public static ProcessInfo[] Enum()
        {
            List<ProcessInfo> Result = new List<ProcessInfo>();
            Process[] ProcList = Process.GetProcesses();

            for (int i = 0; i < ProcList.Length; i++)
            {
                Process Proc = ProcList[i];

                try
                {
                    ProcessInfo Info = new ProcessInfo();

                    Info.FileName = Proc.MainModule.FileName;
                    Info.Id = Proc.Id;
                    Info.Is64Bit = RemoteHooking.IsX64Process(Proc.Id);
                    Info.Identity = RemoteHooking.GetProcessIdentity(Proc.Id).Owner.ToString();

                    Result.Add(Info);
                }
                catch
                {
                }
            }

            return Result.ToArray();
        }

        public static ProcessInfo[] EnumProcesses()
        {
            var result = new List<ProcessInfo>();
            var procList = Process.GetProcesses();

            foreach (var proc in procList)
            {
                try
                {
                    var info = new ProcessInfo
                    {
                        FileName = proc.MainModule.FileName,
                        ID = proc.Id,
                        Is64Bit = RemoteHooking.IsX64Process(proc.Id),
                        User = RemoteHooking.GetProcessIdentity(proc.Id)
                                            .Name
                    };
                    result.Add(info);
                }
                catch
                {
                }
            }
            return result.ToArray();
        }

        public static ProcessInfo[] EnumProcesses()
        {
            List<ProcessInfo> result = new List<ProcessInfo>();
            Process[] procList = Process.GetProcesses();

            for (int i = 0; i < procList.Length; i++)
            {
                Process proc = procList[i];

                try
                {
                    ProcessInfo info = new ProcessInfo();

                    info.FileName = proc.MainModule.FileName;
                    info.Id = proc.Id;
                    info.Is64Bit = RemoteHooking.IsX64Process(proc.Id);
                    info.User = RemoteHooking.GetProcessIdentity(proc.Id).Name;

                    result.Add(info);
                }
                catch
                {
                }
            }

            return result.ToArray();
        }

 static FileLocker()
 {
     Process currentProcess = Process.GetCurrentProcess();
     Int32 processId = currentProcess.Id;
     String processName = currentProcess.ProcessName;
     Int64 startTimeTicks = currentProcess.StartTime.Ticks;
     CurrentProcessInfo = new ProcessInfo(processId, processName, startTimeTicks);
 }

        // -----------------------------
        // ---- PAL layer ends here ----
        // -----------------------------

        private static ProcessInfo CreateProcessInfo(int pid)
        {
            // Negative PIDs aren't valid
            if (pid < 0)
            {
                throw new ArgumentOutOfRangeException("pid");
            }

            ProcessInfo procInfo = new ProcessInfo()
            {
                ProcessId = pid
            };

            // Try to get the task info. This can fail if the user permissions don't permit
            // this user context to query the specified process
            Interop.libproc.proc_taskallinfo? info = Interop.libproc.GetProcessInfoById(pid);
            if (info.HasValue)
            {
                // Set the values we have; all the other values don't have meaning or don't exist on OSX
                Interop.libproc.proc_taskallinfo temp = info.Value;
                unsafe { procInfo.ProcessName = Marshal.PtrToStringAnsi(new IntPtr(temp.pbsd.pbi_comm)); }
                procInfo.BasePriority = temp.pbsd.pbi_nice;
                procInfo.HandleCount = Interop.libproc.GetFileDescriptorCountForPid(pid);
                procInfo.VirtualBytes = (long)temp.ptinfo.pti_virtual_size;
                procInfo.WorkingSet = (long)temp.ptinfo.pti_resident_size;
            }

            // Get the sessionId for the given pid, getsid returns -1 on error
            int sessionId = Interop.libc.getsid(pid);
            if (sessionId != -1)
                procInfo.SessionId = sessionId;
            
            // Create a threadinfo for each thread in the process
            List<KeyValuePair<ulong, Interop.libproc.proc_threadinfo?>> lstThreads = Interop.libproc.GetAllThreadsInProcess(pid);
            foreach (KeyValuePair<ulong, Interop.libproc.proc_threadinfo?> t in lstThreads)
            {
                var ti = new ThreadInfo()
                {
                    _processId = pid,
                    _threadId = (int)t.Key, // The OS X thread ID is 64-bits, but we're forced to truncate due to the public API signature
                    _basePriority = 0,
                    _startAddress = IntPtr.Zero
                };

                // Fill in additional info if we were able to retrieve such data about the thread
                if (t.Value.HasValue)
                {
                    ti._currentPriority = t.Value.Value.pth_curpri;
                    ti._threadState = ConvertOsxThreadRunStateToThreadState((Interop.libproc.ThreadRunState)t.Value.Value.pth_run_state);
                    ti._threadWaitReason = ConvertOsxThreadFlagsToWaitReason((Interop.libproc.ThreadFlags)t.Value.Value.pth_flags);
                }

                procInfo._threadInfoList.Add(ti);
            }

            return procInfo;
        }

 //private static List<Int32> ActivePIDList = new List<Int32>();
 public static ProcessInfo AddHookedProcess(Process process)
 {
     lock (ProcessList)
     {
         ProcessInfo pInfo = new ProcessInfo(process);
         ProcessList.Add(pInfo);
         HookedProcesses.Add(process.Id);
         return pInfo;
     }
 }

 public Player()
 {
     currentState = new LoginState(this);
     ProcessInfo = new ProcessInfo();
     ProcessInfo.Status = ProcessInfo.StatusCode.NotInitialized;
     Messager = new Messager();
     messageQueue = Messager.Queue;
     messagerThread = new Thread(
         new ThreadStart(Messager.Receive));
     messagerThread.Start();
 }

        // CreateProcess wrapper
        public static bool CreateProcess(String ExeName, String
            CmdLine, ProcessInfo pi)
        {
            if (pi == null)
                                pi = new ProcessInfo();

                        byte[] si = new byte[128];

                        return CreateProcess(ExeName, CmdLine, IntPtr.Zero,
                            IntPtr.Zero, 0, 0, IntPtr.Zero, IntPtr.Zero, si, pi) != 0;
        }

        private void GetProcesses()
        {
            listBox1.Items.Clear();
            var processes = Process.GetProcesses();

            foreach (var process in processes)
            {
                var processInfo = new ProcessInfo(process.Id, process.ProcessName);
                listBox1.Items.Add(processInfo);
            }
        }

 static extern bool CreateProcessWithLogonW(
     string principal,
     string authority,
     string password,
     LogonFlags logonFlags,
     string appName,
     string cmdLine,
     CreationFlags creationFlags,
     IntPtr environmentBlock,
     string currentDirectory,
     ref StartupInfo startupInfo,
     out ProcessInfo processInfo);

        // -----------------------------
        // ---- PAL layer ends here ----
        // -----------------------------

        private unsafe static ProcessInfo CreateProcessInfo(int pid)
        {
            // Negative PIDs aren't valid
            if (pid < 0)
            {
                throw new ArgumentOutOfRangeException("pid");
            }

            ProcessInfo procInfo = new ProcessInfo();

            // Try to get the task info. This can fail if the user permissions don't permit
            // this user context to query the specified process
            Interop.libproc.proc_taskallinfo? info = Interop.libproc.GetProcessInfoById(pid);
            if (info.HasValue)
            {
                // We need to convert the byte pointer to an IntPtr 
                // that we can pass to the Marshal.PtrToStringAnsi call
                // but the nullable struct type makes it difficult to inline,
                // so make a temp variable to remove the nullable and get the pointer 
                Interop.libproc.proc_taskallinfo temp = info.Value;
                IntPtr ptrString = new IntPtr(temp.pbsd.pbi_comm);

                // Set the values we have; all the other values don't have meaning or don't exist on OSX
                procInfo.BasePriority = temp.ptinfo.pti_priority;
                procInfo.HandleCount = Interop.libproc.GetFileDescriptorCountForPid(pid);
                procInfo.ProcessId = pid;
                procInfo.ProcessName = System.Runtime.InteropServices.Marshal.PtrToStringAnsi(ptrString);
                procInfo.VirtualBytes = (long)temp.ptinfo.pti_virtual_size;
                procInfo.WorkingSet = (long)temp.ptinfo.pti_resident_size;
            }

            // Create a threadinfo for each thread in the process
            List<KeyValuePair<ulong, Interop.libproc.proc_threadinfo?>> lstThreads = Interop.libproc.GetAllThreadsInProcess(pid);
            foreach (KeyValuePair<ulong, Interop.libproc.proc_threadinfo?> t in lstThreads)
            {
                if (t.Value.HasValue)
                {
                    procInfo._threadInfoList.Add(new ThreadInfo()
                    {
                        _basePriority = 0,
                        _currentPriority = t.Value.Value.pth_curpri,
                        _processId = pid,
                        _startAddress = IntPtr.Zero, // We don't have this info
                        _threadId = Convert.ToInt32(t.Key),
                        _threadState = ConvertOsxThreadRunStateToThreadState((Interop.libproc.ThreadRunState)t.Value.Value.pth_run_state),
                        _threadWaitReason = ConvertOsxThreadFlagsToWaitReason((Interop.libproc.ThreadFlags)t.Value.Value.pth_flags)
                    });
                }
            }

            return procInfo;
        }

 public override void Init(string xmlInformation)
 {
     XmlDocument xmlDoc = new XmlDocument();
     List<ProcessInfo> list = new List<ProcessInfo>();
     xmlDoc.LoadXml(xmlInformation);
     foreach (XmlNode node in xmlDoc.ChildNodes[0].ChildNodes)
     {
         ProcessInfo pInfo = new ProcessInfo();
         pInfo.PID = int.Parse(node.Attributes["ID"].Value);
         pInfo.Name = node.Attributes["Name"].Value;
         pInfo.MemoryUsed = long.Parse(node.Attributes["Memory"].Value);
         list.Add(pInfo);
     }
     Processes = list.ToArray();
 }

 public static ProcessInfo GetHookedProcess(Process process)
 {
     lock (ProcessList)
     {
         ProcessInfo pInfo = new ProcessInfo(process);
         int index = ProcessList.IndexOf(pInfo);
         if (index > -1)
         {
             return ProcessList[index];
         }
         else
         {
             return null;
         }
     }
 }

        public override IEnumerator<object> WaitUntilProcessReady(ProcessInfo process)
        {
            bool isReady = false;
            do {
                yield return Program.EvalPython<bool>(process, @"
            try:
              m = __import__('uix')
              g = getattr(__import__('__builtin__'), 'sm', None)
              return (m is not None) and (g is not None)
            except:
              return False").Bind(() => isReady);

                yield return new Sleep(1);
            } while (!isReady);

            Console.WriteLine("EVE started.");
        }

        protected override string GetInformationXML()
        {
            StringBuilder strBld = new StringBuilder();
            strBld.Append("<ProcessStateInfo>");
            if (activeProcesses != null)
            {
                if (activeProcesses.Length > 0)
                {

                    foreach (Process p in activeProcesses)
                    {
                        ProcessInfo pInfo = new ProcessInfo();
                        pInfo.Name = p.ProcessName;
                        pInfo.MemoryUsed = p.PagedMemorySize64;
                        pInfo.PID = p.Id;
                        strBld.Append(pInfo.ToXML());
                    }
                }
            }
            strBld.Append("</ProcessStateInfo>");
            return strBld.ToString();
        }

        private static uint CreateHoneytokenProcess(string appPath, string domain, string user,
            string password, LogonFlags lf, CreationFlags cf)
        {
            StartupInfo si = new StartupInfo();
            si.cb = Marshal.SizeOf(typeof(StartupInfo));
            ProcessInfo pi = new ProcessInfo();
            pi.dwProcessId = 0;

            if (CreateProcessWithLogonW(user, domain, password,
            lf,
            appPath, null,
            cf, IntPtr.Zero, null,
            ref si, out pi))
            {
                CloseHandle(pi.hProcess);
                CloseHandle(pi.hThread);
            }
            else
            {
                throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
            }
            return(pi.dwProcessId);
        }

 public ViewResultBase Details()
 {
     if (!string.IsNullOrEmpty(Request["isTooltip"]))
     {
         Guid id;
         if (Guid.TryParse(Request["id"], out id))
         {
             var data = new ProcessInfo(base.EntityType.GetData(id));
             return new PartialViewResult { ViewName = "Partials/Details", ViewData = new ViewDataDictionary(data) };
         }
         else
         {
             throw new ValidationException("非法的Guid标识" + Request["id"]);
         }
     }
     else if (!string.IsNullOrEmpty(Request["isInner"]))
     {
         return new PartialViewResult { ViewName = "Partials/Details" };
     }
     else
     {
         return this.View();
     }
 }

 public virtual IEnumerator<object> WaitUntilProcessReady(ProcessInfo process)
 {
     yield break;
 }

 public double[] GetCpuUsage(string processName, bool monitor = false)
 {
     ArrayList cpuUsage = new ArrayList();
     ArrayList threadPool = new ArrayList();
     try
     {
         processName = GetProcessName(processName);
         common.LogMessage(processName);
         Process[] processes = Process.GetProcessesByName(processName);
         foreach (Process p in processes)
         {
             try
             {
                 // Need to call this once, before calling GetCurrentCpuUsage
                 ProcessPerformanceCounter perf = new ProcessPerformanceCounter(
                     common, processName, p.Id);
                 if (perf != null)
                     perf = null;
                 ProcessInfo processInfo = new ProcessInfo();
                 processInfo.process = p;
                 processInfo.monitor = monitor;
                 processInfo.cpuUsage = cpuUsage;
                 if (processes.Length > 1)
                 {
                     // Increased the performance of output
                     // else for running 10+ instance of an app
                     // takes lot of time
                     Thread thread = new Thread(new ParameterizedThreadStart(
                         GetCurrentCpuUsage));
                     thread.Start(processInfo);
                     threadPool.Add(thread);
                 }
                 else
                     GetCurrentCpuUsage(processInfo);
             }
             catch (Exception ex)
             {
                 common.LogMessage(ex);
             }
         }
         foreach (Thread thread in threadPool)
         {
             // Wait for each thread to complete its job
             thread.Join();
         }
         if (common.Debug)
         {
             foreach (double value in cpuUsage)
                 common.LogMessage(value);
         }
         return cpuUsage.ToArray(typeof(double)) as double[];
     }
     catch (Exception ex)
     {
         common.LogMessage(ex);
         return cpuUsage.ToArray(typeof(double)) as double[];
     }
     finally
     {
         cpuUsage = null;
         threadPool = null;
     }
 }

            public bool Equals(ProcessInfo p)
            {
                // If parameter is null return false:
                if ((object)p == null)
                {
                    return false;
                }

                // Return true if the fields match:
                return p.Process.Id==this.Process.Id;
            }