問題描述
我知道要接收有關 Win32 進程創建或終止的通知，我們可能會使用 API PsSetCreateProcessNotifyRoutine() 實現 NT 內核模式驅動程序，該 API 提供注冊系統范圍回調函數的能力，該函數是每次新進程啟動、退出或終止時由操作系統調用.
I know that to receive notifications about Win32 process creation or termination we might implement a NT kernel-mode driver using the APIs PsSetCreateProcessNotifyRoutine() that offers the ability to register system-wide callback function which is called by OS each time when a new process starts, exits or is terminated.
這是否可以不創建 NT 內核模式驅動程序，僅使用使用 c++ 的 Win32 API 函數?當然不是使用無限循環查詢活動進程列表的基本解決方案.
Is this possible without creating a NT kernel-mode driver, only using Win32 API functions using c++? Not using the basic solution of a infinite cycle querying the list of active process of course.
是否有任何庫或 win32 API 提供相同的功能(系統范圍的回調、異步事件)?
Is there any library or win32 API that provides the same functionality (system wide callback, asynchronous events)?
推薦答案
我唯一能想到的就是 WMI，不確定它是否提供進程創建回調，但可能值得研究.
The only thing I could think of is WMI, not sure if it provides a process creation callback, but it might be worth looking into.
這篇關于如何在 C++ 中檢測 win32 進程的創建/終止的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網！