如何在 C++ 中检测 win32 进程的创建/终止
我知道要接收有关 Win32 进程创建或终止的通知，我们可能会使用 API PsSetCreateProcessNotifyRoutine() 实现 NT 内核模式驱动程序，该 API 提供注册系统范围回调函数的能力，该函数是每次新进程启动、退出或终止时由操作系统调用.
I know that to receive notifications about Win32 process creation or termination we might implement a NT kernel-mode driver using the APIs PsSetCreateProcessNotifyRoutine() that offers the ability to register system-wide callback function which is called by OS each time when a new process starts, exits or is terminated.
这是否可以不创建 NT 内核模式驱动程序，仅使用使用 c++ 的 Win32 API 函数?当然不是使用无限循环查询活动进程列表的基本解决方案.
Is this possible without creating a NT kernel-mode driver, only using Win32 API functions using c++? Not using the basic solution of a infinite cycle querying the list of active process of course.
是否有任何库或 win32 API 提供相同的功能(系统范围的回调、异步事件)?
Is there any library or win32 API that provides the same functionality (system wide callback, asynchronous events)?
推荐答案
我唯一能想到的就是 WMI，不确定它是否提供进程创建回调，但可能值得研究.
The only thing I could think of is WMI, not sure if it provides a process creation callback, but it might be worth looking into.
相关文章