巨大的疑问--------------怎么判断一个软件刚启动啊 ？

[lucbesson]

怎么判断一个软件刚启动啊 ？

例如 启动了qq 就知道它被启动了，然后记录键盘字符啊。

怎么才能做到 ？

谢谢哥哥们 谢谢csdn。。。。。。。。。

[北京的雾霾天]

你可以用一个Timer来定时查看,这样简单些:
[System.Runtime.InteropServices.DllImport("user32.dll")]
private static extern IntPtr FindWindow(string strclassName, string strWindowName);

private void timer1_Tick(object sender, System.EventArgs e)
{
string FormTitle = "无标题 - 记事本";
IntPtr hWnd = FindWindow(null, FormTitle);
if (hWnd != IntPtr.Zero)
{
Console.WriteLine("程序已启动!");
}
}

[jlhx_NET]

学习！

[lucbesson]

大家只回答了第一个 问题。

那第二个问题呢 ？

[Uncommon]

感觉应该察看注册表或者系统进程吧

[北京的雾霾天]

那第二个问题呢 ？
-------------------------
那就用Hook了,参考如下的函数:
//装置钩子的函数
[DllImport("user32.dll",CharSet=CharSet.Auto, CallingConvention=CallingConvention.StdCall)]
public static extern int SetWindowsHookEx(int idHook, HookProc lpfn, IntPtr hInstance, int threadId);

//卸下钩子的函数(已用C#语法修改过,可以直接用)
[DllImport("user32.dll",CharSet=CharSet.Auto, CallingConvention=CallingConvention.StdCall)]
public static extern bool UnhookWindowsHookEx(int idHook);

[DllImport("user32.dll",CharSet=CharSet.Auto, CallingConvention=CallingConvention.StdCall)]
public static extern int CallNextHookEx(int idHook, int nCode, Int32 wParam, IntPtr lParam);

[DllImport("user32")]
public static extern int GetKeyboardState(byte[] pbKeyState);

public delegate int HookProc(int nCode, Int32 wParam, IntPtr lParam);

[BasaraTracy]

学习

[Stitanleen]

楼主是在做盗qq号的dd？

[cellblue]

你可以使用钩子记录键盘消息

使用WMI，你可以监测某一个软件是否正在启动运行

WMI你可以从以下链接寻找察看

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/computer_system_hardware_classes.asp

[mobydick]

做一个程序，后台监控线程。

[hebookboy]

要得到键盘信息用钩子，第一个问题学习中，不过感觉hbxtlhx(下着春雨的天) 的方法好简单，可以试试

[lucbesson]

//获取与指定窗口关联在一起的一个进程和线程标识符
[DllImport("user32.dll", EntryPoint="GetWindowThreadProcessId")]
public static extern int GetWindowThreadProcessId (
int hwnd,
ref int lpdwProcessId
);

//安装钩子

SetWindowsHookEx(HookType.WH_KEYBOARD,myKeyboardProc,0,GetWindowThreadProcessId())

问题是最后的GetWindowThreadProcessId() 怎么写参数 ？
拜托拉 各位高手哥哥

[北京的雾霾天]

好像用一个全局的钩子程序最合适了.

[cellblue]

如果采用定时查询某一个进程是否存在，则会导致系统慢很多，人家很快就可以发觉系统不正常运行，所以不大好

可以采用事件的形式，每有一个进程启动，就触发事件，然后进行调用钩子

WMI可以到网站仔细去看看，我只是以前见过，但是没有存下代码，工作量较大，所以就帮到此为止了

钩子的写法这里有一个，很详细的

http://dev.csdn.net/develop/article/41/41301.shtm

[kong19]

mark

[canoe_eyes]

钩子

[xiaoslong]

帮你顶

[seekg]

ding

[北京的雾霾天]

cellblue(cellblue) 的这个地址很好的:

http://dev.csdn.net/develop/article/41/41301.shtm

[北京的雾霾天]

using System;
using System.Runtime.InteropServices;
using System.Reflection;
using System.Threading;
using System.Windows.Forms;

namespace HookGlobal
{

/// <summary>
/// 这个类可以让你得到一个在运行中程序的所有鼠标事件
/// 并且引发一个带MouseEventArgs参数的.NET鼠标事件以便你很容易使用这些信息
/// </summary>
public class MouseHook
{
private const int WM_MOUSEMOVE = 0x200;
private const int WM_LBUTTONDOWN = 0x201;
private const int WM_RBUTTONDOWN = 0x204;
private const int WM_MBUTTONDOWN = 0x207;
private const int WM_LBUTTONUP = 0x202;
private const int WM_RBUTTONUP = 0x205;
private const int WM_MBUTTONUP = 0x208;
private const int WM_LBUTTONDBLCLK = 0x203;
private const int WM_RBUTTONDBLCLK = 0x206;
private const int WM_MBUTTONDBLCLK = 0x209;

//全局的事件
public event MouseEventHandler OnMouseActivity;

static int hMouseHook = 0; //鼠标钩子句柄

//鼠标常量
public const int WH_MOUSE_LL = 14; //mouse hook constant

HookProc MouseHookProcedure; //声明鼠标钩子事件类型.

//声明一个Point的封送类型
[StructLayout(LayoutKind.Sequential)]
public class POINT
{
public int x;
public int y;
}

//声明鼠标钩子的封送结构类型
[StructLayout(LayoutKind.Sequential)]
public class MouseHookStruct
{
public POINT pt;
public int hWnd;
public int wHitTestCode;
public int dwExtraInfo;
}

//装置钩子的函数
[DllImport("user32.dll",CharSet=CharSet.Auto, CallingConvention=CallingConvention.StdCall)]
public static extern int SetWindowsHookEx(int idHook, HookProc lpfn, IntPtr hInstance, int threadId);

//卸下钩子的函数
[DllImport("user32.dll",CharSet=CharSet.Auto, CallingConvention=CallingConvention.StdCall)]
public static extern bool UnhookWindowsHookEx(int idHook);

//下一个钩挂的函数
[DllImport("user32.dll",CharSet=CharSet.Auto, CallingConvention=CallingConvention.StdCall)]
public static extern int CallNextHookEx(int idHook, int nCode, Int32 wParam, IntPtr lParam);

public delegate int HookProc(int nCode, Int32 wParam, IntPtr lParam);

/// <summary>
/// 墨认的构造函数构造当前类的实例.
/// </summary>
public MouseHook()
{
//Start();
}

//析构函数.
~MouseHook()
{
Stop();
}

public void Start()
{
//安装鼠标钩子
if(hMouseHook == 0)
{
//生成一个HookProc的实例.
MouseHookProcedure = new HookProc(MouseHookProc);

hMouseHook = SetWindowsHookEx( WH_MOUSE_LL, MouseHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0);

//如果装置失败停止钩子
if(hMouseHook == 0 )
{
Stop();
throw new Exception("SetWindowsHookEx failed.");
}
}
}

public void Stop()
{
bool retMouse =true;
if(hMouseHook != 0)
{
retMouse = UnhookWindowsHookEx(hMouseHook);
hMouseHook = 0;
}

//如果卸下钩子失败
if (!(retMouse)) throw new Exception("UnhookWindowsHookEx failed.");
}

private int MouseHookProc(int nCode, Int32 wParam, IntPtr lParam)
{
//如果正常运行并且用户要监听鼠标的消息
if ((nCode >= 0) && (OnMouseActivity!=null))
{
MouseButtons button=MouseButtons.None;
int clickCount=0;

switch (wParam)
{
case WM_LBUTTONDOWN:
button=MouseButtons.Left;
clickCount=1;
break;
case WM_LBUTTONUP:
button=MouseButtons.Left;
clickCount=1;
break;
case WM_LBUTTONDBLCLK:
button=MouseButtons.Left;
clickCount=2;
break;
case WM_RBUTTONDOWN:
button=MouseButtons.Right;
clickCount=1;
break;
case WM_RBUTTONUP:
button=MouseButtons.Right;
clickCount=1;
break;
case WM_RBUTTONDBLCLK:
button=MouseButtons.Right;
clickCount=2;
break;
}

//从回调函数中得到鼠标的信息
MouseHookStruct MyMouseHookStruct = (MouseHookStruct) Marshal.PtrToStructure(lParam, typeof(MouseHookStruct));
MouseEventArgs e=new MouseEventArgs(button, clickCount, MyMouseHookStruct.pt.x, MyMouseHookStruct.pt.y, 0 );
OnMouseActivity(this, e);
}
return CallNextHookEx(hMouseHook, nCode, wParam, lParam);
}
}
}

[北京的雾霾天]

如上就是一个鼠标钩子的代码示例.