16,472
社区成员
发帖
与我相关
我的任务
分享一个进程被创建或销毁的时候，如何得到进程被创建或销毁这一消息及相关信息？
比如说A进程被其他程序创建，自己的进程B想要从系统得知这一消息，就好像windows的任务管理器，任何一个进程的创建和销毁都可以显示出来，用C++如何实现？
希望能有详细的解释。
希望能有详细的解释。
...全文
请发表友善的回复…
发表回复
美丽海洋 2007-01-24
- 打赏
- 举报
会有各个销毁的消息比如：WM_DISTOREY WM_CLOSE WM_QueryEndSession等等
你可以拦截以下
你可以拦截以下
rayyear 2007-01-24
- 打赏
- 举报
顶，有没有例子程序，给个撒！！谢谢
DentistryDoctor 2006-10-13
- 打赏
- 举报
1.可以Hook CreateProcess
2.可以用Toolhelp定时的枚举进程列表。
2.可以用Toolhelp定时的枚举进程列表。
Kudeet 2006-10-13
- 打赏
- 举报
PsSetCreateProcessNotifyRoutine可以设置一个回调函数，在Create Process的时候会得到通知，类似的线程函数也有
Kudeet 2006-10-13
- 打赏
- 举报
PsSetCreateProcessNotifyRoutine
PsSetCreateProcessNotifyRoutine adds a driver-supplied callback routine to, or removes it from, a list of routines to be called whenever a process is created or deleted.
NTSTATUS
PsSetCreateProcessNotifyRoutine(
IN PCREATE_PROCESS_NOTIFY_ROUTINE NotifyRoutine,
IN BOOLEAN Remove
);
Parameters
NotifyRoutine
Specifies the entry point of a caller-supplied process-creation callback routine.
Remove
Indicates whether the routine specified by NotifyRoutine should be added to or removed from the system's list of notification routines. If FALSE, the specified routine is added to the list. If TRUE, the specified routine is removed from the list.
Include
ntddk.h
PsSetCreateProcessNotifyRoutine adds a driver-supplied callback routine to, or removes it from, a list of routines to be called whenever a process is created or deleted.
NTSTATUS
PsSetCreateProcessNotifyRoutine(
IN PCREATE_PROCESS_NOTIFY_ROUTINE NotifyRoutine,
IN BOOLEAN Remove
);
Parameters
NotifyRoutine
Specifies the entry point of a caller-supplied process-creation callback routine.
Remove
Indicates whether the routine specified by NotifyRoutine should be added to or removed from the system's list of notification routines. If FALSE, the specified routine is added to the list. If TRUE, the specified routine is removed from the list.
Include
ntddk.h
zctom23 2006-10-13
- 打赏
- 举报
关注下！~学习下！~
lixiaosan 2006-10-13
- 打赏
- 举报
http://blog.csdn.net/lixiaosan/articles/656939.aspx
