CODEWITHSUNDEEP
c++windowswinapiprocessnative
Ohad Horesh
Ohad Horesh

Reputation: 4390

Is there a way to get an event from windows on every new process that is started?

I want to get a notification each time a new process is started by the operating system.
Note that I need to that in native code (I know it can be done in managed code using System.Management members).
Extra points if there is a way to get it before the process starts running :) (i.e in during its initialization)

Thanks.

Upvotes: 5

Views: 2900

Answers (2)

Ana Betts
Ana Betts

Reputation: 74654

A real-time ETW trace will give you this information with low system overhead. Note that this will not let you hook process creation (i.e. it will only be a notification, you cannot control whether or not the process actually gets started)

Upvotes: 0

Ismael
Ismael

Reputation: 3013

The problem with using a driver is that you will require permission to install it, but otherwise I think is the safest method.

In user space you can try to create a window hook which will work if such application uses a windows, but is otherwise quite obnoxious.

On the other hand you can try to use WMI, which is the underlying technology used in C#. You can look for pointers in this anwers and this examples.

Upvotes: 3

Related Questions