GetParentProcessId获取父进程ID

//获取父进程ID
DWORD GetParentProcessId(DWORD ProcessId)
{
NTSTATUS                   status;
DWORD                     dwParentPID = 0;
HANDLE                    hProcess = NULL;
PROCESS_BASIC_INFORMATION pbi;

typedef LONG(WINAPI *PNTQUERYINFORMATIONPROCESS)(HANDLE, UINT, PVOID, ULONG, PULONG);
static PNTQUERYINFORMATIONPROCESS  NtQueryInformationProcess = (PNTQUERYINFORMATIONPROCESS)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtQueryInformationProcess");

do
{
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, ProcessId);
if (!hProcess)break;

status = NtQueryInformationProcess(hProcess, SystemBasicInformation, (PVOID)&pbi, sizeof(PROCESS_BASIC_INFORMATION), NULL);
if (NT_SUCCESS(status))
dwParentPID = (ULONG_PTR)pbi.Reserved3;

} while (FALSE);

SafeCloseHandle(hProcess);
return dwParentPID;
}