, _, err := procReadFile.Call(
uintptr(handle),
uintptr(unsafe.Pointer(&buf[0])),
uintptr(bufSize),
uintptr(unsafe.Pointer(&bytesRead)),
0, // lpOverlapped = NULL (同步)
)
if ret == 0 {
return "", fmt.Errorf("ReadFile 失败: %v", err)
}
return string(buf[:bytesRead]), nil
}
// 使用示例
func ExampleCaptureOutput() {
pi, stdoutRead, stderrRead, err := RunProcessCapture(
`C:\tools\easytier-core.exe`,
`--network-name mynet --network-secret mysecret --peers tcp://host:11010 -d`,
)
if err != nil {
fmt.Println("启动失败:", err)
return
}
defer func() {
syscall.CloseHandle(pi.Process)
syscall.CloseHandle(pi.Thread)
syscall.CloseHandle(stdoutRead)
syscall.CloseHandle(stderrRead)
}()
fmt.Printf("进程已启动, PID=%d\n", pi.ProcessId)
// 实时读取输出（goroutine 持续读取）
go func() {
for {
data, err := ReadFromPipe(stdoutRead, 4096)
if err != nil || data == "" {
return
}
fmt.Print("[stdout] ", data)
}
}()
go func() {
for {
data, err := ReadFromPipe(stderrRead, 4096)
if err != nil || data == "" {
return
}
fmt.Print("[stderr] ", data)
}
}()
}
```
---
## 5. 方案三：Job Object 进程组管理
### 5.1 概念
Job Object 可将多个子进程关联到一个"作业对象"，实现统一的生命周期控制：
- 主进程退出 → Job 内所有子进程自动终止
- 资源限制（CPU、内存）
- 统一通知
### 5.2 实现
```go
const (
JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x00002000
)
type JOBOBJECT_BASIC_LIMIT_INFORMATION struct {
PerProcessUserTimeLimit int64
PerJobUserTimeLimit int64
LimitFlags uint32
MinimumWorkingSetSize uintptr
MaximumWorkingSetSize uintptr
ActiveProcessLimit uint32
Affinity uintptr
PriorityClass uint32
SchedulingClass uint32
}
type JOBOBJECT_EXTENDED_LIMIT_INFORMATION struct {
BasicLimitInformation JOBOBJECT_BASIC_LIMIT_INFORMATION
IoInfo [48]byte // reserved
ProcessMemoryLimit uintptr
JobMemoryLimit uintptr
PeakProcessMemoryUsed uintptr
PeakJobMemoryUsed uintptr
}
// CreateJobWithAutoKill 创建 Job Object，主进程退出时自动终止子进程
func CreateJobWithAutoKill() (syscall.Handle, error) {
kernel32 := syscall.NewLazyDLL("kernel32.dll")
procCreateJobObject := kernel32.NewProc("CreateJobObjectW")
procSetInformationJobObject := kernel32.NewProc("SetInformationJobObject")
// 创建 Job Object
jobName := syscall.StringToUTF16Ptr("")
job, _, err := procCreateJobObject.Call(
0, // lpJobAttributes = NULL
uintptr(unsafe.Pointer(jobName)),
)
if job == 0 {
return 0, fmt.Errorf("CreateJobObject 失败: %v", err)
}
// 设置限制：当 Job 最后一个句柄关闭时，终止所有关联进程
var jeli JOBOBJECT_EXTENDED_LIMIT_INFORMATION
jeli.BasicLimitInformation.LimitFlags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
const JobObjectExtendedLimitInformation = 9
ret, _, err := procSetInformationJobObject.Call(
job,
uintptr(JobObjectExtendedLimitInformation),
uintptr(unsafe.Pointer(&jeli)),
uintptr(unsafe.Sizeof(jeli)),
)
if ret == 0 {
syscall.CloseHandle(syscall.Handle(job))
return 0, fmt.Errorf("SetInformationJobObject 失败: %v", err)
}
return syscall.Handle(job), nil
}
// AssignProcessToJob 将进程关联到 Job Object
func AssignProcessToJob(job syscall.Handle, process syscall.Handle) error {
kernel32 := syscall.NewLazyDLL("kernel32.dll")
procAssignProcessToJobObject := kernel32.NewProc("AssignProcessToJobObject")
ret, _, err := procAssignProcessToJobObject.Call(
uintptr(job),
uintptr(process),
)
if ret == 0 {
return fmt.Errorf("AssignProcessToJobObject 失败: %v", err)
}
return nil
}
// RunProcessInJob 在 Job Object 中启动进程
func RunProcessInJob(exePath string, args string, hidden bool) (*syscall.ProcessInformation, syscall.Handle, error) {
// 先创建 Job
job, err := CreateJobWithAutoKill()
if err != nil {
return nil, 0, fmt.Errorf("创建Job失败: %w", err)
}
// 启动进程（挂起）
cmdLine := fmt.Sprintf(`"%s" %s`, exePath, args)
cmdPtr, _ := syscall.UTF16PtrFromString(cmdLine)
var si syscall.StartupInfo
si.Cb = uint32(unsafe.Sizeof(si))
if hidden {
si.Flags = syscall.STARTF_USESHOWWINDOW
si.ShowWindow = 0
}
var pi syscall.ProcessInformation
kernel32 := syscall.NewLazyDLL("kernel32.dll")
procCreateProcess := kernel32.NewProc("CreateProcessW")
flags := uint32(CREATE_SUSPENDED | NORMAL_PRIORITY_CLASS)
if hidden {
flags |= CREATE_NO_WINDOW
}
ret, _, lastErr := procCreateProcess.Call(
0,
uintptr(unsafe.Pointer(cmdPtr)),
0, 0, 0,
uintptr(flags),
0, 0,
uintptr(unsafe.Pointer(&si)),
uintptr(unsafe.Pointer(&pi)),
)
if ret == 0 {
syscall.CloseHandle(job)
return nil, 0, fmt.Errorf("CreateProcess 失败: %v", lastErr)
}
// 关联到 Job
if err := AssignProcessToJob(job, pi.Process); err != nil {
// 关联失败，终止进程并清理
syscall.TerminateProcess(pi.Process, 1)
syscall.CloseHandle(pi.Process)
syscall.CloseHandle(pi.Thread)
syscall.CloseHandle(job)
return nil, 0, fmt.Errorf("关联Job失败: %w", err)
}
// 恢复进程执行
kernel32.NewProc("ResumeThread").Call(uintptr(pi.Thread))
return &pi, job, nil
}
// 使用示例
func ExampleJobObject() {
pi, job, err := RunProcessInJob(
`C:\tools\easytier-core.exe`,
`--network-name mynet --network-secret mysecret --peers tcp://host:11010 -d`,
true,
)
if err != nil {
fmt.Println("启动失败:", err)
return
}
// 注意：defer 顺序很重要！
// 先关闭 job → 触发 JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE → 子进程自动终止
defer syscall.CloseHandle(job)
defer syscall.CloseHandle(pi.Process)
defer syscall.CloseHandle(pi.Thread)
fmt.Printf("进程已在 Job 中启动, PID=%d\n", pi.ProcessId)
fmt.Println("主进程退出时，所有子进程将自动终止")
// 正常结束流程：
// 1. 先向子进程发送优雅退出信号（如 WM_CLOSE）
// 2. 等待一段时间
// 3. 再 CloseHandle(job) 强制终止
}
```
### 5.3 关键特性
| 特性 | 说明 |
|------|------|
| `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE` | Job 句柄关闭 → 所有关联进程被 `TerminateProcess` 强制终止 |
| `CREATE_SUSPENDED` | 挂起创建，确保进程在加入 Job 之前不会执行任何代码 |
| 自动清理 | 即使主进程崩溃，OS 也会回收 Job 并终止所有子进程 |
---
## 6. 方案四：ShellExecuteEx（提升：已有实现增强）
### 6.1 与 ShellExecute 的对比
当前项目使用 `ShellExecuteW`，`ShellExecuteExW` 增强点：
```go
const (
SW_HIDE = 0
SW_NORMAL = 1
SW_MINIMIZE = 6
SEE_MASK_NOCLOSEPROCESS = 0x00000040 // 获取进程句柄
SEE_MASK_NO_CONSOLE = 0x00008000 // 不创建控制台
SEE_MASK_FLAG_NO_UI = 0x00000400 // 不显示错误对话框
)
type SHELLEXECUTEINFOW struct {
cbSize uint32
fMask uint32
hwnd syscall.Handle
lpVerb *uint16
lpFile *uint16
lpParameters *uint16
lpDirectory *uint16
nShow int32
hInstApp syscall.Handle
lpIDList uintptr
lpClass *uint16
hkeyClass syscall.Handle
dwHotKey uint32
hIcon syscall.Handle
hProcess syscall.Handle
}
// ShellExecuteEx 增强封装
func ShellExec(exe string, params string, verb string, wait bool) (syscall.Handle, error) {
shell32 := syscall.NewLazyDLL("shell32.dll")
procShellExecuteEx := shell32.NewProc("ShellExecuteExW")
verbPtr, _ := syscall.UTF16PtrFromString(verb)
exePtr, _ := syscall.UTF16PtrFromString(exe)
var paramsPtr *uint16
if params != "" {
paramsPtr, _ = syscall.UTF16PtrFromString(params)
}
var info SHELLEXECUTEINFOW
info.cbSize = uint32(unsafe.Sizeof(info))
info.fMask = SEE_MASK_NOCLOSEPROCESS | SEE_MASK_NO_CONSOLE | SEE_MASK_FLAG_NO_UI
info.lpVerb = verbPtr
info.lpFile = exePtr
info.lpParameters = paramsPtr
info.nShow = SW_HIDE
ret, _, err := procShellExecuteEx.Call(uintptr(unsafe.Pointer(&info)))
if ret == 0 {
return 0, fmt.Errorf("ShellExecuteEx 失败: %v", err)
}
if wait {
// WaitForSingleObject 等待进程结束
syscall.WaitForSingleObject(info.hProcess, syscall.INFINITE)
}
return info.hProcess, nil
}
```
---
## 7. 方案五：CreateProcessAsUser / CreateProcessWithTokenW
### 7.1 场景
- 从 SYSTEM 服务降权到当前登录用户启动 GUI 进程
- 以指定域用户身份运行
- Token 窃取/复制后委托执行
### 7.2 降权启动（SYSTEM → User）
```go
// GetActiveUserToken 获取当前活动用户的 Token
func GetActiveUserToken() (syscall.Token, error) {
// 1. 枚举所有会话，找到活动控制台会话
// 2. WTSQueryUserToken 获取 Token
// 3. 返回用户 Token
wtsapi32 := syscall.NewLazyDLL("wtsapi32.dll")
procWTSGetActiveConsoleSessionId := wtsapi32.NewProc("WTSGetActiveConsoleSessionId")
sessionId, _, _ := procWTSGetActiveConsoleSessionId.Call()
procWTSQueryUserToken := wtsapi32.NewProc("WTSQueryUserTokenW")
var token syscall.Token
ret, _, err := procWTSQueryUserToken.Call(
sessionId,
uintptr(unsafe.Pointer(&token)),
)
if ret == 0 {
return 0, fmt.Errorf("WTSQueryUserToken 失败: %v", err)
}
return token, nil
}
// RunAsUser 以指定用户身份启动进程
func RunAsUser(token syscall.Token, exePath string, args string) error {
var si syscall.StartupInfo
si.Cb = uint32(unsafe.Sizeof(si))
var pi syscall.ProcessInformation
cmdLine := fmt.Sprintf(`"%s" %s`, exePath, args)
cmdPtr, _ := syscall.UTF16PtrFromString(cmdLine)
advapi32 := syscall.NewLazyDLL("advapi32.dll")
procCreateProcessAsUser := advapi32.NewProc("CreateProcessAsUserW")
ret, _, err := procCreateProcessAsUser.Call(
uintptr(token),
0, // lpApplicationName
uintptr(unsafe.Pointer(cmdPtr)),
0, 0, // lpProcessAttributes, lpThreadAttributes
0, // bInheritHandles
0, // dwCreationFlags
0, 0, // lpEnvironment, lpCurrentDirectory
uintptr(unsafe.Pointer(&si)),
uintptr(unsafe.Pointer(&pi)),
)
if ret == 0 {
return fmt.Errorf("CreateProcessAsUser 失败: %v", err)
}
defer func() {
syscall.CloseHandle(pi.Process)
syscall.CloseHandle(pi.Thread)
}()
fmt.Printf("以用户身份启动, PID=%d\n", pi.ProcessId)
return nil
}
```
---
## 8. 方案六：进程优雅终止
### 8.1 当前问题
`proc.Kill()` → `TerminateProcess`，子进程无机会清理资源。
### 8.2 优雅终止实现
```go
import "golang.org/x/sys/windows"
const (
CTRL_C_EVENT = 0
CTRL_BREAK_EVENT = 1
)
// SendCtrlC 向控制台进程发送 Ctrl+C
func SendCtrlC(pid uint32) error {
kernel32 := syscall.NewLazyDLL("kernel32.dll")
procAttachConsole := kernel32.NewProc("AttachConsole")
procGenerateConsoleCtrlEvent := kernel32.NewProc("GenerateConsoleCtrlEvent")
procFreeConsole := kernel32.NewProc("FreeConsole")
// 附加到目标进程的控制台
ret, _, _ := procAttachConsole.Call(uintptr(pid))
if ret == 0 {
// 置零当前进程的错误模式，防止自身被 Ctrl+C 影响
kernel32.NewProc("SetConsoleCtrlHandler").Call(0, 1)
procAttachConsole.Call(uintptr(pid))
}
// 发送 Ctrl+C
ret, _, _ = procGenerateConsoleCtrlEvent.Call(
uintptr(CTRL_C_EVENT),
0, // 0 = 发送到当前附加的控制台中的所有进程
)
// 分离
procFreeConsole.Call()
if ret == 0 {
return fmt.Errorf("GenerateConsoleCtrlEvent 失败")
}
return nil
}
// GracefulKill 优雅终止进程
func GracefulKill(process syscall.Handle, timeoutMs uint32) error {
// 1. 尝试 Ctrl+C（仅对控制台进程有效）
// 2. 等待 timeoutMs 毫秒
// 3. 超时则 TerminateProcess
// 获取进程 PID 用于 AttachConsole
pid := syscall.GetProcessId(process)
if err := SendCtrlC(pid); err == nil {
// 等待进程自己退出
event, _ := syscall.WaitForSingleObject(process, timeoutMs)
if event == syscall.WAIT_OBJECT_0 {
return nil // 进程正常退出
}
}
// 强制终止
return syscall.TerminateProcess(process, 0)
}
```
---
## 9. 完整封装：ProcessManager
### 9.1 统一的进程管理器
```go
package main
import (
"fmt"
"sync"
"syscall"
"unsafe"
)
type ProcessManager struct {
mu sync.Mutex
processes map[uint32]*ManagedProcess
job syscall.Handle
}
type ManagedProcess struct {
Process syscall.Handle
Thread syscall.Handle
PID uint32
StdoutRead syscall.Handle
StderrRead syscall.Handle
}
func NewProcessManager() (*ProcessManager, error) {
job, err := CreateJobWithAutoKill()
if err != nil {
return nil, err
}
return &ProcessManager{
processes: make(map[uint32]*ManagedProcess),
job: job,
}, nil
}
func (pm *ProcessManager) Launch(opts LaunchOptions) (*ManagedProcess, error) {
pm.mu.Lock()
defer pm.mu.Unlock()
cmdLine := fmt.Sprintf(`"%s" %s`, opts.ExePath, opts.Args)
cmdPtr, _ := syscall.UTF16PtrFromString(cmdLine)
var si syscall.StartupInfo
si.Cb = uint32(unsafe.Sizeof(si))
if opts.HideWindow {
si.Flags = syscall.STARTF_USESHOWWINDOW
si.ShowWindow = 0
}
// 如果开启输出捕获
var stdoutRead, stderrRead syscall.Handle
if opts.CaptureOutput {
// ... 创建管道，配置 si.StdOutput/si.StdErr ...
}
var pi syscall.ProcessInformation
flags := uint32(CREATE_SUSPENDED | NORMAL_PRIORITY_CLASS)
if opts.HideWindow {
flags |= CREATE_NO_WINDOW
}
kernel32 := syscall.NewLazyDLL("kernel32.dll")
procCreateProcess := kernel32.NewProc("CreateProcessW")
ret, _, err := procCreateProcess.Call(
0,
uintptr(unsafe.Pointer(cmdPtr)),
0, 0, 0,
uintptr(flags),
0, 0,
uintptr(unsafe.Pointer(&si)),
uintptr(unsafe.Pointer(&pi)),
)
if ret == 0 {
return nil, fmt.Errorf("CreateProcess 失败: %v", err)
}
// 关联 Job
AssignProcessToJob(pm.job, pi.Process)
// 恢复线程
kernel32.NewProc("ResumeThread").Call(uintptr(pi.Thread))
mp := &ManagedProcess{
Process: pi.Process,
Thread: pi.Thread,
PID: pi.ProcessId,
StdoutRead: stdoutRead,
StderrRead: stderrRead,
}
pm.processes[pi.ProcessId] = mp
return mp, nil
}
// LaunchOptions 启动选项
type LaunchOptions struct {
ExePath string
Args string
HideWindow bool
CaptureOutput bool
WorkingDir string
}
// Shutdown 关闭所有子进程
func (pm *ProcessManager) Shutdown() {
pm.mu.Lock()
defer pm.mu.Unlock()
// 关闭 Job → 所有子进程自动终止
if pm.job != 0 {
syscall.CloseHandle(pm.job)
pm.job = 0
}
// 清理句柄
for _, mp := range pm.processes {
syscall.CloseHandle(mp.Process)
syscall.CloseHandle(mp.Thread)
if mp.StdoutRead != 0 {
syscall.CloseHandle(mp.StdoutRead)
}
if mp.StderrRead != 0 {
syscall.CloseHandle(mp.StderrRead)
}
}
pm.processes = make(map[uint32]*ManagedProcess)
}
```
---
## 10. 迁移建议
### 10.1 迁移路径
```
当前：
DoConnect.go → exec.Command("cmd", "/c", cmd) → cmd.exe 包装
main.go → exec.Command("cmd", "/c", start) → cmd.exe 包装
Perm.go → ShellExecuteW("runas") → 提权可靠
建议：
DoConnect.go → ProcessManager.Launch() → 直接 CreateProcess + Job
main.go → ShellExecuteEx("open", url) → 去掉 cmd 中间层
Perm.go → 保持不变 → 已是最佳实践
```
### 10.2 DoConnect.go 改造示例
```go
// 改造前
func connectToVirtualHotspot() *os.Process {
cmd := miner.BuildTaskCommand(...)
c := exec.Command("cmd", "/c", cmd)
c.Start()
return c.Process
}
// 改造后
var pm *ProcessManager
func connectToVirtualHotspot() (*ManagedProcess, error) {
cmdArgs := fmt.Sprintf(
"--network-name %s --network-secret %s --peers tcp://%s:%s -d",
netname, token, host, port,
)
return pm.Launch(LaunchOptions{
ExePath: `.\easytier-core.exe`,
Args: cmdArgs,
HideWindow: true,
})
}
func onExit() {
log.Info().Msg("关闭所有子进程")
pm.Shutdown()
log.Info().Msg("程序退出")
}
```
### 10.3 main.go 改造示例
```go
// 改造前
exec.Command("cmd", "/c", "start", "http://...").Start()
// 改造后
shell32 := syscall.NewLazyDLL("shell32.dll")
procShellExecute := shell32.NewProc("ShellExecuteW")
func openURL(url string) {
urlPtr, _ := syscall.UTF16PtrFromString(url)
verbPtr, _ := syscall.UTF16PtrFromString("open")
procShellExecute.Call(0,
uintptr(unsafe.Pointer(verbPtr)),
uintptr(unsafe.Pointer(urlPtr)),
0, 0, 1, // SW_NORMAL
)
}
```
---
## 11. 方案对比总结
| 特性 | `os/exec` | `CreateProcess` | `CreateProcess` + Job | `ShellExecuteEx` |
|------|-----------|-----------------|----------------------|-------------------|
| 隐藏窗口 | ❌ 需 cmd 包装 | ✅ `CREATE_NO_WINDOW` | ✅ | ✅ `SW_HIDE` |
| 实时输出捕获 | ✅ `cmd.StdoutPipe` | ✅ 匿名管道 | ✅ | ❌ 需重定向到文件 |
| 进程组管理 | ❌ | ❌ | ✅ Job Object | ❌ |
| 优雅终止 | ❌ 仅 `Kill()` | ✅ `GenerateConsoleCtrlEvent` | ✅ Job 自动清理 | ❌ |
| 提权启动 | ❌ | ❌ | ❌ | ✅ `runas` verb |
| 无 cmd 依赖 | ✅ | ✅ | ✅ | ✅ |
| 跨平台 | ✅ | ❌ Windows only | ❌ | ❌ |
| 推荐场景 | 开发/调试 | 生产环境最简单的改进 | **生产环境推荐** | URL/文档打开、提权 |
---
## 12. 注意事项
1. **句柄泄漏**：务必 `CloseHandle(pi.Process)` 和 `CloseHandle(pi.Thread)`，否则进程对象不会释放
2. **Job Object 限制**：一个进程只能属于一个 Job，子进程默认继承父进程的 Job
3. **管道死锁**：如果子进程写满管道缓冲区且父进程不读取，子进程会阻塞
4. **CREATE_NO_WINDOW**：仅对控制台子系统程序有效，GUI 程序需要 `SW_HIDE` + `STARTF_USESHOWWINDOW`
5. **UAC 提权**：非管理员进程无法直接启动管理员进程，必须通过 `ShellExecute("runas")` 触发 UAC
Reference in New Issue Copy Permalink